@euconform/core 1.0.1 → 1.3.0

package/dist/scanner/detectors/config-detector.js

@@ -0,0 +1,248 @@
+const envKeyRules = [
+    {
+        id: "ai-provider-openai",
+        name: "OpenAI API key",
+        category: "ai-provider",
+        pattern: /^OPENAI_API_KEY\b/,
+        confidence: "high",
+    },
+    {
+        id: "ai-provider-anthropic",
+        name: "Anthropic API key",
+        category: "ai-provider",
+        pattern: /^ANTHROPIC_API_KEY\b/,
+        confidence: "high",
+    },
+    {
+        id: "ai-provider-azure-openai",
+        name: "Azure OpenAI key",
+        category: "ai-provider",
+        pattern: /^AZURE_OPENAI_/,
+        confidence: "high",
+    },
+    {
+        id: "ai-provider-google-ai",
+        name: "Google AI key",
+        category: "ai-provider",
+        pattern: /^(?:GOOGLE_AI_API_KEY|GEMINI_API_KEY)\b/,
+        confidence: "high",
+    },
+    {
+        id: "ai-provider-cohere",
+        name: "Cohere API key",
+        category: "ai-provider",
+        pattern: /^COHERE_API_KEY\b/,
+        confidence: "high",
+    },
+    {
+        id: "ai-provider-replicate",
+        name: "Replicate API token",
+        category: "ai-provider",
+        pattern: /^REPLICATE_API_TOKEN\b/,
+        confidence: "high",
+    },
+    {
+        id: "ai-provider-huggingface",
+        name: "HuggingFace token",
+        category: "ai-provider",
+        pattern: /^HUGGINGFACE_TOKEN\b|^HF_TOKEN\b/,
+        confidence: "high",
+    },
+    {
+        id: "local-inference-ollama",
+        name: "Ollama host config",
+        category: "local-inference",
+        pattern: /^OLLAMA_HOST\b|^OLLAMA_BASE_URL\b/,
+        confidence: "high",
+    },
+    {
+        id: "rag-pinecone",
+        name: "Pinecone API key",
+        category: "rag",
+        pattern: /^PINECONE_API_KEY\b/,
+        confidence: "high",
+    },
+    {
+        id: "rag-weaviate",
+        name: "Weaviate config",
+        category: "rag",
+        pattern: /^WEAVIATE_/,
+        confidence: "high",
+    },
+    {
+        id: "rag-chroma",
+        name: "ChromaDB config",
+        category: "rag",
+        pattern: /^CHROMA_/,
+        confidence: "high",
+    },
+];
+const dockerServiceRules = [
+    {
+        id: "local-inference-ollama-docker",
+        name: "Ollama Docker service",
+        category: "local-inference",
+        pattern: /\bollama\/ollama\b|image:\s*ollama/,
+        confidence: "high",
+    },
+    {
+        id: "rag-chromadb-docker",
+        name: "ChromaDB Docker service",
+        category: "rag",
+        pattern: /\bchromadb\/chroma\b|image:\s*chroma/,
+        confidence: "high",
+    },
+    {
+        id: "rag-weaviate-docker",
+        name: "Weaviate Docker service",
+        category: "rag",
+        pattern: /\bsemitechnologies\/weaviate\b|image:\s*weaviate/,
+        confidence: "high",
+    },
+    {
+        id: "rag-redis-vector",
+        name: "Redis with vector module",
+        category: "rag",
+        pattern: /redis\/redis-stack|redisearch|redis-stack-server/,
+        confidence: "high",
+    },
+    {
+        id: "rag-qdrant-docker",
+        name: "Qdrant Docker service",
+        category: "rag",
+        pattern: /\bqdrant\/qdrant\b|image:\s*qdrant/,
+        confidence: "high",
+    },
+];
+const dockerfileRules = [
+    {
+        id: "local-inference-pip-ai",
+        name: "AI pip packages in Dockerfile",
+        category: "local-inference",
+        pattern: /pip\s+install\s+.*\b(?:torch|tensorflow|transformers|langchain|llama[-_]?cpp|vllm|onnxruntime)\b/,
+        confidence: "high",
+    },
+    {
+        id: "local-inference-model-download",
+        name: "Model download in Dockerfile",
+        category: "local-inference",
+        pattern: /\b(?:huggingface-cli\s+download|wget\s+.*(?:\.gguf|\.safetensors|\.bin)|COPY\s+.*(?:model|weights))\b/i,
+        confidence: "high",
+    },
+];
+// ---------------------------------------------------------------------------
+// File matching helpers
+// ---------------------------------------------------------------------------
+function isEnvExample(relativePath) {
+    const basename = relativePath.split("/").pop() ?? "";
+    return /^\.env\.(?:example|sample)$/.test(basename);
+}
+function isDockerCompose(relativePath) {
+    const basename = relativePath.split("/").pop() ?? "";
+    return /^docker-compose/.test(basename);
+}
+function isDockerfile(relativePath) {
+    const basename = relativePath.split("/").pop() ?? "";
+    return /^Dockerfile/.test(basename);
+}
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectConfig(ctx) {
+    const { file } = ctx;
+    const signals = [];
+    const lines = ctx.lines;
+    if (isEnvExample(file.relativePath)) {
+        detectEnvKeys(file.relativePath, lines, signals);
+    }
+    else if (isDockerCompose(file.relativePath)) {
+        detectDockerServices(file.relativePath, lines, signals);
+    }
+    else if (isDockerfile(file.relativePath)) {
+        detectDockerfilePatterns(file.relativePath, lines, signals);
+    }
+    return signals;
+}
+function extractEnvVarName(rawLine) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+        return null;
+    const eqIndex = line.indexOf("=");
+    return eqIndex >= 0 ? line.slice(0, eqIndex).trim() : line.trim();
+}
+function detectEnvKeys(relativePath, lines, signals) {
+    for (const rule of envKeyRules) {
+        const evidence = [];
+        for (let i = 0; i < lines.length; i++) {
+            const varName = extractEnvVarName(lines[i] ?? "");
+            if (varName && rule.pattern.test(varName)) {
+                evidence.push({ file: relativePath, line: i + 1, snippet: varName });
+            }
+        }
+        if (evidence.length > 0) {
+            signals.push({
+                id: rule.id,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.confidence,
+                evidence,
+            });
+        }
+    }
+}
+function detectDockerServices(relativePath, lines, signals) {
+    for (const rule of dockerServiceRules) {
+        const evidence = [];
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (!line)
+                continue;
+            if (rule.pattern.test(line)) {
+                evidence.push({
+                    file: relativePath,
+                    line: i + 1,
+                    snippet: line.trim().slice(0, 120),
+                });
+                if (evidence.length >= 3)
+                    break;
+            }
+        }
+        if (evidence.length > 0) {
+            signals.push({
+                id: rule.id,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.confidence,
+                evidence,
+            });
+        }
+    }
+}
+function detectDockerfilePatterns(relativePath, lines, signals) {
+    for (const rule of dockerfileRules) {
+        const evidence = [];
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (!line)
+                continue;
+            if (rule.pattern.test(line)) {
+                evidence.push({
+                    file: relativePath,
+                    line: i + 1,
+                    snippet: line.trim().slice(0, 120),
+                });
+                if (evidence.length >= 3)
+                    break;
+            }
+        }
+        if (evidence.length > 0) {
+            signals.push({
+                id: rule.id,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.confidence,
+                evidence,
+            });
+        }
+    }
+}

package/dist/scanner/detectors/framework-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectFrameworks(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=framework-detector.d.ts.map

package/dist/scanner/detectors/framework-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/framework-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAEhB,MAAM,sBAAsB,CAAC;AAwH9B,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAqCvE"}

package/dist/scanner/detectors/framework-detector.js

@@ -0,0 +1,141 @@
+import { EXTENDED_EXTENSIONS } from "./shared";
+const rules = [
+    // Frameworks
+    {
+        name: "nextjs",
+        category: "framework",
+        configPattern: /^next\.config\./,
+        importPattern: /\bfrom\s+['"]next[\/'"]|\brequire\(\s*['"]next['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "react",
+        category: "framework",
+        importPattern: /\bfrom\s+['"]react['"]|\brequire\(\s*['"]react['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "express",
+        category: "framework",
+        importPattern: /\bfrom\s+['"]express['"]|\brequire\(\s*['"]express['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "fastify",
+        category: "framework",
+        importPattern: /\bfrom\s+['"]fastify['"]|\brequire\(\s*['"]fastify['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "nestjs",
+        category: "framework",
+        importPattern: /\bfrom\s+['"]@nestjs\/|\brequire\(\s*['"]@nestjs\//,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "hono",
+        category: "framework",
+        importPattern: /\bfrom\s+['"]hono['"]|\brequire\(\s*['"]hono['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "elysia",
+        category: "framework",
+        importPattern: /\bfrom\s+['"]elysia['"]|\brequire\(\s*['"]elysia['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "vite",
+        category: "framework",
+        configPattern: /^vite\.config\./,
+        importPattern: /\bfrom\s+['"]vite['"]|\brequire\(\s*['"]vite['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    // Runtimes
+    {
+        name: "nodejs",
+        category: "runtime",
+        importPattern: /\bfrom\s+['"]node:(?:fs|http|path|crypto|stream)['"]|\bfrom\s+['"](?:fs|http|net|dgram)['"]|\brequire\(\s*['"](?:fs|http|path|crypto)['"]\)/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "bun",
+        category: "runtime",
+        importPattern: /\bBun\.serve\b|\bBun\.file\b|\bBun\.write\b/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+    {
+        name: "deno",
+        category: "runtime",
+        importPattern: /\bDeno\.serve\b|\bDeno\.readFile\b|\bDeno\.env\b/,
+        configConfidence: "high",
+        importConfidence: "medium",
+    },
+];
+const CONFIG_NAME_PATTERN = /^(next|vite)\.config\./;
+function shouldProcess(file) {
+    if (EXTENDED_EXTENSIONS.has(file.extension))
+        return true;
+    const basename = file.relativePath.split("/").pop() ?? "";
+    return CONFIG_NAME_PATTERN.test(basename);
+}
+function findImportEvidence(lines, pattern, filePath) {
+    const evidence = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        if (pattern.test(line)) {
+            evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+            if (evidence.length >= 3)
+                break;
+        }
+    }
+    return evidence;
+}
+export function detectFrameworks(ctx) {
+    const { file } = ctx;
+    if (!shouldProcess(file))
+        return [];
+    const basename = file.relativePath.split("/").pop() ?? "";
+    const seen = new Set();
+    const signals = [];
+    for (const rule of rules) {
+        if (rule.configPattern?.test(basename) && !seen.has(rule.name)) {
+            seen.add(rule.name);
+            signals.push({
+                id: `${rule.category}-${rule.name}`,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.configConfidence,
+                evidence: [
+                    { file: file.relativePath, line: 1, snippet: `Config file detected: ${basename}` },
+                ],
+            });
+        }
+        if (!rule.importPattern)
+            continue;
+        const evidence = findImportEvidence(ctx.lines, rule.importPattern, file.relativePath);
+        if (evidence.length > 0 && !seen.has(rule.name)) {
+            seen.add(rule.name);
+            signals.push({
+                id: `${rule.category}-${rule.name}`,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.importConfidence,
+                evidence,
+            });
+        }
+    }
+    return signals;
+}

package/dist/scanner/detectors/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Signal detector registry.
+ *
+ * Runs all registered detectors against a file and returns combined signals.
+ */
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function runAllDetectors(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=index.d.ts.map

package/dist/scanner/detectors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AAuB5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAUtE"}

package/dist/scanner/detectors/index.js

@@ -0,0 +1,37 @@
+/**
+ * Signal detector registry.
+ *
+ * Runs all registered detectors against a file and returns combined signals.
+ */
+import { detectAiFrameworkSignals } from "./ai-framework-detector";
+import { detectAiProviderSignals } from "./ai-provider-detector";
+import { detectCompliance } from "./compliance-detector";
+import { detectConfig } from "./config-detector";
+import { detectFrameworks } from "./framework-detector";
+import { detectLocalInferenceSignals } from "./local-inference-detector";
+import { detectMarkdown } from "./markdown-detector";
+import { detectPackageJsonSignals } from "./package-json-detector";
+import { detectRagSignals } from "./rag-detector";
+const ALL_DETECTORS = [
+    detectPackageJsonSignals,
+    detectAiProviderSignals,
+    detectAiFrameworkSignals,
+    detectLocalInferenceSignals,
+    detectRagSignals,
+    detectFrameworks,
+    detectCompliance,
+    detectConfig,
+    detectMarkdown,
+];
+export function runAllDetectors(ctx) {
+    const signals = [];
+    for (const detector of ALL_DETECTORS) {
+        try {
+            signals.push(...detector(ctx));
+        }
+        catch {
+            // Individual detector failure should not break the scan
+        }
+    }
+    return signals;
+}

package/dist/scanner/detectors/local-inference-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectLocalInferenceSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=local-inference-detector.d.ts.map

package/dist/scanner/detectors/local-inference-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-inference-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/local-inference-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAEhB,MAAM,sBAAsB,CAAC;AAoG9B,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAkBlF"}

package/dist/scanner/detectors/local-inference-detector.js

@@ -0,0 +1,93 @@
+import { EXTENDED_EXTENSIONS } from "./shared";
+const RULES = [
+    // Ollama API URL
+    {
+        id: "local-inference-ollama-api",
+        name: "Ollama API (localhost:11434)",
+        pattern: /localhost:11434/,
+        confidence: "high",
+    },
+    // Ollama imports
+    {
+        id: "local-inference-ollama-import",
+        name: "Ollama SDK import",
+        pattern: /(?:from\s+['"](?:ollama|@ollama\/ollama)['"]|require\s*\(\s*['"](?:ollama|@ollama\/ollama)['"])/,
+        confidence: "medium",
+        extensions: [".ts", ".tsx", ".js", ".jsx"],
+    },
+    // Transformers.js browser usage (pipeline / env)
+    {
+        id: "local-inference-transformers-browser",
+        name: "Transformers.js (browser inference)",
+        pattern: /(?:from\s+['"]@xenova\/transformers['"]|\.pipeline\s*\(|env\.allowLocalModels)/,
+        confidence: "medium",
+        extensions: [".ts", ".tsx", ".js", ".jsx"],
+    },
+    // ONNX Runtime
+    {
+        id: "local-inference-onnx",
+        name: "ONNX Runtime",
+        pattern: /(?:from\s+['"]onnxruntime[^'"]*['"]|require\s*\(\s*['"]onnxruntime[^'"]*['"]|onnxruntime)/,
+        confidence: "medium",
+    },
+    // llama.cpp references
+    {
+        id: "local-inference-llamacpp",
+        name: "llama.cpp",
+        pattern: /llama\.cpp|llama-cpp|llamacpp/,
+        confidence: "medium",
+    },
+    // Docker Compose ollama service
+    {
+        id: "local-inference-ollama-docker",
+        name: "Ollama Docker service",
+        pattern: /ollama\/ollama|image:\s*ollama/,
+        confidence: "high",
+        extensions: [".yaml", ".yml", ".json"],
+    },
+];
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+function matchRuleToLine(rule, line, lineNum, filePath, signalMap) {
+    if (!rule.pattern.test(line))
+        return;
+    const evidence = {
+        file: filePath,
+        line: lineNum,
+        snippet: line.trim().slice(0, 200),
+    };
+    const existing = signalMap.get(rule.id);
+    if (existing) {
+        existing.evidence.push(evidence);
+        if (rule.confidence === "high")
+            existing.confidence = "high";
+    }
+    else {
+        signalMap.set(rule.id, {
+            id: rule.id,
+            name: rule.name,
+            category: "local-inference",
+            confidence: rule.confidence,
+            evidence: [evidence],
+        });
+    }
+}
+export function detectLocalInferenceSignals(ctx) {
+    const { file } = ctx;
+    if (!EXTENDED_EXTENSIONS.has(file.extension))
+        return [];
+    const lines = ctx.lines;
+    const signalMap = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        for (const rule of RULES) {
+            if (rule.extensions && !rule.extensions.includes(file.extension))
+                continue;
+            matchRuleToLine(rule, line, i + 1, file.relativePath, signalMap);
+        }
+    }
+    return Array.from(signalMap.values());
+}

package/dist/scanner/detectors/markdown-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectMarkdown(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=markdown-detector.d.ts.map

package/dist/scanner/detectors/markdown-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/markdown-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAGhB,MAAM,sBAAsB,CAAC;AA6I9B,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CA4BrE"}