@euconform/core 1.2.0 → 1.3.0

package/tests/fixtures/compliance-good/tests/bias-check.test.ts

@@ -0,0 +1,13 @@
+import { disparateImpact, statisticalParityDifference } from "@euconform/core";
+
+describe("Bias Testing", () => {
+  it("should check disparate impact", () => {
+    const result = disparateImpact([]);
+    expect(result).toBeDefined();
+  });
+
+  it("should check statistical parity", () => {
+    const result = statisticalParityDifference([]);
+    expect(result).toBeDefined();
+  });
+});

package/tests/fixtures/nextjs-openai/README.md

@@ -0,0 +1,5 @@
+# My AI App
+
+This application uses AI to generate responses.
+
+**Note:** This app is powered by artificial intelligence. Responses are AI-generated.

package/tests/fixtures/nextjs-openai/app/page.tsx

@@ -0,0 +1,11 @@
+import OpenAI from "openai";
+
+const client = new OpenAI();
+
+export default async function Page() {
+  const response = await client.chat.completions.create({
+    model: "gpt-4",
+    messages: [{ role: "user", content: "Hello" }],
+  });
+  return <div>AI Response: {response.choices[0]?.message?.content}</div>;
+}

package/tests/fixtures/nextjs-openai/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "my-nextjs-ai-app",
+  "version": "1.0.0",
+  "dependencies": {
+    "next": "^14.0.0",
+    "react": "^18.0.0",
+    "openai": "^4.0.0"
+  }
+}

package/tests/fixtures/ollama-rag/.env.example

@@ -0,0 +1,2 @@
+OLLAMA_HOST=http://localhost:11434
+CHROMA_HOST=http://localhost:8000

package/tests/fixtures/ollama-rag/docker-compose.yml

@@ -0,0 +1,9 @@
+services:
+  ollama:
+    image: ollama/ollama:latest
+    ports:
+      - "11434:11434"
+  chromadb:
+    image: chromadb/chroma:latest
+    ports:
+      - "8000:8000"

package/tests/fixtures/ollama-rag/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "ollama-rag-server",
+  "version": "0.1.0",
+  "dependencies": {
+    "express": "^4.18.0",
+    "ollama": "^0.5.0",
+    "chromadb": "^1.8.0"
+  }
+}

package/tests/fixtures/ollama-rag/server.ts

@@ -0,0 +1,21 @@
+import { ChromaClient } from "chromadb";
+import express from "express";
+import { Ollama } from "ollama";
+
+const app = express();
+const ollama = new Ollama({ host: "http://localhost:11434" });
+const chroma = new ChromaClient();
+
+app.post("/chat", async (req, res) => {
+  const collection = await chroma.getCollection({ name: "docs" });
+  const results = await collection.query({ queryTexts: [req.body.query] });
+  const context = results.documents.flat().join("\n");
+
+  const response = await ollama.chat({
+    model: "llama3.2",
+    messages: [{ role: "user", content: `Context: ${context}\n\nQuestion: ${req.body.query}` }],
+  });
+  res.json({ answer: response.message.content });
+});
+
+app.listen(3000);

package/tests/fixtures/plain-webapp/README.md

@@ -0,0 +1,3 @@
+# Plain Web App
+
+A simple web application with no AI components.

package/tests/fixtures/plain-webapp/index.js

@@ -0,0 +1,5 @@
+const express = require("express");
+const app = express();
+app.set("view engine", "ejs");
+app.get("/", (_req, res) => res.render("index", { title: "Hello World" }));
+app.listen(3000);

package/tests/fixtures/plain-webapp/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "plain-webapp",
+  "version": "1.0.0",
+  "dependencies": {
+    "express": "^4.18.0",
+    "ejs": "^3.1.0"
+  }
+}

package/tests/gpai-classifier.test.ts

@@ -32,8 +32,8 @@ describe("classifyGPAICompliance", () => {
       const result = classifyGPAICompliance(answers);
       const flag = result.flags.find((f) => f.obligation === "copyright-policy");
       expect(flag).toBeDefined();
-      expect(flag!.status).toBe("missing");
-      expect(flag!.articleRef).toBe("Art. 53(1)(d)");
+      expect(flag?.status).toBe("missing");
+      expect(flag?.articleRef).toBe("Art. 53(1)(d)");
     });
 
     it("flags copyright-policy as partial when open-source answers 'unsure'", () => {
@@ -44,8 +44,8 @@ describe("classifyGPAICompliance", () => {
       const result = classifyGPAICompliance(answers);
       const flag = result.flags.find((f) => f.obligation === "copyright-policy");
       expect(flag).toBeDefined();
-      expect(flag!.status).toBe("partial");
-      expect(flag!.articleRef).toBe("Art. 53(1)(d)");
+      expect(flag?.status).toBe("partial");
+      expect(flag?.articleRef).toBe("Art. 53(1)(d)");
     });
 
     it("does NOT flag copyright-policy when open-source answers 'yes'", () => {

package/tests/gpai-timeline.test.ts

@@ -15,7 +15,7 @@ describe("getTimelineForAudiences", () => {
     const phases = getTimelineForAudiences(["all", "gpai"]);
     const phase2 = phases.find((p) => p.id === "phase-2-gpai");
     expect(phase2).toBeDefined();
-    const gpaiObligation = phase2!.obligations.find((o) => o.articleRef === "Art. 53");
+    const gpaiObligation = phase2?.obligations.find((o) => o.articleRef === "Art. 53");
     expect(gpaiObligation).toBeDefined();
   });
 
@@ -23,7 +23,7 @@ describe("getTimelineForAudiences", () => {
     const phases = getTimelineForAudiences(["all", "gpai"]);
     const phase2 = phases.find((p) => p.id === "phase-2-gpai");
     expect(phase2).toBeDefined();
-    const systemicObligation = phase2!.obligations.find((o) => o.articleRef === "Art. 55");
+    const systemicObligation = phase2?.obligations.find((o) => o.articleRef === "Art. 55");
     expect(systemicObligation).toBeDefined();
   });
 

package/tests/scanner/aggregator.test.ts

@@ -0,0 +1,122 @@
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import { scanRepository } from "../../src/scanner/aggregator";
+
+const FIXTURES = resolve(__dirname, "../fixtures");
+
+describe("scanRepository", () => {
+  it("scans nextjs-openai fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    const signalIds = result.signals.map((s) => s.id);
+
+    // Should detect Next.js framework
+    expect(signalIds.some((id) => id.includes("nextjs") || id.includes("next"))).toBe(true);
+
+    // Should detect OpenAI provider
+    expect(signalIds.some((id) => id.includes("openai"))).toBe(true);
+
+    // Should detect AI disclosure from README
+    expect(result.signals.some((s) => s.category === "compliance-disclosure")).toBe(true);
+  });
+
+  it("scans ollama-rag fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "ollama-rag"),
+    });
+
+    const signalIds = result.signals.map((s) => s.id);
+    const categories = result.signals.map((s) => s.category);
+
+    // Should detect Express framework
+    expect(signalIds.some((id) => id.includes("express"))).toBe(true);
+
+    // Should detect Ollama (local inference)
+    expect(categories).toContain("local-inference");
+
+    // Should detect ChromaDB (RAG)
+    expect(categories).toContain("rag");
+  });
+
+  it("scans plain-webapp fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "plain-webapp"),
+    });
+
+    // Should NOT detect any AI signals
+    const aiSignals = result.signals.filter(
+      (s) =>
+        s.category === "ai-provider" ||
+        s.category === "ai-framework" ||
+        s.category === "local-inference" ||
+        s.category === "ai-model"
+    );
+    expect(aiSignals).toHaveLength(0);
+
+    // Should have minimal signals (framework at most)
+    expect(result.signals.length).toBeLessThan(10);
+  });
+
+  it("scans compliance-good fixture", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "compliance-good"),
+    });
+
+    const categories = result.signals.map((s) => s.category);
+
+    // Should detect compliance signals for disclosure, logging, bias
+    expect(categories).toContain("compliance-logging");
+    // OpenAI is an AI provider
+    expect(categories).toContain("ai-provider");
+  });
+
+  it("generates open questions when AI is detected", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    expect(result.openQuestions.length).toBeGreaterThan(0);
+
+    // Should include the market placement question
+    const marketQuestion = result.openQuestions.find((q) => q.id === "oq-market-placement");
+    expect(marketQuestion).toBeDefined();
+  });
+
+  it("generates signal summary", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    expect(result.signalSummary.total).toBe(result.signals.length);
+    expect(result.signalSummary.total).toBeGreaterThan(0);
+
+    // byConfidence should have correct totals
+    const confidenceTotal =
+      result.signalSummary.byConfidence.high +
+      result.signalSummary.byConfidence.medium +
+      result.signalSummary.byConfidence.low;
+    expect(confidenceTotal).toBe(result.signalSummary.total);
+  });
+
+  it("deduplicates signals", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    // Check that signal IDs are unique after deduplication
+    const ids = result.signals.map((s) => s.id);
+    const uniqueIds = new Set(ids);
+    expect(ids.length).toBe(uniqueIds.size);
+  });
+
+  it("records scan scope metadata", async () => {
+    const result = await scanRepository({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+      scope: "all",
+    });
+
+    expect(result.meta.scanScope).toBe("all");
+  });
+});

package/tests/scanner/detectors.test.ts

@@ -0,0 +1,274 @@
+import { describe, expect, it } from "vitest";
+import type { DetectorContext, ScanFile } from "../../src/evidence/types";
+import { detectAiFrameworkSignals } from "../../src/scanner/detectors/ai-framework-detector";
+import { detectAiProviderSignals } from "../../src/scanner/detectors/ai-provider-detector";
+import { detectCompliance } from "../../src/scanner/detectors/compliance-detector";
+import { detectConfig } from "../../src/scanner/detectors/config-detector";
+import { detectFrameworks } from "../../src/scanner/detectors/framework-detector";
+import { detectLocalInferenceSignals } from "../../src/scanner/detectors/local-inference-detector";
+import { detectMarkdown } from "../../src/scanner/detectors/markdown-detector";
+import { detectPackageJsonSignals } from "../../src/scanner/detectors/package-json-detector";
+import { detectRagSignals } from "../../src/scanner/detectors/rag-detector";
+
+// ---------------------------------------------------------------------------
+// Helper
+// ---------------------------------------------------------------------------
+
+function makeContext(
+  file: Partial<ScanFile> & { content: string; relativePath: string }
+): DetectorContext {
+  const extension =
+    file.extension ??
+    (file.relativePath.split(".").pop() ? `.${file.relativePath.split(".").pop()}` : "");
+  const provenance =
+    file.provenance ??
+    (extension === ".md" && !file.relativePath.includes("/") ? "root-docs" : "runtime");
+
+  const scanFile = {
+    relativePath: file.relativePath,
+    absolutePath: `/test/${file.relativePath}`,
+    extension,
+    content: file.content,
+    sizeBytes: file.content.length,
+    provenance,
+  };
+
+  return {
+    file: scanFile,
+    lines: scanFile.content.split("\n"),
+    allFiles: [],
+  };
+}
+
+// ---------------------------------------------------------------------------
+// package-json-detector
+// ---------------------------------------------------------------------------
+
+describe("package-json-detector", () => {
+  it("detects AI provider and framework signals from package.json", () => {
+    const ctx = makeContext({
+      relativePath: "package.json",
+      extension: ".json",
+      content: JSON.stringify({
+        dependencies: {
+          openai: "^4.0.0",
+          next: "^14.0.0",
+        },
+      }),
+    });
+
+    const signals = detectPackageJsonSignals(ctx);
+
+    const categories = signals.map((s) => s.category);
+    expect(categories).toContain("ai-provider");
+    expect(categories).toContain("framework");
+
+    const openaiSignal = signals.find((s) => s.category === "ai-provider");
+    expect(openaiSignal).toBeDefined();
+    expect(openaiSignal?.confidence).toBe("high");
+  });
+
+  it("returns empty for non-package files", () => {
+    const ctx = makeContext({
+      relativePath: "src/index.ts",
+      extension: ".ts",
+      content: '{ "openai": "^4.0.0" }',
+    });
+
+    expect(detectPackageJsonSignals(ctx)).toHaveLength(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// ai-provider-detector
+// ---------------------------------------------------------------------------
+
+describe("ai-provider-detector", () => {
+  it("detects OpenAI import in TypeScript", () => {
+    const ctx = makeContext({
+      relativePath: "src/ai.ts",
+      extension: ".ts",
+      content: 'import OpenAI from "openai";\n\nconst client = new OpenAI();',
+    });
+
+    const signals = detectAiProviderSignals(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    expect(signals[0]?.category).toBe("ai-provider");
+    expect(signals[0]?.id).toBe("ai-provider-openai");
+  });
+
+  it("ignores non-source files", () => {
+    const ctx = makeContext({
+      relativePath: "README.md",
+      extension: ".md",
+      content: 'import OpenAI from "openai";',
+    });
+
+    expect(detectAiProviderSignals(ctx)).toHaveLength(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// ai-framework-detector
+// ---------------------------------------------------------------------------
+
+describe("ai-framework-detector", () => {
+  it("detects LangChain import", () => {
+    const ctx = makeContext({
+      relativePath: "src/chain.ts",
+      extension: ".ts",
+      content: 'import { ChatOpenAI } from "langchain/chat_models";\n',
+    });
+
+    const signals = detectAiFrameworkSignals(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    expect(signals[0]?.category).toBe("ai-framework");
+    expect(signals[0]?.id).toContain("langchain");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// local-inference-detector
+// ---------------------------------------------------------------------------
+
+describe("local-inference-detector", () => {
+  it("detects Ollama localhost URL", () => {
+    const ctx = makeContext({
+      relativePath: "src/llm.ts",
+      extension: ".ts",
+      content: 'new Ollama({ host: "http://localhost:11434" })',
+    });
+
+    const signals = detectLocalInferenceSignals(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    expect(signals.some((s) => s.category === "local-inference")).toBe(true);
+    // localhost:11434 is a high-confidence signal
+    const ollamaSignal = signals.find((s) => s.id.includes("ollama-api"));
+    expect(ollamaSignal).toBeDefined();
+    expect(ollamaSignal?.confidence).toBe("high");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// rag-detector
+// ---------------------------------------------------------------------------
+
+describe("rag-detector", () => {
+  it("detects ChromaDB import", () => {
+    const ctx = makeContext({
+      relativePath: "src/rag.ts",
+      extension: ".ts",
+      content: 'import { ChromaClient } from "chromadb";\n\nconst chroma = new ChromaClient();',
+    });
+
+    const signals = detectRagSignals(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    expect(signals.some((s) => s.category === "rag")).toBe(true);
+    const chromaSignal = signals.find((s) => s.id === "rag-chromadb");
+    expect(chromaSignal).toBeDefined();
+    expect(chromaSignal?.confidence).toBe("high");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// framework-detector
+// ---------------------------------------------------------------------------
+
+describe("framework-detector", () => {
+  it("detects Next.js from config file", () => {
+    const ctx = makeContext({
+      relativePath: "next.config.ts",
+      extension: ".ts",
+      content: "export default { reactStrictMode: true };",
+    });
+
+    const signals = detectFrameworks(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    const nextSignal = signals.find((s) => s.id === "framework-nextjs");
+    expect(nextSignal).toBeDefined();
+    expect(nextSignal?.category).toBe("framework");
+    expect(nextSignal?.confidence).toBe("high");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// compliance-detector
+// ---------------------------------------------------------------------------
+
+describe("compliance-detector", () => {
+  it("detects AI disclosure text and logging library", () => {
+    const ctx = makeContext({
+      relativePath: "app/page.tsx",
+      extension: ".tsx",
+      content: [
+        'import pino from "pino";',
+        "const logger = pino();",
+        '// This response was "generated by AI"',
+        'logger.info({ action: "ai-response" }, "done");',
+      ].join("\n"),
+    });
+
+    const signals = detectCompliance(ctx);
+
+    const categories = signals.map((s) => s.category);
+    expect(categories).toContain("compliance-disclosure");
+    expect(categories).toContain("compliance-logging");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// config-detector
+// ---------------------------------------------------------------------------
+
+describe("config-detector", () => {
+  it("detects AI provider from .env.example", () => {
+    const ctx = makeContext({
+      relativePath: ".env.example",
+      extension: "",
+      content: "OPENAI_API_KEY=\nDATABASE_URL=postgres://localhost/db\n",
+    });
+
+    const signals = detectConfig(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    const openaiSignal = signals.find((s) => s.category === "ai-provider");
+    expect(openaiSignal).toBeDefined();
+    expect(openaiSignal?.confidence).toBe("high");
+    // Ensure the value is not leaked — only the key name
+    expect(openaiSignal?.evidence[0]?.snippet).not.toContain("=");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// markdown-detector
+// ---------------------------------------------------------------------------
+
+describe("markdown-detector", () => {
+  it("detects AI disclosure in README", () => {
+    const ctx = makeContext({
+      relativePath: "README.md",
+      extension: ".md",
+      content: "# My App\n\nThis app uses artificial intelligence to generate responses.\n",
+    });
+
+    const signals = detectMarkdown(ctx);
+
+    expect(signals.length).toBeGreaterThanOrEqual(1);
+    expect(signals.some((s) => s.category === "compliance-disclosure")).toBe(true);
+  });
+
+  it("ignores non-markdown files", () => {
+    const ctx = makeContext({
+      relativePath: "src/index.ts",
+      extension: ".ts",
+      content: "This app uses artificial intelligence",
+    });
+
+    expect(detectMarkdown(ctx)).toHaveLength(0);
+  });
+});

package/tests/scanner/discovery.test.ts

@@ -0,0 +1,87 @@
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import { discoverFiles } from "../../src/scanner/discovery";
+
+const FIXTURES = resolve(__dirname, "../fixtures");
+
+describe("discoverFiles", () => {
+  it("discovers files in a fixture directory", async () => {
+    const { files } = await discoverFiles({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    const paths = files.map((f) => f.relativePath);
+    expect(paths).toContain("package.json");
+    expect(paths.some((p) => p.includes("app/page.tsx"))).toBe(true);
+    expect(paths).toContain("README.md");
+  });
+
+  it("respects extension filtering", async () => {
+    const { files } = await discoverFiles({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    // All discovered files should match default extensions or named file patterns
+    for (const file of files) {
+      const ext = file.extension;
+      const isDefaultExt = [".ts", ".tsx", ".js", ".jsx", ".json", ".md", ".yaml", ".yml"].includes(
+        ext
+      );
+      const isNamedFile =
+        /^(package\.json|\.env\.|next\.config\.|vite\.config\.|docker-compose|Dockerfile|tsconfig)/.test(
+          file.relativePath.split("/").pop() ?? ""
+        );
+      expect(isDefaultExt || isNamedFile).toBe(true);
+    }
+  });
+
+  it("skips node_modules", async () => {
+    const { files } = await discoverFiles({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+    });
+
+    const hasNodeModules = files.some((f) => f.relativePath.includes("node_modules"));
+    expect(hasNodeModules).toBe(false);
+  });
+
+  it("defaults to production scope and excludes test/example files", async () => {
+    const { files } = await discoverFiles({
+      targetPath: resolve(FIXTURES, "compliance-good"),
+    });
+
+    const paths = files.map((file) => file.relativePath);
+    expect(paths.some((path) => path.includes("tests/"))).toBe(false);
+  });
+
+  it("includes test files in all scope and annotates provenance", async () => {
+    const { files } = await discoverFiles({
+      targetPath: resolve(FIXTURES, "compliance-good"),
+      scope: "all",
+    });
+
+    const testFile = files.find((file) => file.relativePath.includes("tests/bias-check.test.ts"));
+    expect(testFile).toBeDefined();
+    expect(testFile?.provenance).toBe("test");
+  });
+
+  it("respects max file size", async () => {
+    // Set a very small max file size — only tiny files should be included
+    const { files } = await discoverFiles({
+      targetPath: resolve(FIXTURES, "nextjs-openai"),
+      maxFileSizeBytes: 10,
+    });
+
+    // All included files should be at most 10 bytes
+    for (const file of files) {
+      expect(file.sizeBytes).toBeLessThanOrEqual(10);
+    }
+  });
+
+  it("handles non-existent path", async () => {
+    await expect(
+      discoverFiles({
+        targetPath: resolve(FIXTURES, "this-does-not-exist"),
+      })
+    ).rejects.toThrow(/Cannot read directory/);
+  });
+});

package/vitest.config.ts

@@ -5,6 +5,7 @@ export default defineConfig({
     globals: true,
     environment: "node",
     include: ["tests/**/*.test.ts"],
+    exclude: ["tests/fixtures/**"],
     // Work around rare worker-pool teardown issues (tinypool) on some Node/tooling combos.
     // Core tests are lightweight; single-thread execution improves stability and reproducibility.
     pool: "threads",