@euconform/cli 1.0.0 → 1.1.0

package/dist/index.js

@@ -1,29 +1,16 @@
 #!/usr/bin/env node
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
+import {
+  runBiasTest
+} from "./chunk-F6VBKHY4.js";
+import "./chunk-FEBJZMWY.js";
+import "./chunk-JQTB43B2.js";
+import {
+  formatBiasSeverity
+} from "./chunk-AYXSWY3I.js";
+import {
+  __commonJS,
+  __toESM
+} from "./chunk-JSBRDJBE.js";
 
 // ../../node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
 var require_ignore = __commonJS({
@@ -484,11 +471,137 @@ var require_ignore = __commonJS({
 });
 
 // src/index.ts
-import { defineCommand as defineCommand3, runMain } from "citty";
+import { defineCommand as defineCommand4, runMain } from "citty";
+
+// src/commands/bias.ts
+import { mkdir, stat, writeFile } from "fs/promises";
+import { resolve } from "path";
+import { defineCommand } from "citty";
+import consola2 from "consola";
+
+// src/utils/exit.ts
+import consola from "consola";
+function exitWithError(message) {
+  consola.error(message);
+  process.exit(1);
+}
+
+// src/commands/bias.ts
+var VALID_LANGS = /* @__PURE__ */ new Set(["en", "de"]);
+var VALID_OUTPUTS = /* @__PURE__ */ new Set(["json", "md", "all"]);
+var bias_default = defineCommand({
+  meta: {
+    name: "bias",
+    description: "Run CrowS-Pairs bias test on an Ollama model"
+  },
+  args: {
+    model: {
+      type: "positional",
+      description: "Ollama model name (e.g. llama3.2, mistral:7b)",
+      required: true
+    },
+    lang: {
+      type: "string",
+      description: "Dataset language: en or de",
+      default: "de"
+    },
+    url: {
+      type: "string",
+      description: "Ollama base URL",
+      default: "http://localhost:11434"
+    },
+    output: {
+      type: "string",
+      description: "Output format: json, md, or all",
+      default: "json"
+    },
+    "out-dir": {
+      type: "string",
+      description: "Output directory",
+      default: "./.euconform"
+    }
+  },
+  async run({ args }) {
+    const lang = args.lang;
+    const output = args.output;
+    const outDir = resolve(args["out-dir"]);
+    const model = args.model;
+    const url = args.url;
+    if (!VALID_LANGS.has(lang)) {
+      exitWithError(`Invalid language: ${lang}. Use one of: en, de.`);
+    }
+    if (!VALID_OUTPUTS.has(output)) {
+      exitWithError(`Invalid output format: ${output}. Use one of: json, md, all.`);
+    }
+    const result = await runBiasTest({
+      model,
+      lang,
+      url
+    });
+    try {
+      await stat(outDir);
+    } catch {
+      await mkdir(outDir, { recursive: true });
+    }
+    const biasOutput = {
+      schemaVersion: "euconform.bias.v1",
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      model,
+      dataset: `crows_pairs_${lang}`,
+      result: {
+        score: result.score,
+        method: result.method,
+        pairsAnalyzed: result.pairsAnalyzed,
+        stereotypicalPreference: result.stereotypicalPreference
+      }
+    };
+    const severity = formatBiasSeverity(result.score);
+    if (output === "json" || output === "all") {
+      const jsonPath = resolve(outDir, "euconform.bias.json");
+      await writeFile(jsonPath, JSON.stringify(biasOutput, null, 2));
+      consola2.success(`Written: ${jsonPath}`);
+    }
+    if (output === "md" || output === "all") {
+      const mdContent = [
+        "# EuConform Bias Test Report",
+        "",
+        `**Model:** ${model}`,
+        `**Dataset:** CrowS-Pairs (${lang.toUpperCase()})`,
+        `**Generated:** ${biasOutput.generatedAt}`,
+        "",
+        "## Results",
+        "",
+        "| Metric | Value |",
+        "|--------|-------|",
+        `| Bias Score | ${result.score.toFixed(4)} |`,
+        `| Severity | ${severity} |`,
+        `| Method | ${result.method} |`,
+        `| Pairs Analyzed | ${result.pairsAnalyzed} |`,
+        `| Stereotypical Preference | ${result.stereotypicalPreference.toFixed(1)}% |`,
+        "",
+        "## Thresholds",
+        "",
+        "| Range | Classification |",
+        "|-------|---------------|",
+        "| < 0.1 | Minimal Bias |",
+        "| 0.1 - 0.3 | Light Bias |",
+        "| > 0.3 | Strong Bias |",
+        "",
+        "---",
+        "",
+        "*Generated by [EuConform CLI](https://github.com/Hiepler/EuConform) using CrowS-Pairs methodology (Nangia et al., 2020)*",
+        ""
+      ].join("\n");
+      const mdPath = resolve(outDir, "euconform.bias.md");
+      await writeFile(mdPath, mdContent);
+      consola2.success(`Written: ${mdPath}`);
+    }
+  }
+});
 
 // src/commands/scan.ts
-import { stat as stat2 } from "fs/promises";
-import { resolve as resolve2 } from "path";
+import { stat as stat3 } from "fs/promises";
+import { resolve as resolve3 } from "path";
 
 // ../core/src/evidence/compliance-evaluation.ts
 var IMPLEMENTATION_PROVENANCE = /* @__PURE__ */ new Set(["runtime", "config"]);
@@ -1409,8 +1522,67 @@ function validateCiReport(data) {
 }
 var VALID_BUNDLE_ROLES = /* @__PURE__ */ new Set(["report", "aibom", "ci", "summary"]);
 var SHA256_HEX = /^[a-f0-9]{64}$/;
-function validateScanBundle(data) {
-  const obj = assertObject(data, "bundle");
+function readBundleArtifactFields(raw, index) {
+  const scope = "bundle artifact";
+  const role = requireField(raw, "role", "string", scope, `artifacts[${index}].role`);
+  const fileName = requireField(
+    raw,
+    "fileName",
+    "string",
+    scope,
+    `artifacts[${index}].fileName`
+  );
+  const sha256 = requireField(
+    raw,
+    "sha256",
+    "string",
+    scope,
+    `artifacts[${index}].sha256`
+  );
+  const required = requireField(
+    raw,
+    "required",
+    "boolean",
+    scope,
+    `artifacts[${index}].required`
+  );
+  const declaredSchemaVersion = raw.schemaVersion;
+  if (declaredSchemaVersion !== void 0 && typeof declaredSchemaVersion !== "string") {
+    throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
+  }
+  if (raw.mimeType !== void 0 && typeof raw.mimeType !== "string") {
+    throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
+  }
+  return {
+    role,
+    fileName,
+    sha256,
+    required,
+    declaredSchemaVersion,
+    mimeType: raw.mimeType
+  };
+}
+function assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor) {
+  const { role, fileName, sha256, declaredSchemaVersion } = fields;
+  if (!VALID_BUNDLE_ROLES.has(role)) {
+    throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
+  }
+  if (!SHA256_HEX.test(sha256)) {
+    throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
+  }
+  if (seenRoles.has(role)) {
+    throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
+  }
+  if (seenFiles.has(fileName)) {
+    throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
+  }
+  if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
+    throw new Error(
+      `Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`
+    );
+  }
+}
+function validateBundleHeader(obj) {
   requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
   requireField(obj, "generatedAt", "string", "bundle");
   const tool = requireField(obj, "tool", "object", "bundle");
@@ -1419,6 +1591,10 @@ function validateScanBundle(data) {
   const target = requireField(obj, "target", "object", "bundle");
   requireField(target, "name", "string", "bundle", "target.name");
   requireField(target, "rootPath", "string", "bundle", "target.rootPath");
+}
+function validateScanBundle(data) {
+  const obj = assertObject(data, "bundle");
+  validateBundleHeader(obj);
   const artifacts = requireField(obj, "artifacts", "array", "bundle");
   if (artifacts.length === 0) {
     throw new Error("Invalid bundle: 'artifacts' must contain at least one artifact");
@@ -1428,63 +1604,13 @@ function validateScanBundle(data) {
   const bundleMajor = majorVersion("euconform.bundle.v1");
   let hasRequiredReport = false;
   for (let index = 0; index < artifacts.length; index++) {
-    const artifact = assertObject(artifacts[index], "bundle artifact");
-    const role = requireField(
-      artifact,
-      "role",
-      "string",
-      "bundle artifact",
-      `artifacts[${index}].role`
-    );
-    const fileName = requireField(
-      artifact,
-      "fileName",
-      "string",
-      "bundle artifact",
-      `artifacts[${index}].fileName`
-    );
-    const sha256 = requireField(
-      artifact,
-      "sha256",
-      "string",
-      "bundle artifact",
-      `artifacts[${index}].sha256`
-    );
-    const required = requireField(
-      artifact,
-      "required",
-      "boolean",
-      "bundle artifact",
-      `artifacts[${index}].required`
-    );
-    if (!VALID_BUNDLE_ROLES.has(role)) {
-      throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
-    }
-    if (!SHA256_HEX.test(sha256)) {
-      throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
-    }
-    if (seenRoles.has(role)) {
-      throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
-    }
-    if (seenFiles.has(fileName)) {
-      throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
-    }
-    seenRoles.add(role);
-    seenFiles.add(fileName);
-    const declaredSchemaVersion = artifact.schemaVersion;
-    if (declaredSchemaVersion !== void 0 && typeof declaredSchemaVersion !== "string") {
-      throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
-    }
-    if (artifact.mimeType !== void 0 && typeof artifact.mimeType !== "string") {
-      throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
-    }
-    if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
-      throw new Error(
-        `Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`
-      );
-    }
-    if (role === "report") {
-      hasRequiredReport = required;
+    const raw = assertObject(artifacts[index], "bundle artifact");
+    const fields = readBundleArtifactFields(raw, index);
+    assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor);
+    seenRoles.add(fields.role);
+    seenFiles.add(fields.fileName);
+    if (fields.role === "report") {
+      hasRequiredReport = fields.required;
     }
   }
   if (!hasRequiredReport) {
@@ -2742,8 +2868,8 @@ function runAllDetectors(ctx) {
 
 // ../core/src/scanner/discovery.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFile, readdir, stat } from "fs/promises";
-import { basename as basename2, extname, join, resolve } from "path";
+import { readFile, readdir, stat as stat2 } from "fs/promises";
+import { basename as basename2, extname, join, resolve as resolve2 } from "path";
 var DEFAULT_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".json", ".md", ".yaml", ".yml"];
 var NAMED_FILE_PATTERNS = [
   /^package\.json$/,
@@ -2880,7 +3006,7 @@ function shouldProcessEntry(entry, targetPath, filterOpts) {
 }
 async function tryReadFile(absolutePath, entry, ext, provenance, maxSize) {
   try {
-    const fileStat = await stat(absolutePath);
+    const fileStat = await stat2(absolutePath);
     if (!fileStat.isFile() || fileStat.size === 0) return "ignore";
     if (fileStat.size > maxSize) return "skip";
     const content = await readFile(absolutePath, "utf-8");
@@ -2898,7 +3024,7 @@ async function tryReadFile(absolutePath, entry, ext, provenance, maxSize) {
 }
 function resolveOptions(options) {
   return {
-    targetPath: resolve(options.targetPath),
+    targetPath: resolve2(options.targetPath),
     scope: options.scope ?? DEFAULT_SCOPE,
     extensions: options.extensions ?? DEFAULT_EXTENSIONS,
     maxSize: options.maxFileSizeBytes ?? DEFAULT_MAX_FILE_SIZE,
@@ -3133,13 +3259,13 @@ async function scanRepository(options) {
 }
 
 // src/commands/scan.ts
-import { defineCommand } from "citty";
-import consola4 from "consola";
+import { defineCommand as defineCommand2 } from "citty";
+import consola6 from "consola";
 
 // src/output/ci.ts
-import { appendFile, mkdir, writeFile } from "fs/promises";
+import { appendFile, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { join as join2 } from "path";
-import consola from "consola";
+import consola3 from "consola";
 
 // src/utils/gap-priority.ts
 var GAP_PRIORITY_ORDER = {
@@ -3290,15 +3416,15 @@ function emitGitHubAnnotations(output) {
 }
 async function writeCiArtifacts(output, outputDir, failOn, mode, scanScope, baseArtifacts) {
   if (mode === "off") return null;
-  await mkdir(outputDir, { recursive: true });
+  await mkdir2(outputDir, { recursive: true });
   const ciReport = buildCiReport(output, failOn, scanScope, baseArtifacts);
   const reportPath = join2(outputDir, "euconform.ci.json");
   const summaryPath = join2(outputDir, "euconform.ci-summary.md");
-  await writeFile(reportPath, `${JSON.stringify(ciReport, null, 2)}
+  await writeFile2(reportPath, `${JSON.stringify(ciReport, null, 2)}
 `, "utf-8");
-  await writeFile(summaryPath, renderCiSummaryMarkdown(output, ciReport), "utf-8");
-  consola.success(`Written ${reportPath}`);
-  consola.success(`Written ${summaryPath}`);
+  await writeFile2(summaryPath, renderCiSummaryMarkdown(output, ciReport), "utf-8");
+  consola3.success(`Written ${reportPath}`);
+  consola3.success(`Written ${summaryPath}`);
   let githubStepSummaryPath;
   if (mode === "github") {
     emitGitHubAnnotations(output);
@@ -3307,14 +3433,14 @@ async function writeCiArtifacts(output, outputDir, failOn, mode, scanScope, base
       await appendFile(stepSummaryPath, `
 ${renderCiSummaryMarkdown(output, ciReport)}`, "utf-8");
       githubStepSummaryPath = stepSummaryPath;
-      consola.info(`Appended GitHub step summary: ${stepSummaryPath}`);
+      consola3.info(`Appended GitHub step summary: ${stepSummaryPath}`);
     }
   }
   return { reportPath, summaryPath, githubStepSummaryPath, baseArtifacts };
 }
 
 // src/output/terminal.ts
-import consola2 from "consola";
+import consola4 from "consola";
 var AREA_LABELS = {
   disclosure: "Disclosure & Transparency",
   biasTesting: "Bias Testing",
@@ -3335,56 +3461,56 @@ function printSignalCounts(complianceSignals) {
     byConfidence[area.confidence]++;
   }
   const total = Object.values(complianceSignals).length;
-  consola2.info(
+  consola4.info(
     `${total} compliance areas assessed (${byConfidence.high} high, ${byConfidence.medium} medium, ${byConfidence.low} low confidence)`
   );
 }
 function printComplianceOverview(complianceSignals) {
-  consola2.log("");
-  consola2.info("Compliance Overview:");
+  consola4.log("");
+  consola4.info("Compliance Overview:");
   for (const [key, group] of Object.entries(complianceSignals)) {
     const label = AREA_LABELS[key] ?? key;
     const icon = STATUS_ICONS[group.status] ?? "[??]";
-    consola2.log(`  ${icon} ${label.padEnd(28)} ${group.status} (${group.confidence})`);
+    consola4.log(`  ${icon} ${label.padEnd(28)} ${group.status} (${group.confidence})`);
   }
 }
 function printTopGaps(gaps) {
   if (gaps.length === 0) return;
-  consola2.log("");
-  consola2.warn(`Top gaps (${gaps.length} total):`);
+  consola4.log("");
+  consola4.warn(`Top gaps (${gaps.length} total):`);
   for (const gap of gaps.slice(0, 3)) {
-    consola2.log(`  - [${gap.priority}] ${gap.title}`);
+    consola4.log(`  - [${gap.priority}] ${gap.title}`);
   }
   if (gaps.length > 3) {
-    consola2.log(`  ... and ${gaps.length - 3} more`);
+    consola4.log(`  ... and ${gaps.length - 3} more`);
   }
 }
 function printTerminalSummary(output, outputDir) {
   const { report } = output;
-  consola2.box("EuConform Scan Complete");
+  consola4.box("EuConform Scan Complete");
   printSignalCounts(report.complianceSignals);
   const ai = report.aiFootprint;
-  consola2.info(
+  consola4.info(
     `AI detected: ${ai.usesAI ? "yes" : "no"}${ai.inferenceModes.length > 0 ? ` | Inference: ${ai.inferenceModes.join(", ")}` : ""}`
   );
   printComplianceOverview(report.complianceSignals);
   printTopGaps(report.gaps);
   const openCount = report.assessmentHints.openQuestions.length;
   if (openCount > 0) {
-    consola2.info(`${openCount} open question${openCount > 1 ? "s" : ""} for manual review`);
+    consola4.info(`${openCount} open question${openCount > 1 ? "s" : ""} for manual review`);
   }
-  consola2.log("");
-  consola2.success(`Output written to: ${outputDir}`);
-  consola2.info("Next steps:");
-  consola2.log("  - Review `euconform.report.json` and `euconform.summary.md`");
-  consola2.log("  - Complete role and risk classification in the EuConform web app");
-  consola2.log("  - Use `--ci github --fail-on <level>` to turn scans into CI checks");
+  consola4.log("");
+  consola4.success(`Output written to: ${outputDir}`);
+  consola4.info("Next steps:");
+  consola4.log("  - Review `euconform.report.json` and `euconform.summary.md`");
+  consola4.log("  - Complete role and risk classification in the EuConform web app");
+  consola4.log("  - Use `--ci github --fail-on <level>` to turn scans into CI checks");
 }
 
 // src/output/writer.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
 import { join as join3 } from "path";
-import consola3 from "consola";
+import consola5 from "consola";
 async function tryReadArtifact(outputDir, fileName) {
   try {
     const content = await readFile2(join3(outputDir, fileName), "utf-8");
@@ -3408,30 +3534,30 @@ async function writeBundleManifest(outputDir, metadata) {
     generatedAt: metadata.generatedAt
   });
   const bundlePath = join3(outputDir, "euconform.bundle.json");
-  await writeFile2(bundlePath, `${JSON.stringify(bundle, null, 2)}
+  await writeFile3(bundlePath, `${JSON.stringify(bundle, null, 2)}
 `, "utf-8");
-  consola3.success(`Written ${bundlePath}`);
+  consola5.success(`Written ${bundlePath}`);
   return bundlePath;
 }
 async function writeOutputFiles(output, outputDir, format) {
-  await mkdir2(outputDir, { recursive: true });
+  await mkdir3(outputDir, { recursive: true });
   const written = [];
   if (format === "json" || format === "all") {
     const reportContent = JSON.stringify(output.report, null, 2);
     const reportPath = join3(outputDir, "euconform.report.json");
-    await writeFile2(reportPath, reportContent, "utf-8");
-    consola3.success(`Written ${reportPath}`);
+    await writeFile3(reportPath, reportContent, "utf-8");
+    consola5.success(`Written ${reportPath}`);
     written.push({ fileName: "euconform.report.json", content: reportContent });
     const aibomContent = JSON.stringify(output.aibom, null, 2);
     const aibomPath = join3(outputDir, "euconform.aibom.json");
-    await writeFile2(aibomPath, aibomContent, "utf-8");
-    consola3.success(`Written ${aibomPath}`);
+    await writeFile3(aibomPath, aibomContent, "utf-8");
+    consola5.success(`Written ${aibomPath}`);
     written.push({ fileName: "euconform.aibom.json", content: aibomContent });
   }
   if (format === "md" || format === "all") {
     const mdPath = join3(outputDir, "euconform.summary.md");
-    await writeFile2(mdPath, output.summaryMarkdown, "utf-8");
-    consola3.success(`Written ${mdPath}`);
+    await writeFile3(mdPath, output.summaryMarkdown, "utf-8");
+    consola5.success(`Written ${mdPath}`);
     written.push({ fileName: "euconform.summary.md", content: output.summaryMarkdown });
   }
   if (written.some((artifact) => artifact.fileName === "euconform.report.json")) {
@@ -3468,8 +3594,8 @@ async function writeZipBundle(outputDir) {
   }
   const zipped = zipSync(zipData);
   const zipPath = join3(outputDir, "euconform.bundle.zip");
-  await writeFile2(zipPath, zipped);
-  consola3.success(`Written ${zipPath}`);
+  await writeFile3(zipPath, zipped);
+  consola5.success(`Written ${zipPath}`);
   return zipPath;
 }
 
@@ -3478,55 +3604,58 @@ var VALID_FORMATS = /* @__PURE__ */ new Set(["json", "md", "all"]);
 var VALID_SCOPES = /* @__PURE__ */ new Set(["production", "all"]);
 var FAIL_ON_LEVELS = ["none", "critical", "high", "medium", "low"];
 var VALID_CI_MODES = /* @__PURE__ */ new Set(["off", "github"]);
-async function validateAndParseArgs(args) {
-  const targetPath = resolve2(args.path);
+async function assertDirectoryExists(targetPath) {
   try {
-    const info = await stat2(targetPath);
+    const info = await stat3(targetPath);
     if (!info.isDirectory()) {
-      consola4.error(`Not a directory: ${targetPath}`);
-      process.exit(1);
+      exitWithError(`Not a directory: ${targetPath}`);
     }
   } catch {
-    consola4.error(`Path does not exist: ${targetPath}`);
-    process.exit(1);
+    exitWithError(`Path does not exist: ${targetPath}`);
   }
-  const format = args.format ?? "all";
-  const scope = args.scope ?? "production";
-  const failOn = args["fail-on"] ?? "none";
-  const ciMode = args.ci ?? "off";
-  if (!VALID_FORMATS.has(format)) {
-    consola4.error(`Invalid format: ${format}. Use one of: json, md, all.`);
-    process.exit(1);
+}
+function validateEnumArgs(args) {
+  if (!VALID_FORMATS.has(args.format)) {
+    exitWithError(`Invalid format: ${args.format}. Use one of: json, md, all.`);
   }
-  if (!VALID_SCOPES.has(scope)) {
-    consola4.error(`Invalid scope: ${scope}. Use one of: production, all.`);
-    process.exit(1);
+  if (!VALID_SCOPES.has(args.scope)) {
+    exitWithError(`Invalid scope: ${args.scope}. Use one of: production, all.`);
   }
-  if (!FAIL_ON_LEVELS.includes(failOn)) {
-    consola4.error(`Invalid fail-on level: ${failOn}. Use one of: ${FAIL_ON_LEVELS.join(", ")}.`);
-    process.exit(1);
+  if (!FAIL_ON_LEVELS.includes(args.failOn)) {
+    exitWithError(
+      `Invalid fail-on level: ${args.failOn}. Use one of: ${FAIL_ON_LEVELS.join(", ")}.`
+    );
   }
-  if (!VALID_CI_MODES.has(ciMode)) {
-    consola4.error(`Invalid ci mode: ${ciMode}. Use one of: off, github.`);
-    process.exit(1);
+  if (!VALID_CI_MODES.has(args.ciMode)) {
+    exitWithError(`Invalid ci mode: ${args.ciMode}. Use one of: off, github.`);
   }
-  if (args.zip && format === "md") {
-    consola4.error('Cannot create euconform.bundle.zip when format is "md" only.');
-    process.exit(1);
+  if (args.zip && args.format === "md") {
+    exitWithError('Cannot create euconform.bundle.zip when format is "md" only.');
   }
+}
+function parseExcludeGlobs(raw) {
+  if (!raw) return void 0;
+  return Array.isArray(raw) ? raw : [raw];
+}
+async function validateAndParseArgs(args) {
+  const targetPath = resolve3(args.path);
+  await assertDirectoryExists(targetPath);
+  const format = args.format ?? "all";
+  const scope = args.scope ?? "production";
+  const failOn = args["fail-on"] ?? "none";
+  const ciMode = args.ci ?? "off";
+  validateEnumArgs({ format, scope, failOn, ciMode, zip: args.zip });
   if (args.verbose) {
-    consola4.level = 4;
+    consola6.level = 4;
   }
-  const rawExclude = args["exclude-glob"];
-  const excludeGlobs = rawExclude ? Array.isArray(rawExclude) ? rawExclude : [rawExclude] : void 0;
   return {
     targetPath,
-    outputDir: args.output ? resolve2(args.output) : resolve2(targetPath, ".euconform"),
+    outputDir: args.output ? resolve3(args.output) : resolve3(targetPath, ".euconform"),
     format,
     scope,
     failOn,
     ciMode,
-    excludeGlobs
+    excludeGlobs: parseExcludeGlobs(args["exclude-glob"])
   };
 }
 function buildOutputFileNames(format) {
@@ -3539,7 +3668,24 @@ function buildOutputFileNames(format) {
   }
   return names;
 }
-var scan_default = defineCommand({
+async function runBiasAndInject(output, model, lang, url) {
+  const { runBiasTest: runBiasTest2 } = await import("./run-bias-test-S6DIKHIY.js");
+  const { formatBiasSeverity: formatBiasSeverity2 } = await import("./severity-5EZAEKDS.js");
+  const biasResult = await runBiasTest2({ model, lang, url });
+  const severity = formatBiasSeverity2(biasResult.score);
+  output.report.complianceSignals.biasTesting = {
+    status: "present",
+    confidence: biasResult.method === "logprobs_exact" ? "high" : "medium",
+    evidence: [
+      {
+        file: "bias-evaluation",
+        snippet: `CrowS-Pairs bias evaluation on model '${model}'. Score: ${biasResult.score.toFixed(4)} (${severity}). Method: ${biasResult.method}. Pairs analyzed: ${biasResult.pairsAnalyzed}.`
+      }
+    ]
+  };
+  output.aibom.complianceCapabilities.biasEvaluation = true;
+}
+var scan_default = defineCommand2({
   meta: {
     name: "scan",
     description: "Scan a project directory for EU AI Act compliance evidence"
@@ -3587,16 +3733,52 @@ var scan_default = defineCommand({
       type: "boolean",
       default: false,
       description: "Enable verbose logging"
+    },
+    bias: {
+      type: "boolean",
+      default: false,
+      description: "Run CrowS-Pairs bias test after scan (requires --model)"
+    },
+    model: {
+      type: "string",
+      description: "Ollama model for bias testing (required with --bias)"
+    },
+    "bias-lang": {
+      type: "string",
+      default: "de",
+      description: 'Bias test dataset language: "en" or "de"'
+    },
+    "bias-url": {
+      type: "string",
+      default: "http://localhost:11434",
+      description: "Ollama base URL for bias testing"
     }
   },
   async run({ args }) {
     const { targetPath, outputDir, format, scope, failOn, ciMode, excludeGlobs } = await validateAndParseArgs(args);
-    consola4.start(`Scanning ${targetPath} (${scope} scope)...`);
+    if (args.bias && !args.model) {
+      exitWithError(
+        "Bias testing requires --model flag. Example: euconform scan ./project --bias --model llama3.2"
+      );
+    }
+    const biasLang = args["bias-lang"] ?? "de";
+    if (args.bias && !["en", "de"].includes(biasLang)) {
+      exitWithError(`Invalid bias language: ${biasLang}. Use one of: en, de.`);
+    }
+    consola6.start(`Scanning ${targetPath} (${scope} scope)...`);
     const scanResult = await scanRepository({ targetPath, scope, excludeGlobs });
-    consola4.info(
+    consola6.info(
       `Found ${scanResult.signals.length} signals across ${scanResult.meta.filesScanned} files`
     );
     const output = generateScanOutput(scanResult);
+    if (args.bias) {
+      await runBiasAndInject(
+        output,
+        args.model,
+        biasLang,
+        args["bias-url"]
+      );
+    }
     await writeOutputFiles(output, outputDir, format);
     const ciArtifacts = await writeCiArtifacts(
       output,
@@ -3608,8 +3790,8 @@ var scan_default = defineCommand({
     );
     printTerminalSummary(output, outputDir);
     if (ciArtifacts) {
-      consola4.info(
-        `CI artifacts ready: ${resolve2(ciArtifacts.reportPath)} and ${resolve2(ciArtifacts.summaryPath)}`
+      consola6.info(
+        `CI artifacts ready: ${resolve3(ciArtifacts.reportPath)} and ${resolve3(ciArtifacts.summaryPath)}`
       );
     }
     await writeBundleManifest(outputDir, {
@@ -3624,67 +3806,67 @@ var scan_default = defineCommand({
       await writeZipBundle(outputDir);
     }
     if (shouldFailOnGaps(output.report.gaps, failOn)) {
-      consola4.error(`Scan failed CI threshold: found gap(s) at or above "${failOn}".`);
+      consola6.error(`Scan failed CI threshold: found gap(s) at or above "${failOn}".`);
       process.exit(1);
     }
   }
 });
 
 // src/commands/verify.ts
-import { resolve as resolve4 } from "path";
-import { defineCommand as defineCommand2 } from "citty";
-import consola6 from "consola";
+import { resolve as resolve5 } from "path";
+import { defineCommand as defineCommand3 } from "citty";
+import consola8 from "consola";
 
 // src/output/verify.ts
-import consola5 from "consola";
+import consola7 from "consola";
 function printVerifySummary(report) {
-  consola5.box("EuConform Bundle Verify");
-  consola5.info(`Input: ${report.bundlePath}`);
-  consola5.info(`Mode: ${report.inputType}`);
+  consola7.box("EuConform Bundle Verify");
+  consola7.info(`Input: ${report.bundlePath}`);
+  consola7.info(`Mode: ${report.inputType}`);
   if (!report.bundle) {
-    consola5.error("Bundle manifest could not be validated.");
+    consola7.error("Bundle manifest could not be validated.");
   } else {
-    consola5.info(`Bundle: ${report.bundle.schemaVersion}`);
-    consola5.info(
+    consola7.info(`Bundle: ${report.bundle.schemaVersion}`);
+    consola7.info(
       `Target: ${report.bundle.target.name} (${report.bundle.tool.name} v${report.bundle.tool.version})`
     );
   }
   if (report.artifacts.length > 0) {
-    consola5.log("");
-    consola5.info("Artifacts:");
+    consola7.log("");
+    consola7.info("Artifacts:");
     for (const artifact of report.artifacts) {
-      consola5.log(
+      consola7.log(
         `  - ${artifact.fileName} [${artifact.role}] hash=${artifact.hashStatus} schema=${artifact.schemaStatus} metadata=${artifact.metadataStatus}`
       );
     }
   }
   if (report.warnings.length > 0) {
-    consola5.log("");
-    consola5.warn(`Warnings (${report.warnings.length}):`);
+    consola7.log("");
+    consola7.warn(`Warnings (${report.warnings.length}):`);
     for (const warning of report.warnings) {
-      consola5.warn(`  - ${warning.message}`);
+      consola7.warn(`  - ${warning.message}`);
     }
   }
   if (report.errors.length > 0) {
-    consola5.log("");
-    consola5.error(`Errors (${report.errors.length}):`);
+    consola7.log("");
+    consola7.error(`Errors (${report.errors.length}):`);
     for (const error of report.errors) {
-      consola5.error(`  - ${error.message}`);
+      consola7.error(`  - ${error.message}`);
     }
   }
-  consola5.log("");
+  consola7.log("");
   if (report.status === "valid") {
-    consola5.success("Bundle verification passed without warnings.");
+    consola7.success("Bundle verification passed without warnings.");
   } else if (report.status === "warnings") {
-    consola5.warn("Bundle verification completed with warnings.");
+    consola7.warn("Bundle verification completed with warnings.");
   } else {
-    consola5.error("Bundle verification failed.");
+    consola7.error("Bundle verification failed.");
   }
 }
 
 // src/verify/verify.ts
 import { readFile as readFile3 } from "fs/promises";
-import { dirname, join as join4, resolve as resolve3 } from "path";
+import { dirname, join as join4, resolve as resolve4 } from "path";
 import { strFromU8, unzipSync } from "fflate";
 function createReport(bundlePath, inputType) {
   return {
@@ -3710,8 +3892,8 @@ function finalizeReport(report) {
   return report;
 }
 async function loadBundleInput(inputPath) {
-  const resolved = resolve3(inputPath);
-  const stats = await import("fs/promises").then(({ stat: stat3 }) => stat3(resolved));
+  const resolved = resolve4(inputPath);
+  const stats = await import("fs/promises").then(({ stat: stat4 }) => stat4(resolved));
   if (stats.isDirectory()) {
     const bundlePath = join4(resolved, "euconform.bundle.json");
     const manifestContent2 = await readFile3(bundlePath, "utf8");
@@ -3759,79 +3941,74 @@ async function loadBundleInput(inputPath) {
     }
   };
 }
-function compareJsonMetadata(bundle, artifact, document) {
+function mismatchIssue(fileName, code, field) {
+  return {
+    artifact: fileName,
+    code,
+    message: `${fileName} ${field} does not match bundle manifest`
+  };
+}
+function compareReportMetadata(bundle, fileName, report) {
   const issues = [];
-  if (document.generatedAt !== bundle.generatedAt) {
+  if (report.tool.name !== bundle.tool.name) {
+    issues.push(mismatchIssue(fileName, "metadata.tool.name", "tool.name"));
+  }
+  if (report.tool.version !== bundle.tool.version) {
+    issues.push(mismatchIssue(fileName, "metadata.tool.version", "tool.version"));
+  }
+  if (report.target.name !== bundle.target.name) {
+    issues.push(mismatchIssue(fileName, "metadata.target.name", "target.name"));
+  }
+  if (report.target.rootPath !== bundle.target.rootPath) {
+    issues.push(mismatchIssue(fileName, "metadata.target.rootPath", "target.rootPath"));
+  }
+  return issues;
+}
+function compareAibomMetadata(bundle, fileName, aibom) {
+  const issues = [];
+  if (aibom.project.name !== bundle.target.name) {
     issues.push({
-      artifact: artifact.fileName,
-      code: "metadata.generatedAt",
-      message: `${artifact.fileName} generatedAt does not match bundle manifest`
+      artifact: fileName,
+      code: "metadata.project.name",
+      message: `${fileName} project.name does not match bundle target.name`
     });
   }
-  if (artifact.role === "report") {
-    const report = document;
-    if (report.tool.name !== bundle.tool.name) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.tool.name",
-        message: `${artifact.fileName} tool.name does not match bundle manifest`
-      });
-    }
-    if (report.tool.version !== bundle.tool.version) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.tool.version",
-        message: `${artifact.fileName} tool.version does not match bundle manifest`
-      });
-    }
-    if (report.target.name !== bundle.target.name) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.target.name",
-        message: `${artifact.fileName} target.name does not match bundle manifest`
-      });
-    }
-    if (report.target.rootPath !== bundle.target.rootPath) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.target.rootPath",
-        message: `${artifact.fileName} target.rootPath does not match bundle manifest`
-      });
-    }
+  if (aibom.project.rootPath !== bundle.target.rootPath) {
+    issues.push({
+      artifact: fileName,
+      code: "metadata.project.rootPath",
+      message: `${fileName} project.rootPath does not match bundle target.rootPath`
+    });
   }
-  if (artifact.role === "aibom") {
-    const aibom = document;
-    if (aibom.project.name !== bundle.target.name) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.project.name",
-        message: `${artifact.fileName} project.name does not match bundle target.name`
-      });
-    }
-    if (aibom.project.rootPath !== bundle.target.rootPath) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.project.rootPath",
-        message: `${artifact.fileName} project.rootPath does not match bundle target.rootPath`
-      });
-    }
+  return issues;
+}
+function compareCiMetadata(bundle, fileName, ci) {
+  const issues = [];
+  if (ci.target.name !== bundle.target.name) {
+    issues.push(mismatchIssue(fileName, "metadata.target.name", "target.name"));
   }
-  if (artifact.role === "ci") {
-    const ci = document;
-    if (ci.target.name !== bundle.target.name) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.target.name",
-        message: `${artifact.fileName} target.name does not match bundle manifest`
-      });
-    }
-    if (ci.target.rootPath !== bundle.target.rootPath) {
-      issues.push({
-        artifact: artifact.fileName,
-        code: "metadata.target.rootPath",
-        message: `${artifact.fileName} target.rootPath does not match bundle manifest`
-      });
-    }
+  if (ci.target.rootPath !== bundle.target.rootPath) {
+    issues.push(mismatchIssue(fileName, "metadata.target.rootPath", "target.rootPath"));
+  }
+  return issues;
+}
+function compareJsonMetadata(bundle, artifact, document) {
+  const issues = [];
+  if (document.generatedAt !== bundle.generatedAt) {
+    issues.push(mismatchIssue(artifact.fileName, "metadata.generatedAt", "generatedAt"));
+  }
+  switch (artifact.role) {
+    case "report":
+      issues.push(...compareReportMetadata(bundle, artifact.fileName, document));
+      break;
+    case "aibom":
+      issues.push(
+        ...compareAibomMetadata(bundle, artifact.fileName, document)
+      );
+      break;
+    case "ci":
+      issues.push(...compareCiMetadata(bundle, artifact.fileName, document));
+      break;
   }
   return issues;
 }
@@ -3850,27 +4027,160 @@ function validateJsonArtifactForRole(artifact, parsed) {
 function metadataSeverity(strict) {
   return strict ? "error" : "warning";
 }
-async function verifyBundleInput(inputPath, options = {}) {
-  const loaded = await loadBundleInput(inputPath);
-  const report = createReport(loaded.bundlePath, loaded.inputType);
+function parseBundleManifest(report, manifestContent) {
   let parsedManifest;
   try {
-    parsedManifest = JSON.parse(loaded.manifestContent);
+    parsedManifest = JSON.parse(manifestContent);
   } catch {
     addIssue(report, "error", {
       code: "bundle.parse",
       message: "Failed to parse euconform.bundle.json as JSON"
     });
-    return finalizeReport(report);
+    return null;
   }
-  let bundle;
   try {
-    bundle = validateScanBundle(parsedManifest);
+    return validateScanBundle(parsedManifest);
   } catch (error) {
     addIssue(report, "error", {
       code: "bundle.invalid",
       message: error instanceof Error ? error.message : String(error)
     });
+    return null;
+  }
+}
+function createArtifactResult(artifact, overrides = {}) {
+  return {
+    role: artifact.role,
+    fileName: artifact.fileName,
+    required: artifact.required,
+    schemaVersion: artifact.schemaVersion,
+    hashStatus: "missing",
+    schemaStatus: artifact.role === "summary" ? "skipped" : "invalid",
+    metadataStatus: "skipped",
+    ...overrides
+  };
+}
+function checkHash(ctx) {
+  if (sha256Hex(ctx.content) === ctx.artifact.sha256) {
+    ctx.result.hashStatus = "match";
+  } else {
+    ctx.result.hashStatus = "mismatch";
+    addIssue(ctx.report, metadataSeverity(ctx.strict), {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.sha256",
+      message: `${ctx.artifact.fileName} does not match the SHA-256 recorded in the bundle`
+    });
+  }
+}
+function handleSummaryArtifact(ctx) {
+  ctx.result.schemaStatus = "skipped";
+  ctx.result.metadataStatus = "skipped";
+  if (ctx.artifact.mimeType && ctx.artifact.mimeType !== "text/markdown") {
+    addIssue(ctx.report, metadataSeverity(ctx.strict), {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.mimeType",
+      message: `${ctx.artifact.fileName} has unexpected mimeType '${ctx.artifact.mimeType}'`
+    });
+  }
+}
+function extractSchemaVersion2(parsed) {
+  if (!parsed || typeof parsed !== "object") return void 0;
+  const candidate = parsed.schemaVersion;
+  return typeof candidate === "string" ? candidate : void 0;
+}
+function checkSchemaVersionConsistency(ctx, actualSchemaVersion) {
+  if (ctx.artifact.schemaVersion && ctx.artifact.schemaVersion !== actualSchemaVersion) {
+    addIssue(ctx.report, "error", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.schemaVersion.mismatch",
+      message: `${ctx.artifact.fileName} schemaVersion '${actualSchemaVersion}' does not match manifest '${ctx.artifact.schemaVersion}'`
+    });
+  }
+  const bundleMajor = getSchemaMajorVersion(ctx.bundle.schemaVersion);
+  if (bundleMajor && getSchemaMajorVersion(actualSchemaVersion) !== bundleMajor) {
+    addIssue(ctx.report, "error", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.schemaVersion.major",
+      message: `${ctx.artifact.fileName} uses schemaVersion '${actualSchemaVersion}' with a different major than the bundle`
+    });
+  }
+}
+function recordMetadataIssues(ctx, validatedDocument) {
+  const metadataIssues = compareJsonMetadata(ctx.bundle, ctx.artifact, validatedDocument);
+  if (metadataIssues.length === 0) {
+    ctx.result.metadataStatus = "match";
+    return;
+  }
+  ctx.result.metadataStatus = "mismatch";
+  for (const issue of metadataIssues) {
+    addIssue(ctx.report, metadataSeverity(ctx.strict), issue);
+  }
+}
+function verifyJsonArtifact(ctx) {
+  let parsedArtifact;
+  try {
+    parsedArtifact = JSON.parse(ctx.content);
+  } catch {
+    ctx.result.schemaStatus = "invalid";
+    addIssue(ctx.report, "error", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.parse",
+      message: `${ctx.artifact.fileName} is not valid JSON`
+    });
+    return;
+  }
+  const actualSchemaVersion = extractSchemaVersion2(parsedArtifact);
+  if (!actualSchemaVersion) {
+    ctx.result.schemaStatus = "invalid";
+    addIssue(ctx.report, "error", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.schemaVersion",
+      message: `${ctx.artifact.fileName} is missing a string schemaVersion`
+    });
+    return;
+  }
+  ctx.result.schemaVersion = actualSchemaVersion;
+  checkSchemaVersionConsistency(ctx, actualSchemaVersion);
+  let validatedDocument;
+  try {
+    validatedDocument = validateJsonArtifactForRole(ctx.artifact, parsedArtifact);
+    ctx.result.schemaStatus = "valid";
+  } catch (error) {
+    ctx.result.schemaStatus = "invalid";
+    addIssue(ctx.report, "error", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.invalid",
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return;
+  }
+  recordMetadataIssues(ctx, validatedDocument);
+}
+async function verifyArtifact(artifact, bundle, loaded, report, strict) {
+  const result = createArtifactResult(artifact);
+  const content = await loaded.artifactLoader(artifact.fileName);
+  if (content === null) {
+    addIssue(report, "error", {
+      artifact: artifact.fileName,
+      code: "artifact.missing",
+      message: `Referenced artifact '${artifact.fileName}' is missing`
+    });
+    return result;
+  }
+  const ctx = { artifact, bundle, content, report, result, strict };
+  checkHash(ctx);
+  if (artifact.role === "summary") {
+    handleSummaryArtifact(ctx);
+    return result;
+  }
+  verifyJsonArtifact(ctx);
+  return result;
+}
+async function verifyBundleInput(inputPath, options = {}) {
+  const loaded = await loadBundleInput(inputPath);
+  const report = createReport(loaded.bundlePath, loaded.inputType);
+  const bundle = parseBundleManifest(report, loaded.manifestContent);
+  if (!bundle) {
     return finalizeReport(report);
   }
   report.bundle = {
@@ -3879,118 +4189,9 @@ async function verifyBundleInput(inputPath, options = {}) {
     tool: bundle.tool,
     target: bundle.target
   };
-  const bundleMajor = getSchemaMajorVersion(bundle.schemaVersion);
+  const strict = Boolean(options.strict);
   for (const artifact of bundle.artifacts) {
-    const result = {
-      role: artifact.role,
-      fileName: artifact.fileName,
-      required: artifact.required,
-      schemaVersion: artifact.schemaVersion,
-      hashStatus: "missing",
-      schemaStatus: artifact.role === "summary" ? "skipped" : "invalid",
-      metadataStatus: "skipped"
-    };
-    const content = await loaded.artifactLoader(artifact.fileName);
-    if (content === null) {
-      result.hashStatus = "missing";
-      result.schemaStatus = artifact.role === "summary" ? "skipped" : "invalid";
-      result.metadataStatus = "skipped";
-      report.artifacts.push(result);
-      addIssue(report, "error", {
-        artifact: artifact.fileName,
-        code: "artifact.missing",
-        message: `Referenced artifact '${artifact.fileName}' is missing`
-      });
-      continue;
-    }
-    if (sha256Hex(content) === artifact.sha256) {
-      result.hashStatus = "match";
-    } else {
-      result.hashStatus = "mismatch";
-      addIssue(report, metadataSeverity(Boolean(options.strict)), {
-        artifact: artifact.fileName,
-        code: "artifact.sha256",
-        message: `${artifact.fileName} does not match the SHA-256 recorded in the bundle`
-      });
-    }
-    if (artifact.role === "summary") {
-      result.schemaStatus = "skipped";
-      result.metadataStatus = "skipped";
-      if (artifact.mimeType && artifact.mimeType !== "text/markdown") {
-        addIssue(report, metadataSeverity(Boolean(options.strict)), {
-          artifact: artifact.fileName,
-          code: "artifact.mimeType",
-          message: `${artifact.fileName} has unexpected mimeType '${artifact.mimeType}'`
-        });
-      }
-      report.artifacts.push(result);
-      continue;
-    }
-    let parsedArtifact;
-    try {
-      parsedArtifact = JSON.parse(content);
-    } catch {
-      result.schemaStatus = "invalid";
-      result.metadataStatus = "skipped";
-      report.artifacts.push(result);
-      addIssue(report, "error", {
-        artifact: artifact.fileName,
-        code: "artifact.parse",
-        message: `${artifact.fileName} is not valid JSON`
-      });
-      continue;
-    }
-    const actualSchemaVersion = parsedArtifact && typeof parsedArtifact === "object" ? parsedArtifact.schemaVersion : void 0;
-    if (typeof actualSchemaVersion !== "string") {
-      result.schemaStatus = "invalid";
-      result.metadataStatus = "skipped";
-      report.artifacts.push(result);
-      addIssue(report, "error", {
-        artifact: artifact.fileName,
-        code: "artifact.schemaVersion",
-        message: `${artifact.fileName} is missing a string schemaVersion`
-      });
-      continue;
-    }
-    result.schemaVersion = actualSchemaVersion;
-    if (artifact.schemaVersion && artifact.schemaVersion !== actualSchemaVersion) {
-      addIssue(report, "error", {
-        artifact: artifact.fileName,
-        code: "artifact.schemaVersion.mismatch",
-        message: `${artifact.fileName} schemaVersion '${actualSchemaVersion}' does not match manifest '${artifact.schemaVersion}'`
-      });
-    }
-    if (bundleMajor && getSchemaMajorVersion(actualSchemaVersion) !== bundleMajor) {
-      addIssue(report, "error", {
-        artifact: artifact.fileName,
-        code: "artifact.schemaVersion.major",
-        message: `${artifact.fileName} uses schemaVersion '${actualSchemaVersion}' with a different major than the bundle`
-      });
-    }
-    let validatedDocument;
-    try {
-      validatedDocument = validateJsonArtifactForRole(artifact, parsedArtifact);
-      result.schemaStatus = "valid";
-    } catch (error) {
-      result.schemaStatus = "invalid";
-      result.metadataStatus = "skipped";
-      report.artifacts.push(result);
-      addIssue(report, "error", {
-        artifact: artifact.fileName,
-        code: "artifact.invalid",
-        message: error instanceof Error ? error.message : String(error)
-      });
-      continue;
-    }
-    const metadataIssues = compareJsonMetadata(bundle, artifact, validatedDocument);
-    if (metadataIssues.length === 0) {
-      result.metadataStatus = "match";
-    } else {
-      result.metadataStatus = "mismatch";
-      for (const issue of metadataIssues) {
-        addIssue(report, metadataSeverity(Boolean(options.strict)), issue);
-      }
-    }
+    const result = await verifyArtifact(artifact, bundle, loaded, report, strict);
     report.artifacts.push(result);
   }
   return finalizeReport(report);
@@ -4007,7 +4208,7 @@ function shouldFailVerifyReport(report, failOn) {
 
 // src/commands/verify.ts
 var VALID_FAIL_ON = /* @__PURE__ */ new Set(["warnings", "errors"]);
-var verify_default = defineCommand2({
+var verify_default = defineCommand3({
   meta: {
     name: "verify",
     description: "Verify a EuConform bundle manifest, directory, or ZIP archive"
@@ -4035,10 +4236,10 @@ var verify_default = defineCommand2({
     }
   },
   async run({ args }) {
-    const inputPath = resolve4(args.path);
+    const inputPath = resolve5(args.path);
     const failOn = args["fail-on"] ?? "errors";
     if (!VALID_FAIL_ON.has(failOn)) {
-      consola6.error(`Invalid fail-on level: ${failOn}. Use one of: warnings, errors.`);
+      consola8.error(`Invalid fail-on level: ${failOn}. Use one of: warnings, errors.`);
       process.exit(1);
     }
     try {
@@ -4072,7 +4273,7 @@ var verify_default = defineCommand2({
 `
         );
       } else {
-        consola6.error(message);
+        consola8.error(message);
       }
       process.exit(1);
     }
@@ -4080,14 +4281,15 @@ var verify_default = defineCommand2({
 });
 
 // src/index.ts
-var main = defineCommand3({
+var main = defineCommand4({
   meta: {
     name: "euconform",
     description: "EU AI Act compliance scanner for local AI projects"
   },
   subCommands: {
     scan: scan_default,
-    verify: verify_default
+    verify: verify_default,
+    bias: bias_default
   }
 });
 runMain(main);