@euconform/core 1.3.0 → 1.5.0

package/dist/sbom/cyclonedx-import.js

@@ -0,0 +1,131 @@
+import { basename, extname } from "node:path";
+import { validate } from "../validation/schema-validator";
+import { mapComponent } from "./component-mapper";
+import { SUPPORTED_SPEC_VERSIONS } from "./types";
+export function importCycloneDx(sbom, options) {
+    const bom = parseBom(sbom);
+    const scope = options?.scope ?? "all";
+    const allComponents = bom.components ?? [];
+    const warnings = [];
+    const totalComponents = allComponents.length;
+    const inScope = scope === "production"
+        ? allComponents.filter((c) => c.scope !== "optional" && c.scope !== "excluded")
+        : allComponents;
+    const filteredByScope = totalComponents - inScope.length;
+    const mapped = [];
+    for (const comp of inScope) {
+        const mapping = mapComponent(comp);
+        if (!mapping) {
+            if (!comp.name || comp.name.trim() === "") {
+                warnings.push({ component: "(empty)", message: "Skipped: missing or empty name" });
+            }
+            continue;
+        }
+        const version = comp.version || mapping.purlVersion;
+        if (!version) {
+            warnings.push({ component: comp.name, message: "Missing version field" });
+        }
+        mapped.push({
+            id: version ? `${mapping.kind}:${comp.name}:${version}` : `${mapping.kind}:${comp.name}`,
+            kind: mapping.kind,
+            name: comp.name,
+            ...(version ? { version } : {}),
+            source: "sbom-import",
+        });
+    }
+    const seen = new Set();
+    let duplicatesRemoved = 0;
+    const deduped = [];
+    for (const comp of mapped) {
+        if (seen.has(comp.id)) {
+            duplicatesRemoved++;
+            continue;
+        }
+        seen.add(comp.id);
+        deduped.push(comp);
+    }
+    const byKind = {};
+    for (const comp of deduped) {
+        byKind[comp.kind] = (byKind[comp.kind] ?? 0) + 1;
+    }
+    const { projectName, projectNameSource } = resolveProjectName(bom, options?.sourcePath);
+    const importTool = extractToolString(bom);
+    const originalTimestamp = bom.metadata?.timestamp;
+    const aibom = {
+        schemaVersion: "euconform.aibom.v1.1",
+        generatedAt: new Date().toISOString(),
+        project: { name: projectName, rootPath: "." },
+        components: deduped,
+        complianceCapabilities: {
+            biasEvaluation: false,
+            jsonExport: false,
+            pdfExport: false,
+            loggingInfrastructure: false,
+            humanReviewFlow: false,
+            incidentHandling: false,
+        },
+        metadata: buildMetadata(importTool, originalTimestamp),
+    };
+    const validation = validate(aibom);
+    return {
+        aibom,
+        summary: {
+            totalComponents,
+            filteredByScope,
+            aiRelevant: deduped.length,
+            skipped: inScope.length - mapped.length,
+            duplicatesRemoved,
+            byKind,
+            warnings,
+            source: buildSourceInfo(bom.specVersion, projectNameSource, importTool, originalTimestamp),
+        },
+        validation,
+    };
+}
+function resolveProjectName(bom, sourcePath) {
+    const metaName = bom.metadata?.component?.name;
+    if (metaName) {
+        return { projectName: metaName, projectNameSource: "metadata.component.name" };
+    }
+    if (sourcePath) {
+        const name = basename(sourcePath, extname(sourcePath));
+        return { projectName: name, projectNameSource: "sourcePath" };
+    }
+    return { projectName: "sbom-import", projectNameSource: "fallback" };
+}
+function extractToolString(bom) {
+    const tool = bom.metadata?.tools?.[0];
+    if (!tool?.name)
+        return undefined;
+    return tool.version ? `${tool.name} ${tool.version}` : tool.name;
+}
+function buildMetadata(importTool, originalTimestamp) {
+    const meta = { importSource: "cyclonedx" };
+    if (importTool)
+        meta.importTool = importTool;
+    if (originalTimestamp)
+        meta.originalTimestamp = originalTimestamp;
+    return meta;
+}
+function buildSourceInfo(specVersion, projectNameSource, importTool, originalTimestamp) {
+    const info = { bomFormat: "CycloneDX", specVersion, projectNameSource };
+    if (importTool)
+        info.importTool = importTool;
+    if (originalTimestamp)
+        info.originalTimestamp = originalTimestamp;
+    return info;
+}
+function parseBom(sbom) {
+    if (typeof sbom !== "object" || sbom === null) {
+        throw new Error("Input must be a JSON object");
+    }
+    const record = sbom;
+    if (record.bomFormat !== "CycloneDX") {
+        throw new Error(`Invalid bomFormat: expected "CycloneDX", got "${String(record.bomFormat)}"`);
+    }
+    const specVersion = String(record.specVersion ?? "");
+    if (!SUPPORTED_SPEC_VERSIONS.includes(specVersion)) {
+        throw new Error(`Unsupported specVersion "${specVersion}". Supported: ${SUPPORTED_SPEC_VERSIONS.join(", ")}`);
+    }
+    return sbom;
+}

package/dist/sbom/index.d.ts

@@ -0,0 +1,6 @@
+export { importCycloneDx, type CycloneDxImportResult, type ImportSummary, type ImportWarning, type ImportOptions, type ImportSourceInfo, } from "./cyclonedx-import";
+export { mapComponent, type ComponentMapping } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl, type ParsedPurl } from "./purl";
+export type { CycloneDxBom, CycloneDxComponent } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/sbom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sbom/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC"}

package/dist/sbom/index.js

@@ -0,0 +1,4 @@
+export { importCycloneDx, } from "./cyclonedx-import";
+export { mapComponent } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl } from "./purl";

package/dist/sbom/known-packages.d.ts

@@ -0,0 +1,13 @@
+import type { BomComponentKind } from "../evidence/types";
+export declare const KNOWN_AI_PACKAGES: Record<string, BomComponentKind>;
+export declare const KNOWN_AI_SCOPES: Record<string, BomComponentKind>;
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export declare function lookupKnownPackage(name: string): BomComponentKind | null;
+//# sourceMappingURL=known-packages.d.ts.map

package/dist/sbom/known-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-packages.d.ts","sourceRoot":"","sources":["../../src/sbom/known-packages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAiG9D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAO5D,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAuBxE"}

package/dist/sbom/known-packages.js

@@ -0,0 +1,129 @@
+export const KNOWN_AI_PACKAGES = {
+    // Models / model runtimes
+    "llama.cpp": "model",
+    "llama-cpp-python": "model",
+    "whisper.cpp": "model",
+    ggml: "model",
+    ctransformers: "model",
+    // AI Frameworks
+    transformers: "ai-framework",
+    torch: "ai-framework",
+    pytorch: "ai-framework",
+    tensorflow: "ai-framework",
+    "tensorflow-gpu": "ai-framework",
+    jax: "ai-framework",
+    keras: "ai-framework",
+    "pytorch-lightning": "ai-framework",
+    "scikit-learn": "ai-framework",
+    sklearn: "ai-framework",
+    xgboost: "ai-framework",
+    lightgbm: "ai-framework",
+    spacy: "ai-framework",
+    "huggingface-hub": "ai-framework",
+    diffusers: "ai-framework",
+    accelerate: "ai-framework",
+    peft: "ai-framework",
+    trl: "ai-framework",
+    onnxruntime: "ai-framework",
+    "onnxruntime-gpu": "ai-framework",
+    mlflow: "ai-framework",
+    // Embeddings
+    "sentence-transformers": "embedding",
+    fastembed: "embedding",
+    "openai-embeddings": "embedding",
+    "cohere-embed": "embedding",
+    // Inference Providers
+    openai: "inference-provider",
+    anthropic: "inference-provider",
+    ollama: "inference-provider",
+    vllm: "inference-provider",
+    "together-ai": "inference-provider",
+    replicate: "inference-provider",
+    groq: "inference-provider",
+    mistralai: "inference-provider",
+    cohere: "inference-provider",
+    "google-generativeai": "inference-provider",
+    ai21: "inference-provider",
+    // Vector Stores
+    pinecone: "vector-store",
+    "pinecone-client": "vector-store",
+    weaviate: "vector-store",
+    "weaviate-client": "vector-store",
+    qdrant: "vector-store",
+    "qdrant-client": "vector-store",
+    milvus: "vector-store",
+    pymilvus: "vector-store",
+    chromadb: "vector-store",
+    "chromadb-client": "vector-store",
+    pgvector: "vector-store",
+    faiss: "vector-store",
+    "faiss-cpu": "vector-store",
+    "faiss-gpu": "vector-store",
+    // Datasets
+    datasets: "dataset",
+    // Tools / Orchestration
+    langchain: "tool",
+    "langchain-core": "tool",
+    "langchain-community": "tool",
+    llamaindex: "tool",
+    "llama-index": "tool",
+    "semantic-kernel": "tool",
+    autogen: "tool",
+    crewai: "tool",
+    dspy: "tool",
+    "haystack-ai": "tool",
+    guidance: "tool",
+    guardrails: "tool",
+    "guardrails-ai": "tool",
+    lmql: "tool",
+    outlines: "tool",
+    // Scoped packages (npm)
+    "@langchain/core": "tool",
+    "@langchain/openai": "tool",
+    "@langchain/community": "tool",
+    "@langchain/anthropic": "tool",
+    "@huggingface/transformers": "ai-framework",
+    "@huggingface/inference": "inference-provider",
+    "@google/generative-ai": "inference-provider",
+    "@anthropic-ai/sdk": "inference-provider",
+    "@pinecone-database/pinecone": "vector-store",
+    "@qdrant/js-client-rest": "vector-store",
+};
+export const KNOWN_AI_SCOPES = {
+    "@langchain": "tool",
+    "@huggingface": "ai-framework",
+    "@tensorflow": "ai-framework",
+    "@anthropic-ai": "inference-provider",
+    "@pinecone-database": "vector-store",
+    "@qdrant": "vector-store",
+};
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export function lookupKnownPackage(name) {
+    const lower = name.toLowerCase();
+    // 1. Exact match
+    const exact = KNOWN_AI_PACKAGES[lower];
+    if (exact)
+        return exact;
+    // Scoped package handling
+    if (lower.startsWith("@") && lower.includes("/")) {
+        const scopeEnd = lower.indexOf("/");
+        const scope = lower.slice(0, scopeEnd);
+        const bareName = lower.slice(scopeEnd + 1);
+        // 2. Known AI scope
+        const scopeKind = KNOWN_AI_SCOPES[scope];
+        if (scopeKind)
+            return scopeKind;
+        // 3. Strip scope, check bare name
+        const bareKind = KNOWN_AI_PACKAGES[bareName];
+        if (bareKind)
+            return bareKind;
+    }
+    return null;
+}

package/dist/sbom/purl.d.ts

@@ -0,0 +1,14 @@
+export interface ParsedPurl {
+    scheme: "pkg";
+    type: string;
+    namespace?: string;
+    name: string;
+    version?: string;
+}
+/**
+ * Parse a Package URL (purl) string into its components.
+ * Follows the purl spec: pkg:type/namespace/name@version?qualifiers#subpath
+ * Returns null for invalid or non-pkg URLs.
+ */
+export declare function parsePurl(purl: string): ParsedPurl | null;
+//# sourceMappingURL=purl.d.ts.map

package/dist/sbom/purl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../src/sbom/purl.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,KAAK,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoDzD"}

package/dist/sbom/purl.js

@@ -0,0 +1,56 @@
+/**
+ * Parse a Package URL (purl) string into its components.
+ * Follows the purl spec: pkg:type/namespace/name@version?qualifiers#subpath
+ * Returns null for invalid or non-pkg URLs.
+ */
+export function parsePurl(purl) {
+    if (!purl || !purl.startsWith("pkg:"))
+        return null;
+    // Strip qualifiers and subpath
+    let rest = purl.slice(4); // remove "pkg:"
+    const hashIdx = rest.indexOf("#");
+    if (hashIdx !== -1)
+        rest = rest.slice(0, hashIdx);
+    const queryIdx = rest.indexOf("?");
+    if (queryIdx !== -1)
+        rest = rest.slice(0, queryIdx);
+    // Split type from the rest: type/...
+    const slashIdx = rest.indexOf("/");
+    if (slashIdx <= 0)
+        return null;
+    const type = rest.slice(0, slashIdx);
+    let remainder = rest.slice(slashIdx + 1);
+    try {
+        remainder = decodeURIComponent(remainder);
+    }
+    catch {
+        return null;
+    }
+    // Extract version
+    let version;
+    const atIdx = remainder.lastIndexOf("@");
+    if (atIdx !== -1) {
+        version = remainder.slice(atIdx + 1);
+        remainder = remainder.slice(0, atIdx);
+    }
+    // Split namespace/name (last segment is name, rest is namespace)
+    const lastSlash = remainder.lastIndexOf("/");
+    let namespace;
+    let name;
+    if (lastSlash !== -1) {
+        namespace = remainder.slice(0, lastSlash);
+        name = remainder.slice(lastSlash + 1);
+    }
+    else {
+        name = remainder;
+    }
+    if (!name)
+        return null;
+    return {
+        scheme: "pkg",
+        type,
+        namespace: namespace || undefined,
+        name,
+        version: version || undefined,
+    };
+}

package/dist/sbom/types.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Minimal CycloneDX types covering fields relevant to AI component detection.
+ * Supports CycloneDX JSON format versions 1.4, 1.5, 1.6.
+ */
+export interface CycloneDxBom {
+    bomFormat: "CycloneDX";
+    specVersion: string;
+    version?: number;
+    metadata?: CycloneDxMetadata;
+    components?: CycloneDxComponent[];
+}
+export interface CycloneDxMetadata {
+    timestamp?: string;
+    tools?: Array<{
+        name?: string;
+        version?: string;
+    }>;
+    component?: CycloneDxComponent;
+}
+export interface CycloneDxComponent {
+    type: string;
+    name: string;
+    version?: string;
+    purl?: string;
+    group?: string;
+    description?: string;
+    scope?: "required" | "optional" | "excluded";
+    properties?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** CycloneDX ML-BOM extensions (1.5+) */
+    modelCard?: unknown;
+    data?: Array<{
+        type?: string;
+    }>;
+}
+export declare const SUPPORTED_SPEC_VERSIONS: readonly ["1.4", "1.5", "1.6"];
+//# sourceMappingURL=types.d.ts.map

package/dist/sbom/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sbom/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAC7C,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjC;AAED,eAAO,MAAM,uBAAuB,gCAAiC,CAAC"}

package/dist/sbom/types.js

@@ -0,0 +1,5 @@
+/**
+ * Minimal CycloneDX types covering fields relevant to AI component detection.
+ * Supports CycloneDX JSON format versions 1.4, 1.5, 1.6.
+ */
+export const SUPPORTED_SPEC_VERSIONS = ["1.4", "1.5", "1.6"];

package/dist/validation/index.d.ts

@@ -0,0 +1,2 @@
+export { validate, type ValidationResult, type ValidationError, type SchemaType, type ValidateOptions, } from "./schema-validator";
+//# sourceMappingURL=index.d.ts.map

package/dist/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC"}

package/dist/validation/index.js

@@ -0,0 +1 @@
+export { validate, } from "./schema-validator";

package/dist/validation/schema-validator.d.ts

@@ -0,0 +1,18 @@
+export interface ValidationError {
+    path: string;
+    message: string;
+    keyword: string;
+    expected?: unknown;
+    received?: unknown;
+}
+export type SchemaType = "report.v1" | "aibom.v1" | "aibom.v1.1" | "ci.v1" | "bundle.v1";
+export interface ValidationResult {
+    valid: boolean;
+    schemaType: SchemaType;
+    errors: ValidationError[];
+}
+export interface ValidateOptions {
+    strict?: boolean;
+}
+export declare function validate(data: unknown, _options?: ValidateOptions): ValidationResult;
+//# sourceMappingURL=schema-validator.d.ts.map

package/dist/validation/schema-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-validator.d.ts","sourceRoot":"","sources":["../../src/validation/schema-validator.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,GAAG,WAAW,CAAC;AAEzF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAmCD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,gBAAgB,CAyEpF"}

package/dist/validation/schema-validator.js

@@ -0,0 +1,99 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import addFormats from "ajv-formats";
+import Ajv2020 from "ajv/dist/2020";
+// Resolve schema directory relative to this file at runtime.
+// When bundled into packages/cli/dist, schemas are copied to dist/schemas/.
+// When running from source at packages/core/src/validation/, schemas are at ../../../../docs/spec/schemas.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const _bundledSchemasDir = resolve(__dirname, "schemas");
+const schemasDir = existsSync(_bundledSchemasDir)
+    ? _bundledSchemasDir
+    : resolve(__dirname, "../../../../docs/spec/schemas");
+function loadSchema(filename) {
+    const content = readFileSync(resolve(schemasDir, filename), "utf-8");
+    return JSON.parse(content);
+}
+const SCHEMA_MAP = {
+    "euconform.report.v1": { schemaFile: "report-v1.schema.json", type: "report.v1" },
+    "euconform.aibom.v1": { schemaFile: "aibom-v1.schema.json", type: "aibom.v1" },
+    "euconform.aibom.v1.1": { schemaFile: "aibom-v1.1.schema.json", type: "aibom.v1.1" },
+    "euconform.ci.v1": { schemaFile: "ci-v1.schema.json", type: "ci.v1" },
+    "euconform.bundle.v1": { schemaFile: "bundle-v1.schema.json", type: "bundle.v1" },
+};
+let ajvInstance = null;
+function getAjv() {
+    if (!ajvInstance) {
+        ajvInstance = new Ajv2020({ allErrors: true, strict: false });
+        addFormats(ajvInstance);
+    }
+    return ajvInstance;
+}
+export function validate(data, _options) {
+    if (typeof data !== "object" || data === null) {
+        return {
+            valid: false,
+            schemaType: "report.v1",
+            errors: [
+                {
+                    path: "",
+                    message: "Input must be a JSON object",
+                    keyword: "type",
+                    expected: "object",
+                    received: typeof data,
+                },
+            ],
+        };
+    }
+    const record = data;
+    const schemaVersion = record.schemaVersion;
+    if (typeof schemaVersion !== "string") {
+        return {
+            valid: false,
+            schemaType: "report.v1",
+            errors: [
+                {
+                    path: "",
+                    message: `Missing or invalid schemaVersion field. Expected one of: ${Object.keys(SCHEMA_MAP).join(", ")}`,
+                    keyword: "required",
+                },
+            ],
+        };
+    }
+    const entry = SCHEMA_MAP[schemaVersion];
+    if (!entry) {
+        return {
+            valid: false,
+            schemaType: "report.v1",
+            errors: [
+                {
+                    path: "/schemaVersion",
+                    message: `Unknown schemaVersion "${schemaVersion}". Expected one of: ${Object.keys(SCHEMA_MAP).join(", ")}`,
+                    keyword: "const",
+                    expected: Object.keys(SCHEMA_MAP),
+                    received: schemaVersion,
+                },
+            ],
+        };
+    }
+    const ajv = getAjv();
+    let validateFn = ajv.getSchema(schemaVersion);
+    if (!validateFn) {
+        const schema = loadSchema(entry.schemaFile);
+        validateFn = ajv.compile({ ...schema, $id: schemaVersion });
+    }
+    const valid = validateFn(data);
+    if (valid) {
+        return { valid: true, schemaType: entry.type, errors: [] };
+    }
+    const errors = (validateFn.errors ?? []).map((err) => ({
+        path: err.instancePath ?? "",
+        message: err.message ?? "Validation error",
+        keyword: err.keyword ?? "unknown",
+        expected: err.params,
+        received: undefined,
+    }));
+    return { valid: false, schemaType: entry.type, errors };
+}

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@euconform/core",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "license": "MIT OR EUPL-1.2",
   "author": "Benedikt Hiepler",
   "description": "Core engine for EU AI Act compliance, risk classification, and fairness metrics.",
   "type": "module",
+  "sideEffects": false,
   "keywords": [
     "eu-ai-act",
     "compliance",
@@ -28,7 +29,10 @@
     "./fairness-metrics": "./src/fairness-metrics.ts",
     "./types": "./src/types.ts",
     "./scanner": "./src/scanner/index.ts",
-    "./evidence": "./src/evidence/index.ts"
+    "./evidence": "./src/evidence/index.ts",
+    "./datasets": "./src/datasets/crows-pairs.ts",
+    "./validation": "./src/validation/index.ts",
+    "./sbom": "./src/sbom/index.ts"
   },
   "devDependencies": {
     "@types/node": "^22.15.30",
@@ -39,6 +43,8 @@
   },
   "dependencies": {
     "@xenova/transformers": "^2.17.2",
+    "ajv": "^8.18.0",
+    "ajv-formats": "^3.0.1",
     "ignore": "^7.0.3"
   },
   "scripts": {

package/src/datasets/crows-pairs.ts

@@ -0,0 +1,64 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { CrowsPairsEntry } from "../types";
+
+interface CrowsPairsDataset {
+  metadata: {
+    name: string;
+    description: string;
+    version: string;
+    license: string;
+    source: string;
+  };
+  pairs: Array<{
+    id: number;
+    stereotype: string;
+    antiStereotype: string;
+    biasType: string;
+  }>;
+}
+
+function findDatasetPath(language: "en" | "de"): string {
+  const fileName = `crows-pairs-${language}.json`;
+
+  // Strategy 1: Relative to this source file (works in unbundled tsc builds)
+  const currentDir = dirname(fileURLToPath(import.meta.url));
+  const fromSource = resolve(currentDir, `../../assets/datasets/${fileName}`);
+  if (existsSync(fromSource)) return fromSource;
+
+  // Strategy 2: Relative to process.cwd() (works in monorepo context)
+  const fromCwd = resolve(process.cwd(), `packages/core/assets/datasets/${fileName}`);
+  if (existsSync(fromCwd)) return fromCwd;
+
+  // Strategy 3: Walk up from the entry script to find the monorepo root
+  if (process.argv[1]) {
+    let dir = dirname(resolve(process.argv[1]));
+    for (let i = 0; i < 5; i++) {
+      const candidate = resolve(dir, `packages/core/assets/datasets/${fileName}`);
+      if (existsSync(candidate)) return candidate;
+      dir = dirname(dir);
+    }
+  }
+
+  throw new Error(
+    `CrowS-Pairs dataset (${language}) not found. Ensure packages/core/assets/datasets/ exists.`
+  );
+}
+
+/**
+ * Load CrowS-Pairs dataset from bundled assets.
+ * Converts the structured JSON format to CrowsPairsEntry[] for the bias engine.
+ */
+export function loadCrowsPairsDataset(language: "en" | "de"): CrowsPairsEntry[] {
+  const filePath = findDatasetPath(language);
+  const raw = readFileSync(filePath, "utf-8");
+  const dataset: CrowsPairsDataset = JSON.parse(raw);
+
+  return dataset.pairs.map((pair) => ({
+    id: pair.id,
+    sent_more: pair.stereotype,
+    sent_less: pair.antiStereotype,
+    bias_type: pair.biasType,
+  }));
+}

package/src/evidence/output.ts

@@ -81,6 +81,7 @@ const SOURCE_PRIORITY: Record<BomComponent["source"], number> = {
   config: 4,
   code: 3,
   "lock-file": 2,
+  "sbom-import": 2,
   docs: 1,
 };