@euconform/core 1.2.0 → 1.4.0

package/dist/inference/ollama-client.js

@@ -142,10 +142,12 @@ export class OllamaClient {
     baseUrl;
     model;
     capabilityCache;
-    constructor(model, baseUrl = OLLAMA_BASE_URL) {
+    externalCache;
+    constructor(model, baseUrl = OLLAMA_BASE_URL, cache) {
         this.baseUrl = baseUrl;
         this.model = model;
         this.capabilityCache = new Map();
+        this.externalCache = cache ?? null;
     }
     isCloudModel() {
         return this.model.includes(":cloud");
@@ -240,29 +242,34 @@ export class OllamaClient {
         }
     }
     /**
-     * Get cached capability result from localStorage
+     * Get cached capability result from localStorage or external cache
      */
     getCachedCapability() {
         try {
             const cacheKey = `ollama_supports_logprobs_${this.model}`;
-            const cached = localStorage.getItem(cacheKey);
+            let cached = null;
+            if (this.externalCache) {
+                cached = this.externalCache.get(cacheKey);
+            }
+            else if (typeof localStorage !== "undefined") {
+                cached = localStorage.getItem(cacheKey);
+            }
             if (cached) {
                 const capability = JSON.parse(cached);
-                // Check if cache is still valid (24 hours)
                 const cacheAge = Date.now() - new Date(capability.testedAt).getTime();
-                const maxAge = 24 * 60 * 60 * 1000; // 24 hours in milliseconds
-                if (cacheAge < maxAge) {
+                const CACHE_TTL = 24 * 60 * 60 * 1000; // 24 hours
+                if (cacheAge < CACHE_TTL) {
                     return capability;
                 }
             }
+            return null;
         }
-        catch (error) {
-            console.warn("Failed to read capability cache:", error);
+        catch {
+            return null;
         }
-        return null;
     }
     /**
-     * Cache capability result in localStorage
+     * Cache capability result in localStorage or external cache
      */
     setCachedCapability(supports) {
         try {
@@ -272,7 +279,12 @@ export class OllamaClient {
                 supportsLogProbs: supports,
                 testedAt: new Date().toISOString(),
             };
-            localStorage.setItem(cacheKey, JSON.stringify(capability));
+            if (this.externalCache) {
+                this.externalCache.set(cacheKey, JSON.stringify(capability));
+            }
+            else if (typeof localStorage !== "undefined") {
+                localStorage.setItem(cacheKey, JSON.stringify(capability));
+            }
             this.capabilityCache.set(this.model, capability);
         }
         catch (error) {
@@ -300,56 +312,11 @@ export class OllamaClient {
         this.setCachedCapability(supports);
         return supports;
     }
-    /**
-     * Get log-probability with automatic fallback to latency method
-     * Returns both the calculated value and the method used
-     */
-    async getLogProbWithFallback(prompt) {
+    async tryExactLogProbs(prompt) {
+        const supportsLogProbs = await this.detectLogProbSupport();
+        if (!supportsLogProbs || this.isCloudModel())
+            return null;
         try {
-            // First, check if model supports log-probabilities
-            const supportsLogProbs = await this.detectLogProbSupport();
-            if (supportsLogProbs && !this.isCloudModel()) {
-                try {
-                    const response = await fetch(`${this.baseUrl}/api/generate`, {
-                        method: "POST",
-                        headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify({
-                            model: this.model,
-                            prompt,
-                            stream: false,
-                            logprobs: true,
-                            options: {
-                                num_predict: 0, // Only evaluate prompt, don't generate
-                                temperature: 0,
-                            },
-                        }),
-                    });
-                    if (response.ok) {
-                        const data = await response.json();
-                        if (data.logprobs && Array.isArray(data.logprobs) && data.logprobs.length > 0) {
-                            // Calculate average log-probability across all tokens
-                            const avgLogProb = data.logprobs.reduce((sum, item) => sum + item.logprob, 0) / data.logprobs.length;
-                            console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
-                            return {
-                                logprob: avgLogProb,
-                                method: "logprobs_exact",
-                            };
-                        }
-                        console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
-                    }
-                    else {
-                        console.warn(`❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`);
-                    }
-                }
-                catch (error) {
-                    console.warn(`❌ Log-probability request failed for ${this.model}, falling back to latency method:`, error);
-                }
-            }
-            // Fallback to latency-based method
-            const isCloud = this.isCloudModel();
-            console.log(`⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`);
-            const startTime = performance.now();
-            const numPredict = isCloud ? 1 : 0;
             const response = await fetch(`${this.baseUrl}/api/generate`, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
@@ -357,36 +324,69 @@ export class OllamaClient {
                     model: this.model,
                     prompt,
                     stream: false,
-                    options: {
-                        num_predict: numPredict,
-                        temperature: 0,
-                    },
+                    logprobs: true,
+                    options: { num_predict: 0, temperature: 0 },
                 }),
             });
-            const endTime = performance.now();
             if (!response.ok) {
-                const errorText = await response.text();
-                throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+                console.warn(`❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`);
+                return null;
             }
             const data = await response.json();
-            // Calculate latency-based pseudo log-probability
-            let latency;
-            if (data.prompt_eval_duration && data.prompt_eval_count) {
-                // Use prompt evaluation metrics (preferred)
-                latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9; // ns to seconds per token
-            }
-            else {
-                // Fallback to total request time
-                const totalTime = (endTime - startTime) / 1000; // ms to seconds
-                const tokenCount = prompt.split(/\s+/).length; // rough token estimate
-                latency = totalTime / Math.max(tokenCount, 1);
+            if (!data.logprobs || !Array.isArray(data.logprobs) || data.logprobs.length === 0) {
+                console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
+                return null;
             }
-            // Convert latency to pseudo log-probability (faster = higher probability)
-            const pseudoLogProb = -Math.log(latency + 0.00001);
-            return {
-                logprob: pseudoLogProb,
-                method: "logprobs_fallback_latency",
-            };
+            const avgLogProb = data.logprobs.reduce((sum, item) => sum + item.logprob, 0) / data.logprobs.length;
+            console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
+            return { logprob: avgLogProb, method: "logprobs_exact" };
+        }
+        catch (error) {
+            console.warn(`❌ Log-probability request failed for ${this.model}, falling back to latency method:`, error);
+            return null;
+        }
+    }
+    async latencyFallback(prompt) {
+        const isCloud = this.isCloudModel();
+        console.log(`⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`);
+        const startTime = performance.now();
+        const response = await fetch(`${this.baseUrl}/api/generate`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                model: this.model,
+                prompt,
+                stream: false,
+                options: { num_predict: isCloud ? 1 : 0, temperature: 0 },
+            }),
+        });
+        const endTime = performance.now();
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+        }
+        const data = await response.json();
+        let latency;
+        if (data.prompt_eval_duration && data.prompt_eval_count) {
+            latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9;
+        }
+        else {
+            const totalTime = (endTime - startTime) / 1000;
+            const tokenCount = prompt.split(/\s+/).length;
+            latency = totalTime / Math.max(tokenCount, 1);
+        }
+        return { logprob: -Math.log(latency + 0.00001), method: "logprobs_fallback_latency" };
+    }
+    /**
+     * Get log-probability with automatic fallback to latency method
+     * Returns both the calculated value and the method used
+     */
+    async getLogProbWithFallback(prompt) {
+        try {
+            const exact = await this.tryExactLogProbs(prompt);
+            if (exact)
+                return exact;
+            return await this.latencyFallback(prompt);
         }
         catch (error) {
             console.error(`Error in getLogProbWithFallback for model ${this.model}:`, error);

package/dist/scanner/aggregator.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Scanner aggregator — orchestrates file discovery and signal detection,
+ * deduplicates signals, and assembles the ScanResult.
+ */
+import type { ScanOptions, ScanResult } from "../evidence/types";
+export declare function scanRepository(options: ScanOptions): Promise<ScanResult>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/scanner/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../src/scanner/aggregator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAQV,WAAW,EACX,UAAU,EAEX,MAAM,mBAAmB,CAAC;AA6M3B,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAkC9E"}

package/dist/scanner/aggregator.js

@@ -0,0 +1,200 @@
+/**
+ * Scanner aggregator — orchestrates file discovery and signal detection,
+ * deduplicates signals, and assembles the ScanResult.
+ */
+import { basename } from "node:path";
+import { hasImplementationSignals } from "../evidence/compliance-evaluation";
+import { runAllDetectors } from "./detectors";
+import { CONFIDENCE_RANK } from "./detectors/shared";
+import { discoverFiles } from "./discovery";
+const TOOL_VERSION = "0.1.0";
+function parseRootPackageJson(files) {
+    const pkgFile = files.find((f) => f.relativePath === "package.json");
+    if (!pkgFile)
+        return undefined;
+    try {
+        return JSON.parse(pkgFile.content);
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildRepoProfile(targetPath, pkg, files) {
+    const hasTs = files.some((f) => f.extension === ".ts" || f.extension === ".tsx");
+    const hasJs = files.some((f) => f.extension === ".js" || f.extension === ".jsx");
+    const languages = [];
+    if (hasTs)
+        languages.push("typescript");
+    if (hasJs)
+        languages.push("javascript");
+    let packageManager;
+    if (files.some((f) => f.relativePath === "pnpm-lock.yaml"))
+        packageManager = "pnpm";
+    else if (files.some((f) => f.relativePath === "yarn.lock"))
+        packageManager = "yarn";
+    else if (files.some((f) => f.relativePath === "package-lock.json"))
+        packageManager = "npm";
+    const isMonorepo = Boolean(pkg?.workspaces || files.some((f) => f.relativePath === "pnpm-workspace.yaml"));
+    return {
+        name: pkg?.name ?? basename(targetPath),
+        version: pkg?.version,
+        description: pkg?.description,
+        license: pkg?.license,
+        isMonorepo,
+        packageManager,
+        languages,
+    };
+}
+function inferAppTypes(signals) {
+    const types = new Set();
+    const has = (id) => signals.some((s) => s.id === id);
+    const hasCategory = (cat) => signals.some((s) => s.category === cat);
+    if (has("framework-nextjs") || has("framework-react"))
+        types.add("web-app");
+    if (has("framework-express") ||
+        has("framework-fastify") ||
+        has("framework-nestjs") ||
+        has("framework-hono") ||
+        has("framework-elysia"))
+        types.add("api-server");
+    if (hasCategory("local-inference") || hasCategory("ai-provider"))
+        if (signals.some((s) => s.name.toLowerCase().includes("chat")))
+            types.add("chatbot");
+    if (hasCategory("training"))
+        types.add("ml-pipeline");
+    if (types.size === 0)
+        types.add("unknown");
+    return [...types];
+}
+/** Merge signals with the same ID: keep highest confidence, combine evidence */
+function deduplicateSignals(signals) {
+    const map = new Map();
+    for (const signal of signals) {
+        const existing = map.get(signal.id);
+        if (!existing) {
+            map.set(signal.id, { ...signal, evidence: [...signal.evidence] });
+            continue;
+        }
+        // Merge evidence (use Set for O(1) dedup instead of O(n) .some())
+        const seen = new Set(existing.evidence.map((e) => `${e.file}:${e.line ?? ""}`));
+        for (const ev of signal.evidence) {
+            const key = `${ev.file}:${ev.line ?? ""}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                existing.evidence.push(ev);
+            }
+        }
+        // Upgrade confidence
+        if (CONFIDENCE_RANK[signal.confidence] > CONFIDENCE_RANK[existing.confidence]) {
+            existing.confidence = signal.confidence;
+        }
+    }
+    return [...map.values()];
+}
+function annotateEvidenceProvenance(signals, files) {
+    const provenanceByPath = new Map();
+    for (const file of files) {
+        provenanceByPath.set(file.relativePath, file.provenance);
+    }
+    return signals.map((signal) => ({
+        ...signal,
+        evidence: signal.evidence.map((evidence) => ({
+            ...evidence,
+            provenance: evidence.provenance ?? provenanceByPath.get(evidence.file) ?? "runtime",
+        })),
+    }));
+}
+function generateOpenQuestions(signals) {
+    const questions = [];
+    const hasAI = signals.some((s) => s.category === "ai-provider" ||
+        s.category === "ai-framework" ||
+        s.category === "local-inference");
+    if (hasAI) {
+        questions.push({
+            id: "oq-market-placement",
+            question: "Is this AI system placed on the EU market or used within the EU?",
+            context: "The EU AI Act applies to AI systems placed on or put into service in the EU market.",
+            relatedSignalIds: signals.filter((s) => s.category.startsWith("ai-")).map((s) => s.id),
+            suggestedAction: "Determine your system's geographic scope and market placement.",
+        });
+        questions.push({
+            id: "oq-intended-purpose",
+            question: "What is the intended purpose of this AI system?",
+            context: "Risk classification under the EU AI Act depends on the system's intended purpose and deployment context, which cannot be determined from code alone.",
+            relatedSignalIds: [],
+            suggestedAction: "Use the EuConform wizard to complete your risk assessment with human-provided context.",
+        });
+        questions.push({
+            id: "oq-provider-role",
+            question: "Are you a provider, deployer, or importer of this AI system?",
+            context: "Different roles under Art. 3 carry different obligations. A scanner cannot determine your organizational role.",
+            relatedSignalIds: [],
+            suggestedAction: "Clarify your role in the AI value chain to determine applicable obligations.",
+        });
+    }
+    const hasGpaiSignals = signals.some((s) => s.category === "ai-provider" || s.id.includes("langchain") || s.id.includes("llamaindex"));
+    if (hasGpaiSignals) {
+        questions.push({
+            id: "oq-gpai-downstream",
+            question: "Are you using a general-purpose AI model? Do you provide downstream access to others?",
+            context: "GPAI obligations (Art. 53-55) apply to providers of general-purpose AI models. Using an API does not automatically make you a GPAI provider.",
+            relatedSignalIds: signals.filter((s) => s.category === "ai-provider").map((s) => s.id),
+            suggestedAction: "Determine whether you are a GPAI provider or deployer.",
+        });
+    }
+    const hasNoDisclosure = !hasImplementationSignals(signals, ["compliance-disclosure"]);
+    if (hasAI && hasNoDisclosure) {
+        questions.push({
+            id: "oq-disclosure-missing",
+            question: "Does your system inform users that they are interacting with AI?",
+            context: "No AI disclosure signals were found in the codebase. Art. 50 requires transparency for AI systems interacting with natural persons.",
+            relatedSignalIds: [],
+            suggestedAction: "Add explicit AI disclosure in user-facing entry points.",
+        });
+    }
+    return questions;
+}
+function buildSignalSummary(signals) {
+    const byCategory = {};
+    const byConfidence = {
+        high: 0,
+        medium: 0,
+        low: 0,
+    };
+    for (const s of signals) {
+        byCategory[s.category] = (byCategory[s.category] ?? 0) + 1;
+        byConfidence[s.confidence]++;
+    }
+    return { total: signals.length, byCategory, byConfidence };
+}
+export async function scanRepository(options) {
+    const startTime = Date.now();
+    const scope = options.scope ?? "production";
+    const discovery = await discoverFiles(options);
+    const allFiles = discovery.files;
+    const rootPkg = parseRootPackageJson(allFiles);
+    // Run detectors on all files
+    const rawSignals = [];
+    for (const file of allFiles) {
+        const ctx = { file, lines: file.content.split("\n"), allFiles, rootPackageJson: rootPkg };
+        rawSignals.push(...runAllDetectors(ctx));
+    }
+    const signals = annotateEvidenceProvenance(deduplicateSignals(rawSignals), allFiles);
+    const openQuestions = generateOpenQuestions(signals);
+    return {
+        meta: {
+            scannedAt: new Date().toISOString(),
+            scanDurationMs: Date.now() - startTime,
+            toolVersion: TOOL_VERSION,
+            targetPath: options.targetPath,
+            scanScope: scope,
+            filesScanned: allFiles.length,
+            filesSkipped: discovery.skippedCount,
+        },
+        repo: buildRepoProfile(options.targetPath, rootPkg, allFiles),
+        appTypes: inferAppTypes(signals),
+        signals,
+        openQuestions,
+        signalSummary: buildSignalSummary(signals),
+    };
+}

package/dist/scanner/detectors/ai-framework-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectAiFrameworkSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=ai-framework-detector.d.ts.map

package/dist/scanner/detectors/ai-framework-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-framework-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/ai-framework-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAwD5E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAqC/E"}

package/dist/scanner/detectors/ai-framework-detector.js

@@ -0,0 +1,74 @@
+import { SOURCE_EXTENSIONS } from "./shared";
+const FRAMEWORK_IMPORTS = [
+    {
+        id: "ai-framework-langchain",
+        name: "LangChain",
+        importPattern: /(?:from\s+['"]langchain[/'"]|require\s*\(\s*['"]langchain[/'"])/,
+    },
+    {
+        id: "ai-framework-langchain-core",
+        name: "LangChain Core",
+        importPattern: /(?:from\s+['"]@langchain\/[^'"]+['"]|require\s*\(\s*['"]@langchain\/[^'"]+['"])/,
+    },
+    {
+        id: "ai-framework-llamaindex",
+        name: "LlamaIndex",
+        importPattern: /(?:from\s+['"]llamaindex[/'"]|require\s*\(\s*['"]llamaindex[/'"])/,
+    },
+    {
+        id: "ai-framework-transformers",
+        name: "Transformers.js",
+        importPattern: /(?:from\s+['"]@xenova\/transformers['"]|require\s*\(\s*['"]@xenova\/transformers['"])/,
+    },
+    {
+        id: "ai-framework-vercel-ai",
+        name: "Vercel AI SDK",
+        // Only match Vercel AI SDK subpath imports (ai/react, ai/rsc) to avoid false positives
+        // on generic "ai" package name. Bare "ai" import matched only with package.json cross-check.
+        importPattern: /(?:from\s+['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"']|require\s*\(\s*['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"])/,
+    },
+    {
+        id: "ai-framework-huggingface",
+        name: "HuggingFace",
+        importPattern: /(?:from\s+['"]@huggingface\/[^'"]+['"]|require\s*\(\s*['"]@huggingface\/[^'"]+['"])/,
+    },
+];
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectAiFrameworkSignals(ctx) {
+    const { file } = ctx;
+    if (!SOURCE_EXTENSIONS.has(file.extension))
+        return [];
+    const lines = ctx.lines;
+    const signalMap = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        const lineNum = i + 1;
+        for (const framework of FRAMEWORK_IMPORTS) {
+            if (framework.importPattern.test(line)) {
+                const existing = signalMap.get(framework.id);
+                const evidence = {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                };
+                if (existing) {
+                    existing.evidence.push(evidence);
+                }
+                else {
+                    signalMap.set(framework.id, {
+                        id: framework.id,
+                        name: framework.name,
+                        category: "ai-framework",
+                        confidence: "medium",
+                        evidence: [evidence],
+                    });
+                }
+            }
+        }
+    }
+    return Array.from(signalMap.values());
+}

package/dist/scanner/detectors/ai-provider-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectAiProviderSignals(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=ai-provider-detector.d.ts.map

package/dist/scanner/detectors/ai-provider-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/ai-provider-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAyE5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAoC9E"}

package/dist/scanner/detectors/ai-provider-detector.js

@@ -0,0 +1,100 @@
+import { SOURCE_EXTENSIONS } from "./shared";
+const PROVIDER_IMPORTS = [
+    {
+        id: "ai-provider-openai",
+        name: "OpenAI SDK",
+        importPattern: /(?:from\s+['"]openai['"]|require\s*\(\s*['"]openai['"])/,
+    },
+    {
+        id: "ai-provider-anthropic",
+        name: "Anthropic SDK",
+        importPattern: /(?:from\s+['"]@anthropic-ai\/sdk['"]|require\s*\(\s*['"]@anthropic-ai\/sdk['"])/,
+    },
+    {
+        id: "ai-provider-cohere",
+        name: "Cohere SDK",
+        importPattern: /(?:from\s+['"]cohere-ai['"]|require\s*\(\s*['"]cohere-ai['"])/,
+    },
+    {
+        id: "ai-provider-google-genai",
+        name: "Google Generative AI",
+        importPattern: /(?:from\s+['"]@google\/generative-ai['"]|require\s*\(\s*['"]@google\/generative-ai['"])/,
+    },
+    {
+        id: "ai-provider-mistral",
+        name: "Mistral AI SDK",
+        importPattern: /(?:from\s+['"]@mistralai\/mistralai['"]|require\s*\(\s*['"]@mistralai\/mistralai['"])/,
+    },
+];
+const API_ENDPOINTS = [
+    {
+        id: "ai-provider-openai-api",
+        name: "OpenAI API endpoint",
+        pattern: /api\.openai\.com/,
+    },
+    {
+        id: "ai-provider-anthropic-api",
+        name: "Anthropic API endpoint",
+        pattern: /api\.anthropic\.com/,
+    },
+    {
+        id: "ai-provider-cohere-api",
+        name: "Cohere API endpoint",
+        pattern: /api\.cohere\.ai/,
+    },
+];
+// ---------------------------------------------------------------------------
+// Detector
+// ---------------------------------------------------------------------------
+export function detectAiProviderSignals(ctx) {
+    const { file } = ctx;
+    if (!SOURCE_EXTENSIONS.has(file.extension))
+        return [];
+    const lines = ctx.lines;
+    const signalMap = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        const lineNum = i + 1;
+        // Check import/require patterns
+        for (const provider of PROVIDER_IMPORTS) {
+            if (provider.importPattern.test(line)) {
+                addEvidence(signalMap, provider.id, provider.name, "medium", {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                });
+            }
+        }
+        // Check API endpoint URLs
+        for (const endpoint of API_ENDPOINTS) {
+            if (endpoint.pattern.test(line)) {
+                addEvidence(signalMap, endpoint.id, endpoint.name, "medium", {
+                    file: file.relativePath,
+                    line: lineNum,
+                    snippet: line.trim().slice(0, 200),
+                });
+            }
+        }
+    }
+    return Array.from(signalMap.values());
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function addEvidence(map, id, name, confidence, evidence) {
+    const existing = map.get(id);
+    if (existing) {
+        existing.evidence.push(evidence);
+    }
+    else {
+        map.set(id, {
+            id,
+            name,
+            category: "ai-provider",
+            confidence,
+            evidence: [evidence],
+        });
+    }
+}

package/dist/scanner/detectors/compliance-detector.d.ts

@@ -0,0 +1,3 @@
+import type { DetectedSignal, DetectorContext } from "../../evidence/types";
+export declare function detectCompliance(ctx: DetectorContext): DetectedSignal[];
+//# sourceMappingURL=compliance-detector.d.ts.map

package/dist/scanner/detectors/compliance-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/compliance-detector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAGhB,MAAM,sBAAsB,CAAC;AAqM9B,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CA2BvE"}