@nobulex/eu-compliance 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +120 -0
- package/dist/index.mjs +95 -0
- package/package.json +21 -0
- package/tsup.config.ts +8 -0
package/dist/index.js
ADDED
|
@@ -0,0 +1,120 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __defProp = Object.defineProperty;
|
|
3
|
+
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
4
|
+
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
5
|
+
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
6
|
+
var __export = (target, all) => {
|
|
7
|
+
for (var name in all)
|
|
8
|
+
__defProp(target, name, { get: all[name], enumerable: true });
|
|
9
|
+
};
|
|
10
|
+
var __copyProps = (to, from, except, desc) => {
|
|
11
|
+
if (from && typeof from === "object" || typeof from === "function") {
|
|
12
|
+
for (let key of __getOwnPropNames(from))
|
|
13
|
+
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
14
|
+
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
|
15
|
+
}
|
|
16
|
+
return to;
|
|
17
|
+
};
|
|
18
|
+
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
19
|
+
|
|
20
|
+
// src/index.ts
|
|
21
|
+
var index_exports = {};
|
|
22
|
+
__export(index_exports, {
|
|
23
|
+
computeEUCompliance: () => computeEUCompliance
|
|
24
|
+
});
|
|
25
|
+
module.exports = __toCommonJS(index_exports);
|
|
26
|
+
var ARTICLE_MAP = {
|
|
27
|
+
"Art.10": {
|
|
28
|
+
title: "Risk Management",
|
|
29
|
+
requirement: "Identify and analyze known and foreseeable risks",
|
|
30
|
+
capabilities: [
|
|
31
|
+
{ package: "@nobulex/core", feature: "Covenant constraints", coverage: "full" },
|
|
32
|
+
{ package: "@nobulex/canary", feature: "Canary tests probe boundaries", coverage: "full" },
|
|
33
|
+
{ package: "@nobulex/temporal", feature: "Covenant evolution", coverage: "supporting" }
|
|
34
|
+
]
|
|
35
|
+
},
|
|
36
|
+
"Art.11": {
|
|
37
|
+
title: "Data Governance",
|
|
38
|
+
requirement: "Data provenance and bias monitoring",
|
|
39
|
+
capabilities: [
|
|
40
|
+
{ package: "@nobulex/enforcement", feature: "Behavioral provenance", coverage: "full" },
|
|
41
|
+
{ package: "@nobulex/canary", feature: "Discriminatory pattern tests", coverage: "partial" }
|
|
42
|
+
]
|
|
43
|
+
},
|
|
44
|
+
"Art.13": {
|
|
45
|
+
title: "Transparency and Explainability",
|
|
46
|
+
requirement: "Design for interpretability, documentation",
|
|
47
|
+
capabilities: [
|
|
48
|
+
{ package: "@nobulex/core", feature: "CCL human-readable", coverage: "full" },
|
|
49
|
+
{ package: "@nobulex/legal", feature: "LegalIdentityPackage", coverage: "full" }
|
|
50
|
+
]
|
|
51
|
+
},
|
|
52
|
+
"Art.14": {
|
|
53
|
+
title: "Human Oversight",
|
|
54
|
+
requirement: "Effective human oversight, override",
|
|
55
|
+
capabilities: [
|
|
56
|
+
{ package: "@nobulex/ccl", feature: "require/deny rules", coverage: "full" },
|
|
57
|
+
{ package: "@nobulex/breach", feature: "Breach attestation", coverage: "supporting" }
|
|
58
|
+
]
|
|
59
|
+
},
|
|
60
|
+
"Art.15": {
|
|
61
|
+
title: "Accuracy, Robustness, Cybersecurity",
|
|
62
|
+
requirement: "Adversarial robustness, fallback",
|
|
63
|
+
capabilities: [
|
|
64
|
+
{ package: "@nobulex/robustness", feature: "Fuzz testing", coverage: "full" },
|
|
65
|
+
{ package: "@nobulex/crypto", feature: "Ed25519, constant-time", coverage: "full" }
|
|
66
|
+
]
|
|
67
|
+
},
|
|
68
|
+
"Art.17": {
|
|
69
|
+
title: "Record-Keeping (Logs)",
|
|
70
|
+
requirement: "Automatic logging, traceability",
|
|
71
|
+
capabilities: [
|
|
72
|
+
{ package: "@nobulex/enforcement", feature: "Hash-chained audit trail", coverage: "full" },
|
|
73
|
+
{ package: "@nobulex/canary", feature: "Canary tests", coverage: "supporting" }
|
|
74
|
+
]
|
|
75
|
+
}
|
|
76
|
+
};
|
|
77
|
+
function computeEUCompliance(covenant, signals) {
|
|
78
|
+
const articles = [];
|
|
79
|
+
const gaps = [];
|
|
80
|
+
const recommendations = [];
|
|
81
|
+
const hasCovenant = covenant != null && covenant.id != null;
|
|
82
|
+
const sig = signals ?? {};
|
|
83
|
+
for (const [id, meta] of Object.entries(ARTICLE_MAP)) {
|
|
84
|
+
const satisfied = hasCovenant && meta.capabilities.length > 0;
|
|
85
|
+
articles.push({
|
|
86
|
+
article: { id, title: meta.title, requirement: meta.requirement },
|
|
87
|
+
satisfied,
|
|
88
|
+
capabilities: meta.capabilities,
|
|
89
|
+
gap: satisfied ? void 0 : `Missing: ${meta.requirement}`
|
|
90
|
+
});
|
|
91
|
+
if (!satisfied) {
|
|
92
|
+
gaps.push(`${id}: ${meta.requirement}`);
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
let score = hasCovenant ? 40 : 0;
|
|
96
|
+
score += sig.hasAgentsMd ? 10 : 0;
|
|
97
|
+
score += sig.hasMcpConfig ? 10 : 0;
|
|
98
|
+
score += sig.hasKovaDep ? 15 : 0;
|
|
99
|
+
score += articles.filter((a) => a.satisfied).length * 5;
|
|
100
|
+
score = Math.min(100, score);
|
|
101
|
+
if (score < 50) {
|
|
102
|
+
recommendations.push("Run `kova init` to create covenants and stele.config.json");
|
|
103
|
+
}
|
|
104
|
+
if (!sig.hasKovaDep && sig.hasMcpConfig) {
|
|
105
|
+
recommendations.push('Add kova: npm install kova \u2014 wrap MCP server with withKova(server, "data-isolation")');
|
|
106
|
+
}
|
|
107
|
+
if (score < 100) {
|
|
108
|
+
recommendations.push("See docs/eu-ai-act-mapping.md for full Article-to-Kova mapping");
|
|
109
|
+
}
|
|
110
|
+
return {
|
|
111
|
+
readinessScore: Math.round(score),
|
|
112
|
+
articles,
|
|
113
|
+
gaps,
|
|
114
|
+
recommendations
|
|
115
|
+
};
|
|
116
|
+
}
|
|
117
|
+
// Annotate the CommonJS export names for ESM import in node:
|
|
118
|
+
0 && (module.exports = {
|
|
119
|
+
computeEUCompliance
|
|
120
|
+
});
|
package/dist/index.mjs
ADDED
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
// src/index.ts
|
|
2
|
+
var ARTICLE_MAP = {
|
|
3
|
+
"Art.10": {
|
|
4
|
+
title: "Risk Management",
|
|
5
|
+
requirement: "Identify and analyze known and foreseeable risks",
|
|
6
|
+
capabilities: [
|
|
7
|
+
{ package: "@nobulex/core", feature: "Covenant constraints", coverage: "full" },
|
|
8
|
+
{ package: "@nobulex/canary", feature: "Canary tests probe boundaries", coverage: "full" },
|
|
9
|
+
{ package: "@nobulex/temporal", feature: "Covenant evolution", coverage: "supporting" }
|
|
10
|
+
]
|
|
11
|
+
},
|
|
12
|
+
"Art.11": {
|
|
13
|
+
title: "Data Governance",
|
|
14
|
+
requirement: "Data provenance and bias monitoring",
|
|
15
|
+
capabilities: [
|
|
16
|
+
{ package: "@nobulex/enforcement", feature: "Behavioral provenance", coverage: "full" },
|
|
17
|
+
{ package: "@nobulex/canary", feature: "Discriminatory pattern tests", coverage: "partial" }
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"Art.13": {
|
|
21
|
+
title: "Transparency and Explainability",
|
|
22
|
+
requirement: "Design for interpretability, documentation",
|
|
23
|
+
capabilities: [
|
|
24
|
+
{ package: "@nobulex/core", feature: "CCL human-readable", coverage: "full" },
|
|
25
|
+
{ package: "@nobulex/legal", feature: "LegalIdentityPackage", coverage: "full" }
|
|
26
|
+
]
|
|
27
|
+
},
|
|
28
|
+
"Art.14": {
|
|
29
|
+
title: "Human Oversight",
|
|
30
|
+
requirement: "Effective human oversight, override",
|
|
31
|
+
capabilities: [
|
|
32
|
+
{ package: "@nobulex/ccl", feature: "require/deny rules", coverage: "full" },
|
|
33
|
+
{ package: "@nobulex/breach", feature: "Breach attestation", coverage: "supporting" }
|
|
34
|
+
]
|
|
35
|
+
},
|
|
36
|
+
"Art.15": {
|
|
37
|
+
title: "Accuracy, Robustness, Cybersecurity",
|
|
38
|
+
requirement: "Adversarial robustness, fallback",
|
|
39
|
+
capabilities: [
|
|
40
|
+
{ package: "@nobulex/robustness", feature: "Fuzz testing", coverage: "full" },
|
|
41
|
+
{ package: "@nobulex/crypto", feature: "Ed25519, constant-time", coverage: "full" }
|
|
42
|
+
]
|
|
43
|
+
},
|
|
44
|
+
"Art.17": {
|
|
45
|
+
title: "Record-Keeping (Logs)",
|
|
46
|
+
requirement: "Automatic logging, traceability",
|
|
47
|
+
capabilities: [
|
|
48
|
+
{ package: "@nobulex/enforcement", feature: "Hash-chained audit trail", coverage: "full" },
|
|
49
|
+
{ package: "@nobulex/canary", feature: "Canary tests", coverage: "supporting" }
|
|
50
|
+
]
|
|
51
|
+
}
|
|
52
|
+
};
|
|
53
|
+
function computeEUCompliance(covenant, signals) {
|
|
54
|
+
const articles = [];
|
|
55
|
+
const gaps = [];
|
|
56
|
+
const recommendations = [];
|
|
57
|
+
const hasCovenant = covenant != null && covenant.id != null;
|
|
58
|
+
const sig = signals ?? {};
|
|
59
|
+
for (const [id, meta] of Object.entries(ARTICLE_MAP)) {
|
|
60
|
+
const satisfied = hasCovenant && meta.capabilities.length > 0;
|
|
61
|
+
articles.push({
|
|
62
|
+
article: { id, title: meta.title, requirement: meta.requirement },
|
|
63
|
+
satisfied,
|
|
64
|
+
capabilities: meta.capabilities,
|
|
65
|
+
gap: satisfied ? void 0 : `Missing: ${meta.requirement}`
|
|
66
|
+
});
|
|
67
|
+
if (!satisfied) {
|
|
68
|
+
gaps.push(`${id}: ${meta.requirement}`);
|
|
69
|
+
}
|
|
70
|
+
}
|
|
71
|
+
let score = hasCovenant ? 40 : 0;
|
|
72
|
+
score += sig.hasAgentsMd ? 10 : 0;
|
|
73
|
+
score += sig.hasMcpConfig ? 10 : 0;
|
|
74
|
+
score += sig.hasKovaDep ? 15 : 0;
|
|
75
|
+
score += articles.filter((a) => a.satisfied).length * 5;
|
|
76
|
+
score = Math.min(100, score);
|
|
77
|
+
if (score < 50) {
|
|
78
|
+
recommendations.push("Run `kova init` to create covenants and stele.config.json");
|
|
79
|
+
}
|
|
80
|
+
if (!sig.hasKovaDep && sig.hasMcpConfig) {
|
|
81
|
+
recommendations.push('Add kova: npm install kova \u2014 wrap MCP server with withKova(server, "data-isolation")');
|
|
82
|
+
}
|
|
83
|
+
if (score < 100) {
|
|
84
|
+
recommendations.push("See docs/eu-ai-act-mapping.md for full Article-to-Kova mapping");
|
|
85
|
+
}
|
|
86
|
+
return {
|
|
87
|
+
readinessScore: Math.round(score),
|
|
88
|
+
articles,
|
|
89
|
+
gaps,
|
|
90
|
+
recommendations
|
|
91
|
+
};
|
|
92
|
+
}
|
|
93
|
+
export {
|
|
94
|
+
computeEUCompliance
|
|
95
|
+
};
|
package/package.json
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@nobulex/eu-compliance",
|
|
3
|
+
"version": "0.2.0",
|
|
4
|
+
"description": "EU AI Act compliance checker — fastest path to Aug 2026 compliance for agentic systems",
|
|
5
|
+
"main": "dist/index.js",
|
|
6
|
+
"types": "dist/index.d.ts",
|
|
7
|
+
"scripts": {
|
|
8
|
+
"build": "tsup src/index.ts --format cjs,esm",
|
|
9
|
+
"test": "vitest run",
|
|
10
|
+
"prepublishOnly": "npm run build"
|
|
11
|
+
},
|
|
12
|
+
"dependencies": {
|
|
13
|
+
"@nobulex/core": "0.2.0",
|
|
14
|
+
"@nobulex/legal": "0.2.0",
|
|
15
|
+
"@nobulex/enforcement": "0.2.0",
|
|
16
|
+
"@nobulex/canary": "0.2.0"
|
|
17
|
+
},
|
|
18
|
+
"keywords": ["nobulex", "kova", "eu-ai-act", "compliance", "regulation"],
|
|
19
|
+
"license": "MIT",
|
|
20
|
+
"engines": { "node": ">=18" }
|
|
21
|
+
}
|