@euconform/core 1.0.1 → 1.3.0

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @euconform/core@1.0.0 build /Users/benedikthiepler/projects/priv/aimpact/packages/core
+> @euconform/core@1.3.0 build /home/runner/work/EuConform/EuConform/packages/core
 > tsc
 

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @euconform/core
 
+## 1.3.0
+
+### Minor Changes
+
+- caae33d: ECEF Stage 2: Add bundle.v1 manifest with SHA-256 integrity hashes and optional ZIP transport. Add verify command to CLI for manifest, directory, and ZIP validation. First public release of @euconform/cli with scan, verify, and --zip support.
+
+## 1.2.0
+
+### Minor Changes
+
+- 50566c7: Add GPAI compliance module (Art. 53-55) with dedicated quiz flow, classifier, and results checklist for Foundation Model providers. Add compliance gap analysis with prioritized action plans for both Annex III and GPAI paths. Fix open-source unsure flag,
+
 ## 1.0.1
 
 ### Patch Changes

package/dist/evidence/bundle.d.ts

@@ -0,0 +1,23 @@
+import type { ScanBundle } from "./types";
+interface ArtifactInput {
+    content: string;
+    fileName: string;
+}
+interface BuildBundleOptions {
+    report: ArtifactInput;
+    aibom?: ArtifactInput;
+    ci?: ArtifactInput;
+    summary?: ArtifactInput;
+    tool: {
+        name: string;
+        version: string;
+    };
+    target: {
+        name: string;
+        rootPath: string;
+    };
+    generatedAt: string;
+}
+export declare function buildBundleManifest(opts: BuildBundleOptions): ScanBundle;
+export {};
+//# sourceMappingURL=bundle.d.ts.map

package/dist/evidence/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/evidence/bundle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyC,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjF,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAcxE"}

package/dist/evidence/bundle.js

@@ -0,0 +1,44 @@
+import { sha256Hex } from "./hash";
+function extractSchemaVersion(content) {
+    try {
+        const parsed = JSON.parse(content);
+        return typeof parsed.schemaVersion === "string" ? parsed.schemaVersion : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function makeArtifactRef(role, input, required) {
+    const isJson = input.fileName.endsWith(".json");
+    const ref = {
+        role,
+        fileName: input.fileName,
+        sha256: sha256Hex(input.content),
+        required,
+    };
+    if (isJson) {
+        const sv = extractSchemaVersion(input.content);
+        if (sv)
+            ref.schemaVersion = sv;
+    }
+    else {
+        ref.mimeType = "text/markdown";
+    }
+    return ref;
+}
+export function buildBundleManifest(opts) {
+    const artifacts = [makeArtifactRef("report", opts.report, true)];
+    if (opts.aibom)
+        artifacts.push(makeArtifactRef("aibom", opts.aibom, false));
+    if (opts.ci)
+        artifacts.push(makeArtifactRef("ci", opts.ci, false));
+    if (opts.summary)
+        artifacts.push(makeArtifactRef("summary", opts.summary, false));
+    return {
+        schemaVersion: "euconform.bundle.v1",
+        generatedAt: opts.generatedAt,
+        tool: opts.tool,
+        target: opts.target,
+        artifacts,
+    };
+}

package/dist/evidence/compliance-evaluation.d.ts

@@ -0,0 +1,12 @@
+import type { DetectedSignal, FileProvenance, SignalCategory, SignalEvidence } from "./types";
+export declare const IMPLEMENTATION_PROVENANCE: Set<FileProvenance>;
+export declare function isUserFacingPath(relativePath: string): boolean;
+export declare function isImplementationEvidence(category: SignalCategory, evidence: SignalEvidence): boolean;
+export declare function isSupportingEvidence(category: SignalCategory, evidence: SignalEvidence): boolean;
+export interface EvaluatedSignalSet {
+    implementationSignals: DetectedSignal[];
+    supportingSignals: DetectedSignal[];
+}
+export declare function evaluateSignalsForCategories(signals: DetectedSignal[], categories: SignalCategory[]): EvaluatedSignalSet;
+export declare function hasImplementationSignals(signals: DetectedSignal[], categories: SignalCategory[]): boolean;
+//# sourceMappingURL=compliance-evaluation.d.ts.map

package/dist/evidence/compliance-evaluation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-evaluation.d.ts","sourceRoot":"","sources":["../../src/evidence/compliance-evaluation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9F,eAAO,MAAM,yBAAyB,qBAAiD,CAAC;AAkCxF,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAS9D;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAUT;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAQhG;AAWD,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,EAAE,cAAc,EAAE,CAAC;IACxC,iBAAiB,EAAE,cAAc,EAAE,CAAC;CACrC;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,cAAc,EAAE,EACzB,UAAU,EAAE,cAAc,EAAE,GAC3B,kBAAkB,CAiBpB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,EAAE,EACzB,UAAU,EAAE,cAAc,EAAE,GAC3B,OAAO,CAET"}

package/dist/evidence/compliance-evaluation.js

@@ -0,0 +1,78 @@
+export const IMPLEMENTATION_PROVENANCE = new Set(["runtime", "config"]);
+const SUPPORTING_PROVENANCE = new Set(["root-docs", "docs"]);
+const USER_FACING_SEGMENTS = new Set([
+    "app",
+    "pages",
+    "routes",
+    "route",
+    "components",
+    "ui",
+    "views",
+    "view",
+    "screens",
+    "screen",
+    "templates",
+    "template",
+    "public",
+    "content",
+    "locales",
+    "messages",
+    "copy",
+    "emails",
+]);
+const USER_FACING_BASENAME_PATTERN = /(?:page|layout|route|template|loading|error|view|screen|dialog|modal|form|widget|banner|notice)\.[^.]+$/i;
+function normalizedProvenance(provenance) {
+    return provenance ?? "runtime";
+}
+function isInternalAnalysisPath(relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
+    return normalized.includes("/scanner/") || normalized.includes("/detectors/");
+}
+export function isUserFacingPath(relativePath) {
+    const normalized = relativePath.replace(/\\/g, "/").toLowerCase();
+    const segments = normalized.split("/").filter(Boolean);
+    const basename = segments[segments.length - 1] ?? "";
+    return (segments.some((segment) => USER_FACING_SEGMENTS.has(segment)) ||
+        USER_FACING_BASENAME_PATTERN.test(basename));
+}
+export function isImplementationEvidence(category, evidence) {
+    const provenance = normalizedProvenance(evidence.provenance);
+    if (!IMPLEMENTATION_PROVENANCE.has(provenance))
+        return false;
+    if (isInternalAnalysisPath(evidence.file))
+        return false;
+    if (category === "compliance-disclosure") {
+        return isUserFacingPath(evidence.file);
+    }
+    return true;
+}
+export function isSupportingEvidence(category, evidence) {
+    const provenance = normalizedProvenance(evidence.provenance);
+    if (!SUPPORTING_PROVENANCE.has(provenance))
+        return false;
+    if (category === "compliance-disclosure")
+        return true;
+    if (category.startsWith("compliance-"))
+        return true;
+    return false;
+}
+function withFilteredEvidence(signal, matcher) {
+    const evidence = signal.evidence.filter(matcher);
+    if (evidence.length === 0)
+        return null;
+    return { ...signal, evidence };
+}
+export function evaluateSignalsForCategories(signals, categories) {
+    const relevant = signals.filter((signal) => categories.includes(signal.category));
+    return {
+        implementationSignals: relevant
+            .map((signal) => withFilteredEvidence(signal, (evidence) => isImplementationEvidence(signal.category, evidence)))
+            .filter((signal) => signal !== null),
+        supportingSignals: relevant
+            .map((signal) => withFilteredEvidence(signal, (evidence) => isSupportingEvidence(signal.category, evidence)))
+            .filter((signal) => signal !== null),
+    };
+}
+export function hasImplementationSignals(signals, categories) {
+    return evaluateSignalsForCategories(signals, categories).implementationSignals.length > 0;
+}

package/dist/evidence/hash.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256Hex(content: string): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/evidence/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/evidence/hash.ts"],"names":[],"mappings":"AAEA,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/evidence/hash.js

@@ -0,0 +1,4 @@
+import { createHash } from "node:crypto";
+export function sha256Hex(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}

package/dist/evidence/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @euconform/core/evidence — Evidence model and output generation
+ *
+ * This module defines the evidence types produced by the scanner
+ * and transforms raw scan results into structured output artifacts.
+ */
+export type { AiBillOfMaterials, AppType, AssessmentHint, BomComponent, BomComponentKind, BundleArtifactRef, BundleArtifactRole, CiReport, ComplianceSignalGroup, ConfidenceLevel, DetectedSignal, DetectorContext, FailOnLevel, FileProvenance, GapCounts, OpenQuestion, RepoProfile, ScanBundle, ScanFile, ScanGap, ScanMeta, ScanOptions, ScanOutput, ScanReport, ScanResult, ScanScope, SignalCategory, SignalDetector, SignalEvidence, } from "./types";
+export { generateScanOutput } from "./output";
+export { generateSummaryMarkdown } from "./markdown";
+export { buildBundleManifest } from "./bundle";
+export { sha256Hex } from "./hash";
+export { getSchemaMajorVersion, validateAiBillOfMaterials, validateCiReport, validateEcefJsonDocument, validateScanBundle, validateScanReport, } from "./validate";
+//# sourceMappingURL=index.d.ts.map

package/dist/evidence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,eAAe,EACf,WAAW,EACX,cAAc,EACd,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}

package/dist/evidence/index.js

@@ -0,0 +1,11 @@
+/**
+ * @euconform/core/evidence — Evidence model and output generation
+ *
+ * This module defines the evidence types produced by the scanner
+ * and transforms raw scan results into structured output artifacts.
+ */
+export { generateScanOutput } from "./output";
+export { generateSummaryMarkdown } from "./markdown";
+export { buildBundleManifest } from "./bundle";
+export { sha256Hex } from "./hash";
+export { getSchemaMajorVersion, validateAiBillOfMaterials, validateCiReport, validateEcefJsonDocument, validateScanBundle, validateScanReport, } from "./validate";

package/dist/evidence/markdown.d.ts

@@ -0,0 +1,9 @@
+/**
+ * EuConform Evidence Engine — Markdown Summary Generation
+ *
+ * Generates a human-readable markdown summary from ScanReport and AiBillOfMaterials.
+ * Pure function — no side effects, no filesystem operations.
+ */
+import type { AiBillOfMaterials, ScanReport, ScanScope } from "./types";
+export declare function generateSummaryMarkdown(report: ScanReport, aibom: AiBillOfMaterials, scanScope: ScanScope): string;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/evidence/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/evidence/markdown.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,iBAAiB,EAGjB,UAAU,EACV,SAAS,EACV,MAAM,SAAS,CAAC;AAmMjB,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,iBAAiB,EACxB,SAAS,EAAE,SAAS,GACnB,MAAM,CAaR"}

package/dist/evidence/markdown.js

@@ -0,0 +1,169 @@
+/**
+ * EuConform Evidence Engine — Markdown Summary Generation
+ *
+ * Generates a human-readable markdown summary from ScanReport and AiBillOfMaterials.
+ * Pure function — no side effects, no filesystem operations.
+ */
+const COMPLIANCE_LABELS = {
+    disclosure: "AI Disclosure",
+    biasTesting: "Bias Testing",
+    reportingExports: "Reporting & Exports",
+    loggingMonitoring: "Logging & Monitoring",
+    humanOversight: "Human Oversight",
+    dataGovernance: "Data Governance",
+    incidentReporting: "Incident Reporting",
+};
+const STATUS_LABELS = {
+    present: "Present",
+    partial: "Partial",
+    absent: "Absent",
+    unknown: "Unknown",
+};
+function bomKindLabel(kind) {
+    const labels = {
+        framework: "Framework",
+        runtime: "Runtime",
+        "inference-provider": "Inference Provider",
+        "ai-framework": "AI Framework",
+        model: "Model",
+        "vector-store": "Vector Store",
+        embedding: "Embedding",
+        dataset: "Dataset",
+        tool: "Tool",
+    };
+    return labels[kind];
+}
+function formatDate(iso) {
+    try {
+        const d = new Date(iso);
+        return d.toISOString().split("T")[0] ?? iso;
+    }
+    catch {
+        return iso;
+    }
+}
+// ---------------------------------------------------------------------------
+// Section builders
+// ---------------------------------------------------------------------------
+function buildHeader(report, scanScope) {
+    const date = formatDate(report.generatedAt);
+    return [
+        "# EuConform Scan Report",
+        "",
+        "> **Disclaimer:** This is technical guidance only. It does not constitute legal advice.",
+        `> Generated by EuConform v${report.tool.version} on ${date}.`,
+        `> Scan scope: \`${scanScope}\`.`,
+    ].join("\n");
+}
+function buildProjectOverview(report) {
+    const lines = [
+        "## Project Overview",
+        "",
+        `- **Name:** ${report.target.name}`,
+        `- **Type:** ${report.target.repoType}`,
+    ];
+    if (report.target.detectedStack.length > 0) {
+        lines.push(`- **Stack:** ${report.target.detectedStack.join(", ")}`);
+    }
+    else {
+        lines.push("- **Stack:** Not detected");
+    }
+    return lines.join("\n");
+}
+function buildAiComponents(aibom) {
+    const lines = ["## AI Components Detected", ""];
+    if (aibom.components.length === 0) {
+        lines.push("No AI components detected.");
+        return lines.join("\n");
+    }
+    lines.push("| Component | Kind | Source |");
+    lines.push("|-----------|------|--------|");
+    for (const comp of aibom.components) {
+        lines.push(`| ${comp.name} | ${bomKindLabel(comp.kind)} | ${comp.source} |`);
+    }
+    return lines.join("\n");
+}
+function buildComplianceSignals(report) {
+    const lines = ["## Compliance Signals", ""];
+    lines.push("| Area | Status | Confidence |");
+    lines.push("|------|--------|------------|");
+    const areas = Object.keys(COMPLIANCE_LABELS);
+    for (const area of areas) {
+        const group = report.complianceSignals[area];
+        lines.push(`| ${COMPLIANCE_LABELS[area]} | ${STATUS_LABELS[group.status]} | ${group.confidence} |`);
+    }
+    return lines.join("\n");
+}
+function buildAssessmentHints(report) {
+    const { riskIndicators, gpaiIndicators, possibleModes } = report.assessmentHints;
+    const lines = ["## Assessment Hints", ""];
+    if (gpaiIndicators.length === 0 && riskIndicators.length === 0 && possibleModes.length === 0) {
+        lines.push("No assessment hints generated (no AI detected).");
+        return lines.join("\n");
+    }
+    if (possibleModes.length > 0) {
+        lines.push(`**Possible classification modes:** ${possibleModes.join(", ")}`);
+        lines.push("");
+    }
+    if (gpaiIndicators.length > 0) {
+        lines.push("### GPAI Indicators");
+        lines.push("");
+        for (const hint of gpaiIndicators) {
+            const ref = hint.articleRef ? ` (${hint.articleRef})` : "";
+            lines.push(`- ${hint.hint}${ref}`);
+        }
+        lines.push("");
+    }
+    if (riskIndicators.length > 0) {
+        lines.push("### Risk Indicators");
+        lines.push("");
+        for (const hint of riskIndicators) {
+            const ref = hint.articleRef ? ` (${hint.articleRef})` : "";
+            lines.push(`- ${hint.hint}${ref}`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}
+function buildOpenQuestions(report) {
+    const questions = report.assessmentHints.openQuestions;
+    const lines = ["## Open Questions", ""];
+    if (questions.length === 0) {
+        lines.push("No open questions.");
+        return lines.join("\n");
+    }
+    questions.forEach((q, i) => {
+        lines.push(`${i + 1}. ${q}`);
+    });
+    return lines.join("\n");
+}
+function buildRecommendedActions(report) {
+    const lines = ["## Recommended Actions", ""];
+    if (report.recommendationSummary.length === 0) {
+        lines.push("No recommended actions.");
+        return lines.join("\n");
+    }
+    for (const rec of report.recommendationSummary) {
+        lines.push(`- ${rec}`);
+    }
+    return lines.join("\n");
+}
+function buildFooter() {
+    return ["---", "*Full details: `euconform.report.json` -- AI BOM: `euconform.aibom.json`*"].join("\n");
+}
+// ---------------------------------------------------------------------------
+// Main export
+// ---------------------------------------------------------------------------
+export function generateSummaryMarkdown(report, aibom, scanScope) {
+    const sections = [
+        buildHeader(report, scanScope),
+        buildProjectOverview(report),
+        buildAiComponents(aibom),
+        buildComplianceSignals(report),
+        buildAssessmentHints(report),
+        buildOpenQuestions(report),
+        buildRecommendedActions(report),
+        buildFooter(),
+    ];
+    return `${sections.join("\n\n")}\n`;
+}

package/dist/evidence/output.d.ts

@@ -0,0 +1,13 @@
+/**
+ * EuConform Evidence Engine — Output Generation
+ *
+ * Transforms a ScanResult into a ScanOutput containing:
+ * - ScanReport (euconform.report.v1)
+ * - AiBillOfMaterials (euconform.aibom.v1)
+ * - summaryMarkdown
+ *
+ * Pure function — no side effects, no filesystem operations.
+ */
+import type { ScanOutput, ScanResult } from "./types";
+export declare function generateScanOutput(scanResult: ScanResult): ScanOutput;
+//# sourceMappingURL=output.d.ts.map

package/dist/evidence/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAkoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}