@euconform/core 1.3.0 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/.turbo/turbo-build.log +1 -1
  2. package/CHANGELOG.md +24 -0
  3. package/assets/datasets/crows-pairs-de.json +613 -0
  4. package/assets/datasets/crows-pairs-en.json +9055 -0
  5. package/dist/datasets/crows-pairs.d.ts +7 -0
  6. package/dist/datasets/crows-pairs.d.ts.map +1 -0
  7. package/dist/datasets/crows-pairs.js +41 -0
  8. package/dist/evidence/output.d.ts.map +1 -1
  9. package/dist/evidence/output.js +1 -0
  10. package/dist/evidence/types.d.ts +8 -2
  11. package/dist/evidence/types.d.ts.map +1 -1
  12. package/dist/evidence/validate.d.ts.map +1 -1
  13. package/dist/evidence/validate.js +59 -39
  14. package/dist/index.d.ts +1 -1
  15. package/dist/index.d.ts.map +1 -1
  16. package/dist/inference/index.d.ts +1 -1
  17. package/dist/inference/index.d.ts.map +1 -1
  18. package/dist/inference/index.js +1 -1
  19. package/dist/inference/ollama-client.d.ts +9 -3
  20. package/dist/inference/ollama-client.d.ts.map +1 -1
  21. package/dist/inference/ollama-client.js +23 -11
  22. package/dist/sbom/component-mapper.d.ts +26 -0
  23. package/dist/sbom/component-mapper.d.ts.map +1 -0
  24. package/dist/sbom/component-mapper.js +83 -0
  25. package/dist/sbom/cyclonedx-import.d.ts +34 -0
  26. package/dist/sbom/cyclonedx-import.d.ts.map +1 -0
  27. package/dist/sbom/cyclonedx-import.js +131 -0
  28. package/dist/sbom/index.d.ts +6 -0
  29. package/dist/sbom/index.d.ts.map +1 -0
  30. package/dist/sbom/index.js +4 -0
  31. package/dist/sbom/known-packages.d.ts +13 -0
  32. package/dist/sbom/known-packages.d.ts.map +1 -0
  33. package/dist/sbom/known-packages.js +129 -0
  34. package/dist/sbom/purl.d.ts +14 -0
  35. package/dist/sbom/purl.d.ts.map +1 -0
  36. package/dist/sbom/purl.js +56 -0
  37. package/dist/sbom/types.d.ts +39 -0
  38. package/dist/sbom/types.d.ts.map +1 -0
  39. package/dist/sbom/types.js +5 -0
  40. package/dist/validation/index.d.ts +2 -0
  41. package/dist/validation/index.d.ts.map +1 -0
  42. package/dist/validation/index.js +1 -0
  43. package/dist/validation/schema-validator.d.ts +18 -0
  44. package/dist/validation/schema-validator.d.ts.map +1 -0
  45. package/dist/validation/schema-validator.js +99 -0
  46. package/package.json +8 -2
  47. package/src/datasets/crows-pairs.ts +64 -0
  48. package/src/evidence/output.ts +1 -0
  49. package/src/evidence/types.ts +9 -2
  50. package/src/evidence/validate.ts +107 -70
  51. package/src/index.ts +1 -0
  52. package/src/inference/index.ts +6 -1
  53. package/src/inference/ollama-client.ts +30 -14
  54. package/src/sbom/component-mapper.ts +107 -0
  55. package/src/sbom/cyclonedx-import.ts +198 -0
  56. package/src/sbom/index.ts +12 -0
  57. package/src/sbom/known-packages.ts +142 -0
  58. package/src/sbom/purl.ts +66 -0
  59. package/src/sbom/types.ts +34 -0
  60. package/src/validation/index.ts +7 -0
  61. package/src/validation/schema-validator.ts +133 -0
  62. package/tests/evidence/{ecef-schemas.test.ts → spec-schemas.test.ts} +3 -3
  63. package/tests/fixtures/cyclonedx-minimal.json +13 -0
  64. package/tests/fixtures/cyclonedx-mixed.json +17 -0
  65. package/tests/fixtures/cyclonedx-ml-bom.json +25 -0
  66. package/tests/sbom/component-mapper.test.ts +258 -0
  67. package/tests/sbom/cyclonedx-import.test.ts +329 -0
  68. package/tests/sbom/purl.test.ts +102 -0
  69. package/tests/validation/schema-validator.test.ts +219 -0
@@ -0,0 +1,7 @@
1
+ import type { CrowsPairsEntry } from "../types";
2
+ /**
3
+ * Load CrowS-Pairs dataset from bundled assets.
4
+ * Converts the structured JSON format to CrowsPairsEntry[] for the bias engine.
5
+ */
6
+ export declare function loadCrowsPairsDataset(language: "en" | "de"): CrowsPairsEntry[];
7
+ //# sourceMappingURL=crows-pairs.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"crows-pairs.d.ts","sourceRoot":"","sources":["../../src/datasets/crows-pairs.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AA6ChD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,eAAe,EAAE,CAW9E"}
@@ -0,0 +1,41 @@
1
+ import { existsSync, readFileSync } from "node:fs";
2
+ import { dirname, resolve } from "node:path";
3
+ import { fileURLToPath } from "node:url";
4
+ function findDatasetPath(language) {
5
+ const fileName = `crows-pairs-${language}.json`;
6
+ // Strategy 1: Relative to this source file (works in unbundled tsc builds)
7
+ const currentDir = dirname(fileURLToPath(import.meta.url));
8
+ const fromSource = resolve(currentDir, `../../assets/datasets/${fileName}`);
9
+ if (existsSync(fromSource))
10
+ return fromSource;
11
+ // Strategy 2: Relative to process.cwd() (works in monorepo context)
12
+ const fromCwd = resolve(process.cwd(), `packages/core/assets/datasets/${fileName}`);
13
+ if (existsSync(fromCwd))
14
+ return fromCwd;
15
+ // Strategy 3: Walk up from the entry script to find the monorepo root
16
+ if (process.argv[1]) {
17
+ let dir = dirname(resolve(process.argv[1]));
18
+ for (let i = 0; i < 5; i++) {
19
+ const candidate = resolve(dir, `packages/core/assets/datasets/${fileName}`);
20
+ if (existsSync(candidate))
21
+ return candidate;
22
+ dir = dirname(dir);
23
+ }
24
+ }
25
+ throw new Error(`CrowS-Pairs dataset (${language}) not found. Ensure packages/core/assets/datasets/ exists.`);
26
+ }
27
+ /**
28
+ * Load CrowS-Pairs dataset from bundled assets.
29
+ * Converts the structured JSON format to CrowsPairsEntry[] for the bias engine.
30
+ */
31
+ export function loadCrowsPairsDataset(language) {
32
+ const filePath = findDatasetPath(language);
33
+ const raw = readFileSync(filePath, "utf-8");
34
+ const dataset = JSON.parse(raw);
35
+ return dataset.pairs.map((pair) => ({
36
+ id: pair.id,
37
+ sent_more: pair.stereotype,
38
+ sent_less: pair.antiStereotype,
39
+ bias_type: pair.biasType,
40
+ }));
41
+ }
@@ -1 +1 @@
1
- {"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAkoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}
1
+ {"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAmoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}
@@ -59,6 +59,7 @@ const SOURCE_PRIORITY = {
59
59
  config: 4,
60
60
  code: 3,
61
61
  "lock-file": 2,
62
+ "sbom-import": 2,
62
63
  docs: 1,
63
64
  };
64
65
  const EVIDENCE_PROVENANCE_PRIORITY = {
@@ -146,10 +146,15 @@ export interface BomComponent {
146
146
  kind: BomComponentKind;
147
147
  name: string;
148
148
  version?: string;
149
- source: "package.json" | "lock-file" | "code" | "config" | "docs";
149
+ source: "package.json" | "lock-file" | "code" | "config" | "docs" | "sbom-import";
150
+ }
151
+ export interface AibomMetadata {
152
+ importSource: "cyclonedx" | "spdx" | "manual";
153
+ importTool?: string;
154
+ originalTimestamp?: string;
150
155
  }
151
156
  export interface AiBillOfMaterials {
152
- schemaVersion: "euconform.aibom.v1";
157
+ schemaVersion: "euconform.aibom.v1" | "euconform.aibom.v1.1";
153
158
  generatedAt: string;
154
159
  project: {
155
160
  name: string;
@@ -164,6 +169,7 @@ export interface AiBillOfMaterials {
164
169
  humanReviewFlow: boolean;
165
170
  incidentHandling: boolean;
166
171
  };
172
+ metadata?: AibomMetadata;
167
173
  }
168
174
  export type FailOnLevel = "none" | "critical" | "high" | "medium" | "low";
169
175
  export interface GapCounts {
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;CACnE;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;CACnF;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC"}
@@ -1 +1 @@
1
- {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA6DnF,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAKD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAiG5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAaxD"}
1
+ {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAmEnF,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAoGD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAgC5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAcxD"}
@@ -5,8 +5,10 @@ function assertObject(data, label) {
5
5
  return data;
6
6
  }
7
7
  function requireSchemaVersion(obj, expected, label) {
8
- if (obj.schemaVersion !== expected) {
9
- throw new Error(`Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`);
8
+ const allowed = Array.isArray(expected) ? expected : [expected];
9
+ if (!allowed.includes(obj.schemaVersion)) {
10
+ const quoted = allowed.map((v) => `"${v}"`).join(" or ");
11
+ throw new Error(`Invalid ${label} schema version: expected ${quoted}, got "${String(obj.schemaVersion)}"`);
10
12
  }
11
13
  }
12
14
  function requireField(obj, key, type, label, fieldName = key) {
@@ -67,7 +69,7 @@ export function validateScanReport(data) {
67
69
  }
68
70
  export function validateAiBillOfMaterials(data) {
69
71
  const obj = assertObject(data, "AIBOM");
70
- requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
72
+ requireSchemaVersion(obj, ["euconform.aibom.v1", "euconform.aibom.v1.1"], "AIBOM");
71
73
  requireField(obj, "generatedAt", "string", "AIBOM");
72
74
  const project = requireField(obj, "project", "object", "AIBOM");
73
75
  requireField(project, "name", "string", "AIBOM", "project.name");
@@ -100,8 +102,47 @@ export function validateCiReport(data) {
100
102
  }
101
103
  const VALID_BUNDLE_ROLES = new Set(["report", "aibom", "ci", "summary"]);
102
104
  const SHA256_HEX = /^[a-f0-9]{64}$/;
103
- export function validateScanBundle(data) {
104
- const obj = assertObject(data, "bundle");
105
+ function readBundleArtifactFields(raw, index) {
106
+ const scope = "bundle artifact";
107
+ const role = requireField(raw, "role", "string", scope, `artifacts[${index}].role`);
108
+ const fileName = requireField(raw, "fileName", "string", scope, `artifacts[${index}].fileName`);
109
+ const sha256 = requireField(raw, "sha256", "string", scope, `artifacts[${index}].sha256`);
110
+ const required = requireField(raw, "required", "boolean", scope, `artifacts[${index}].required`);
111
+ const declaredSchemaVersion = raw.schemaVersion;
112
+ if (declaredSchemaVersion !== undefined && typeof declaredSchemaVersion !== "string") {
113
+ throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
114
+ }
115
+ if (raw.mimeType !== undefined && typeof raw.mimeType !== "string") {
116
+ throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
117
+ }
118
+ return {
119
+ role,
120
+ fileName,
121
+ sha256,
122
+ required,
123
+ declaredSchemaVersion: declaredSchemaVersion,
124
+ mimeType: raw.mimeType,
125
+ };
126
+ }
127
+ function assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor) {
128
+ const { role, fileName, sha256, declaredSchemaVersion } = fields;
129
+ if (!VALID_BUNDLE_ROLES.has(role)) {
130
+ throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
131
+ }
132
+ if (!SHA256_HEX.test(sha256)) {
133
+ throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
134
+ }
135
+ if (seenRoles.has(role)) {
136
+ throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
137
+ }
138
+ if (seenFiles.has(fileName)) {
139
+ throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
140
+ }
141
+ if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
142
+ throw new Error(`Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`);
143
+ }
144
+ }
145
+ function validateBundleHeader(obj) {
105
146
  requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
106
147
  requireField(obj, "generatedAt", "string", "bundle");
107
148
  const tool = requireField(obj, "tool", "object", "bundle");
@@ -110,6 +151,10 @@ export function validateScanBundle(data) {
110
151
  const target = requireField(obj, "target", "object", "bundle");
111
152
  requireField(target, "name", "string", "bundle", "target.name");
112
153
  requireField(target, "rootPath", "string", "bundle", "target.rootPath");
154
+ }
155
+ export function validateScanBundle(data) {
156
+ const obj = assertObject(data, "bundle");
157
+ validateBundleHeader(obj);
113
158
  const artifacts = requireField(obj, "artifacts", "array", "bundle");
114
159
  if (artifacts.length === 0) {
115
160
  throw new Error("Invalid bundle: 'artifacts' must contain at least one artifact");
@@ -119,39 +164,13 @@ export function validateScanBundle(data) {
119
164
  const bundleMajor = majorVersion("euconform.bundle.v1");
120
165
  let hasRequiredReport = false;
121
166
  for (let index = 0; index < artifacts.length; index++) {
122
- const artifact = assertObject(artifacts[index], "bundle artifact");
123
- const role = requireField(artifact, "role", "string", "bundle artifact", `artifacts[${index}].role`);
124
- const fileName = requireField(artifact, "fileName", "string", "bundle artifact", `artifacts[${index}].fileName`);
125
- const sha256 = requireField(artifact, "sha256", "string", "bundle artifact", `artifacts[${index}].sha256`);
126
- const required = requireField(artifact, "required", "boolean", "bundle artifact", `artifacts[${index}].required`);
127
- if (!VALID_BUNDLE_ROLES.has(role)) {
128
- throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
129
- }
130
- if (!SHA256_HEX.test(sha256)) {
131
- throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
132
- }
133
- if (seenRoles.has(role)) {
134
- throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
135
- }
136
- if (seenFiles.has(fileName)) {
137
- throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
138
- }
139
- seenRoles.add(role);
140
- seenFiles.add(fileName);
141
- const declaredSchemaVersion = artifact.schemaVersion;
142
- if (declaredSchemaVersion !== undefined && typeof declaredSchemaVersion !== "string") {
143
- throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
144
- }
145
- if (artifact.mimeType !== undefined && typeof artifact.mimeType !== "string") {
146
- throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
147
- }
148
- if (declaredSchemaVersion &&
149
- bundleMajor &&
150
- majorVersion(declaredSchemaVersion) !== bundleMajor) {
151
- throw new Error(`Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`);
152
- }
153
- if (role === "report") {
154
- hasRequiredReport = required;
167
+ const raw = assertObject(artifacts[index], "bundle artifact");
168
+ const fields = readBundleArtifactFields(raw, index);
169
+ assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor);
170
+ seenRoles.add(fields.role);
171
+ seenFiles.add(fields.fileName);
172
+ if (fields.role === "report") {
173
+ hasRequiredReport = fields.required;
155
174
  }
156
175
  }
157
176
  if (!hasRequiredReport) {
@@ -164,12 +183,13 @@ export function validateEcefJsonDocument(schemaVersion, data) {
164
183
  case "euconform.report.v1":
165
184
  return validateScanReport(data);
166
185
  case "euconform.aibom.v1":
186
+ case "euconform.aibom.v1.1":
167
187
  return validateAiBillOfMaterials(data);
168
188
  case "euconform.ci.v1":
169
189
  return validateCiReport(data);
170
190
  case "euconform.bundle.v1":
171
191
  return validateScanBundle(data);
172
192
  default:
173
- throw new Error(`Unsupported ECEF schemaVersion '${schemaVersion}'`);
193
+ throw new Error(`Unsupported EuConform Evidence Format schemaVersion '${schemaVersion}'`);
174
194
  }
175
195
  }
package/dist/index.d.ts CHANGED
@@ -8,7 +8,7 @@ export { ANNEX_III_QUESTIONS, PROHIBITED_AI_SCREENING_QUESTIONS, classifyAnnexII
8
8
  export type { AnnexIIIAnswer, AnnexIIIRiskResult, Citation, CounterfactualPair, CrowsPairsLogProbOptions, CrowsPairsLogProbResult, ChecklistStatus, DataGovernanceChecklistResult, RobustnessResult, RobustnessTestCase, Perturbation, PredictTextFn, HumanOversightRecommendation, LoggingTemplate, AnnexIVStructuredReportV1, GroupTextSample, RegardResult, RegardScorer, SensitiveAttribute, ToxicityResult, ToxicityScorer, DeadlineStatus, AffectedAudience, DeadlineObligation, DeadlinePhase, GPAIObligationType, GPAIComplianceLevel, GPAIComplianceFlag, GPAIComplianceResult, GapPriority, GapAction, GapAnalysisResult, } from "./legal-checks";
9
9
  export { classifyRisk, getComplianceGuidance, getQuizQuestions, RISK_QUIZ_QUESTIONS, } from "./risk-engine";
10
10
  export { disparateImpact, equalizedOdds, generateLoanDataset, predictiveParity, runFairnessAnalysis, statisticalParityDifference, runCrowsPairsBiasAnalysis, runComprehensiveBiasAnalysis, runCrowsPairsBiasAnalysisWithFactory, runComprehensiveBiasAnalysisWithFactory, } from "./fairness-metrics";
11
- export { detectOllama, listOllamaModels, OllamaClient, BrowserInference, checkWebGPU, BROWSER_MODELS, detectCapabilities, createInferenceClient, createAutoInferenceClient, createCapabilityDetectionService, DefaultCapabilityDetectionService, EnhancedCapabilityDetectionService, type OllamaModel, type BrowserModel, type InferenceEngine, type InferenceCapabilities, type InferenceClient, type CapabilityDetectionService, type ModelCapability, type ModelSelectionState, type CapabilityCacheEntry, type DetectionProgress, type UserPreferences, type EnhancedModelSelectionState, type CapabilityDetectionStatus, } from "./inference";
11
+ export { detectOllama, listOllamaModels, OllamaClient, BrowserInference, checkWebGPU, BROWSER_MODELS, detectCapabilities, createInferenceClient, createAutoInferenceClient, createCapabilityDetectionService, DefaultCapabilityDetectionService, EnhancedCapabilityDetectionService, type OllamaModel, type BrowserModel, type InferenceEngine, type InferenceCapabilities, type InferenceClient, type CapabilityDetectionService, type ModelCapability, type ModelSelectionState, type CapabilityCacheEntry, type DetectionProgress, type UserPreferences, type EnhancedModelSelectionState, type CapabilityDetectionStatus, type CapabilityCache, } from "./inference";
12
12
  export { InferenceFactory, createInferenceFactory, detectBestMethodForConfig, type InferenceResult, } from "./inference/inference-factory";
13
13
  export { testPair, aggregateByCategory, runStereotypeBiasTest, quickBiasCheck, type StereotypePair, type BiasType, type PairTestResult, type CategoryResult, type StereotypeBiasResult, calculateCrowsPairsBias, calculateLogProbBias, calculateLatencyBias, validateCrowsPairsDataset, } from "./metrics";
14
14
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,UAAU,EACV,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EACjC,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,wBAAwB,EACxB,iCAAiC,EACjC,mCAAmC,EACnC,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,4BAA4B,EAC5B,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,oCAAoC,EACpC,uCAAuC,GACxC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,WAAW,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,UAAU,EACV,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,mBAAmB,EACnB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EACjC,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,cAAc,EACd,cAAc,EACd,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,0BAA0B,EAC1B,wBAAwB,EACxB,iCAAiC,EACjC,mCAAmC,EACnC,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,6BAA6B,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,4BAA4B,EAC5B,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,oCAAoC,EACpC,uCAAuC,GACxC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,WAAW,CAAC"}
@@ -35,7 +35,7 @@ export declare function createInferenceClient(engine: InferenceEngine, modelId:
35
35
  * Auto-select the best available inference client
36
36
  */
37
37
  export declare function createAutoInferenceClient(preferredModel?: string): Promise<InferenceClient>;
38
- export { detectOllama, listOllamaModels, OllamaClient } from "./ollama-client";
38
+ export { detectOllama, listOllamaModels, OllamaClient, type CapabilityCache, } from "./ollama-client";
39
39
  export { BrowserInference, checkWebGPU, BROWSER_MODELS } from "./browser-inference";
40
40
  export { InferenceFactory, createInferenceFactory, detectBestMethodForConfig, type InferenceResult, } from "./inference-factory";
41
41
  export { createCapabilityDetectionService, DefaultCapabilityDetectionService, EnhancedCapabilityDetectionService, type CapabilityDetectionService, type ModelCapability, type ModelSelectionState, type CapabilityCacheEntry, type DetectionProgress, type UserPreferences, type EnhancedModelSelectionState, type CapabilityDetectionStatus, } from "./capability-detection";
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/inference/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,WAAW,EAAkC,MAAM,iBAAiB,CAAC;AAEjG,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QACN,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,EAAE,WAAW,EAAE,CAAC;KACvB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,YAAY,EAAE,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CA2BzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACxC,eAAe,CAqCjB;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAejG;AAGD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/inference/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,WAAW,EAAkC,MAAM,iBAAiB,CAAC;AAEjG,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QACN,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,EAAE,WAAW,EAAE,CAAC;KACvB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,YAAY,EAAE,CAAC;KACxB,CAAC;IACF,WAAW,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,qBAAqB,CAAC,CA2BzE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACxC,eAAe,CAqCjB;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAejG;AAGD,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC"}
@@ -91,7 +91,7 @@ export async function createAutoInferenceClient(preferredModel) {
91
91
  return createInferenceClient("demo", "demo-model");
92
92
  }
93
93
  // Re-export types and utilities
94
- export { detectOllama, listOllamaModels, OllamaClient } from "./ollama-client";
94
+ export { detectOllama, listOllamaModels, OllamaClient, } from "./ollama-client";
95
95
  export { BrowserInference, checkWebGPU, BROWSER_MODELS } from "./browser-inference";
96
96
  export { InferenceFactory, createInferenceFactory, detectBestMethodForConfig, } from "./inference-factory";
97
97
  export { createCapabilityDetectionService, DefaultCapabilityDetectionService, EnhancedCapabilityDetectionService, } from "./capability-detection";
@@ -46,6 +46,11 @@ export interface OllamaLogProbsResponse extends OllamaGenerateResponse {
46
46
  logprob: number;
47
47
  }>;
48
48
  }
49
+ /** Abstraction for capability caching — localStorage in browser, file-based in CLI */
50
+ export interface CapabilityCache {
51
+ get(key: string): string | null;
52
+ set(key: string, value: string): void;
53
+ }
49
54
  /**
50
55
  * Check if Ollama is running and accessible
51
56
  */
@@ -74,7 +79,8 @@ export declare class OllamaClient {
74
79
  private baseUrl;
75
80
  readonly model: string;
76
81
  private capabilityCache;
77
- constructor(model: string, baseUrl?: string);
82
+ private externalCache;
83
+ constructor(model: string, baseUrl?: string, cache?: CapabilityCache);
78
84
  private isCloudModel;
79
85
  /**
80
86
  * Ensures the model is available in Ollama before proceeding
@@ -91,11 +97,11 @@ export declare class OllamaClient {
91
97
  */
92
98
  private testLogProbCapability;
93
99
  /**
94
- * Get cached capability result from localStorage
100
+ * Get cached capability result from localStorage or external cache
95
101
  */
96
102
  private getCachedCapability;
97
103
  /**
98
- * Cache capability result in localStorage
104
+ * Cache capability result in localStorage or external cache
99
105
  */
100
106
  private setCachedCapability;
101
107
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"ollama-client.d.ts","sourceRoot":"","sources":["../../src/inference/ollama-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAwB,MAAM,UAAU,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAID;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAcrD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAc/D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAkBjC;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiChF;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,eAAe,CAAoC;gBAE/C,KAAK,EAAE,MAAM,EAAE,OAAO,SAAkB;IAMpD,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBlC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASzC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM3C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD;;;OAGG;YACW,qBAAqB;IAmEnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAuB3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;YAqBhC,gBAAgB;YAgDhB,eAAe;IAyC7B;;;OAGG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAC;CAU/D"}
1
+ {"version":3,"file":"ollama-client.d.ts","sourceRoot":"","sources":["../../src/inference/ollama-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAwB,MAAM,UAAU,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAID;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAcrD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAc/D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAkBjC;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiChF;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,eAAe,CAAoC;IAC3D,OAAO,CAAC,aAAa,CAAyB;gBAElC,KAAK,EAAE,MAAM,EAAE,OAAO,SAAkB,EAAE,KAAK,CAAC,EAAE,eAAe;IAO7E,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBlC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASzC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM3C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD;;;OAGG;YACW,qBAAqB;IAmEnC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAqB3B;;;OAGG;IACG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;YAqBhC,gBAAgB;YAgDhB,eAAe;IAyC7B;;;OAGG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAC;CAU/D"}
@@ -142,10 +142,12 @@ export class OllamaClient {
142
142
  baseUrl;
143
143
  model;
144
144
  capabilityCache;
145
- constructor(model, baseUrl = OLLAMA_BASE_URL) {
145
+ externalCache;
146
+ constructor(model, baseUrl = OLLAMA_BASE_URL, cache) {
146
147
  this.baseUrl = baseUrl;
147
148
  this.model = model;
148
149
  this.capabilityCache = new Map();
150
+ this.externalCache = cache ?? null;
149
151
  }
150
152
  isCloudModel() {
151
153
  return this.model.includes(":cloud");
@@ -240,29 +242,34 @@ export class OllamaClient {
240
242
  }
241
243
  }
242
244
  /**
243
- * Get cached capability result from localStorage
245
+ * Get cached capability result from localStorage or external cache
244
246
  */
245
247
  getCachedCapability() {
246
248
  try {
247
249
  const cacheKey = `ollama_supports_logprobs_${this.model}`;
248
- const cached = localStorage.getItem(cacheKey);
250
+ let cached = null;
251
+ if (this.externalCache) {
252
+ cached = this.externalCache.get(cacheKey);
253
+ }
254
+ else if (typeof localStorage !== "undefined") {
255
+ cached = localStorage.getItem(cacheKey);
256
+ }
249
257
  if (cached) {
250
258
  const capability = JSON.parse(cached);
251
- // Check if cache is still valid (24 hours)
252
259
  const cacheAge = Date.now() - new Date(capability.testedAt).getTime();
253
- const maxAge = 24 * 60 * 60 * 1000; // 24 hours in milliseconds
254
- if (cacheAge < maxAge) {
260
+ const CACHE_TTL = 24 * 60 * 60 * 1000; // 24 hours
261
+ if (cacheAge < CACHE_TTL) {
255
262
  return capability;
256
263
  }
257
264
  }
265
+ return null;
258
266
  }
259
- catch (error) {
260
- console.warn("Failed to read capability cache:", error);
267
+ catch {
268
+ return null;
261
269
  }
262
- return null;
263
270
  }
264
271
  /**
265
- * Cache capability result in localStorage
272
+ * Cache capability result in localStorage or external cache
266
273
  */
267
274
  setCachedCapability(supports) {
268
275
  try {
@@ -272,7 +279,12 @@ export class OllamaClient {
272
279
  supportsLogProbs: supports,
273
280
  testedAt: new Date().toISOString(),
274
281
  };
275
- localStorage.setItem(cacheKey, JSON.stringify(capability));
282
+ if (this.externalCache) {
283
+ this.externalCache.set(cacheKey, JSON.stringify(capability));
284
+ }
285
+ else if (typeof localStorage !== "undefined") {
286
+ localStorage.setItem(cacheKey, JSON.stringify(capability));
287
+ }
276
288
  this.capabilityCache.set(this.model, capability);
277
289
  }
278
290
  catch (error) {
@@ -0,0 +1,26 @@
1
+ import type { BomComponentKind } from "../evidence/types";
2
+ import type { CycloneDxComponent } from "./types";
3
+ export interface ComponentMapping {
4
+ kind: BomComponentKind;
5
+ source: "sbom-import";
6
+ confidence: "high" | "medium";
7
+ purlVersion?: string;
8
+ }
9
+ /**
10
+ * Map a CycloneDX component to an EuConform aibom component kind.
11
+ *
12
+ * 8-tier detection (descending priority):
13
+ * 1. ML-BOM extensions (modelCard, data)
14
+ * 2. CycloneDX component type mapping
15
+ * 3. Exact package name in registry
16
+ * 4. Explicit scoped name in registry (@langchain/core)
17
+ * 5. Scope mapping via KNOWN_AI_SCOPES (@langchain -> tool)
18
+ * 6. Scope-stripped name in registry (@huggingface/transformers -> transformers)
19
+ * 7. Purl namespace/name against registry
20
+ * 8. Purl name-only against registry
21
+ *
22
+ * Steps 3-6 are handled by lookupKnownPackage().
23
+ * Returns null if the component is not AI-relevant or has empty name.
24
+ */
25
+ export declare function mapComponent(component: CycloneDxComponent): ComponentMapping | null;
26
+ //# sourceMappingURL=component-mapper.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"component-mapper.d.ts","sourceRoot":"","sources":["../../src/sbom/component-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAgCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,CAgDnF"}
@@ -0,0 +1,83 @@
1
+ import { lookupKnownPackage } from "./known-packages";
2
+ import { parsePurl } from "./purl";
3
+ const CYCLONEDX_TYPE_MAP = {
4
+ "machine-learning-model": { kind: "model", confidence: "high" },
5
+ data: { kind: "dataset", confidence: "medium" },
6
+ platform: { kind: "inference-provider", confidence: "medium" },
7
+ service: { kind: "inference-provider", confidence: "medium" },
8
+ };
9
+ /** Tiers 7-8: Try to find a kind via purl namespace/name and name-only lookups. */
10
+ function lookupViaPurl(parsed) {
11
+ if (!parsed)
12
+ return null;
13
+ // Tier 7: namespace/name (e.g. @langchain/core)
14
+ if (parsed.namespace) {
15
+ const scopedName = `${parsed.namespace}/${parsed.name}`;
16
+ const scopedKind = lookupKnownPackage(scopedName);
17
+ if (scopedKind)
18
+ return { kind: scopedKind, confidence: "high" };
19
+ }
20
+ // Tier 8: purl name only
21
+ const purlKind = lookupKnownPackage(parsed.name);
22
+ if (purlKind)
23
+ return { kind: purlKind, confidence: "medium" };
24
+ return null;
25
+ }
26
+ /**
27
+ * Map a CycloneDX component to an EuConform aibom component kind.
28
+ *
29
+ * 8-tier detection (descending priority):
30
+ * 1. ML-BOM extensions (modelCard, data)
31
+ * 2. CycloneDX component type mapping
32
+ * 3. Exact package name in registry
33
+ * 4. Explicit scoped name in registry (@langchain/core)
34
+ * 5. Scope mapping via KNOWN_AI_SCOPES (@langchain -> tool)
35
+ * 6. Scope-stripped name in registry (@huggingface/transformers -> transformers)
36
+ * 7. Purl namespace/name against registry
37
+ * 8. Purl name-only against registry
38
+ *
39
+ * Steps 3-6 are handled by lookupKnownPackage().
40
+ * Returns null if the component is not AI-relevant or has empty name.
41
+ */
42
+ export function mapComponent(component) {
43
+ // Name validation
44
+ if (!component.name || component.name.trim() === "") {
45
+ return null;
46
+ }
47
+ // Extract purl info (used for fallback and version)
48
+ const parsed = component.purl ? parsePurl(component.purl) : null;
49
+ const purlVersion = parsed?.version;
50
+ // Tier 1: ML-BOM extensions
51
+ if (component.modelCard != null) {
52
+ return { kind: "model", source: "sbom-import", confidence: "high", purlVersion };
53
+ }
54
+ if (Array.isArray(component.data) && component.data.some((d) => d.type === "dataset")) {
55
+ return { kind: "dataset", source: "sbom-import", confidence: "high", purlVersion };
56
+ }
57
+ // Tier 2: CycloneDX component type
58
+ const typeMapping = CYCLONEDX_TYPE_MAP[component.type];
59
+ if (typeMapping) {
60
+ return {
61
+ kind: typeMapping.kind,
62
+ source: "sbom-import",
63
+ confidence: typeMapping.confidence,
64
+ purlVersion,
65
+ };
66
+ }
67
+ // Tiers 3-6: Known-package registry (handles exact, scoped, scope-fallback, scope-stripped)
68
+ const knownKind = lookupKnownPackage(component.name);
69
+ if (knownKind) {
70
+ return { kind: knownKind, source: "sbom-import", confidence: "high", purlVersion };
71
+ }
72
+ // Tiers 7-8: Purl fallback
73
+ const purlMatch = lookupViaPurl(parsed);
74
+ if (purlMatch) {
75
+ return {
76
+ kind: purlMatch.kind,
77
+ source: "sbom-import",
78
+ confidence: purlMatch.confidence,
79
+ purlVersion,
80
+ };
81
+ }
82
+ return null;
83
+ }
@@ -0,0 +1,34 @@
1
+ import type { AiBillOfMaterials } from "../evidence/types";
2
+ import type { ValidationResult } from "../validation/schema-validator";
3
+ export interface ImportWarning {
4
+ component: string;
5
+ message: string;
6
+ }
7
+ export interface ImportSourceInfo {
8
+ bomFormat: "CycloneDX";
9
+ specVersion: string;
10
+ projectNameSource: "metadata.component.name" | "sourcePath" | "fallback";
11
+ importTool?: string;
12
+ originalTimestamp?: string;
13
+ }
14
+ export interface ImportSummary {
15
+ totalComponents: number;
16
+ filteredByScope: number;
17
+ aiRelevant: number;
18
+ skipped: number;
19
+ duplicatesRemoved: number;
20
+ byKind: Record<string, number>;
21
+ warnings: ImportWarning[];
22
+ source: ImportSourceInfo;
23
+ }
24
+ export interface ImportOptions {
25
+ scope?: "all" | "production";
26
+ sourcePath?: string;
27
+ }
28
+ export interface CycloneDxImportResult {
29
+ aibom: AiBillOfMaterials;
30
+ summary: ImportSummary;
31
+ validation: ValidationResult;
32
+ }
33
+ export declare function importCycloneDx(sbom: unknown, options?: ImportOptions): CycloneDxImportResult;
34
+ //# sourceMappingURL=cyclonedx-import.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cyclonedx-import.d.ts","sourceRoot":"","sources":["../../src/sbom/cyclonedx-import.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAA+B,MAAM,mBAAmB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,yBAAyB,GAAG,YAAY,GAAG,UAAU,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,qBAAqB,CA2F7F"}