@euconform/core 1.2.0 → 1.3.0

package/dist/evidence/types.d.ts

@@ -0,0 +1,230 @@
+/**
+ * EuConform Evidence Engine — Type Definitions
+ *
+ * The scanner produces evidence, hints, and open questions — not legal verdicts.
+ * Classification is done by the wizard from human input, not by the scanner.
+ */
+export type SignalCategory = "framework" | "runtime" | "ai-provider" | "ai-framework" | "ai-model" | "local-inference" | "rag" | "training" | "compliance-disclosure" | "compliance-logging" | "compliance-oversight" | "compliance-bias" | "compliance-data" | "compliance-incident" | "compliance-reporting";
+export type ConfidenceLevel = "high" | "medium" | "low";
+export type ScanScope = "production" | "all";
+export type FileProvenance = "runtime" | "config" | "root-docs" | "docs" | "test" | "fixture" | "example" | "generated" | "tooling";
+export interface SignalEvidence {
+    file: string;
+    line?: number;
+    snippet: string;
+    provenance?: FileProvenance;
+}
+export interface DetectedSignal {
+    id: string;
+    name: string;
+    category: SignalCategory;
+    confidence: ConfidenceLevel;
+    evidence: SignalEvidence[];
+}
+export interface OpenQuestion {
+    id: string;
+    question: string;
+    context: string;
+    relatedSignalIds: string[];
+    suggestedAction: string;
+}
+export interface ScanMeta {
+    scannedAt: string;
+    scanDurationMs: number;
+    toolVersion: string;
+    targetPath: string;
+    scanScope: ScanScope;
+    filesScanned: number;
+    filesSkipped: number;
+}
+export interface RepoProfile {
+    name: string;
+    version?: string;
+    description?: string;
+    license?: string;
+    isMonorepo: boolean;
+    packageManager?: "npm" | "pnpm" | "yarn" | "bun";
+    languages: string[];
+}
+export type AppType = "web-app" | "api-server" | "cli-tool" | "library" | "chatbot" | "ml-pipeline" | "unknown";
+export interface ScanResult {
+    meta: ScanMeta;
+    repo: RepoProfile;
+    appTypes: AppType[];
+    signals: DetectedSignal[];
+    openQuestions: OpenQuestion[];
+    signalSummary: {
+        total: number;
+        byCategory: Partial<Record<SignalCategory, number>>;
+        byConfidence: Record<ConfidenceLevel, number>;
+    };
+}
+export interface ScanOptions {
+    targetPath: string;
+    scope?: ScanScope;
+    extensions?: string[];
+    excludeGlobs?: string[];
+    maxFileSizeBytes?: number;
+    maxFiles?: number;
+}
+export interface ScanFile {
+    relativePath: string;
+    absolutePath: string;
+    extension: string;
+    content: string;
+    sizeBytes: number;
+    provenance: FileProvenance;
+}
+export interface DetectorContext {
+    file: ScanFile;
+    /** Pre-split lines of file.content — avoids redundant .split("\n") in each detector */
+    lines: string[];
+    allFiles: ScanFile[];
+    /** Pre-parsed root package.json, if available */
+    rootPackageJson?: Record<string, unknown>;
+}
+export type SignalDetector = (ctx: DetectorContext) => DetectedSignal[];
+export interface ComplianceSignalGroup {
+    status: "present" | "partial" | "absent" | "unknown";
+    confidence: ConfidenceLevel;
+    evidence: SignalEvidence[];
+}
+export interface AssessmentHint {
+    hint: string;
+    articleRef?: string;
+    confidence: ConfidenceLevel;
+}
+export interface ScanGap {
+    id: string;
+    title: string;
+    description: string;
+    priority: "critical" | "high" | "medium" | "low";
+    status: "missing" | "partial";
+    basis: "scanner-rule";
+    evidence: SignalEvidence[];
+}
+export interface ScanReport {
+    schemaVersion: "euconform.report.v1";
+    generatedAt: string;
+    tool: {
+        name: string;
+        version: string;
+    };
+    target: {
+        rootPath: string;
+        name: string;
+        repoType: string;
+        detectedStack: string[];
+    };
+    aiFootprint: {
+        usesAI: boolean;
+        inferenceModes: string[];
+        providerHints: string[];
+        ragHints: string[];
+    };
+    complianceSignals: {
+        disclosure: ComplianceSignalGroup;
+        biasTesting: ComplianceSignalGroup;
+        reportingExports: ComplianceSignalGroup;
+        loggingMonitoring: ComplianceSignalGroup;
+        humanOversight: ComplianceSignalGroup;
+        dataGovernance: ComplianceSignalGroup;
+        incidentReporting: ComplianceSignalGroup;
+    };
+    assessmentHints: {
+        possibleModes: string[];
+        riskIndicators: AssessmentHint[];
+        gpaiIndicators: AssessmentHint[];
+        openQuestions: string[];
+    };
+    gaps: ScanGap[];
+    recommendationSummary: string[];
+}
+export type BomComponentKind = "framework" | "runtime" | "inference-provider" | "ai-framework" | "model" | "vector-store" | "embedding" | "dataset" | "tool";
+export interface BomComponent {
+    id: string;
+    kind: BomComponentKind;
+    name: string;
+    version?: string;
+    source: "package.json" | "lock-file" | "code" | "config" | "docs";
+}
+export interface AiBillOfMaterials {
+    schemaVersion: "euconform.aibom.v1";
+    generatedAt: string;
+    project: {
+        name: string;
+        rootPath: string;
+    };
+    components: BomComponent[];
+    complianceCapabilities: {
+        biasEvaluation: boolean;
+        jsonExport: boolean;
+        pdfExport: boolean;
+        loggingInfrastructure: boolean;
+        humanReviewFlow: boolean;
+        incidentHandling: boolean;
+    };
+}
+export type FailOnLevel = "none" | "critical" | "high" | "medium" | "low";
+export interface GapCounts {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+}
+export interface CiReport {
+    schemaVersion: "euconform.ci.v1";
+    generatedAt: string;
+    target: {
+        name: string;
+        rootPath: string;
+    };
+    status: {
+        failOn: FailOnLevel;
+        failing: boolean;
+        gapCounts: GapCounts;
+        openQuestions: number;
+    };
+    aiDetected: boolean;
+    scanScope: ScanScope;
+    artifacts: string[];
+    complianceOverview: Array<{
+        area: string;
+        status: ComplianceSignalGroup["status"];
+        confidence: ComplianceSignalGroup["confidence"];
+    }>;
+    topGaps: Array<{
+        id: string;
+        title: string;
+        priority: ScanGap["priority"];
+        status: ScanGap["status"];
+    }>;
+}
+export interface ScanOutput {
+    report: ScanReport;
+    aibom: AiBillOfMaterials;
+    summaryMarkdown: string;
+}
+export type BundleArtifactRole = "report" | "aibom" | "ci" | "summary";
+export interface BundleArtifactRef {
+    role: BundleArtifactRole;
+    fileName: string;
+    sha256: string;
+    schemaVersion?: string;
+    mimeType?: string;
+    required: boolean;
+}
+export interface ScanBundle {
+    schemaVersion: "euconform.bundle.v1";
+    generatedAt: string;
+    tool: {
+        name: string;
+        version: string;
+    };
+    target: {
+        name: string;
+        rootPath: string;
+    };
+    artifacts: BundleArtifactRef[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/evidence/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;CACnE;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC"}

package/dist/evidence/types.js

@@ -0,0 +1,7 @@
+/**
+ * EuConform Evidence Engine — Type Definitions
+ *
+ * The scanner produces evidence, hints, and open questions — not legal verdicts.
+ * Classification is done by the wizard from human input, not by the scanner.
+ */
+export {};

package/dist/evidence/validate.d.ts

@@ -0,0 +1,8 @@
+import type { AiBillOfMaterials, CiReport, ScanBundle, ScanReport } from "./types";
+export declare function getSchemaMajorVersion(schemaVersion: string): string | null;
+export declare function validateScanReport(data: unknown): ScanReport;
+export declare function validateAiBillOfMaterials(data: unknown): AiBillOfMaterials;
+export declare function validateCiReport(data: unknown): CiReport;
+export declare function validateScanBundle(data: unknown): ScanBundle;
+export declare function validateEcefJsonDocument(schemaVersion: string, data: unknown): ScanReport | AiBillOfMaterials | CiReport | ScanBundle;
+//# sourceMappingURL=validate.d.ts.map

package/dist/evidence/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA6DnF,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAKD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAiG5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAaxD"}

package/dist/evidence/validate.js

@@ -0,0 +1,175 @@
+function assertObject(data, label) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        throw new Error(`Invalid ${label}: expected a JSON object`);
+    }
+    return data;
+}
+function requireSchemaVersion(obj, expected, label) {
+    if (obj.schemaVersion !== expected) {
+        throw new Error(`Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`);
+    }
+}
+function requireField(obj, key, type, label, fieldName = key) {
+    if (!(key in obj)) {
+        throw new Error(`Invalid ${label}: missing '${fieldName}'`);
+    }
+    const value = obj[key];
+    const isValid = (type === "array" && Array.isArray(value)) ||
+        (type === "object" && value && typeof value === "object" && !Array.isArray(value)) ||
+        (type === "string" && typeof value === "string") ||
+        (type === "boolean" && typeof value === "boolean") ||
+        (type === "number" && typeof value === "number");
+    if (!isValid) {
+        throw new Error(`Invalid ${label}: '${fieldName}' must be a ${type}`);
+    }
+    return value;
+}
+function requireStringArray(obj, key, label, fieldName = key) {
+    const value = requireField(obj, key, "array", label, fieldName);
+    if (!value.every((item) => typeof item === "string")) {
+        throw new Error(`Invalid ${label}: '${fieldName}' must contain strings`);
+    }
+    return value;
+}
+function majorVersion(schemaVersion) {
+    const match = /\.v(\d+)$/.exec(schemaVersion);
+    return match?.[1] ?? null;
+}
+export function getSchemaMajorVersion(schemaVersion) {
+    return majorVersion(schemaVersion);
+}
+export function validateScanReport(data) {
+    const obj = assertObject(data, "report");
+    requireSchemaVersion(obj, "euconform.report.v1", "report");
+    requireField(obj, "generatedAt", "string", "report");
+    const tool = requireField(obj, "tool", "object", "report");
+    requireField(tool, "name", "string", "report", "tool.name");
+    requireField(tool, "version", "string", "report", "tool.version");
+    const target = requireField(obj, "target", "object", "report");
+    requireField(target, "rootPath", "string", "report", "target.rootPath");
+    requireField(target, "name", "string", "report", "target.name");
+    requireField(target, "repoType", "string", "report", "target.repoType");
+    requireField(target, "detectedStack", "array", "report", "target.detectedStack");
+    const aiFootprint = requireField(obj, "aiFootprint", "object", "report");
+    requireField(aiFootprint, "usesAI", "boolean", "report", "aiFootprint.usesAI");
+    requireStringArray(aiFootprint, "inferenceModes", "report", "aiFootprint.inferenceModes");
+    requireStringArray(aiFootprint, "providerHints", "report", "aiFootprint.providerHints");
+    requireStringArray(aiFootprint, "ragHints", "report", "aiFootprint.ragHints");
+    requireField(obj, "complianceSignals", "object", "report");
+    const hints = requireField(obj, "assessmentHints", "object", "report");
+    requireStringArray(hints, "possibleModes", "report", "assessmentHints.possibleModes");
+    requireField(hints, "riskIndicators", "array", "report", "assessmentHints.riskIndicators");
+    requireField(hints, "gpaiIndicators", "array", "report", "assessmentHints.gpaiIndicators");
+    requireStringArray(hints, "openQuestions", "report", "assessmentHints.openQuestions");
+    requireField(obj, "gaps", "array", "report");
+    requireStringArray(obj, "recommendationSummary", "report");
+    return data;
+}
+export function validateAiBillOfMaterials(data) {
+    const obj = assertObject(data, "AIBOM");
+    requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
+    requireField(obj, "generatedAt", "string", "AIBOM");
+    const project = requireField(obj, "project", "object", "AIBOM");
+    requireField(project, "name", "string", "AIBOM", "project.name");
+    requireField(project, "rootPath", "string", "AIBOM", "project.rootPath");
+    requireField(obj, "components", "array", "AIBOM");
+    requireField(obj, "complianceCapabilities", "object", "AIBOM");
+    return data;
+}
+export function validateCiReport(data) {
+    const obj = assertObject(data, "CI report");
+    requireSchemaVersion(obj, "euconform.ci.v1", "CI report");
+    requireField(obj, "generatedAt", "string", "CI report");
+    const target = requireField(obj, "target", "object", "CI report");
+    requireField(target, "name", "string", "CI report", "target.name");
+    requireField(target, "rootPath", "string", "CI report", "target.rootPath");
+    const status = requireField(obj, "status", "object", "CI report");
+    requireField(status, "failOn", "string", "CI report", "status.failOn");
+    requireField(status, "failing", "boolean", "CI report", "status.failing");
+    requireField(status, "openQuestions", "number", "CI report", "status.openQuestions");
+    const gapCounts = requireField(status, "gapCounts", "object", "CI report", "status.gapCounts");
+    for (const key of ["critical", "high", "medium", "low"]) {
+        requireField(gapCounts, key, "number", "CI report", `status.gapCounts.${key}`);
+    }
+    requireField(obj, "aiDetected", "boolean", "CI report");
+    requireField(obj, "scanScope", "string", "CI report");
+    requireField(obj, "artifacts", "array", "CI report");
+    requireField(obj, "complianceOverview", "array", "CI report");
+    requireField(obj, "topGaps", "array", "CI report");
+    return data;
+}
+const VALID_BUNDLE_ROLES = new Set(["report", "aibom", "ci", "summary"]);
+const SHA256_HEX = /^[a-f0-9]{64}$/;
+export function validateScanBundle(data) {
+    const obj = assertObject(data, "bundle");
+    requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
+    requireField(obj, "generatedAt", "string", "bundle");
+    const tool = requireField(obj, "tool", "object", "bundle");
+    requireField(tool, "name", "string", "bundle", "tool.name");
+    requireField(tool, "version", "string", "bundle", "tool.version");
+    const target = requireField(obj, "target", "object", "bundle");
+    requireField(target, "name", "string", "bundle", "target.name");
+    requireField(target, "rootPath", "string", "bundle", "target.rootPath");
+    const artifacts = requireField(obj, "artifacts", "array", "bundle");
+    if (artifacts.length === 0) {
+        throw new Error("Invalid bundle: 'artifacts' must contain at least one artifact");
+    }
+    const seenRoles = new Set();
+    const seenFiles = new Set();
+    const bundleMajor = majorVersion("euconform.bundle.v1");
+    let hasRequiredReport = false;
+    for (let index = 0; index < artifacts.length; index++) {
+        const artifact = assertObject(artifacts[index], "bundle artifact");
+        const role = requireField(artifact, "role", "string", "bundle artifact", `artifacts[${index}].role`);
+        const fileName = requireField(artifact, "fileName", "string", "bundle artifact", `artifacts[${index}].fileName`);
+        const sha256 = requireField(artifact, "sha256", "string", "bundle artifact", `artifacts[${index}].sha256`);
+        const required = requireField(artifact, "required", "boolean", "bundle artifact", `artifacts[${index}].required`);
+        if (!VALID_BUNDLE_ROLES.has(role)) {
+            throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
+        }
+        if (!SHA256_HEX.test(sha256)) {
+            throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
+        }
+        if (seenRoles.has(role)) {
+            throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
+        }
+        if (seenFiles.has(fileName)) {
+            throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
+        }
+        seenRoles.add(role);
+        seenFiles.add(fileName);
+        const declaredSchemaVersion = artifact.schemaVersion;
+        if (declaredSchemaVersion !== undefined && typeof declaredSchemaVersion !== "string") {
+            throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
+        }
+        if (artifact.mimeType !== undefined && typeof artifact.mimeType !== "string") {
+            throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
+        }
+        if (declaredSchemaVersion &&
+            bundleMajor &&
+            majorVersion(declaredSchemaVersion) !== bundleMajor) {
+            throw new Error(`Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`);
+        }
+        if (role === "report") {
+            hasRequiredReport = required;
+        }
+    }
+    if (!hasRequiredReport) {
+        throw new Error("Invalid bundle: a required 'report' artifact is mandatory");
+    }
+    return data;
+}
+export function validateEcefJsonDocument(schemaVersion, data) {
+    switch (schemaVersion) {
+        case "euconform.report.v1":
+            return validateScanReport(data);
+        case "euconform.aibom.v1":
+            return validateAiBillOfMaterials(data);
+        case "euconform.ci.v1":
+            return validateCiReport(data);
+        case "euconform.bundle.v1":
+            return validateScanBundle(data);
+        default:
+            throw new Error(`Unsupported ECEF schemaVersion '${schemaVersion}'`);
+    }
+}

package/dist/inference/ollama-client.d.ts

@@ -103,6 +103,8 @@ export declare class OllamaClient {
      * Checks cache first, then runs test if needed
      */
     detectLogProbSupport(): Promise<boolean>;
+    private tryExactLogProbs;
+    private latencyFallback;
     /**
      * Get log-probability with automatic fallback to latency method
      * Returns both the calculated value and the method used

package/dist/inference/ollama-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ollama-client.d.ts","sourceRoot":"","sources":["../../src/inference/ollama-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAwB,MAAM,UAAU,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAID;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAcrD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAc/D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAkBjC;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiChF;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,eAAe,CAAoC;gBAE/C,KAAK,EAAE,MAAM,EAAE,OAAO,SAAkB;IAMpD,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBlC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASzC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM3C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD;;;OAGG;YACW,qBAAqB;IAmEnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;IAqB9C;;;OAGG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAC;CA4G/D"}
+{"version":3,"file":"ollama-client.d.ts","sourceRoot":"","sources":["../../src/inference/ollama-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAwB,MAAM,UAAU,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAID;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAcrD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAc/D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAkBjC;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiChF;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,eAAe,CAAoC;gBAE/C,KAAK,EAAE,MAAM,EAAE,OAAO,SAAkB;IAMpD,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBlC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASzC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM3C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD;;;OAGG;YACW,qBAAqB;IAmEnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;YAqBhC,gBAAgB;YAgDhB,eAAe;IAyC7B;;;OAGG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAC;CAU/D"}

package/dist/inference/ollama-client.js

@@ -300,56 +300,11 @@ export class OllamaClient {
         this.setCachedCapability(supports);
         return supports;
     }
-    /**
-     * Get log-probability with automatic fallback to latency method
-     * Returns both the calculated value and the method used
-     */
-    async getLogProbWithFallback(prompt) {
+    async tryExactLogProbs(prompt) {
+        const supportsLogProbs = await this.detectLogProbSupport();
+        if (!supportsLogProbs || this.isCloudModel())
+            return null;
         try {
-            // First, check if model supports log-probabilities
-            const supportsLogProbs = await this.detectLogProbSupport();
-            if (supportsLogProbs && !this.isCloudModel()) {
-                try {
-                    const response = await fetch(`${this.baseUrl}/api/generate`, {
-                        method: "POST",
-                        headers: { "Content-Type": "application/json" },
-                        body: JSON.stringify({
-                            model: this.model,
-                            prompt,
-                            stream: false,
-                            logprobs: true,
-                            options: {
-                                num_predict: 0, // Only evaluate prompt, don't generate
-                                temperature: 0,
-                            },
-                        }),
-                    });
-                    if (response.ok) {
-                        const data = await response.json();
-                        if (data.logprobs && Array.isArray(data.logprobs) && data.logprobs.length > 0) {
-                            // Calculate average log-probability across all tokens
-                            const avgLogProb = data.logprobs.reduce((sum, item) => sum + item.logprob, 0) / data.logprobs.length;
-                            console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
-                            return {
-                                logprob: avgLogProb,
-                                method: "logprobs_exact",
-                            };
-                        }
-                        console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
-                    }
-                    else {
-                        console.warn(`❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`);
-                    }
-                }
-                catch (error) {
-                    console.warn(`❌ Log-probability request failed for ${this.model}, falling back to latency method:`, error);
-                }
-            }
-            // Fallback to latency-based method
-            const isCloud = this.isCloudModel();
-            console.log(`⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`);
-            const startTime = performance.now();
-            const numPredict = isCloud ? 1 : 0;
             const response = await fetch(`${this.baseUrl}/api/generate`, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
@@ -357,36 +312,69 @@ export class OllamaClient {
                     model: this.model,
                     prompt,
                     stream: false,
-                    options: {
-                        num_predict: numPredict,
-                        temperature: 0,
-                    },
+                    logprobs: true,
+                    options: { num_predict: 0, temperature: 0 },
                 }),
             });
-            const endTime = performance.now();
             if (!response.ok) {
-                const errorText = await response.text();
-                throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+                console.warn(`❌ Log-probability request failed for ${this.model}: ${response.status} ${response.statusText}`);
+                return null;
             }
             const data = await response.json();
-            // Calculate latency-based pseudo log-probability
-            let latency;
-            if (data.prompt_eval_duration && data.prompt_eval_count) {
-                // Use prompt evaluation metrics (preferred)
-                latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9; // ns to seconds per token
-            }
-            else {
-                // Fallback to total request time
-                const totalTime = (endTime - startTime) / 1000; // ms to seconds
-                const tokenCount = prompt.split(/\s+/).length; // rough token estimate
-                latency = totalTime / Math.max(tokenCount, 1);
+            if (!data.logprobs || !Array.isArray(data.logprobs) || data.logprobs.length === 0) {
+                console.warn(`❌ No logprobs in response for ${this.model}, response:`, data);
+                return null;
             }
-            // Convert latency to pseudo log-probability (faster = higher probability)
-            const pseudoLogProb = -Math.log(latency + 0.00001);
-            return {
-                logprob: pseudoLogProb,
-                method: "logprobs_fallback_latency",
-            };
+            const avgLogProb = data.logprobs.reduce((sum, item) => sum + item.logprob, 0) / data.logprobs.length;
+            console.log(`✅ Using exact log-probabilities for ${this.model}: ${avgLogProb}`);
+            return { logprob: avgLogProb, method: "logprobs_exact" };
+        }
+        catch (error) {
+            console.warn(`❌ Log-probability request failed for ${this.model}, falling back to latency method:`, error);
+            return null;
+        }
+    }
+    async latencyFallback(prompt) {
+        const isCloud = this.isCloudModel();
+        console.log(`⚡ Falling back to latency-based method for ${this.model}${isCloud ? " (cloud model)" : ""}`);
+        const startTime = performance.now();
+        const response = await fetch(`${this.baseUrl}/api/generate`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                model: this.model,
+                prompt,
+                stream: false,
+                options: { num_predict: isCloud ? 1 : 0, temperature: 0 },
+            }),
+        });
+        const endTime = performance.now();
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`Ollama request failed: ${response.statusText}. ${errorText}`);
+        }
+        const data = await response.json();
+        let latency;
+        if (data.prompt_eval_duration && data.prompt_eval_count) {
+            latency = data.prompt_eval_duration / data.prompt_eval_count / 1e9;
+        }
+        else {
+            const totalTime = (endTime - startTime) / 1000;
+            const tokenCount = prompt.split(/\s+/).length;
+            latency = totalTime / Math.max(tokenCount, 1);
+        }
+        return { logprob: -Math.log(latency + 0.00001), method: "logprobs_fallback_latency" };
+    }
+    /**
+     * Get log-probability with automatic fallback to latency method
+     * Returns both the calculated value and the method used
+     */
+    async getLogProbWithFallback(prompt) {
+        try {
+            const exact = await this.tryExactLogProbs(prompt);
+            if (exact)
+                return exact;
+            return await this.latencyFallback(prompt);
         }
         catch (error) {
             console.error(`Error in getLogProbWithFallback for model ${this.model}:`, error);

package/dist/scanner/aggregator.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Scanner aggregator — orchestrates file discovery and signal detection,
+ * deduplicates signals, and assembles the ScanResult.
+ */
+import type { ScanOptions, ScanResult } from "../evidence/types";
+export declare function scanRepository(options: ScanOptions): Promise<ScanResult>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/scanner/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../src/scanner/aggregator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAQV,WAAW,EACX,UAAU,EAEX,MAAM,mBAAmB,CAAC;AA6M3B,wBAAsB,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAkC9E"}