@euconform/core 1.4.0 → 1.6.0

package/dist/evidence/bundle.d.ts

@@ -7,6 +7,7 @@ interface BuildBundleOptions {
     report: ArtifactInput;
     aibom?: ArtifactInput;
     ci?: ArtifactInput;
+    bias?: ArtifactInput;
     summary?: ArtifactInput;
     tool: {
         name: string;

package/dist/evidence/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/evidence/bundle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyC,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjF,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAcxE"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/evidence/bundle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyC,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjF,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,kBAAkB;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAexE"}

package/dist/evidence/bundle.js

@@ -32,6 +32,8 @@ export function buildBundleManifest(opts) {
         artifacts.push(makeArtifactRef("aibom", opts.aibom, false));
     if (opts.ci)
         artifacts.push(makeArtifactRef("ci", opts.ci, false));
+    if (opts.bias)
+        artifacts.push(makeArtifactRef("bias", opts.bias, false));
     if (opts.summary)
         artifacts.push(makeArtifactRef("summary", opts.summary, false));
     return {

package/dist/evidence/index.d.ts

@@ -4,10 +4,17 @@
  * This module defines the evidence types produced by the scanner
  * and transforms raw scan results into structured output artifacts.
  */
-export type { AiBillOfMaterials, AppType, AssessmentHint, BomComponent, BomComponentKind, BundleArtifactRef, BundleArtifactRole, CiReport, ComplianceSignalGroup, ConfidenceLevel, DetectedSignal, DetectorContext, FailOnLevel, FileProvenance, GapCounts, OpenQuestion, RepoProfile, ScanBundle, ScanFile, ScanGap, ScanMeta, ScanOptions, ScanOutput, ScanReport, ScanResult, ScanScope, SignalCategory, SignalDetector, SignalEvidence, } from "./types";
+export type { AiBillOfMaterials, AppType, AssessmentHint, BiasReport, BiasReportV2, BiasReportV2Provenance, BiasReportV2Sampling, BomComponent, BomComponentKind, BundleArtifactRef, BundleArtifactRole, CiReport, ComplianceSignalGroup, ConfidenceLevel, DetectedSignal, DetectorContext, ExternalObservation, FailOnLevel, FileProvenance, GapCounts, OpenQuestion, RepoProfile, ScanBundle, ScanFile, ScanGap, ScanMeta, ScanOptions, ScanOutput, ScanReport, ScanResult, ScanScope, SignalCategory, SignalDetector, SignalEvidence, } from "./types";
+export type { BiasStatisticsV2, CategoryPreferenceStatistics, Quartiles, WilsonInterval, } from "./bias-statistics";
+export type { BiasComparison, BiasComparisonPaired, BiasPairChange, BiasRunSummary, BiasTypeComparison, CompareBiasRunsOptions, } from "./bias-comparison";
+export type { BiasValidationResult } from "./validate";
 export { generateScanOutput } from "./output";
 export { generateSummaryMarkdown } from "./markdown";
 export { buildBundleManifest } from "./bundle";
 export { sha256Hex } from "./hash";
-export { getSchemaMajorVersion, validateAiBillOfMaterials, validateCiReport, validateEcefJsonDocument, validateScanBundle, validateScanReport, } from "./validate";
+export { buildBiasStatistics, quartilesType7, wilson95, WILSON_Z95 } from "./bias-statistics";
+export { compareBiasRuns, mcnemarExactPValue, summarizeBiasRun, } from "./bias-comparison";
+export { formatBiasComparisonMarkdown } from "./bias-comparison-markdown";
+export { validateBiasReportV2, isPartialRun } from "./validate-bias-v2";
+export { getSchemaMajorVersion, validateAiBillOfMaterials, validateBiasArtifact, validateBiasReport, validateCiReport, validateEcefJsonDocument, validateExternalObservation, validateScanBundle, validateScanReport, } from "./validate";
 //# sourceMappingURL=index.d.ts.map

package/dist/evidence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,eAAe,EACf,WAAW,EACX,cAAc,EACd,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,4BAA4B,EAC5B,SAAS,EACT,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}

package/dist/evidence/index.js

@@ -8,4 +8,8 @@ export { generateScanOutput } from "./output";
 export { generateSummaryMarkdown } from "./markdown";
 export { buildBundleManifest } from "./bundle";
 export { sha256Hex } from "./hash";
-export { getSchemaMajorVersion, validateAiBillOfMaterials, validateCiReport, validateEcefJsonDocument, validateScanBundle, validateScanReport, } from "./validate";
+export { buildBiasStatistics, quartilesType7, wilson95, WILSON_Z95 } from "./bias-statistics";
+export { compareBiasRuns, mcnemarExactPValue, summarizeBiasRun, } from "./bias-comparison";
+export { formatBiasComparisonMarkdown } from "./bias-comparison-markdown";
+export { validateBiasReportV2, isPartialRun } from "./validate-bias-v2";
+export { getSchemaMajorVersion, validateAiBillOfMaterials, validateBiasArtifact, validateBiasReport, validateCiReport, validateEcefJsonDocument, validateExternalObservation, validateScanBundle, validateScanReport, } from "./validate";

package/dist/evidence/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAkoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAmoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}

package/dist/evidence/output.js

@@ -59,6 +59,7 @@ const SOURCE_PRIORITY = {
     config: 4,
     code: 3,
     "lock-file": 2,
+    "sbom-import": 2,
     docs: 1,
 };
 const EVIDENCE_PROVENANCE_PRIORITY = {

package/dist/evidence/types.d.ts

@@ -4,6 +4,8 @@
  * The scanner produces evidence, hints, and open questions — not legal verdicts.
  * Classification is done by the wizard from human input, not by the scanner.
  */
+import type { CrowsPairsFailedPair, CrowsPairsPairResult, SequenceLogProbMethod } from "../types";
+import type { BiasStatisticsV2 } from "./bias-statistics";
 export type SignalCategory = "framework" | "runtime" | "ai-provider" | "ai-framework" | "ai-model" | "local-inference" | "rag" | "training" | "compliance-disclosure" | "compliance-logging" | "compliance-oversight" | "compliance-bias" | "compliance-data" | "compliance-incident" | "compliance-reporting";
 export type ConfidenceLevel = "high" | "medium" | "low";
 export type ScanScope = "production" | "all";
@@ -146,10 +148,15 @@ export interface BomComponent {
     kind: BomComponentKind;
     name: string;
     version?: string;
-    source: "package.json" | "lock-file" | "code" | "config" | "docs";
+    source: "package.json" | "lock-file" | "code" | "config" | "docs" | "sbom-import";
+}
+export interface AibomMetadata {
+    importSource: "cyclonedx" | "spdx" | "manual";
+    importTool?: string;
+    originalTimestamp?: string;
 }
 export interface AiBillOfMaterials {
-    schemaVersion: "euconform.aibom.v1";
+    schemaVersion: "euconform.aibom.v1" | "euconform.aibom.v1.1";
     generatedAt: string;
     project: {
         name: string;
@@ -164,6 +171,7 @@ export interface AiBillOfMaterials {
         humanReviewFlow: boolean;
         incidentHandling: boolean;
     };
+    metadata?: AibomMetadata;
 }
 export type FailOnLevel = "none" | "critical" | "high" | "medium" | "low";
 export interface GapCounts {
@@ -205,7 +213,121 @@ export interface ScanOutput {
     aibom: AiBillOfMaterials;
     summaryMarkdown: string;
 }
-export type BundleArtifactRole = "report" | "aibom" | "ci" | "summary";
+export interface BiasReport {
+    schemaVersion: "euconform.bias.v1";
+    generatedAt: string;
+    model: string;
+    dataset: string;
+    result: {
+        score: number;
+        method: string;
+        pairsAnalyzed: number;
+        stereotypicalPreference: number;
+    };
+    /** Absent in runs written before sampling was recorded; null fields mean the full dataset. */
+    sampling?: {
+        datasetSize: number;
+        maxPairs: number | null;
+        seed: number | null;
+    };
+    limitations?: string[];
+    /** Provenance of a user-supplied question catalog. Absent when a bundled dataset was used. */
+    catalog?: {
+        name: string;
+        version: string;
+        sha256: string;
+        pairCount: number;
+    };
+    /** Per-category aggregates over pairResults. Optional so pre-existing artifacts stay valid. */
+    byBiasType?: {
+        biasType: string;
+        pairsCount: number;
+        stereotypePreferenceCount: number;
+        stereotypePreferencePercent: number;
+        averageBiasScore: number;
+    }[];
+    /** One entry per analysed pair, enabling third-party recomputation of the score. */
+    pairResults?: {
+        pairId: number | null;
+        stereotype: string;
+        antiStereotype: string;
+        biasType: string | null;
+        stereotypeLogProb: number;
+        antiStereotypeLogProb: number;
+        biasScore: number;
+        biasDirection: "stereotype" | "anti-stereotype" | "neutral";
+        method: string;
+    }[];
+}
+/** Mandatory measurement provenance — v2's core honesty guarantee. */
+export interface BiasReportV2Provenance {
+    /** Single supported engine (Ollama cannot measure sentence log-probabilities). */
+    engine: "transformers";
+    modelId: string;
+    /** Resolved immutable commit SHA (40 hex chars), never a mutable ref like "main". */
+    modelRevision: string;
+    /** The tokenizer actually used; equals modelId unless a distinct tokenizer repo was loaded. */
+    tokenizerId: string;
+    transformersVersion: string;
+    /**
+     * Installed onnxruntime-node version. Ergebnisrelevant: a native ONNX Runtime version
+     * bump (1.14.0 -> 1.24.3 across the @xenova/transformers -> @huggingface/transformers
+     * migration) shifted sequence log-probabilities at the 1e-6 relative level even with
+     * byte-identical model weights and dtype (Messmotor-Sanierung Task 4). Must be resolved
+     * from the installed package at measurement time; an artifact that cannot resolve it is
+     * a loud failure, not a placeholder.
+     */
+    onnxruntimeVersion: string;
+    /** Numeric precision used for scoring, e.g. "fp32" or "q8" — ergebnisrelevant (Task 1: up to 11.9% deviation quantized vs fp32). */
+    dtype: string;
+    backend: "node-onnx";
+    templateStrategy: "none" | "fixed_template_span";
+    /** Present only when templateStrategy is "fixed_template_span". */
+    promptText?: string;
+    promptSha256?: string;
+    contextTokenHash?: string;
+}
+export interface BiasReportV2Sampling {
+    mode: "seeded_sample" | "full";
+    datasetSize: number;
+    maxPairs: number | null;
+    seed: number | null;
+    /** SHA-256 over the compact JSON of the full dataset that was sampled from. */
+    datasetSha256: string;
+    /** Pair ids in selection order — the exact reproducible sample. */
+    pairIds: (number | null)[];
+}
+export interface BiasReportV2 {
+    schemaVersion: "euconform.bias.v2";
+    generatedAt: string;
+    model: string;
+    dataset: string;
+    provenance: BiasReportV2Provenance;
+    sampling: BiasReportV2Sampling;
+    result: {
+        score: number;
+        method: SequenceLogProbMethod;
+        pairsAnalyzed: number;
+    };
+    runStatus: "complete" | "partial";
+    selectedCount: number;
+    analyzedCount: number;
+    failedCount: number;
+    failedPairs: CrowsPairsFailedPair[];
+    /** Self-checkable: the semantic validator recomputes this from pairResults and rejects on mismatch (tolerance 1e-9, unrounded). */
+    statistics: BiasStatisticsV2;
+    /** One entry per analysed pair — the raw values statistics/validation recompute from. */
+    pairResults: CrowsPairsPairResult[];
+    limitations?: string[];
+    /** Provenance of a user-supplied question catalog. Absent when a bundled dataset was used. */
+    catalog?: {
+        name: string;
+        version: string;
+        sha256: string;
+        pairCount: number;
+    };
+}
+export type BundleArtifactRole = "report" | "aibom" | "ci" | "summary" | "bias";
 export interface BundleArtifactRef {
     role: BundleArtifactRole;
     fileName: string;
@@ -227,4 +349,62 @@ export interface ScanBundle {
     };
     artifacts: BundleArtifactRef[];
 }
+/**
+ * Provider-neutral envelope for an externally produced observation of a
+ * machine-readable declaration (rights, AI use, licence metadata, robots policy).
+ *
+ * It records what was visible at a point in time. It is NOT a licence, NOT an
+ * ownership determination, NOT proof of use and NOT permission — `result` only
+ * says whether a declaration was visible, and `unknown` must never be read as
+ * permission. The shape intentionally has no field that could express permission.
+ */
+export interface ExternalObservation {
+    schemaVersion: "euconform.external-observation.v1";
+    /** Provider-scoped unique id, so the exact record can be cited and re-fetched. */
+    observationId: string;
+    /** When the provider observed the declaration (not when the artifact was exported). */
+    observedAt: string;
+    /** Who produced the observation. Identification only; it does not change the meaning. */
+    provider: {
+        name: string;
+        version: string;
+        endpoint?: string;
+        contact?: string;
+    };
+    subject: {
+        kind: "url" | "repository" | "dataset" | "artifact";
+        identifier: string;
+        /** When the subject content was fetched; bounds the validity of the statement. */
+        retrievedAt: string;
+        /** Optional hash of the observed content. */
+        contentSha256?: string;
+    };
+    observation: {
+        kind: "rights-declaration" | "ai-use-declaration" | "license-metadata" | "robots-policy" | "terms-of-service";
+        /** Query vocabulary of the provider (e.g. ai-input, ai-train). Free-form on purpose. */
+        intendedUse: string[];
+        /**
+         * `declared` = a supported machine-readable declaration was visible — NOT that
+         * the use is permitted. `unknown` must never be converted into permission.
+         */
+        result: "declared" | "not-declared" | "unknown" | "not-applicable";
+        /** Present exactly when `result` is `declared`, so the claim stays checkable. */
+        declaration?: {
+            text: string;
+            sha256: string;
+            url?: string;
+            license?: string;
+        };
+    };
+    /** Mandatory coverage limits; an observation without stated limits is not reviewable. */
+    limitations: string[];
+    /** Optional integrity proof. Unsigned observations are valid but must be treated as unverified. */
+    signature?: {
+        algorithm: string;
+        keyId: string;
+        value: string;
+        signedPayloadSha256: string;
+        verifyUrl?: string;
+    };
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/evidence/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;CACnE;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAM1D,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;CACnF;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,mBAAmB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,uBAAuB,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,8FAA8F;IAC9F,QAAQ,CAAC,EAAE;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,+FAA+F;IAC/F,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,yBAAyB,EAAE,MAAM,CAAC;QAClC,2BAA2B,EAAE,MAAM,CAAC;QACpC,gBAAgB,EAAE,MAAM,CAAC;KAC1B,EAAE,CAAC;IACJ,oFAAoF;IACpF,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,qBAAqB,EAAE,MAAM,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,YAAY,GAAG,iBAAiB,GAAG,SAAS,CAAC;QAC5D,MAAM,EAAE,MAAM,CAAC;KAChB,EAAE,CAAC;CACL;AAYD,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oIAAoI;IACpI,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,MAAM,GAAG,qBAAqB,CAAC;IACjD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,eAAe,GAAG,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,OAAO,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,mBAAmB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,sBAAsB,CAAC;IACnC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,qBAAqB,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,mIAAmI;IACnI,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yFAAyF;IACzF,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,mCAAmC,CAAC;IACnD,kFAAkF;IAClF,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;QACpD,UAAU,EAAE,MAAM,CAAC;QACnB,kFAAkF;QAClF,WAAW,EAAE,MAAM,CAAC;QACpB,6CAA6C;QAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,WAAW,EAAE;QACX,IAAI,EACA,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,CAAC;QACvB,wFAAwF;QACxF,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB;;;WAGG;QACH,MAAM,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,CAAC;QACnE,iFAAiF;QACjF,WAAW,CAAC,EAAE;YACZ,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IACF,yFAAyF;IACzF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mGAAmG;IACnG,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH"}

package/dist/evidence/validate-bias-v2.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The ONE validator entrypoint for `euconform.bias.v2` artifacts
+ * (Messmotor-Sanierung Task 3). Both `euconform validate` and `euconform verify`
+ * call this — before this task they used different validators (AJV-only vs. the
+ * lenient hand-rolled `validateBiasReport`) that could disagree on the same file.
+ *
+ * Validation has two layers:
+ *  1. Schema shape — delegated to the AJV schema (`bias-v2.schema.json` via
+ *     `packages/core/src/validation/schema-validator.ts`), so there is exactly
+ *     one source of truth for "what fields must exist". Node-only (reads the
+ *     schema from disk); the browser calls `assertBiasV2Semantics` from
+ *     `@euconform/core/evidence/browser` for layer 2.
+ *  2. Semantic recomputation — every statistic, and the partial-run invariants,
+ *     are recomputed from the raw `pairResults` and compared against the stored
+ *     values with an absolute tolerance of 1e-9 (ambiguity resolution #2:
+ *     statistics are stored UNROUNDED; rounding only happens in the Markdown
+ *     report, so a tolerance far below any human-rounding step is meaningful).
+ *     A mismatch means the artifact's numbers do not follow from its own raw
+ *     data — e.g. a manipulated Wilson bound — and the artifact is rejected
+ *     with a message naming exactly which field disagreed.
+ *     This layer lives in `bias-v2-semantics.ts` so it can also run in the browser.
+ */
+import type { BiasReportV2 } from "./types";
+/**
+ * `verify --strict` rejects a partial run outright (ambiguity resolution #3):
+ * a diagnostic run is, by definition, not the complete measurement a strict
+ * check demands. Non-strict callers get this back as a plain boolean instead.
+ */
+export declare function isPartialRun(report: BiasReportV2): boolean;
+export declare function validateBiasReportV2(data: unknown): BiasReportV2;
+//# sourceMappingURL=validate-bias-v2.d.ts.map

package/dist/evidence/validate-bias-v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-bias-v2.d.ts","sourceRoot":"","sources":["../../src/evidence/validate-bias-v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAE1D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAUhE"}

package/dist/evidence/validate-bias-v2.js

@@ -0,0 +1,40 @@
+/**
+ * The ONE validator entrypoint for `euconform.bias.v2` artifacts
+ * (Messmotor-Sanierung Task 3). Both `euconform validate` and `euconform verify`
+ * call this — before this task they used different validators (AJV-only vs. the
+ * lenient hand-rolled `validateBiasReport`) that could disagree on the same file.
+ *
+ * Validation has two layers:
+ *  1. Schema shape — delegated to the AJV schema (`bias-v2.schema.json` via
+ *     `packages/core/src/validation/schema-validator.ts`), so there is exactly
+ *     one source of truth for "what fields must exist". Node-only (reads the
+ *     schema from disk); the browser calls `assertBiasV2Semantics` from
+ *     `@euconform/core/evidence/browser` for layer 2.
+ *  2. Semantic recomputation — every statistic, and the partial-run invariants,
+ *     are recomputed from the raw `pairResults` and compared against the stored
+ *     values with an absolute tolerance of 1e-9 (ambiguity resolution #2:
+ *     statistics are stored UNROUNDED; rounding only happens in the Markdown
+ *     report, so a tolerance far below any human-rounding step is meaningful).
+ *     A mismatch means the artifact's numbers do not follow from its own raw
+ *     data — e.g. a manipulated Wilson bound — and the artifact is rejected
+ *     with a message naming exactly which field disagreed.
+ *     This layer lives in `bias-v2-semantics.ts` so it can also run in the browser.
+ */
+import { validate as validateAgainstSchema } from "../validation/schema-validator";
+import { assertBiasV2Semantics } from "./bias-v2-semantics";
+/**
+ * `verify --strict` rejects a partial run outright (ambiguity resolution #3):
+ * a diagnostic run is, by definition, not the complete measurement a strict
+ * check demands. Non-strict callers get this back as a plain boolean instead.
+ */
+export function isPartialRun(report) {
+    return report.runStatus === "partial";
+}
+export function validateBiasReportV2(data) {
+    const schemaResult = validateAgainstSchema(data);
+    if (!schemaResult.valid) {
+        const messages = schemaResult.errors.map((e) => `${e.path || "/"} ${e.message}`).join("; ");
+        throw new Error(`Invalid euconform.bias.v2 artifact: ${messages || "schema validation failed"}`);
+    }
+    return assertBiasV2Semantics(data);
+}

package/dist/evidence/validate.d.ts

@@ -1,8 +1,35 @@
-import type { AiBillOfMaterials, CiReport, ScanBundle, ScanReport } from "./types";
+import type { AiBillOfMaterials, BiasReport, BiasReportV2, CiReport, ExternalObservation, ScanBundle, ScanReport } from "./types";
+/** Result of validating any bias artifact, v1 (legacy) or v2. */
+export interface BiasValidationResult {
+    legacy: boolean;
+    warning?: string;
+    document: BiasReport | BiasReportV2;
+}
 export declare function getSchemaMajorVersion(schemaVersion: string): string | null;
 export declare function validateScanReport(data: unknown): ScanReport;
 export declare function validateAiBillOfMaterials(data: unknown): AiBillOfMaterials;
 export declare function validateCiReport(data: unknown): CiReport;
+export declare function validateBiasReport(data: unknown): BiasReport;
+/**
+ * The ONE entry point for bias artifacts, dispatching on schemaVersion.
+ * `validate` (CLI) and `verify` both call this instead of picking their own
+ * validator, so they can no longer disagree on the same file.
+ *
+ * v1 keeps its existing (lenient) validation behaviour EXACTLY as before —
+ * `validateBiasReport` is untouched — but is now flagged `legacy: true` with a
+ * warning naming the incident. v2 is delegated to the shared semantic
+ * validator (`validate-bias-v2.ts`), which also recomputes statistics.
+ */
+export declare function validateBiasArtifact(data: unknown): BiasValidationResult;
+/**
+ * Shape check for `euconform.external-observation.v1`. The schema is the source
+ * of truth for shape (`euconform validate` delegates to it); this function is the
+ * programmatic entrypoint, mirroring the other document validators.
+ *
+ * It deliberately performs no interpretation: whether a declaration exists is
+ * data, and nothing here may turn `unknown` into permission.
+ */
+export declare function validateExternalObservation(data: unknown): ExternalObservation;
 export declare function validateScanBundle(data: unknown): ScanBundle;
-export declare function validateEcefJsonDocument(schemaVersion: string, data: unknown): ScanReport | AiBillOfMaterials | CiReport | ScanBundle;
+export declare function validateEcefJsonDocument(schemaVersion: string, data: unknown): ScanReport | AiBillOfMaterials | CiReport | ScanBundle | ExternalObservation;
 //# sourceMappingURL=validate.d.ts.map

package/dist/evidence/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA6DnF,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAoGD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAgC5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAaxD"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,mBAAmB,EACnB,UAAU,EACV,UAAU,EACX,MAAM,SAAS,CAAC;AAUjB,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,UAAU,GAAG,YAAY,CAAC;CACrC;AAmED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAsGD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAoB5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,oBAAoB,CAUxE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB,CA+C9E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CA+B5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,GAAG,mBAAmB,CAgB9E"}

package/dist/evidence/validate.js

@@ -1,3 +1,9 @@
+import { validateBiasReportV2 } from "./validate-bias-v2";
+const V1_BIAS_LEGACY_WARNING = "This artifact uses euconform.bias.v1: the method label 'logprobs_exact' on v1 bias " +
+    "artifacts is unreliable (Messmotor-Sanierung Task 1/2 found the measurement path it " +
+    "described could silently fall back to wall-clock nanoseconds instead of real " +
+    "log-probabilities). Re-measure with `euconform bias --engine transformers` to get a " +
+    "euconform.bias.v2 artifact.";
 function assertObject(data, label) {
     if (!data || typeof data !== "object" || Array.isArray(data)) {
         throw new Error(`Invalid ${label}: expected a JSON object`);
@@ -5,8 +11,10 @@ function assertObject(data, label) {
     return data;
 }
 function requireSchemaVersion(obj, expected, label) {
-    if (obj.schemaVersion !== expected) {
-        throw new Error(`Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`);
+    const allowed = Array.isArray(expected) ? expected : [expected];
+    if (!allowed.includes(obj.schemaVersion)) {
+        const quoted = allowed.map((v) => `"${v}"`).join(" or ");
+        throw new Error(`Invalid ${label} schema version: expected ${quoted}, got "${String(obj.schemaVersion)}"`);
     }
 }
 function requireField(obj, key, type, label, fieldName = key) {
@@ -67,7 +75,7 @@ export function validateScanReport(data) {
 }
 export function validateAiBillOfMaterials(data) {
     const obj = assertObject(data, "AIBOM");
-    requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
+    requireSchemaVersion(obj, ["euconform.aibom.v1", "euconform.aibom.v1.1"], "AIBOM");
     requireField(obj, "generatedAt", "string", "AIBOM");
     const project = requireField(obj, "project", "object", "AIBOM");
     requireField(project, "name", "string", "AIBOM", "project.name");
@@ -98,7 +106,7 @@ export function validateCiReport(data) {
     requireField(obj, "topGaps", "array", "CI report");
     return data;
 }
-const VALID_BUNDLE_ROLES = new Set(["report", "aibom", "ci", "summary"]);
+const VALID_BUNDLE_ROLES = new Set(["report", "aibom", "ci", "summary", "bias"]);
 const SHA256_HEX = /^[a-f0-9]{64}$/;
 function readBundleArtifactFields(raw, index) {
     const scope = "bundle artifact";
@@ -122,8 +130,16 @@ function readBundleArtifactFields(raw, index) {
         mimeType: raw.mimeType,
     };
 }
-function assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor) {
-    const { role, fileName, sha256, declaredSchemaVersion } = fields;
+/**
+ * Bundle decoupling (Messmotor-Sanierung Task 3): artifact schema versions are
+ * independent of the bundle's own schema version. A `euconform.bundle.v1`
+ * manifest may reference a `euconform.bias.v2` artifact — the bundle's job is
+ * to bind artifacts by hash and role, not to pin their versions. There is
+ * therefore no "same major as the bundle" check here; per-artifact schema
+ * shape is the responsibility of that artifact's own validator.
+ */
+function assertBundleArtifactIntegrity(fields, seenRoles, seenFiles) {
+    const { role, fileName, sha256 } = fields;
     if (!VALID_BUNDLE_ROLES.has(role)) {
         throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
     }
@@ -136,9 +152,6 @@ function assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor
     if (seenFiles.has(fileName)) {
         throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
     }
-    if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
-        throw new Error(`Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`);
-    }
 }
 function validateBundleHeader(obj) {
     requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
@@ -150,6 +163,76 @@ function validateBundleHeader(obj) {
     requireField(target, "name", "string", "bundle", "target.name");
     requireField(target, "rootPath", "string", "bundle", "target.rootPath");
 }
+export function validateBiasReport(data) {
+    const obj = assertObject(data, "bias report");
+    requireSchemaVersion(obj, "euconform.bias.v1", "bias report");
+    requireField(obj, "generatedAt", "string", "bias report");
+    requireField(obj, "model", "string", "bias report");
+    requireField(obj, "dataset", "string", "bias report");
+    const result = requireField(obj, "result", "object", "bias report");
+    requireField(result, "score", "number", "bias report", "result.score");
+    requireField(result, "method", "string", "bias report", "result.method");
+    requireField(result, "pairsAnalyzed", "number", "bias report", "result.pairsAnalyzed");
+    requireField(result, "stereotypicalPreference", "number", "bias report", "result.stereotypicalPreference");
+    return data;
+}
+/**
+ * The ONE entry point for bias artifacts, dispatching on schemaVersion.
+ * `validate` (CLI) and `verify` both call this instead of picking their own
+ * validator, so they can no longer disagree on the same file.
+ *
+ * v1 keeps its existing (lenient) validation behaviour EXACTLY as before —
+ * `validateBiasReport` is untouched — but is now flagged `legacy: true` with a
+ * warning naming the incident. v2 is delegated to the shared semantic
+ * validator (`validate-bias-v2.ts`), which also recomputes statistics.
+ */
+export function validateBiasArtifact(data) {
+    const obj = assertObject(data, "bias report");
+    if (obj.schemaVersion === "euconform.bias.v2") {
+        return { legacy: false, document: validateBiasReportV2(data) };
+    }
+    return {
+        legacy: true,
+        warning: V1_BIAS_LEGACY_WARNING,
+        document: validateBiasReport(data),
+    };
+}
+/**
+ * Shape check for `euconform.external-observation.v1`. The schema is the source
+ * of truth for shape (`euconform validate` delegates to it); this function is the
+ * programmatic entrypoint, mirroring the other document validators.
+ *
+ * It deliberately performs no interpretation: whether a declaration exists is
+ * data, and nothing here may turn `unknown` into permission.
+ */
+export function validateExternalObservation(data) {
+    const label = "external observation";
+    const obj = assertObject(data, label);
+    requireSchemaVersion(obj, "euconform.external-observation.v1", label);
+    requireField(obj, "observationId", "string", label);
+    requireField(obj, "observedAt", "string", label);
+    const provider = requireField(obj, "provider", "object", label);
+    requireField(provider, "name", "string", label, "provider.name");
+    requireField(provider, "version", "string", label, "provider.version");
+    const subject = requireField(obj, "subject", "object", label);
+    requireField(subject, "kind", "string", label, "subject.kind");
+    requireField(subject, "identifier", "string", label, "subject.identifier");
+    requireField(subject, "retrievedAt", "string", label, "subject.retrievedAt");
+    const observation = requireField(obj, "observation", "object", label);
+    requireField(observation, "kind", "string", label, "observation.kind");
+    requireStringArray(observation, "intendedUse", label, "observation.intendedUse");
+    const result = requireField(observation, "result", "string", label, "observation.result");
+    if (result === "declared") {
+        const declaration = requireField(observation, "declaration", "object", label, "observation.declaration");
+        requireField(declaration, "text", "string", label, "observation.declaration.text");
+        requireField(declaration, "sha256", "string", label, "observation.declaration.sha256");
+    }
+    const limitations = requireStringArray(obj, "limitations", label);
+    if (limitations.length === 0) {
+        throw new Error(`Invalid ${label}: 'limitations' must name at least one coverage limit — an observation without stated limits is not reviewable`);
+    }
+    return data;
+}
 export function validateScanBundle(data) {
     const obj = assertObject(data, "bundle");
     validateBundleHeader(obj);
@@ -159,12 +242,11 @@ export function validateScanBundle(data) {
     }
     const seenRoles = new Set();
     const seenFiles = new Set();
-    const bundleMajor = majorVersion("euconform.bundle.v1");
     let hasRequiredReport = false;
     for (let index = 0; index < artifacts.length; index++) {
         const raw = assertObject(artifacts[index], "bundle artifact");
         const fields = readBundleArtifactFields(raw, index);
-        assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor);
+        assertBundleArtifactIntegrity(fields, seenRoles, seenFiles);
         seenRoles.add(fields.role);
         seenFiles.add(fields.fileName);
         if (fields.role === "report") {
@@ -181,11 +263,14 @@ export function validateEcefJsonDocument(schemaVersion, data) {
         case "euconform.report.v1":
             return validateScanReport(data);
         case "euconform.aibom.v1":
+        case "euconform.aibom.v1.1":
             return validateAiBillOfMaterials(data);
         case "euconform.ci.v1":
             return validateCiReport(data);
         case "euconform.bundle.v1":
             return validateScanBundle(data);
+        case "euconform.external-observation.v1":
+            return validateExternalObservation(data);
         default:
             throw new Error(`Unsupported EuConform Evidence Format schemaVersion '${schemaVersion}'`);
     }