@euconform/core 1.0.1 → 1.3.0

package/dist/scanner/detectors/markdown-detector.js

@@ -0,0 +1,139 @@
+const rules = [
+    // --- compliance-disclosure ---
+    {
+        id: "compliance-disclosure-readme",
+        name: "AI disclosure in README",
+        category: "compliance-disclosure",
+        pattern: /\b(?:artificial\s+intelligence|machine\s+learning|AI[- ]powered|AI[- ]generated|uses?\s+AI|deep\s+learning|neural\s+network|large\s+language\s+model|LLM)\b/i,
+        confidence: "low",
+    },
+    {
+        id: "compliance-disclosure-transparency",
+        name: "Transparency notice",
+        category: "compliance-disclosure",
+        pattern: /\b(?:transparency\s+notice|AI\s+disclosure|generated\s+by\s+AI)\b/i,
+        confidence: "medium",
+    },
+    // --- Model card ---
+    {
+        id: "compliance-disclosure-model-card",
+        name: "Model card documentation",
+        category: "compliance-disclosure",
+        pattern: /^#{1,3}\s+Model\s+Card\b/i,
+        confidence: "medium",
+        sectionHeading: true,
+    },
+    // --- compliance-data ---
+    {
+        id: "compliance-data-docs",
+        name: "Data governance documentation",
+        category: "compliance-data",
+        pattern: /^#{1,3}\s+(?:Data\s+(?:Sources?|Governance|Quality|Lineage)|Training\s+Data)\b/i,
+        confidence: "medium",
+        sectionHeading: true,
+    },
+    {
+        id: "compliance-data-reference",
+        name: "Data source references",
+        category: "compliance-data",
+        pattern: /\b(?:training\s+data|data\s+sources?|dataset\s+documentation)\b/i,
+        confidence: "low",
+    },
+    // --- Privacy / GDPR ---
+    {
+        id: "compliance-data-privacy",
+        name: "Privacy policy reference",
+        category: "compliance-data",
+        pattern: /\b(?:privacy\s+policy|GDPR|data\s+protection|DSGVO)\b/i,
+        confidence: "medium",
+    },
+    // --- License / AI-specific ---
+    {
+        id: "compliance-disclosure-license",
+        name: "AI-relevant license terms",
+        category: "compliance-disclosure",
+        pattern: /\b(?:model\s+license|AI\s+license|responsible\s+AI|acceptable\s+use\s+policy|RAIL\s+license)\b/i,
+        confidence: "medium",
+    },
+];
+// ---------------------------------------------------------------------------
+// File filtering
+// ---------------------------------------------------------------------------
+/** Files that should always be skipped unless they contain AI-specific content */
+const SKIP_BASENAMES = new Set([
+    "changelog.md",
+    "changes.md",
+    "history.md",
+    "contributing.md",
+    "code_of_conduct.md",
+]);
+/** Only process these docs-level paths */
+function isRelevantMarkdown(relativePath) {
+    const lower = relativePath.toLowerCase();
+    const basename = lower.split("/").pop() ?? "";
+    // Always process README files at any level
+    if (basename.startsWith("readme"))
+        return true;
+    // Process files inside docs/ directories
+    if (lower.includes("/docs/") || lower.startsWith("docs/")) {
+        return !SKIP_BASENAMES.has(basename);
+    }
+    // For other markdown files, skip known non-relevant ones
+    if (SKIP_BASENAMES.has(basename))
+        return false;
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+function gatherMarkdownEvidence(rule, lines, filePath) {
+    const evidence = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        if (rule.sectionHeading && !line.startsWith("#"))
+            continue;
+        if (rule.pattern.test(line)) {
+            evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+            if (evidence.length >= 5)
+                break;
+        }
+    }
+    return evidence;
+}
+function isSkippableGenericContent(basename, evidence) {
+    if (!SKIP_BASENAMES.has(basename))
+        return false;
+    return !evidence.some((e) => /\bAI\b|\bML\b|\bmodel\b|\binference\b/i.test(e.snippet));
+}
+export function detectMarkdown(ctx) {
+    const { file } = ctx;
+    if (file.extension !== ".md")
+        return [];
+    if (!isRelevantMarkdown(file.relativePath))
+        return [];
+    const signalMap = new Map();
+    const basename = file.relativePath.toLowerCase().split("/").pop() ?? "";
+    for (const rule of rules) {
+        const evidence = gatherMarkdownEvidence(rule, ctx.lines, file.relativePath);
+        if (evidence.length === 0)
+            continue;
+        if (isSkippableGenericContent(basename, evidence))
+            continue;
+        const existing = signalMap.get(rule.id);
+        if (existing) {
+            existing.evidence.push(...evidence);
+        }
+        else {
+            signalMap.set(rule.id, {
+                id: rule.id,
+                name: rule.name,
+                category: rule.category,
+                confidence: rule.confidence,
+                evidence,
+            });
+        }
+    }
+    return Array.from(signalMap.values());
+}

package/dist/scanner/detectors/package-json-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectPackageJsonSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=package-json-detector.d.ts.map

package/dist/scanner/detectors/package-json-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/package-json-detector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AA6E5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAY/E"}

package/dist/scanner/detectors/package-json-detector.js

@@ -0,0 +1,166 @@
+import { basename } from "node:path";
+import { escapeRegex } from "./shared";
+const AI_PACKAGES = {
+    // Providers
+    openai: { category: "ai-provider", label: "OpenAI SDK" },
+    "@anthropic-ai/sdk": { category: "ai-provider", label: "Anthropic SDK" },
+    "cohere-ai": { category: "ai-provider", label: "Cohere SDK" },
+    "@google/generative-ai": { category: "ai-provider", label: "Google Generative AI" },
+    "@mistralai/mistralai": { category: "ai-provider", label: "Mistral AI SDK" },
+    // Frameworks
+    langchain: { category: "ai-framework", label: "LangChain" },
+    "@langchain/core": { category: "ai-framework", label: "LangChain Core" },
+    llamaindex: { category: "ai-framework", label: "LlamaIndex" },
+    "@xenova/transformers": { category: "ai-framework", label: "Transformers.js" },
+    ai: { category: "ai-framework", label: "Vercel AI SDK" },
+    "@huggingface/inference": { category: "ai-framework", label: "HuggingFace Inference" },
+    // Local inference
+    ollama: { category: "local-inference", label: "Ollama" },
+    "@ollama/ollama": { category: "local-inference", label: "Ollama SDK" },
+    // RAG / Vector
+    chromadb: { category: "rag", label: "ChromaDB" },
+    "@pinecone-database/pinecone": { category: "rag", label: "Pinecone" },
+    "weaviate-client": { category: "rag", label: "Weaviate" },
+    "@qdrant/js-client-rest": { category: "rag", label: "Qdrant" },
+    pgvector: { category: "rag", label: "pgvector" },
+    // Bias / Eval
+    "@euconform/core": { category: "compliance-bias", label: "EuConform Core" },
+};
+const FRAMEWORK_PACKAGES = {
+    next: { category: "framework", label: "Next.js" },
+    react: { category: "framework", label: "React" },
+    express: { category: "framework", label: "Express" },
+    fastify: { category: "framework", label: "Fastify" },
+    "@nestjs/core": { category: "framework", label: "NestJS" },
+    hono: { category: "framework", label: "Hono" },
+    elysia: { category: "framework", label: "Elysia" },
+};
+const ALL_PACKAGES = {
+    ...AI_PACKAGES,
+    ...FRAMEWORK_PACKAGES,
+};
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+const PACKAGE_JSON_NAMES = new Set([
+    "package.json",
+    "pnpm-lock.yaml",
+    "package-lock.json",
+    "yarn.lock",
+]);
+function isPackageJsonFile(relativePath) {
+    return PACKAGE_JSON_NAMES.has(basename(relativePath));
+}
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectPackageJsonSignals(ctx) {
+    const { file } = ctx;
+    if (!isPackageJsonFile(file.relativePath))
+        return [];
+    const fileName = basename(file.relativePath);
+    if (fileName === "package.json") {
+        return detectFromPackageJson(file.relativePath, file.content);
+    }
+    // Lock files — scan for known package name strings
+    return detectFromLockFile(file.relativePath, file.content);
+}
+// ---------------------------------------------------------------------------
+// package.json detection
+// ---------------------------------------------------------------------------
+function detectFromPackageJson(filePath, content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    const signals = [];
+    const deps = {
+        ...parsed.dependencies,
+        ...parsed.devDependencies,
+    };
+    for (const [pkg, info] of Object.entries(ALL_PACKAGES)) {
+        if (pkg in deps) {
+            const version = deps[pkg] ?? "unknown";
+            signals.push({
+                id: `${info.category}-${pkg.replace(/[@/]/g, "").replace(/\s/g, "-")}`,
+                name: info.label,
+                category: info.category,
+                confidence: "high",
+                evidence: [
+                    {
+                        file: filePath,
+                        snippet: `"${pkg}": "${version}"`,
+                    },
+                ],
+            });
+        }
+    }
+    // Monorepo signals
+    if (parsed.workspaces) {
+        signals.push({
+            id: "runtime-monorepo-workspaces",
+            name: "Monorepo (workspaces)",
+            category: "runtime",
+            confidence: "high",
+            evidence: [
+                {
+                    file: filePath,
+                    snippet: `"workspaces": ${JSON.stringify(parsed.workspaces).slice(0, 120)}`,
+                },
+            ],
+        });
+    }
+    const devDeps = parsed.devDependencies;
+    if (devDeps && "turbo" in devDeps) {
+        signals.push({
+            id: "runtime-monorepo-turbo",
+            name: "Monorepo (Turborepo)",
+            category: "runtime",
+            confidence: "high",
+            evidence: [
+                {
+                    file: filePath,
+                    snippet: `"turbo": "${devDeps.turbo}"`,
+                },
+            ],
+        });
+    }
+    return signals;
+}
+// ---------------------------------------------------------------------------
+// Lock-file detection (string search, no full parse)
+// ---------------------------------------------------------------------------
+// Pre-compiled lock-file patterns — avoids RegExp construction on every call
+const LOCK_FILE_PATTERNS = new Map(Object.keys(AI_PACKAGES).map((pkg) => [pkg, new RegExp(`["'/]${escapeRegex(pkg)}["'/@:]`)]));
+function detectFromLockFile(filePath, content) {
+    const signals = [];
+    const seen = new Set();
+    for (const [pkg, info] of Object.entries(AI_PACKAGES)) {
+        if (seen.has(pkg))
+            continue;
+        // Use boundary-aware pattern to avoid false positives on short names
+        // Lock files quote package names or use them as path segments
+        const pattern = LOCK_FILE_PATTERNS.get(pkg);
+        if (!pattern)
+            continue;
+        if (pattern.test(content)) {
+            seen.add(pkg);
+            signals.push({
+                id: `${info.category}-${pkg.replace(/[@/]/g, "").replace(/\s/g, "-")}`,
+                name: info.label,
+                category: info.category,
+                confidence: "medium",
+                evidence: [
+                    {
+                        file: filePath,
+                        snippet: `Found "${pkg}" in lock file`,
+                    },
+                ],
+            });
+        }
+    }
+    return signals;
+}

package/dist/scanner/detectors/rag-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectRagSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=rag-detector.d.ts.map

package/dist/scanner/detectors/rag-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rag-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/rag-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAEhB,MAAM,sBAAsB,CAAC;AAsH9B,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAsCvE"}

package/dist/scanner/detectors/rag-detector.js

@@ -0,0 +1,132 @@
+import { SOURCE_EXTENSIONS, higherConfidence } from "./shared";
+// Explicit vector store imports (high confidence)
+const IMPORT_RULES = [
+    {
+        id: "rag-chromadb",
+        name: "ChromaDB",
+        pattern: /(?:from\s+['"]chromadb['"]|require\s*\(\s*['"]chromadb['"])/,
+        confidence: "high",
+    },
+    {
+        id: "rag-pinecone",
+        name: "Pinecone",
+        pattern: /(?:from\s+['"]@pinecone-database\/pinecone['"]|require\s*\(\s*['"]@pinecone-database\/pinecone['"])/,
+        confidence: "high",
+    },
+    {
+        id: "rag-weaviate",
+        name: "Weaviate",
+        pattern: /(?:from\s+['"]weaviate-client['"]|require\s*\(\s*['"]weaviate-client['"])/,
+        confidence: "high",
+    },
+    {
+        id: "rag-qdrant",
+        name: "Qdrant",
+        pattern: /(?:from\s+['"]@qdrant\/js-client-rest['"]|require\s*\(\s*['"]@qdrant\/js-client-rest['"])/,
+        confidence: "high",
+    },
+    {
+        id: "rag-pgvector",
+        name: "pgvector",
+        pattern: /(?:from\s+['"]pgvector['"]|require\s*\(\s*['"]pgvector['"])/,
+        confidence: "high",
+    },
+    {
+        id: "rag-faiss",
+        name: "FAISS",
+        pattern: /(?:from\s+['"]faiss-node['"]|require\s*\(\s*['"]faiss-node['"])/,
+        confidence: "high",
+    },
+];
+// Function call / usage patterns (medium confidence)
+const USAGE_RULES = [
+    {
+        id: "rag-embedding-call",
+        name: "Embedding function call",
+        pattern: /\.(?:createEmbedding|embedDocuments|embedQuery|embed)\s*\(/,
+        confidence: "medium",
+    },
+    {
+        id: "rag-retriever-pattern",
+        name: "Retriever pattern",
+        pattern: /\.(?:asRetriever|getRelevantDocuments|similaritySearch|similaritySearchWithScore)\s*\(/,
+        confidence: "medium",
+    },
+    {
+        id: "rag-vectorstore-usage",
+        name: "Vector store usage",
+        pattern: /(?:VectorStore|vectorStore|fromDocuments|fromTexts|addDocuments)\s*\(/,
+        confidence: "medium",
+    },
+];
+// Keyword patterns (low confidence)
+const KEYWORD_RULES = [
+    {
+        id: "rag-keyword-embedding",
+        name: "Embedding keyword reference",
+        pattern: /\b(?:text[_-]?embedding|embedding[_-]?(?:model|vector|dimension|size)|openai.*embedding|embedding[_-]?api)\b/i,
+        confidence: "low",
+    },
+    {
+        id: "rag-keyword-vector",
+        name: "Vector keyword reference",
+        pattern: /\b(?:vector(?:Store|DB|Database|Index))\b/,
+        confidence: "low",
+    },
+    {
+        id: "rag-keyword-retriever",
+        name: "Retriever keyword reference",
+        pattern: /\bretriever\b/i,
+        confidence: "low",
+    },
+    {
+        id: "rag-keyword-similarity",
+        name: "Similarity search keyword",
+        pattern: /\bsimilarity_search\b/,
+        confidence: "low",
+    },
+];
+// ---------------------------------------------------------------------------
+// Combined rules (hoisted to module scope to avoid per-call reconstruction)
+// ---------------------------------------------------------------------------
+const ALL_RULES = [...IMPORT_RULES, ...USAGE_RULES, ...KEYWORD_RULES];
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectRagSignals(ctx) {
+    const { file } = ctx;
+    if (!SOURCE_EXTENSIONS.has(file.extension))
+        return [];
+    const lines = ctx.lines;
+    const signalMap = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        const lineNum = i + 1;
+        for (const rule of ALL_RULES) {
+            if (rule.pattern.test(line)) {
+                const evidence = {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                };
+                const existing = signalMap.get(rule.id);
+                if (existing) {
+                    existing.evidence.push(evidence);
+                    existing.confidence = higherConfidence(existing.confidence, rule.confidence);
+                }
+                else {
+                    signalMap.set(rule.id, {
+                        id: rule.id,
+                        name: rule.name,
+                        category: "rag",
+                        confidence: rule.confidence,
+                        evidence: [evidence],
+                    });
+                }
+            }
+        }
+    }
+    return Array.from(signalMap.values());
+}

package/dist/scanner/detectors/shared.d.ts

@@ -0,0 +1,18 @@
+import type { ConfidenceLevel } from "../../evidence/types";
+/** Source-code extensions used by ai-provider, ai-framework, rag, compliance detectors */
+export declare const SOURCE_EXTENSIONS: Set<string>;
+/** Extended set including config formats, used by framework and local-inference detectors */
+export declare const EXTENDED_EXTENSIONS: Set<string>;
+/** Standardized snippet truncation length */
+export declare const MAX_SNIPPET_LENGTH = 200;
+/** Numeric ranking for confidence levels (higher = more confident) */
+export declare const CONFIDENCE_RANK: Record<ConfidenceLevel, number>;
+/** Return the higher of two confidence levels */
+export declare function higherConfidence(a: ConfidenceLevel, b: ConfidenceLevel): ConfidenceLevel;
+/** Escape special regex characters in a string */
+export declare function escapeRegex(str: string): string;
+/** Check whether an extension is a standard source file */
+export declare function isSourceFile(ext: string): boolean;
+/** Check whether an extension is in the extended (source + config) set */
+export declare function isExtendedSourceFile(ext: string): boolean;
+//# sourceMappingURL=shared.d.ts.map

package/dist/scanner/detectors/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,aAA0C,CAAC;AAEzE,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,aAQ9B,CAAC;AAEH,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,sEAAsE;AACtE,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAI3D,CAAC;AAEF,iDAAiD;AACjD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,eAAe,CAExF;AAED,kDAAkD;AAClD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/scanner/detectors/shared.js

@@ -0,0 +1,36 @@
+/** Source-code extensions used by ai-provider, ai-framework, rag, compliance detectors */
+export const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+/** Extended set including config formats, used by framework and local-inference detectors */
+export const EXTENDED_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".json",
+    ".yaml",
+    ".yml",
+]);
+/** Standardized snippet truncation length */
+export const MAX_SNIPPET_LENGTH = 200;
+/** Numeric ranking for confidence levels (higher = more confident) */
+export const CONFIDENCE_RANK = {
+    high: 2,
+    medium: 1,
+    low: 0,
+};
+/** Return the higher of two confidence levels */
+export function higherConfidence(a, b) {
+    return CONFIDENCE_RANK[a] >= CONFIDENCE_RANK[b] ? a : b;
+}
+/** Escape special regex characters in a string */
+export function escapeRegex(str) {
+    return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Check whether an extension is a standard source file */
+export function isSourceFile(ext) {
+    return SOURCE_EXTENSIONS.has(ext);
+}
+/** Check whether an extension is in the extended (source + config) set */
+export function isExtendedSourceFile(ext) {
+    return EXTENDED_EXTENSIONS.has(ext);
+}

package/dist/scanner/discovery.d.ts

@@ -0,0 +1,14 @@
+/**
+ * File discovery for the EuConform scanner.
+ *
+ * Walks a target directory, respects .gitignore, filters by extension
+ * and named files, and returns file contents for pattern matching.
+ */
+import type { FileProvenance, ScanFile, ScanOptions } from "../evidence/types";
+export declare function classifyFileProvenance(relativePath: string): FileProvenance;
+export interface DiscoveryResult {
+    files: ScanFile[];
+    skippedCount: number;
+}
+export declare function discoverFiles(options: ScanOptions): Promise<DiscoveryResult>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/scanner/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/scanner/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAa,MAAM,mBAAmB,CAAC;AAsG1F,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CAoC3E;AAeD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAiFD,wBAAsB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CA0ClF"}