@euconform/core 1.2.0 → 1.3.0

package/src/inference/ollama-client.ts

@@ -413,72 +413,13 @@ export class OllamaClient {
     return supports;
   }
 
-  /**
-   * Get log-probability with automatic fallback to latency method
-   * Returns both the calculated value and the method used
-   */
-  async getLogProbWithFallback(
+  private async tryExactLogProbs(
     prompt: string
-  ): Promise<{ logprob: number; method: BiasCalculationMethod }> {
-    try {
-      // First, check if model supports log-probabilities
-      const supportsLogProbs = await this.detectLogProbSupport();
-
-      if (supportsLogProbs && !this.isCloudModel()) {
-        try {
-          const response = await fetch(`${this.baseUrl}/api/generate`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              model: this.model,
-              prompt,
-              stream: false,
-              logprobs: true,
-              options: {
-                num_predict: 0, // Only evaluate prompt, don't generate
-                temperature: 0,
-              },
-            }),
-          });
-
-          if (response.ok) {
-            const data = await response.json();
-
-            if (data.logprobs && Array.isArray(data.logprobs) && data.logprobs.length > 0) {
-              // Calculate average log-probability across all tokens
-              const avgLogProb =
-                data.logprobs.reduce(
-                  (sum: number, item: { token: string; logprob: number }) => sum + item.logprob,
-                  0
-                ) / data.logprobs.length;
-              console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
-              return {
-                logprob: avgLogProb,
-                method: "logprobs_exact",
-              };
-            }
-            console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
-          } else {
-            console.warn(
-              `❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`
-            );
-          }
-        } catch (error) {
-          console.warn(
-            `❌ Log-probability request failed for ${this.model}, falling back to latency method:`,
-            error
-          );
-        }
-      }
-
-      // Fallback to latency-based method
-      const isCloud = this.isCloudModel();
-      console.log(
-        `⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`
-      );
-      const startTime = performance.now();
-      const numPredict = isCloud ? 1 : 0;
+  ): Promise<{ logprob: number; method: BiasCalculationMethod } | null> {
+    const supportsLogProbs = await this.detectLogProbSupport();
+    if (!supportsLogProbs || this.isCloudModel()) return null;
 
+    try {
       const response = await fetch(`${this.baseUrl}/api/generate`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -486,42 +427,92 @@ export class OllamaClient {
           model: this.model,
           prompt,
           stream: false,
-          options: {
-            num_predict: numPredict,
-            temperature: 0,
-          },
+          logprobs: true,
+          options: { num_predict: 0, temperature: 0 },
         }),
       });
 
-      const endTime = performance.now();
-
       if (!response.ok) {
-        const errorText = await response.text();
-        throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+        console.warn(
+          `❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`
+        );
+        return null;
       }
 
       const data = await response.json();
-
-      // Calculate latency-based pseudo log-probability
-      let latency: number;
-
-      if (data.prompt_eval_duration && data.prompt_eval_count) {
-        // Use prompt evaluation metrics (preferred)
-        latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9; // ns to seconds per token
-      } else {
-        // Fallback to total request time
-        const totalTime = (endTime - startTime) / 1000; // ms to seconds
-        const tokenCount = prompt.split(/\s+/).length; // rough token estimate
-        latency = totalTime / Math.max(tokenCount, 1);
+      if (!data.logprobs || !Array.isArray(data.logprobs) || data.logprobs.length === 0) {
+        console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
+        return null;
       }
 
-      // Convert latency to pseudo log-probability (faster = higher probability)
-      const pseudoLogProb = -Math.log(latency + 0.00001);
+      const avgLogProb =
+        data.logprobs.reduce(
+          (sum: number, item: { token: string; logprob: number }) => sum + item.logprob,
+          0
+        ) / data.logprobs.length;
+      console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
+      return { logprob: avgLogProb, method: "logprobs_exact" };
+    } catch (error) {
+      console.warn(
+        `❌ Log-probability request failed for ${this.model}, falling back to latency method:`,
+        error
+      );
+      return null;
+    }
+  }
 
-      return {
-        logprob: pseudoLogProb,
-        method: "logprobs_fallback_latency",
-      };
+  private async latencyFallback(
+    prompt: string
+  ): Promise<{ logprob: number; method: BiasCalculationMethod }> {
+    const isCloud = this.isCloudModel();
+    console.log(
+      `⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`
+    );
+    const startTime = performance.now();
+
+    const response = await fetch(`${this.baseUrl}/api/generate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        model: this.model,
+        prompt,
+        stream: false,
+        options: { num_predict: isCloud ? 1 : 0, temperature: 0 },
+      }),
+    });
+
+    const endTime = performance.now();
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+    }
+
+    const data = await response.json();
+
+    let latency: number;
+    if (data.prompt_eval_duration && data.prompt_eval_count) {
+      latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9;
+    } else {
+      const totalTime = (endTime - startTime) / 1000;
+      const tokenCount = prompt.split(/\s+/).length;
+      latency = totalTime / Math.max(tokenCount, 1);
+    }
+
+    return { logprob: -Math.log(latency + 0.00001), method: "logprobs_fallback_latency" };
+  }
+
+  /**
+   * Get log-probability with automatic fallback to latency method
+   * Returns both the calculated value and the method used
+   */
+  async getLogProbWithFallback(
+    prompt: string
+  ): Promise<{ logprob: number; method: BiasCalculationMethod }> {
+    try {
+      const exact = await this.tryExactLogProbs(prompt);
+      if (exact) return exact;
+      return await this.latencyFallback(prompt);
     } catch (error) {
       console.error(`Error in getLogProbWithFallback for model ${this.model}:`, error);
       throw error;

package/src/scanner/aggregator.ts

@@ -0,0 +1,258 @@
+/**
+ * Scanner aggregator — orchestrates file discovery and signal detection,
+ * deduplicates signals, and assembles the ScanResult.
+ */
+
+import { basename } from "node:path";
+import { hasImplementationSignals } from "../evidence/compliance-evaluation";
+import type {
+  AppType,
+  ConfidenceLevel,
+  DetectedSignal,
+  FileProvenance,
+  OpenQuestion,
+  RepoProfile,
+  ScanFile,
+  ScanOptions,
+  ScanResult,
+  SignalCategory,
+} from "../evidence/types";
+import { runAllDetectors } from "./detectors";
+import { CONFIDENCE_RANK } from "./detectors/shared";
+import { discoverFiles } from "./discovery";
+
+const TOOL_VERSION = "0.1.0";
+
+function parseRootPackageJson(files: ScanFile[]): Record<string, unknown> | undefined {
+  const pkgFile = files.find((f) => f.relativePath === "package.json");
+  if (!pkgFile) return undefined;
+  try {
+    return JSON.parse(pkgFile.content) as Record<string, unknown>;
+  } catch {
+    return undefined;
+  }
+}
+
+function buildRepoProfile(
+  targetPath: string,
+  pkg: Record<string, unknown> | undefined,
+  files: ScanFile[]
+): RepoProfile {
+  const hasTs = files.some((f) => f.extension === ".ts" || f.extension === ".tsx");
+  const hasJs = files.some((f) => f.extension === ".js" || f.extension === ".jsx");
+  const languages: string[] = [];
+  if (hasTs) languages.push("typescript");
+  if (hasJs) languages.push("javascript");
+
+  let packageManager: RepoProfile["packageManager"];
+  if (files.some((f) => f.relativePath === "pnpm-lock.yaml")) packageManager = "pnpm";
+  else if (files.some((f) => f.relativePath === "yarn.lock")) packageManager = "yarn";
+  else if (files.some((f) => f.relativePath === "package-lock.json")) packageManager = "npm";
+
+  const isMonorepo = Boolean(
+    pkg?.workspaces || files.some((f) => f.relativePath === "pnpm-workspace.yaml")
+  );
+
+  return {
+    name: (pkg?.name as string) ?? basename(targetPath),
+    version: pkg?.version as string | undefined,
+    description: pkg?.description as string | undefined,
+    license: pkg?.license as string | undefined,
+    isMonorepo,
+    packageManager,
+    languages,
+  };
+}
+
+function inferAppTypes(signals: DetectedSignal[]): AppType[] {
+  const types = new Set<AppType>();
+
+  const has = (id: string) => signals.some((s) => s.id === id);
+  const hasCategory = (cat: SignalCategory) => signals.some((s) => s.category === cat);
+
+  if (has("framework-nextjs") || has("framework-react")) types.add("web-app");
+  if (
+    has("framework-express") ||
+    has("framework-fastify") ||
+    has("framework-nestjs") ||
+    has("framework-hono") ||
+    has("framework-elysia")
+  )
+    types.add("api-server");
+  if (hasCategory("local-inference") || hasCategory("ai-provider"))
+    if (signals.some((s) => s.name.toLowerCase().includes("chat"))) types.add("chatbot");
+  if (hasCategory("training")) types.add("ml-pipeline");
+
+  if (types.size === 0) types.add("unknown");
+  return [...types];
+}
+
+/** Merge signals with the same ID: keep highest confidence, combine evidence */
+function deduplicateSignals(signals: DetectedSignal[]): DetectedSignal[] {
+  const map = new Map<string, DetectedSignal>();
+
+  for (const signal of signals) {
+    const existing = map.get(signal.id);
+    if (!existing) {
+      map.set(signal.id, { ...signal, evidence: [...signal.evidence] });
+      continue;
+    }
+
+    // Merge evidence (use Set for O(1) dedup instead of O(n) .some())
+    const seen = new Set(existing.evidence.map((e) => `${e.file}:${e.line ?? ""}`));
+    for (const ev of signal.evidence) {
+      const key = `${ev.file}:${ev.line ?? ""}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        existing.evidence.push(ev);
+      }
+    }
+
+    // Upgrade confidence
+    if (CONFIDENCE_RANK[signal.confidence] > CONFIDENCE_RANK[existing.confidence]) {
+      existing.confidence = signal.confidence;
+    }
+  }
+
+  return [...map.values()];
+}
+
+function annotateEvidenceProvenance(
+  signals: DetectedSignal[],
+  files: ScanFile[]
+): DetectedSignal[] {
+  const provenanceByPath = new Map<string, FileProvenance>();
+  for (const file of files) {
+    provenanceByPath.set(file.relativePath, file.provenance);
+  }
+
+  return signals.map((signal) => ({
+    ...signal,
+    evidence: signal.evidence.map((evidence) => ({
+      ...evidence,
+      provenance: evidence.provenance ?? provenanceByPath.get(evidence.file) ?? "runtime",
+    })),
+  }));
+}
+
+function generateOpenQuestions(signals: DetectedSignal[]): OpenQuestion[] {
+  const questions: OpenQuestion[] = [];
+  const hasAI = signals.some(
+    (s) =>
+      s.category === "ai-provider" ||
+      s.category === "ai-framework" ||
+      s.category === "local-inference"
+  );
+
+  if (hasAI) {
+    questions.push({
+      id: "oq-market-placement",
+      question: "Is this AI system placed on the EU market or used within the EU?",
+      context:
+        "The EU AI Act applies to AI systems placed on or put into service in the EU market.",
+      relatedSignalIds: signals.filter((s) => s.category.startsWith("ai-")).map((s) => s.id),
+      suggestedAction: "Determine your system's geographic scope and market placement.",
+    });
+
+    questions.push({
+      id: "oq-intended-purpose",
+      question: "What is the intended purpose of this AI system?",
+      context:
+        "Risk classification under the EU AI Act depends on the system's intended purpose and deployment context, which cannot be determined from code alone.",
+      relatedSignalIds: [],
+      suggestedAction:
+        "Use the EuConform wizard to complete your risk assessment with human-provided context.",
+    });
+
+    questions.push({
+      id: "oq-provider-role",
+      question: "Are you a provider, deployer, or importer of this AI system?",
+      context:
+        "Different roles under Art. 3 carry different obligations. A scanner cannot determine your organizational role.",
+      relatedSignalIds: [],
+      suggestedAction:
+        "Clarify your role in the AI value chain to determine applicable obligations.",
+    });
+  }
+
+  const hasGpaiSignals = signals.some(
+    (s) => s.category === "ai-provider" || s.id.includes("langchain") || s.id.includes("llamaindex")
+  );
+  if (hasGpaiSignals) {
+    questions.push({
+      id: "oq-gpai-downstream",
+      question:
+        "Are you using a general-purpose AI model? Do you provide downstream access to others?",
+      context:
+        "GPAI obligations (Art. 53-55) apply to providers of general-purpose AI models. Using an API does not automatically make you a GPAI provider.",
+      relatedSignalIds: signals.filter((s) => s.category === "ai-provider").map((s) => s.id),
+      suggestedAction: "Determine whether you are a GPAI provider or deployer.",
+    });
+  }
+
+  const hasNoDisclosure = !hasImplementationSignals(signals, ["compliance-disclosure"]);
+  if (hasAI && hasNoDisclosure) {
+    questions.push({
+      id: "oq-disclosure-missing",
+      question: "Does your system inform users that they are interacting with AI?",
+      context:
+        "No AI disclosure signals were found in the codebase. Art. 50 requires transparency for AI systems interacting with natural persons.",
+      relatedSignalIds: [],
+      suggestedAction: "Add explicit AI disclosure in user-facing entry points.",
+    });
+  }
+
+  return questions;
+}
+
+function buildSignalSummary(signals: DetectedSignal[]): ScanResult["signalSummary"] {
+  const byCategory: Partial<Record<SignalCategory, number>> = {};
+  const byConfidence: Record<ConfidenceLevel, number> = {
+    high: 0,
+    medium: 0,
+    low: 0,
+  };
+
+  for (const s of signals) {
+    byCategory[s.category] = (byCategory[s.category] ?? 0) + 1;
+    byConfidence[s.confidence]++;
+  }
+
+  return { total: signals.length, byCategory, byConfidence };
+}
+
+export async function scanRepository(options: ScanOptions): Promise<ScanResult> {
+  const startTime = Date.now();
+  const scope = options.scope ?? "production";
+
+  const discovery = await discoverFiles(options);
+  const allFiles = discovery.files;
+  const rootPkg = parseRootPackageJson(allFiles);
+
+  // Run detectors on all files
+  const rawSignals: DetectedSignal[] = [];
+  for (const file of allFiles) {
+    const ctx = { file, lines: file.content.split("\n"), allFiles, rootPackageJson: rootPkg };
+    rawSignals.push(...runAllDetectors(ctx));
+  }
+
+  const signals = annotateEvidenceProvenance(deduplicateSignals(rawSignals), allFiles);
+  const openQuestions = generateOpenQuestions(signals);
+
+  return {
+    meta: {
+      scannedAt: new Date().toISOString(),
+      scanDurationMs: Date.now() - startTime,
+      toolVersion: TOOL_VERSION,
+      targetPath: options.targetPath,
+      scanScope: scope,
+      filesScanned: allFiles.length,
+      filesSkipped: discovery.skippedCount,
+    },
+    repo: buildRepoProfile(options.targetPath, rootPkg, allFiles),
+    appTypes: inferAppTypes(signals),
+    signals,
+    openQuestions,
+    signalSummary: buildSignalSummary(signals),
+  };
+}

package/src/scanner/detectors/ai-framework-detector.ts

@@ -0,0 +1,94 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+import { SOURCE_EXTENSIONS } from "./shared";
+
+// ---------------------------------------------------------------------------
+// Framework patterns
+// ---------------------------------------------------------------------------
+
+interface FrameworkPattern {
+  id: string;
+  name: string;
+  importPattern: RegExp;
+}
+
+const FRAMEWORK_IMPORTS: FrameworkPattern[] = [
+  {
+    id: "ai-framework-langchain",
+    name: "LangChain",
+    importPattern: /(?:from\s+['"]langchain[/'"]|require\s*\(\s*['"]langchain[/'"])/,
+  },
+  {
+    id: "ai-framework-langchain-core",
+    name: "LangChain Core",
+    importPattern:
+      /(?:from\s+['"]@langchain\/[^'"]+['"]|require\s*\(\s*['"]@langchain\/[^'"]+['"])/,
+  },
+  {
+    id: "ai-framework-llamaindex",
+    name: "LlamaIndex",
+    importPattern: /(?:from\s+['"]llamaindex[/'"]|require\s*\(\s*['"]llamaindex[/'"])/,
+  },
+  {
+    id: "ai-framework-transformers",
+    name: "Transformers.js",
+    importPattern:
+      /(?:from\s+['"]@xenova\/transformers['"]|require\s*\(\s*['"]@xenova\/transformers['"])/,
+  },
+  {
+    id: "ai-framework-vercel-ai",
+    name: "Vercel AI SDK",
+    // Only match Vercel AI SDK subpath imports (ai/react, ai/rsc) to avoid false positives
+    // on generic "ai" package name. Bare "ai" import matched only with package.json cross-check.
+    importPattern:
+      /(?:from\s+['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"']|require\s*\(\s*['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"])/,
+  },
+  {
+    id: "ai-framework-huggingface",
+    name: "HuggingFace",
+    importPattern:
+      /(?:from\s+['"]@huggingface\/[^'"]+['"]|require\s*\(\s*['"]@huggingface\/[^'"]+['"])/,
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+
+export function detectAiFrameworkSignals(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+
+  const lines = ctx.lines;
+  const signalMap = new Map<string, DetectedSignal>();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const lineNum = i + 1;
+
+    for (const framework of FRAMEWORK_IMPORTS) {
+      if (framework.importPattern.test(line)) {
+        const existing = signalMap.get(framework.id);
+        const evidence = {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200),
+        };
+
+        if (existing) {
+          existing.evidence.push(evidence);
+        } else {
+          signalMap.set(framework.id, {
+            id: framework.id,
+            name: framework.name,
+            category: "ai-framework",
+            confidence: "medium",
+            evidence: [evidence],
+          });
+        }
+      }
+    }
+  }
+
+  return Array.from(signalMap.values());
+}

package/src/scanner/detectors/ai-provider-detector.ts

@@ -0,0 +1,135 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+import { SOURCE_EXTENSIONS } from "./shared";
+
+// ---------------------------------------------------------------------------
+// Provider patterns
+// ---------------------------------------------------------------------------
+
+interface ProviderPattern {
+  id: string;
+  name: string;
+  /** Regex applied per line to detect imports/requires */
+  importPattern: RegExp;
+}
+
+const PROVIDER_IMPORTS: ProviderPattern[] = [
+  {
+    id: "ai-provider-openai",
+    name: "OpenAI SDK",
+    importPattern: /(?:from\s+['"]openai['"]|require\s*\(\s*['"]openai['"])/,
+  },
+  {
+    id: "ai-provider-anthropic",
+    name: "Anthropic SDK",
+    importPattern:
+      /(?:from\s+['"]@anthropic-ai\/sdk['"]|require\s*\(\s*['"]@anthropic-ai\/sdk['"])/,
+  },
+  {
+    id: "ai-provider-cohere",
+    name: "Cohere SDK",
+    importPattern: /(?:from\s+['"]cohere-ai['"]|require\s*\(\s*['"]cohere-ai['"])/,
+  },
+  {
+    id: "ai-provider-google-genai",
+    name: "Google Generative AI",
+    importPattern:
+      /(?:from\s+['"]@google\/generative-ai['"]|require\s*\(\s*['"]@google\/generative-ai['"])/,
+  },
+  {
+    id: "ai-provider-mistral",
+    name: "Mistral AI SDK",
+    importPattern:
+      /(?:from\s+['"]@mistralai\/mistralai['"]|require\s*\(\s*['"]@mistralai\/mistralai['"])/,
+  },
+];
+
+interface ApiEndpoint {
+  id: string;
+  name: string;
+  pattern: RegExp;
+}
+
+const API_ENDPOINTS: ApiEndpoint[] = [
+  {
+    id: "ai-provider-openai-api",
+    name: "OpenAI API endpoint",
+    pattern: /api\.openai\.com/,
+  },
+  {
+    id: "ai-provider-anthropic-api",
+    name: "Anthropic API endpoint",
+    pattern: /api\.anthropic\.com/,
+  },
+  {
+    id: "ai-provider-cohere-api",
+    name: "Cohere API endpoint",
+    pattern: /api\.cohere\.ai/,
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+
+export function detectAiProviderSignals(ctx: DetectorContext): DetectedSignal[] {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+
+  const lines = ctx.lines;
+  const signalMap = new Map<string, DetectedSignal>();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const lineNum = i + 1;
+
+    // Check import/require patterns
+    for (const provider of PROVIDER_IMPORTS) {
+      if (provider.importPattern.test(line)) {
+        addEvidence(signalMap, provider.id, provider.name, "medium", {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200),
+        });
+      }
+    }
+
+    // Check API endpoint URLs
+    for (const endpoint of API_ENDPOINTS) {
+      if (endpoint.pattern.test(line)) {
+        addEvidence(signalMap, endpoint.id, endpoint.name, "medium", {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200),
+        });
+      }
+    }
+  }
+
+  return Array.from(signalMap.values());
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function addEvidence(
+  map: Map<string, DetectedSignal>,
+  id: string,
+  name: string,
+  confidence: "high" | "medium" | "low",
+  evidence: { file: string; line?: number; snippet: string }
+): void {
+  const existing = map.get(id);
+  if (existing) {
+    existing.evidence.push(evidence);
+  } else {
+    map.set(id, {
+      id,
+      name,
+      category: "ai-provider",
+      confidence,
+      evidence: [evidence],
+    });
+  }
+}