@euconform/core 1.3.0 → 1.5.0

package/src/evidence/types.ts

@@ -232,11 +232,17 @@ export interface BomComponent {
   kind: BomComponentKind;
   name: string;
   version?: string;
-  source: "package.json" | "lock-file" | "code" | "config" | "docs";
+  source: "package.json" | "lock-file" | "code" | "config" | "docs" | "sbom-import";
+}
+
+export interface AibomMetadata {
+  importSource: "cyclonedx" | "spdx" | "manual";
+  importTool?: string;
+  originalTimestamp?: string;
 }
 
 export interface AiBillOfMaterials {
-  schemaVersion: "euconform.aibom.v1";
+  schemaVersion: "euconform.aibom.v1" | "euconform.aibom.v1.1";
   generatedAt: string;
   project: {
     name: string;
@@ -251,6 +257,7 @@ export interface AiBillOfMaterials {
     humanReviewFlow: boolean;
     incidentHandling: boolean;
   };
+  metadata?: AibomMetadata;
 }
 
 // ---------------------------------------------------------------------------

package/src/evidence/validate.ts

@@ -7,10 +7,16 @@ function assertObject(data: unknown, label: string): Record<string, unknown> {
   return data as Record<string, unknown>;
 }
 
-function requireSchemaVersion(obj: Record<string, unknown>, expected: string, label: string): void {
-  if (obj.schemaVersion !== expected) {
+function requireSchemaVersion(
+  obj: Record<string, unknown>,
+  expected: string | string[],
+  label: string
+): void {
+  const allowed = Array.isArray(expected) ? expected : [expected];
+  if (!allowed.includes(obj.schemaVersion as string)) {
+    const quoted = allowed.map((v) => `"${v}"`).join(" or ");
     throw new Error(
-      `Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`
+      `Invalid ${label} schema version: expected ${quoted}, got "${String(obj.schemaVersion)}"`
     );
   }
 }
@@ -102,7 +108,7 @@ export function validateScanReport(data: unknown): ScanReport {
 
 export function validateAiBillOfMaterials(data: unknown): AiBillOfMaterials {
   const obj = assertObject(data, "AIBOM");
-  requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
+  requireSchemaVersion(obj, ["euconform.aibom.v1", "euconform.aibom.v1.1"], "AIBOM");
   requireField(obj, "generatedAt", "string", "AIBOM");
 
   const project = requireField(obj, "project", "object", "AIBOM") as Record<string, unknown>;
@@ -152,8 +158,89 @@ export function validateCiReport(data: unknown): CiReport {
 const VALID_BUNDLE_ROLES = new Set(["report", "aibom", "ci", "summary"]);
 const SHA256_HEX = /^[a-f0-9]{64}$/;
 
-export function validateScanBundle(data: unknown): ScanBundle {
-  const obj = assertObject(data, "bundle");
+interface BundleArtifactFields {
+  role: string;
+  fileName: string;
+  sha256: string;
+  required: boolean;
+  declaredSchemaVersion: string | undefined;
+  mimeType: string | undefined;
+}
+
+function readBundleArtifactFields(
+  raw: Record<string, unknown>,
+  index: number
+): BundleArtifactFields {
+  const scope = "bundle artifact";
+  const role = requireField(raw, "role", "string", scope, `artifacts[${index}].role`) as string;
+  const fileName = requireField(
+    raw,
+    "fileName",
+    "string",
+    scope,
+    `artifacts[${index}].fileName`
+  ) as string;
+  const sha256 = requireField(
+    raw,
+    "sha256",
+    "string",
+    scope,
+    `artifacts[${index}].sha256`
+  ) as string;
+  const required = requireField(
+    raw,
+    "required",
+    "boolean",
+    scope,
+    `artifacts[${index}].required`
+  ) as boolean;
+
+  const declaredSchemaVersion = raw.schemaVersion;
+  if (declaredSchemaVersion !== undefined && typeof declaredSchemaVersion !== "string") {
+    throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
+  }
+  if (raw.mimeType !== undefined && typeof raw.mimeType !== "string") {
+    throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
+  }
+
+  return {
+    role,
+    fileName,
+    sha256,
+    required,
+    declaredSchemaVersion: declaredSchemaVersion as string | undefined,
+    mimeType: raw.mimeType as string | undefined,
+  };
+}
+
+function assertBundleArtifactIntegrity(
+  fields: BundleArtifactFields,
+  seenRoles: Set<string>,
+  seenFiles: Set<string>,
+  bundleMajor: string | null
+): void {
+  const { role, fileName, sha256, declaredSchemaVersion } = fields;
+
+  if (!VALID_BUNDLE_ROLES.has(role)) {
+    throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
+  }
+  if (!SHA256_HEX.test(sha256)) {
+    throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
+  }
+  if (seenRoles.has(role)) {
+    throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
+  }
+  if (seenFiles.has(fileName)) {
+    throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
+  }
+  if (declaredSchemaVersion && bundleMajor && majorVersion(declaredSchemaVersion) !== bundleMajor) {
+    throw new Error(
+      `Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`
+    );
+  }
+}
+
+function validateBundleHeader(obj: Record<string, unknown>): void {
   requireSchemaVersion(obj, "euconform.bundle.v1", "bundle");
   requireField(obj, "generatedAt", "string", "bundle");
 
@@ -164,6 +251,11 @@ export function validateScanBundle(data: unknown): ScanBundle {
   const target = requireField(obj, "target", "object", "bundle") as Record<string, unknown>;
   requireField(target, "name", "string", "bundle", "target.name");
   requireField(target, "rootPath", "string", "bundle", "target.rootPath");
+}
+
+export function validateScanBundle(data: unknown): ScanBundle {
+  const obj = assertObject(data, "bundle");
+  validateBundleHeader(obj);
 
   const artifacts = requireField(obj, "artifacts", "array", "bundle") as unknown[];
   if (artifacts.length === 0) {
@@ -176,71 +268,15 @@ export function validateScanBundle(data: unknown): ScanBundle {
   let hasRequiredReport = false;
 
   for (let index = 0; index < artifacts.length; index++) {
-    const artifact = assertObject(artifacts[index], "bundle artifact");
-    const role = requireField(
-      artifact,
-      "role",
-      "string",
-      "bundle artifact",
-      `artifacts[${index}].role`
-    ) as string;
-    const fileName = requireField(
-      artifact,
-      "fileName",
-      "string",
-      "bundle artifact",
-      `artifacts[${index}].fileName`
-    ) as string;
-    const sha256 = requireField(
-      artifact,
-      "sha256",
-      "string",
-      "bundle artifact",
-      `artifacts[${index}].sha256`
-    ) as string;
-    const required = requireField(
-      artifact,
-      "required",
-      "boolean",
-      "bundle artifact",
-      `artifacts[${index}].required`
-    ) as boolean;
-
-    if (!VALID_BUNDLE_ROLES.has(role)) {
-      throw new Error(`Invalid bundle artifact: unsupported role '${role}'`);
-    }
-    if (!SHA256_HEX.test(sha256)) {
-      throw new Error(`Invalid bundle artifact: '${fileName}' has invalid sha256`);
-    }
-    if (seenRoles.has(role)) {
-      throw new Error(`Invalid bundle artifact: duplicate role '${role}'`);
-    }
-    if (seenFiles.has(fileName)) {
-      throw new Error(`Invalid bundle artifact: duplicate fileName '${fileName}'`);
-    }
-    seenRoles.add(role);
-    seenFiles.add(fileName);
+    const raw = assertObject(artifacts[index], "bundle artifact");
+    const fields = readBundleArtifactFields(raw, index);
+    assertBundleArtifactIntegrity(fields, seenRoles, seenFiles, bundleMajor);
 
-    const declaredSchemaVersion = artifact.schemaVersion;
-    if (declaredSchemaVersion !== undefined && typeof declaredSchemaVersion !== "string") {
-      throw new Error(`Invalid bundle artifact: '${fileName}' has non-string schemaVersion`);
-    }
-    if (artifact.mimeType !== undefined && typeof artifact.mimeType !== "string") {
-      throw new Error(`Invalid bundle artifact: '${fileName}' has non-string mimeType`);
-    }
-
-    if (
-      declaredSchemaVersion &&
-      bundleMajor &&
-      majorVersion(declaredSchemaVersion) !== bundleMajor
-    ) {
-      throw new Error(
-        `Invalid bundle artifact: '${fileName}' uses schemaVersion '${declaredSchemaVersion}' with a different major than the bundle`
-      );
-    }
+    seenRoles.add(fields.role);
+    seenFiles.add(fields.fileName);
 
-    if (role === "report") {
-      hasRequiredReport = required;
+    if (fields.role === "report") {
+      hasRequiredReport = fields.required;
     }
   }
 
@@ -259,12 +295,13 @@ export function validateEcefJsonDocument(
     case "euconform.report.v1":
       return validateScanReport(data);
     case "euconform.aibom.v1":
+    case "euconform.aibom.v1.1":
       return validateAiBillOfMaterials(data);
     case "euconform.ci.v1":
       return validateCiReport(data);
     case "euconform.bundle.v1":
       return validateScanBundle(data);
     default:
-      throw new Error(`Unsupported ECEF schemaVersion '${schemaVersion}'`);
+      throw new Error(`Unsupported EuConform Evidence Format schemaVersion '${schemaVersion}'`);
   }
 }

package/src/index.ts

@@ -147,6 +147,7 @@ export {
   type UserPreferences,
   type EnhancedModelSelectionState,
   type CapabilityDetectionStatus,
+  type CapabilityCache,
 } from "./inference";
 
 // Inference Factory

package/src/inference/index.ts

@@ -132,7 +132,12 @@ export async function createAutoInferenceClient(preferredModel?: string): Promis
 }
 
 // Re-export types and utilities
-export { detectOllama, listOllamaModels, OllamaClient } from "./ollama-client";
+export {
+  detectOllama,
+  listOllamaModels,
+  OllamaClient,
+  type CapabilityCache,
+} from "./ollama-client";
 export { BrowserInference, checkWebGPU, BROWSER_MODELS } from "./browser-inference";
 export {
   InferenceFactory,

package/src/inference/ollama-client.ts

@@ -54,6 +54,12 @@ export interface OllamaLogProbsResponse extends OllamaGenerateResponse {
   }>;
 }
 
+/** Abstraction for capability caching — localStorage in browser, file-based in CLI */
+export interface CapabilityCache {
+  get(key: string): string | null;
+  set(key: string, value: string): void;
+}
+
 const OLLAMA_BASE_URL = "http://localhost:11434";
 
 /**
@@ -217,11 +223,13 @@ export class OllamaClient {
   private baseUrl: string;
   public readonly model: string;
   private capabilityCache: Map<string, ModelCapabilityCache>;
+  private externalCache: CapabilityCache | null;
 
-  constructor(model: string, baseUrl = OLLAMA_BASE_URL) {
+  constructor(model: string, baseUrl = OLLAMA_BASE_URL, cache?: CapabilityCache) {
     this.baseUrl = baseUrl;
     this.model = model;
     this.capabilityCache = new Map();
+    this.externalCache = cache ?? null;
   }
 
   private isCloudModel(): boolean {
@@ -344,33 +352,36 @@ export class OllamaClient {
   }
 
   /**
-   * Get cached capability result from localStorage
+   * Get cached capability result from localStorage or external cache
    */
   private getCachedCapability(): ModelCapabilityCache | null {
     try {
       const cacheKey = `ollama_supports_logprobs_${this.model}`;
-      const cached = localStorage.getItem(cacheKey);
+      let cached: string | null = null;
+
+      if (this.externalCache) {
+        cached = this.externalCache.get(cacheKey);
+      } else if (typeof localStorage !== "undefined") {
+        cached = localStorage.getItem(cacheKey);
+      }
 
       if (cached) {
         const capability: ModelCapabilityCache = JSON.parse(cached);
-
-        // Check if cache is still valid (24 hours)
         const cacheAge = Date.now() - new Date(capability.testedAt).getTime();
-        const maxAge = 24 * 60 * 60 * 1000; // 24 hours in milliseconds
-
-        if (cacheAge < maxAge) {
+        const CACHE_TTL = 24 * 60 * 60 * 1000; // 24 hours
+        if (cacheAge < CACHE_TTL) {
           return capability;
         }
       }
-    } catch (error) {
-      console.warn("Failed to read capability cache:", error);
-    }
 
-    return null;
+      return null;
+    } catch {
+      return null;
+    }
   }
 
   /**
-   * Cache capability result in localStorage
+   * Cache capability result in localStorage or external cache
    */
   private setCachedCapability(supports: boolean): void {
     try {
@@ -381,7 +392,12 @@ export class OllamaClient {
         testedAt: new Date().toISOString(),
       };
 
-      localStorage.setItem(cacheKey, JSON.stringify(capability));
+      if (this.externalCache) {
+        this.externalCache.set(cacheKey, JSON.stringify(capability));
+      } else if (typeof localStorage !== "undefined") {
+        localStorage.setItem(cacheKey, JSON.stringify(capability));
+      }
+
       this.capabilityCache.set(this.model, capability);
     } catch (error) {
       console.warn("Failed to cache capability result:", error);

package/src/sbom/component-mapper.ts

@@ -0,0 +1,107 @@
+import type { BomComponentKind } from "../evidence/types";
+import { lookupKnownPackage } from "./known-packages";
+import { parsePurl } from "./purl";
+import type { CycloneDxComponent } from "./types";
+
+export interface ComponentMapping {
+  kind: BomComponentKind;
+  source: "sbom-import";
+  confidence: "high" | "medium";
+  purlVersion?: string;
+}
+
+const CYCLONEDX_TYPE_MAP: Record<
+  string,
+  { kind: BomComponentKind; confidence: "high" | "medium" }
+> = {
+  "machine-learning-model": { kind: "model", confidence: "high" },
+  data: { kind: "dataset", confidence: "medium" },
+  platform: { kind: "inference-provider", confidence: "medium" },
+  service: { kind: "inference-provider", confidence: "medium" },
+};
+
+/** Tiers 7-8: Try to find a kind via purl namespace/name and name-only lookups. */
+function lookupViaPurl(
+  parsed: ReturnType<typeof parsePurl>
+): { kind: BomComponentKind; confidence: "high" | "medium" } | null {
+  if (!parsed) return null;
+
+  // Tier 7: namespace/name (e.g. @langchain/core)
+  if (parsed.namespace) {
+    const scopedName = `${parsed.namespace}/${parsed.name}`;
+    const scopedKind = lookupKnownPackage(scopedName);
+    if (scopedKind) return { kind: scopedKind, confidence: "high" };
+  }
+
+  // Tier 8: purl name only
+  const purlKind = lookupKnownPackage(parsed.name);
+  if (purlKind) return { kind: purlKind, confidence: "medium" };
+
+  return null;
+}
+
+/**
+ * Map a CycloneDX component to an EuConform aibom component kind.
+ *
+ * 8-tier detection (descending priority):
+ * 1. ML-BOM extensions (modelCard, data)
+ * 2. CycloneDX component type mapping
+ * 3. Exact package name in registry
+ * 4. Explicit scoped name in registry (@langchain/core)
+ * 5. Scope mapping via KNOWN_AI_SCOPES (@langchain -> tool)
+ * 6. Scope-stripped name in registry (@huggingface/transformers -> transformers)
+ * 7. Purl namespace/name against registry
+ * 8. Purl name-only against registry
+ *
+ * Steps 3-6 are handled by lookupKnownPackage().
+ * Returns null if the component is not AI-relevant or has empty name.
+ */
+export function mapComponent(component: CycloneDxComponent): ComponentMapping | null {
+  // Name validation
+  if (!component.name || component.name.trim() === "") {
+    return null;
+  }
+
+  // Extract purl info (used for fallback and version)
+  const parsed = component.purl ? parsePurl(component.purl) : null;
+  const purlVersion = parsed?.version;
+
+  // Tier 1: ML-BOM extensions
+  if (component.modelCard != null) {
+    return { kind: "model", source: "sbom-import", confidence: "high", purlVersion };
+  }
+
+  if (Array.isArray(component.data) && component.data.some((d) => d.type === "dataset")) {
+    return { kind: "dataset", source: "sbom-import", confidence: "high", purlVersion };
+  }
+
+  // Tier 2: CycloneDX component type
+  const typeMapping = CYCLONEDX_TYPE_MAP[component.type];
+  if (typeMapping) {
+    return {
+      kind: typeMapping.kind,
+      source: "sbom-import",
+      confidence: typeMapping.confidence,
+      purlVersion,
+    };
+  }
+
+  // Tiers 3-6: Known-package registry (handles exact, scoped, scope-fallback, scope-stripped)
+  const knownKind = lookupKnownPackage(component.name);
+  if (knownKind) {
+    return { kind: knownKind, source: "sbom-import", confidence: "high", purlVersion };
+  }
+
+  // Tiers 7-8: Purl fallback
+  const purlMatch = lookupViaPurl(parsed);
+  if (purlMatch) {
+    return {
+      kind: purlMatch.kind,
+      source: "sbom-import",
+      confidence: purlMatch.confidence,
+      purlVersion,
+    };
+  }
+
+  return null;
+}

package/src/sbom/cyclonedx-import.ts

@@ -0,0 +1,198 @@
+import { basename, extname } from "node:path";
+import type { AiBillOfMaterials, AibomMetadata, BomComponent } from "../evidence/types";
+import type { ValidationResult } from "../validation/schema-validator";
+import { validate } from "../validation/schema-validator";
+import { mapComponent } from "./component-mapper";
+import type { CycloneDxBom } from "./types";
+import { SUPPORTED_SPEC_VERSIONS } from "./types";
+
+export interface ImportWarning {
+  component: string;
+  message: string;
+}
+
+export interface ImportSourceInfo {
+  bomFormat: "CycloneDX";
+  specVersion: string;
+  projectNameSource: "metadata.component.name" | "sourcePath" | "fallback";
+  importTool?: string;
+  originalTimestamp?: string;
+}
+
+export interface ImportSummary {
+  totalComponents: number;
+  filteredByScope: number;
+  aiRelevant: number;
+  skipped: number;
+  duplicatesRemoved: number;
+  byKind: Record<string, number>;
+  warnings: ImportWarning[];
+  source: ImportSourceInfo;
+}
+
+export interface ImportOptions {
+  scope?: "all" | "production";
+  sourcePath?: string;
+}
+
+export interface CycloneDxImportResult {
+  aibom: AiBillOfMaterials;
+  summary: ImportSummary;
+  validation: ValidationResult;
+}
+
+export function importCycloneDx(sbom: unknown, options?: ImportOptions): CycloneDxImportResult {
+  const bom = parseBom(sbom);
+  const scope = options?.scope ?? "all";
+
+  const allComponents = bom.components ?? [];
+  const warnings: ImportWarning[] = [];
+  const totalComponents = allComponents.length;
+
+  const inScope =
+    scope === "production"
+      ? allComponents.filter((c) => c.scope !== "optional" && c.scope !== "excluded")
+      : allComponents;
+  const filteredByScope = totalComponents - inScope.length;
+
+  const mapped: BomComponent[] = [];
+  for (const comp of inScope) {
+    const mapping = mapComponent(comp);
+    if (!mapping) {
+      if (!comp.name || comp.name.trim() === "") {
+        warnings.push({ component: "(empty)", message: "Skipped: missing or empty name" });
+      }
+      continue;
+    }
+
+    const version = comp.version || mapping.purlVersion;
+    if (!version) {
+      warnings.push({ component: comp.name, message: "Missing version field" });
+    }
+
+    mapped.push({
+      id: version ? `${mapping.kind}:${comp.name}:${version}` : `${mapping.kind}:${comp.name}`,
+      kind: mapping.kind,
+      name: comp.name,
+      ...(version ? { version } : {}),
+      source: "sbom-import",
+    });
+  }
+
+  const seen = new Set<string>();
+  let duplicatesRemoved = 0;
+  const deduped: BomComponent[] = [];
+  for (const comp of mapped) {
+    if (seen.has(comp.id)) {
+      duplicatesRemoved++;
+      continue;
+    }
+    seen.add(comp.id);
+    deduped.push(comp);
+  }
+
+  const byKind: Record<string, number> = {};
+  for (const comp of deduped) {
+    byKind[comp.kind] = (byKind[comp.kind] ?? 0) + 1;
+  }
+
+  const { projectName, projectNameSource } = resolveProjectName(bom, options?.sourcePath);
+  const importTool = extractToolString(bom);
+  const originalTimestamp = bom.metadata?.timestamp;
+
+  const aibom: AiBillOfMaterials = {
+    schemaVersion: "euconform.aibom.v1.1",
+    generatedAt: new Date().toISOString(),
+    project: { name: projectName, rootPath: "." },
+    components: deduped,
+    complianceCapabilities: {
+      biasEvaluation: false,
+      jsonExport: false,
+      pdfExport: false,
+      loggingInfrastructure: false,
+      humanReviewFlow: false,
+      incidentHandling: false,
+    },
+    metadata: buildMetadata(importTool, originalTimestamp),
+  };
+
+  const validation = validate(aibom);
+
+  return {
+    aibom,
+    summary: {
+      totalComponents,
+      filteredByScope,
+      aiRelevant: deduped.length,
+      skipped: inScope.length - mapped.length,
+      duplicatesRemoved,
+      byKind,
+      warnings,
+      source: buildSourceInfo(bom.specVersion, projectNameSource, importTool, originalTimestamp),
+    },
+    validation,
+  };
+}
+
+function resolveProjectName(
+  bom: CycloneDxBom,
+  sourcePath?: string
+): { projectName: string; projectNameSource: ImportSourceInfo["projectNameSource"] } {
+  const metaName = bom.metadata?.component?.name;
+  if (metaName) {
+    return { projectName: metaName, projectNameSource: "metadata.component.name" };
+  }
+
+  if (sourcePath) {
+    const name = basename(sourcePath, extname(sourcePath));
+    return { projectName: name, projectNameSource: "sourcePath" };
+  }
+
+  return { projectName: "sbom-import", projectNameSource: "fallback" };
+}
+
+function extractToolString(bom: CycloneDxBom): string | undefined {
+  const tool = bom.metadata?.tools?.[0];
+  if (!tool?.name) return undefined;
+  return tool.version ? `${tool.name} ${tool.version}` : tool.name;
+}
+
+function buildMetadata(importTool?: string, originalTimestamp?: string): AibomMetadata {
+  const meta: AibomMetadata = { importSource: "cyclonedx" };
+  if (importTool) meta.importTool = importTool;
+  if (originalTimestamp) meta.originalTimestamp = originalTimestamp;
+  return meta;
+}
+
+function buildSourceInfo(
+  specVersion: string,
+  projectNameSource: ImportSourceInfo["projectNameSource"],
+  importTool?: string,
+  originalTimestamp?: string
+): ImportSourceInfo {
+  const info: ImportSourceInfo = { bomFormat: "CycloneDX", specVersion, projectNameSource };
+  if (importTool) info.importTool = importTool;
+  if (originalTimestamp) info.originalTimestamp = originalTimestamp;
+  return info;
+}
+
+function parseBom(sbom: unknown): CycloneDxBom {
+  if (typeof sbom !== "object" || sbom === null) {
+    throw new Error("Input must be a JSON object");
+  }
+
+  const record = sbom as Record<string, unknown>;
+
+  if (record.bomFormat !== "CycloneDX") {
+    throw new Error(`Invalid bomFormat: expected "CycloneDX", got "${String(record.bomFormat)}"`);
+  }
+
+  const specVersion = String(record.specVersion ?? "");
+  if (!SUPPORTED_SPEC_VERSIONS.includes(specVersion as (typeof SUPPORTED_SPEC_VERSIONS)[number])) {
+    throw new Error(
+      `Unsupported specVersion "${specVersion}". Supported: ${SUPPORTED_SPEC_VERSIONS.join(", ")}`
+    );
+  }
+
+  return sbom as CycloneDxBom;
+}

package/src/sbom/index.ts

@@ -0,0 +1,12 @@
+export {
+  importCycloneDx,
+  type CycloneDxImportResult,
+  type ImportSummary,
+  type ImportWarning,
+  type ImportOptions,
+  type ImportSourceInfo,
+} from "./cyclonedx-import";
+export { mapComponent, type ComponentMapping } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl, type ParsedPurl } from "./purl";
+export type { CycloneDxBom, CycloneDxComponent } from "./types";