@euconform/core 1.3.0 → 1.5.0

package/src/sbom/known-packages.ts

@@ -0,0 +1,142 @@
+import type { BomComponentKind } from "../evidence/types";
+
+export const KNOWN_AI_PACKAGES: Record<string, BomComponentKind> = {
+  // Models / model runtimes
+  "llama.cpp": "model",
+  "llama-cpp-python": "model",
+  "whisper.cpp": "model",
+  ggml: "model",
+  ctransformers: "model",
+
+  // AI Frameworks
+  transformers: "ai-framework",
+  torch: "ai-framework",
+  pytorch: "ai-framework",
+  tensorflow: "ai-framework",
+  "tensorflow-gpu": "ai-framework",
+  jax: "ai-framework",
+  keras: "ai-framework",
+  "pytorch-lightning": "ai-framework",
+  "scikit-learn": "ai-framework",
+  sklearn: "ai-framework",
+  xgboost: "ai-framework",
+  lightgbm: "ai-framework",
+  spacy: "ai-framework",
+  "huggingface-hub": "ai-framework",
+  diffusers: "ai-framework",
+  accelerate: "ai-framework",
+  peft: "ai-framework",
+  trl: "ai-framework",
+  onnxruntime: "ai-framework",
+  "onnxruntime-gpu": "ai-framework",
+  mlflow: "ai-framework",
+
+  // Embeddings
+  "sentence-transformers": "embedding",
+  fastembed: "embedding",
+  "openai-embeddings": "embedding",
+  "cohere-embed": "embedding",
+
+  // Inference Providers
+  openai: "inference-provider",
+  anthropic: "inference-provider",
+  ollama: "inference-provider",
+  vllm: "inference-provider",
+  "together-ai": "inference-provider",
+  replicate: "inference-provider",
+  groq: "inference-provider",
+  mistralai: "inference-provider",
+  cohere: "inference-provider",
+  "google-generativeai": "inference-provider",
+  ai21: "inference-provider",
+
+  // Vector Stores
+  pinecone: "vector-store",
+  "pinecone-client": "vector-store",
+  weaviate: "vector-store",
+  "weaviate-client": "vector-store",
+  qdrant: "vector-store",
+  "qdrant-client": "vector-store",
+  milvus: "vector-store",
+  pymilvus: "vector-store",
+  chromadb: "vector-store",
+  "chromadb-client": "vector-store",
+  pgvector: "vector-store",
+  faiss: "vector-store",
+  "faiss-cpu": "vector-store",
+  "faiss-gpu": "vector-store",
+
+  // Datasets
+  datasets: "dataset",
+
+  // Tools / Orchestration
+  langchain: "tool",
+  "langchain-core": "tool",
+  "langchain-community": "tool",
+  llamaindex: "tool",
+  "llama-index": "tool",
+  "semantic-kernel": "tool",
+  autogen: "tool",
+  crewai: "tool",
+  dspy: "tool",
+  "haystack-ai": "tool",
+  guidance: "tool",
+  guardrails: "tool",
+  "guardrails-ai": "tool",
+  lmql: "tool",
+  outlines: "tool",
+
+  // Scoped packages (npm)
+  "@langchain/core": "tool",
+  "@langchain/openai": "tool",
+  "@langchain/community": "tool",
+  "@langchain/anthropic": "tool",
+  "@huggingface/transformers": "ai-framework",
+  "@huggingface/inference": "inference-provider",
+  "@google/generative-ai": "inference-provider",
+  "@anthropic-ai/sdk": "inference-provider",
+  "@pinecone-database/pinecone": "vector-store",
+  "@qdrant/js-client-rest": "vector-store",
+};
+
+export const KNOWN_AI_SCOPES: Record<string, BomComponentKind> = {
+  "@langchain": "tool",
+  "@huggingface": "ai-framework",
+  "@tensorflow": "ai-framework",
+  "@anthropic-ai": "inference-provider",
+  "@pinecone-database": "vector-store",
+  "@qdrant": "vector-store",
+};
+
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export function lookupKnownPackage(name: string): BomComponentKind | null {
+  const lower = name.toLowerCase();
+
+  // 1. Exact match
+  const exact = KNOWN_AI_PACKAGES[lower];
+  if (exact) return exact;
+
+  // Scoped package handling
+  if (lower.startsWith("@") && lower.includes("/")) {
+    const scopeEnd = lower.indexOf("/");
+    const scope = lower.slice(0, scopeEnd);
+    const bareName = lower.slice(scopeEnd + 1);
+
+    // 2. Known AI scope
+    const scopeKind = KNOWN_AI_SCOPES[scope];
+    if (scopeKind) return scopeKind;
+
+    // 3. Strip scope, check bare name
+    const bareKind = KNOWN_AI_PACKAGES[bareName];
+    if (bareKind) return bareKind;
+  }
+
+  return null;
+}

package/src/sbom/purl.ts

@@ -0,0 +1,66 @@
+export interface ParsedPurl {
+  scheme: "pkg";
+  type: string;
+  namespace?: string;
+  name: string;
+  version?: string;
+}
+
+/**
+ * Parse a Package URL (purl) string into its components.
+ * Follows the purl spec: pkg:type/namespace/name@version?qualifiers#subpath
+ * Returns null for invalid or non-pkg URLs.
+ */
+export function parsePurl(purl: string): ParsedPurl | null {
+  if (!purl || !purl.startsWith("pkg:")) return null;
+
+  // Strip qualifiers and subpath
+  let rest = purl.slice(4); // remove "pkg:"
+  const hashIdx = rest.indexOf("#");
+  if (hashIdx !== -1) rest = rest.slice(0, hashIdx);
+  const queryIdx = rest.indexOf("?");
+  if (queryIdx !== -1) rest = rest.slice(0, queryIdx);
+
+  // Split type from the rest: type/...
+  const slashIdx = rest.indexOf("/");
+  if (slashIdx <= 0) return null;
+
+  const type = rest.slice(0, slashIdx);
+  let remainder = rest.slice(slashIdx + 1);
+
+  try {
+    remainder = decodeURIComponent(remainder);
+  } catch {
+    return null;
+  }
+
+  // Extract version
+  let version: string | undefined;
+  const atIdx = remainder.lastIndexOf("@");
+  if (atIdx !== -1) {
+    version = remainder.slice(atIdx + 1);
+    remainder = remainder.slice(0, atIdx);
+  }
+
+  // Split namespace/name (last segment is name, rest is namespace)
+  const lastSlash = remainder.lastIndexOf("/");
+  let namespace: string | undefined;
+  let name: string;
+
+  if (lastSlash !== -1) {
+    namespace = remainder.slice(0, lastSlash);
+    name = remainder.slice(lastSlash + 1);
+  } else {
+    name = remainder;
+  }
+
+  if (!name) return null;
+
+  return {
+    scheme: "pkg",
+    type,
+    namespace: namespace || undefined,
+    name,
+    version: version || undefined,
+  };
+}

package/src/sbom/types.ts

@@ -0,0 +1,34 @@
+/**
+ * Minimal CycloneDX types covering fields relevant to AI component detection.
+ * Supports CycloneDX JSON format versions 1.4, 1.5, 1.6.
+ */
+
+export interface CycloneDxBom {
+  bomFormat: "CycloneDX";
+  specVersion: string;
+  version?: number;
+  metadata?: CycloneDxMetadata;
+  components?: CycloneDxComponent[];
+}
+
+export interface CycloneDxMetadata {
+  timestamp?: string;
+  tools?: Array<{ name?: string; version?: string }>;
+  component?: CycloneDxComponent;
+}
+
+export interface CycloneDxComponent {
+  type: string;
+  name: string;
+  version?: string;
+  purl?: string;
+  group?: string;
+  description?: string;
+  scope?: "required" | "optional" | "excluded";
+  properties?: Array<{ name: string; value: string }>;
+  /** CycloneDX ML-BOM extensions (1.5+) */
+  modelCard?: unknown;
+  data?: Array<{ type?: string }>;
+}
+
+export const SUPPORTED_SPEC_VERSIONS = ["1.4", "1.5", "1.6"] as const;

package/src/validation/index.ts

@@ -0,0 +1,7 @@
+export {
+  validate,
+  type ValidationResult,
+  type ValidationError,
+  type SchemaType,
+  type ValidateOptions,
+} from "./schema-validator";

package/src/validation/schema-validator.ts

@@ -0,0 +1,133 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import addFormats from "ajv-formats";
+import Ajv2020 from "ajv/dist/2020";
+
+export interface ValidationError {
+  path: string;
+  message: string;
+  keyword: string;
+  expected?: unknown;
+  received?: unknown;
+}
+
+export type SchemaType = "report.v1" | "aibom.v1" | "aibom.v1.1" | "ci.v1" | "bundle.v1";
+
+export interface ValidationResult {
+  valid: boolean;
+  schemaType: SchemaType;
+  errors: ValidationError[];
+}
+
+export interface ValidateOptions {
+  strict?: boolean;
+}
+
+// Resolve schema directory relative to this file at runtime.
+// When bundled into packages/cli/dist, schemas are copied to dist/schemas/.
+// When running from source at packages/core/src/validation/, schemas are at ../../../../docs/spec/schemas.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const _bundledSchemasDir = resolve(__dirname, "schemas");
+const schemasDir = existsSync(_bundledSchemasDir)
+  ? _bundledSchemasDir
+  : resolve(__dirname, "../../../../docs/spec/schemas");
+
+function loadSchema(filename: string): object {
+  const content = readFileSync(resolve(schemasDir, filename), "utf-8");
+  return JSON.parse(content) as object;
+}
+
+const SCHEMA_MAP: Record<string, { schemaFile: string; type: SchemaType }> = {
+  "euconform.report.v1": { schemaFile: "report-v1.schema.json", type: "report.v1" },
+  "euconform.aibom.v1": { schemaFile: "aibom-v1.schema.json", type: "aibom.v1" },
+  "euconform.aibom.v1.1": { schemaFile: "aibom-v1.1.schema.json", type: "aibom.v1.1" },
+  "euconform.ci.v1": { schemaFile: "ci-v1.schema.json", type: "ci.v1" },
+  "euconform.bundle.v1": { schemaFile: "bundle-v1.schema.json", type: "bundle.v1" },
+};
+
+let ajvInstance: Ajv2020 | null = null;
+
+function getAjv(): Ajv2020 {
+  if (!ajvInstance) {
+    ajvInstance = new Ajv2020({ allErrors: true, strict: false });
+    addFormats(ajvInstance);
+  }
+  return ajvInstance;
+}
+
+export function validate(data: unknown, _options?: ValidateOptions): ValidationResult {
+  if (typeof data !== "object" || data === null) {
+    return {
+      valid: false,
+      schemaType: "report.v1",
+      errors: [
+        {
+          path: "",
+          message: "Input must be a JSON object",
+          keyword: "type",
+          expected: "object",
+          received: typeof data,
+        },
+      ],
+    };
+  }
+
+  const record = data as Record<string, unknown>;
+  const schemaVersion = record.schemaVersion;
+
+  if (typeof schemaVersion !== "string") {
+    return {
+      valid: false,
+      schemaType: "report.v1",
+      errors: [
+        {
+          path: "",
+          message: `Missing or invalid schemaVersion field. Expected one of: ${Object.keys(SCHEMA_MAP).join(", ")}`,
+          keyword: "required",
+        },
+      ],
+    };
+  }
+
+  const entry = SCHEMA_MAP[schemaVersion];
+  if (!entry) {
+    return {
+      valid: false,
+      schemaType: "report.v1",
+      errors: [
+        {
+          path: "/schemaVersion",
+          message: `Unknown schemaVersion "${schemaVersion}". Expected one of: ${Object.keys(SCHEMA_MAP).join(", ")}`,
+          keyword: "const",
+          expected: Object.keys(SCHEMA_MAP),
+          received: schemaVersion,
+        },
+      ],
+    };
+  }
+
+  const ajv = getAjv();
+  let validateFn = ajv.getSchema(schemaVersion);
+  if (!validateFn) {
+    const schema = loadSchema(entry.schemaFile);
+    validateFn = ajv.compile({ ...schema, $id: schemaVersion });
+  }
+
+  const valid = validateFn(data) as boolean;
+
+  if (valid) {
+    return { valid: true, schemaType: entry.type, errors: [] };
+  }
+
+  const errors: ValidationError[] = (validateFn.errors ?? []).map((err) => ({
+    path: err.instancePath ?? "",
+    message: err.message ?? "Validation error",
+    keyword: err.keyword ?? "unknown",
+    expected: err.params,
+    received: undefined,
+  }));
+
+  return { valid: false, schemaType: entry.type, errors };
+}

package/tests/evidence/{ecef-schemas.test.ts → spec-schemas.test.ts}

@@ -18,8 +18,8 @@ type JsonSchema = {
 };
 
 const ROOT = resolve(__dirname, "../../../..");
-const SCHEMAS_DIR = resolve(ROOT, "docs/ecef/schemas");
-const EXAMPLES_DIR = resolve(ROOT, "docs/ecef/examples");
+const SCHEMAS_DIR = resolve(ROOT, "docs/spec/schemas");
+const EXAMPLES_DIR = resolve(ROOT, "docs/spec/examples");
 
 function readJson<T>(path: string): T {
   return JSON.parse(readFileSync(path, "utf8")) as T;
@@ -168,7 +168,7 @@ const EXAMPLE_FILES = {
   bundle: "euconform.bundle.json",
 } as const;
 
-describe("ECEF schemas", () => {
+describe("EuConform Evidence Format schemas", () => {
   const schemaEntries = Object.entries(SCHEMA_FILES).map(([kind, path]) => [
     kind,
     readJson<JsonSchema>(path),

package/tests/fixtures/cyclonedx-minimal.json

@@ -0,0 +1,13 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "machine-learning-model",
+      "name": "llama-3.2-1b",
+      "version": "1.0.0",
+      "purl": "pkg:generic/llama-3.2-1b@1.0.0"
+    }
+  ]
+}

package/tests/fixtures/cyclonedx-mixed.json

@@ -0,0 +1,17 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    { "type": "library", "name": "express", "version": "4.18.2" },
+    { "type": "library", "name": "lodash", "version": "4.17.21" },
+    { "type": "library", "name": "openai", "version": "1.12.0" },
+    { "type": "framework", "name": "transformers", "version": "4.38.0" },
+    { "type": "library", "name": "chromadb", "version": "0.4.22" },
+    { "type": "library", "name": "langchain", "version": "0.1.0" },
+    { "type": "machine-learning-model", "name": "whisper-large-v3", "version": "1.0.0" },
+    { "type": "library", "name": "typescript", "version": "5.3.0" },
+    { "type": "library", "name": "react", "version": "18.2.0" },
+    { "type": "library", "name": "axios", "version": "1.6.0" }
+  ]
+}

package/tests/fixtures/cyclonedx-ml-bom.json

@@ -0,0 +1,25 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "custom-bert-model",
+      "version": "2.0.0",
+      "modelCard": {
+        "modelParameters": {
+          "approach": { "type": "supervised" },
+          "task": "text-classification"
+        }
+      }
+    },
+    {
+      "type": "library",
+      "name": "sentiment-dataset",
+      "version": "1.0.0",
+      "data": [{ "type": "dataset", "name": "imdb-reviews" }]
+    },
+    { "type": "library", "name": "numpy", "version": "1.24.0" }
+  ]
+}