@euconform/core 1.0.1 → 1.3.0

package/dist/legal-checks/index.js

@@ -4,3 +4,6 @@ export { runDataGovernanceChecklist } from "./data-governance";
 export { defaultTextPerturbations, runTextPerturbationRobustnessTest, } from "./robustness-transparency";
 export { getHumanOversightAndLoggingTemplate } from "./human-oversight-logging";
 export { buildAnnexIVReportV1 } from "./annex-iv-report";
+export { EU_AI_ACT_TIMELINE, DIGITAL_OMNIBUS_PROPOSALS, getDeadlineStatus, getDaysUntilDeadline, getAudiencesForRiskLevel, getNextDeadline, getTimelineForRiskLevel, getTimelineForAudiences, } from "./deadline-timeline";
+export { GPAI_QUESTIONS, classifyGPAICompliance, getGPAIQuestions, isSystemicRiskModel, } from "./gpai-classifier";
+export { generateAnnexIIIGapAnalysis, generateGPAIGapAnalysis } from "./gap-analysis";

package/dist/scanner/aggregator.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Scanner aggregator — orchestrates file discovery and signal detection,
+ * deduplicates signals, and assembles the ScanResult.
+ */
+import type { ScanOptions, ScanResult } from "../evidence/types";
+export declare function scanRepository(options: ScanOptions): Promise<ScanResult>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/scanner/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../src/scanner/aggregator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAQV,WAAW,EACX,UAAU,EAEX,MAAM,mBAAmB,CAAC;AA6M3B,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAkC9E"}

package/dist/scanner/aggregator.js

@@ -0,0 +1,200 @@
+/**
+ * Scanner aggregator — orchestrates file discovery and signal detection,
+ * deduplicates signals, and assembles the ScanResult.
+ */
+import { basename } from "node:path";
+import { hasImplementationSignals } from "../evidence/compliance-evaluation";
+import { runAllDetectors } from "./detectors";
+import { CONFIDENCE_RANK } from "./detectors/shared";
+import { discoverFiles } from "./discovery";
+const TOOL_VERSION = "0.1.0";
+function parseRootPackageJson(files) {
+    const pkgFile = files.find((f) => f.relativePath === "package.json");
+    if (!pkgFile)
+        return undefined;
+    try {
+        return JSON.parse(pkgFile.content);
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildRepoProfile(targetPath, pkg, files) {
+    const hasTs = files.some((f) => f.extension === ".ts" || f.extension === ".tsx");
+    const hasJs = files.some((f) => f.extension === ".js" || f.extension === ".jsx");
+    const languages = [];
+    if (hasTs)
+        languages.push("typescript");
+    if (hasJs)
+        languages.push("javascript");
+    let packageManager;
+    if (files.some((f) => f.relativePath === "pnpm-lock.yaml"))
+        packageManager = "pnpm";
+    else if (files.some((f) => f.relativePath === "yarn.lock"))
+        packageManager = "yarn";
+    else if (files.some((f) => f.relativePath === "package-lock.json"))
+        packageManager = "npm";
+    const isMonorepo = Boolean(pkg?.workspaces || files.some((f) => f.relativePath === "pnpm-workspace.yaml"));
+    return {
+        name: pkg?.name ?? basename(targetPath),
+        version: pkg?.version,
+        description: pkg?.description,
+        license: pkg?.license,
+        isMonorepo,
+        packageManager,
+        languages,
+    };
+}
+function inferAppTypes(signals) {
+    const types = new Set();
+    const has = (id) => signals.some((s) => s.id === id);
+    const hasCategory = (cat) => signals.some((s) => s.category === cat);
+    if (has("framework-nextjs") || has("framework-react"))
+        types.add("web-app");
+    if (has("framework-express") ||
+        has("framework-fastify") ||
+        has("framework-nestjs") ||
+        has("framework-hono") ||
+        has("framework-elysia"))
+        types.add("api-server");
+    if (hasCategory("local-inference") || hasCategory("ai-provider"))
+        if (signals.some((s) => s.name.toLowerCase().includes("chat")))
+            types.add("chatbot");
+    if (hasCategory("training"))
+        types.add("ml-pipeline");
+    if (types.size === 0)
+        types.add("unknown");
+    return [...types];
+}
+/** Merge signals with the same ID: keep highest confidence, combine evidence */
+function deduplicateSignals(signals) {
+    const map = new Map();
+    for (const signal of signals) {
+        const existing = map.get(signal.id);
+        if (!existing) {
+            map.set(signal.id, { ...signal, evidence: [...signal.evidence] });
+            continue;
+        }
+        // Merge evidence (use Set for O(1) dedup instead of O(n) .some())
+        const seen = new Set(existing.evidence.map((e) => `${e.file}:${e.line ?? ""}`));
+        for (const ev of signal.evidence) {
+            const key = `${ev.file}:${ev.line ?? ""}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                existing.evidence.push(ev);
+            }
+        }
+        // Upgrade confidence
+        if (CONFIDENCE_RANK[signal.confidence] > CONFIDENCE_RANK[existing.confidence]) {
+            existing.confidence = signal.confidence;
+        }
+    }
+    return [...map.values()];
+}
+function annotateEvidenceProvenance(signals, files) {
+    const provenanceByPath = new Map();
+    for (const file of files) {
+        provenanceByPath.set(file.relativePath, file.provenance);
+    }
+    return signals.map((signal) => ({
+        ...signal,
+        evidence: signal.evidence.map((evidence) => ({
+            ...evidence,
+            provenance: evidence.provenance ?? provenanceByPath.get(evidence.file) ?? "runtime",
+        })),
+    }));
+}
+function generateOpenQuestions(signals) {
+    const questions = [];
+    const hasAI = signals.some((s) => s.category === "ai-provider" ||
+        s.category === "ai-framework" ||
+        s.category === "local-inference");
+    if (hasAI) {
+        questions.push({
+            id: "oq-market-placement",
+            question: "Is this AI system placed on the EU market or used within the EU?",
+            context: "The EU AI Act applies to AI systems placed on or put into service in the EU market.",
+            relatedSignalIds: signals.filter((s) => s.category.startsWith("ai-")).map((s) => s.id),
+            suggestedAction: "Determine your system's geographic scope and market placement.",
+        });
+        questions.push({
+            id: "oq-intended-purpose",
+            question: "What is the intended purpose of this AI system?",
+            context: "Risk classification under the EU AI Act depends on the system's intended purpose and deployment context, which cannot be determined from code alone.",
+            relatedSignalIds: [],
+            suggestedAction: "Use the EuConform wizard to complete your risk assessment with human-provided context.",
+        });
+        questions.push({
+            id: "oq-provider-role",
+            question: "Are you a provider, deployer, or importer of this AI system?",
+            context: "Different roles under Art. 3 carry different obligations. A scanner cannot determine your organizational role.",
+            relatedSignalIds: [],
+            suggestedAction: "Clarify your role in the AI value chain to determine applicable obligations.",
+        });
+    }
+    const hasGpaiSignals = signals.some((s) => s.category === "ai-provider" || s.id.includes("langchain") || s.id.includes("llamaindex"));
+    if (hasGpaiSignals) {
+        questions.push({
+            id: "oq-gpai-downstream",
+            question: "Are you using a general-purpose AI model? Do you provide downstream access to others?",
+            context: "GPAI obligations (Art. 53-55) apply to providers of general-purpose AI models. Using an API does not automatically make you a GPAI provider.",
+            relatedSignalIds: signals.filter((s) => s.category === "ai-provider").map((s) => s.id),
+            suggestedAction: "Determine whether you are a GPAI provider or deployer.",
+        });
+    }
+    const hasNoDisclosure = !hasImplementationSignals(signals, ["compliance-disclosure"]);
+    if (hasAI && hasNoDisclosure) {
+        questions.push({
+            id: "oq-disclosure-missing",
+            question: "Does your system inform users that they are interacting with AI?",
+            context: "No AI disclosure signals were found in the codebase. Art. 50 requires transparency for AI systems interacting with natural persons.",
+            relatedSignalIds: [],
+            suggestedAction: "Add explicit AI disclosure in user-facing entry points.",
+        });
+    }
+    return questions;
+}
+function buildSignalSummary(signals) {
+    const byCategory = {};
+    const byConfidence = {
+        high: 0,
+        medium: 0,
+        low: 0,
+    };
+    for (const s of signals) {
+        byCategory[s.category] = (byCategory[s.category] ?? 0) + 1;
+        byConfidence[s.confidence]++;
+    }
+    return { total: signals.length, byCategory, byConfidence };
+}
+export async function scanRepository(options) {
+    const startTime = Date.now();
+    const scope = options.scope ?? "production";
+    const discovery = await discoverFiles(options);
+    const allFiles = discovery.files;
+    const rootPkg = parseRootPackageJson(allFiles);
+    // Run detectors on all files
+    const rawSignals = [];
+    for (const file of allFiles) {
+        const ctx = { file, lines: file.content.split("\n"), allFiles, rootPackageJson: rootPkg };
+        rawSignals.push(...runAllDetectors(ctx));
+    }
+    const signals = annotateEvidenceProvenance(deduplicateSignals(rawSignals), allFiles);
+    const openQuestions = generateOpenQuestions(signals);
+    return {
+        meta: {
+            scannedAt: new Date().toISOString(),
+            scanDurationMs: Date.now() - startTime,
+            toolVersion: TOOL_VERSION,
+            targetPath: options.targetPath,
+            scanScope: scope,
+            filesScanned: allFiles.length,
+            filesSkipped: discovery.skippedCount,
+        },
+        repo: buildRepoProfile(options.targetPath, rootPkg, allFiles),
+        appTypes: inferAppTypes(signals),
+        signals,
+        openQuestions,
+        signalSummary: buildSignalSummary(signals),
+    };
+}

package/dist/scanner/detectors/ai-framework-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectAiFrameworkSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=ai-framework-detector.d.ts.map

package/dist/scanner/detectors/ai-framework-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-framework-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/ai-framework-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAwD5E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAqC/E"}

package/dist/scanner/detectors/ai-framework-detector.js

@@ -0,0 +1,74 @@
+import { SOURCE_EXTENSIONS } from "./shared";
+const FRAMEWORK_IMPORTS = [
+    {
+        id: "ai-framework-langchain",
+        name: "LangChain",
+        importPattern: /(?:from\s+['"]langchain[/'"]|require\s*\(\s*['"]langchain[/'"])/,
+    },
+    {
+        id: "ai-framework-langchain-core",
+        name: "LangChain Core",
+        importPattern: /(?:from\s+['"]@langchain\/[^'"]+['"]|require\s*\(\s*['"]@langchain\/[^'"]+['"])/,
+    },
+    {
+        id: "ai-framework-llamaindex",
+        name: "LlamaIndex",
+        importPattern: /(?:from\s+['"]llamaindex[/'"]|require\s*\(\s*['"]llamaindex[/'"])/,
+    },
+    {
+        id: "ai-framework-transformers",
+        name: "Transformers.js",
+        importPattern: /(?:from\s+['"]@xenova\/transformers['"]|require\s*\(\s*['"]@xenova\/transformers['"])/,
+    },
+    {
+        id: "ai-framework-vercel-ai",
+        name: "Vercel AI SDK",
+        // Only match Vercel AI SDK subpath imports (ai/react, ai/rsc) to avoid false positives
+        // on generic "ai" package name. Bare "ai" import matched only with package.json cross-check.
+        importPattern: /(?:from\s+['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"']|require\s*\(\s*['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"])/,
+    },
+    {
+        id: "ai-framework-huggingface",
+        name: "HuggingFace",
+        importPattern: /(?:from\s+['"]@huggingface\/[^'"]+['"]|require\s*\(\s*['"]@huggingface\/[^'"]+['"])/,
+    },
+];
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectAiFrameworkSignals(ctx) {
+    const { file } = ctx;
+    if (!SOURCE_EXTENSIONS.has(file.extension))
+        return [];
+    const lines = ctx.lines;
+    const signalMap = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        const lineNum = i + 1;
+        for (const framework of FRAMEWORK_IMPORTS) {
+            if (framework.importPattern.test(line)) {
+                const existing = signalMap.get(framework.id);
+                const evidence = {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                };
+                if (existing) {
+                    existing.evidence.push(evidence);
+                }
+                else {
+                    signalMap.set(framework.id, {
+                        id: framework.id,
+                        name: framework.name,
+                        category: "ai-framework",
+                        confidence: "medium",
+                        evidence: [evidence],
+                    });
+                }
+            }
+        }
+    }
+    return Array.from(signalMap.values());
+}

package/dist/scanner/detectors/ai-provider-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectAiProviderSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=ai-provider-detector.d.ts.map

package/dist/scanner/detectors/ai-provider-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/ai-provider-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAyE5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAoC9E"}

package/dist/scanner/detectors/ai-provider-detector.js

@@ -0,0 +1,100 @@
+import { SOURCE_EXTENSIONS } from "./shared";
+const PROVIDER_IMPORTS = [
+    {
+        id: "ai-provider-openai",
+        name: "OpenAI SDK",
+        importPattern: /(?:from\s+['"]openai['"]|require\s*\(\s*['"]openai['"])/,
+    },
+    {
+        id: "ai-provider-anthropic",
+        name: "Anthropic SDK",
+        importPattern: /(?:from\s+['"]@anthropic-ai\/sdk['"]|require\s*\(\s*['"]@anthropic-ai\/sdk['"])/,
+    },
+    {
+        id: "ai-provider-cohere",
+        name: "Cohere SDK",
+        importPattern: /(?:from\s+['"]cohere-ai['"]|require\s*\(\s*['"]cohere-ai['"])/,
+    },
+    {
+        id: "ai-provider-google-genai",
+        name: "Google Generative AI",
+        importPattern: /(?:from\s+['"]@google\/generative-ai['"]|require\s*\(\s*['"]@google\/generative-ai['"])/,
+    },
+    {
+        id: "ai-provider-mistral",
+        name: "Mistral AI SDK",
+        importPattern: /(?:from\s+['"]@mistralai\/mistralai['"]|require\s*\(\s*['"]@mistralai\/mistralai['"])/,
+    },
+];
+const API_ENDPOINTS = [
+    {
+        id: "ai-provider-openai-api",
+        name: "OpenAI API endpoint",
+        pattern: /api\.openai\.com/,
+    },
+    {
+        id: "ai-provider-anthropic-api",
+        name: "Anthropic API endpoint",
+        pattern: /api\.anthropic\.com/,
+    },
+    {
+        id: "ai-provider-cohere-api",
+        name: "Cohere API endpoint",
+        pattern: /api\.cohere\.ai/,
+    },
+];
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectAiProviderSignals(ctx) {
+    const { file } = ctx;
+    if (!SOURCE_EXTENSIONS.has(file.extension))
+        return [];
+    const lines = ctx.lines;
+    const signalMap = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        const lineNum = i + 1;
+        // Check import/require patterns
+        for (const provider of PROVIDER_IMPORTS) {
+            if (provider.importPattern.test(line)) {
+                addEvidence(signalMap, provider.id, provider.name, "medium", {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                });
+            }
+        }
+        // Check API endpoint URLs
+        for (const endpoint of API_ENDPOINTS) {
+            if (endpoint.pattern.test(line)) {
+                addEvidence(signalMap, endpoint.id, endpoint.name, "medium", {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                });
+            }
+        }
+    }
+    return Array.from(signalMap.values());
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function addEvidence(map, id, name, confidence, evidence) {
+    const existing = map.get(id);
+    if (existing) {
+        existing.evidence.push(evidence);
+    }
+    else {
+        map.set(id, {
+            id,
+            name,
+            category: "ai-provider",
+            confidence,
+            evidence: [evidence],
+        });
+    }
+}

package/dist/scanner/detectors/compliance-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectCompliance(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=compliance-detector.d.ts.map

package/dist/scanner/detectors/compliance-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/compliance-detector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAGhB,MAAM,sBAAsB,CAAC;AAqM9B,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CA2BvE"}

package/dist/scanner/detectors/compliance-detector.js

@@ -0,0 +1,201 @@
+import { IMPLEMENTATION_PROVENANCE, isUserFacingPath } from "../../evidence/compliance-evaluation";
+import { SOURCE_EXTENSIONS } from "./shared";
+const rules = [
+    // --- compliance-disclosure ---
+    {
+        id: "compliance-disclosure-ai-generated",
+        name: "AI disclosure text",
+        category: "compliance-disclosure",
+        pattern: /\b(?:generated\s+by\s+ai|ai[- ]generated|powered\s+by\s+ai)\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-disclosure-ai-notice",
+        name: "AI transparency notice",
+        category: "compliance-disclosure",
+        pattern: /\b(?:artificial\s+intelligence|machine\s+learning\s+model|transparency\s+notice)\b/i,
+        confidence: "medium",
+    },
+    // --- compliance-logging ---
+    {
+        id: "compliance-logging-structured",
+        name: "Structured logging library",
+        category: "compliance-logging",
+        pattern: /\bfrom\s+['"](?:winston|pino|bunyan)['"]|\brequire\(\s*['"](?:winston|pino|bunyan)['"]\)/,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-logging-audit",
+        name: "Audit trail pattern",
+        category: "compliance-logging",
+        pattern: /\b(?:audit[._-]?log|audit[._-]?trail|log[._-]?audit)\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-logging-middleware",
+        name: "Logging middleware",
+        category: "compliance-logging",
+        pattern: /\b(?:logging[Mm]iddleware|requestLogger|morgan)\b/,
+        confidence: "low",
+    },
+    // --- compliance-oversight ---
+    {
+        id: "compliance-oversight-review",
+        name: "Human review flow",
+        category: "compliance-oversight",
+        pattern: /\b(?:human[_-]?review|manual[_-]?review|approval[_-]?flow|review[_-]?gate)\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-oversight-approve-reject",
+        name: "Approval/rejection mechanism",
+        category: "compliance-oversight",
+        pattern: /\b(?:onApprove|onReject|handleApproval|approveAction|rejectAction)\b/,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-oversight-override",
+        name: "Override mechanism",
+        category: "compliance-oversight",
+        pattern: /\b(?:override[_-]?ai|human[_-]?override|manual[_-]?override)\b/i,
+        confidence: "medium",
+    },
+    // --- compliance-bias ---
+    {
+        id: "compliance-bias-fairness",
+        name: "Fairness/bias testing",
+        category: "compliance-bias",
+        pattern: /\b(?:fairness[_-]?test|bias[_-]?test|disparate[_-]?impact|demographic[_-]?parity)\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-bias-benchmark",
+        name: "Bias benchmark reference",
+        category: "compliance-bias",
+        pattern: /\bCrowS[_-]?Pairs\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-bias-euconform",
+        name: "EuConform bias utilities",
+        category: "compliance-bias",
+        pattern: /\bfrom\s+['"]@euconform\/core.*bias/,
+        confidence: "medium",
+    },
+    // --- compliance-data ---
+    {
+        id: "compliance-data-quality",
+        name: "Data quality checks",
+        category: "compliance-data",
+        pattern: /\b(?:data[_-]?quality|data[_-]?validation|dataset[_-]?doc|data[_-]?lineage)\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-data-pii",
+        name: "PII handling / anonymization",
+        category: "compliance-data",
+        pattern: /\b(?:pii[_-]?filter|anonymi[sz]e|pseudonymi[sz]e|redact[_-]?pii)\b/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-data-gdpr",
+        name: "GDPR reference",
+        category: "compliance-data",
+        pattern: /\bGDPR\b|data[_-]?protection[_-]?regulation/i,
+        confidence: "low",
+    },
+    // --- compliance-reporting ---
+    {
+        id: "compliance-reporting-json",
+        name: "JSON export capability",
+        category: "compliance-reporting",
+        pattern: /\b(?:exportJSON|downloadJSON|writeJSONFile|saveJSONReport|exportAuditJSON|exportAnnexJSON|generateAnnexJson)\b|(?:writeFile(?:Sync)?|saveAs|download)\s*\([^)]*(?:report|audit|annex|compliance)[^)]*\.json/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-reporting-pdf",
+        name: "PDF export capability",
+        category: "compliance-reporting",
+        pattern: /\b(?:jspdf|pdf[_-]?lib|pdfmake|generatePDF|exportPDF|downloadPDF|renderPDF|generateAnnexPdf)\b|puppeteer.*\.pdf/i,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-reporting-report",
+        name: "Report generation",
+        category: "compliance-reporting",
+        pattern: /\b(?:generateReport|buildReport|exportReport|downloadReport|createReport|annex[_-]?iv[_-]?report|compliance[_-]?report|audit[_-]?report)\b/i,
+        confidence: "medium",
+    },
+    // --- compliance-incident ---
+    {
+        id: "compliance-incident-sentry",
+        name: "Sentry error reporting",
+        category: "compliance-incident",
+        pattern: /\bfrom\s+['"]@sentry\/|\bSentry\.init\b|\brequire\(\s*['"]@sentry\//,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-incident-boundary",
+        name: "Error boundary",
+        category: "compliance-incident",
+        pattern: /\bErrorBoundary\b|componentDidCatch/,
+        confidence: "medium",
+    },
+    {
+        id: "compliance-incident-response",
+        name: "Incident response hook",
+        category: "compliance-incident",
+        pattern: /\b(?:incident[_-]?report|incident[_-]?response|useIncident|alerting[_-]?hook)\b/i,
+        confidence: "medium",
+    },
+];
+function canEvaluateRule(rule, file) {
+    if (!IMPLEMENTATION_PROVENANCE.has(file.provenance))
+        return false;
+    if (rule.category === "compliance-disclosure")
+        return isUserFacingPath(file.relativePath);
+    if (rule.requiresUserFacingPath)
+        return isUserFacingPath(file.relativePath);
+    return true;
+}
+function gatherEvidence(lines, pattern, filePath, maxItems) {
+    const evidence = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        if (pattern.test(line)) {
+            evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+            if (evidence.length >= maxItems)
+                break;
+        }
+    }
+    return evidence;
+}
+export function detectCompliance(ctx) {
+    const { file } = ctx;
+    if (!SOURCE_EXTENSIONS.has(file.extension))
+        return [];
+    const signalMap = new Map();
+    for (const rule of rules) {
+        if (!canEvaluateRule(rule, file))
+            continue;
+        const evidence = gatherEvidence(ctx.lines, rule.pattern, file.relativePath, 3);
+        if (evidence.length === 0)
+            continue;
+        const existing = signalMap.get(rule.id);
+        if (existing) {
+            existing.evidence.push(...evidence);
+        }
+        else {
+            signalMap.set(rule.id, {
+                id: rule.id,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.confidence,
+                evidence,
+            });
+        }
+    }
+    return Array.from(signalMap.values());
+}

package/dist/scanner/detectors/config-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectConfig(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=config-detector.d.ts.map

package/dist/scanner/detectors/config-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/config-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAGhB,MAAM,sBAAsB,CAAC;AAsM9B,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAenE"}