@euconform/cli 1.0.0

package/dist/index.js

@@ -0,0 +1,4093 @@
+#!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
+var require_ignore = __commonJS({
+  "../../node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js"(exports, module) {
+    "use strict";
+    function makeArray(subject) {
+      return Array.isArray(subject) ? subject : [subject];
+    }
+    var UNDEFINED = void 0;
+    var EMPTY = "";
+    var SPACE = " ";
+    var ESCAPE = "\\";
+    var REGEX_TEST_BLANK_LINE = /^\s+$/;
+    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
+    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
+    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
+    var REGEX_SPLITALL_CRLF = /\r?\n/g;
+    var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
+    var REGEX_TEST_TRAILING_SLASH = /\/$/;
+    var SLASH = "/";
+    var TMP_KEY_IGNORE = "node-ignore";
+    if (typeof Symbol !== "undefined") {
+      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
+    }
+    var KEY_IGNORE = TMP_KEY_IGNORE;
+    var define = (object, key, value) => {
+      Object.defineProperty(object, key, { value });
+      return value;
+    };
+    var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
+    var RETURN_FALSE = () => false;
+    var sanitizeRange = (range) => range.replace(
+      REGEX_REGEXP_RANGE,
+      (match, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match : EMPTY
+    );
+    var cleanRangeBackSlash = (slashes) => {
+      const { length } = slashes;
+      return slashes.slice(0, length - length % 2);
+    };
+    var REPLACERS = [
+      [
+        // Remove BOM
+        // TODO:
+        // Other similar zero-width characters?
+        /^\uFEFF/,
+        () => EMPTY
+      ],
+      // > Trailing spaces are ignored unless they are quoted with backslash ("\")
+      [
+        // (a\ ) -> (a )
+        // (a  ) -> (a)
+        // (a ) -> (a)
+        // (a \ ) -> (a  )
+        /((?:\\\\)*?)(\\?\s+)$/,
+        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)
+      ],
+      // Replace (\ ) with ' '
+      // (\ ) -> ' '
+      // (\\ ) -> '\\ '
+      // (\\\ ) -> '\\ '
+      [
+        /(\\+?)\s/g,
+        (_, m1) => {
+          const { length } = m1;
+          return m1.slice(0, length - length % 2) + SPACE;
+        }
+      ],
+      // Escape metacharacters
+      // which is written down by users but means special for regular expressions.
+      // > There are 12 characters with special meanings:
+      // > - the backslash \,
+      // > - the caret ^,
+      // > - the dollar sign $,
+      // > - the period or dot .,
+      // > - the vertical bar or pipe symbol |,
+      // > - the question mark ?,
+      // > - the asterisk or star *,
+      // > - the plus sign +,
+      // > - the opening parenthesis (,
+      // > - the closing parenthesis ),
+      // > - and the opening square bracket [,
+      // > - the opening curly brace {,
+      // > These special characters are often called "metacharacters".
+      [
+        /[\\$.|*+(){^]/g,
+        (match) => `\\${match}`
+      ],
+      [
+        // > a question mark (?) matches a single character
+        /(?!\\)\?/g,
+        () => "[^/]"
+      ],
+      // leading slash
+      [
+        // > A leading slash matches the beginning of the pathname.
+        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
+        // A leading slash matches the beginning of the pathname
+        /^\//,
+        () => "^"
+      ],
+      // replace special metacharacter slash after the leading slash
+      [
+        /\//g,
+        () => "\\/"
+      ],
+      [
+        // > A leading "**" followed by a slash means match in all directories.
+        // > For example, "**/foo" matches file or directory "foo" anywhere,
+        // > the same as pattern "foo".
+        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
+        // >   under directory "foo".
+        // Notice that the '*'s have been replaced as '\\*'
+        /^\^*\\\*\\\*\\\//,
+        // '**/foo' <-> 'foo'
+        () => "^(?:.*\\/)?"
+      ],
+      // starting
+      [
+        // there will be no leading '/'
+        //   (which has been replaced by section "leading slash")
+        // If starts with '**', adding a '^' to the regular expression also works
+        /^(?=[^^])/,
+        function startingReplacer() {
+          return !/\/(?!$)/.test(this) ? "(?:^|\\/)" : "^";
+        }
+      ],
+      // two globstars
+      [
+        // Use lookahead assertions so that we could match more than one `'/**'`
+        /\\\/\\\*\\\*(?=\\\/|$)/g,
+        // Zero, one or several directories
+        // should not use '*', or it will be replaced by the next replacer
+        // Check if it is not the last `'/**'`
+        (_, index, str) => index + 6 < str.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
+      ],
+      // normal intermediate wildcards
+      [
+        // Never replace escaped '*'
+        // ignore rule '\*' will match the path '*'
+        // 'abc.*/' -> go
+        // 'abc.*'  -> skip this rule,
+        //    coz trailing single wildcard will be handed by [trailing wildcard]
+        /(^|[^\\]+)(\\\*)+(?=.+)/g,
+        // '*.js' matches '.js'
+        // '*.js' doesn't match 'abc'
+        (_, p1, p2) => {
+          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
+          return p1 + unescaped;
+        }
+      ],
+      [
+        // unescape, revert step 3 except for back slash
+        // For example, if a user escape a '\\*',
+        // after step 3, the result will be '\\\\\\*'
+        /\\\\\\(?=[$.|*+(){^])/g,
+        () => ESCAPE
+      ],
+      [
+        // '\\\\' -> '\\'
+        /\\\\/g,
+        () => ESCAPE
+      ],
+      [
+        // > The range notation, e.g. [a-zA-Z],
+        // > can be used to match one of the characters in a range.
+        // `\` is escaped by step 3
+        /(\\)?\[([^\]/]*?)(\\*)($|\])/g,
+        (match, leadEscape, range, endEscape, close) => leadEscape === ESCAPE ? `\\[${range}${cleanRangeBackSlash(endEscape)}${close}` : close === "]" ? endEscape.length % 2 === 0 ? `[${sanitizeRange(range)}${endEscape}]` : "[]" : "[]"
+      ],
+      // ending
+      [
+        // 'js' will not match 'js.'
+        // 'ab' will not match 'abc'
+        /(?:[^*])$/,
+        // WTF!
+        // https://git-scm.com/docs/gitignore
+        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
+        // which re-fixes #24, #38
+        // > If there is a separator at the end of the pattern then the pattern
+        // > will only match directories, otherwise the pattern can match both
+        // > files and directories.
+        // 'js*' will not match 'a.js'
+        // 'js/' will not match 'a.js'
+        // 'js' will match 'a.js' and 'a.js/'
+        (match) => /\/$/.test(match) ? `${match}$` : `${match}(?=$|\\/$)`
+      ]
+    ];
+    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\\\*$/;
+    var MODE_IGNORE = "regex";
+    var MODE_CHECK_IGNORE = "checkRegex";
+    var UNDERSCORE = "_";
+    var TRAILING_WILD_CARD_REPLACERS = {
+      [MODE_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      },
+      [MODE_CHECK_IGNORE](_, p1) {
+        const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
+        return `${prefix}(?=$|\\/$)`;
+      }
+    };
+    var makeRegexPrefix = (pattern) => REPLACERS.reduce(
+      (prev, [matcher, replacer]) => prev.replace(matcher, replacer.bind(pattern)),
+      pattern
+    );
+    var isString = (subject) => typeof subject === "string";
+    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
+    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
+    var IgnoreRule = class {
+      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
+        this.pattern = pattern;
+        this.mark = mark;
+        this.negative = negative;
+        define(this, "body", body);
+        define(this, "ignoreCase", ignoreCase);
+        define(this, "regexPrefix", prefix);
+      }
+      get regex() {
+        const key = UNDERSCORE + MODE_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_IGNORE, key);
+      }
+      get checkRegex() {
+        const key = UNDERSCORE + MODE_CHECK_IGNORE;
+        if (this[key]) {
+          return this[key];
+        }
+        return this._make(MODE_CHECK_IGNORE, key);
+      }
+      _make(mode, key) {
+        const str = this.regexPrefix.replace(
+          REGEX_REPLACE_TRAILING_WILDCARD,
+          // It does not need to bind pattern
+          TRAILING_WILD_CARD_REPLACERS[mode]
+        );
+        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
+        return define(this, key, regex);
+      }
+    };
+    var createRule = ({
+      pattern,
+      mark
+    }, ignoreCase) => {
+      let negative = false;
+      let body = pattern;
+      if (body.indexOf("!") === 0) {
+        negative = true;
+        body = body.substr(1);
+      }
+      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
+      const regexPrefix = makeRegexPrefix(body);
+      return new IgnoreRule(
+        pattern,
+        mark,
+        body,
+        ignoreCase,
+        negative,
+        regexPrefix
+      );
+    };
+    var RuleManager = class {
+      constructor(ignoreCase) {
+        this._ignoreCase = ignoreCase;
+        this._rules = [];
+      }
+      _add(pattern) {
+        if (pattern && pattern[KEY_IGNORE]) {
+          this._rules = this._rules.concat(pattern._rules._rules);
+          this._added = true;
+          return;
+        }
+        if (isString(pattern)) {
+          pattern = {
+            pattern
+          };
+        }
+        if (checkPattern(pattern.pattern)) {
+          const rule = createRule(pattern, this._ignoreCase);
+          this._added = true;
+          this._rules.push(rule);
+        }
+      }
+      // @param {Array<string> | string | Ignore} pattern
+      add(pattern) {
+        this._added = false;
+        makeArray(
+          isString(pattern) ? splitPattern(pattern) : pattern
+        ).forEach(this._add, this);
+        return this._added;
+      }
+      // Test one single path without recursively checking parent directories
+      //
+      // - checkUnignored `boolean` whether should check if the path is unignored,
+      //   setting `checkUnignored` to `false` could reduce additional
+      //   path matching.
+      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
+      // @returns {TestResult} true if a file is ignored
+      test(path, checkUnignored, mode) {
+        let ignored = false;
+        let unignored = false;
+        let matchedRule;
+        this._rules.forEach((rule) => {
+          const { negative } = rule;
+          if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
+            return;
+          }
+          const matched = rule[mode].test(path);
+          if (!matched) {
+            return;
+          }
+          ignored = !negative;
+          unignored = negative;
+          matchedRule = negative ? UNDEFINED : rule;
+        });
+        const ret = {
+          ignored,
+          unignored
+        };
+        if (matchedRule) {
+          ret.rule = matchedRule;
+        }
+        return ret;
+      }
+    };
+    var throwError = (message, Ctor) => {
+      throw new Ctor(message);
+    };
+    var checkPath = (path, originalPath, doThrow) => {
+      if (!isString(path)) {
+        return doThrow(
+          `path must be a string, but got \`${originalPath}\``,
+          TypeError
+        );
+      }
+      if (!path) {
+        return doThrow(`path must not be empty`, TypeError);
+      }
+      if (checkPath.isNotRelative(path)) {
+        const r = "`path.relative()`d";
+        return doThrow(
+          `path should be a ${r} string, but got "${originalPath}"`,
+          RangeError
+        );
+      }
+      return true;
+    };
+    var isNotRelative = (path) => REGEX_TEST_INVALID_PATH.test(path);
+    checkPath.isNotRelative = isNotRelative;
+    checkPath.convert = (p) => p;
+    var Ignore = class {
+      constructor({
+        ignorecase = true,
+        ignoreCase = ignorecase,
+        allowRelativePaths = false
+      } = {}) {
+        define(this, KEY_IGNORE, true);
+        this._rules = new RuleManager(ignoreCase);
+        this._strictPathCheck = !allowRelativePaths;
+        this._initCache();
+      }
+      _initCache() {
+        this._ignoreCache = /* @__PURE__ */ Object.create(null);
+        this._testCache = /* @__PURE__ */ Object.create(null);
+      }
+      add(pattern) {
+        if (this._rules.add(pattern)) {
+          this._initCache();
+        }
+        return this;
+      }
+      // legacy
+      addPattern(pattern) {
+        return this.add(pattern);
+      }
+      // @returns {TestResult}
+      _test(originalPath, cache, checkUnignored, slices) {
+        const path = originalPath && checkPath.convert(originalPath);
+        checkPath(
+          path,
+          originalPath,
+          this._strictPathCheck ? throwError : RETURN_FALSE
+        );
+        return this._t(path, cache, checkUnignored, slices);
+      }
+      checkIgnore(path) {
+        if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
+          return this.test(path);
+        }
+        const slices = path.split(SLASH).filter(Boolean);
+        slices.pop();
+        if (slices.length) {
+          const parent = this._t(
+            slices.join(SLASH) + SLASH,
+            this._testCache,
+            true,
+            slices
+          );
+          if (parent.ignored) {
+            return parent;
+          }
+        }
+        return this._rules.test(path, false, MODE_CHECK_IGNORE);
+      }
+      _t(path, cache, checkUnignored, slices) {
+        if (path in cache) {
+          return cache[path];
+        }
+        if (!slices) {
+          slices = path.split(SLASH).filter(Boolean);
+        }
+        slices.pop();
+        if (!slices.length) {
+          return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
+        }
+        const parent = this._t(
+          slices.join(SLASH) + SLASH,
+          cache,
+          checkUnignored,
+          slices
+        );
+        return cache[path] = parent.ignored ? parent : this._rules.test(path, checkUnignored, MODE_IGNORE);
+      }
+      ignores(path) {
+        return this._test(path, this._ignoreCache, false).ignored;
+      }
+      createFilter() {
+        return (path) => !this.ignores(path);
+      }
+      filter(paths) {
+        return makeArray(paths).filter(this.createFilter());
+      }
+      // @returns {TestResult}
+      test(path) {
+        return this._test(path, this._testCache, true);
+      }
+    };
+    var factory = (options) => new Ignore(options);
+    var isPathValid = (path) => checkPath(path && checkPath.convert(path), path, RETURN_FALSE);
+    var setupWindows = () => {
+      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
+      checkPath.convert = makePosix;
+      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
+      checkPath.isNotRelative = (path) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path) || isNotRelative(path);
+    };
+    if (
+      // Detect `process` so that it can run in browsers.
+      typeof process !== "undefined" && process.platform === "win32"
+    ) {
+      setupWindows();
+    }
+    module.exports = factory;
+    factory.default = factory;
+    module.exports.isPathValid = isPathValid;
+    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
+  }
+});
+
+// src/index.ts
+import { defineCommand as defineCommand3, runMain } from "citty";
+
+// src/commands/scan.ts
+import { stat as stat2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
+
+// ../core/src/evidence/compliance-evaluation.ts
+var IMPLEMENTATION_PROVENANCE = /* @__PURE__ */ new Set(["runtime", "config"]);
+var SUPPORTING_PROVENANCE = /* @__PURE__ */ new Set(["root-docs", "docs"]);
+var USER_FACING_SEGMENTS = /* @__PURE__ */ new Set([
+  "app",
+  "pages",
+  "routes",
+  "route",
+  "components",
+  "ui",
+  "views",
+  "view",
+  "screens",
+  "screen",
+  "templates",
+  "template",
+  "public",
+  "content",
+  "locales",
+  "messages",
+  "copy",
+  "emails"
+]);
+var USER_FACING_BASENAME_PATTERN = /(?:page|layout|route|template|loading|error|view|screen|dialog|modal|form|widget|banner|notice)\.[^.]+$/i;
+function normalizedProvenance(provenance) {
+  return provenance ?? "runtime";
+}
+function isInternalAnalysisPath(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
+  return normalized.includes("/scanner/") || normalized.includes("/detectors/");
+}
+function isUserFacingPath(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
+  const segments = normalized.split("/").filter(Boolean);
+  const basename4 = segments[segments.length - 1] ?? "";
+  return segments.some((segment) => USER_FACING_SEGMENTS.has(segment)) || USER_FACING_BASENAME_PATTERN.test(basename4);
+}
+function isImplementationEvidence(category, evidence) {
+  const provenance = normalizedProvenance(evidence.provenance);
+  if (!IMPLEMENTATION_PROVENANCE.has(provenance)) return false;
+  if (isInternalAnalysisPath(evidence.file)) return false;
+  if (category === "compliance-disclosure") {
+    return isUserFacingPath(evidence.file);
+  }
+  return true;
+}
+function isSupportingEvidence(category, evidence) {
+  const provenance = normalizedProvenance(evidence.provenance);
+  if (!SUPPORTING_PROVENANCE.has(provenance)) return false;
+  if (category === "compliance-disclosure") return true;
+  if (category.startsWith("compliance-")) return true;
+  return false;
+}
+function withFilteredEvidence(signal, matcher) {
+  const evidence = signal.evidence.filter(matcher);
+  if (evidence.length === 0) return null;
+  return { ...signal, evidence };
+}
+function evaluateSignalsForCategories(signals, categories) {
+  const relevant = signals.filter((signal) => categories.includes(signal.category));
+  return {
+    implementationSignals: relevant.map(
+      (signal) => withFilteredEvidence(
+        signal,
+        (evidence) => isImplementationEvidence(signal.category, evidence)
+      )
+    ).filter((signal) => signal !== null),
+    supportingSignals: relevant.map(
+      (signal) => withFilteredEvidence(signal, (evidence) => isSupportingEvidence(signal.category, evidence))
+    ).filter((signal) => signal !== null)
+  };
+}
+function hasImplementationSignals(signals, categories) {
+  return evaluateSignalsForCategories(signals, categories).implementationSignals.length > 0;
+}
+
+// ../core/src/evidence/markdown.ts
+var COMPLIANCE_LABELS = {
+  disclosure: "AI Disclosure",
+  biasTesting: "Bias Testing",
+  reportingExports: "Reporting & Exports",
+  loggingMonitoring: "Logging & Monitoring",
+  humanOversight: "Human Oversight",
+  dataGovernance: "Data Governance",
+  incidentReporting: "Incident Reporting"
+};
+var STATUS_LABELS = {
+  present: "Present",
+  partial: "Partial",
+  absent: "Absent",
+  unknown: "Unknown"
+};
+function bomKindLabel(kind) {
+  const labels = {
+    framework: "Framework",
+    runtime: "Runtime",
+    "inference-provider": "Inference Provider",
+    "ai-framework": "AI Framework",
+    model: "Model",
+    "vector-store": "Vector Store",
+    embedding: "Embedding",
+    dataset: "Dataset",
+    tool: "Tool"
+  };
+  return labels[kind];
+}
+function formatDate(iso) {
+  try {
+    const d = new Date(iso);
+    return d.toISOString().split("T")[0] ?? iso;
+  } catch {
+    return iso;
+  }
+}
+function buildHeader(report, scanScope) {
+  const date = formatDate(report.generatedAt);
+  return [
+    "# EuConform Scan Report",
+    "",
+    "> **Disclaimer:** This is technical guidance only. It does not constitute legal advice.",
+    `> Generated by EuConform v${report.tool.version} on ${date}.`,
+    `> Scan scope: \`${scanScope}\`.`
+  ].join("\n");
+}
+function buildProjectOverview(report) {
+  const lines = [
+    "## Project Overview",
+    "",
+    `- **Name:** ${report.target.name}`,
+    `- **Type:** ${report.target.repoType}`
+  ];
+  if (report.target.detectedStack.length > 0) {
+    lines.push(`- **Stack:** ${report.target.detectedStack.join(", ")}`);
+  } else {
+    lines.push("- **Stack:** Not detected");
+  }
+  return lines.join("\n");
+}
+function buildAiComponents(aibom) {
+  const lines = ["## AI Components Detected", ""];
+  if (aibom.components.length === 0) {
+    lines.push("No AI components detected.");
+    return lines.join("\n");
+  }
+  lines.push("| Component | Kind | Source |");
+  lines.push("|-----------|------|--------|");
+  for (const comp of aibom.components) {
+    lines.push(`| ${comp.name} | ${bomKindLabel(comp.kind)} | ${comp.source} |`);
+  }
+  return lines.join("\n");
+}
+function buildComplianceSignals(report) {
+  const lines = ["## Compliance Signals", ""];
+  lines.push("| Area | Status | Confidence |");
+  lines.push("|------|--------|------------|");
+  const areas = Object.keys(COMPLIANCE_LABELS);
+  for (const area of areas) {
+    const group = report.complianceSignals[area];
+    lines.push(
+      `| ${COMPLIANCE_LABELS[area]} | ${STATUS_LABELS[group.status]} | ${group.confidence} |`
+    );
+  }
+  return lines.join("\n");
+}
+function buildAssessmentHints(report) {
+  const { riskIndicators, gpaiIndicators, possibleModes } = report.assessmentHints;
+  const lines = ["## Assessment Hints", ""];
+  if (gpaiIndicators.length === 0 && riskIndicators.length === 0 && possibleModes.length === 0) {
+    lines.push("No assessment hints generated (no AI detected).");
+    return lines.join("\n");
+  }
+  if (possibleModes.length > 0) {
+    lines.push(`**Possible classification modes:** ${possibleModes.join(", ")}`);
+    lines.push("");
+  }
+  if (gpaiIndicators.length > 0) {
+    lines.push("### GPAI Indicators");
+    lines.push("");
+    for (const hint of gpaiIndicators) {
+      const ref = hint.articleRef ? ` (${hint.articleRef})` : "";
+      lines.push(`- ${hint.hint}${ref}`);
+    }
+    lines.push("");
+  }
+  if (riskIndicators.length > 0) {
+    lines.push("### Risk Indicators");
+    lines.push("");
+    for (const hint of riskIndicators) {
+      const ref = hint.articleRef ? ` (${hint.articleRef})` : "";
+      lines.push(`- ${hint.hint}${ref}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function buildOpenQuestions(report) {
+  const questions = report.assessmentHints.openQuestions;
+  const lines = ["## Open Questions", ""];
+  if (questions.length === 0) {
+    lines.push("No open questions.");
+    return lines.join("\n");
+  }
+  questions.forEach((q, i) => {
+    lines.push(`${i + 1}. ${q}`);
+  });
+  return lines.join("\n");
+}
+function buildRecommendedActions(report) {
+  const lines = ["## Recommended Actions", ""];
+  if (report.recommendationSummary.length === 0) {
+    lines.push("No recommended actions.");
+    return lines.join("\n");
+  }
+  for (const rec of report.recommendationSummary) {
+    lines.push(`- ${rec}`);
+  }
+  return lines.join("\n");
+}
+function buildFooter() {
+  return ["---", "*Full details: `euconform.report.json` -- AI BOM: `euconform.aibom.json`*"].join(
+    "\n"
+  );
+}
+function generateSummaryMarkdown(report, aibom, scanScope) {
+  const sections = [
+    buildHeader(report, scanScope),
+    buildProjectOverview(report),
+    buildAiComponents(aibom),
+    buildComplianceSignals(report),
+    buildAssessmentHints(report),
+    buildOpenQuestions(report),
+    buildRecommendedActions(report),
+    buildFooter()
+  ];
+  return `${sections.join("\n\n")}
+`;
+}
+
+// ../core/src/evidence/output.ts
+var COMPLIANCE_AREA_MAP = {
+  disclosure: ["compliance-disclosure"],
+  biasTesting: ["compliance-bias"],
+  reportingExports: ["compliance-reporting"],
+  loggingMonitoring: ["compliance-logging"],
+  humanOversight: ["compliance-oversight"],
+  dataGovernance: ["compliance-data"],
+  incidentReporting: ["compliance-incident"]
+};
+var COMPLIANCE_AREA_LABELS = {
+  disclosure: "AI disclosure",
+  biasTesting: "bias testing",
+  reportingExports: "reporting and exports",
+  loggingMonitoring: "logging and monitoring",
+  humanOversight: "human oversight",
+  dataGovernance: "data governance",
+  incidentReporting: "incident reporting"
+};
+var AI_CATEGORIES = /* @__PURE__ */ new Set([
+  "ai-provider",
+  "ai-framework",
+  "ai-model",
+  "local-inference"
+]);
+var BOM_CATEGORIES = /* @__PURE__ */ new Set([
+  "ai-provider",
+  "ai-framework",
+  "ai-model",
+  "local-inference",
+  "rag",
+  "training",
+  "framework",
+  "runtime"
+]);
+var CATEGORY_TO_BOM_KIND = {
+  "ai-provider": "inference-provider",
+  "ai-framework": "ai-framework",
+  "ai-model": "model",
+  "local-inference": "inference-provider",
+  framework: "framework",
+  runtime: "runtime",
+  rag: "vector-store",
+  training: "dataset"
+};
+var SOURCE_PRIORITY = {
+  "package.json": 5,
+  config: 4,
+  code: 3,
+  "lock-file": 2,
+  docs: 1
+};
+var EVIDENCE_PROVENANCE_PRIORITY = {
+  runtime: 5,
+  config: 4,
+  tooling: 3,
+  "root-docs": 2,
+  docs: 1,
+  test: 0,
+  fixture: 0,
+  example: 0,
+  generated: 0
+};
+function hasAI(signals) {
+  return signals.some((signal) => AI_CATEGORIES.has(signal.category));
+}
+function highestConfidence(signals) {
+  if (signals.some((signal) => signal.confidence === "high")) return "high";
+  if (signals.some((signal) => signal.confidence === "medium")) return "medium";
+  return "low";
+}
+function collectEvidence(signals) {
+  return normalizeEvidence(signals.flatMap((signal) => signal.evidence));
+}
+function uniquePush(items, value) {
+  if (!items.includes(value)) items.push(value);
+}
+function toKebabCase(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function makeBomComponentId(kind, name) {
+  const slug = toKebabCase(name);
+  return `${kind}:${slug || "component"}`;
+}
+function compareEvidence(left, right) {
+  const leftPriority = left.provenance ? EVIDENCE_PROVENANCE_PRIORITY[left.provenance] : 0;
+  const rightPriority = right.provenance ? EVIDENCE_PROVENANCE_PRIORITY[right.provenance] : 0;
+  if (leftPriority !== rightPriority) {
+    return rightPriority - leftPriority;
+  }
+  if (left.file !== right.file) {
+    return left.file.localeCompare(right.file);
+  }
+  return (left.line ?? 0) - (right.line ?? 0);
+}
+function normalizeEvidence(evidence, maxItems = 12) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const item of evidence) {
+    const key = `${item.file}:${item.line ?? 0}:${item.snippet}`;
+    if (!unique.has(key)) {
+      unique.set(key, item);
+    }
+  }
+  return [...unique.values()].sort(compareEvidence).slice(0, maxItems);
+}
+var SIGNAL_NAME_MAP = [
+  ["react", "React"],
+  ["express", "Express"],
+  ["fastify", "Fastify"],
+  ["nestjs", "NestJS"],
+  ["nodejs", "Node.js"],
+  ["langchain", "LangChain"],
+  ["llamaindex", "LlamaIndex"],
+  ["transformers", "Transformers.js"],
+  ["anthropic", "Anthropic"],
+  ["azure", "Azure OpenAI"],
+  ["ollama", "Ollama"],
+  ["onnx", "ONNX Runtime"],
+  ["chroma", "ChromaDB"],
+  ["qdrant", "Qdrant"],
+  ["pinecone", "Pinecone"],
+  ["weaviate", "Weaviate"],
+  ["pgvector", "pgvector"]
+];
+function canonicalizeSignalName(signal) {
+  const id = signal.id.toLowerCase();
+  const lowerName = signal.name.toLowerCase();
+  if (id.includes("next") || lowerName === "nextjs") return "Next.js";
+  if (id.includes("openai")) return signal.category === "ai-provider" ? "OpenAI" : "OpenAI SDK";
+  if (id.includes("google") || id.includes("gemini")) return "Google AI";
+  if (id.includes("llamacpp") || lowerName.includes("llama.cpp")) return "llama.cpp";
+  if (id.includes("turborepo") || lowerName.includes("turborepo")) return "Monorepo (Turborepo)";
+  for (const [key, canonical] of SIGNAL_NAME_MAP) {
+    if (id.includes(key)) return canonical;
+  }
+  return signal.name;
+}
+var LOCAL_INFERENCE_MAP = [
+  ["ollama", "local-ollama"],
+  ["transformers", "browser-transformers"],
+  ["onnx", "local-onnx"],
+  ["llama", "local-llama"]
+];
+var CLOUD_PROVIDER_MAP = [
+  ["openai", "cloud-openai"],
+  ["anthropic", "cloud-anthropic"],
+  ["google", "cloud-google"],
+  ["gemini", "cloud-google"],
+  ["azure", "cloud-azure"]
+];
+function lookupInferenceMode(id, entries, prefix, name) {
+  for (const [key, mode] of entries) {
+    if (id.includes(key)) return mode;
+  }
+  const slug = toKebabCase(name);
+  return slug ? `${prefix}-${slug}` : null;
+}
+function canonicalizeInferenceMode(signal) {
+  const id = signal.id.toLowerCase();
+  const name = canonicalizeSignalName(signal);
+  if (signal.category === "local-inference") {
+    return lookupInferenceMode(id, LOCAL_INFERENCE_MAP, "local", name);
+  }
+  if (signal.category === "ai-provider") {
+    return lookupInferenceMode(id, CLOUD_PROVIDER_MAP, "cloud", name);
+  }
+  return null;
+}
+function deriveSource(evidence) {
+  let strongest = "code";
+  for (const item of evidence) {
+    let source = "code";
+    if (item.file.endsWith("package.json")) source = "package.json";
+    else if (item.file.endsWith("pnpm-lock.yaml") || item.file.endsWith("package-lock.json") || item.file.endsWith("yarn.lock")) {
+      source = "lock-file";
+    } else if (item.provenance === "config") {
+      source = "config";
+    } else if (item.provenance === "root-docs" || item.provenance === "docs") {
+      source = "docs";
+    }
+    if (SOURCE_PRIORITY[source] > SOURCE_PRIORITY[strongest]) {
+      strongest = source;
+    }
+  }
+  return strongest;
+}
+function buildAiFootprint(signals) {
+  const usesAI = hasAI(signals);
+  const inferenceModes = [];
+  const providerHints = [];
+  const ragHints = [];
+  for (const signal of signals) {
+    const mode = canonicalizeInferenceMode(signal);
+    if (mode) uniquePush(inferenceModes, mode);
+    if (signal.category === "ai-provider") {
+      uniquePush(providerHints, toKebabCase(canonicalizeSignalName(signal)));
+    }
+    if (signal.category === "rag" && signal.confidence !== "low") {
+      uniquePush(ragHints, canonicalizeSignalName(signal));
+    }
+  }
+  return { usesAI, inferenceModes, providerHints, ragHints };
+}
+function buildComplianceSignalGroup(implementationSignals, aiDetected) {
+  if (implementationSignals.length === 0) {
+    return {
+      status: aiDetected ? "absent" : "unknown",
+      confidence: "low",
+      evidence: []
+    };
+  }
+  const confidence = highestConfidence(implementationSignals);
+  return {
+    status: confidence === "high" ? "present" : "partial",
+    confidence,
+    evidence: collectEvidence(implementationSignals)
+  };
+}
+function evaluateComplianceAreas(signals, aiDetected) {
+  const result = {};
+  for (const key of Object.keys(COMPLIANCE_AREA_MAP)) {
+    const { implementationSignals, supportingSignals } = evaluateSignalsForCategories(
+      signals,
+      COMPLIANCE_AREA_MAP[key]
+    );
+    result[key] = {
+      group: buildComplianceSignalGroup(implementationSignals, aiDetected),
+      implementationSignals,
+      supportingSignals
+    };
+  }
+  return result;
+}
+function buildAssessmentHints2(signals, complianceAreas, openQuestions) {
+  const possibleModes = [];
+  const riskIndicators = [];
+  const gpaiIndicators = [];
+  const aiDetected = hasAI(signals);
+  if (!aiDetected) {
+    return {
+      possibleModes: [],
+      riskIndicators: [],
+      gpaiIndicators: [],
+      openQuestions: openQuestions.map((question) => question.question)
+    };
+  }
+  const hasCloudProvider = signals.some((signal) => signal.category === "ai-provider");
+  const hasLocalInference = signals.some((signal) => signal.category === "local-inference");
+  if (hasCloudProvider) {
+    possibleModes.push("gpai-user");
+    const providers = Array.from(
+      new Set(
+        signals.filter((signal) => signal.category === "ai-provider").map((signal) => canonicalizeSignalName(signal))
+      )
+    );
+    gpaiIndicators.push({
+      hint: `GPAI model usage detected \u2014 cloud providers found: ${providers.join(", ")}. Provider obligations depend on your role and downstream distribution.`,
+      articleRef: "Art. 53",
+      confidence: "medium"
+    });
+  }
+  if (hasLocalInference) {
+    gpaiIndicators.push({
+      hint: "Local deployment detected \u2014 provider-side GPAI obligations are less likely unless you distribute or provide downstream access to the model.",
+      articleRef: "Art. 53",
+      confidence: "low"
+    });
+  }
+  if (complianceAreas.biasTesting.group.status !== "absent") {
+    riskIndicators.push({
+      hint: "Bias evaluation infrastructure detected \u2014 this can support Art. 10 evidence if it is part of your real evaluation workflow.",
+      articleRef: "Art. 10",
+      confidence: complianceAreas.biasTesting.group.confidence
+    });
+  }
+  if (signals.some((signal) => signal.category === "training")) {
+    riskIndicators.push({
+      hint: "Training or fine-tuning signals detected \u2014 data governance and provider obligations may apply depending on your role.",
+      articleRef: "Art. 10",
+      confidence: "high"
+    });
+    possibleModes.push("gpai-provider");
+  }
+  for (const [key, evaluation] of Object.entries(complianceAreas)) {
+    if (evaluation.implementationSignals.length > 0 || evaluation.supportingSignals.length === 0) {
+      continue;
+    }
+    riskIndicators.push({
+      hint: `Documentation references ${COMPLIANCE_AREA_LABELS[key]}, but no production implementation evidence was detected.`,
+      confidence: "low"
+    });
+  }
+  if (!possibleModes.includes("annex-iii-unclear")) {
+    possibleModes.push("annex-iii-unclear");
+  }
+  return {
+    possibleModes,
+    riskIndicators,
+    gpaiIndicators,
+    openQuestions: openQuestions.map((question) => question.question)
+  };
+}
+var GAP_RULES = [
+  {
+    id: "gap-disclosure",
+    title: "No AI disclosure mechanism detected",
+    description: "The EU AI Act requires that users are informed when interacting with AI systems. No user-facing disclosure implementation was found in the production codebase.",
+    priority: "critical",
+    area: "disclosure"
+  },
+  {
+    id: "gap-logging",
+    title: "No logging or monitoring infrastructure detected",
+    description: "AI system outputs and decisions should be logged for traceability and audit purposes. No production logging infrastructure was detected.",
+    priority: "high",
+    area: "loggingMonitoring"
+  },
+  {
+    id: "gap-oversight",
+    title: "No human oversight mechanism detected",
+    description: "High-risk AI systems require human oversight capabilities. No production review or override mechanisms were found.",
+    priority: "high",
+    area: "humanOversight"
+  },
+  {
+    id: "gap-bias",
+    title: "No bias testing infrastructure detected",
+    description: "AI systems should be evaluated for bias and discrimination. No production-grade bias evaluation tooling was found.",
+    priority: "medium",
+    area: "biasTesting"
+  },
+  {
+    id: "gap-data",
+    title: "No data governance mechanisms detected",
+    description: "Training and inference data should be governed with clear provenance and quality controls. No production data governance infrastructure was found.",
+    priority: "medium",
+    area: "dataGovernance"
+  },
+  {
+    id: "gap-incident",
+    title: "No incident reporting mechanism detected",
+    description: "AI system incidents should be reportable and trackable. No production incident reporting infrastructure was found.",
+    priority: "medium",
+    area: "incidentReporting"
+  }
+];
+function buildGaps(complianceAreas, aiDetected) {
+  if (!aiDetected) return [];
+  const gaps = [];
+  for (const rule of GAP_RULES) {
+    const evaluation = complianceAreas[rule.area];
+    const confidence = highestConfidence(evaluation.implementationSignals);
+    if (evaluation.implementationSignals.length === 0) {
+      gaps.push({
+        id: rule.id,
+        title: rule.title,
+        description: rule.description,
+        priority: rule.priority,
+        status: "missing",
+        basis: "scanner-rule",
+        evidence: []
+      });
+      continue;
+    }
+    if (confidence !== "high") {
+      gaps.push({
+        id: rule.id,
+        title: `${rule.title.replace("No ", "Partial ")}`.replace(" detected", ""),
+        description: `Some implementation signals were found, but confidence is not yet high. ${rule.description}`,
+        priority: rule.priority === "critical" ? "high" : rule.priority === "high" ? "medium" : "low",
+        status: "partial",
+        basis: "scanner-rule",
+        evidence: collectEvidence(evaluation.implementationSignals)
+      });
+    }
+  }
+  return gaps;
+}
+function buildRecommendationSummary(gaps, openQuestions, complianceAreas) {
+  const recommendations = [];
+  const priorityOrder = {
+    critical: 0,
+    high: 1,
+    medium: 2,
+    low: 3
+  };
+  const sortedGaps = [...gaps].sort(
+    (left, right) => priorityOrder[left.priority] - priorityOrder[right.priority]
+  );
+  for (const gap of sortedGaps.slice(0, 4)) {
+    const prefix = gap.status === "missing" ? "Implement" : "Strengthen";
+    recommendations.push(`[${gap.priority.toUpperCase()}] ${prefix}: ${gap.title}`);
+  }
+  if (recommendations.length < 4) {
+    for (const [key, evaluation] of Object.entries(complianceAreas)) {
+      if (evaluation.implementationSignals.length > 0 || evaluation.supportingSignals.length === 0) {
+        continue;
+      }
+      recommendations.push(
+        `[LOW] Convert documented ${COMPLIANCE_AREA_LABELS[key]} into production implementation evidence`
+      );
+      if (recommendations.length >= 4) break;
+    }
+  }
+  if (openQuestions.length > 0) {
+    recommendations.push(
+      `Resolve ${openQuestions.length} open question(s) that require human context`
+    );
+  }
+  const finalRecommendation = "Review the generated artifacts and complete role/risk classification in the EuConform web app";
+  return [...recommendations.slice(0, 4), finalRecommendation];
+}
+function buildDetectedStack(signals) {
+  const stack = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const signal of signals) {
+    if (signal.category !== "framework" && signal.category !== "runtime" && signal.category !== "ai-framework") {
+      continue;
+    }
+    const canonicalName = canonicalizeSignalName(signal);
+    const key = canonicalName.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    stack.push(canonicalName);
+  }
+  return stack;
+}
+function hasCapability(group) {
+  return group.status === "present" || group.status === "partial";
+}
+function resolveBomKind(signal, canonicalName) {
+  if (signal.category === "rag") {
+    return canonicalName.toLowerCase().includes("embedding") ? "embedding" : "vector-store";
+  }
+  return CATEGORY_TO_BOM_KIND[signal.category] ?? "tool";
+}
+function buildAiBom(scanResult, complianceAreas, generatedAt) {
+  const components = [];
+  const componentIndex = /* @__PURE__ */ new Map();
+  for (const signal of scanResult.signals) {
+    if (!BOM_CATEGORIES.has(signal.category)) continue;
+    if (signal.category === "rag" && signal.confidence === "low") continue;
+    const canonicalName = canonicalizeSignalName(signal);
+    const kind = resolveBomKind(signal, canonicalName);
+    const key = `${kind}:${canonicalName.toLowerCase()}`;
+    const source = deriveSource(signal.evidence);
+    const existingIndex = componentIndex.get(key);
+    if (existingIndex === void 0) {
+      componentIndex.set(key, components.length);
+      components.push({
+        id: makeBomComponentId(kind, canonicalName),
+        kind,
+        name: canonicalName,
+        source
+      });
+      continue;
+    }
+    const existing = components[existingIndex];
+    if (!existing) continue;
+    if (SOURCE_PRIORITY[source] > SOURCE_PRIORITY[existing.source]) {
+      existing.source = source;
+    }
+  }
+  const reportingSignals = complianceAreas.reportingExports.implementationSignals;
+  return {
+    schemaVersion: "euconform.aibom.v1",
+    generatedAt,
+    project: {
+      name: scanResult.repo.name,
+      rootPath: scanResult.meta.targetPath
+    },
+    components: [...components].sort(
+      (left, right) => `${left.kind}:${left.name}`.localeCompare(`${right.kind}:${right.name}`)
+    ),
+    complianceCapabilities: {
+      biasEvaluation: hasCapability(complianceAreas.biasTesting.group),
+      jsonExport: reportingSignals.some((signal) => signal.id.includes("json")),
+      pdfExport: reportingSignals.some((signal) => signal.id.includes("pdf")),
+      loggingInfrastructure: hasCapability(complianceAreas.loggingMonitoring.group),
+      humanReviewFlow: hasCapability(complianceAreas.humanOversight.group),
+      incidentHandling: hasCapability(complianceAreas.incidentReporting.group)
+    }
+  };
+}
+function generateScanOutput(scanResult) {
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const aiDetected = hasAI(scanResult.signals);
+  const complianceAreas = evaluateComplianceAreas(scanResult.signals, aiDetected);
+  const report = {
+    schemaVersion: "euconform.report.v1",
+    generatedAt,
+    tool: {
+      name: "euconform",
+      version: scanResult.meta.toolVersion
+    },
+    target: {
+      rootPath: scanResult.meta.targetPath,
+      name: scanResult.repo.name,
+      repoType: scanResult.appTypes[0] ?? "unknown",
+      detectedStack: buildDetectedStack(scanResult.signals)
+    },
+    aiFootprint: buildAiFootprint(scanResult.signals),
+    complianceSignals: {
+      disclosure: complianceAreas.disclosure.group,
+      biasTesting: complianceAreas.biasTesting.group,
+      reportingExports: complianceAreas.reportingExports.group,
+      loggingMonitoring: complianceAreas.loggingMonitoring.group,
+      humanOversight: complianceAreas.humanOversight.group,
+      dataGovernance: complianceAreas.dataGovernance.group,
+      incidentReporting: complianceAreas.incidentReporting.group
+    },
+    assessmentHints: buildAssessmentHints2(
+      scanResult.signals,
+      complianceAreas,
+      scanResult.openQuestions
+    ),
+    gaps: buildGaps(complianceAreas, aiDetected),
+    recommendationSummary: []
+  };
+  report.recommendationSummary = buildRecommendationSummary(
+    report.gaps,
+    scanResult.openQuestions,
+    complianceAreas
+  );
+  const aibom = buildAiBom(scanResult, complianceAreas, generatedAt);
+  const summaryMarkdown = generateSummaryMarkdown(report, aibom, scanResult.meta.scanScope);
+  return { report, aibom, summaryMarkdown };
+}
+
+// ../core/src/evidence/hash.ts
+import { createHash } from "crypto";
+function sha256Hex(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+
+// ../core/src/evidence/bundle.ts
+function extractSchemaVersion(content) {
+  try {
+    const parsed = JSON.parse(content);
+    return typeof parsed.schemaVersion === "string" ? parsed.schemaVersion : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function makeArtifactRef(role, input, required) {
+  const isJson = input.fileName.endsWith(".json");
+  const ref = {
+    role,
+    fileName: input.fileName,
+    sha256: sha256Hex(input.content),
+    required
+  };
+  if (isJson) {
+    const sv = extractSchemaVersion(input.content);
+    if (sv) ref.schemaVersion = sv;
+  } else {
+    ref.mimeType = "text/markdown";
+  }
+  return ref;
+}
+function buildBundleManifest(opts) {
+  const artifacts = [makeArtifactRef("report", opts.report, true)];
+  if (opts.aibom) artifacts.push(makeArtifactRef("aibom", opts.aibom, false));
+  if (opts.ci) artifacts.push(makeArtifactRef("ci", opts.ci, false));
+  if (opts.summary) artifacts.push(makeArtifactRef("summary", opts.summary, false));
+  return {
+    schemaVersion: "euconform.bundle.v1",
+    generatedAt: opts.generatedAt,
+    tool: opts.tool,
+    target: opts.target,
+    artifacts
+  };
+}
+
+// ../core/src/evidence/validate.ts
+function assertObject(data, label) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new Error(`Invalid ${label}: expected a JSON object`);
+  }
+  return data;
+}
+function requireSchemaVersion(obj, expected, label) {
+  if (obj.schemaVersion !== expected) {
+    throw new Error(
+      `Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`
+    );
+  }
+}
+function requireField(obj, key, type, label, fieldName = key) {
+  if (!(key in obj)) {
+    throw new Error(`Invalid ${label}: missing '${fieldName}'`);
+  }
+  const value = obj[key];
+  const isValid = type === "array" && Array.isArray(value) || type === "object" && value && typeof value === "object" && !Array.isArray(value) || type === "string" && typeof value === "string" || type === "boolean" && typeof value === "boolean" || type === "number" && typeof value === "number";
+  if (!isValid) {
+    throw new Error(`Invalid ${label}: '${fieldName}' must be a ${type}`);
+  }
+  return value;
+}
+function requireStringArray(obj, key, label, fieldName = key) {
+  const value = requireField(obj, key, "array", label, fieldName);
+  if (!value.every((item) => typeof item === "string")) {
+    throw new Error(`Invalid ${label}: '${fieldName}' must contain strings`);
+  }
+  return value;
+}
+function majorVersion(schemaVersion) {
+  const match = /\.v(\d+)$/.exec(schemaVersion);
+  return match?.[1] ?? null;
+}
+function getSchemaMajorVersion(schemaVersion) {
+  return majorVersion(schemaVersion);
+}
+function validateScanReport(data) {
+  const obj = assertObject(data, "report");
+  requireSchemaVersion(obj, "euconform.report.v1", "report");
+  requireField(obj, "generatedAt", "string", "report");
+  const tool = requireField(obj, "tool", "object", "report");
+  requireField(tool, "name", "string", "report", "tool.name");
+  requireField(tool, "version", "string", "report", "tool.version");
+  const target = requireField(obj, "target", "object", "report");
+  requireField(target, "rootPath", "string", "report", "target.rootPath");
+  requireField(target, "name", "string", "report", "target.name");
+  requireField(target, "repoType", "string", "report", "target.repoType");
+  requireField(target, "detectedStack", "array", "report", "target.detectedStack");
+  const aiFootprint = requireField(obj, "aiFootprint", "object", "report");
+  requireField(aiFootprint, "usesAI", "boolean", "report", "aiFootprint.usesAI");
+  requireStringArray(aiFootprint, "inferenceModes", "report", "aiFootprint.inferenceModes");
+  requireStringArray(aiFootprint, "providerHints", "report", "aiFootprint.providerHints");
+  requireStringArray(aiFootprint, "ragHints", "report", "aiFootprint.ragHints");
+  requireField(obj, "complianceSignals", "object", "report");
+  const hints = requireField(obj, "assessmentHints", "object", "report");
+  requireStringArray(hints, "possibleModes", "report", "assessmentHints.possibleModes");
+  requireField(hints, "riskIndicators", "array", "report", "assessmentHints.riskIndicators");
+  requireField(hints, "gpaiIndicators", "array", "report", "assessmentHints.gpaiIndicators");
+  requireStringArray(hints, "openQuestions", "report", "assessmentHints.openQuestions");
+  requireField(obj, "gaps", "array", "report");
+  requireStringArray(obj, "recommendationSummary", "report");
+  return data;
+}
+function validateAiBillOfMaterials(data) {
+  const obj = assertObject(data, "AIBOM");
+  requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
+  requireField(obj, "generatedAt", "string", "AIBOM");
+  const project = requireField(obj, "project", "object", "AIBOM");
+  requireField(project, "name", "string", "AIBOM", "project.name");
+  requireField(project, "rootPath", "string", "AIBOM", "project.rootPath");
+  requireField(obj, "components", "array", "AIBOM");
+  requireField(obj, "complianceCapabilities", "object", "AIBOM");
+  return data;
+}
+function validateCiReport(data) {
+  const obj = assertObject(data, "CI report");
+  requireSchemaVersion(obj, "euconform.ci.v1", "CI report");
+  requireField(obj, "generatedAt", "string", "CI report");
+  const target = requireField(obj, "target", "object", "CI report");
+  requireField(target, "name", "string", "CI report", "target.name");
+  requireField(target, "rootPath", "string", "CI report", "target.rootPath");
+  const status = requireField(obj, "status", "object", "CI report");
+  requireField(status, "failOn", "string", "CI report", "status.failOn");
+  requireField(status, "failing", "boolean", "CI report", "status.failing");
+  requireField(status, "openQuestions", "number", "CI report", "status.openQuestions");
+  const gapCounts = requireField(
+    status,
+    "gapCounts",
+    "object",
+    "CI report",
+    "status.gapCounts"
+  );
+  for (const key of ["critical", "high", "medium", "low"]) {
+    requireField(gapCounts, key, "number", "CI report", `status.gapCounts.${key}`);
+  }
+  requireField(obj, "aiDetected", "boolean", "CI report");
+  requireField(obj, "scanScope", "string", "CI report");
+  requireField(obj, "artifacts", "array", "CI report");
+  requireField(obj, "complianceOverview", "array", "CI report");
+  requireField(obj, "topGaps", "array", "CI report");
+  return data;
+}
+var VALID_BUNDLE_ROLES = /* @__PURE__ */ new Set(["report", "aibom", "ci", "summary"]);
+var SHA256_HEX = /^[a-f0-9]{64}$/;
+function validateScanBundle(data) {
+  const obj = assertObject(data, "bundle");
+  requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
+  requireField(obj, "generatedAt", "string", "bundle");
+  const tool = requireField(obj, "tool", "object", "bundle");
+  requireField(tool, "name", "string", "bundle", "tool.name");
+  requireField(tool, "version", "string", "bundle", "tool.version");
+  const target = requireField(obj, "target", "object", "bundle");
+  requireField(target, "name", "string", "bundle", "target.name");
+  requireField(target, "rootPath", "string", "bundle", "target.rootPath");
+  const artifacts = requireField(obj, "artifacts", "array", "bundle");
+  if (artifacts.length === 0) {
+    throw new Error("Invalid bundle: 'artifacts' must contain at least one artifact");
+  }
+  const seenRoles = /* @__PURE__ */ new Set();
+  const seenFiles = /* @__PURE__ */ new Set();
+  const bundleMajor = majorVersion("euconform.bundle.v1");
+  let hasRequiredReport = false;
+  for (let index = 0; index < artifacts.length; index++) {
+    const artifact = assertObject(artifacts[index], "bundle artifact");
+    const role = requireField(
+      artifact,
+      "role",
+      "string",
+      "bundle artifact",
+      `artifacts[${index}].role`
+    );
+    const fileName = requireField(
+      artifact,
+      "fileName",
+      "string",
+      "bundle artifact",
+      `artifacts[${index}].fileName`
+    );
+    const sha256 = requireField(
+      artifact,
+      "sha256",
+      "string",
+      "bundle artifact",
+      `artifacts[${index}].sha256`
+    );
+    const required = requireField(
+      artifact,
+      "required",
+      "boolean",
+      "bundle artifact",
+      `artifacts[${index}].required`
+    );
+    if (!VALID_BUNDLE_ROLES.has(role)) {
+      throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
+    }
+    if (!SHA256_HEX.test(sha256)) {
+      throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
+    }
+    if (seenRoles.has(role)) {
+      throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
+    }
+    if (seenFiles.has(fileName)) {
+      throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
+    }
+    seenRoles.add(role);
+    seenFiles.add(fileName);
+    const declaredSchemaVersion = artifact.schemaVersion;
+    if (declaredSchemaVersion !== void 0 && typeof declaredSchemaVersion !== "string") {
+      throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
+    }
+    if (artifact.mimeType !== void 0 && typeof artifact.mimeType !== "string") {
+      throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
+    }
+    if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
+      throw new Error(
+        `Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`
+      );
+    }
+    if (role === "report") {
+      hasRequiredReport = required;
+    }
+  }
+  if (!hasRequiredReport) {
+    throw new Error("Invalid bundle: a required 'report' artifact is mandatory");
+  }
+  return data;
+}
+
+// ../core/src/scanner/aggregator.ts
+import { basename as basename3 } from "path";
+
+// ../core/src/scanner/detectors/shared.ts
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
+var EXTENDED_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".json",
+  ".yaml",
+  ".yml"
+]);
+var CONFIDENCE_RANK = {
+  high: 2,
+  medium: 1,
+  low: 0
+};
+function higherConfidence(a, b) {
+  return CONFIDENCE_RANK[a] >= CONFIDENCE_RANK[b] ? a : b;
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ../core/src/scanner/detectors/ai-framework-detector.ts
+var FRAMEWORK_IMPORTS = [
+  {
+    id: "ai-framework-langchain",
+    name: "LangChain",
+    importPattern: /(?:from\s+['"]langchain[/'"]|require\s*\(\s*['"]langchain[/'"])/
+  },
+  {
+    id: "ai-framework-langchain-core",
+    name: "LangChain Core",
+    importPattern: /(?:from\s+['"]@langchain\/[^'"]+['"]|require\s*\(\s*['"]@langchain\/[^'"]+['"])/
+  },
+  {
+    id: "ai-framework-llamaindex",
+    name: "LlamaIndex",
+    importPattern: /(?:from\s+['"]llamaindex[/'"]|require\s*\(\s*['"]llamaindex[/'"])/
+  },
+  {
+    id: "ai-framework-transformers",
+    name: "Transformers.js",
+    importPattern: /(?:from\s+['"]@xenova\/transformers['"]|require\s*\(\s*['"]@xenova\/transformers['"])/
+  },
+  {
+    id: "ai-framework-vercel-ai",
+    name: "Vercel AI SDK",
+    // Only match Vercel AI SDK subpath imports (ai/react, ai/rsc) to avoid false positives
+    // on generic "ai" package name. Bare "ai" import matched only with package.json cross-check.
+    importPattern: /(?:from\s+['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"']|require\s*\(\s*['"]ai\/(?:react|rsc|svelte|vue|solid|core)['"])/
+  },
+  {
+    id: "ai-framework-huggingface",
+    name: "HuggingFace",
+    importPattern: /(?:from\s+['"]@huggingface\/[^'"]+['"]|require\s*\(\s*['"]@huggingface\/[^'"]+['"])/
+  }
+];
+function detectAiFrameworkSignals(ctx) {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+  const lines = ctx.lines;
+  const signalMap = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const lineNum = i + 1;
+    for (const framework of FRAMEWORK_IMPORTS) {
+      if (framework.importPattern.test(line)) {
+        const existing = signalMap.get(framework.id);
+        const evidence = {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200)
+        };
+        if (existing) {
+          existing.evidence.push(evidence);
+        } else {
+          signalMap.set(framework.id, {
+            id: framework.id,
+            name: framework.name,
+            category: "ai-framework",
+            confidence: "medium",
+            evidence: [evidence]
+          });
+        }
+      }
+    }
+  }
+  return Array.from(signalMap.values());
+}
+
+// ../core/src/scanner/detectors/ai-provider-detector.ts
+var PROVIDER_IMPORTS = [
+  {
+    id: "ai-provider-openai",
+    name: "OpenAI SDK",
+    importPattern: /(?:from\s+['"]openai['"]|require\s*\(\s*['"]openai['"])/
+  },
+  {
+    id: "ai-provider-anthropic",
+    name: "Anthropic SDK",
+    importPattern: /(?:from\s+['"]@anthropic-ai\/sdk['"]|require\s*\(\s*['"]@anthropic-ai\/sdk['"])/
+  },
+  {
+    id: "ai-provider-cohere",
+    name: "Cohere SDK",
+    importPattern: /(?:from\s+['"]cohere-ai['"]|require\s*\(\s*['"]cohere-ai['"])/
+  },
+  {
+    id: "ai-provider-google-genai",
+    name: "Google Generative AI",
+    importPattern: /(?:from\s+['"]@google\/generative-ai['"]|require\s*\(\s*['"]@google\/generative-ai['"])/
+  },
+  {
+    id: "ai-provider-mistral",
+    name: "Mistral AI SDK",
+    importPattern: /(?:from\s+['"]@mistralai\/mistralai['"]|require\s*\(\s*['"]@mistralai\/mistralai['"])/
+  }
+];
+var API_ENDPOINTS = [
+  {
+    id: "ai-provider-openai-api",
+    name: "OpenAI API endpoint",
+    pattern: /api\.openai\.com/
+  },
+  {
+    id: "ai-provider-anthropic-api",
+    name: "Anthropic API endpoint",
+    pattern: /api\.anthropic\.com/
+  },
+  {
+    id: "ai-provider-cohere-api",
+    name: "Cohere API endpoint",
+    pattern: /api\.cohere\.ai/
+  }
+];
+function detectAiProviderSignals(ctx) {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+  const lines = ctx.lines;
+  const signalMap = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const lineNum = i + 1;
+    for (const provider of PROVIDER_IMPORTS) {
+      if (provider.importPattern.test(line)) {
+        addEvidence(signalMap, provider.id, provider.name, "medium", {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200)
+        });
+      }
+    }
+    for (const endpoint of API_ENDPOINTS) {
+      if (endpoint.pattern.test(line)) {
+        addEvidence(signalMap, endpoint.id, endpoint.name, "medium", {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200)
+        });
+      }
+    }
+  }
+  return Array.from(signalMap.values());
+}
+function addEvidence(map, id, name, confidence, evidence) {
+  const existing = map.get(id);
+  if (existing) {
+    existing.evidence.push(evidence);
+  } else {
+    map.set(id, {
+      id,
+      name,
+      category: "ai-provider",
+      confidence,
+      evidence: [evidence]
+    });
+  }
+}
+
+// ../core/src/scanner/detectors/compliance-detector.ts
+var rules = [
+  // --- compliance-disclosure ---
+  {
+    id: "compliance-disclosure-ai-generated",
+    name: "AI disclosure text",
+    category: "compliance-disclosure",
+    pattern: /\b(?:generated\s+by\s+ai|ai[- ]generated|powered\s+by\s+ai)\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-disclosure-ai-notice",
+    name: "AI transparency notice",
+    category: "compliance-disclosure",
+    pattern: /\b(?:artificial\s+intelligence|machine\s+learning\s+model|transparency\s+notice)\b/i,
+    confidence: "medium"
+  },
+  // --- compliance-logging ---
+  {
+    id: "compliance-logging-structured",
+    name: "Structured logging library",
+    category: "compliance-logging",
+    pattern: /\bfrom\s+['"](?:winston|pino|bunyan)['"]|\brequire\(\s*['"](?:winston|pino|bunyan)['"]\)/,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-logging-audit",
+    name: "Audit trail pattern",
+    category: "compliance-logging",
+    pattern: /\b(?:audit[._-]?log|audit[._-]?trail|log[._-]?audit)\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-logging-middleware",
+    name: "Logging middleware",
+    category: "compliance-logging",
+    pattern: /\b(?:logging[Mm]iddleware|requestLogger|morgan)\b/,
+    confidence: "low"
+  },
+  // --- compliance-oversight ---
+  {
+    id: "compliance-oversight-review",
+    name: "Human review flow",
+    category: "compliance-oversight",
+    pattern: /\b(?:human[_-]?review|manual[_-]?review|approval[_-]?flow|review[_-]?gate)\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-oversight-approve-reject",
+    name: "Approval/rejection mechanism",
+    category: "compliance-oversight",
+    pattern: /\b(?:onApprove|onReject|handleApproval|approveAction|rejectAction)\b/,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-oversight-override",
+    name: "Override mechanism",
+    category: "compliance-oversight",
+    pattern: /\b(?:override[_-]?ai|human[_-]?override|manual[_-]?override)\b/i,
+    confidence: "medium"
+  },
+  // --- compliance-bias ---
+  {
+    id: "compliance-bias-fairness",
+    name: "Fairness/bias testing",
+    category: "compliance-bias",
+    pattern: /\b(?:fairness[_-]?test|bias[_-]?test|disparate[_-]?impact|demographic[_-]?parity)\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-bias-benchmark",
+    name: "Bias benchmark reference",
+    category: "compliance-bias",
+    pattern: /\bCrowS[_-]?Pairs\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-bias-euconform",
+    name: "EuConform bias utilities",
+    category: "compliance-bias",
+    pattern: /\bfrom\s+['"]@euconform\/core.*bias/,
+    confidence: "medium"
+  },
+  // --- compliance-data ---
+  {
+    id: "compliance-data-quality",
+    name: "Data quality checks",
+    category: "compliance-data",
+    pattern: /\b(?:data[_-]?quality|data[_-]?validation|dataset[_-]?doc|data[_-]?lineage)\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-data-pii",
+    name: "PII handling / anonymization",
+    category: "compliance-data",
+    pattern: /\b(?:pii[_-]?filter|anonymi[sz]e|pseudonymi[sz]e|redact[_-]?pii)\b/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-data-gdpr",
+    name: "GDPR reference",
+    category: "compliance-data",
+    pattern: /\bGDPR\b|data[_-]?protection[_-]?regulation/i,
+    confidence: "low"
+  },
+  // --- compliance-reporting ---
+  {
+    id: "compliance-reporting-json",
+    name: "JSON export capability",
+    category: "compliance-reporting",
+    pattern: /\b(?:exportJSON|downloadJSON|writeJSONFile|saveJSONReport|exportAuditJSON|exportAnnexJSON|generateAnnexJson)\b|(?:writeFile(?:Sync)?|saveAs|download)\s*\([^)]*(?:report|audit|annex|compliance)[^)]*\.json/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-reporting-pdf",
+    name: "PDF export capability",
+    category: "compliance-reporting",
+    pattern: /\b(?:jspdf|pdf[_-]?lib|pdfmake|generatePDF|exportPDF|downloadPDF|renderPDF|generateAnnexPdf)\b|puppeteer.*\.pdf/i,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-reporting-report",
+    name: "Report generation",
+    category: "compliance-reporting",
+    pattern: /\b(?:generateReport|buildReport|exportReport|downloadReport|createReport|annex[_-]?iv[_-]?report|compliance[_-]?report|audit[_-]?report)\b/i,
+    confidence: "medium"
+  },
+  // --- compliance-incident ---
+  {
+    id: "compliance-incident-sentry",
+    name: "Sentry error reporting",
+    category: "compliance-incident",
+    pattern: /\bfrom\s+['"]@sentry\/|\bSentry\.init\b|\brequire\(\s*['"]@sentry\//,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-incident-boundary",
+    name: "Error boundary",
+    category: "compliance-incident",
+    pattern: /\bErrorBoundary\b|componentDidCatch/,
+    confidence: "medium"
+  },
+  {
+    id: "compliance-incident-response",
+    name: "Incident response hook",
+    category: "compliance-incident",
+    pattern: /\b(?:incident[_-]?report|incident[_-]?response|useIncident|alerting[_-]?hook)\b/i,
+    confidence: "medium"
+  }
+];
+function canEvaluateRule(rule, file) {
+  if (!IMPLEMENTATION_PROVENANCE.has(file.provenance)) return false;
+  if (rule.category === "compliance-disclosure") return isUserFacingPath(file.relativePath);
+  if (rule.requiresUserFacingPath) return isUserFacingPath(file.relativePath);
+  return true;
+}
+function gatherEvidence(lines, pattern, filePath, maxItems) {
+  const evidence = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    if (pattern.test(line)) {
+      evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+      if (evidence.length >= maxItems) break;
+    }
+  }
+  return evidence;
+}
+function detectCompliance(ctx) {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+  const signalMap = /* @__PURE__ */ new Map();
+  for (const rule of rules) {
+    if (!canEvaluateRule(rule, file)) continue;
+    const evidence = gatherEvidence(ctx.lines, rule.pattern, file.relativePath, 3);
+    if (evidence.length === 0) continue;
+    const existing = signalMap.get(rule.id);
+    if (existing) {
+      existing.evidence.push(...evidence);
+    } else {
+      signalMap.set(rule.id, {
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence
+      });
+    }
+  }
+  return Array.from(signalMap.values());
+}
+
+// ../core/src/scanner/detectors/config-detector.ts
+var envKeyRules = [
+  {
+    id: "ai-provider-openai",
+    name: "OpenAI API key",
+    category: "ai-provider",
+    pattern: /^OPENAI_API_KEY\b/,
+    confidence: "high"
+  },
+  {
+    id: "ai-provider-anthropic",
+    name: "Anthropic API key",
+    category: "ai-provider",
+    pattern: /^ANTHROPIC_API_KEY\b/,
+    confidence: "high"
+  },
+  {
+    id: "ai-provider-azure-openai",
+    name: "Azure OpenAI key",
+    category: "ai-provider",
+    pattern: /^AZURE_OPENAI_/,
+    confidence: "high"
+  },
+  {
+    id: "ai-provider-google-ai",
+    name: "Google AI key",
+    category: "ai-provider",
+    pattern: /^(?:GOOGLE_AI_API_KEY|GEMINI_API_KEY)\b/,
+    confidence: "high"
+  },
+  {
+    id: "ai-provider-cohere",
+    name: "Cohere API key",
+    category: "ai-provider",
+    pattern: /^COHERE_API_KEY\b/,
+    confidence: "high"
+  },
+  {
+    id: "ai-provider-replicate",
+    name: "Replicate API token",
+    category: "ai-provider",
+    pattern: /^REPLICATE_API_TOKEN\b/,
+    confidence: "high"
+  },
+  {
+    id: "ai-provider-huggingface",
+    name: "HuggingFace token",
+    category: "ai-provider",
+    pattern: /^HUGGINGFACE_TOKEN\b|^HF_TOKEN\b/,
+    confidence: "high"
+  },
+  {
+    id: "local-inference-ollama",
+    name: "Ollama host config",
+    category: "local-inference",
+    pattern: /^OLLAMA_HOST\b|^OLLAMA_BASE_URL\b/,
+    confidence: "high"
+  },
+  {
+    id: "rag-pinecone",
+    name: "Pinecone API key",
+    category: "rag",
+    pattern: /^PINECONE_API_KEY\b/,
+    confidence: "high"
+  },
+  {
+    id: "rag-weaviate",
+    name: "Weaviate config",
+    category: "rag",
+    pattern: /^WEAVIATE_/,
+    confidence: "high"
+  },
+  {
+    id: "rag-chroma",
+    name: "ChromaDB config",
+    category: "rag",
+    pattern: /^CHROMA_/,
+    confidence: "high"
+  }
+];
+var dockerServiceRules = [
+  {
+    id: "local-inference-ollama-docker",
+    name: "Ollama Docker service",
+    category: "local-inference",
+    pattern: /\bollama\/ollama\b|image:\s*ollama/,
+    confidence: "high"
+  },
+  {
+    id: "rag-chromadb-docker",
+    name: "ChromaDB Docker service",
+    category: "rag",
+    pattern: /\bchromadb\/chroma\b|image:\s*chroma/,
+    confidence: "high"
+  },
+  {
+    id: "rag-weaviate-docker",
+    name: "Weaviate Docker service",
+    category: "rag",
+    pattern: /\bsemitechnologies\/weaviate\b|image:\s*weaviate/,
+    confidence: "high"
+  },
+  {
+    id: "rag-redis-vector",
+    name: "Redis with vector module",
+    category: "rag",
+    pattern: /redis\/redis-stack|redisearch|redis-stack-server/,
+    confidence: "high"
+  },
+  {
+    id: "rag-qdrant-docker",
+    name: "Qdrant Docker service",
+    category: "rag",
+    pattern: /\bqdrant\/qdrant\b|image:\s*qdrant/,
+    confidence: "high"
+  }
+];
+var dockerfileRules = [
+  {
+    id: "local-inference-pip-ai",
+    name: "AI pip packages in Dockerfile",
+    category: "local-inference",
+    pattern: /pip\s+install\s+.*\b(?:torch|tensorflow|transformers|langchain|llama[-_]?cpp|vllm|onnxruntime)\b/,
+    confidence: "high"
+  },
+  {
+    id: "local-inference-model-download",
+    name: "Model download in Dockerfile",
+    category: "local-inference",
+    pattern: /\b(?:huggingface-cli\s+download|wget\s+.*(?:\.gguf|\.safetensors|\.bin)|COPY\s+.*(?:model|weights))\b/i,
+    confidence: "high"
+  }
+];
+function isEnvExample(relativePath) {
+  const basename4 = relativePath.split("/").pop() ?? "";
+  return /^\.env\.(?:example|sample)$/.test(basename4);
+}
+function isDockerCompose(relativePath) {
+  const basename4 = relativePath.split("/").pop() ?? "";
+  return /^docker-compose/.test(basename4);
+}
+function isDockerfile(relativePath) {
+  const basename4 = relativePath.split("/").pop() ?? "";
+  return /^Dockerfile/.test(basename4);
+}
+function detectConfig(ctx) {
+  const { file } = ctx;
+  const signals = [];
+  const lines = ctx.lines;
+  if (isEnvExample(file.relativePath)) {
+    detectEnvKeys(file.relativePath, lines, signals);
+  } else if (isDockerCompose(file.relativePath)) {
+    detectDockerServices(file.relativePath, lines, signals);
+  } else if (isDockerfile(file.relativePath)) {
+    detectDockerfilePatterns(file.relativePath, lines, signals);
+  }
+  return signals;
+}
+function extractEnvVarName(rawLine) {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#")) return null;
+  const eqIndex = line.indexOf("=");
+  return eqIndex >= 0 ? line.slice(0, eqIndex).trim() : line.trim();
+}
+function detectEnvKeys(relativePath, lines, signals) {
+  for (const rule of envKeyRules) {
+    const evidence = [];
+    for (let i = 0; i < lines.length; i++) {
+      const varName = extractEnvVarName(lines[i] ?? "");
+      if (varName && rule.pattern.test(varName)) {
+        evidence.push({ file: relativePath, line: i + 1, snippet: varName });
+      }
+    }
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence
+      });
+    }
+  }
+}
+function detectDockerServices(relativePath, lines, signals) {
+  for (const rule of dockerServiceRules) {
+    const evidence = [];
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      if (rule.pattern.test(line)) {
+        evidence.push({
+          file: relativePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 120)
+        });
+        if (evidence.length >= 3) break;
+      }
+    }
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence
+      });
+    }
+  }
+}
+function detectDockerfilePatterns(relativePath, lines, signals) {
+  for (const rule of dockerfileRules) {
+    const evidence = [];
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      if (rule.pattern.test(line)) {
+        evidence.push({
+          file: relativePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 120)
+        });
+        if (evidence.length >= 3) break;
+      }
+    }
+    if (evidence.length > 0) {
+      signals.push({
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence
+      });
+    }
+  }
+}
+
+// ../core/src/scanner/detectors/framework-detector.ts
+var rules2 = [
+  // Frameworks
+  {
+    name: "nextjs",
+    category: "framework",
+    configPattern: /^next\.config\./,
+    importPattern: /\bfrom\s+['"]next[\/'"]|\brequire\(\s*['"]next['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "react",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]react['"]|\brequire\(\s*['"]react['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "express",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]express['"]|\brequire\(\s*['"]express['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "fastify",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]fastify['"]|\brequire\(\s*['"]fastify['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "nestjs",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]@nestjs\/|\brequire\(\s*['"]@nestjs\//,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "hono",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]hono['"]|\brequire\(\s*['"]hono['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "elysia",
+    category: "framework",
+    importPattern: /\bfrom\s+['"]elysia['"]|\brequire\(\s*['"]elysia['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "vite",
+    category: "framework",
+    configPattern: /^vite\.config\./,
+    importPattern: /\bfrom\s+['"]vite['"]|\brequire\(\s*['"]vite['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  // Runtimes
+  {
+    name: "nodejs",
+    category: "runtime",
+    importPattern: /\bfrom\s+['"]node:(?:fs|http|path|crypto|stream)['"]|\bfrom\s+['"](?:fs|http|net|dgram)['"]|\brequire\(\s*['"](?:fs|http|path|crypto)['"]\)/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "bun",
+    category: "runtime",
+    importPattern: /\bBun\.serve\b|\bBun\.file\b|\bBun\.write\b/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  },
+  {
+    name: "deno",
+    category: "runtime",
+    importPattern: /\bDeno\.serve\b|\bDeno\.readFile\b|\bDeno\.env\b/,
+    configConfidence: "high",
+    importConfidence: "medium"
+  }
+];
+var CONFIG_NAME_PATTERN = /^(next|vite)\.config\./;
+function shouldProcess(file) {
+  if (EXTENDED_EXTENSIONS.has(file.extension)) return true;
+  const basename4 = file.relativePath.split("/").pop() ?? "";
+  return CONFIG_NAME_PATTERN.test(basename4);
+}
+function findImportEvidence(lines, pattern, filePath) {
+  const evidence = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    if (pattern.test(line)) {
+      evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+      if (evidence.length >= 3) break;
+    }
+  }
+  return evidence;
+}
+function detectFrameworks(ctx) {
+  const { file } = ctx;
+  if (!shouldProcess(file)) return [];
+  const basename4 = file.relativePath.split("/").pop() ?? "";
+  const seen = /* @__PURE__ */ new Set();
+  const signals = [];
+  for (const rule of rules2) {
+    if (rule.configPattern?.test(basename4) && !seen.has(rule.name)) {
+      seen.add(rule.name);
+      signals.push({
+        id: `${rule.category}-${rule.name}`,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.configConfidence,
+        evidence: [
+          { file: file.relativePath, line: 1, snippet: `Config file detected: ${basename4}` }
+        ]
+      });
+    }
+    if (!rule.importPattern) continue;
+    const evidence = findImportEvidence(ctx.lines, rule.importPattern, file.relativePath);
+    if (evidence.length > 0 && !seen.has(rule.name)) {
+      seen.add(rule.name);
+      signals.push({
+        id: `${rule.category}-${rule.name}`,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.importConfidence,
+        evidence
+      });
+    }
+  }
+  return signals;
+}
+
+// ../core/src/scanner/detectors/local-inference-detector.ts
+var RULES = [
+  // Ollama API URL
+  {
+    id: "local-inference-ollama-api",
+    name: "Ollama API (localhost:11434)",
+    pattern: /localhost:11434/,
+    confidence: "high"
+  },
+  // Ollama imports
+  {
+    id: "local-inference-ollama-import",
+    name: "Ollama SDK import",
+    pattern: /(?:from\s+['"](?:ollama|@ollama\/ollama)['"]|require\s*\(\s*['"](?:ollama|@ollama\/ollama)['"])/,
+    confidence: "medium",
+    extensions: [".ts", ".tsx", ".js", ".jsx"]
+  },
+  // Transformers.js browser usage (pipeline / env)
+  {
+    id: "local-inference-transformers-browser",
+    name: "Transformers.js (browser inference)",
+    pattern: /(?:from\s+['"]@xenova\/transformers['"]|\.pipeline\s*\(|env\.allowLocalModels)/,
+    confidence: "medium",
+    extensions: [".ts", ".tsx", ".js", ".jsx"]
+  },
+  // ONNX Runtime
+  {
+    id: "local-inference-onnx",
+    name: "ONNX Runtime",
+    pattern: /(?:from\s+['"]onnxruntime[^'"]*['"]|require\s*\(\s*['"]onnxruntime[^'"]*['"]|onnxruntime)/,
+    confidence: "medium"
+  },
+  // llama.cpp references
+  {
+    id: "local-inference-llamacpp",
+    name: "llama.cpp",
+    pattern: /llama\.cpp|llama-cpp|llamacpp/,
+    confidence: "medium"
+  },
+  // Docker Compose ollama service
+  {
+    id: "local-inference-ollama-docker",
+    name: "Ollama Docker service",
+    pattern: /ollama\/ollama|image:\s*ollama/,
+    confidence: "high",
+    extensions: [".yaml", ".yml", ".json"]
+  }
+];
+function matchRuleToLine(rule, line, lineNum, filePath, signalMap) {
+  if (!rule.pattern.test(line)) return;
+  const evidence = {
+    file: filePath,
+    line: lineNum,
+    snippet: line.trim().slice(0, 200)
+  };
+  const existing = signalMap.get(rule.id);
+  if (existing) {
+    existing.evidence.push(evidence);
+    if (rule.confidence === "high") existing.confidence = "high";
+  } else {
+    signalMap.set(rule.id, {
+      id: rule.id,
+      name: rule.name,
+      category: "local-inference",
+      confidence: rule.confidence,
+      evidence: [evidence]
+    });
+  }
+}
+function detectLocalInferenceSignals(ctx) {
+  const { file } = ctx;
+  if (!EXTENDED_EXTENSIONS.has(file.extension)) return [];
+  const lines = ctx.lines;
+  const signalMap = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    for (const rule of RULES) {
+      if (rule.extensions && !rule.extensions.includes(file.extension)) continue;
+      matchRuleToLine(rule, line, i + 1, file.relativePath, signalMap);
+    }
+  }
+  return Array.from(signalMap.values());
+}
+
+// ../core/src/scanner/detectors/markdown-detector.ts
+var rules3 = [
+  // --- compliance-disclosure ---
+  {
+    id: "compliance-disclosure-readme",
+    name: "AI disclosure in README",
+    category: "compliance-disclosure",
+    pattern: /\b(?:artificial\s+intelligence|machine\s+learning|AI[- ]powered|AI[- ]generated|uses?\s+AI|deep\s+learning|neural\s+network|large\s+language\s+model|LLM)\b/i,
+    confidence: "low"
+  },
+  {
+    id: "compliance-disclosure-transparency",
+    name: "Transparency notice",
+    category: "compliance-disclosure",
+    pattern: /\b(?:transparency\s+notice|AI\s+disclosure|generated\s+by\s+AI)\b/i,
+    confidence: "medium"
+  },
+  // --- Model card ---
+  {
+    id: "compliance-disclosure-model-card",
+    name: "Model card documentation",
+    category: "compliance-disclosure",
+    pattern: /^#{1,3}\s+Model\s+Card\b/i,
+    confidence: "medium",
+    sectionHeading: true
+  },
+  // --- compliance-data ---
+  {
+    id: "compliance-data-docs",
+    name: "Data governance documentation",
+    category: "compliance-data",
+    pattern: /^#{1,3}\s+(?:Data\s+(?:Sources?|Governance|Quality|Lineage)|Training\s+Data)\b/i,
+    confidence: "medium",
+    sectionHeading: true
+  },
+  {
+    id: "compliance-data-reference",
+    name: "Data source references",
+    category: "compliance-data",
+    pattern: /\b(?:training\s+data|data\s+sources?|dataset\s+documentation)\b/i,
+    confidence: "low"
+  },
+  // --- Privacy / GDPR ---
+  {
+    id: "compliance-data-privacy",
+    name: "Privacy policy reference",
+    category: "compliance-data",
+    pattern: /\b(?:privacy\s+policy|GDPR|data\s+protection|DSGVO)\b/i,
+    confidence: "medium"
+  },
+  // --- License / AI-specific ---
+  {
+    id: "compliance-disclosure-license",
+    name: "AI-relevant license terms",
+    category: "compliance-disclosure",
+    pattern: /\b(?:model\s+license|AI\s+license|responsible\s+AI|acceptable\s+use\s+policy|RAIL\s+license)\b/i,
+    confidence: "medium"
+  }
+];
+var SKIP_BASENAMES = /* @__PURE__ */ new Set([
+  "changelog.md",
+  "changes.md",
+  "history.md",
+  "contributing.md",
+  "code_of_conduct.md"
+]);
+function isRelevantMarkdown(relativePath) {
+  const lower = relativePath.toLowerCase();
+  const basename4 = lower.split("/").pop() ?? "";
+  if (basename4.startsWith("readme")) return true;
+  if (lower.includes("/docs/") || lower.startsWith("docs/")) {
+    return !SKIP_BASENAMES.has(basename4);
+  }
+  if (SKIP_BASENAMES.has(basename4)) return false;
+  return true;
+}
+function gatherMarkdownEvidence(rule, lines, filePath) {
+  const evidence = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    if (rule.sectionHeading && !line.startsWith("#")) continue;
+    if (rule.pattern.test(line)) {
+      evidence.push({ file: filePath, line: i + 1, snippet: line.trim().slice(0, 120) });
+      if (evidence.length >= 5) break;
+    }
+  }
+  return evidence;
+}
+function isSkippableGenericContent(basename4, evidence) {
+  if (!SKIP_BASENAMES.has(basename4)) return false;
+  return !evidence.some((e) => /\bAI\b|\bML\b|\bmodel\b|\binference\b/i.test(e.snippet));
+}
+function detectMarkdown(ctx) {
+  const { file } = ctx;
+  if (file.extension !== ".md") return [];
+  if (!isRelevantMarkdown(file.relativePath)) return [];
+  const signalMap = /* @__PURE__ */ new Map();
+  const basename4 = file.relativePath.toLowerCase().split("/").pop() ?? "";
+  for (const rule of rules3) {
+    const evidence = gatherMarkdownEvidence(rule, ctx.lines, file.relativePath);
+    if (evidence.length === 0) continue;
+    if (isSkippableGenericContent(basename4, evidence)) continue;
+    const existing = signalMap.get(rule.id);
+    if (existing) {
+      existing.evidence.push(...evidence);
+    } else {
+      signalMap.set(rule.id, {
+        id: rule.id,
+        name: rule.name,
+        category: rule.category,
+        confidence: rule.confidence,
+        evidence
+      });
+    }
+  }
+  return Array.from(signalMap.values());
+}
+
+// ../core/src/scanner/detectors/package-json-detector.ts
+import { basename } from "path";
+var AI_PACKAGES = {
+  // Providers
+  openai: { category: "ai-provider", label: "OpenAI SDK" },
+  "@anthropic-ai/sdk": { category: "ai-provider", label: "Anthropic SDK" },
+  "cohere-ai": { category: "ai-provider", label: "Cohere SDK" },
+  "@google/generative-ai": { category: "ai-provider", label: "Google Generative AI" },
+  "@mistralai/mistralai": { category: "ai-provider", label: "Mistral AI SDK" },
+  // Frameworks
+  langchain: { category: "ai-framework", label: "LangChain" },
+  "@langchain/core": { category: "ai-framework", label: "LangChain Core" },
+  llamaindex: { category: "ai-framework", label: "LlamaIndex" },
+  "@xenova/transformers": { category: "ai-framework", label: "Transformers.js" },
+  ai: { category: "ai-framework", label: "Vercel AI SDK" },
+  "@huggingface/inference": { category: "ai-framework", label: "HuggingFace Inference" },
+  // Local inference
+  ollama: { category: "local-inference", label: "Ollama" },
+  "@ollama/ollama": { category: "local-inference", label: "Ollama SDK" },
+  // RAG / Vector
+  chromadb: { category: "rag", label: "ChromaDB" },
+  "@pinecone-database/pinecone": { category: "rag", label: "Pinecone" },
+  "weaviate-client": { category: "rag", label: "Weaviate" },
+  "@qdrant/js-client-rest": { category: "rag", label: "Qdrant" },
+  pgvector: { category: "rag", label: "pgvector" },
+  // Bias / Eval
+  "@euconform/core": { category: "compliance-bias", label: "EuConform Core" }
+};
+var FRAMEWORK_PACKAGES = {
+  next: { category: "framework", label: "Next.js" },
+  react: { category: "framework", label: "React" },
+  express: { category: "framework", label: "Express" },
+  fastify: { category: "framework", label: "Fastify" },
+  "@nestjs/core": { category: "framework", label: "NestJS" },
+  hono: { category: "framework", label: "Hono" },
+  elysia: { category: "framework", label: "Elysia" }
+};
+var ALL_PACKAGES = {
+  ...AI_PACKAGES,
+  ...FRAMEWORK_PACKAGES
+};
+var PACKAGE_JSON_NAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "yarn.lock"
+]);
+function isPackageJsonFile(relativePath) {
+  return PACKAGE_JSON_NAMES.has(basename(relativePath));
+}
+function detectPackageJsonSignals(ctx) {
+  const { file } = ctx;
+  if (!isPackageJsonFile(file.relativePath)) return [];
+  const fileName = basename(file.relativePath);
+  if (fileName === "package.json") {
+    return detectFromPackageJson(file.relativePath, file.content);
+  }
+  return detectFromLockFile(file.relativePath, file.content);
+}
+function detectFromPackageJson(filePath, content) {
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  const signals = [];
+  const deps = {
+    ...parsed.dependencies,
+    ...parsed.devDependencies
+  };
+  for (const [pkg, info] of Object.entries(ALL_PACKAGES)) {
+    if (pkg in deps) {
+      const version = deps[pkg] ?? "unknown";
+      signals.push({
+        id: `${info.category}-${pkg.replace(/[@/]/g, "").replace(/\s/g, "-")}`,
+        name: info.label,
+        category: info.category,
+        confidence: "high",
+        evidence: [
+          {
+            file: filePath,
+            snippet: `"${pkg}": "${version}"`
+          }
+        ]
+      });
+    }
+  }
+  if (parsed.workspaces) {
+    signals.push({
+      id: "runtime-monorepo-workspaces",
+      name: "Monorepo (workspaces)",
+      category: "runtime",
+      confidence: "high",
+      evidence: [
+        {
+          file: filePath,
+          snippet: `"workspaces": ${JSON.stringify(parsed.workspaces).slice(0, 120)}`
+        }
+      ]
+    });
+  }
+  const devDeps = parsed.devDependencies;
+  if (devDeps && "turbo" in devDeps) {
+    signals.push({
+      id: "runtime-monorepo-turbo",
+      name: "Monorepo (Turborepo)",
+      category: "runtime",
+      confidence: "high",
+      evidence: [
+        {
+          file: filePath,
+          snippet: `"turbo": "${devDeps.turbo}"`
+        }
+      ]
+    });
+  }
+  return signals;
+}
+var LOCK_FILE_PATTERNS = new Map(
+  Object.keys(AI_PACKAGES).map((pkg) => [pkg, new RegExp(`["'/]${escapeRegex(pkg)}["'/@:]`)])
+);
+function detectFromLockFile(filePath, content) {
+  const signals = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [pkg, info] of Object.entries(AI_PACKAGES)) {
+    if (seen.has(pkg)) continue;
+    const pattern = LOCK_FILE_PATTERNS.get(pkg);
+    if (!pattern) continue;
+    if (pattern.test(content)) {
+      seen.add(pkg);
+      signals.push({
+        id: `${info.category}-${pkg.replace(/[@/]/g, "").replace(/\s/g, "-")}`,
+        name: info.label,
+        category: info.category,
+        confidence: "medium",
+        evidence: [
+          {
+            file: filePath,
+            snippet: `Found "${pkg}" in lock file`
+          }
+        ]
+      });
+    }
+  }
+  return signals;
+}
+
+// ../core/src/scanner/detectors/rag-detector.ts
+var IMPORT_RULES = [
+  {
+    id: "rag-chromadb",
+    name: "ChromaDB",
+    pattern: /(?:from\s+['"]chromadb['"]|require\s*\(\s*['"]chromadb['"])/,
+    confidence: "high"
+  },
+  {
+    id: "rag-pinecone",
+    name: "Pinecone",
+    pattern: /(?:from\s+['"]@pinecone-database\/pinecone['"]|require\s*\(\s*['"]@pinecone-database\/pinecone['"])/,
+    confidence: "high"
+  },
+  {
+    id: "rag-weaviate",
+    name: "Weaviate",
+    pattern: /(?:from\s+['"]weaviate-client['"]|require\s*\(\s*['"]weaviate-client['"])/,
+    confidence: "high"
+  },
+  {
+    id: "rag-qdrant",
+    name: "Qdrant",
+    pattern: /(?:from\s+['"]@qdrant\/js-client-rest['"]|require\s*\(\s*['"]@qdrant\/js-client-rest['"])/,
+    confidence: "high"
+  },
+  {
+    id: "rag-pgvector",
+    name: "pgvector",
+    pattern: /(?:from\s+['"]pgvector['"]|require\s*\(\s*['"]pgvector['"])/,
+    confidence: "high"
+  },
+  {
+    id: "rag-faiss",
+    name: "FAISS",
+    pattern: /(?:from\s+['"]faiss-node['"]|require\s*\(\s*['"]faiss-node['"])/,
+    confidence: "high"
+  }
+];
+var USAGE_RULES = [
+  {
+    id: "rag-embedding-call",
+    name: "Embedding function call",
+    pattern: /\.(?:createEmbedding|embedDocuments|embedQuery|embed)\s*\(/,
+    confidence: "medium"
+  },
+  {
+    id: "rag-retriever-pattern",
+    name: "Retriever pattern",
+    pattern: /\.(?:asRetriever|getRelevantDocuments|similaritySearch|similaritySearchWithScore)\s*\(/,
+    confidence: "medium"
+  },
+  {
+    id: "rag-vectorstore-usage",
+    name: "Vector store usage",
+    pattern: /(?:VectorStore|vectorStore|fromDocuments|fromTexts|addDocuments)\s*\(/,
+    confidence: "medium"
+  }
+];
+var KEYWORD_RULES = [
+  {
+    id: "rag-keyword-embedding",
+    name: "Embedding keyword reference",
+    pattern: /\b(?:text[_-]?embedding|embedding[_-]?(?:model|vector|dimension|size)|openai.*embedding|embedding[_-]?api)\b/i,
+    confidence: "low"
+  },
+  {
+    id: "rag-keyword-vector",
+    name: "Vector keyword reference",
+    pattern: /\b(?:vector(?:Store|DB|Database|Index))\b/,
+    confidence: "low"
+  },
+  {
+    id: "rag-keyword-retriever",
+    name: "Retriever keyword reference",
+    pattern: /\bretriever\b/i,
+    confidence: "low"
+  },
+  {
+    id: "rag-keyword-similarity",
+    name: "Similarity search keyword",
+    pattern: /\bsimilarity_search\b/,
+    confidence: "low"
+  }
+];
+var ALL_RULES = [...IMPORT_RULES, ...USAGE_RULES, ...KEYWORD_RULES];
+function detectRagSignals(ctx) {
+  const { file } = ctx;
+  if (!SOURCE_EXTENSIONS.has(file.extension)) return [];
+  const lines = ctx.lines;
+  const signalMap = /* @__PURE__ */ new Map();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const lineNum = i + 1;
+    for (const rule of ALL_RULES) {
+      if (rule.pattern.test(line)) {
+        const evidence = {
+          file: file.relativePath,
+          line: lineNum,
+          snippet: line.trim().slice(0, 200)
+        };
+        const existing = signalMap.get(rule.id);
+        if (existing) {
+          existing.evidence.push(evidence);
+          existing.confidence = higherConfidence(existing.confidence, rule.confidence);
+        } else {
+          signalMap.set(rule.id, {
+            id: rule.id,
+            name: rule.name,
+            category: "rag",
+            confidence: rule.confidence,
+            evidence: [evidence]
+          });
+        }
+      }
+    }
+  }
+  return Array.from(signalMap.values());
+}
+
+// ../core/src/scanner/detectors/index.ts
+var ALL_DETECTORS = [
+  detectPackageJsonSignals,
+  detectAiProviderSignals,
+  detectAiFrameworkSignals,
+  detectLocalInferenceSignals,
+  detectRagSignals,
+  detectFrameworks,
+  detectCompliance,
+  detectConfig,
+  detectMarkdown
+];
+function runAllDetectors(ctx) {
+  const signals = [];
+  for (const detector of ALL_DETECTORS) {
+    try {
+      signals.push(...detector(ctx));
+    } catch {
+    }
+  }
+  return signals;
+}
+
+// ../core/src/scanner/discovery.ts
+var import_ignore = __toESM(require_ignore(), 1);
+import { readFile, readdir, stat } from "fs/promises";
+import { basename as basename2, extname, join, resolve } from "path";
+var DEFAULT_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".json", ".md", ".yaml", ".yml"];
+var NAMED_FILE_PATTERNS = [
+  /^package\.json$/,
+  /^pnpm-lock\.yaml$/,
+  /^package-lock\.json$/,
+  /^yarn\.lock$/,
+  /^\.env\.example$/,
+  /^\.env\.sample$/,
+  /^next\.config\./,
+  /^vite\.config\./,
+  /^docker-compose/,
+  /^Dockerfile/,
+  /^tsconfig.*\.json$/
+];
+var ALWAYS_SKIP_DIRS = [
+  "node_modules",
+  ".git",
+  "dist",
+  ".next",
+  "build",
+  "coverage",
+  ".turbo",
+  ".cache",
+  ".euconform"
+];
+var DEFAULT_MAX_FILE_SIZE = 1048576;
+var DEFAULT_MAX_FILES = 1e4;
+var DEFAULT_SCOPE = "production";
+var PRODUCTION_SKIP_PROVENANCE = /* @__PURE__ */ new Set([
+  "test",
+  "fixture",
+  "example",
+  "generated"
+]);
+var TEST_SEGMENTS = /* @__PURE__ */ new Set(["test", "tests", "__test__", "__tests__", "spec", "__spec__"]);
+var FIXTURE_SEGMENTS = /* @__PURE__ */ new Set([
+  "fixture",
+  "fixtures",
+  "__fixture__",
+  "__fixtures__",
+  "mocks",
+  "__mocks__",
+  "mock-data"
+]);
+var EXAMPLE_SEGMENTS = /* @__PURE__ */ new Set(["example", "examples", "sample", "samples", "demo", "demos"]);
+var GENERATED_SEGMENTS = /* @__PURE__ */ new Set(["generated", "__generated__", ".generated", "gen"]);
+var TOOLING_SEGMENTS = /* @__PURE__ */ new Set([".github", "scripts", "tools", "tooling", "bin"]);
+var TEST_FILE_PATTERN = /(?:^|\.)(?:test|spec)\.[^.]+$/i;
+var GENERATED_FILE_PATTERN = /(?:^|\.)(?:generated|min)\.[^.]+$/i;
+var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".ico",
+  ".svg",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".br",
+  ".pdf",
+  ".doc",
+  ".docx",
+  ".mp3",
+  ".mp4",
+  ".webm",
+  ".ogg",
+  ".wasm",
+  ".node",
+  ".dylib",
+  ".so",
+  ".lock"
+  // bun.lockb is binary
+]);
+function isBinaryExtension(ext) {
+  return BINARY_EXTENSIONS.has(ext);
+}
+function isNamedFile(fileName) {
+  return NAMED_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+function shouldIncludeFile(fileName, ext, extensions) {
+  if (isNamedFile(fileName)) return true;
+  if (isBinaryExtension(ext)) return false;
+  return extensions.includes(ext);
+}
+function classifyFileProvenance(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/");
+  const rawSegments = normalized.split("/").filter(Boolean);
+  const segments = rawSegments.map((segment) => segment.toLowerCase());
+  const rawFileName = rawSegments[rawSegments.length - 1] ?? "";
+  const fileName = segments[segments.length - 1] ?? "";
+  const ext = extname(fileName);
+  const isRootFile = segments.length === 1;
+  if (segments.some((segment) => FIXTURE_SEGMENTS.has(segment))) return "fixture";
+  if (segments.some((segment) => TEST_SEGMENTS.has(segment)) || TEST_FILE_PATTERN.test(fileName)) {
+    return "test";
+  }
+  if (segments.some((segment) => EXAMPLE_SEGMENTS.has(segment))) return "example";
+  if (segments.some((segment) => GENERATED_SEGMENTS.has(segment)) || GENERATED_FILE_PATTERN.test(fileName)) {
+    return "generated";
+  }
+  if (segments.some((segment) => TOOLING_SEGMENTS.has(segment))) return "tooling";
+  if (fileName.startsWith("readme") && isRootFile) return "root-docs";
+  if (ext === ".md") return "docs";
+  if (isNamedFile(rawFileName) || ext === ".yaml" || ext === ".yml" || fileName.startsWith(".env") || /\.config\.[^.]+$/i.test(rawFileName)) {
+    return "config";
+  }
+  return "runtime";
+}
+async function loadGitignore(targetPath) {
+  const ig = (0, import_ignore.default)();
+  try {
+    const content = await readFile(join(targetPath, ".gitignore"), "utf-8");
+    ig.add(content);
+  } catch {
+  }
+  ig.add(ALWAYS_SKIP_DIRS.map((d) => `${d}/`));
+  return ig;
+}
+function shouldProcessEntry(entry, targetPath, filterOpts) {
+  const absolutePath = join(targetPath, entry);
+  const fileName = basename2(entry);
+  const ext = extname(fileName).toLowerCase();
+  const provenance = classifyFileProvenance(entry);
+  if (filterOpts.scope === "production" && PRODUCTION_SKIP_PROVENANCE.has(provenance)) {
+    return "skip";
+  }
+  if (!shouldIncludeFile(fileName, ext, filterOpts.extensions)) return "ignore";
+  return { absolutePath, ext, provenance };
+}
+async function tryReadFile(absolutePath, entry, ext, provenance, maxSize) {
+  try {
+    const fileStat = await stat(absolutePath);
+    if (!fileStat.isFile() || fileStat.size === 0) return "ignore";
+    if (fileStat.size > maxSize) return "skip";
+    const content = await readFile(absolutePath, "utf-8");
+    return {
+      relativePath: entry,
+      absolutePath,
+      extension: ext,
+      content,
+      sizeBytes: fileStat.size,
+      provenance
+    };
+  } catch {
+    return "skip";
+  }
+}
+function resolveOptions(options) {
+  return {
+    targetPath: resolve(options.targetPath),
+    scope: options.scope ?? DEFAULT_SCOPE,
+    extensions: options.extensions ?? DEFAULT_EXTENSIONS,
+    maxSize: options.maxFileSizeBytes ?? DEFAULT_MAX_FILE_SIZE,
+    maxFiles: options.maxFiles ?? DEFAULT_MAX_FILES,
+    excludeGlobs: options.excludeGlobs
+  };
+}
+async function readDirectoryEntries(targetPath) {
+  try {
+    return await readdir(targetPath, { recursive: true, encoding: "utf-8" });
+  } catch (err) {
+    throw new Error(`Cannot read directory: ${targetPath}: ${err}`);
+  }
+}
+function processEntry(entry, ig, targetPath, filterOpts) {
+  if (ig.ignores(entry)) return "ignore";
+  return shouldProcessEntry(entry, targetPath, filterOpts);
+}
+async function discoverFiles(options) {
+  const { targetPath, scope, extensions, maxSize, maxFiles, excludeGlobs } = resolveOptions(options);
+  const ig = await loadGitignore(targetPath);
+  if (excludeGlobs?.length) ig.add(excludeGlobs);
+  const entries = await readDirectoryEntries(targetPath);
+  const filterOpts = { scope, extensions, maxSize };
+  const files = [];
+  let skippedCount = 0;
+  for (const entry of entries) {
+    if (files.length >= maxFiles) {
+      skippedCount++;
+      continue;
+    }
+    const processed = processEntry(entry, ig, targetPath, filterOpts);
+    if (processed === "skip") {
+      skippedCount++;
+      continue;
+    }
+    if (processed === "ignore") continue;
+    const result = await tryReadFile(
+      processed.absolutePath,
+      entry,
+      processed.ext,
+      processed.provenance,
+      maxSize
+    );
+    if (result === "skip") {
+      skippedCount++;
+      continue;
+    }
+    if (result === "ignore") continue;
+    files.push(result);
+  }
+  return { files, skippedCount };
+}
+
+// ../core/src/scanner/aggregator.ts
+var TOOL_VERSION = "0.1.0";
+function parseRootPackageJson(files) {
+  const pkgFile = files.find((f) => f.relativePath === "package.json");
+  if (!pkgFile) return void 0;
+  try {
+    return JSON.parse(pkgFile.content);
+  } catch {
+    return void 0;
+  }
+}
+function buildRepoProfile(targetPath, pkg, files) {
+  const hasTs = files.some((f) => f.extension === ".ts" || f.extension === ".tsx");
+  const hasJs = files.some((f) => f.extension === ".js" || f.extension === ".jsx");
+  const languages = [];
+  if (hasTs) languages.push("typescript");
+  if (hasJs) languages.push("javascript");
+  let packageManager;
+  if (files.some((f) => f.relativePath === "pnpm-lock.yaml")) packageManager = "pnpm";
+  else if (files.some((f) => f.relativePath === "yarn.lock")) packageManager = "yarn";
+  else if (files.some((f) => f.relativePath === "package-lock.json")) packageManager = "npm";
+  const isMonorepo = Boolean(
+    pkg?.workspaces || files.some((f) => f.relativePath === "pnpm-workspace.yaml")
+  );
+  return {
+    name: pkg?.name ?? basename3(targetPath),
+    version: pkg?.version,
+    description: pkg?.description,
+    license: pkg?.license,
+    isMonorepo,
+    packageManager,
+    languages
+  };
+}
+function inferAppTypes(signals) {
+  const types = /* @__PURE__ */ new Set();
+  const has = (id) => signals.some((s) => s.id === id);
+  const hasCategory = (cat) => signals.some((s) => s.category === cat);
+  if (has("framework-nextjs") || has("framework-react")) types.add("web-app");
+  if (has("framework-express") || has("framework-fastify") || has("framework-nestjs") || has("framework-hono") || has("framework-elysia"))
+    types.add("api-server");
+  if (hasCategory("local-inference") || hasCategory("ai-provider")) {
+    if (signals.some((s) => s.name.toLowerCase().includes("chat"))) types.add("chatbot");
+  }
+  if (hasCategory("training")) types.add("ml-pipeline");
+  if (types.size === 0) types.add("unknown");
+  return [...types];
+}
+function deduplicateSignals(signals) {
+  const map = /* @__PURE__ */ new Map();
+  for (const signal of signals) {
+    const existing = map.get(signal.id);
+    if (!existing) {
+      map.set(signal.id, { ...signal, evidence: [...signal.evidence] });
+      continue;
+    }
+    const seen = new Set(existing.evidence.map((e) => `${e.file}:${e.line ?? ""}`));
+    for (const ev of signal.evidence) {
+      const key = `${ev.file}:${ev.line ?? ""}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        existing.evidence.push(ev);
+      }
+    }
+    if (CONFIDENCE_RANK[signal.confidence] > CONFIDENCE_RANK[existing.confidence]) {
+      existing.confidence = signal.confidence;
+    }
+  }
+  return [...map.values()];
+}
+function annotateEvidenceProvenance(signals, files) {
+  const provenanceByPath = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    provenanceByPath.set(file.relativePath, file.provenance);
+  }
+  return signals.map((signal) => ({
+    ...signal,
+    evidence: signal.evidence.map((evidence) => ({
+      ...evidence,
+      provenance: evidence.provenance ?? provenanceByPath.get(evidence.file) ?? "runtime"
+    }))
+  }));
+}
+function generateOpenQuestions(signals) {
+  const questions = [];
+  const hasAI2 = signals.some(
+    (s) => s.category === "ai-provider" || s.category === "ai-framework" || s.category === "local-inference"
+  );
+  if (hasAI2) {
+    questions.push({
+      id: "oq-market-placement",
+      question: "Is this AI system placed on the EU market or used within the EU?",
+      context: "The EU AI Act applies to AI systems placed on or put into service in the EU market.",
+      relatedSignalIds: signals.filter((s) => s.category.startsWith("ai-")).map((s) => s.id),
+      suggestedAction: "Determine your system's geographic scope and market placement."
+    });
+    questions.push({
+      id: "oq-intended-purpose",
+      question: "What is the intended purpose of this AI system?",
+      context: "Risk classification under the EU AI Act depends on the system's intended purpose and deployment context, which cannot be determined from code alone.",
+      relatedSignalIds: [],
+      suggestedAction: "Use the EuConform wizard to complete your risk assessment with human-provided context."
+    });
+    questions.push({
+      id: "oq-provider-role",
+      question: "Are you a provider, deployer, or importer of this AI system?",
+      context: "Different roles under Art. 3 carry different obligations. A scanner cannot determine your organizational role.",
+      relatedSignalIds: [],
+      suggestedAction: "Clarify your role in the AI value chain to determine applicable obligations."
+    });
+  }
+  const hasGpaiSignals = signals.some(
+    (s) => s.category === "ai-provider" || s.id.includes("langchain") || s.id.includes("llamaindex")
+  );
+  if (hasGpaiSignals) {
+    questions.push({
+      id: "oq-gpai-downstream",
+      question: "Are you using a general-purpose AI model? Do you provide downstream access to others?",
+      context: "GPAI obligations (Art. 53-55) apply to providers of general-purpose AI models. Using an API does not automatically make you a GPAI provider.",
+      relatedSignalIds: signals.filter((s) => s.category === "ai-provider").map((s) => s.id),
+      suggestedAction: "Determine whether you are a GPAI provider or deployer."
+    });
+  }
+  const hasNoDisclosure = !hasImplementationSignals(signals, ["compliance-disclosure"]);
+  if (hasAI2 && hasNoDisclosure) {
+    questions.push({
+      id: "oq-disclosure-missing",
+      question: "Does your system inform users that they are interacting with AI?",
+      context: "No AI disclosure signals were found in the codebase. Art. 50 requires transparency for AI systems interacting with natural persons.",
+      relatedSignalIds: [],
+      suggestedAction: "Add explicit AI disclosure in user-facing entry points."
+    });
+  }
+  return questions;
+}
+function buildSignalSummary(signals) {
+  const byCategory = {};
+  const byConfidence = {
+    high: 0,
+    medium: 0,
+    low: 0
+  };
+  for (const s of signals) {
+    byCategory[s.category] = (byCategory[s.category] ?? 0) + 1;
+    byConfidence[s.confidence]++;
+  }
+  return { total: signals.length, byCategory, byConfidence };
+}
+async function scanRepository(options) {
+  const startTime = Date.now();
+  const scope = options.scope ?? "production";
+  const discovery = await discoverFiles(options);
+  const allFiles = discovery.files;
+  const rootPkg = parseRootPackageJson(allFiles);
+  const rawSignals = [];
+  for (const file of allFiles) {
+    const ctx = { file, lines: file.content.split("\n"), allFiles, rootPackageJson: rootPkg };
+    rawSignals.push(...runAllDetectors(ctx));
+  }
+  const signals = annotateEvidenceProvenance(deduplicateSignals(rawSignals), allFiles);
+  const openQuestions = generateOpenQuestions(signals);
+  return {
+    meta: {
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      scanDurationMs: Date.now() - startTime,
+      toolVersion: TOOL_VERSION,
+      targetPath: options.targetPath,
+      scanScope: scope,
+      filesScanned: allFiles.length,
+      filesSkipped: discovery.skippedCount
+    },
+    repo: buildRepoProfile(options.targetPath, rootPkg, allFiles),
+    appTypes: inferAppTypes(signals),
+    signals,
+    openQuestions,
+    signalSummary: buildSignalSummary(signals)
+  };
+}
+
+// src/commands/scan.ts
+import { defineCommand } from "citty";
+import consola4 from "consola";
+
+// src/output/ci.ts
+import { appendFile, mkdir, writeFile } from "fs/promises";
+import { join as join2 } from "path";
+import consola from "consola";
+
+// src/utils/gap-priority.ts
+var GAP_PRIORITY_ORDER = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3
+};
+function shouldFailOnGaps(gaps, failOn) {
+  if (failOn === "none") return false;
+  const threshold = GAP_PRIORITY_ORDER[failOn];
+  return gaps.some((gap) => GAP_PRIORITY_ORDER[gap.priority] <= threshold);
+}
+
+// src/output/ci.ts
+var PRIORITY_LABELS = {
+  critical: "Critical",
+  high: "High",
+  medium: "Medium",
+  low: "Low"
+};
+function countGaps(gaps) {
+  return gaps.reduce(
+    (counts, gap) => {
+      counts[gap.priority]++;
+      return counts;
+    },
+    { critical: 0, high: 0, medium: 0, low: 0 }
+  );
+}
+function escapeGitHubValue(value) {
+  return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+function annotationLevel(priority) {
+  if (priority === "critical" || priority === "high") return "error";
+  if (priority === "medium") return "warning";
+  return "notice";
+}
+function buildCiReport(output, failOn, scanScope, baseArtifacts) {
+  const gapCounts = countGaps(output.report.gaps);
+  const complianceAreas = [
+    { area: "Disclosure", group: output.report.complianceSignals.disclosure },
+    { area: "Bias Testing", group: output.report.complianceSignals.biasTesting },
+    { area: "Reporting & Exports", group: output.report.complianceSignals.reportingExports },
+    { area: "Logging & Monitoring", group: output.report.complianceSignals.loggingMonitoring },
+    { area: "Human Oversight", group: output.report.complianceSignals.humanOversight },
+    { area: "Data Governance", group: output.report.complianceSignals.dataGovernance },
+    { area: "Incident Reporting", group: output.report.complianceSignals.incidentReporting }
+  ];
+  return {
+    schemaVersion: "euconform.ci.v1",
+    generatedAt: output.report.generatedAt,
+    target: {
+      name: output.report.target.name,
+      rootPath: output.report.target.rootPath
+    },
+    status: {
+      failOn,
+      failing: shouldFailOnGaps(output.report.gaps, failOn),
+      gapCounts,
+      openQuestions: output.report.assessmentHints.openQuestions.length
+    },
+    aiDetected: output.report.aiFootprint.usesAI,
+    scanScope,
+    artifacts: [
+      ...baseArtifacts,
+      "euconform.bundle.json",
+      "euconform.ci.json",
+      "euconform.ci-summary.md"
+    ],
+    complianceOverview: complianceAreas.map(({ area, group }) => ({
+      area,
+      status: group.status,
+      confidence: group.confidence
+    })),
+    topGaps: output.report.gaps.slice(0, 5).map((gap) => ({
+      id: gap.id,
+      title: gap.title,
+      priority: gap.priority,
+      status: gap.status
+    }))
+  };
+}
+function renderCiSummaryMarkdown(output, report) {
+  const lines = [
+    "## EuConform Compliance Scan",
+    "",
+    `- **Project:** ${report.target.name}`,
+    `- **Scan Scope:** ${report.scanScope}`,
+    `- **AI Detected:** ${report.aiDetected ? "yes" : "no"}`,
+    `- **Fail Threshold:** ${report.status.failOn}`,
+    `- **CI Status:** ${report.status.failing ? "failing" : "passing"}`,
+    "",
+    "### Gap Counts",
+    "",
+    `- Critical: ${report.status.gapCounts.critical}`,
+    `- High: ${report.status.gapCounts.high}`,
+    `- Medium: ${report.status.gapCounts.medium}`,
+    `- Low: ${report.status.gapCounts.low}`,
+    "",
+    "### Compliance Overview",
+    "",
+    "| Area | Status | Confidence |",
+    "|------|--------|------------|",
+    ...report.complianceOverview.map(
+      (item) => `| ${item.area} | ${item.status} | ${item.confidence} |`
+    ),
+    ""
+  ];
+  if (report.topGaps.length > 0) {
+    lines.push("### Top Gaps", "");
+    for (const gap of report.topGaps) {
+      lines.push(`- **${PRIORITY_LABELS[gap.priority]}** ${gap.title}`);
+    }
+    lines.push("");
+  }
+  if (output.report.assessmentHints.openQuestions.length > 0) {
+    lines.push("### Open Questions", "");
+    for (const question of output.report.assessmentHints.openQuestions.slice(0, 5)) {
+      lines.push(`- ${question}`);
+    }
+    lines.push("");
+  }
+  lines.push("### Artifacts", "", ...report.artifacts.map((artifact) => `- \`${artifact}\``));
+  return `${lines.join("\n")}
+`;
+}
+function emitGitHubAnnotations(output) {
+  for (const gap of output.report.gaps.slice(0, 10)) {
+    const level = annotationLevel(gap.priority);
+    const firstEvidence = gap.evidence[0];
+    const message = escapeGitHubValue(`EuConform: ${gap.title}`);
+    if (firstEvidence?.file) {
+      const line = firstEvidence.line ? `,line=${firstEvidence.line}` : "";
+      process.stdout.write(`::${level} file=${firstEvidence.file}${line}::${message}
+`);
+    } else {
+      process.stdout.write(`::${level}::${message}
+`);
+    }
+  }
+  for (const question of output.report.assessmentHints.openQuestions.slice(0, 5)) {
+    process.stdout.write(
+      `::notice::${escapeGitHubValue(`EuConform open question: ${question}`)}
+`
+    );
+  }
+}
+async function writeCiArtifacts(output, outputDir, failOn, mode, scanScope, baseArtifacts) {
+  if (mode === "off") return null;
+  await mkdir(outputDir, { recursive: true });
+  const ciReport = buildCiReport(output, failOn, scanScope, baseArtifacts);
+  const reportPath = join2(outputDir, "euconform.ci.json");
+  const summaryPath = join2(outputDir, "euconform.ci-summary.md");
+  await writeFile(reportPath, `${JSON.stringify(ciReport, null, 2)}
+`, "utf-8");
+  await writeFile(summaryPath, renderCiSummaryMarkdown(output, ciReport), "utf-8");
+  consola.success(`Written ${reportPath}`);
+  consola.success(`Written ${summaryPath}`);
+  let githubStepSummaryPath;
+  if (mode === "github") {
+    emitGitHubAnnotations(output);
+    const stepSummaryPath = process.env.GITHUB_STEP_SUMMARY;
+    if (stepSummaryPath) {
+      await appendFile(stepSummaryPath, `
+${renderCiSummaryMarkdown(output, ciReport)}`, "utf-8");
+      githubStepSummaryPath = stepSummaryPath;
+      consola.info(`Appended GitHub step summary: ${stepSummaryPath}`);
+    }
+  }
+  return { reportPath, summaryPath, githubStepSummaryPath, baseArtifacts };
+}
+
+// src/output/terminal.ts
+import consola2 from "consola";
+var AREA_LABELS = {
+  disclosure: "Disclosure & Transparency",
+  biasTesting: "Bias Testing",
+  reportingExports: "Reporting & Exports",
+  loggingMonitoring: "Logging & Monitoring",
+  humanOversight: "Human Oversight",
+  dataGovernance: "Data Governance",
+  incidentReporting: "Incident Reporting"
+};
+var STATUS_ICONS = {
+  present: "[OK]",
+  partial: "[!!]",
+  absent: "[--]"
+};
+function printSignalCounts(complianceSignals) {
+  const byConfidence = { high: 0, medium: 0, low: 0 };
+  for (const area of Object.values(complianceSignals)) {
+    byConfidence[area.confidence]++;
+  }
+  const total = Object.values(complianceSignals).length;
+  consola2.info(
+    `${total} compliance areas assessed (${byConfidence.high} high, ${byConfidence.medium} medium, ${byConfidence.low} low confidence)`
+  );
+}
+function printComplianceOverview(complianceSignals) {
+  consola2.log("");
+  consola2.info("Compliance Overview:");
+  for (const [key, group] of Object.entries(complianceSignals)) {
+    const label = AREA_LABELS[key] ?? key;
+    const icon = STATUS_ICONS[group.status] ?? "[??]";
+    consola2.log(`  ${icon} ${label.padEnd(28)} ${group.status} (${group.confidence})`);
+  }
+}
+function printTopGaps(gaps) {
+  if (gaps.length === 0) return;
+  consola2.log("");
+  consola2.warn(`Top gaps (${gaps.length} total):`);
+  for (const gap of gaps.slice(0, 3)) {
+    consola2.log(`  - [${gap.priority}] ${gap.title}`);
+  }
+  if (gaps.length > 3) {
+    consola2.log(`  ... and ${gaps.length - 3} more`);
+  }
+}
+function printTerminalSummary(output, outputDir) {
+  const { report } = output;
+  consola2.box("EuConform Scan Complete");
+  printSignalCounts(report.complianceSignals);
+  const ai = report.aiFootprint;
+  consola2.info(
+    `AI detected: ${ai.usesAI ? "yes" : "no"}${ai.inferenceModes.length > 0 ? ` | Inference: ${ai.inferenceModes.join(", ")}` : ""}`
+  );
+  printComplianceOverview(report.complianceSignals);
+  printTopGaps(report.gaps);
+  const openCount = report.assessmentHints.openQuestions.length;
+  if (openCount > 0) {
+    consola2.info(`${openCount} open question${openCount > 1 ? "s" : ""} for manual review`);
+  }
+  consola2.log("");
+  consola2.success(`Output written to: ${outputDir}`);
+  consola2.info("Next steps:");
+  consola2.log("  - Review `euconform.report.json` and `euconform.summary.md`");
+  consola2.log("  - Complete role and risk classification in the EuConform web app");
+  consola2.log("  - Use `--ci github --fail-on <level>` to turn scans into CI checks");
+}
+
+// src/output/writer.ts
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join3 } from "path";
+import consola3 from "consola";
+async function tryReadArtifact(outputDir, fileName) {
+  try {
+    const content = await readFile2(join3(outputDir, fileName), "utf-8");
+    return { fileName, content };
+  } catch {
+    return null;
+  }
+}
+async function writeBundleManifest(outputDir, metadata) {
+  const report = await tryReadArtifact(outputDir, "euconform.report.json");
+  if (!report) {
+    return null;
+  }
+  const bundle = buildBundleManifest({
+    report,
+    aibom: await tryReadArtifact(outputDir, "euconform.aibom.json") ?? void 0,
+    ci: await tryReadArtifact(outputDir, "euconform.ci.json") ?? void 0,
+    summary: await tryReadArtifact(outputDir, "euconform.summary.md") ?? void 0,
+    tool: metadata.tool,
+    target: metadata.target,
+    generatedAt: metadata.generatedAt
+  });
+  const bundlePath = join3(outputDir, "euconform.bundle.json");
+  await writeFile2(bundlePath, `${JSON.stringify(bundle, null, 2)}
+`, "utf-8");
+  consola3.success(`Written ${bundlePath}`);
+  return bundlePath;
+}
+async function writeOutputFiles(output, outputDir, format) {
+  await mkdir2(outputDir, { recursive: true });
+  const written = [];
+  if (format === "json" || format === "all") {
+    const reportContent = JSON.stringify(output.report, null, 2);
+    const reportPath = join3(outputDir, "euconform.report.json");
+    await writeFile2(reportPath, reportContent, "utf-8");
+    consola3.success(`Written ${reportPath}`);
+    written.push({ fileName: "euconform.report.json", content: reportContent });
+    const aibomContent = JSON.stringify(output.aibom, null, 2);
+    const aibomPath = join3(outputDir, "euconform.aibom.json");
+    await writeFile2(aibomPath, aibomContent, "utf-8");
+    consola3.success(`Written ${aibomPath}`);
+    written.push({ fileName: "euconform.aibom.json", content: aibomContent });
+  }
+  if (format === "md" || format === "all") {
+    const mdPath = join3(outputDir, "euconform.summary.md");
+    await writeFile2(mdPath, output.summaryMarkdown, "utf-8");
+    consola3.success(`Written ${mdPath}`);
+    written.push({ fileName: "euconform.summary.md", content: output.summaryMarkdown });
+  }
+  if (written.some((artifact) => artifact.fileName === "euconform.report.json")) {
+    await writeBundleManifest(outputDir, {
+      tool: output.report.tool,
+      target: {
+        name: output.report.target.name,
+        rootPath: output.report.target.rootPath
+      },
+      generatedAt: output.report.generatedAt
+    });
+  }
+}
+async function writeZipBundle(outputDir) {
+  const { zipSync, strToU8 } = await import("fflate");
+  const fileNames = [
+    "euconform.report.json",
+    "euconform.aibom.json",
+    "euconform.summary.md",
+    "euconform.ci.json",
+    "euconform.ci-summary.md",
+    "euconform.bundle.json"
+  ];
+  const zipData = {};
+  for (const fileName of fileNames) {
+    try {
+      const content = await readFile2(join3(outputDir, fileName), "utf-8");
+      zipData[fileName] = strToU8(content);
+    } catch {
+    }
+  }
+  if (!("euconform.bundle.json" in zipData)) {
+    throw new Error("Cannot create euconform.bundle.zip without euconform.bundle.json");
+  }
+  const zipped = zipSync(zipData);
+  const zipPath = join3(outputDir, "euconform.bundle.zip");
+  await writeFile2(zipPath, zipped);
+  consola3.success(`Written ${zipPath}`);
+  return zipPath;
+}
+
+// src/commands/scan.ts
+var VALID_FORMATS = /* @__PURE__ */ new Set(["json", "md", "all"]);
+var VALID_SCOPES = /* @__PURE__ */ new Set(["production", "all"]);
+var FAIL_ON_LEVELS = ["none", "critical", "high", "medium", "low"];
+var VALID_CI_MODES = /* @__PURE__ */ new Set(["off", "github"]);
+async function validateAndParseArgs(args) {
+  const targetPath = resolve2(args.path);
+  try {
+    const info = await stat2(targetPath);
+    if (!info.isDirectory()) {
+      consola4.error(`Not a directory: ${targetPath}`);
+      process.exit(1);
+    }
+  } catch {
+    consola4.error(`Path does not exist: ${targetPath}`);
+    process.exit(1);
+  }
+  const format = args.format ?? "all";
+  const scope = args.scope ?? "production";
+  const failOn = args["fail-on"] ?? "none";
+  const ciMode = args.ci ?? "off";
+  if (!VALID_FORMATS.has(format)) {
+    consola4.error(`Invalid format: ${format}. Use one of: json, md, all.`);
+    process.exit(1);
+  }
+  if (!VALID_SCOPES.has(scope)) {
+    consola4.error(`Invalid scope: ${scope}. Use one of: production, all.`);
+    process.exit(1);
+  }
+  if (!FAIL_ON_LEVELS.includes(failOn)) {
+    consola4.error(`Invalid fail-on level: ${failOn}. Use one of: ${FAIL_ON_LEVELS.join(", ")}.`);
+    process.exit(1);
+  }
+  if (!VALID_CI_MODES.has(ciMode)) {
+    consola4.error(`Invalid ci mode: ${ciMode}. Use one of: off, github.`);
+    process.exit(1);
+  }
+  if (args.zip && format === "md") {
+    consola4.error('Cannot create euconform.bundle.zip when format is "md" only.');
+    process.exit(1);
+  }
+  if (args.verbose) {
+    consola4.level = 4;
+  }
+  const rawExclude = args["exclude-glob"];
+  const excludeGlobs = rawExclude ? Array.isArray(rawExclude) ? rawExclude : [rawExclude] : void 0;
+  return {
+    targetPath,
+    outputDir: args.output ? resolve2(args.output) : resolve2(targetPath, ".euconform"),
+    format,
+    scope,
+    failOn,
+    ciMode,
+    excludeGlobs
+  };
+}
+function buildOutputFileNames(format) {
+  const names = [];
+  if (format === "json" || format === "all") {
+    names.push("euconform.report.json", "euconform.aibom.json");
+  }
+  if (format === "md" || format === "all") {
+    names.push("euconform.summary.md");
+  }
+  return names;
+}
+var scan_default = defineCommand({
+  meta: {
+    name: "scan",
+    description: "Scan a project directory for EU AI Act compliance evidence"
+  },
+  args: {
+    path: {
+      type: "positional",
+      required: true,
+      description: "Path to project directory"
+    },
+    output: {
+      type: "string",
+      description: "Output directory (default: <path>/.euconform)"
+    },
+    format: {
+      type: "string",
+      default: "all",
+      description: 'Output format: "json", "md", or "all"'
+    },
+    scope: {
+      type: "string",
+      default: "production",
+      description: 'Scan scope: "production" or "all"'
+    },
+    "fail-on": {
+      type: "string",
+      default: "none",
+      description: 'Exit non-zero when a gap is at or above: "none", "critical", "high", "medium", "low"'
+    },
+    ci: {
+      type: "string",
+      default: "off",
+      description: 'CI output mode: "off" or "github"'
+    },
+    "exclude-glob": {
+      type: "string",
+      description: "Additional exclude patterns (repeatable)"
+    },
+    zip: {
+      type: "boolean",
+      default: false,
+      description: "Create a ZIP archive of all scan artifacts"
+    },
+    verbose: {
+      type: "boolean",
+      default: false,
+      description: "Enable verbose logging"
+    }
+  },
+  async run({ args }) {
+    const { targetPath, outputDir, format, scope, failOn, ciMode, excludeGlobs } = await validateAndParseArgs(args);
+    consola4.start(`Scanning ${targetPath} (${scope} scope)...`);
+    const scanResult = await scanRepository({ targetPath, scope, excludeGlobs });
+    consola4.info(
+      `Found ${scanResult.signals.length} signals across ${scanResult.meta.filesScanned} files`
+    );
+    const output = generateScanOutput(scanResult);
+    await writeOutputFiles(output, outputDir, format);
+    const ciArtifacts = await writeCiArtifacts(
+      output,
+      outputDir,
+      failOn,
+      ciMode,
+      scope,
+      buildOutputFileNames(format)
+    );
+    printTerminalSummary(output, outputDir);
+    if (ciArtifacts) {
+      consola4.info(
+        `CI artifacts ready: ${resolve2(ciArtifacts.reportPath)} and ${resolve2(ciArtifacts.summaryPath)}`
+      );
+    }
+    await writeBundleManifest(outputDir, {
+      tool: output.report.tool,
+      target: {
+        name: output.report.target.name,
+        rootPath: output.report.target.rootPath
+      },
+      generatedAt: output.report.generatedAt
+    });
+    if (args.zip) {
+      await writeZipBundle(outputDir);
+    }
+    if (shouldFailOnGaps(output.report.gaps, failOn)) {
+      consola4.error(`Scan failed CI threshold: found gap(s) at or above "${failOn}".`);
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/verify.ts
+import { resolve as resolve4 } from "path";
+import { defineCommand as defineCommand2 } from "citty";
+import consola6 from "consola";
+
+// src/output/verify.ts
+import consola5 from "consola";
+function printVerifySummary(report) {
+  consola5.box("EuConform Bundle Verify");
+  consola5.info(`Input: ${report.bundlePath}`);
+  consola5.info(`Mode: ${report.inputType}`);
+  if (!report.bundle) {
+    consola5.error("Bundle manifest could not be validated.");
+  } else {
+    consola5.info(`Bundle: ${report.bundle.schemaVersion}`);
+    consola5.info(
+      `Target: ${report.bundle.target.name} (${report.bundle.tool.name} v${report.bundle.tool.version})`
+    );
+  }
+  if (report.artifacts.length > 0) {
+    consola5.log("");
+    consola5.info("Artifacts:");
+    for (const artifact of report.artifacts) {
+      consola5.log(
+        `  - ${artifact.fileName} [${artifact.role}] hash=${artifact.hashStatus} schema=${artifact.schemaStatus} metadata=${artifact.metadataStatus}`
+      );
+    }
+  }
+  if (report.warnings.length > 0) {
+    consola5.log("");
+    consola5.warn(`Warnings (${report.warnings.length}):`);
+    for (const warning of report.warnings) {
+      consola5.warn(`  - ${warning.message}`);
+    }
+  }
+  if (report.errors.length > 0) {
+    consola5.log("");
+    consola5.error(`Errors (${report.errors.length}):`);
+    for (const error of report.errors) {
+      consola5.error(`  - ${error.message}`);
+    }
+  }
+  consola5.log("");
+  if (report.status === "valid") {
+    consola5.success("Bundle verification passed without warnings.");
+  } else if (report.status === "warnings") {
+    consola5.warn("Bundle verification completed with warnings.");
+  } else {
+    consola5.error("Bundle verification failed.");
+  }
+}
+
+// src/verify/verify.ts
+import { readFile as readFile3 } from "fs/promises";
+import { dirname, join as join4, resolve as resolve3 } from "path";
+import { strFromU8, unzipSync } from "fflate";
+function createReport(bundlePath, inputType) {
+  return {
+    bundle: null,
+    bundlePath,
+    inputType,
+    artifacts: [],
+    warnings: [],
+    errors: [],
+    status: "valid"
+  };
+}
+function addIssue(report, severity, issue) {
+  const finding = { severity, ...issue };
+  if (severity === "error") {
+    report.errors.push(finding);
+  } else {
+    report.warnings.push(finding);
+  }
+}
+function finalizeReport(report) {
+  report.status = report.errors.length > 0 ? "errors" : report.warnings.length > 0 ? "warnings" : "valid";
+  return report;
+}
+async function loadBundleInput(inputPath) {
+  const resolved = resolve3(inputPath);
+  const stats = await import("fs/promises").then(({ stat: stat3 }) => stat3(resolved));
+  if (stats.isDirectory()) {
+    const bundlePath = join4(resolved, "euconform.bundle.json");
+    const manifestContent2 = await readFile3(bundlePath, "utf8");
+    return {
+      inputType: "bundle-dir",
+      bundlePath,
+      manifestContent: manifestContent2,
+      artifactLoader: async (fileName) => {
+        try {
+          return await readFile3(join4(resolved, fileName), "utf8");
+        } catch {
+          return null;
+        }
+      }
+    };
+  }
+  if (resolved.endsWith(".zip")) {
+    const zipData = await readFile3(resolved);
+    const archive = unzipSync(new Uint8Array(zipData));
+    const manifest = archive["euconform.bundle.json"];
+    if (!manifest) {
+      throw new Error("Bundle ZIP does not contain euconform.bundle.json");
+    }
+    return {
+      inputType: "bundle-zip",
+      bundlePath: resolved,
+      manifestContent: strFromU8(manifest),
+      artifactLoader: async (fileName) => {
+        const entry = archive[fileName];
+        return entry ? strFromU8(entry) : null;
+      }
+    };
+  }
+  const manifestContent = await readFile3(resolved, "utf8");
+  return {
+    inputType: "bundle-json",
+    bundlePath: resolved,
+    manifestContent,
+    artifactLoader: async (fileName) => {
+      try {
+        return await readFile3(join4(dirname(resolved), fileName), "utf8");
+      } catch {
+        return null;
+      }
+    }
+  };
+}
+function compareJsonMetadata(bundle, artifact, document) {
+  const issues = [];
+  if (document.generatedAt !== bundle.generatedAt) {
+    issues.push({
+      artifact: artifact.fileName,
+      code: "metadata.generatedAt",
+      message: `${artifact.fileName} generatedAt does not match bundle manifest`
+    });
+  }
+  if (artifact.role === "report") {
+    const report = document;
+    if (report.tool.name !== bundle.tool.name) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.tool.name",
+        message: `${artifact.fileName} tool.name does not match bundle manifest`
+      });
+    }
+    if (report.tool.version !== bundle.tool.version) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.tool.version",
+        message: `${artifact.fileName} tool.version does not match bundle manifest`
+      });
+    }
+    if (report.target.name !== bundle.target.name) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.target.name",
+        message: `${artifact.fileName} target.name does not match bundle manifest`
+      });
+    }
+    if (report.target.rootPath !== bundle.target.rootPath) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.target.rootPath",
+        message: `${artifact.fileName} target.rootPath does not match bundle manifest`
+      });
+    }
+  }
+  if (artifact.role === "aibom") {
+    const aibom = document;
+    if (aibom.project.name !== bundle.target.name) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.project.name",
+        message: `${artifact.fileName} project.name does not match bundle target.name`
+      });
+    }
+    if (aibom.project.rootPath !== bundle.target.rootPath) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.project.rootPath",
+        message: `${artifact.fileName} project.rootPath does not match bundle target.rootPath`
+      });
+    }
+  }
+  if (artifact.role === "ci") {
+    const ci = document;
+    if (ci.target.name !== bundle.target.name) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.target.name",
+        message: `${artifact.fileName} target.name does not match bundle manifest`
+      });
+    }
+    if (ci.target.rootPath !== bundle.target.rootPath) {
+      issues.push({
+        artifact: artifact.fileName,
+        code: "metadata.target.rootPath",
+        message: `${artifact.fileName} target.rootPath does not match bundle manifest`
+      });
+    }
+  }
+  return issues;
+}
+function validateJsonArtifactForRole(artifact, parsed) {
+  switch (artifact.role) {
+    case "report":
+      return validateScanReport(parsed);
+    case "aibom":
+      return validateAiBillOfMaterials(parsed);
+    case "ci":
+      return validateCiReport(parsed);
+    default:
+      throw new Error(`Unsupported JSON artifact role '${artifact.role}'`);
+  }
+}
+function metadataSeverity(strict) {
+  return strict ? "error" : "warning";
+}
+async function verifyBundleInput(inputPath, options = {}) {
+  const loaded = await loadBundleInput(inputPath);
+  const report = createReport(loaded.bundlePath, loaded.inputType);
+  let parsedManifest;
+  try {
+    parsedManifest = JSON.parse(loaded.manifestContent);
+  } catch {
+    addIssue(report, "error", {
+      code: "bundle.parse",
+      message: "Failed to parse euconform.bundle.json as JSON"
+    });
+    return finalizeReport(report);
+  }
+  let bundle;
+  try {
+    bundle = validateScanBundle(parsedManifest);
+  } catch (error) {
+    addIssue(report, "error", {
+      code: "bundle.invalid",
+      message: error instanceof Error ? error.message : String(error)
+    });
+    return finalizeReport(report);
+  }
+  report.bundle = {
+    schemaVersion: bundle.schemaVersion,
+    generatedAt: bundle.generatedAt,
+    tool: bundle.tool,
+    target: bundle.target
+  };
+  const bundleMajor = getSchemaMajorVersion(bundle.schemaVersion);
+  for (const artifact of bundle.artifacts) {
+    const result = {
+      role: artifact.role,
+      fileName: artifact.fileName,
+      required: artifact.required,
+      schemaVersion: artifact.schemaVersion,
+      hashStatus: "missing",
+      schemaStatus: artifact.role === "summary" ? "skipped" : "invalid",
+      metadataStatus: "skipped"
+    };
+    const content = await loaded.artifactLoader(artifact.fileName);
+    if (content === null) {
+      result.hashStatus = "missing";
+      result.schemaStatus = artifact.role === "summary" ? "skipped" : "invalid";
+      result.metadataStatus = "skipped";
+      report.artifacts.push(result);
+      addIssue(report, "error", {
+        artifact: artifact.fileName,
+        code: "artifact.missing",
+        message: `Referenced artifact '${artifact.fileName}' is missing`
+      });
+      continue;
+    }
+    if (sha256Hex(content) === artifact.sha256) {
+      result.hashStatus = "match";
+    } else {
+      result.hashStatus = "mismatch";
+      addIssue(report, metadataSeverity(Boolean(options.strict)), {
+        artifact: artifact.fileName,
+        code: "artifact.sha256",
+        message: `${artifact.fileName} does not match the SHA-256 recorded in the bundle`
+      });
+    }
+    if (artifact.role === "summary") {
+      result.schemaStatus = "skipped";
+      result.metadataStatus = "skipped";
+      if (artifact.mimeType && artifact.mimeType !== "text/markdown") {
+        addIssue(report, metadataSeverity(Boolean(options.strict)), {
+          artifact: artifact.fileName,
+          code: "artifact.mimeType",
+          message: `${artifact.fileName} has unexpected mimeType '${artifact.mimeType}'`
+        });
+      }
+      report.artifacts.push(result);
+      continue;
+    }
+    let parsedArtifact;
+    try {
+      parsedArtifact = JSON.parse(content);
+    } catch {
+      result.schemaStatus = "invalid";
+      result.metadataStatus = "skipped";
+      report.artifacts.push(result);
+      addIssue(report, "error", {
+        artifact: artifact.fileName,
+        code: "artifact.parse",
+        message: `${artifact.fileName} is not valid JSON`
+      });
+      continue;
+    }
+    const actualSchemaVersion = parsedArtifact && typeof parsedArtifact === "object" ? parsedArtifact.schemaVersion : void 0;
+    if (typeof actualSchemaVersion !== "string") {
+      result.schemaStatus = "invalid";
+      result.metadataStatus = "skipped";
+      report.artifacts.push(result);
+      addIssue(report, "error", {
+        artifact: artifact.fileName,
+        code: "artifact.schemaVersion",
+        message: `${artifact.fileName} is missing a string schemaVersion`
+      });
+      continue;
+    }
+    result.schemaVersion = actualSchemaVersion;
+    if (artifact.schemaVersion && artifact.schemaVersion !== actualSchemaVersion) {
+      addIssue(report, "error", {
+        artifact: artifact.fileName,
+        code: "artifact.schemaVersion.mismatch",
+        message: `${artifact.fileName} schemaVersion '${actualSchemaVersion}' does not match manifest '${artifact.schemaVersion}'`
+      });
+    }
+    if (bundleMajor && getSchemaMajorVersion(actualSchemaVersion) !== bundleMajor) {
+      addIssue(report, "error", {
+        artifact: artifact.fileName,
+        code: "artifact.schemaVersion.major",
+        message: `${artifact.fileName} uses schemaVersion '${actualSchemaVersion}' with a different major than the bundle`
+      });
+    }
+    let validatedDocument;
+    try {
+      validatedDocument = validateJsonArtifactForRole(artifact, parsedArtifact);
+      result.schemaStatus = "valid";
+    } catch (error) {
+      result.schemaStatus = "invalid";
+      result.metadataStatus = "skipped";
+      report.artifacts.push(result);
+      addIssue(report, "error", {
+        artifact: artifact.fileName,
+        code: "artifact.invalid",
+        message: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    const metadataIssues = compareJsonMetadata(bundle, artifact, validatedDocument);
+    if (metadataIssues.length === 0) {
+      result.metadataStatus = "match";
+    } else {
+      result.metadataStatus = "mismatch";
+      for (const issue of metadataIssues) {
+        addIssue(report, metadataSeverity(Boolean(options.strict)), issue);
+      }
+    }
+    report.artifacts.push(result);
+  }
+  return finalizeReport(report);
+}
+function shouldFailVerifyReport(report, failOn) {
+  if (report.errors.length > 0) {
+    return true;
+  }
+  if (failOn === "warnings" && report.warnings.length > 0) {
+    return true;
+  }
+  return false;
+}
+
+// src/commands/verify.ts
+var VALID_FAIL_ON = /* @__PURE__ */ new Set(["warnings", "errors"]);
+var verify_default = defineCommand2({
+  meta: {
+    name: "verify",
+    description: "Verify a EuConform bundle manifest, directory, or ZIP archive"
+  },
+  args: {
+    path: {
+      type: "positional",
+      required: true,
+      description: "Path to euconform.bundle.json, a bundle directory, or euconform.bundle.zip"
+    },
+    strict: {
+      type: "boolean",
+      default: false,
+      description: "Escalate hash and metadata mismatches from warnings to errors"
+    },
+    json: {
+      type: "boolean",
+      default: false,
+      description: "Print the verify report as JSON"
+    },
+    "fail-on": {
+      type: "string",
+      default: "errors",
+      description: 'Exit non-zero on "errors" or on "warnings" and errors'
+    }
+  },
+  async run({ args }) {
+    const inputPath = resolve4(args.path);
+    const failOn = args["fail-on"] ?? "errors";
+    if (!VALID_FAIL_ON.has(failOn)) {
+      consola6.error(`Invalid fail-on level: ${failOn}. Use one of: warnings, errors.`);
+      process.exit(1);
+    }
+    try {
+      const report = await verifyBundleInput(inputPath, { strict: Boolean(args.strict) });
+      if (args.json) {
+        process.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+      } else {
+        printVerifySummary(report);
+      }
+      if (shouldFailVerifyReport(report, failOn)) {
+        process.exit(1);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (args.json) {
+        process.stdout.write(
+          `${JSON.stringify(
+            {
+              bundlePath: inputPath,
+              inputType: "bundle-json",
+              bundle: null,
+              artifacts: [],
+              warnings: [],
+              errors: [{ severity: "error", code: "verify.load", message }],
+              status: "errors"
+            },
+            null,
+            2
+          )}
+`
+        );
+      } else {
+        consola6.error(message);
+      }
+      process.exit(1);
+    }
+  }
+});
+
+// src/index.ts
+var main = defineCommand3({
+  meta: {
+    name: "euconform",
+    description: "EU AI Act compliance scanner for local AI projects"
+  },
+  subCommands: {
+    scan: scan_default,
+    verify: verify_default
+  }
+});
+runMain(main);