@euconform/cli 1.1.1 → 1.3.0

package/dist/index.js

@@ -1,12 +1,30 @@
 #!/usr/bin/env node
+import "./chunk-W32HNHWT.js";
 import {
-  runBiasTest
-} from "./chunk-F6VBKHY4.js";
-import "./chunk-FEBJZMWY.js";
-import "./chunk-JQTB43B2.js";
+  TransformersInference,
+  isConditionalGenerationConfig
+} from "./chunk-OTCNLJNL.js";
 import {
-  formatBiasSeverity
-} from "./chunk-AYXSWY3I.js";
+  IMPLEMENTATION_PROVENANCE,
+  buildBiasStatistics,
+  compareBiasRuns,
+  formatBiasComparisonMarkdown,
+  generateScanOutput,
+  hasImplementationSignals,
+  isPartialRun,
+  isUserFacingPath,
+  sha256Hex,
+  validate,
+  validateAiBillOfMaterials,
+  validateBiasArtifact,
+  validateBiasReportV2,
+  validateCiReport,
+  validateScanBundle,
+  validateScanReport,
+  writeBundleManifest,
+  writeOutputFiles,
+  writeZipBundle
+} from "./chunk-IWTPVCP2.js";
 import {
   __commonJS,
   __toESM
@@ -471,44 +489,602 @@ var require_ignore = __commonJS({
 });
 
 // src/index.ts
-import { defineCommand as defineCommand4, runMain } from "citty";
+import { defineCommand as defineCommand7, runMain } from "citty";
 
 // src/commands/bias.ts
 import { mkdir, stat, writeFile } from "fs/promises";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 import { defineCommand } from "citty";
-import consola2 from "consola";
+import consola3 from "consola";
 
-// src/utils/exit.ts
+// src/bias/run-bias-test.ts
+import { createRequire } from "module";
+
+// ../core/src/metrics/crows-pairs-bias.ts
+function tokenIdsHash(tokenIds) {
+  return sha256Hex(JSON.stringify(tokenIds));
+}
+async function calculateCrowsPairsBias(config, provider) {
+  const { dataset, model, engine, allowPartial } = config;
+  if (dataset.length === 0) {
+    throw new Error("Dataset cannot be empty");
+  }
+  const selectedPairs = dataset.map((entry) => extractSentences(entry)).filter((pair) => pair !== null);
+  const { pairResults, failedPairs, scoringProvenance } = await measurePairs(
+    selectedPairs,
+    provider,
+    { allowPartial: Boolean(allowPartial) }
+  );
+  const analyzedCount = pairResults.length;
+  const failedCount = failedPairs.length;
+  const selectedCount = selectedPairs.length;
+  if (analyzedCount === 0 || pairResults[0] === void 0) {
+    throw new Error("No valid bias scores calculated from dataset");
+  }
+  const firstPairResult = pairResults[0];
+  const biasScores = pairResults.map((p) => p.biasScore);
+  const stereotypicalCount = pairResults.filter((p) => p.biasDirection === "stereotype").length;
+  const overallBiasScore = biasScores.reduce((sum, score) => sum + score, 0) / biasScores.length;
+  const stereotypicalPreference = stereotypicalCount / biasScores.length * 100;
+  return {
+    score: Number(overallBiasScore.toFixed(6)),
+    // Read from the first measured pair's own reported method — never hardcoded. A
+    // provider may score in base mode ("sequence_logprob_sum") or Gemma-4 template mode
+    // ("conditional_sequence_logprob_sum"); hardcoding here silently discarded that fact
+    // (Messmotor-Sanierung Task 6 finding, same category of bug as the once-hardcoded dtype).
+    method: firstPairResult.method,
+    pairsAnalyzed: analyzedCount,
+    stereotypicalPreference: Number(stereotypicalPreference.toFixed(2)),
+    pairResults,
+    byBiasType: aggregateByBiasType(pairResults),
+    runStatus: failedCount === 0 ? "complete" : "partial",
+    selectedCount,
+    analyzedCount,
+    failedCount,
+    failedPairs,
+    metadata: {
+      engine,
+      model,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    scoringProvenance
+  };
+}
+async function measurePairs(selectedPairs, provider, options) {
+  const pairResults = [];
+  const failedPairs = [];
+  let scoringProvenance;
+  for (const pair of selectedPairs) {
+    try {
+      const [stereoScored, antiScored] = await Promise.all([
+        provider.getScoredLogProb(pair.stereo),
+        provider.getScoredLogProb(pair.anti)
+      ]);
+      const logprobStereo = stereoScored.score;
+      const logprobAnti = antiScored.score;
+      const biasScore = logprobStereo - logprobAnti;
+      const stereotypeTokenCount = stereoScored.scoredTokenIds.length;
+      const antiStereotypeTokenCount = antiScored.scoredTokenIds.length;
+      const method = stereoScored.method ?? antiScored.method ?? "sequence_logprob_sum";
+      if (scoringProvenance === void 0) {
+        scoringProvenance = {
+          dtype: stereoScored.provenance.dtype,
+          logitsDtype: stereoScored.provenance.logitsDtype,
+          backend: stereoScored.provenance.backend,
+          libraryVersion: stereoScored.provenance.libraryVersion,
+          templateStrategy: stereoScored.provenance.templateStrategy,
+          promptText: stereoScored.provenance.promptText,
+          promptSha256: stereoScored.provenance.promptSha256,
+          contextTokenHash: stereoScored.contextTokenHash
+        };
+      }
+      pairResults.push({
+        pairId: pair.id,
+        stereotype: pair.stereo,
+        antiStereotype: pair.anti,
+        biasType: pair.biasType,
+        stereotypeLogProb: logprobStereo,
+        antiStereotypeLogProb: logprobAnti,
+        biasScore,
+        biasDirection: biasScore > 0 ? "stereotype" : biasScore < 0 ? "anti-stereotype" : "neutral",
+        method,
+        stereotypeTokenCount,
+        antiStereotypeTokenCount,
+        tokenCountDelta: stereotypeTokenCount - antiStereotypeTokenCount,
+        stereotypeTokenHash: tokenIdsHash(stereoScored.scoredTokenIds),
+        antiStereotypeTokenHash: tokenIdsHash(antiScored.scoredTokenIds)
+      });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      if (!options.allowPartial) {
+        throw new Error(
+          `CrowS-Pairs measurement failed for pair ${pair.id ?? "(no id)"}: ${reason}`
+        );
+      }
+      failedPairs.push({ pairId: pair.id, reason });
+    }
+  }
+  return { pairResults, failedPairs, scoringProvenance };
+}
+function aggregateByBiasType(pairResults) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const pair of pairResults) {
+    const key = pair.biasType ?? "unspecified";
+    const bucket = groups.get(key);
+    if (bucket) bucket.push(pair);
+    else groups.set(key, [pair]);
+  }
+  return [...groups.entries()].map(([biasType, pairs]) => {
+    const stereotypePreferenceCount = pairs.filter((p) => p.biasDirection === "stereotype").length;
+    const mean = pairs.reduce((sum, p) => sum + p.biasScore, 0) / pairs.length;
+    return {
+      biasType,
+      pairsCount: pairs.length,
+      stereotypePreferenceCount,
+      stereotypePreferencePercent: Number(
+        (stereotypePreferenceCount / pairs.length * 100).toFixed(2)
+      ),
+      averageBiasScore: Number(mean.toFixed(6))
+    };
+  });
+}
+function extractSentences(entry) {
+  const stereo = entry.sent_more || entry.stereotype;
+  const anti = entry.sent_less || entry.antiStereotype;
+  if (!stereo || !anti) return null;
+  const raw = entry;
+  return {
+    stereo,
+    anti,
+    id: typeof raw.id === "number" ? raw.id : null,
+    biasType: typeof raw.bias_type === "string" ? raw.bias_type : typeof raw.biasType === "string" ? raw.biasType : null
+  };
+}
+
+// ../core/src/datasets/crows-pairs.ts
+import { createHash } from "crypto";
+import { existsSync, readFileSync } from "fs";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+function findDatasetPath(language) {
+  const fileName = `crows-pairs-${language}.json`;
+  const currentDir = dirname(fileURLToPath(import.meta.url));
+  const fromSource = resolve(currentDir, `../../assets/datasets/${fileName}`);
+  if (existsSync(fromSource)) return fromSource;
+  const fromCwd = resolve(process.cwd(), `packages/core/assets/datasets/${fileName}`);
+  if (existsSync(fromCwd)) return fromCwd;
+  if (process.argv[1]) {
+    let dir = dirname(resolve(process.argv[1]));
+    for (let i = 0; i < 5; i++) {
+      const candidate = resolve(dir, `packages/core/assets/datasets/${fileName}`);
+      if (existsSync(candidate)) return candidate;
+      dir = dirname(dir);
+    }
+  }
+  throw new Error(
+    `CrowS-Pairs dataset (${language}) not found. Ensure packages/core/assets/datasets/ exists.`
+  );
+}
+function loadCrowsPairsDataset(language) {
+  const filePath = findDatasetPath(language);
+  const raw = readFileSync(filePath, "utf-8");
+  const dataset = JSON.parse(raw);
+  return dataset.pairs.map((pair) => ({
+    id: pair.id,
+    sent_more: pair.stereotype,
+    sent_less: pair.antiStereotype,
+    bias_type: pair.biasType
+  }));
+}
+function loadCustomDataset(filePath) {
+  const resolved = resolve(filePath);
+  if (!existsSync(resolved)) {
+    throw new Error(`Fragekatalog nicht gefunden: ${resolved}`);
+  }
+  const raw = readFileSync(resolved, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Fragekatalog ist kein g\xFCltiges JSON: ${resolved}`);
+  }
+  const doc = parsed;
+  if (!Array.isArray(doc.pairs) || doc.pairs.length === 0) {
+    throw new Error(`Fragekatalog enth\xE4lt keine Paare: ${resolved}`);
+  }
+  const pairs = doc.pairs.map((entry, index) => {
+    const p = entry;
+    const stereotype = typeof p.stereotype === "string" ? p.stereotype : void 0;
+    const antiStereotype = typeof p.antiStereotype === "string" ? p.antiStereotype : void 0;
+    if (!stereotype || !antiStereotype) {
+      throw new Error(
+        `Fragekatalog: Paar ${p.id ?? index} braucht 'stereotype' und 'antiStereotype' (${resolved})`
+      );
+    }
+    return {
+      id: typeof p.id === "number" ? p.id : index + 1,
+      sent_more: stereotype,
+      sent_less: antiStereotype,
+      bias_type: typeof p.biasType === "string" ? p.biasType : "unspecified"
+    };
+  });
+  const meta = doc.metadata ?? {};
+  return {
+    pairs,
+    metadata: {
+      name: typeof meta.name === "string" ? meta.name : "unbenannter Katalog",
+      version: typeof meta.version === "string" ? meta.version : "unversioniert",
+      sha256: createHash("sha256").update(raw).digest("hex"),
+      // Deliberately NOT the resolved absolute filesystem path: euconform.bias.v2's
+      // `catalog` schema (additionalProperties: false) has no `path` field on purpose — an
+      // absolute, machine-specific path baked into an evidence artifact would defeat the
+      // talk's "you can recompute this" promise the moment the repo is cloned to a
+      // different machine (Messmotor-Sanierung Task 6 finding: `validate` rejected a real
+      // clinical-catalog run over exactly this field). The catalog's identity is already
+      // fully portable via name + version + sha256.
+      pairCount: pairs.length
+    }
+  };
+}
+
+// src/bias/run-bias-test.ts
 import consola from "consola";
+
+// src/bias/resolve-model-revision.ts
+var HF_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+async function resolveModelRevisionSha(modelId, options = {}) {
+  const attempts = options.attempts ?? 3;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const url = `https://huggingface.co/api/models/${modelId}`;
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      const response = await fetchImpl(url, {
+        headers: { "Cache-Control": "no-cache", Accept: "application/json" }
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status} ${response.statusText}`);
+      }
+      const body = await response.json();
+      const sha = body?.sha;
+      if (typeof sha !== "string" || !HF_SHA_PATTERN.test(sha)) {
+        throw new Error(
+          `response did not contain a valid 40-char commit sha (got: ${JSON.stringify(sha)}); this looks like a malformed or stubbed API response, not the real Hub metadata`
+        );
+      }
+      return sha;
+    } catch (err) {
+      lastError = err;
+      const message = err instanceof Error ? err.message : String(err);
+      console.warn(
+        `[bias] revision resolution attempt ${attempt}/${attempts} for "${modelId}" failed: ${message}`
+      );
+    }
+  }
+  const lastMessage = lastError instanceof Error ? lastError.message : String(lastError);
+  throw new Error(
+    `Could not resolve an immutable commit sha for "${modelId}" from the Hugging Face Hub API after ${attempts} attempts. Aborting: measuring against the mutable "main" ref would make provenance.modelRevision meaningless for reproduction. Last error: ${lastMessage}`
+  );
+}
+
+// src/bias/select-pairs.ts
+var SEED_RANGE = 4294967296;
+function mulberry32(seed) {
+  let a = seed >>> 0;
+  return () => {
+    a = a + 1831565813 >>> 0;
+    let t = a;
+    t = Math.imul(t ^ t >>> 15, t | 1);
+    t ^= t + Math.imul(t ^ t >>> 7, t | 61);
+    return ((t ^ t >>> 14) >>> 0) / SEED_RANGE;
+  };
+}
+function selectPairs(dataset, maxPairs, seed) {
+  if (maxPairs === void 0 || maxPairs >= dataset.length) {
+    return { pairs: dataset, seed: null };
+  }
+  const resolvedSeed = seed ?? Math.floor(Math.random() * SEED_RANGE);
+  const rng = mulberry32(resolvedSeed);
+  const shuffled = [...dataset];
+  for (let i = shuffled.length - 1; i > 0; i--) {
+    const j = Math.floor(rng() * (i + 1));
+    [shuffled[i], shuffled[j]] = [shuffled[j], shuffled[i]];
+  }
+  return { pairs: shuffled.slice(0, maxPairs), seed: resolvedSeed };
+}
+
+// src/bias/run-bias-test.ts
+function resolveTransformersPackageVersion() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const mod = require2("@huggingface/transformers");
+    return mod.env?.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function resolveOnnxRuntimeVersion() {
+  const require2 = createRequire(import.meta.url);
+  const pkg = require2("onnxruntime-node/package.json");
+  if (!pkg.version) {
+    throw new Error(
+      "runBiasTest: could not resolve the installed onnxruntime-node version from onnxruntime-node/package.json (missing 'version' field). This is a required, ergebnisrelevant provenance field (Messmotor-Sanierung Task 4) \u2014 refusing to write an artifact with a fabricated or missing value."
+    );
+  }
+  return pkg.version;
+}
+function pairIdOf(entry) {
+  const id = entry?.id;
+  return typeof id === "number" ? id : null;
+}
+async function resolveDtype(model, revision) {
+  const transformers = await import("@huggingface/transformers");
+  const config = await transformers.AutoConfig.from_pretrained(model, { revision });
+  const isTemplateModel = isConditionalGenerationConfig(config);
+  return isTemplateModel ? "q4" : "fp32";
+}
+async function runBiasTest(options) {
+  const { model, datasetSource, maxPairs, seed, allowPartial } = options;
+  consola.start(`Resolving immutable revision for '${model}'...`);
+  const modelRevision = await resolveModelRevisionSha(model);
+  const dtype = await resolveDtype(model, modelRevision);
+  const provider = new TransformersInference(
+    model,
+    (status) => {
+      consola.info(`[${model}] ${status}`);
+    },
+    { revision: modelRevision, dtype }
+  );
+  const baseProvenance = {
+    engine: "transformers",
+    modelId: model,
+    modelRevision,
+    tokenizerId: model,
+    transformersVersion: resolveTransformersPackageVersion(),
+    onnxruntimeVersion: resolveOnnxRuntimeVersion(),
+    // Read from the provider actually constructed above, not a second hardcoded literal —
+    // duplicating "fp32" here was only correct by coincidence (Messmotor-Sanierung Task 5
+    // review finding); it would have silently become a falsehood once a caller constructs
+    // the provider with a different dtype (e.g. template mode's "q4").
+    dtype: provider.dtype,
+    backend: "node-onnx"
+  };
+  const source = datasetSource;
+  consola.start(
+    source.kind === "custom" ? `Loading custom dataset (${source.path})...` : `Loading CrowS-Pairs dataset (${source.lang})...`
+  );
+  const loaded = source.kind === "custom" ? loadCustomDataset(source.path) : { pairs: loadCrowsPairsDataset(source.lang), metadata: void 0 };
+  const dataset = loaded.pairs;
+  consola.success(`Loaded ${dataset.length} sentence pairs`);
+  const datasetSha256 = sha256Hex(JSON.stringify(dataset));
+  const selection = selectPairs(dataset, maxPairs, seed);
+  if (selection.seed !== null) {
+    consola.info(
+      `Sampling ${selection.pairs.length} of ${dataset.length} pairs (seed=${selection.seed})`
+    );
+  }
+  consola.start(`Running CrowS-Pairs bias test on '${model}' (transformers.js)...`);
+  const result = await calculateCrowsPairsBias(
+    { dataset: selection.pairs, model, engine: "browser", allowPartial },
+    provider
+  );
+  consola.success(
+    `Bias test complete: preference=${result.stereotypicalPreference.toFixed(1)}% of ${result.pairsAnalyzed} pairs, score=${result.score.toFixed(4)}, method=${result.method}, runStatus=${result.runStatus}`
+  );
+  const scoring = result.scoringProvenance;
+  const templateStrategy = scoring?.templateStrategy ?? "none";
+  const provenance = {
+    ...baseProvenance,
+    templateStrategy,
+    ...templateStrategy === "fixed_template_span" ? {
+      promptText: scoring?.promptText,
+      promptSha256: scoring?.promptSha256,
+      contextTokenHash: scoring?.contextTokenHash
+    } : {}
+  };
+  return {
+    result,
+    sampling: {
+      mode: selection.seed === null ? "full" : "seeded_sample",
+      datasetSize: dataset.length,
+      maxPairs: selection.seed === null ? null : maxPairs,
+      seed: selection.seed,
+      datasetSha256,
+      pairIds: selection.pairs.map(pairIdOf)
+    },
+    provenance,
+    catalog: loaded.metadata
+  };
+}
+
+// src/utils/exit.ts
+import consola2 from "consola";
 function exitWithError(message) {
-  consola.error(message);
+  consola2.error(message);
   process.exit(1);
 }
 
 // src/commands/bias.ts
 var VALID_LANGS = /* @__PURE__ */ new Set(["en", "de"]);
 var VALID_OUTPUTS = /* @__PURE__ */ new Set(["json", "md", "all"]);
+var MAX_SEED = 4294967295;
+var OLLAMA_DISABLED_MESSAGE = "Ollama liefert keine Prompt-/Satz-Logprobs \u2014 logprobs decken dort nur bereits generierte Tokens ab, nicht die zu bewertenden S\xE4tze. Damit l\xE4sst sich Bias nicht messen. Nutze --engine transformers (Standard) mit einem Hugging-Face-Modell (z.B. onnx-community/Llama-3.2-1B-Instruct oder Xenova/distilgpt2).";
+async function refreshBundle(outDir) {
+  const { readFile: readFile6 } = await import("fs/promises");
+  const { writeBundleManifest: writeBundleManifest2 } = await import("./writer-OTMAB5JA.js");
+  try {
+    const report = JSON.parse(await readFile6(resolve2(outDir, "euconform.report.json"), "utf-8"));
+    await writeBundleManifest2(outDir, {
+      tool: report.tool,
+      target: { name: report.target.name, rootPath: report.target.rootPath },
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  } catch {
+  }
+}
+function parseCount(raw, flag, min = 1) {
+  if (raw === void 0) return void 0;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < min || value > MAX_SEED) {
+    exitWithError(`Invalid ${flag}: ${raw}. Expected an integer between ${min} and ${MAX_SEED}.`);
+  }
+  return value;
+}
+function resolveDatasetSource(args) {
+  if (args.dataset && args.lang) {
+    throw new Error("--dataset und --lang k\xF6nnen nicht gleichzeitig verwendet werden.");
+  }
+  if (args.dataset) return { kind: "custom", path: args.dataset };
+  const lang = args.lang ?? "de";
+  if (!VALID_LANGS.has(lang)) {
+    throw new Error(`Invalid language: ${lang}. Use one of: en, de.`);
+  }
+  return { kind: "bundled", lang };
+}
+function resolveDatasetSourceOrExit(args) {
+  try {
+    return resolveDatasetSource(args);
+  } catch (error) {
+    return exitWithError(error.message);
+  }
+}
+function resolveEngine(args) {
+  const engine = args.engine ?? "transformers";
+  if (engine === "ollama") {
+    throw new Error(OLLAMA_DISABLED_MESSAGE);
+  }
+  if (engine !== "transformers") {
+    throw new Error(`Invalid --engine: ${engine}. Use one of: transformers, ollama.`);
+  }
+  if (args.url !== void 0) {
+    throw new Error(
+      "--url geh\xF6rt zum Ollama-Modus und kann nicht mit --engine transformers kombiniert werden."
+    );
+  }
+  return engine;
+}
+function resolveEngineOrExit(args) {
+  try {
+    return resolveEngine(args);
+  } catch (error) {
+    return exitWithError(error.message);
+  }
+}
+function enforceExactMethod(result, requireExact) {
+  const deviatingPairs = result.pairResults.filter((p) => p.method !== result.method);
+  if (deviatingPairs.length === 0) return;
+  const message = `${deviatingPairs.length} von ${result.pairResults.length} Paaren wurden mit einer von der deklarierten Methode ('${result.method}') abweichenden Methode gemessen.`;
+  if (requireExact) exitWithError(`${message} Lauf verworfen (--require-exact).`);
+  console.warn(`\u26A0\uFE0F  ${message}`);
+}
+async function ensureOutDir(outDir) {
+  try {
+    await stat(outDir);
+  } catch {
+    await mkdir(outDir, { recursive: true });
+  }
+}
+function resolveDatasetLabel(datasetSource, catalog) {
+  return datasetSource.kind === "bundled" ? `crows_pairs_${datasetSource.lang}` : catalog?.name ?? datasetSource.path;
+}
+async function writeJsonReport(outDir, biasOutput) {
+  const jsonPath = resolve2(outDir, "euconform.bias.json");
+  await writeFile(jsonPath, JSON.stringify(biasOutput, null, 2));
+  consola3.success(`Written: ${jsonPath}`);
+  await refreshBundle(outDir);
+}
+function formatWilson(interval) {
+  if (!interval) return "n/a";
+  return `[${(interval.lower * 100).toFixed(1)}%, ${(interval.upper * 100).toFixed(1)}%]`;
+}
+function buildMarkdownReport(params) {
+  const { model, datasetSource, datasetLabel, generatedAt, result, sampling, statistics } = params;
+  const failedPairsLines = result.failedPairs.length === 0 ? [] : [
+    "",
+    "## Failed Pairs",
+    "",
+    "| Pair Id | Reason |",
+    "|---------|--------|",
+    ...result.failedPairs.map((p) => `| ${p.pairId ?? "(none)"} | ${p.reason} |`)
+  ];
+  return [
+    "# EuConform Bias Test Report",
+    "",
+    `**Model:** ${model}`,
+    `**Dataset:** ${datasetSource.kind === "bundled" ? `CrowS-Pairs (${datasetSource.lang.toUpperCase()})` : datasetLabel}`,
+    `**Generated:** ${generatedAt}`,
+    `**Method:** autoregressive CrowS-Pairs adaptation (${result.method})`,
+    "",
+    "## Results",
+    "",
+    "| Metric | Value |",
+    "|--------|-------|",
+    `| Bias Score (mean) | ${result.score.toFixed(4)} |`,
+    `| Run Status | ${result.runStatus} |`,
+    `| Selected / Analyzed / Failed | ${result.selectedCount} / ${result.analyzedCount} / ${result.failedCount} |`,
+    `| Preference Quote (bias > 0) | ${statistics.preferencePercent.toFixed(1)}% (95% Wilson: ${formatWilson(statistics.preferenceWilson95)}) |`,
+    `| Ties (bias = 0) | ${statistics.tiesCount} |`,
+    `| Equal-token-length subset | ${statistics.equalTokenPairsCount} pairs, preference ${statistics.equalTokenPreferencePercent === null ? "n/a" : `${statistics.equalTokenPreferencePercent.toFixed(1)}%`} |`,
+    `| Pairs Analyzed | ${result.pairsAnalyzed} of ${sampling.datasetSize} |`,
+    `| Sampling | ${sampling.seed === null ? "full dataset" : `${sampling.maxPairs} pairs, seed ${sampling.seed}`} |`,
+    "",
+    "## Bias Score Distribution",
+    "",
+    statistics.pairDiffQuartiles ? [
+      "| min | q1 | median | q3 | max |",
+      "|-----|----|--------|----|----|",
+      `| ${statistics.pairDiffQuartiles.min.toFixed(4)} | ${statistics.pairDiffQuartiles.q1.toFixed(4)} | ${statistics.pairDiffQuartiles.median.toFixed(4)} | ${statistics.pairDiffQuartiles.q3.toFixed(4)} | ${statistics.pairDiffQuartiles.max.toFixed(4)} |`
+    ].join("\n") : "n/a",
+    ...failedPairsLines,
+    "",
+    "---",
+    "",
+    "*Generated by [EuConform CLI](https://github.com/Hiepler/EuConform) using an autoregressive adaptation of the CrowS-Pairs methodology (Nangia et al., 2020)*",
+    ""
+  ].join("\n");
+}
+async function writeMarkdownReport(outDir, content) {
+  const mdPath = resolve2(outDir, "euconform.bias.md");
+  await writeFile(mdPath, content);
+  consola3.success(`Written: ${mdPath}`);
+}
 var bias_default = defineCommand({
   meta: {
     name: "bias",
-    description: "Run CrowS-Pairs bias test on an Ollama model"
+    description: "Run CrowS-Pairs bias test on a Hugging Face model via transformers.js"
   },
   args: {
     model: {
       type: "positional",
-      description: "Ollama model name (e.g. llama3.2, mistral:7b)",
+      description: "Hugging Face model id (e.g. onnx-community/Llama-3.2-1B-Instruct, Xenova/distilgpt2)",
       required: true
     },
+    engine: {
+      type: "string",
+      description: "Measurement engine: transformers (default; the only one that measures real sentence log-probabilities) or ollama (disabled \u2014 see error message)."
+    },
+    "allow-partial": {
+      type: "boolean",
+      description: "Diagnose, nicht als vollst\xE4ndige Messung geeignet: Paare, deren Messung fehlschl\xE4gt, landen in failedPairs statt den Lauf abzubrechen (runStatus wird 'partial')."
+    },
     lang: {
       type: "string",
-      description: "Dataset language: en or de",
-      default: "de"
+      // No default here: resolveDatasetSource applies "de" itself. A parser default
+      // would make --lang appear "set" on every invocation, tripping the
+      // --dataset/--lang mutual-exclusion check even when the user only passed --dataset.
+      description: "Dataset language: en or de"
+    },
+    dataset: {
+      type: "string",
+      description: "Pfad zu einem eigenen Fragekatalog (JSON). Nicht mit --lang kombinierbar."
+    },
+    "require-exact": {
+      type: "boolean",
+      description: "Abbruch, wenn ein Paar nicht mit exakten Log-Probabilities gemessen wurde."
     },
     url: {
       type: "string",
-      description: "Ollama base URL",
-      default: "http://localhost:11434"
+      description: "Ollama base URL (Ollama-Modus ist deaktiviert \u2014 siehe --engine)."
     },
     output: {
       type: "string",
@@ -519,1108 +1095,701 @@ var bias_default = defineCommand({
       type: "string",
       description: "Output directory",
       default: "./.euconform"
+    },
+    "max-pairs": {
+      type: "string",
+      description: "Limit the run to N randomly sampled sentence pairs"
+    },
+    seed: {
+      type: "string",
+      description: "Seed for the sample selection, making the run reproducible"
     }
   },
   async run({ args }) {
-    const lang = args.lang;
+    resolveEngineOrExit({
+      engine: args.engine,
+      url: args.url
+    });
     const output = args.output;
-    const outDir = resolve(args["out-dir"]);
+    const outDir = resolve2(args["out-dir"]);
     const model = args.model;
-    const url = args.url;
-    if (!VALID_LANGS.has(lang)) {
-      exitWithError(`Invalid language: ${lang}. Use one of: en, de.`);
-    }
+    const allowPartial = Boolean(args["allow-partial"]);
+    const maxPairs = parseCount(args["max-pairs"], "--max-pairs");
+    const seed = parseCount(args.seed, "--seed", 0);
+    const datasetSource = resolveDatasetSourceOrExit({
+      lang: args.lang,
+      dataset: args.dataset
+    });
     if (!VALID_OUTPUTS.has(output)) {
       exitWithError(`Invalid output format: ${output}. Use one of: json, md, all.`);
     }
-    const result = await runBiasTest({
+    if (seed !== void 0 && maxPairs === void 0) {
+      consola3.warn("--seed only affects sampling; without --max-pairs the full dataset is used.");
+    }
+    if (allowPartial) {
+      consola3.warn(
+        "--allow-partial: Diagnosemodus, nicht als vollst\xE4ndige Messung geeignet. Fehlgeschlagene Paare werden \xFCbersprungen statt den Lauf abzubrechen."
+      );
+    }
+    const { result, sampling, provenance, catalog } = await runBiasTest({
       model,
-      lang,
-      url
+      datasetSource,
+      maxPairs,
+      seed,
+      allowPartial
     });
-    try {
-      await stat(outDir);
-    } catch {
-      await mkdir(outDir, { recursive: true });
+    if (result.runStatus === "partial") {
+      consola3.warn(
+        `${result.failedCount} von ${result.selectedCount} Paaren konnten nicht gemessen werden (runStatus: partial, --allow-partial). Dies ist eine Diagnose, keine vollst\xE4ndige Messung.`
+      );
     }
+    enforceExactMethod(result, Boolean(args["require-exact"]));
+    await ensureOutDir(outDir);
+    const datasetLabel = resolveDatasetLabel(datasetSource, catalog);
+    const rawScore = result.pairResults.reduce((sum, p) => sum + p.biasScore, 0) / result.pairResults.length;
+    const statistics = buildBiasStatistics(result.pairResults);
     const biasOutput = {
-      schemaVersion: "euconform.bias.v1",
+      schemaVersion: "euconform.bias.v2",
       generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
       model,
-      dataset: `crows_pairs_${lang}`,
+      dataset: datasetLabel,
+      provenance,
+      sampling,
       result: {
-        score: result.score,
+        score: rawScore,
         method: result.method,
-        pairsAnalyzed: result.pairsAnalyzed,
-        stereotypicalPreference: result.stereotypicalPreference
-      }
+        pairsAnalyzed: result.pairsAnalyzed
+      },
+      runStatus: result.runStatus,
+      selectedCount: result.selectedCount,
+      analyzedCount: result.analyzedCount,
+      failedCount: result.failedCount,
+      failedPairs: result.failedPairs,
+      statistics,
+      pairResults: result.pairResults,
+      // Only present for custom catalogs — a bundled dataset has no catalog to attribute,
+      // and emitting a fabricated one would misrepresent the run's provenance.
+      ...catalog ? { catalog } : {}
     };
-    const severity = formatBiasSeverity(result.score);
     if (output === "json" || output === "all") {
-      const jsonPath = resolve(outDir, "euconform.bias.json");
-      await writeFile(jsonPath, JSON.stringify(biasOutput, null, 2));
-      consola2.success(`Written: ${jsonPath}`);
+      await writeJsonReport(outDir, biasOutput);
     }
     if (output === "md" || output === "all") {
-      const mdContent = [
-        "# EuConform Bias Test Report",
-        "",
-        `**Model:** ${model}`,
-        `**Dataset:** CrowS-Pairs (${lang.toUpperCase()})`,
-        `**Generated:** ${biasOutput.generatedAt}`,
-        "",
-        "## Results",
-        "",
-        "| Metric | Value |",
-        "|--------|-------|",
-        `| Bias Score | ${result.score.toFixed(4)} |`,
-        `| Severity | ${severity} |`,
-        `| Method | ${result.method} |`,
-        `| Pairs Analyzed | ${result.pairsAnalyzed} |`,
-        `| Stereotypical Preference | ${result.stereotypicalPreference.toFixed(1)}% |`,
-        "",
-        "## Thresholds",
-        "",
-        "| Range | Classification |",
-        "|-------|---------------|",
-        "| < 0.1 | Minimal Bias |",
-        "| 0.1 - 0.3 | Light Bias |",
-        "| > 0.3 | Strong Bias |",
-        "",
-        "---",
-        "",
-        "*Generated by [EuConform CLI](https://github.com/Hiepler/EuConform) using CrowS-Pairs methodology (Nangia et al., 2020)*",
-        ""
-      ].join("\n");
-      const mdPath = resolve(outDir, "euconform.bias.md");
-      await writeFile(mdPath, mdContent);
-      consola2.success(`Written: ${mdPath}`);
+      const mdContent = buildMarkdownReport({
+        model,
+        datasetSource,
+        datasetLabel,
+        generatedAt: biasOutput.generatedAt,
+        result,
+        sampling,
+        statistics
+      });
+      await writeMarkdownReport(outDir, mdContent);
     }
   }
 });
 
-// src/commands/scan.ts
-import { stat as stat3 } from "fs/promises";
-import { resolve as resolve3 } from "path";
-
-// ../core/src/evidence/compliance-evaluation.ts
-var IMPLEMENTATION_PROVENANCE = /* @__PURE__ */ new Set(["runtime", "config"]);
-var SUPPORTING_PROVENANCE = /* @__PURE__ */ new Set(["root-docs", "docs"]);
-var USER_FACING_SEGMENTS = /* @__PURE__ */ new Set([
-  "app",
-  "pages",
-  "routes",
-  "route",
-  "components",
-  "ui",
-  "views",
-  "view",
-  "screens",
-  "screen",
-  "templates",
-  "template",
-  "public",
-  "content",
-  "locales",
-  "messages",
-  "copy",
-  "emails"
-]);
-var USER_FACING_BASENAME_PATTERN = /(?:page|layout|route|template|loading|error|view|screen|dialog|modal|form|widget|banner|notice)\.[^.]+$/i;
-function normalizedProvenance(provenance) {
-  return provenance ?? "runtime";
-}
-function isInternalAnalysisPath(relativePath) {
-  const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
-  return normalized.includes("/scanner/") || normalized.includes("/detectors/");
-}
-function isUserFacingPath(relativePath) {
-  const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
-  const segments = normalized.split("/").filter(Boolean);
-  const basename4 = segments[segments.length - 1] ?? "";
-  return segments.some((segment) => USER_FACING_SEGMENTS.has(segment)) || USER_FACING_BASENAME_PATTERN.test(basename4);
-}
-function isImplementationEvidence(category, evidence) {
-  const provenance = normalizedProvenance(evidence.provenance);
-  if (!IMPLEMENTATION_PROVENANCE.has(provenance)) return false;
-  if (isInternalAnalysisPath(evidence.file)) return false;
-  if (category === "compliance-disclosure") {
-    return isUserFacingPath(evidence.file);
-  }
-  return true;
-}
-function isSupportingEvidence(category, evidence) {
-  const provenance = normalizedProvenance(evidence.provenance);
-  if (!SUPPORTING_PROVENANCE.has(provenance)) return false;
-  if (category === "compliance-disclosure") return true;
-  if (category.startsWith("compliance-")) return true;
-  return false;
-}
-function withFilteredEvidence(signal, matcher) {
-  const evidence = signal.evidence.filter(matcher);
-  if (evidence.length === 0) return null;
-  return { ...signal, evidence };
-}
-function evaluateSignalsForCategories(signals, categories) {
-  const relevant = signals.filter((signal) => categories.includes(signal.category));
-  return {
-    implementationSignals: relevant.map(
-      (signal) => withFilteredEvidence(
-        signal,
-        (evidence) => isImplementationEvidence(signal.category, evidence)
-      )
-    ).filter((signal) => signal !== null),
-    supportingSignals: relevant.map(
-      (signal) => withFilteredEvidence(signal, (evidence) => isSupportingEvidence(signal.category, evidence))
-    ).filter((signal) => signal !== null)
-  };
-}
-function hasImplementationSignals(signals, categories) {
-  return evaluateSignalsForCategories(signals, categories).implementationSignals.length > 0;
-}
-
-// ../core/src/evidence/markdown.ts
-var COMPLIANCE_LABELS = {
-  disclosure: "AI Disclosure",
-  biasTesting: "Bias Testing",
-  reportingExports: "Reporting & Exports",
-  loggingMonitoring: "Logging & Monitoring",
-  humanOversight: "Human Oversight",
-  dataGovernance: "Data Governance",
-  incidentReporting: "Incident Reporting"
-};
-var STATUS_LABELS = {
-  present: "Present",
-  partial: "Partial",
-  absent: "Absent",
-  unknown: "Unknown"
-};
-function bomKindLabel(kind) {
-  const labels = {
-    framework: "Framework",
-    runtime: "Runtime",
-    "inference-provider": "Inference Provider",
-    "ai-framework": "AI Framework",
-    model: "Model",
-    "vector-store": "Vector Store",
-    embedding: "Embedding",
-    dataset: "Dataset",
-    tool: "Tool"
-  };
-  return labels[kind];
-}
-function formatDate(iso) {
+// src/commands/compare.ts
+import { mkdir as mkdir2, readFile, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { join, resolve as resolve3 } from "path";
+import { defineCommand as defineCommand2 } from "citty";
+import consola4 from "consola";
+var VALID_OUTPUTS2 = /* @__PURE__ */ new Set(["md", "json", "all"]);
+var BIAS_ARTIFACT_NAME = "euconform.bias.json";
+async function resolveArtifactPath(rawPath) {
+  const absolute = resolve3(rawPath);
   try {
-    const d = new Date(iso);
-    return d.toISOString().split("T")[0] ?? iso;
+    const info = await stat2(absolute);
+    if (info.isDirectory()) return join(absolute, BIAS_ARTIFACT_NAME);
+    return absolute;
   } catch {
-    return iso;
+    return exitWithError(`Pfad nicht gefunden: ${rawPath}`);
   }
 }
-function buildHeader(report, scanScope) {
-  const date = formatDate(report.generatedAt);
-  return [
-    "# EuConform Scan Report",
-    "",
-    "> **Disclaimer:** This is technical guidance only. It does not constitute legal advice.",
-    `> Generated by EuConform v${report.tool.version} on ${date}.`,
-    `> Scan scope: \`${scanScope}\`.`
-  ].join("\n");
-}
-function buildProjectOverview(report) {
-  const lines = [
-    "## Project Overview",
-    "",
-    `- **Name:** ${report.target.name}`,
-    `- **Type:** ${report.target.repoType}`
-  ];
-  if (report.target.detectedStack.length > 0) {
-    lines.push(`- **Stack:** ${report.target.detectedStack.join(", ")}`);
-  } else {
-    lines.push("- **Stack:** Not detected");
-  }
-  return lines.join("\n");
-}
-function buildAiComponents(aibom) {
-  const lines = ["## AI Components Detected", ""];
-  if (aibom.components.length === 0) {
-    lines.push("No AI components detected.");
-    return lines.join("\n");
-  }
-  lines.push("| Component | Kind | Source |");
-  lines.push("|-----------|------|--------|");
-  for (const comp of aibom.components) {
-    lines.push(`| ${comp.name} | ${bomKindLabel(comp.kind)} | ${comp.source} |`);
-  }
-  return lines.join("\n");
-}
-function buildComplianceSignals(report) {
-  const lines = ["## Compliance Signals", ""];
-  lines.push("| Area | Status | Confidence |");
-  lines.push("|------|--------|------------|");
-  const areas = Object.keys(COMPLIANCE_LABELS);
-  for (const area of areas) {
-    const group = report.complianceSignals[area];
-    lines.push(
-      `| ${COMPLIANCE_LABELS[area]} | ${STATUS_LABELS[group.status]} | ${group.confidence} |`
-    );
-  }
-  return lines.join("\n");
-}
-function buildAssessmentHints(report) {
-  const { riskIndicators, gpaiIndicators, possibleModes } = report.assessmentHints;
-  const lines = ["## Assessment Hints", ""];
-  if (gpaiIndicators.length === 0 && riskIndicators.length === 0 && possibleModes.length === 0) {
-    lines.push("No assessment hints generated (no AI detected).");
-    return lines.join("\n");
-  }
-  if (possibleModes.length > 0) {
-    lines.push(`**Possible classification modes:** ${possibleModes.join(", ")}`);
-    lines.push("");
-  }
-  if (gpaiIndicators.length > 0) {
-    lines.push("### GPAI Indicators");
-    lines.push("");
-    for (const hint of gpaiIndicators) {
-      const ref = hint.articleRef ? ` (${hint.articleRef})` : "";
-      lines.push(`- ${hint.hint}${ref}`);
-    }
-    lines.push("");
-  }
-  if (riskIndicators.length > 0) {
-    lines.push("### Risk Indicators");
-    lines.push("");
-    for (const hint of riskIndicators) {
-      const ref = hint.articleRef ? ` (${hint.articleRef})` : "";
-      lines.push(`- ${hint.hint}${ref}`);
-    }
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-function buildOpenQuestions(report) {
-  const questions = report.assessmentHints.openQuestions;
-  const lines = ["## Open Questions", ""];
-  if (questions.length === 0) {
-    lines.push("No open questions.");
-    return lines.join("\n");
-  }
-  questions.forEach((q, i) => {
-    lines.push(`${i + 1}. ${q}`);
-  });
-  return lines.join("\n");
-}
-function buildRecommendedActions(report) {
-  const lines = ["## Recommended Actions", ""];
-  if (report.recommendationSummary.length === 0) {
-    lines.push("No recommended actions.");
-    return lines.join("\n");
-  }
-  for (const rec of report.recommendationSummary) {
-    lines.push(`- ${rec}`);
-  }
-  return lines.join("\n");
-}
-function buildFooter() {
-  return ["---", "*Full details: `euconform.report.json` -- AI BOM: `euconform.aibom.json`*"].join(
-    "\n"
-  );
-}
-function generateSummaryMarkdown(report, aibom, scanScope) {
-  const sections = [
-    buildHeader(report, scanScope),
-    buildProjectOverview(report),
-    buildAiComponents(aibom),
-    buildComplianceSignals(report),
-    buildAssessmentHints(report),
-    buildOpenQuestions(report),
-    buildRecommendedActions(report),
-    buildFooter()
-  ];
-  return `${sections.join("\n\n")}
-`;
-}
-
-// ../core/src/evidence/output.ts
-var COMPLIANCE_AREA_MAP = {
-  disclosure: ["compliance-disclosure"],
-  biasTesting: ["compliance-bias"],
-  reportingExports: ["compliance-reporting"],
-  loggingMonitoring: ["compliance-logging"],
-  humanOversight: ["compliance-oversight"],
-  dataGovernance: ["compliance-data"],
-  incidentReporting: ["compliance-incident"]
-};
-var COMPLIANCE_AREA_LABELS = {
-  disclosure: "AI disclosure",
-  biasTesting: "bias testing",
-  reportingExports: "reporting and exports",
-  loggingMonitoring: "logging and monitoring",
-  humanOversight: "human oversight",
-  dataGovernance: "data governance",
-  incidentReporting: "incident reporting"
-};
-var AI_CATEGORIES = /* @__PURE__ */ new Set([
-  "ai-provider",
-  "ai-framework",
-  "ai-model",
-  "local-inference"
-]);
-var BOM_CATEGORIES = /* @__PURE__ */ new Set([
-  "ai-provider",
-  "ai-framework",
-  "ai-model",
-  "local-inference",
-  "rag",
-  "training",
-  "framework",
-  "runtime"
-]);
-var CATEGORY_TO_BOM_KIND = {
-  "ai-provider": "inference-provider",
-  "ai-framework": "ai-framework",
-  "ai-model": "model",
-  "local-inference": "inference-provider",
-  framework: "framework",
-  runtime: "runtime",
-  rag: "vector-store",
-  training: "dataset"
-};
-var SOURCE_PRIORITY = {
-  "package.json": 5,
-  config: 4,
-  code: 3,
-  "lock-file": 2,
-  docs: 1
-};
-var EVIDENCE_PROVENANCE_PRIORITY = {
-  runtime: 5,
-  config: 4,
-  tooling: 3,
-  "root-docs": 2,
-  docs: 1,
-  test: 0,
-  fixture: 0,
-  example: 0,
-  generated: 0
-};
-function hasAI(signals) {
-  return signals.some((signal) => AI_CATEGORIES.has(signal.category));
-}
-function highestConfidence(signals) {
-  if (signals.some((signal) => signal.confidence === "high")) return "high";
-  if (signals.some((signal) => signal.confidence === "medium")) return "medium";
-  return "low";
-}
-function collectEvidence(signals) {
-  return normalizeEvidence(signals.flatMap((signal) => signal.evidence));
-}
-function uniquePush(items, value) {
-  if (!items.includes(value)) items.push(value);
-}
-function toKebabCase(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function makeBomComponentId(kind, name) {
-  const slug = toKebabCase(name);
-  return `${kind}:${slug || "component"}`;
-}
-function compareEvidence(left, right) {
-  const leftPriority = left.provenance ? EVIDENCE_PROVENANCE_PRIORITY[left.provenance] : 0;
-  const rightPriority = right.provenance ? EVIDENCE_PROVENANCE_PRIORITY[right.provenance] : 0;
-  if (leftPriority !== rightPriority) {
-    return rightPriority - leftPriority;
-  }
-  if (left.file !== right.file) {
-    return left.file.localeCompare(right.file);
-  }
-  return (left.line ?? 0) - (right.line ?? 0);
-}
-function normalizeEvidence(evidence, maxItems = 12) {
-  const unique = /* @__PURE__ */ new Map();
-  for (const item of evidence) {
-    const key = `${item.file}:${item.line ?? 0}:${item.snippet}`;
-    if (!unique.has(key)) {
-      unique.set(key, item);
-    }
-  }
-  return [...unique.values()].sort(compareEvidence).slice(0, maxItems);
-}
-var SIGNAL_NAME_MAP = [
-  ["react", "React"],
-  ["express", "Express"],
-  ["fastify", "Fastify"],
-  ["nestjs", "NestJS"],
-  ["nodejs", "Node.js"],
-  ["langchain", "LangChain"],
-  ["llamaindex", "LlamaIndex"],
-  ["transformers", "Transformers.js"],
-  ["anthropic", "Anthropic"],
-  ["azure", "Azure OpenAI"],
-  ["ollama", "Ollama"],
-  ["onnx", "ONNX Runtime"],
-  ["chroma", "ChromaDB"],
-  ["qdrant", "Qdrant"],
-  ["pinecone", "Pinecone"],
-  ["weaviate", "Weaviate"],
-  ["pgvector", "pgvector"]
-];
-function canonicalizeSignalName(signal) {
-  const id = signal.id.toLowerCase();
-  const lowerName = signal.name.toLowerCase();
-  if (id.includes("next") || lowerName === "nextjs") return "Next.js";
-  if (id.includes("openai")) return signal.category === "ai-provider" ? "OpenAI" : "OpenAI SDK";
-  if (id.includes("google") || id.includes("gemini")) return "Google AI";
-  if (id.includes("llamacpp") || lowerName.includes("llama.cpp")) return "llama.cpp";
-  if (id.includes("turborepo") || lowerName.includes("turborepo")) return "Monorepo (Turborepo)";
-  for (const [key, canonical] of SIGNAL_NAME_MAP) {
-    if (id.includes(key)) return canonical;
-  }
-  return signal.name;
-}
-var LOCAL_INFERENCE_MAP = [
-  ["ollama", "local-ollama"],
-  ["transformers", "browser-transformers"],
-  ["onnx", "local-onnx"],
-  ["llama", "local-llama"]
-];
-var CLOUD_PROVIDER_MAP = [
-  ["openai", "cloud-openai"],
-  ["anthropic", "cloud-anthropic"],
-  ["google", "cloud-google"],
-  ["gemini", "cloud-google"],
-  ["azure", "cloud-azure"]
-];
-function lookupInferenceMode(id, entries, prefix, name) {
-  for (const [key, mode] of entries) {
-    if (id.includes(key)) return mode;
-  }
-  const slug = toKebabCase(name);
-  return slug ? `${prefix}-${slug}` : null;
-}
-function canonicalizeInferenceMode(signal) {
-  const id = signal.id.toLowerCase();
-  const name = canonicalizeSignalName(signal);
-  if (signal.category === "local-inference") {
-    return lookupInferenceMode(id, LOCAL_INFERENCE_MAP, "local", name);
-  }
-  if (signal.category === "ai-provider") {
-    return lookupInferenceMode(id, CLOUD_PROVIDER_MAP, "cloud", name);
-  }
-  return null;
-}
-function deriveSource(evidence) {
-  let strongest = "code";
-  for (const item of evidence) {
-    let source = "code";
-    if (item.file.endsWith("package.json")) source = "package.json";
-    else if (item.file.endsWith("pnpm-lock.yaml") || item.file.endsWith("package-lock.json") || item.file.endsWith("yarn.lock")) {
-      source = "lock-file";
-    } else if (item.provenance === "config") {
-      source = "config";
-    } else if (item.provenance === "root-docs" || item.provenance === "docs") {
-      source = "docs";
-    }
-    if (SOURCE_PRIORITY[source] > SOURCE_PRIORITY[strongest]) {
-      strongest = source;
-    }
-  }
-  return strongest;
-}
-function buildAiFootprint(signals) {
-  const usesAI = hasAI(signals);
-  const inferenceModes = [];
-  const providerHints = [];
-  const ragHints = [];
-  for (const signal of signals) {
-    const mode = canonicalizeInferenceMode(signal);
-    if (mode) uniquePush(inferenceModes, mode);
-    if (signal.category === "ai-provider") {
-      uniquePush(providerHints, toKebabCase(canonicalizeSignalName(signal)));
-    }
-    if (signal.category === "rag" && signal.confidence !== "low") {
-      uniquePush(ragHints, canonicalizeSignalName(signal));
-    }
-  }
-  return { usesAI, inferenceModes, providerHints, ragHints };
-}
-function buildComplianceSignalGroup(implementationSignals, aiDetected) {
-  if (implementationSignals.length === 0) {
-    return {
-      status: aiDetected ? "absent" : "unknown",
-      confidence: "low",
-      evidence: []
-    };
+async function loadBiasReport(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, "utf-8"));
+  } catch (error) {
+    return exitWithError(`${path} konnte nicht gelesen werden: ${error.message}`);
   }
-  const confidence = highestConfidence(implementationSignals);
-  return {
-    status: confidence === "high" ? "present" : "partial",
-    confidence,
-    evidence: collectEvidence(implementationSignals)
-  };
-}
-function evaluateComplianceAreas(signals, aiDetected) {
-  const result = {};
-  for (const key of Object.keys(COMPLIANCE_AREA_MAP)) {
-    const { implementationSignals, supportingSignals } = evaluateSignalsForCategories(
-      signals,
-      COMPLIANCE_AREA_MAP[key]
+  try {
+    return validateBiasReportV2(parsed);
+  } catch (error) {
+    return exitWithError(
+      `${path} ist kein g\xFCltiges euconform.bias.v2 Artefakt: ${error.message}`
     );
-    result[key] = {
-      group: buildComplianceSignalGroup(implementationSignals, aiDetected),
-      implementationSignals,
-      supportingSignals
-    };
   }
-  return result;
 }
-function buildAssessmentHints2(signals, complianceAreas, openQuestions) {
-  const possibleModes = [];
-  const riskIndicators = [];
-  const gpaiIndicators = [];
-  const aiDetected = hasAI(signals);
-  if (!aiDetected) {
-    return {
-      possibleModes: [],
-      riskIndicators: [],
-      gpaiIndicators: [],
-      openQuestions: openQuestions.map((question) => question.question)
-    };
+function parseTop(raw) {
+  if (raw === void 0) return 10;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1) {
+    return exitWithError(`Ung\xFCltiges --top: ${raw}. Erwartet eine ganze Zahl >= 1.`);
   }
-  const hasCloudProvider = signals.some((signal) => signal.category === "ai-provider");
-  const hasLocalInference = signals.some((signal) => signal.category === "local-inference");
-  if (hasCloudProvider) {
-    possibleModes.push("gpai-user");
-    const providers = Array.from(
-      new Set(
-        signals.filter((signal) => signal.category === "ai-provider").map((signal) => canonicalizeSignalName(signal))
-      )
-    );
-    gpaiIndicators.push({
-      hint: `GPAI model usage detected \u2014 cloud providers found: ${providers.join(", ")}. Provider obligations depend on your role and downstream distribution.`,
-      articleRef: "Art. 53",
-      confidence: "medium"
-    });
-  }
-  if (hasLocalInference) {
-    gpaiIndicators.push({
-      hint: "Local deployment detected \u2014 provider-side GPAI obligations are less likely unless you distribute or provide downstream access to the model.",
-      articleRef: "Art. 53",
-      confidence: "low"
-    });
-  }
-  if (complianceAreas.biasTesting.group.status !== "absent") {
-    riskIndicators.push({
-      hint: "Bias evaluation infrastructure detected \u2014 this can support Art. 10 evidence if it is part of your real evaluation workflow.",
-      articleRef: "Art. 10",
-      confidence: complianceAreas.biasTesting.group.confidence
-    });
-  }
-  if (signals.some((signal) => signal.category === "training")) {
-    riskIndicators.push({
-      hint: "Training or fine-tuning signals detected \u2014 data governance and provider obligations may apply depending on your role.",
-      articleRef: "Art. 10",
-      confidence: "high"
-    });
-    possibleModes.push("gpai-provider");
-  }
-  for (const [key, evaluation] of Object.entries(complianceAreas)) {
-    if (evaluation.implementationSignals.length > 0 || evaluation.supportingSignals.length === 0) {
-      continue;
-    }
-    riskIndicators.push({
-      hint: `Documentation references ${COMPLIANCE_AREA_LABELS[key]}, but no production implementation evidence was detected.`,
-      confidence: "low"
-    });
-  }
-  if (!possibleModes.includes("annex-iii-unclear")) {
-    possibleModes.push("annex-iii-unclear");
+  return value;
+}
+function parseAlpha(raw) {
+  if (raw === void 0) return 0.05;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value <= 0 || value >= 1) {
+    return exitWithError(`Ung\xFCltiges --alpha: ${raw}. Erwartet eine Zahl zwischen 0 und 1.`);
   }
-  return {
-    possibleModes,
-    riskIndicators,
-    gpaiIndicators,
-    openQuestions: openQuestions.map((question) => question.question)
-  };
+  return value;
 }
-var GAP_RULES = [
-  {
-    id: "gap-disclosure",
-    title: "No AI disclosure mechanism detected",
-    description: "The EU AI Act requires that users are informed when interacting with AI systems. No user-facing disclosure implementation was found in the production codebase.",
-    priority: "critical",
-    area: "disclosure"
-  },
-  {
-    id: "gap-logging",
-    title: "No logging or monitoring infrastructure detected",
-    description: "AI system outputs and decisions should be logged for traceability and audit purposes. No production logging infrastructure was detected.",
-    priority: "high",
-    area: "loggingMonitoring"
-  },
-  {
-    id: "gap-oversight",
-    title: "No human oversight mechanism detected",
-    description: "High-risk AI systems require human oversight capabilities. No production review or override mechanisms were found.",
-    priority: "high",
-    area: "humanOversight"
-  },
-  {
-    id: "gap-bias",
-    title: "No bias testing infrastructure detected",
-    description: "AI systems should be evaluated for bias and discrimination. No production-grade bias evaluation tooling was found.",
-    priority: "medium",
-    area: "biasTesting"
+var compare_default = defineCommand2({
+  meta: {
+    name: "compare",
+    description: "Compare two euconform.bias.v2 artifacts (baseline vs candidate): score/preference deltas, per-bias-type shifts, McNemar significance"
   },
-  {
-    id: "gap-data",
-    title: "No data governance mechanisms detected",
-    description: "Training and inference data should be governed with clear provenance and quality controls. No production data governance infrastructure was found.",
-    priority: "medium",
-    area: "dataGovernance"
+  args: {
+    baseline: {
+      type: "positional",
+      description: "Baseline artifact (euconform.bias.json) or the directory containing it",
+      required: true
+    },
+    candidate: {
+      type: "positional",
+      description: "Candidate artifact (euconform.bias.json) or the directory containing it",
+      required: true
+    },
+    output: {
+      type: "string",
+      description: "Output format: md, json, or all (all requires --out-dir)",
+      default: "md"
+    },
+    "out-dir": {
+      type: "string",
+      description: "Write euconform.bias-comparison.{md,json} into this directory instead of stdout"
+    },
+    top: {
+      type: "string",
+      description: "Number of per-pair changes to list (default 10)"
+    },
+    alpha: {
+      type: "string",
+      description: "Significance level for the McNemar test (default 0.05)"
+    },
+    "allow-incomparable": {
+      type: "boolean",
+      description: "Report deltas even when catalog/method/template differ. The result is then explicitly marked comparable: false."
+    }
   },
-  {
-    id: "gap-incident",
-    title: "No incident reporting mechanism detected",
-    description: "AI system incidents should be reportable and trackable. No production incident reporting infrastructure was found.",
-    priority: "medium",
-    area: "incidentReporting"
-  }
-];
-function buildGaps(complianceAreas, aiDetected) {
-  if (!aiDetected) return [];
-  const gaps = [];
-  for (const rule of GAP_RULES) {
-    const evaluation = complianceAreas[rule.area];
-    const confidence = highestConfidence(evaluation.implementationSignals);
-    if (evaluation.implementationSignals.length === 0) {
-      gaps.push({
-        id: rule.id,
-        title: rule.title,
-        description: rule.description,
-        priority: rule.priority,
-        status: "missing",
-        basis: "scanner-rule",
-        evidence: []
-      });
-      continue;
+  async run({ args }) {
+    const output = args.output;
+    if (!VALID_OUTPUTS2.has(output)) {
+      exitWithError(`Invalid output format: ${output}. Use one of: md, json, all.`);
     }
-    if (confidence !== "high") {
-      gaps.push({
-        id: rule.id,
-        title: `${rule.title.replace("No ", "Partial ")}`.replace(" detected", ""),
-        description: `Some implementation signals were found, but confidence is not yet high. ${rule.description}`,
-        priority: rule.priority === "critical" ? "high" : rule.priority === "high" ? "medium" : "low",
-        status: "partial",
-        basis: "scanner-rule",
-        evidence: collectEvidence(evaluation.implementationSignals)
-      });
+    const outDir = args["out-dir"];
+    if (output === "all" && outDir === void 0) {
+      exitWithError(
+        "--output all ben\xF6tigt --out-dir, sonst w\xFCrden zwei Formate auf stdout kollidieren."
+      );
     }
-  }
-  return gaps;
-}
-function buildRecommendationSummary(gaps, openQuestions, complianceAreas) {
-  const recommendations = [];
-  const priorityOrder = {
-    critical: 0,
-    high: 1,
-    medium: 2,
-    low: 3
-  };
-  const sortedGaps = [...gaps].sort(
-    (left, right) => priorityOrder[left.priority] - priorityOrder[right.priority]
-  );
-  for (const gap of sortedGaps.slice(0, 4)) {
-    const prefix = gap.status === "missing" ? "Implement" : "Strengthen";
-    recommendations.push(`[${gap.priority.toUpperCase()}] ${prefix}: ${gap.title}`);
-  }
-  if (recommendations.length < 4) {
-    for (const [key, evaluation] of Object.entries(complianceAreas)) {
-      if (evaluation.implementationSignals.length > 0 || evaluation.supportingSignals.length === 0) {
-        continue;
+    const baselinePath = await resolveArtifactPath(args.baseline);
+    const candidatePath = await resolveArtifactPath(args.candidate);
+    const baseline = await loadBiasReport(baselinePath);
+    const candidate = await loadBiasReport(candidatePath);
+    const comparison = compareBiasRuns(baseline, candidate, {
+      baselinePath,
+      candidatePath,
+      alpha: parseAlpha(args.alpha),
+      topChanges: parseTop(args.top)
+    });
+    if (!comparison.comparable) {
+      const message = [
+        "Die beiden L\xE4ufe sind nicht vergleichbar \u2014 sie beantworten nicht dieselbe Frage mit demselben Messaufbau:",
+        ...comparison.comparabilityIssues.map((issue) => `  - ${issue}`)
+      ].join("\n");
+      if (!args["allow-incomparable"]) {
+        exitWithError(
+          `${message}
+Mit --allow-incomparable wird der Vergleich trotzdem geschrieben (explizit als comparable: false markiert).`
+        );
       }
-      recommendations.push(
-        `[LOW] Convert documented ${COMPLIANCE_AREA_LABELS[key]} into production implementation evidence`
-      );
-      if (recommendations.length >= 4) break;
+      consola4.warn(message);
     }
-  }
-  if (openQuestions.length > 0) {
-    recommendations.push(
-      `Resolve ${openQuestions.length} open question(s) that require human context`
-    );
-  }
-  const finalRecommendation = "Review the generated artifacts and complete role/risk classification in the EuConform web app";
-  return [...recommendations.slice(0, 4), finalRecommendation];
-}
-function buildDetectedStack(signals) {
-  const stack = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const signal of signals) {
-    if (signal.category !== "framework" && signal.category !== "runtime" && signal.category !== "ai-framework") {
-      continue;
+    const markdown = formatBiasComparisonMarkdown(comparison);
+    const json = `${JSON.stringify(comparison, null, 2)}
+`;
+    if (outDir === void 0) {
+      process.stdout.write(output === "json" ? json : markdown);
+      return;
     }
-    const canonicalName = canonicalizeSignalName(signal);
-    const key = canonicalName.toLowerCase();
-    if (seen.has(key)) continue;
-    seen.add(key);
-    stack.push(canonicalName);
-  }
-  return stack;
-}
-function hasCapability(group) {
-  return group.status === "present" || group.status === "partial";
-}
-function resolveBomKind(signal, canonicalName) {
-  if (signal.category === "rag") {
-    return canonicalName.toLowerCase().includes("embedding") ? "embedding" : "vector-store";
-  }
-  return CATEGORY_TO_BOM_KIND[signal.category] ?? "tool";
-}
-function buildAiBom(scanResult, complianceAreas, generatedAt) {
-  const components = [];
-  const componentIndex = /* @__PURE__ */ new Map();
-  for (const signal of scanResult.signals) {
-    if (!BOM_CATEGORIES.has(signal.category)) continue;
-    if (signal.category === "rag" && signal.confidence === "low") continue;
-    const canonicalName = canonicalizeSignalName(signal);
-    const kind = resolveBomKind(signal, canonicalName);
-    const key = `${kind}:${canonicalName.toLowerCase()}`;
-    const source = deriveSource(signal.evidence);
-    const existingIndex = componentIndex.get(key);
-    if (existingIndex === void 0) {
-      componentIndex.set(key, components.length);
-      components.push({
-        id: makeBomComponentId(kind, canonicalName),
-        kind,
-        name: canonicalName,
-        source
-      });
-      continue;
+    const targetDir = resolve3(outDir);
+    await mkdir2(targetDir, { recursive: true });
+    if (output === "md" || output === "all") {
+      const path = join(targetDir, "euconform.bias-comparison.md");
+      await writeFile2(path, markdown);
+      consola4.success(`Written: ${path}`);
     }
-    const existing = components[existingIndex];
-    if (!existing) continue;
-    if (SOURCE_PRIORITY[source] > SOURCE_PRIORITY[existing.source]) {
-      existing.source = source;
+    if (output === "json" || output === "all") {
+      const path = join(targetDir, "euconform.bias-comparison.json");
+      await writeFile2(path, json);
+      consola4.success(`Written: ${path}`);
     }
   }
-  const reportingSignals = complianceAreas.reportingExports.implementationSignals;
-  return {
-    schemaVersion: "euconform.aibom.v1",
-    generatedAt,
-    project: {
-      name: scanResult.repo.name,
-      rootPath: scanResult.meta.targetPath
-    },
-    components: [...components].sort(
-      (left, right) => `${left.kind}:${left.name}`.localeCompare(`${right.kind}:${right.name}`)
-    ),
-    complianceCapabilities: {
-      biasEvaluation: hasCapability(complianceAreas.biasTesting.group),
-      jsonExport: reportingSignals.some((signal) => signal.id.includes("json")),
-      pdfExport: reportingSignals.some((signal) => signal.id.includes("pdf")),
-      loggingInfrastructure: hasCapability(complianceAreas.loggingMonitoring.group),
-      humanReviewFlow: hasCapability(complianceAreas.humanOversight.group),
-      incidentHandling: hasCapability(complianceAreas.incidentReporting.group)
-    }
-  };
-}
-function generateScanOutput(scanResult) {
-  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const aiDetected = hasAI(scanResult.signals);
-  const complianceAreas = evaluateComplianceAreas(scanResult.signals, aiDetected);
-  const report = {
-    schemaVersion: "euconform.report.v1",
-    generatedAt,
-    tool: {
-      name: "euconform",
-      version: scanResult.meta.toolVersion
-    },
-    target: {
-      rootPath: scanResult.meta.targetPath,
-      name: scanResult.repo.name,
-      repoType: scanResult.appTypes[0] ?? "unknown",
-      detectedStack: buildDetectedStack(scanResult.signals)
-    },
-    aiFootprint: buildAiFootprint(scanResult.signals),
-    complianceSignals: {
-      disclosure: complianceAreas.disclosure.group,
-      biasTesting: complianceAreas.biasTesting.group,
-      reportingExports: complianceAreas.reportingExports.group,
-      loggingMonitoring: complianceAreas.loggingMonitoring.group,
-      humanOversight: complianceAreas.humanOversight.group,
-      dataGovernance: complianceAreas.dataGovernance.group,
-      incidentReporting: complianceAreas.incidentReporting.group
-    },
-    assessmentHints: buildAssessmentHints2(
-      scanResult.signals,
-      complianceAreas,
-      scanResult.openQuestions
-    ),
-    gaps: buildGaps(complianceAreas, aiDetected),
-    recommendationSummary: []
-  };
-  report.recommendationSummary = buildRecommendationSummary(
-    report.gaps,
-    scanResult.openQuestions,
-    complianceAreas
-  );
-  const aibom = buildAiBom(scanResult, complianceAreas, generatedAt);
-  const summaryMarkdown = generateSummaryMarkdown(report, aibom, scanResult.meta.scanScope);
-  return { report, aibom, summaryMarkdown };
-}
+});
 
-// ../core/src/evidence/hash.ts
-import { createHash } from "crypto";
-function sha256Hex(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
+// src/commands/import.ts
+import { mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
+import { basename as basename2, join as join2, resolve as resolve4 } from "path";
+
+// ../core/src/sbom/cyclonedx-import.ts
+import { basename, extname } from "path";
+
+// ../core/src/sbom/known-packages.ts
+var KNOWN_AI_PACKAGES = {
+  // Models / model runtimes
+  "llama.cpp": "model",
+  "llama-cpp-python": "model",
+  "whisper.cpp": "model",
+  ggml: "model",
+  ctransformers: "model",
+  // AI Frameworks
+  transformers: "ai-framework",
+  torch: "ai-framework",
+  pytorch: "ai-framework",
+  tensorflow: "ai-framework",
+  "tensorflow-gpu": "ai-framework",
+  jax: "ai-framework",
+  keras: "ai-framework",
+  "pytorch-lightning": "ai-framework",
+  "scikit-learn": "ai-framework",
+  sklearn: "ai-framework",
+  xgboost: "ai-framework",
+  lightgbm: "ai-framework",
+  spacy: "ai-framework",
+  "huggingface-hub": "ai-framework",
+  diffusers: "ai-framework",
+  accelerate: "ai-framework",
+  peft: "ai-framework",
+  trl: "ai-framework",
+  onnxruntime: "ai-framework",
+  "onnxruntime-gpu": "ai-framework",
+  mlflow: "ai-framework",
+  // Embeddings
+  "sentence-transformers": "embedding",
+  fastembed: "embedding",
+  "openai-embeddings": "embedding",
+  "cohere-embed": "embedding",
+  // Inference Providers
+  openai: "inference-provider",
+  anthropic: "inference-provider",
+  ollama: "inference-provider",
+  vllm: "inference-provider",
+  "together-ai": "inference-provider",
+  replicate: "inference-provider",
+  groq: "inference-provider",
+  mistralai: "inference-provider",
+  cohere: "inference-provider",
+  "google-generativeai": "inference-provider",
+  ai21: "inference-provider",
+  // Vector Stores
+  pinecone: "vector-store",
+  "pinecone-client": "vector-store",
+  weaviate: "vector-store",
+  "weaviate-client": "vector-store",
+  qdrant: "vector-store",
+  "qdrant-client": "vector-store",
+  milvus: "vector-store",
+  pymilvus: "vector-store",
+  chromadb: "vector-store",
+  "chromadb-client": "vector-store",
+  pgvector: "vector-store",
+  faiss: "vector-store",
+  "faiss-cpu": "vector-store",
+  "faiss-gpu": "vector-store",
+  // Datasets
+  datasets: "dataset",
+  // Tools / Orchestration
+  langchain: "tool",
+  "langchain-core": "tool",
+  "langchain-community": "tool",
+  llamaindex: "tool",
+  "llama-index": "tool",
+  "semantic-kernel": "tool",
+  autogen: "tool",
+  crewai: "tool",
+  dspy: "tool",
+  "haystack-ai": "tool",
+  guidance: "tool",
+  guardrails: "tool",
+  "guardrails-ai": "tool",
+  lmql: "tool",
+  outlines: "tool",
+  // Scoped packages (npm)
+  "@langchain/core": "tool",
+  "@langchain/openai": "tool",
+  "@langchain/community": "tool",
+  "@langchain/anthropic": "tool",
+  "@huggingface/transformers": "ai-framework",
+  "@huggingface/inference": "inference-provider",
+  "@google/generative-ai": "inference-provider",
+  "@anthropic-ai/sdk": "inference-provider",
+  "@pinecone-database/pinecone": "vector-store",
+  "@qdrant/js-client-rest": "vector-store"
+};
+var KNOWN_AI_SCOPES = {
+  "@langchain": "tool",
+  "@huggingface": "ai-framework",
+  "@tensorflow": "ai-framework",
+  "@anthropic-ai": "inference-provider",
+  "@pinecone-database": "vector-store",
+  "@qdrant": "vector-store"
+};
+function lookupKnownPackage(name) {
+  const lower = name.toLowerCase();
+  const exact = KNOWN_AI_PACKAGES[lower];
+  if (exact) return exact;
+  if (lower.startsWith("@") && lower.includes("/")) {
+    const scopeEnd = lower.indexOf("/");
+    const scope = lower.slice(0, scopeEnd);
+    const bareName = lower.slice(scopeEnd + 1);
+    const scopeKind = KNOWN_AI_SCOPES[scope];
+    if (scopeKind) return scopeKind;
+    const bareKind = KNOWN_AI_PACKAGES[bareName];
+    if (bareKind) return bareKind;
+  }
+  return null;
 }
 
-// ../core/src/evidence/bundle.ts
-function extractSchemaVersion(content) {
+// ../core/src/sbom/purl.ts
+function parsePurl(purl) {
+  if (!purl || !purl.startsWith("pkg:")) return null;
+  let rest = purl.slice(4);
+  const hashIdx = rest.indexOf("#");
+  if (hashIdx !== -1) rest = rest.slice(0, hashIdx);
+  const queryIdx = rest.indexOf("?");
+  if (queryIdx !== -1) rest = rest.slice(0, queryIdx);
+  const slashIdx = rest.indexOf("/");
+  if (slashIdx <= 0) return null;
+  const type = rest.slice(0, slashIdx);
+  let remainder = rest.slice(slashIdx + 1);
   try {
-    const parsed = JSON.parse(content);
-    return typeof parsed.schemaVersion === "string" ? parsed.schemaVersion : void 0;
+    remainder = decodeURIComponent(remainder);
   } catch {
-    return void 0;
+    return null;
   }
-}
-function makeArtifactRef(role, input, required) {
-  const isJson = input.fileName.endsWith(".json");
-  const ref = {
-    role,
-    fileName: input.fileName,
-    sha256: sha256Hex(input.content),
-    required
-  };
-  if (isJson) {
-    const sv = extractSchemaVersion(input.content);
-    if (sv) ref.schemaVersion = sv;
+  let version;
+  const atIdx = remainder.lastIndexOf("@");
+  if (atIdx !== -1) {
+    version = remainder.slice(atIdx + 1);
+    remainder = remainder.slice(0, atIdx);
+  }
+  const lastSlash = remainder.lastIndexOf("/");
+  let namespace;
+  let name;
+  if (lastSlash !== -1) {
+    namespace = remainder.slice(0, lastSlash);
+    name = remainder.slice(lastSlash + 1);
   } else {
-    ref.mimeType = "text/markdown";
+    name = remainder;
   }
-  return ref;
-}
-function buildBundleManifest(opts) {
-  const artifacts = [makeArtifactRef("report", opts.report, true)];
-  if (opts.aibom) artifacts.push(makeArtifactRef("aibom", opts.aibom, false));
-  if (opts.ci) artifacts.push(makeArtifactRef("ci", opts.ci, false));
-  if (opts.summary) artifacts.push(makeArtifactRef("summary", opts.summary, false));
+  if (!name) return null;
   return {
-    schemaVersion: "euconform.bundle.v1",
-    generatedAt: opts.generatedAt,
-    tool: opts.tool,
-    target: opts.target,
-    artifacts
+    scheme: "pkg",
+    type,
+    namespace: namespace || void 0,
+    name,
+    version: version || void 0
   };
 }
 
-// ../core/src/evidence/validate.ts
-function assertObject(data, label) {
-  if (!data || typeof data !== "object" || Array.isArray(data)) {
-    throw new Error(`Invalid ${label}: expected a JSON object`);
-  }
-  return data;
+// ../core/src/sbom/component-mapper.ts
+var CYCLONEDX_TYPE_MAP = {
+  "machine-learning-model": { kind: "model", confidence: "high" },
+  data: { kind: "dataset", confidence: "medium" },
+  platform: { kind: "inference-provider", confidence: "medium" },
+  service: { kind: "inference-provider", confidence: "medium" }
+};
+function lookupViaPurl(parsed) {
+  if (!parsed) return null;
+  if (parsed.namespace) {
+    const scopedName = `${parsed.namespace}/${parsed.name}`;
+    const scopedKind = lookupKnownPackage(scopedName);
+    if (scopedKind) return { kind: scopedKind, confidence: "high" };
+  }
+  const purlKind = lookupKnownPackage(parsed.name);
+  if (purlKind) return { kind: purlKind, confidence: "medium" };
+  return null;
 }
-function requireSchemaVersion(obj, expected, label) {
-  if (obj.schemaVersion !== expected) {
-    throw new Error(
-      `Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`
-    );
+function mapComponent(component) {
+  if (!component.name || component.name.trim() === "") {
+    return null;
   }
-}
-function requireField(obj, key, type, label, fieldName = key) {
-  if (!(key in obj)) {
-    throw new Error(`Invalid ${label}: missing '${fieldName}'`);
+  const parsed = component.purl ? parsePurl(component.purl) : null;
+  const purlVersion = parsed?.version;
+  if (component.modelCard != null) {
+    return { kind: "model", source: "sbom-import", confidence: "high", purlVersion };
   }
-  const value = obj[key];
-  const isValid = type === "array" && Array.isArray(value) || type === "object" && value && typeof value === "object" && !Array.isArray(value) || type === "string" && typeof value === "string" || type === "boolean" && typeof value === "boolean" || type === "number" && typeof value === "number";
-  if (!isValid) {
-    throw new Error(`Invalid ${label}: '${fieldName}' must be a ${type}`);
+  if (Array.isArray(component.data) && component.data.some((d) => d.type === "dataset")) {
+    return { kind: "dataset", source: "sbom-import", confidence: "high", purlVersion };
   }
-  return value;
-}
-function requireStringArray(obj, key, label, fieldName = key) {
-  const value = requireField(obj, key, "array", label, fieldName);
-  if (!value.every((item) => typeof item === "string")) {
-    throw new Error(`Invalid ${label}: '${fieldName}' must contain strings`);
+  const typeMapping = CYCLONEDX_TYPE_MAP[component.type];
+  if (typeMapping) {
+    return {
+      kind: typeMapping.kind,
+      source: "sbom-import",
+      confidence: typeMapping.confidence,
+      purlVersion
+    };
   }
-  return value;
-}
-function majorVersion(schemaVersion) {
-  const match = /\.v(\d+)$/.exec(schemaVersion);
-  return match?.[1] ?? null;
-}
-function getSchemaMajorVersion(schemaVersion) {
-  return majorVersion(schemaVersion);
-}
-function validateScanReport(data) {
-  const obj = assertObject(data, "report");
-  requireSchemaVersion(obj, "euconform.report.v1", "report");
-  requireField(obj, "generatedAt", "string", "report");
-  const tool = requireField(obj, "tool", "object", "report");
-  requireField(tool, "name", "string", "report", "tool.name");
-  requireField(tool, "version", "string", "report", "tool.version");
-  const target = requireField(obj, "target", "object", "report");
-  requireField(target, "rootPath", "string", "report", "target.rootPath");
-  requireField(target, "name", "string", "report", "target.name");
-  requireField(target, "repoType", "string", "report", "target.repoType");
-  requireField(target, "detectedStack", "array", "report", "target.detectedStack");
-  const aiFootprint = requireField(obj, "aiFootprint", "object", "report");
-  requireField(aiFootprint, "usesAI", "boolean", "report", "aiFootprint.usesAI");
-  requireStringArray(aiFootprint, "inferenceModes", "report", "aiFootprint.inferenceModes");
-  requireStringArray(aiFootprint, "providerHints", "report", "aiFootprint.providerHints");
-  requireStringArray(aiFootprint, "ragHints", "report", "aiFootprint.ragHints");
-  requireField(obj, "complianceSignals", "object", "report");
-  const hints = requireField(obj, "assessmentHints", "object", "report");
-  requireStringArray(hints, "possibleModes", "report", "assessmentHints.possibleModes");
-  requireField(hints, "riskIndicators", "array", "report", "assessmentHints.riskIndicators");
-  requireField(hints, "gpaiIndicators", "array", "report", "assessmentHints.gpaiIndicators");
-  requireStringArray(hints, "openQuestions", "report", "assessmentHints.openQuestions");
-  requireField(obj, "gaps", "array", "report");
-  requireStringArray(obj, "recommendationSummary", "report");
-  return data;
-}
-function validateAiBillOfMaterials(data) {
-  const obj = assertObject(data, "AIBOM");
-  requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
-  requireField(obj, "generatedAt", "string", "AIBOM");
-  const project = requireField(obj, "project", "object", "AIBOM");
-  requireField(project, "name", "string", "AIBOM", "project.name");
-  requireField(project, "rootPath", "string", "AIBOM", "project.rootPath");
-  requireField(obj, "components", "array", "AIBOM");
-  requireField(obj, "complianceCapabilities", "object", "AIBOM");
-  return data;
-}
-function validateCiReport(data) {
-  const obj = assertObject(data, "CI report");
-  requireSchemaVersion(obj, "euconform.ci.v1", "CI report");
-  requireField(obj, "generatedAt", "string", "CI report");
-  const target = requireField(obj, "target", "object", "CI report");
-  requireField(target, "name", "string", "CI report", "target.name");
-  requireField(target, "rootPath", "string", "CI report", "target.rootPath");
-  const status = requireField(obj, "status", "object", "CI report");
-  requireField(status, "failOn", "string", "CI report", "status.failOn");
-  requireField(status, "failing", "boolean", "CI report", "status.failing");
-  requireField(status, "openQuestions", "number", "CI report", "status.openQuestions");
-  const gapCounts = requireField(
-    status,
-    "gapCounts",
-    "object",
-    "CI report",
-    "status.gapCounts"
-  );
-  for (const key of ["critical", "high", "medium", "low"]) {
-    requireField(gapCounts, key, "number", "CI report", `status.gapCounts.${key}`);
-  }
-  requireField(obj, "aiDetected", "boolean", "CI report");
-  requireField(obj, "scanScope", "string", "CI report");
-  requireField(obj, "artifacts", "array", "CI report");
-  requireField(obj, "complianceOverview", "array", "CI report");
-  requireField(obj, "topGaps", "array", "CI report");
-  return data;
-}
-var VALID_BUNDLE_ROLES = /* @__PURE__ */ new Set(["report", "aibom", "ci", "summary"]);
-var SHA256_HEX = /^[a-f0-9]{64}$/;
-function readBundleArtifactFields(raw, index) {
-  const scope = "bundle artifact";
-  const role = requireField(raw, "role", "string", scope, `artifacts[${index}].role`);
-  const fileName = requireField(
-    raw,
-    "fileName",
-    "string",
-    scope,
-    `artifacts[${index}].fileName`
-  );
-  const sha256 = requireField(
-    raw,
-    "sha256",
-    "string",
-    scope,
-    `artifacts[${index}].sha256`
-  );
-  const required = requireField(
-    raw,
-    "required",
-    "boolean",
-    scope,
-    `artifacts[${index}].required`
-  );
-  const declaredSchemaVersion = raw.schemaVersion;
-  if (declaredSchemaVersion !== void 0 && typeof declaredSchemaVersion !== "string") {
-    throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
+  const knownKind = lookupKnownPackage(component.name);
+  if (knownKind) {
+    return { kind: knownKind, source: "sbom-import", confidence: "high", purlVersion };
   }
-  if (raw.mimeType !== void 0 && typeof raw.mimeType !== "string") {
-    throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
+  const purlMatch = lookupViaPurl(parsed);
+  if (purlMatch) {
+    return {
+      kind: purlMatch.kind,
+      source: "sbom-import",
+      confidence: purlMatch.confidence,
+      purlVersion
+    };
+  }
+  return null;
+}
+
+// ../core/src/sbom/types.ts
+var SUPPORTED_SPEC_VERSIONS = ["1.4", "1.5", "1.6"];
+
+// ../core/src/sbom/cyclonedx-import.ts
+function importCycloneDx(sbom, options) {
+  const bom = parseBom(sbom);
+  const scope = options?.scope ?? "all";
+  const allComponents = bom.components ?? [];
+  const warnings = [];
+  const totalComponents = allComponents.length;
+  const inScope = scope === "production" ? allComponents.filter((c) => c.scope !== "optional" && c.scope !== "excluded") : allComponents;
+  const filteredByScope = totalComponents - inScope.length;
+  const mapped = [];
+  for (const comp of inScope) {
+    const mapping = mapComponent(comp);
+    if (!mapping) {
+      if (!comp.name || comp.name.trim() === "") {
+        warnings.push({ component: "(empty)", message: "Skipped: missing or empty name" });
+      }
+      continue;
+    }
+    const version = comp.version || mapping.purlVersion;
+    if (!version) {
+      warnings.push({ component: comp.name, message: "Missing version field" });
+    }
+    mapped.push({
+      id: version ? `${mapping.kind}:${comp.name}:${version}` : `${mapping.kind}:${comp.name}`,
+      kind: mapping.kind,
+      name: comp.name,
+      ...version ? { version } : {},
+      source: "sbom-import"
+    });
   }
+  const seen = /* @__PURE__ */ new Set();
+  let duplicatesRemoved = 0;
+  const deduped = [];
+  for (const comp of mapped) {
+    if (seen.has(comp.id)) {
+      duplicatesRemoved++;
+      continue;
+    }
+    seen.add(comp.id);
+    deduped.push(comp);
+  }
+  const byKind = {};
+  for (const comp of deduped) {
+    byKind[comp.kind] = (byKind[comp.kind] ?? 0) + 1;
+  }
+  const { projectName, projectNameSource } = resolveProjectName(bom, options?.sourcePath);
+  const importTool = extractToolString(bom);
+  const originalTimestamp = bom.metadata?.timestamp;
+  const aibom = {
+    schemaVersion: "euconform.aibom.v1.1",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    project: { name: projectName, rootPath: "." },
+    components: deduped,
+    complianceCapabilities: {
+      biasEvaluation: false,
+      jsonExport: false,
+      pdfExport: false,
+      loggingInfrastructure: false,
+      humanReviewFlow: false,
+      incidentHandling: false
+    },
+    metadata: buildMetadata(importTool, originalTimestamp)
+  };
+  const validation = validate(aibom);
   return {
-    role,
-    fileName,
-    sha256,
-    required,
-    declaredSchemaVersion,
-    mimeType: raw.mimeType
+    aibom,
+    summary: {
+      totalComponents,
+      filteredByScope,
+      aiRelevant: deduped.length,
+      skipped: inScope.length - mapped.length,
+      duplicatesRemoved,
+      byKind,
+      warnings,
+      source: buildSourceInfo(bom.specVersion, projectNameSource, importTool, originalTimestamp)
+    },
+    validation
   };
 }
-function assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor) {
-  const { role, fileName, sha256, declaredSchemaVersion } = fields;
-  if (!VALID_BUNDLE_ROLES.has(role)) {
-    throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
+function resolveProjectName(bom, sourcePath) {
+  const metaName = bom.metadata?.component?.name;
+  if (metaName) {
+    return { projectName: metaName, projectNameSource: "metadata.component.name" };
   }
-  if (!SHA256_HEX.test(sha256)) {
-    throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
+  if (sourcePath) {
+    const name = basename(sourcePath, extname(sourcePath));
+    return { projectName: name, projectNameSource: "sourcePath" };
   }
-  if (seenRoles.has(role)) {
-    throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
+  return { projectName: "sbom-import", projectNameSource: "fallback" };
+}
+function extractToolString(bom) {
+  const tool = bom.metadata?.tools?.[0];
+  if (!tool?.name) return void 0;
+  return tool.version ? `${tool.name} ${tool.version}` : tool.name;
+}
+function buildMetadata(importTool, originalTimestamp) {
+  const meta = { importSource: "cyclonedx" };
+  if (importTool) meta.importTool = importTool;
+  if (originalTimestamp) meta.originalTimestamp = originalTimestamp;
+  return meta;
+}
+function buildSourceInfo(specVersion, projectNameSource, importTool, originalTimestamp) {
+  const info = { bomFormat: "CycloneDX", specVersion, projectNameSource };
+  if (importTool) info.importTool = importTool;
+  if (originalTimestamp) info.originalTimestamp = originalTimestamp;
+  return info;
+}
+function parseBom(sbom) {
+  if (typeof sbom !== "object" || sbom === null) {
+    throw new Error("Input must be a JSON object");
   }
-  if (seenFiles.has(fileName)) {
-    throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
+  const record = sbom;
+  if (record.bomFormat !== "CycloneDX") {
+    throw new Error(`Invalid bomFormat: expected "CycloneDX", got "${String(record.bomFormat)}"`);
   }
-  if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
+  const specVersion = String(record.specVersion ?? "");
+  if (!SUPPORTED_SPEC_VERSIONS.includes(specVersion)) {
     throw new Error(
-      `Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`
+      `Unsupported specVersion "${specVersion}". Supported: ${SUPPORTED_SPEC_VERSIONS.join(", ")}`
     );
   }
+  return sbom;
 }
-function validateBundleHeader(obj) {
-  requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
-  requireField(obj, "generatedAt", "string", "bundle");
-  const tool = requireField(obj, "tool", "object", "bundle");
-  requireField(tool, "name", "string", "bundle", "tool.name");
-  requireField(tool, "version", "string", "bundle", "tool.version");
-  const target = requireField(obj, "target", "object", "bundle");
-  requireField(target, "name", "string", "bundle", "target.name");
-  requireField(target, "rootPath", "string", "bundle", "target.rootPath");
-}
-function validateScanBundle(data) {
-  const obj = assertObject(data, "bundle");
-  validateBundleHeader(obj);
-  const artifacts = requireField(obj, "artifacts", "array", "bundle");
-  if (artifacts.length === 0) {
-    throw new Error("Invalid bundle: 'artifacts' must contain at least one artifact");
-  }
-  const seenRoles = /* @__PURE__ */ new Set();
-  const seenFiles = /* @__PURE__ */ new Set();
-  const bundleMajor = majorVersion("euconform.bundle.v1");
-  let hasRequiredReport = false;
-  for (let index = 0; index < artifacts.length; index++) {
-    const raw = assertObject(artifacts[index], "bundle artifact");
-    const fields = readBundleArtifactFields(raw, index);
-    assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor);
-    seenRoles.add(fields.role);
-    seenFiles.add(fields.fileName);
-    if (fields.role === "report") {
-      hasRequiredReport = fields.required;
+
+// src/commands/import.ts
+import { defineCommand as defineCommand3 } from "citty";
+import consola5 from "consola";
+var import_default = defineCommand3({
+  meta: {
+    name: "import",
+    description: "Import a CycloneDX SBOM and extract AI-relevant components into an EuConform AI BOM"
+  },
+  args: {
+    path: {
+      type: "positional",
+      required: true,
+      description: "Path to a CycloneDX JSON SBOM file"
+    },
+    scope: {
+      type: "string",
+      default: "all",
+      description: 'Component scope filter: "all" includes everything, "production" excludes optional and excluded-scope components'
+    },
+    json: {
+      type: "boolean",
+      default: false,
+      description: "Output results as JSON to stdout"
+    },
+    output: {
+      type: "string",
+      alias: "o",
+      default: ".euconform",
+      description: "Output directory for the generated aibom file"
+    }
+  },
+  async run({ args }) {
+    const inputPath = resolve4(args.path);
+    const outputDir = resolve4(args.output);
+    const scope = args.scope === "production" ? "production" : "all";
+    let data;
+    try {
+      const content = await readFile2(inputPath, "utf-8");
+      data = JSON.parse(content);
+    } catch {
+      consola5.error(`Failed to read or parse file: ${inputPath}`);
+      process.exit(2);
+    }
+    let result;
+    try {
+      result = importCycloneDx(data, { scope, sourcePath: inputPath });
+    } catch (error) {
+      consola5.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
+    if (args.json) {
+      process.stdout.write(
+        `${JSON.stringify(
+          {
+            aibom: result.aibom,
+            summary: result.summary,
+            validation: { valid: result.validation.valid, errors: result.validation.errors }
+          },
+          null,
+          2
+        )}
+`
+      );
+      return;
+    }
+    const fileName = basename2(inputPath);
+    const src = result.summary.source;
+    const sourceLabel = src.importTool ? `${fileName} (CycloneDX ${src.specVersion}, ${src.importTool})` : `${fileName} (CycloneDX ${src.specVersion})`;
+    consola5.log("");
+    consola5.log("CycloneDX Import");
+    consola5.log("\u2500".repeat(40));
+    consola5.log(`Source:      ${sourceLabel}`);
+    consola5.log(`Project:     ${result.aibom.project.name}`);
+    let componentsLine = `Components:  ${result.summary.totalComponents} total \u2192 ${result.summary.aiRelevant} AI-relevant, ${result.summary.skipped} skipped`;
+    if (result.summary.filteredByScope > 0) {
+      componentsLine += `, ${result.summary.filteredByScope} scope-filtered`;
+    }
+    if (result.summary.duplicatesRemoved > 0) {
+      componentsLine += `, ${result.summary.duplicatesRemoved} duplicates removed`;
+    }
+    consola5.log(componentsLine);
+    consola5.log("");
+    for (const [kind, count] of Object.entries(result.summary.byKind).sort((a, b) => b[1] - a[1])) {
+      const names = result.aibom.components.filter((c) => c.kind === kind).map((c) => c.name).join(", ");
+      consola5.log(`  ${kind.padEnd(20)} ${String(count).padStart(2)}  (${names})`);
+    }
+    if (result.summary.warnings.length > 0) {
+      consola5.log("");
+      for (const w of result.summary.warnings) {
+        consola5.warn(`${w.component}: ${w.message}`);
+      }
+    }
+    await mkdir3(outputDir, { recursive: true });
+    const aibomPath = join2(outputDir, "euconform.aibom.json");
+    await writeFile3(aibomPath, JSON.stringify(result.aibom, null, 2), "utf-8");
+    consola5.log("");
+    consola5.success(`${aibomPath} ${result.validation.valid ? "(valid)" : "(validation errors!)"}`);
+    if (!result.validation.valid) {
+      for (const err of result.validation.errors) {
+        consola5.error(`  ${err.path || "/"} \u2014 ${err.message}`);
+      }
+      process.exit(1);
     }
   }
-  if (!hasRequiredReport) {
-    throw new Error("Invalid bundle: a required 'report' artifact is mandatory");
-  }
-  return data;
-}
+});
+
+// src/commands/scan.ts
+import { stat as stat4 } from "fs/promises";
+import { resolve as resolve6 } from "path";
 
 // ../core/src/scanner/aggregator.ts
-import { basename as basename3 } from "path";
+import { basename as basename5 } from "path";
 
 // ../core/src/scanner/detectors/shared.ts
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
@@ -1665,7 +1834,7 @@ var FRAMEWORK_IMPORTS = [
   {
     id: "ai-framework-transformers",
     name: "Transformers.js",
-    importPattern: /(?:from\s+['"]@xenova\/transformers['"]|require\s*\(\s*['"]@xenova\/transformers['"])/
+    importPattern: /(?:from\s+['"](?:@xenova|@huggingface)\/transformers['"]|require\s*\(\s*['"](?:@xenova|@huggingface)\/transformers['"])/
   },
   {
     id: "ai-framework-vercel-ai",
@@ -2130,16 +2299,16 @@ var dockerfileRules = [
   }
 ];
 function isEnvExample(relativePath) {
-  const basename4 = relativePath.split("/").pop() ?? "";
-  return /^\.env\.(?:example|sample)$/.test(basename4);
+  const basename7 = relativePath.split("/").pop() ?? "";
+  return /^\.env\.(?:example|sample)$/.test(basename7);
 }
 function isDockerCompose(relativePath) {
-  const basename4 = relativePath.split("/").pop() ?? "";
-  return /^docker-compose/.test(basename4);
+  const basename7 = relativePath.split("/").pop() ?? "";
+  return /^docker-compose/.test(basename7);
 }
 function isDockerfile(relativePath) {
-  const basename4 = relativePath.split("/").pop() ?? "";
-  return /^Dockerfile/.test(basename4);
+  const basename7 = relativePath.split("/").pop() ?? "";
+  return /^Dockerfile/.test(basename7);
 }
 function detectConfig(ctx) {
   const { file } = ctx;
@@ -2320,8 +2489,8 @@ var rules2 = [
 var CONFIG_NAME_PATTERN = /^(next|vite)\.config\./;
 function shouldProcess(file) {
   if (EXTENDED_EXTENSIONS.has(file.extension)) return true;
-  const basename4 = file.relativePath.split("/").pop() ?? "";
-  return CONFIG_NAME_PATTERN.test(basename4);
+  const basename7 = file.relativePath.split("/").pop() ?? "";
+  return CONFIG_NAME_PATTERN.test(basename7);
 }
 function findImportEvidence(lines, pattern, filePath) {
   const evidence = [];
@@ -2338,11 +2507,11 @@ function findImportEvidence(lines, pattern, filePath) {
 function detectFrameworks(ctx) {
   const { file } = ctx;
   if (!shouldProcess(file)) return [];
-  const basename4 = file.relativePath.split("/").pop() ?? "";
+  const basename7 = file.relativePath.split("/").pop() ?? "";
   const seen = /* @__PURE__ */ new Set();
   const signals = [];
   for (const rule of rules2) {
-    if (rule.configPattern?.test(basename4) && !seen.has(rule.name)) {
+    if (rule.configPattern?.test(basename7) && !seen.has(rule.name)) {
       seen.add(rule.name);
       signals.push({
         id: `${rule.category}-${rule.name}`,
@@ -2350,7 +2519,7 @@ function detectFrameworks(ctx) {
         category: rule.category,
         confidence: rule.configConfidence,
         evidence: [
-          { file: file.relativePath, line: 1, snippet: `Config file detected: ${basename4}` }
+          { file: file.relativePath, line: 1, snippet: `Config file detected: ${basename7}` }
         ]
       });
     }
@@ -2391,7 +2560,7 @@ var RULES = [
   {
     id: "local-inference-transformers-browser",
     name: "Transformers.js (browser inference)",
-    pattern: /(?:from\s+['"]@xenova\/transformers['"]|\.pipeline\s*\(|env\.allowLocalModels)/,
+    pattern: /(?:from\s+['"](?:@xenova|@huggingface)\/transformers['"]|\.pipeline\s*\(|env\.allowLocalModels)/,
     confidence: "medium",
     extensions: [".ts", ".tsx", ".js", ".jsx"]
   },
@@ -2523,12 +2692,12 @@ var SKIP_BASENAMES = /* @__PURE__ */ new Set([
 ]);
 function isRelevantMarkdown(relativePath) {
   const lower = relativePath.toLowerCase();
-  const basename4 = lower.split("/").pop() ?? "";
-  if (basename4.startsWith("readme")) return true;
+  const basename7 = lower.split("/").pop() ?? "";
+  if (basename7.startsWith("readme")) return true;
   if (lower.includes("/docs/") || lower.startsWith("docs/")) {
-    return !SKIP_BASENAMES.has(basename4);
+    return !SKIP_BASENAMES.has(basename7);
   }
-  if (SKIP_BASENAMES.has(basename4)) return false;
+  if (SKIP_BASENAMES.has(basename7)) return false;
   return true;
 }
 function gatherMarkdownEvidence(rule, lines, filePath) {
@@ -2544,8 +2713,8 @@ function gatherMarkdownEvidence(rule, lines, filePath) {
   }
   return evidence;
 }
-function isSkippableGenericContent(basename4, evidence) {
-  if (!SKIP_BASENAMES.has(basename4)) return false;
+function isSkippableGenericContent(basename7, evidence) {
+  if (!SKIP_BASENAMES.has(basename7)) return false;
   return !evidence.some((e) => /\bAI\b|\bML\b|\bmodel\b|\binference\b/i.test(e.snippet));
 }
 function detectMarkdown(ctx) {
@@ -2553,11 +2722,11 @@ function detectMarkdown(ctx) {
   if (file.extension !== ".md") return [];
   if (!isRelevantMarkdown(file.relativePath)) return [];
   const signalMap = /* @__PURE__ */ new Map();
-  const basename4 = file.relativePath.toLowerCase().split("/").pop() ?? "";
+  const basename7 = file.relativePath.toLowerCase().split("/").pop() ?? "";
   for (const rule of rules3) {
     const evidence = gatherMarkdownEvidence(rule, ctx.lines, file.relativePath);
     if (evidence.length === 0) continue;
-    if (isSkippableGenericContent(basename4, evidence)) continue;
+    if (isSkippableGenericContent(basename7, evidence)) continue;
     const existing = signalMap.get(rule.id);
     if (existing) {
       existing.evidence.push(...evidence);
@@ -2575,7 +2744,7 @@ function detectMarkdown(ctx) {
 }
 
 // ../core/src/scanner/detectors/package-json-detector.ts
-import { basename } from "path";
+import { basename as basename3 } from "path";
 var AI_PACKAGES = {
   // Providers
   openai: { category: "ai-provider", label: "OpenAI SDK" },
@@ -2588,6 +2757,7 @@ var AI_PACKAGES = {
   "@langchain/core": { category: "ai-framework", label: "LangChain Core" },
   llamaindex: { category: "ai-framework", label: "LlamaIndex" },
   "@xenova/transformers": { category: "ai-framework", label: "Transformers.js" },
+  "@huggingface/transformers": { category: "ai-framework", label: "Transformers.js" },
   ai: { category: "ai-framework", label: "Vercel AI SDK" },
   "@huggingface/inference": { category: "ai-framework", label: "HuggingFace Inference" },
   // Local inference
@@ -2622,12 +2792,12 @@ var PACKAGE_JSON_NAMES = /* @__PURE__ */ new Set([
   "yarn.lock"
 ]);
 function isPackageJsonFile(relativePath) {
-  return PACKAGE_JSON_NAMES.has(basename(relativePath));
+  return PACKAGE_JSON_NAMES.has(basename3(relativePath));
 }
 function detectPackageJsonSignals(ctx) {
   const { file } = ctx;
   if (!isPackageJsonFile(file.relativePath)) return [];
-  const fileName = basename(file.relativePath);
+  const fileName = basename3(file.relativePath);
   if (fileName === "package.json") {
     return detectFromPackageJson(file.relativePath, file.content);
   }
@@ -2868,8 +3038,8 @@ function runAllDetectors(ctx) {
 
 // ../core/src/scanner/discovery.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { readFile, readdir, stat as stat2 } from "fs/promises";
-import { basename as basename2, extname, join, resolve as resolve2 } from "path";
+import { readFile as readFile3, readdir, stat as stat3 } from "fs/promises";
+import { basename as basename4, extname as extname2, join as join3, resolve as resolve5 } from "path";
 var DEFAULT_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".json", ".md", ".yaml", ".yml"];
 var NAMED_FILE_PATTERNS = [
   /^package\.json$/,
@@ -2965,7 +3135,7 @@ function classifyFileProvenance(relativePath) {
   const segments = rawSegments.map((segment) => segment.toLowerCase());
   const rawFileName = rawSegments[rawSegments.length - 1] ?? "";
   const fileName = segments[segments.length - 1] ?? "";
-  const ext = extname(fileName);
+  const ext = extname2(fileName);
   const isRootFile = segments.length === 1;
   if (segments.some((segment) => FIXTURE_SEGMENTS.has(segment))) return "fixture";
   if (segments.some((segment) => TEST_SEGMENTS.has(segment)) || TEST_FILE_PATTERN.test(fileName)) {
@@ -2986,7 +3156,7 @@ function classifyFileProvenance(relativePath) {
 async function loadGitignore(targetPath) {
   const ig = (0, import_ignore.default)();
   try {
-    const content = await readFile(join(targetPath, ".gitignore"), "utf-8");
+    const content = await readFile3(join3(targetPath, ".gitignore"), "utf-8");
     ig.add(content);
   } catch {
   }
@@ -2994,9 +3164,9 @@ async function loadGitignore(targetPath) {
   return ig;
 }
 function shouldProcessEntry(entry, targetPath, filterOpts) {
-  const absolutePath = join(targetPath, entry);
-  const fileName = basename2(entry);
-  const ext = extname(fileName).toLowerCase();
+  const absolutePath = join3(targetPath, entry);
+  const fileName = basename4(entry);
+  const ext = extname2(fileName).toLowerCase();
   const provenance = classifyFileProvenance(entry);
   if (filterOpts.scope === "production" && PRODUCTION_SKIP_PROVENANCE.has(provenance)) {
     return "skip";
@@ -3006,10 +3176,10 @@ function shouldProcessEntry(entry, targetPath, filterOpts) {
 }
 async function tryReadFile(absolutePath, entry, ext, provenance, maxSize) {
   try {
-    const fileStat = await stat2(absolutePath);
+    const fileStat = await stat3(absolutePath);
     if (!fileStat.isFile() || fileStat.size === 0) return "ignore";
     if (fileStat.size > maxSize) return "skip";
-    const content = await readFile(absolutePath, "utf-8");
+    const content = await readFile3(absolutePath, "utf-8");
     return {
       relativePath: entry,
       absolutePath,
@@ -3024,7 +3194,7 @@ async function tryReadFile(absolutePath, entry, ext, provenance, maxSize) {
 }
 function resolveOptions(options) {
   return {
-    targetPath: resolve2(options.targetPath),
+    targetPath: resolve5(options.targetPath),
     scope: options.scope ?? DEFAULT_SCOPE,
     extensions: options.extensions ?? DEFAULT_EXTENSIONS,
     maxSize: options.maxFileSizeBytes ?? DEFAULT_MAX_FILE_SIZE,
@@ -3104,7 +3274,7 @@ function buildRepoProfile(targetPath, pkg, files) {
     pkg?.workspaces || files.some((f) => f.relativePath === "pnpm-workspace.yaml")
   );
   return {
-    name: pkg?.name ?? basename3(targetPath),
+    name: pkg?.name ?? basename5(targetPath),
     version: pkg?.version,
     description: pkg?.description,
     license: pkg?.license,
@@ -3164,10 +3334,10 @@ function annotateEvidenceProvenance(signals, files) {
 }
 function generateOpenQuestions(signals) {
   const questions = [];
-  const hasAI2 = signals.some(
+  const hasAI = signals.some(
     (s) => s.category === "ai-provider" || s.category === "ai-framework" || s.category === "local-inference"
   );
-  if (hasAI2) {
+  if (hasAI) {
     questions.push({
       id: "oq-market-placement",
       question: "Is this AI system placed on the EU market or used within the EU?",
@@ -3203,7 +3373,7 @@ function generateOpenQuestions(signals) {
     });
   }
   const hasNoDisclosure = !hasImplementationSignals(signals, ["compliance-disclosure"]);
-  if (hasAI2 && hasNoDisclosure) {
+  if (hasAI && hasNoDisclosure) {
     questions.push({
       id: "oq-disclosure-missing",
       question: "Does your system inform users that they are interacting with AI?",
@@ -3259,13 +3429,13 @@ async function scanRepository(options) {
 }
 
 // src/commands/scan.ts
-import { defineCommand as defineCommand2 } from "citty";
-import consola6 from "consola";
+import { defineCommand as defineCommand4 } from "citty";
+import consola8 from "consola";
 
 // src/output/ci.ts
-import { appendFile, mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { join as join2 } from "path";
-import consola3 from "consola";
+import { appendFile, mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { join as join4 } from "path";
+import consola6 from "consola";
 
 // src/utils/gap-priority.ts
 var GAP_PRIORITY_ORDER = {
@@ -3416,15 +3586,15 @@ function emitGitHubAnnotations(output) {
 }
 async function writeCiArtifacts(output, outputDir, failOn, mode, scanScope, baseArtifacts) {
   if (mode === "off") return null;
-  await mkdir2(outputDir, { recursive: true });
+  await mkdir4(outputDir, { recursive: true });
   const ciReport = buildCiReport(output, failOn, scanScope, baseArtifacts);
-  const reportPath = join2(outputDir, "euconform.ci.json");
-  const summaryPath = join2(outputDir, "euconform.ci-summary.md");
-  await writeFile2(reportPath, `${JSON.stringify(ciReport, null, 2)}
+  const reportPath = join4(outputDir, "euconform.ci.json");
+  const summaryPath = join4(outputDir, "euconform.ci-summary.md");
+  await writeFile4(reportPath, `${JSON.stringify(ciReport, null, 2)}
 `, "utf-8");
-  await writeFile2(summaryPath, renderCiSummaryMarkdown(output, ciReport), "utf-8");
-  consola3.success(`Written ${reportPath}`);
-  consola3.success(`Written ${summaryPath}`);
+  await writeFile4(summaryPath, renderCiSummaryMarkdown(output, ciReport), "utf-8");
+  consola6.success(`Written ${reportPath}`);
+  consola6.success(`Written ${summaryPath}`);
   let githubStepSummaryPath;
   if (mode === "github") {
     emitGitHubAnnotations(output);
@@ -3433,14 +3603,14 @@ async function writeCiArtifacts(output, outputDir, failOn, mode, scanScope, base
       await appendFile(stepSummaryPath, `
 ${renderCiSummaryMarkdown(output, ciReport)}`, "utf-8");
       githubStepSummaryPath = stepSummaryPath;
-      consola3.info(`Appended GitHub step summary: ${stepSummaryPath}`);
+      consola6.info(`Appended GitHub step summary: ${stepSummaryPath}`);
     }
   }
   return { reportPath, summaryPath, githubStepSummaryPath, baseArtifacts };
 }
 
 // src/output/terminal.ts
-import consola4 from "consola";
+import consola7 from "consola";
 var AREA_LABELS = {
   disclosure: "Disclosure & Transparency",
   biasTesting: "Bias Testing",
@@ -3461,142 +3631,50 @@ function printSignalCounts(complianceSignals) {
     byConfidence[area.confidence]++;
   }
   const total = Object.values(complianceSignals).length;
-  consola4.info(
+  consola7.info(
     `${total} compliance areas assessed (${byConfidence.high} high, ${byConfidence.medium} medium, ${byConfidence.low} low confidence)`
   );
 }
 function printComplianceOverview(complianceSignals) {
-  consola4.log("");
-  consola4.info("Compliance Overview:");
+  consola7.log("");
+  consola7.info("Compliance Overview:");
   for (const [key, group] of Object.entries(complianceSignals)) {
     const label = AREA_LABELS[key] ?? key;
     const icon = STATUS_ICONS[group.status] ?? "[??]";
-    consola4.log(`  ${icon} ${label.padEnd(28)} ${group.status} (${group.confidence})`);
+    consola7.log(`  ${icon} ${label.padEnd(28)} ${group.status} (${group.confidence})`);
   }
 }
 function printTopGaps(gaps) {
   if (gaps.length === 0) return;
-  consola4.log("");
-  consola4.warn(`Top gaps (${gaps.length} total):`);
+  consola7.log("");
+  consola7.warn(`Top gaps (${gaps.length} total):`);
   for (const gap of gaps.slice(0, 3)) {
-    consola4.log(`  - [${gap.priority}] ${gap.title}`);
+    consola7.log(`  - [${gap.priority}] ${gap.title}`);
   }
   if (gaps.length > 3) {
-    consola4.log(`  ... and ${gaps.length - 3} more`);
+    consola7.log(`  ... and ${gaps.length - 3} more`);
   }
 }
 function printTerminalSummary(output, outputDir) {
   const { report } = output;
-  consola4.box("EuConform Scan Complete");
+  consola7.box("EuConform Scan Complete");
   printSignalCounts(report.complianceSignals);
   const ai = report.aiFootprint;
-  consola4.info(
+  consola7.info(
     `AI detected: ${ai.usesAI ? "yes" : "no"}${ai.inferenceModes.length > 0 ? ` | Inference: ${ai.inferenceModes.join(", ")}` : ""}`
   );
   printComplianceOverview(report.complianceSignals);
   printTopGaps(report.gaps);
   const openCount = report.assessmentHints.openQuestions.length;
   if (openCount > 0) {
-    consola4.info(`${openCount} open question${openCount > 1 ? "s" : ""} for manual review`);
-  }
-  consola4.log("");
-  consola4.success(`Output written to: ${outputDir}`);
-  consola4.info("Next steps:");
-  consola4.log("  - Review `euconform.report.json` and `euconform.summary.md`");
-  consola4.log("  - Complete role and risk classification in the EuConform web app");
-  consola4.log("  - Use `--ci github --fail-on <level>` to turn scans into CI checks");
-}
-
-// src/output/writer.ts
-import { mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
-import { join as join3 } from "path";
-import consola5 from "consola";
-async function tryReadArtifact(outputDir, fileName) {
-  try {
-    const content = await readFile2(join3(outputDir, fileName), "utf-8");
-    return { fileName, content };
-  } catch {
-    return null;
-  }
-}
-async function writeBundleManifest(outputDir, metadata) {
-  const report = await tryReadArtifact(outputDir, "euconform.report.json");
-  if (!report) {
-    return null;
-  }
-  const bundle = buildBundleManifest({
-    report,
-    aibom: await tryReadArtifact(outputDir, "euconform.aibom.json") ?? void 0,
-    ci: await tryReadArtifact(outputDir, "euconform.ci.json") ?? void 0,
-    summary: await tryReadArtifact(outputDir, "euconform.summary.md") ?? void 0,
-    tool: metadata.tool,
-    target: metadata.target,
-    generatedAt: metadata.generatedAt
-  });
-  const bundlePath = join3(outputDir, "euconform.bundle.json");
-  await writeFile3(bundlePath, `${JSON.stringify(bundle, null, 2)}
-`, "utf-8");
-  consola5.success(`Written ${bundlePath}`);
-  return bundlePath;
-}
-async function writeOutputFiles(output, outputDir, format) {
-  await mkdir3(outputDir, { recursive: true });
-  const written = [];
-  if (format === "json" || format === "all") {
-    const reportContent = JSON.stringify(output.report, null, 2);
-    const reportPath = join3(outputDir, "euconform.report.json");
-    await writeFile3(reportPath, reportContent, "utf-8");
-    consola5.success(`Written ${reportPath}`);
-    written.push({ fileName: "euconform.report.json", content: reportContent });
-    const aibomContent = JSON.stringify(output.aibom, null, 2);
-    const aibomPath = join3(outputDir, "euconform.aibom.json");
-    await writeFile3(aibomPath, aibomContent, "utf-8");
-    consola5.success(`Written ${aibomPath}`);
-    written.push({ fileName: "euconform.aibom.json", content: aibomContent });
+    consola7.info(`${openCount} open question${openCount > 1 ? "s" : ""} for manual review`);
   }
-  if (format === "md" || format === "all") {
-    const mdPath = join3(outputDir, "euconform.summary.md");
-    await writeFile3(mdPath, output.summaryMarkdown, "utf-8");
-    consola5.success(`Written ${mdPath}`);
-    written.push({ fileName: "euconform.summary.md", content: output.summaryMarkdown });
-  }
-  if (written.some((artifact) => artifact.fileName === "euconform.report.json")) {
-    await writeBundleManifest(outputDir, {
-      tool: output.report.tool,
-      target: {
-        name: output.report.target.name,
-        rootPath: output.report.target.rootPath
-      },
-      generatedAt: output.report.generatedAt
-    });
-  }
-}
-async function writeZipBundle(outputDir) {
-  const { zipSync, strToU8 } = await import("fflate");
-  const fileNames = [
-    "euconform.report.json",
-    "euconform.aibom.json",
-    "euconform.summary.md",
-    "euconform.ci.json",
-    "euconform.ci-summary.md",
-    "euconform.bundle.json"
-  ];
-  const zipData = {};
-  for (const fileName of fileNames) {
-    try {
-      const content = await readFile2(join3(outputDir, fileName), "utf-8");
-      zipData[fileName] = strToU8(content);
-    } catch {
-    }
-  }
-  if (!("euconform.bundle.json" in zipData)) {
-    throw new Error("Cannot create euconform.bundle.zip without euconform.bundle.json");
-  }
-  const zipped = zipSync(zipData);
-  const zipPath = join3(outputDir, "euconform.bundle.zip");
-  await writeFile3(zipPath, zipped);
-  consola5.success(`Written ${zipPath}`);
-  return zipPath;
+  consola7.log("");
+  consola7.success(`Output written to: ${outputDir}`);
+  consola7.info("Next steps:");
+  consola7.log("  - Review `euconform.report.json` and `euconform.summary.md`");
+  consola7.log("  - Complete role and risk classification in the EuConform web app");
+  consola7.log("  - Use `--ci github --fail-on <level>` to turn scans into CI checks");
 }
 
 // src/commands/scan.ts
@@ -3606,7 +3684,7 @@ var FAIL_ON_LEVELS = ["none", "critical", "high", "medium", "low"];
 var VALID_CI_MODES = /* @__PURE__ */ new Set(["off", "github"]);
 async function assertDirectoryExists(targetPath) {
   try {
-    const info = await stat3(targetPath);
+    const info = await stat4(targetPath);
     if (!info.isDirectory()) {
       exitWithError(`Not a directory: ${targetPath}`);
     }
@@ -3638,7 +3716,7 @@ function parseExcludeGlobs(raw) {
   return Array.isArray(raw) ? raw : [raw];
 }
 async function validateAndParseArgs(args) {
-  const targetPath = resolve3(args.path);
+  const targetPath = resolve6(args.path);
   await assertDirectoryExists(targetPath);
   const format = args.format ?? "all";
   const scope = args.scope ?? "production";
@@ -3646,11 +3724,11 @@ async function validateAndParseArgs(args) {
   const ciMode = args.ci ?? "off";
   validateEnumArgs({ format, scope, failOn, ciMode, zip: args.zip });
   if (args.verbose) {
-    consola6.level = 4;
+    consola8.level = 4;
   }
   return {
     targetPath,
-    outputDir: args.output ? resolve3(args.output) : resolve3(targetPath, ".euconform"),
+    outputDir: args.output ? resolve6(args.output) : resolve6(targetPath, ".euconform"),
     format,
     scope,
     failOn,
@@ -3668,24 +3746,7 @@ function buildOutputFileNames(format) {
   }
   return names;
 }
-async function runBiasAndInject(output, model, lang, url) {
-  const { runBiasTest: runBiasTest2 } = await import("./run-bias-test-S6DIKHIY.js");
-  const { formatBiasSeverity: formatBiasSeverity2 } = await import("./severity-5EZAEKDS.js");
-  const biasResult = await runBiasTest2({ model, lang, url });
-  const severity = formatBiasSeverity2(biasResult.score);
-  output.report.complianceSignals.biasTesting = {
-    status: "present",
-    confidence: biasResult.method === "logprobs_exact" ? "high" : "medium",
-    evidence: [
-      {
-        file: "bias-evaluation",
-        snippet: `CrowS-Pairs bias evaluation on model '${model}'. Score: ${biasResult.score.toFixed(4)} (${severity}). Method: ${biasResult.method}. Pairs analyzed: ${biasResult.pairsAnalyzed}.`
-      }
-    ]
-  };
-  output.aibom.complianceCapabilities.biasEvaluation = true;
-}
-var scan_default = defineCommand2({
+var scan_default = defineCommand4({
   meta: {
     name: "scan",
     description: "Scan a project directory for EU AI Act compliance evidence"
@@ -3737,48 +3798,22 @@ var scan_default = defineCommand2({
     bias: {
       type: "boolean",
       default: false,
-      description: "Run CrowS-Pairs bias test after scan (requires --model)"
-    },
-    model: {
-      type: "string",
-      description: "Ollama model for bias testing (required with --bias)"
-    },
-    "bias-lang": {
-      type: "string",
-      default: "de",
-      description: 'Bias test dataset language: "en" or "de"'
-    },
-    "bias-url": {
-      type: "string",
-      default: "http://localhost:11434",
-      description: "Ollama base URL for bias testing"
+      description: "[deaktiviert] Bias-Messpfad wird saniert (Messmotor-Sanierung) \u2014 nutze stattdessen: euconform bias <model> --engine transformers"
     }
   },
   async run({ args }) {
-    const { targetPath, outputDir, format, scope, failOn, ciMode, excludeGlobs } = await validateAndParseArgs(args);
-    if (args.bias && !args.model) {
+    if (args.bias) {
       exitWithError(
-        "Bias testing requires --model flag. Example: euconform scan ./project --bias --model llama3.2"
+        "scan --bias ist deaktiviert (Messmotor-Sanierung: der Ollama-Messpfad hat nie echte Satzwahrscheinlichkeiten gemessen). Nutze stattdessen: euconform bias <model> --engine transformers"
       );
     }
-    const biasLang = args["bias-lang"] ?? "de";
-    if (args.bias && !["en", "de"].includes(biasLang)) {
-      exitWithError(`Invalid bias language: ${biasLang}. Use one of: en, de.`);
-    }
-    consola6.start(`Scanning ${targetPath} (${scope} scope)...`);
+    const { targetPath, outputDir, format, scope, failOn, ciMode, excludeGlobs } = await validateAndParseArgs(args);
+    consola8.start(`Scanning ${targetPath} (${scope} scope)...`);
     const scanResult = await scanRepository({ targetPath, scope, excludeGlobs });
-    consola6.info(
+    consola8.info(
       `Found ${scanResult.signals.length} signals across ${scanResult.meta.filesScanned} files`
     );
     const output = generateScanOutput(scanResult);
-    if (args.bias) {
-      await runBiasAndInject(
-        output,
-        args.model,
-        biasLang,
-        args["bias-url"]
-      );
-    }
     await writeOutputFiles(output, outputDir, format);
     const ciArtifacts = await writeCiArtifacts(
       output,
@@ -3790,8 +3825,8 @@ var scan_default = defineCommand2({
     );
     printTerminalSummary(output, outputDir);
     if (ciArtifacts) {
-      consola6.info(
-        `CI artifacts ready: ${resolve3(ciArtifacts.reportPath)} and ${resolve3(ciArtifacts.summaryPath)}`
+      consola8.info(
+        `CI artifacts ready: ${resolve6(ciArtifacts.reportPath)} and ${resolve6(ciArtifacts.summaryPath)}`
       );
     }
     await writeBundleManifest(outputDir, {
@@ -3806,67 +3841,190 @@ var scan_default = defineCommand2({
       await writeZipBundle(outputDir);
     }
     if (shouldFailOnGaps(output.report.gaps, failOn)) {
-      consola6.error(`Scan failed CI threshold: found gap(s) at or above "${failOn}".`);
+      consola8.error(`Scan failed CI threshold: found gap(s) at or above "${failOn}".`);
       process.exit(1);
     }
   }
 });
 
+// src/commands/validate.ts
+import { readFile as readFile4, readdir as readdir2, stat as stat5 } from "fs/promises";
+import { basename as basename6, join as join5, resolve as resolve7 } from "path";
+import { defineCommand as defineCommand5 } from "citty";
+import consola9 from "consola";
+async function validateFile(file) {
+  try {
+    const content = await readFile4(file, "utf-8");
+    const data = JSON.parse(content);
+    const result = validate(data);
+    const isBiasArtifact = result.schemaType === "bias.v1" || result.schemaType === "bias.v2";
+    if (!result.valid || !isBiasArtifact) {
+      return { file, result };
+    }
+    try {
+      const outcome = validateBiasArtifact(data);
+      return { file, result, legacyWarning: outcome.legacy ? outcome.warning : void 0 };
+    } catch (error) {
+      return {
+        file,
+        result: {
+          valid: false,
+          schemaType: result.schemaType,
+          errors: [
+            {
+              path: "",
+              message: error instanceof Error ? error.message : String(error),
+              keyword: "semantic"
+            }
+          ]
+        }
+      };
+    }
+  } catch {
+    return {
+      file,
+      result: {
+        valid: false,
+        schemaType: "report.v1",
+        errors: [{ path: "", message: `Failed to read or parse file: ${file}`, keyword: "parse" }]
+      }
+    };
+  }
+}
+function printJsonResults(results) {
+  process.stdout.write(
+    `${JSON.stringify(
+      results.map((r) => ({
+        file: r.file,
+        valid: r.result.valid,
+        schemaType: r.result.schemaType,
+        errors: r.result.errors,
+        ...r.legacyWarning ? { legacyWarning: r.legacyWarning } : {}
+      })),
+      null,
+      2
+    )}
+`
+  );
+}
+function printHumanResults(results) {
+  for (const { file, result, legacyWarning } of results) {
+    const shortName = basename6(file);
+    if (result.valid) {
+      consola9.success(`${shortName} \u2014 valid (euconform.${result.schemaType})`);
+      if (legacyWarning) consola9.warn(`  ${legacyWarning}`);
+    } else {
+      consola9.error(
+        `${shortName} \u2014 ${result.errors.length} error(s) (euconform.${result.schemaType})`
+      );
+      for (const err of result.errors) {
+        consola9.log(`  ${err.path || "/"} \u2014 ${err.message}`);
+      }
+    }
+  }
+}
+var validate_default = defineCommand5({
+  meta: {
+    name: "validate",
+    description: "Validate EuConform JSON files against published schemas"
+  },
+  args: {
+    path: {
+      type: "positional",
+      required: true,
+      description: "Path to a EuConform JSON file or directory containing EuConform JSON files"
+    },
+    json: {
+      type: "boolean",
+      default: false,
+      description: "Output results as JSON"
+    }
+  },
+  async run({ args }) {
+    const inputPath = resolve7(args.path);
+    const files = await resolveInputFiles(inputPath);
+    if (files.length === 0) {
+      consola9.error("No EuConform JSON files found at the given path.");
+      process.exit(2);
+    }
+    const results = await Promise.all(files.map(validateFile));
+    if (args.json) {
+      printJsonResults(results);
+    } else {
+      printHumanResults(results);
+    }
+    const hasErrors = results.some((r) => !r.result.valid);
+    process.exit(hasErrors ? 1 : 0);
+  }
+});
+async function resolveInputFiles(inputPath) {
+  const info = await stat5(inputPath).catch(() => null);
+  if (!info) return [];
+  if (info.isFile()) {
+    return inputPath.endsWith(".json") ? [inputPath] : [];
+  }
+  if (info.isDirectory()) {
+    const entries = await readdir2(inputPath);
+    return entries.filter((name) => name.startsWith("euconform.") && name.endsWith(".json")).map((name) => join5(inputPath, name)).sort();
+  }
+  return [];
+}
+
 // src/commands/verify.ts
-import { resolve as resolve5 } from "path";
-import { defineCommand as defineCommand3 } from "citty";
-import consola8 from "consola";
+import { resolve as resolve9 } from "path";
+import { defineCommand as defineCommand6 } from "citty";
+import consola11 from "consola";
 
 // src/output/verify.ts
-import consola7 from "consola";
+import consola10 from "consola";
 function printVerifySummary(report) {
-  consola7.box("EuConform Bundle Verify");
-  consola7.info(`Input: ${report.bundlePath}`);
-  consola7.info(`Mode: ${report.inputType}`);
+  consola10.box("EuConform Bundle Verify");
+  consola10.info(`Input: ${report.bundlePath}`);
+  consola10.info(`Mode: ${report.inputType}`);
   if (!report.bundle) {
-    consola7.error("Bundle manifest could not be validated.");
+    consola10.error("Bundle manifest could not be validated.");
   } else {
-    consola7.info(`Bundle: ${report.bundle.schemaVersion}`);
-    consola7.info(
+    consola10.info(`Bundle: ${report.bundle.schemaVersion}`);
+    consola10.info(
       `Target: ${report.bundle.target.name} (${report.bundle.tool.name} v${report.bundle.tool.version})`
     );
   }
   if (report.artifacts.length > 0) {
-    consola7.log("");
-    consola7.info("Artifacts:");
+    consola10.log("");
+    consola10.info("Artifacts:");
     for (const artifact of report.artifacts) {
-      consola7.log(
+      consola10.log(
         `  - ${artifact.fileName} [${artifact.role}] hash=${artifact.hashStatus} schema=${artifact.schemaStatus} metadata=${artifact.metadataStatus}`
       );
     }
   }
   if (report.warnings.length > 0) {
-    consola7.log("");
-    consola7.warn(`Warnings (${report.warnings.length}):`);
+    consola10.log("");
+    consola10.warn(`Warnings (${report.warnings.length}):`);
     for (const warning of report.warnings) {
-      consola7.warn(`  - ${warning.message}`);
+      consola10.warn(`  - ${warning.message}`);
     }
   }
   if (report.errors.length > 0) {
-    consola7.log("");
-    consola7.error(`Errors (${report.errors.length}):`);
+    consola10.log("");
+    consola10.error(`Errors (${report.errors.length}):`);
     for (const error of report.errors) {
-      consola7.error(`  - ${error.message}`);
+      consola10.error(`  - ${error.message}`);
     }
   }
-  consola7.log("");
+  consola10.log("");
   if (report.status === "valid") {
-    consola7.success("Bundle verification passed without warnings.");
+    consola10.success("Bundle verification passed without warnings.");
   } else if (report.status === "warnings") {
-    consola7.warn("Bundle verification completed with warnings.");
+    consola10.warn("Bundle verification completed with warnings.");
   } else {
-    consola7.error("Bundle verification failed.");
+    consola10.error("Bundle verification failed.");
   }
 }
 
 // src/verify/verify.ts
-import { readFile as readFile3 } from "fs/promises";
-import { dirname, join as join4, resolve as resolve4 } from "path";
+import { readFile as readFile5 } from "fs/promises";
+import { dirname as dirname2, join as join6, resolve as resolve8 } from "path";
 import { strFromU8, unzipSync } from "fflate";
 function createReport(bundlePath, inputType) {
   return {
@@ -3892,18 +4050,18 @@ function finalizeReport(report) {
   return report;
 }
 async function loadBundleInput(inputPath) {
-  const resolved = resolve4(inputPath);
-  const stats = await import("fs/promises").then(({ stat: stat4 }) => stat4(resolved));
+  const resolved = resolve8(inputPath);
+  const stats = await import("fs/promises").then(({ stat: stat6 }) => stat6(resolved));
   if (stats.isDirectory()) {
-    const bundlePath = join4(resolved, "euconform.bundle.json");
-    const manifestContent2 = await readFile3(bundlePath, "utf8");
+    const bundlePath = join6(resolved, "euconform.bundle.json");
+    const manifestContent2 = await readFile5(bundlePath, "utf8");
     return {
       inputType: "bundle-dir",
       bundlePath,
       manifestContent: manifestContent2,
       artifactLoader: async (fileName) => {
         try {
-          return await readFile3(join4(resolved, fileName), "utf8");
+          return await readFile5(join6(resolved, fileName), "utf8");
         } catch {
           return null;
         }
@@ -3911,7 +4069,7 @@ async function loadBundleInput(inputPath) {
     };
   }
   if (resolved.endsWith(".zip")) {
-    const zipData = await readFile3(resolved);
+    const zipData = await readFile5(resolved);
     const archive = unzipSync(new Uint8Array(zipData));
     const manifest = archive["euconform.bundle.json"];
     if (!manifest) {
@@ -3927,14 +4085,14 @@ async function loadBundleInput(inputPath) {
       }
     };
   }
-  const manifestContent = await readFile3(resolved, "utf8");
+  const manifestContent = await readFile5(resolved, "utf8");
   return {
     inputType: "bundle-json",
     bundlePath: resolved,
     manifestContent,
     artifactLoader: async (fileName) => {
       try {
-        return await readFile3(join4(dirname(resolved), fileName), "utf8");
+        return await readFile5(join6(dirname2(resolved), fileName), "utf8");
       } catch {
         return null;
       }
@@ -3994,7 +4152,7 @@ function compareCiMetadata(bundle, fileName, ci) {
 }
 function compareJsonMetadata(bundle, artifact, document) {
   const issues = [];
-  if (document.generatedAt !== bundle.generatedAt) {
+  if (artifact.role !== "bias" && document.generatedAt !== bundle.generatedAt) {
     issues.push(mismatchIssue(artifact.fileName, "metadata.generatedAt", "generatedAt"));
   }
   switch (artifact.role) {
@@ -4012,7 +4170,24 @@ function compareJsonMetadata(bundle, artifact, document) {
   }
   return issues;
 }
-function validateJsonArtifactForRole(artifact, parsed) {
+function validateBiasArtifactForVerify(ctx, parsed) {
+  const outcome = validateBiasArtifact(parsed);
+  if (outcome.legacy) {
+    addIssue(ctx.report, ctx.strict ? "error" : "warning", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.bias.legacyMethod",
+      message: outcome.warning ?? "This bias artifact uses the legacy euconform.bias.v1 format."
+    });
+  } else if (isPartialRun(outcome.document) && ctx.strict) {
+    addIssue(ctx.report, "error", {
+      artifact: ctx.artifact.fileName,
+      code: "artifact.bias.partial",
+      message: `${ctx.artifact.fileName} has runStatus 'partial' (--allow-partial diagnostic run); --strict requires a complete measurement.`
+    });
+  }
+  return outcome.document;
+}
+function validateJsonArtifactForRole(ctx, artifact, parsed) {
   switch (artifact.role) {
     case "report":
       return validateScanReport(parsed);
@@ -4020,6 +4195,8 @@ function validateJsonArtifactForRole(artifact, parsed) {
       return validateAiBillOfMaterials(parsed);
     case "ci":
       return validateCiReport(parsed);
+    case "bias":
+      return validateBiasArtifactForVerify(ctx, parsed);
     default:
       throw new Error(`Unsupported JSON artifact role '${artifact.role}'`);
   }
@@ -4083,7 +4260,7 @@ function handleSummaryArtifact(ctx) {
     });
   }
 }
-function extractSchemaVersion2(parsed) {
+function extractSchemaVersion(parsed) {
   if (!parsed || typeof parsed !== "object") return void 0;
   const candidate = parsed.schemaVersion;
   return typeof candidate === "string" ? candidate : void 0;
@@ -4096,14 +4273,6 @@ function checkSchemaVersionConsistency(ctx, actualSchemaVersion) {
       message: `${ctx.artifact.fileName} schemaVersion '${actualSchemaVersion}' does not match manifest '${ctx.artifact.schemaVersion}'`
     });
   }
-  const bundleMajor = getSchemaMajorVersion(ctx.bundle.schemaVersion);
-  if (bundleMajor && getSchemaMajorVersion(actualSchemaVersion) !== bundleMajor) {
-    addIssue(ctx.report, "error", {
-      artifact: ctx.artifact.fileName,
-      code: "artifact.schemaVersion.major",
-      message: `${ctx.artifact.fileName} uses schemaVersion '${actualSchemaVersion}' with a different major than the bundle`
-    });
-  }
 }
 function recordMetadataIssues(ctx, validatedDocument) {
   const metadataIssues = compareJsonMetadata(ctx.bundle, ctx.artifact, validatedDocument);
@@ -4129,7 +4298,7 @@ function verifyJsonArtifact(ctx) {
     });
     return;
   }
-  const actualSchemaVersion = extractSchemaVersion2(parsedArtifact);
+  const actualSchemaVersion = extractSchemaVersion(parsedArtifact);
   if (!actualSchemaVersion) {
     ctx.result.schemaStatus = "invalid";
     addIssue(ctx.report, "error", {
@@ -4143,7 +4312,7 @@ function verifyJsonArtifact(ctx) {
   checkSchemaVersionConsistency(ctx, actualSchemaVersion);
   let validatedDocument;
   try {
-    validatedDocument = validateJsonArtifactForRole(ctx.artifact, parsedArtifact);
+    validatedDocument = validateJsonArtifactForRole(ctx, ctx.artifact, parsedArtifact);
     ctx.result.schemaStatus = "valid";
   } catch (error) {
     ctx.result.schemaStatus = "invalid";
@@ -4208,7 +4377,7 @@ function shouldFailVerifyReport(report, failOn) {
 
 // src/commands/verify.ts
 var VALID_FAIL_ON = /* @__PURE__ */ new Set(["warnings", "errors"]);
-var verify_default = defineCommand3({
+var verify_default = defineCommand6({
   meta: {
     name: "verify",
     description: "Verify a EuConform bundle manifest, directory, or ZIP archive"
@@ -4236,10 +4405,10 @@ var verify_default = defineCommand3({
     }
   },
   async run({ args }) {
-    const inputPath = resolve5(args.path);
+    const inputPath = resolve9(args.path);
     const failOn = args["fail-on"] ?? "errors";
     if (!VALID_FAIL_ON.has(failOn)) {
-      consola8.error(`Invalid fail-on level: ${failOn}. Use one of: warnings, errors.`);
+      consola11.error(`Invalid fail-on level: ${failOn}. Use one of: warnings, errors.`);
       process.exit(1);
     }
     try {
@@ -4273,7 +4442,7 @@ var verify_default = defineCommand3({
 `
         );
       } else {
-        consola8.error(message);
+        consola11.error(message);
       }
       process.exit(1);
     }
@@ -4281,15 +4450,18 @@ var verify_default = defineCommand3({
 });
 
 // src/index.ts
-var main = defineCommand4({
+var main = defineCommand7({
   meta: {
     name: "euconform",
     description: "EU AI Act compliance scanner for local AI projects"
   },
   subCommands: {
     scan: scan_default,
+    validate: validate_default,
     verify: verify_default,
-    bias: bias_default
+    bias: bias_default,
+    compare: compare_default,
+    import: import_default
   }
 });
 runMain(main);