@euconform/core 1.4.0 → 1.6.0

package/dist/types.d.ts

@@ -48,7 +48,7 @@ export interface FairnessMetric {
 export interface BiasTestResult {
     modelId: string;
     timestamp: string;
-    method: BiasCalculationMethod;
+    method: BiasCalculationMethod | SequenceLogProbMethod;
     engine: "browser" | "ollama";
     protectedAttribute?: string;
     crowsPairsResult?: CrowsPairsBiasResult;
@@ -71,6 +71,16 @@ export interface CrowsPairsEntry {
 }
 /** Bias calculation method types */
 export type BiasCalculationMethod = "logprobs_exact" | "logprobs_fallback_latency";
+/**
+ * How a sentence's log-probability was accumulated for the autoregressive
+ * CrowS-Pairs adaptation (Messmotor-Sanierung Task 3). "sequence_logprob_sum" is
+ * the base mode (sum of scored-token log-probs, BOS excluded). Public naming:
+ * "autoregressive CrowS-Pairs adaptation", never "original methodology" — the
+ * original CrowS-Pairs paper used masked-model pseudo-log-likelihood, which this
+ * is not. "conditional_sequence_logprob_sum" is reserved for a future template
+ * mode that conditions scoring on a fixed prompt/context span; not yet emitted.
+ */
+export type SequenceLogProbMethod = "sequence_logprob_sum" | "conditional_sequence_logprob_sum";
 /** Model capability cache for log-probability support */
 export interface ModelCapabilityCache {
     model: string;
@@ -78,23 +88,114 @@ export interface ModelCapabilityCache {
     testedAt: string;
     ollamaVersion?: string;
 }
+/** Result for a single CrowS-Pairs sentence pair. */
+export interface CrowsPairsPairResult {
+    pairId: number | null;
+    stereotype: string;
+    antiStereotype: string;
+    biasType: string | null;
+    stereotypeLogProb: number;
+    antiStereotypeLogProb: number;
+    biasScore: number;
+    biasDirection: "stereotype" | "anti-stereotype" | "neutral";
+    method: SequenceLogProbMethod;
+    /** Number of scored tokens (BOS excluded) in the stereotype sentence. */
+    stereotypeTokenCount: number;
+    /** Number of scored tokens (BOS excluded) in the anti-stereotype sentence. */
+    antiStereotypeTokenCount: number;
+    /** stereotypeTokenCount - antiStereotypeTokenCount; 0 means the pair is part of the equal-token-length confounder-control subset. */
+    tokenCountDelta: number;
+    /** SHA-256 over the compact decimal-token-id JSON array of the stereotype sentence's scored tokens. */
+    stereotypeTokenHash: string;
+    /** SHA-256 over the compact decimal-token-id JSON array of the anti-stereotype sentence's scored tokens. */
+    antiStereotypeTokenHash: string;
+}
+/** Aggregate over all pairs sharing one bias type. */
+export interface CrowsPairsBiasTypeSummary {
+    biasType: string;
+    pairsCount: number;
+    stereotypePreferenceCount: number;
+    stereotypePreferencePercent: number;
+    averageBiasScore: number;
+}
+/** A pair that was selected for measurement but whose scoring failed (allowPartial runs only). */
+export interface CrowsPairsFailedPair {
+    pairId: number | null;
+    reason: string;
+}
+/**
+ * Snapshot of the measurement provenance the provider actually reported for a run,
+ * echoed by `calculateCrowsPairsBias` so CLI callers (see `run-bias-test.ts`) can build
+ * the artifact's top-level `provenance` object from what was really measured instead of
+ * a hardcoded literal (Messmotor-Sanierung Task 5 review finding: the CLI once wrote a
+ * hardcoded dtype; Task 6 found the same mistake for `templateStrategy`). Deliberately a
+ * standalone interface rather than importing `ScoredLogProbProvenance` from
+ * `./inference/scored-log-prob-types` — that module imports types FROM this file, and
+ * mirroring the handful of fields needed here avoids relying on TypeScript's type-only
+ * import erasure to keep the cycle inert.
+ */
+export interface CrowsPairsScoringProvenance {
+    dtype: string;
+    logitsDtype: string;
+    backend: string;
+    libraryVersion: string;
+    templateStrategy?: "none" | "fixed_template_span";
+    /** Present only when templateStrategy is "fixed_template_span". */
+    promptText?: string;
+    promptSha256?: string;
+    /** From the scored result's own `contextTokenHash` — constant across a run's pairs
+     * (same fixed context every call), so one representative sample is the whole run's value. */
+    contextTokenHash?: string;
+}
 /** CrowS-Pairs bias calculation result */
 export interface CrowsPairsBiasResult {
     score: number;
-    method: BiasCalculationMethod;
+    method: SequenceLogProbMethod;
     pairsAnalyzed: number;
     stereotypicalPreference: number;
+    /** One entry per analysed pair. Empty only if nothing could be analysed. */
+    pairResults: CrowsPairsPairResult[];
+    /** Per-category aggregates. The whole point: the overall score hides these. */
+    byBiasType: CrowsPairsBiasTypeSummary[];
+    /**
+     * "complete": every selected pair was analysed. "partial": at least one pair
+     * failed and `allowPartial` was set — this run is a diagnostic, not a full
+     * measurement. Fail-closed by default: without `allowPartial`, any failure
+     * aborts the whole run rather than producing a "partial" result.
+     */
+    runStatus: "complete" | "partial";
+    /** Pairs selected for measurement after dataset-extraction filtering. */
+    selectedCount: number;
+    /** Pairs successfully measured; the statistical denominator for score/preference. */
+    analyzedCount: number;
+    /** Pairs selected but that failed measurement (only possible with allowPartial). */
+    failedCount: number;
+    /** One entry per failed pair. Invariant: selectedCount === analyzedCount + failedCount. */
+    failedPairs: CrowsPairsFailedPair[];
     metadata: {
         engine: "browser" | "ollama";
         model: string;
         timestamp: string;
     };
+    /**
+     * The provider's actual scoring provenance (from the first successfully-measured
+     * pair — the fixed template context, if any, does not vary across pairs in one run).
+     * Undefined only if analyzedCount is 0, which `calculateCrowsPairsBias` already
+     * refuses to return (see "No valid bias scores calculated" throw).
+     */
+    scoringProvenance?: CrowsPairsScoringProvenance;
 }
 /** Configuration for bias test execution */
 export interface BiasTestConfig {
     dataset: CrowsPairsEntry[];
     model: string;
     engine: "browser" | "ollama";
+    /**
+     * Diagnostic mode: a pair that fails measurement is recorded in `failedPairs`
+     * instead of aborting the whole run. NOT suitable as a complete measurement —
+     * see `runStatus: "partial"`. Default: false (fail-closed).
+     */
+    allowPartial?: boolean;
 }
 /** Annex IV Technical Documentation Report */
 export interface AnnexIVReport {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAExE,wDAAwD;AACxD,MAAM,MAAM,gBAAgB,GACxB,0BAA0B,GAC1B,yBAAyB,GACzB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,2BAA2B,CAAC;AAEnF,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qBAAqB,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE;QACR,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC;QACrB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;KAC7B,CAAC;IACF,cAAc,EAAE;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE;QAChB,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,gBAAgB,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAAC;CAC7D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAExE,wDAAwD;AACxD,MAAM,MAAM,gBAAgB,GACxB,0BAA0B,GAC1B,yBAAyB,GACzB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,CAAC;IACtD,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,2BAA2B,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG,kCAAkC,CAAC;AAEhG,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,YAAY,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC5D,MAAM,EAAE,qBAAqB,CAAC;IAC9B,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,wBAAwB,EAAE,MAAM,CAAC;IACjC,qIAAqI;IACrI,eAAe,EAAE,MAAM,CAAC;IACxB,uGAAuG;IACvG,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4GAA4G;IAC5G,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB,EAAE,MAAM,CAAC;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,kGAAkG;AAClG,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAClD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;iGAC6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qBAAqB,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,+EAA+E;IAC/E,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC;;;;;OAKG;IACH,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAClC,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,QAAQ,EAAE;QACR,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;CACjD;AAED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC;QACrB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;KAC7B,CAAC;IACF,cAAc,EAAE;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE;QAChB,MAAM,EAAE,qBAAqB,CAAC;QAC9B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,gBAAgB,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAAC;CAC7D"}

package/dist/validation/index.d.ts

@@ -0,0 +1,2 @@
+export { validate, type ValidationResult, type ValidationError, type SchemaType, type ValidateOptions, } from "./schema-validator";
+//# sourceMappingURL=index.d.ts.map

package/dist/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC"}

package/dist/validation/index.js

@@ -0,0 +1 @@
+export { validate, } from "./schema-validator";

package/dist/validation/schema-validator.d.ts

@@ -0,0 +1,18 @@
+export interface ValidationError {
+    path: string;
+    message: string;
+    keyword: string;
+    expected?: unknown;
+    received?: unknown;
+}
+export type SchemaType = "report.v1" | "aibom.v1" | "aibom.v1.1" | "ci.v1" | "bundle.v1" | "bias.v1" | "bias.v2" | "external-observation.v1";
+export interface ValidationResult {
+    valid: boolean;
+    schemaType: SchemaType;
+    errors: ValidationError[];
+}
+export interface ValidateOptions {
+    strict?: boolean;
+}
+export declare function validate(data: unknown, _options?: ValidateOptions): ValidationResult;
+//# sourceMappingURL=schema-validator.d.ts.map

package/dist/validation/schema-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-validator.d.ts","sourceRoot":"","sources":["../../src/validation/schema-validator.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,UAAU,GACV,YAAY,GACZ,OAAO,GACP,WAAW,GACX,SAAS,GACT,SAAS,GACT,yBAAyB,CAAC;AAE9B,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAyCD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,gBAAgB,CAyEpF"}

package/dist/validation/schema-validator.js

@@ -0,0 +1,105 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import addFormats from "ajv-formats";
+import Ajv2020 from "ajv/dist/2020";
+// Resolve schema directory relative to this file at runtime.
+// When bundled into packages/cli/dist, schemas are copied to dist/schemas/.
+// When running from source at packages/core/src/validation/, schemas are at ../../../../docs/spec/schemas.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const _bundledSchemasDir = resolve(__dirname, "schemas");
+const schemasDir = existsSync(_bundledSchemasDir)
+    ? _bundledSchemasDir
+    : resolve(__dirname, "../../../../docs/spec/schemas");
+function loadSchema(filename) {
+    const content = readFileSync(resolve(schemasDir, filename), "utf-8");
+    return JSON.parse(content);
+}
+const SCHEMA_MAP = {
+    "euconform.report.v1": { schemaFile: "report-v1.schema.json", type: "report.v1" },
+    "euconform.aibom.v1": { schemaFile: "aibom-v1.schema.json", type: "aibom.v1" },
+    "euconform.aibom.v1.1": { schemaFile: "aibom-v1.1.schema.json", type: "aibom.v1.1" },
+    "euconform.ci.v1": { schemaFile: "ci-v1.schema.json", type: "ci.v1" },
+    "euconform.bundle.v1": { schemaFile: "bundle-v1.schema.json", type: "bundle.v1" },
+    "euconform.bias.v1": { schemaFile: "bias-v1.schema.json", type: "bias.v1" },
+    "euconform.bias.v2": { schemaFile: "bias-v2.schema.json", type: "bias.v2" },
+    "euconform.external-observation.v1": {
+        schemaFile: "external-observation-v1.schema.json",
+        type: "external-observation.v1",
+    },
+};
+let ajvInstance = null;
+function getAjv() {
+    if (!ajvInstance) {
+        ajvInstance = new Ajv2020({ allErrors: true, strict: false });
+        addFormats(ajvInstance);
+    }
+    return ajvInstance;
+}
+export function validate(data, _options) {
+    if (typeof data !== "object" || data === null) {
+        return {
+            valid: false,
+            schemaType: "report.v1",
+            errors: [
+                {
+                    path: "",
+                    message: "Input must be a JSON object",
+                    keyword: "type",
+                    expected: "object",
+                    received: typeof data,
+                },
+            ],
+        };
+    }
+    const record = data;
+    const schemaVersion = record.schemaVersion;
+    if (typeof schemaVersion !== "string") {
+        return {
+            valid: false,
+            schemaType: "report.v1",
+            errors: [
+                {
+                    path: "",
+                    message: `Missing or invalid schemaVersion field. Expected one of: ${Object.keys(SCHEMA_MAP).join(", ")}`,
+                    keyword: "required",
+                },
+            ],
+        };
+    }
+    const entry = SCHEMA_MAP[schemaVersion];
+    if (!entry) {
+        return {
+            valid: false,
+            schemaType: "report.v1",
+            errors: [
+                {
+                    path: "/schemaVersion",
+                    message: `Unknown schemaVersion "${schemaVersion}". Expected one of: ${Object.keys(SCHEMA_MAP).join(", ")}`,
+                    keyword: "const",
+                    expected: Object.keys(SCHEMA_MAP),
+                    received: schemaVersion,
+                },
+            ],
+        };
+    }
+    const ajv = getAjv();
+    let validateFn = ajv.getSchema(schemaVersion);
+    if (!validateFn) {
+        const schema = loadSchema(entry.schemaFile);
+        validateFn = ajv.compile({ ...schema, $id: schemaVersion });
+    }
+    const valid = validateFn(data);
+    if (valid) {
+        return { valid: true, schemaType: entry.type, errors: [] };
+    }
+    const errors = (validateFn.errors ?? []).map((err) => ({
+        path: err.instancePath ?? "",
+        message: err.message ?? "Validation error",
+        keyword: err.keyword ?? "unknown",
+        expected: err.params,
+        received: undefined,
+    }));
+    return { valid: false, schemaType: entry.type, errors };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@euconform/core",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "license": "MIT OR EUPL-1.2",
   "author": "Benedikt Hiepler",
   "description": "Core engine for EU AI Act compliance, risk classification, and fairness metrics.",
@@ -30,7 +30,10 @@
     "./types": "./src/types.ts",
     "./scanner": "./src/scanner/index.ts",
     "./evidence": "./src/evidence/index.ts",
-    "./datasets": "./src/datasets/crows-pairs.ts"
+    "./evidence/browser": "./src/evidence/browser.ts",
+    "./datasets": "./src/datasets/crows-pairs.ts",
+    "./validation": "./src/validation/index.ts",
+    "./sbom": "./src/sbom/index.ts"
   },
   "devDependencies": {
     "@types/node": "^22.15.30",
@@ -40,7 +43,10 @@
     "@euconform/typescript-config": "0.0.0"
   },
   "dependencies": {
-    "@xenova/transformers": "^2.17.2",
+    "@huggingface/transformers": "^4.2.0",
+    "onnxruntime-node": "1.24.3",
+    "ajv": "^8.18.0",
+    "ajv-formats": "^3.0.1",
     "ignore": "^7.0.3"
   },
   "scripts": {

package/scripts/seed-logprob-fixture.mjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+/**
+ * Maintenance script: generates the checked-in golden fixture for the log-probability
+ * integration test (tests/inference/logprob-golden.integration.test.ts).
+ *
+ * This is the ONLY place that writes tests/inference/fixtures/logprob-golden.json.
+ * The integration test only READS it and never writes.
+ *
+ * Usage:
+ *   node --experimental-strip-types packages/core/scripts/seed-logprob-fixture.mjs
+ *
+ * Requires network access on first run (to download Xenova/gpt2 into the
+ * transformers.js cache) or a warm cache.
+ */
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { createRequire, register } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const CORE_ROOT = join(SCRIPT_DIR, "..");
+
+register(join(SCRIPT_DIR, "ts-extensionless-resolve-hook.mjs"), import.meta.url);
+
+const { BrowserInference } = await import(join(CORE_ROOT, "src/inference/browser-inference.ts"));
+
+const MODEL_ID = "Xenova/gpt2";
+const HF_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+
+/**
+ * Resolve the CURRENT commit SHA of the model repo on the Hugging Face Hub.
+ *
+ * "main" is a mutable branch pointer, not a pin: a future push to Xenova/gpt2 would
+ * silently move it and invalidate this fixture without anyone noticing. This is a
+ * tiny metadata fetch (not a model download), so we resolve it eagerly at seed time
+ * and pass the immutable SHA to `from_pretrained` as the `revision`. This script is
+ * online-by-nature (it downloads model weights), so a failure here aborts loudly
+ * rather than silently falling back to "main".
+ *
+ * Observed in this environment: a bare `fetch` sometimes returns a stale/cached
+ * schema-shaped stub instead of the real API response. Sending `Cache-Control:
+ * no-cache` reliably returns the real payload; we still validate the `sha` field's
+ * shape before trusting it, and retry a few times before giving up.
+ */
+async function resolveModelRevisionSha(modelId, { attempts = 3 } = {}) {
+  const url = `https://huggingface.co/api/models/${modelId}`;
+  let lastError;
+
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      const response = await fetch(url, {
+        headers: { "Cache-Control": "no-cache", Accept: "application/json" },
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP ${response.status} ${response.statusText}`);
+      }
+      const body = await response.json();
+      const sha = body?.sha;
+      if (typeof sha !== "string" || !HF_SHA_PATTERN.test(sha)) {
+        throw new Error(
+          `response did not contain a valid 40-char commit sha (got: ${JSON.stringify(sha)}); this looks like a malformed or stubbed API response, not the real Hub metadata`
+        );
+      }
+      return sha;
+    } catch (err) {
+      lastError = err;
+      console.warn(
+        `[seed-logprob-fixture] revision resolution attempt ${attempt}/${attempts} failed: ${err.message}`
+      );
+    }
+  }
+
+  throw new Error(
+    `Could not resolve an immutable commit sha for "${modelId}" from the Hugging Face Hub API ` +
+      `after ${attempts} attempts. Aborting: seeding against the mutable "main" ref would silently ` +
+      `invalidate this fixture on the next upstream push. Last error: ${lastError?.message}`
+  );
+}
+
+// 5 sentences per the binding spec:
+// - 2 German sentences forming a gender minimal pair, taken from a clinical
+//   question catalogue; they differ in exactly one token so the fixture also
+//   covers the equal-token path
+// - 1 additional German sentence, umlaut-heavy
+// - 1 English sentence
+// - 1 long German sentence
+const SENTENCES = [
+  "Die Patientin übertreibt ihre Kopfschmerzen.",
+  "Der Patient übertreibt seine Kopfschmerzen.",
+  "Ärztinnen und Ärzte prüfen die Kopfschmerzen sorgfältig, bevor sie eine Überweisung veranlassen.",
+  "The patient reports a sudden and severe headache.",
+  "Nach ausführlicher Anamnese, wiederholter neurologischer Untersuchung und Rücksprache mit der Kollegin wurde entschieden, dass eine bildgebende Abklärung der Kopfschmerzen derzeit nicht dringlich erforderlich ist.",
+];
+
+function sha256HexOfIds(ids) {
+  return createHash("sha256").update(JSON.stringify(ids), "utf8").digest("hex");
+}
+
+function round6(n) {
+  return Math.round(n * 1e6) / 1e6;
+}
+
+/**
+ * The installed onnxruntime-node version. Not caught-and-"unknown": Messmotor-Sanierung
+ * Task 4 proved that an onnxruntime-node version bump alone (1.14.0 -> 1.24.3, byte-identical
+ * model weights, same dtype) shifts sequence log-probabilities at the 1e-6 relative level.
+ * This fixture exists to catch exactly that kind of silent drift, so it must record which
+ * onnxruntime-node version produced it — a script that can't resolve this must abort loudly,
+ * not silently write a fixture without it.
+ */
+function resolveOnnxRuntimeVersion() {
+  const require = createRequire(import.meta.url);
+  const pkg = require("onnxruntime-node/package.json");
+  if (!pkg.version) {
+    throw new Error(
+      "seed-logprob-fixture: could not resolve the installed onnxruntime-node version " +
+        "(missing 'version' field in onnxruntime-node/package.json). Aborting rather than " +
+        "writing a fixture missing this ergebnisrelevant field."
+    );
+  }
+  return pkg.version;
+}
+
+async function main() {
+  const revision = await resolveModelRevisionSha(MODEL_ID);
+  console.log(`resolved revision (immutable commit sha): ${revision}`);
+  const onnxruntimeVersion = resolveOnnxRuntimeVersion();
+  console.log(`resolved onnxruntime-node version: ${onnxruntimeVersion}`);
+
+  // dtype: "fp32" -- full precision. Log-probability scoring for bias measurement
+  // must not carry quantization noise; the fixture is a numerical truth anchor.
+  const engine = new BrowserInference(MODEL_ID, null, { revision, dtype: "fp32" });
+  await engine.load();
+
+  const sentenceResults = [];
+  for (const text of SENTENCES) {
+    const result = await engine.getScoredLogProb(text);
+    sentenceResults.push({
+      text,
+      score: round6(result.score),
+      span: result.span,
+      scoredTokenIdsHash: sha256HexOfIds(result.scoredTokenIds),
+      scoredTokenCount: result.scoredTokenIds.length,
+      contextTokenHash: result.contextTokenHash,
+      provenance: result.provenance,
+    });
+    console.log(
+      `scored: "${text.slice(0, 40)}${text.length > 40 ? "..." : ""}" -> ${round6(result.score)}`
+    );
+  }
+
+  const fixture = {
+    modelId: MODEL_ID,
+    revision,
+    dtype: sentenceResults[0]?.provenance.dtype ?? "unknown",
+    logitsDtype: sentenceResults[0]?.provenance.logitsDtype ?? "unknown",
+    backend: "node-onnx",
+    transformersVersion: sentenceResults[0]?.provenance.libraryVersion ?? "unknown",
+    onnxruntimeVersion,
+    nodeVersion: process.version,
+    // Relative, not absolute: the score is a SUM over tokens, so its magnitude scales with
+    // sentence length. An absolute tolerance tightens arbitrarily for short sentences and
+    // loosens for long ones. The observed onnxruntime-node 1.14.0 -> 1.24.3 drift (Messmotor-
+    // Sanierung Task 4, byte-identical weights, same dtype) was ~1.16e-6 relative (max 3.55e-6
+    // across these 5 sentences); 1e-5 leaves an order of magnitude of headroom without being
+    // permissive enough to hide a real regression.
+    relativeTolerance: 1e-5,
+    generatedAt: new Date().toISOString(),
+    sentences: sentenceResults.map(({ provenance, ...rest }) => rest),
+  };
+
+  const fixturePath = join(CORE_ROOT, "tests/inference/fixtures/logprob-golden.json");
+  await mkdir(dirname(fixturePath), { recursive: true });
+  await writeFile(fixturePath, `${JSON.stringify(fixture, null, 2)}\n`, "utf8");
+  console.log(`\nFixture written to ${fixturePath}`);
+}
+
+await main();

package/scripts/ts-extensionless-resolve-hook.mjs

@@ -0,0 +1,26 @@
+/**
+ * Minimal Node.js module-resolution hook: when a relative specifier without an
+ * extension fails to resolve (the normal case for TypeScript sources compiled with
+ * `moduleResolution: "bundler"`, which intentionally omit ".ts" from import specifiers),
+ * retry once with ".ts" appended.
+ *
+ * This exists ONLY so that maintenance scripts can run directly against the
+ * TypeScript sources with `node --experimental-strip-types`, without needing a
+ * bundler or ts-node. It changes no application behavior.
+ */
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+export async function resolve(specifier, context, nextResolve) {
+  try {
+    return await nextResolve(specifier, context);
+  } catch (err) {
+    const isBareRelative = specifier.startsWith(".") && !/\.[a-zA-Z]+$/.test(specifier);
+    if (!isBareRelative) throw err;
+
+    const candidate = new URL(`${specifier}.ts`, context.parentURL);
+    if (!existsSync(fileURLToPath(candidate))) throw err;
+
+    return nextResolve(candidate.href, context);
+  }
+}

package/src/datasets/crows-pairs.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -62,3 +63,76 @@ export function loadCrowsPairsDataset(language: "en" | "de"): CrowsPairsEntry[]
     bias_type: pair.biasType,
   }));
 }
+
+export interface CustomDatasetMetadata {
+  name: string;
+  version: string;
+  sha256: string;
+  pairCount: number;
+}
+
+/**
+ * Load a user-supplied question catalog.
+ *
+ * Deliberately separate from loadCrowsPairsDataset: that one resolves a bundled
+ * asset by language code, this one takes a path the caller chose. The hash goes
+ * into the evidence artifact so "Fragekatalog + Version" is verifiable rather
+ * than merely stated.
+ */
+export function loadCustomDataset(filePath: string): {
+  pairs: CrowsPairsEntry[];
+  metadata: CustomDatasetMetadata;
+} {
+  const resolved = resolve(filePath);
+  if (!existsSync(resolved)) {
+    throw new Error(`Fragekatalog nicht gefunden: ${resolved}`);
+  }
+
+  const raw = readFileSync(resolved, "utf-8");
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Fragekatalog ist kein gültiges JSON: ${resolved}`);
+  }
+
+  const doc = parsed as { metadata?: Record<string, unknown>; pairs?: unknown[] };
+  if (!Array.isArray(doc.pairs) || doc.pairs.length === 0) {
+    throw new Error(`Fragekatalog enthält keine Paare: ${resolved}`);
+  }
+
+  const pairs: CrowsPairsEntry[] = doc.pairs.map((entry, index) => {
+    const p = entry as Record<string, unknown>;
+    const stereotype = typeof p.stereotype === "string" ? p.stereotype : undefined;
+    const antiStereotype = typeof p.antiStereotype === "string" ? p.antiStereotype : undefined;
+    if (!stereotype || !antiStereotype) {
+      throw new Error(
+        `Fragekatalog: Paar ${p.id ?? index} braucht 'stereotype' und 'antiStereotype' (${resolved})`
+      );
+    }
+    return {
+      id: typeof p.id === "number" ? p.id : index + 1,
+      sent_more: stereotype,
+      sent_less: antiStereotype,
+      bias_type: typeof p.biasType === "string" ? p.biasType : "unspecified",
+    };
+  });
+
+  const meta = doc.metadata ?? {};
+  return {
+    pairs,
+    metadata: {
+      name: typeof meta.name === "string" ? meta.name : "unbenannter Katalog",
+      version: typeof meta.version === "string" ? meta.version : "unversioniert",
+      sha256: createHash("sha256").update(raw).digest("hex"),
+      // Deliberately NOT the resolved absolute filesystem path: euconform.bias.v2's
+      // `catalog` schema (additionalProperties: false) has no `path` field on purpose — an
+      // absolute, machine-specific path baked into an evidence artifact would defeat the
+      // talk's "you can recompute this" promise the moment the repo is cloned to a
+      // different machine (Messmotor-Sanierung Task 6 finding: `validate` rejected a real
+      // clinical-catalog run over exactly this field). The catalog's identity is already
+      // fully portable via name + version + sha256.
+      pairCount: pairs.length,
+    },
+  };
+}