@euconform/core 1.4.0 → 1.5.0

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @euconform/core@1.4.0 build /home/runner/work/EuConform/EuConform/packages/core
+> @euconform/core@1.5.0 build /home/runner/work/EuConform/EuConform/packages/core
 > tsc
 

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @euconform/core
 
+## 1.5.0
+
+### Minor Changes
+
+- 0f6c07d: Add schema validation, CycloneDX SBOM import, and AI BOM v1.1 schema revision
+
+  - Introduce `euconform.aibom.v1.1` schema with optional import provenance metadata
+  - Add `validate` command for checking EuConform JSON documents against published schemas
+  - Add `import` command for mapping CycloneDX JSON SBOMs into the EuConform AI BOM layer
+  - Add PURL parser with graceful handling of malformed percent-encoding
+  - Remove `validate` and `importCycloneDx` from core barrel export (available via `@euconform/core/validation` and `@euconform/core/sbom` subpath exports)
+
 ## 1.4.0
 
 ### Minor Changes

package/dist/evidence/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAkoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/evidence/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EASV,UAAU,EAEV,UAAU,EAGX,MAAM,SAAS,CAAC;AAmoBjB,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CA+CrE"}

package/dist/evidence/output.js

@@ -59,6 +59,7 @@ const SOURCE_PRIORITY = {
     config: 4,
     code: 3,
     "lock-file": 2,
+    "sbom-import": 2,
     docs: 1,
 };
 const EVIDENCE_PROVENANCE_PRIORITY = {

package/dist/evidence/types.d.ts

@@ -146,10 +146,15 @@ export interface BomComponent {
     kind: BomComponentKind;
     name: string;
     version?: string;
-    source: "package.json" | "lock-file" | "code" | "config" | "docs";
+    source: "package.json" | "lock-file" | "code" | "config" | "docs" | "sbom-import";
+}
+export interface AibomMetadata {
+    importSource: "cyclonedx" | "spdx" | "manual";
+    importTool?: string;
+    originalTimestamp?: string;
 }
 export interface AiBillOfMaterials {
-    schemaVersion: "euconform.aibom.v1";
+    schemaVersion: "euconform.aibom.v1" | "euconform.aibom.v1.1";
     generatedAt: string;
     project: {
         name: string;
@@ -164,6 +169,7 @@ export interface AiBillOfMaterials {
         humanReviewFlow: boolean;
         incidentHandling: boolean;
     };
+    metadata?: AibomMetadata;
 }
 export type FailOnLevel = "none" | "critical" | "high" | "medium" | "low";
 export interface GapCounts {

package/dist/evidence/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;CACnE;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,SAAS,GACT,aAAa,GACb,cAAc,GACd,UAAU,GACV,iBAAiB,GACjB,KAAK,GACL,UAAU,GACV,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC;AAE7C,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,QAAQ,GACR,WAAW,GACX,MAAM,GACN,MAAM,GACN,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAMD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,OAAO,GACf,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;KAC/C,CAAC;CACH;AAMD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,cAAc,CAAC;CAC5B;AAMD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,EAAE,CAAC;AAMxE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrD,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,WAAW,EAAE;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,iBAAiB,EAAE;QACjB,UAAU,EAAE,qBAAqB,CAAC;QAClC,WAAW,EAAE,qBAAqB,CAAC;QACnC,gBAAgB,EAAE,qBAAqB,CAAC;QACxC,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,cAAc,EAAE,qBAAqB,CAAC;QACtC,cAAc,EAAE,qBAAqB,CAAC;QACtC,iBAAiB,EAAE,qBAAqB,CAAC;KAC1C,CAAC;IACF,eAAe,EAAE;QACf,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,EAAE,CAAC;QACjC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAMD,MAAM,MAAM,gBAAgB,GACxB,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,cAAc,GACd,OAAO,GACP,cAAc,GACd,WAAW,GACX,SAAS,GACT,MAAM,CAAC;AAEX,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;CACnF;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,sBAAsB,EAAE;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAMD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kBAAkB,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxC,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B,CAAC,CAAC;CACJ;AAMD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC"}

package/dist/evidence/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA6DnF,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAoGD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAgC5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAaxD"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/evidence/validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAmEnF,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAmC5D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAa1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAgCxD;AAoGD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAgC5D;AAED,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,GACZ,UAAU,GAAG,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAcxD"}

package/dist/evidence/validate.js

@@ -5,8 +5,10 @@ function assertObject(data, label) {
     return data;
 }
 function requireSchemaVersion(obj, expected, label) {
-    if (obj.schemaVersion !== expected) {
-        throw new Error(`Invalid ${label} schema version: expected "${expected}", got "${String(obj.schemaVersion)}"`);
+    const allowed = Array.isArray(expected) ? expected : [expected];
+    if (!allowed.includes(obj.schemaVersion)) {
+        const quoted = allowed.map((v) => `"${v}"`).join(" or ");
+        throw new Error(`Invalid ${label} schema version: expected ${quoted}, got "${String(obj.schemaVersion)}"`);
     }
 }
 function requireField(obj, key, type, label, fieldName = key) {
@@ -67,7 +69,7 @@ export function validateScanReport(data) {
 }
 export function validateAiBillOfMaterials(data) {
     const obj = assertObject(data, "AIBOM");
-    requireSchemaVersion(obj, "euconform.aibom.v1", "AIBOM");
+    requireSchemaVersion(obj, ["euconform.aibom.v1", "euconform.aibom.v1.1"], "AIBOM");
     requireField(obj, "generatedAt", "string", "AIBOM");
     const project = requireField(obj, "project", "object", "AIBOM");
     requireField(project, "name", "string", "AIBOM", "project.name");
@@ -181,6 +183,7 @@ export function validateEcefJsonDocument(schemaVersion, data) {
         case "euconform.report.v1":
             return validateScanReport(data);
         case "euconform.aibom.v1":
+        case "euconform.aibom.v1.1":
             return validateAiBillOfMaterials(data);
         case "euconform.ci.v1":
             return validateCiReport(data);

package/dist/sbom/component-mapper.d.ts

@@ -0,0 +1,26 @@
+import type { BomComponentKind } from "../evidence/types";
+import type { CycloneDxComponent } from "./types";
+export interface ComponentMapping {
+    kind: BomComponentKind;
+    source: "sbom-import";
+    confidence: "high" | "medium";
+    purlVersion?: string;
+}
+/**
+ * Map a CycloneDX component to an EuConform aibom component kind.
+ *
+ * 8-tier detection (descending priority):
+ * 1. ML-BOM extensions (modelCard, data)
+ * 2. CycloneDX component type mapping
+ * 3. Exact package name in registry
+ * 4. Explicit scoped name in registry (@langchain/core)
+ * 5. Scope mapping via KNOWN_AI_SCOPES (@langchain -> tool)
+ * 6. Scope-stripped name in registry (@huggingface/transformers -> transformers)
+ * 7. Purl namespace/name against registry
+ * 8. Purl name-only against registry
+ *
+ * Steps 3-6 are handled by lookupKnownPackage().
+ * Returns null if the component is not AI-relevant or has empty name.
+ */
+export declare function mapComponent(component: CycloneDxComponent): ComponentMapping | null;
+//# sourceMappingURL=component-mapper.d.ts.map

package/dist/sbom/component-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-mapper.d.ts","sourceRoot":"","sources":["../../src/sbom/component-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAgCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,CAgDnF"}

package/dist/sbom/component-mapper.js

@@ -0,0 +1,83 @@
+import { lookupKnownPackage } from "./known-packages";
+import { parsePurl } from "./purl";
+const CYCLONEDX_TYPE_MAP = {
+    "machine-learning-model": { kind: "model", confidence: "high" },
+    data: { kind: "dataset", confidence: "medium" },
+    platform: { kind: "inference-provider", confidence: "medium" },
+    service: { kind: "inference-provider", confidence: "medium" },
+};
+/** Tiers 7-8: Try to find a kind via purl namespace/name and name-only lookups. */
+function lookupViaPurl(parsed) {
+    if (!parsed)
+        return null;
+    // Tier 7: namespace/name (e.g. @langchain/core)
+    if (parsed.namespace) {
+        const scopedName = `${parsed.namespace}/${parsed.name}`;
+        const scopedKind = lookupKnownPackage(scopedName);
+        if (scopedKind)
+            return { kind: scopedKind, confidence: "high" };
+    }
+    // Tier 8: purl name only
+    const purlKind = lookupKnownPackage(parsed.name);
+    if (purlKind)
+        return { kind: purlKind, confidence: "medium" };
+    return null;
+}
+/**
+ * Map a CycloneDX component to an EuConform aibom component kind.
+ *
+ * 8-tier detection (descending priority):
+ * 1. ML-BOM extensions (modelCard, data)
+ * 2. CycloneDX component type mapping
+ * 3. Exact package name in registry
+ * 4. Explicit scoped name in registry (@langchain/core)
+ * 5. Scope mapping via KNOWN_AI_SCOPES (@langchain -> tool)
+ * 6. Scope-stripped name in registry (@huggingface/transformers -> transformers)
+ * 7. Purl namespace/name against registry
+ * 8. Purl name-only against registry
+ *
+ * Steps 3-6 are handled by lookupKnownPackage().
+ * Returns null if the component is not AI-relevant or has empty name.
+ */
+export function mapComponent(component) {
+    // Name validation
+    if (!component.name || component.name.trim() === "") {
+        return null;
+    }
+    // Extract purl info (used for fallback and version)
+    const parsed = component.purl ? parsePurl(component.purl) : null;
+    const purlVersion = parsed?.version;
+    // Tier 1: ML-BOM extensions
+    if (component.modelCard != null) {
+        return { kind: "model", source: "sbom-import", confidence: "high", purlVersion };
+    }
+    if (Array.isArray(component.data) && component.data.some((d) => d.type === "dataset")) {
+        return { kind: "dataset", source: "sbom-import", confidence: "high", purlVersion };
+    }
+    // Tier 2: CycloneDX component type
+    const typeMapping = CYCLONEDX_TYPE_MAP[component.type];
+    if (typeMapping) {
+        return {
+            kind: typeMapping.kind,
+            source: "sbom-import",
+            confidence: typeMapping.confidence,
+            purlVersion,
+        };
+    }
+    // Tiers 3-6: Known-package registry (handles exact, scoped, scope-fallback, scope-stripped)
+    const knownKind = lookupKnownPackage(component.name);
+    if (knownKind) {
+        return { kind: knownKind, source: "sbom-import", confidence: "high", purlVersion };
+    }
+    // Tiers 7-8: Purl fallback
+    const purlMatch = lookupViaPurl(parsed);
+    if (purlMatch) {
+        return {
+            kind: purlMatch.kind,
+            source: "sbom-import",
+            confidence: purlMatch.confidence,
+            purlVersion,
+        };
+    }
+    return null;
+}

package/dist/sbom/cyclonedx-import.d.ts

@@ -0,0 +1,34 @@
+import type { AiBillOfMaterials } from "../evidence/types";
+import type { ValidationResult } from "../validation/schema-validator";
+export interface ImportWarning {
+    component: string;
+    message: string;
+}
+export interface ImportSourceInfo {
+    bomFormat: "CycloneDX";
+    specVersion: string;
+    projectNameSource: "metadata.component.name" | "sourcePath" | "fallback";
+    importTool?: string;
+    originalTimestamp?: string;
+}
+export interface ImportSummary {
+    totalComponents: number;
+    filteredByScope: number;
+    aiRelevant: number;
+    skipped: number;
+    duplicatesRemoved: number;
+    byKind: Record<string, number>;
+    warnings: ImportWarning[];
+    source: ImportSourceInfo;
+}
+export interface ImportOptions {
+    scope?: "all" | "production";
+    sourcePath?: string;
+}
+export interface CycloneDxImportResult {
+    aibom: AiBillOfMaterials;
+    summary: ImportSummary;
+    validation: ValidationResult;
+}
+export declare function importCycloneDx(sbom: unknown, options?: ImportOptions): CycloneDxImportResult;
+//# sourceMappingURL=cyclonedx-import.d.ts.map

package/dist/sbom/cyclonedx-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx-import.d.ts","sourceRoot":"","sources":["../../src/sbom/cyclonedx-import.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAA+B,MAAM,mBAAmB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,yBAAyB,GAAG,YAAY,GAAG,UAAU,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,qBAAqB,CA2F7F"}

package/dist/sbom/cyclonedx-import.js

@@ -0,0 +1,131 @@
+import { basename, extname } from "node:path";
+import { validate } from "../validation/schema-validator";
+import { mapComponent } from "./component-mapper";
+import { SUPPORTED_SPEC_VERSIONS } from "./types";
+export function importCycloneDx(sbom, options) {
+    const bom = parseBom(sbom);
+    const scope = options?.scope ?? "all";
+    const allComponents = bom.components ?? [];
+    const warnings = [];
+    const totalComponents = allComponents.length;
+    const inScope = scope === "production"
+        ? allComponents.filter((c) => c.scope !== "optional" && c.scope !== "excluded")
+        : allComponents;
+    const filteredByScope = totalComponents - inScope.length;
+    const mapped = [];
+    for (const comp of inScope) {
+        const mapping = mapComponent(comp);
+        if (!mapping) {
+            if (!comp.name || comp.name.trim() === "") {
+                warnings.push({ component: "(empty)", message: "Skipped: missing or empty name" });
+            }
+            continue;
+        }
+        const version = comp.version || mapping.purlVersion;
+        if (!version) {
+            warnings.push({ component: comp.name, message: "Missing version field" });
+        }
+        mapped.push({
+            id: version ? `${mapping.kind}:${comp.name}:${version}` : `${mapping.kind}:${comp.name}`,
+            kind: mapping.kind,
+            name: comp.name,
+            ...(version ? { version } : {}),
+            source: "sbom-import",
+        });
+    }
+    const seen = new Set();
+    let duplicatesRemoved = 0;
+    const deduped = [];
+    for (const comp of mapped) {
+        if (seen.has(comp.id)) {
+            duplicatesRemoved++;
+            continue;
+        }
+        seen.add(comp.id);
+        deduped.push(comp);
+    }
+    const byKind = {};
+    for (const comp of deduped) {
+        byKind[comp.kind] = (byKind[comp.kind] ?? 0) + 1;
+    }
+    const { projectName, projectNameSource } = resolveProjectName(bom, options?.sourcePath);
+    const importTool = extractToolString(bom);
+    const originalTimestamp = bom.metadata?.timestamp;
+    const aibom = {
+        schemaVersion: "euconform.aibom.v1.1",
+        generatedAt: new Date().toISOString(),
+        project: { name: projectName, rootPath: "." },
+        components: deduped,
+        complianceCapabilities: {
+            biasEvaluation: false,
+            jsonExport: false,
+            pdfExport: false,
+            loggingInfrastructure: false,
+            humanReviewFlow: false,
+            incidentHandling: false,
+        },
+        metadata: buildMetadata(importTool, originalTimestamp),
+    };
+    const validation = validate(aibom);
+    return {
+        aibom,
+        summary: {
+            totalComponents,
+            filteredByScope,
+            aiRelevant: deduped.length,
+            skipped: inScope.length - mapped.length,
+            duplicatesRemoved,
+            byKind,
+            warnings,
+            source: buildSourceInfo(bom.specVersion, projectNameSource, importTool, originalTimestamp),
+        },
+        validation,
+    };
+}
+function resolveProjectName(bom, sourcePath) {
+    const metaName = bom.metadata?.component?.name;
+    if (metaName) {
+        return { projectName: metaName, projectNameSource: "metadata.component.name" };
+    }
+    if (sourcePath) {
+        const name = basename(sourcePath, extname(sourcePath));
+        return { projectName: name, projectNameSource: "sourcePath" };
+    }
+    return { projectName: "sbom-import", projectNameSource: "fallback" };
+}
+function extractToolString(bom) {
+    const tool = bom.metadata?.tools?.[0];
+    if (!tool?.name)
+        return undefined;
+    return tool.version ? `${tool.name} ${tool.version}` : tool.name;
+}
+function buildMetadata(importTool, originalTimestamp) {
+    const meta = { importSource: "cyclonedx" };
+    if (importTool)
+        meta.importTool = importTool;
+    if (originalTimestamp)
+        meta.originalTimestamp = originalTimestamp;
+    return meta;
+}
+function buildSourceInfo(specVersion, projectNameSource, importTool, originalTimestamp) {
+    const info = { bomFormat: "CycloneDX", specVersion, projectNameSource };
+    if (importTool)
+        info.importTool = importTool;
+    if (originalTimestamp)
+        info.originalTimestamp = originalTimestamp;
+    return info;
+}
+function parseBom(sbom) {
+    if (typeof sbom !== "object" || sbom === null) {
+        throw new Error("Input must be a JSON object");
+    }
+    const record = sbom;
+    if (record.bomFormat !== "CycloneDX") {
+        throw new Error(`Invalid bomFormat: expected "CycloneDX", got "${String(record.bomFormat)}"`);
+    }
+    const specVersion = String(record.specVersion ?? "");
+    if (!SUPPORTED_SPEC_VERSIONS.includes(specVersion)) {
+        throw new Error(`Unsupported specVersion "${specVersion}". Supported: ${SUPPORTED_SPEC_VERSIONS.join(", ")}`);
+    }
+    return sbom;
+}

package/dist/sbom/index.d.ts

@@ -0,0 +1,6 @@
+export { importCycloneDx, type CycloneDxImportResult, type ImportSummary, type ImportWarning, type ImportOptions, type ImportSourceInfo, } from "./cyclonedx-import";
+export { mapComponent, type ComponentMapping } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl, type ParsedPurl } from "./purl";
+export type { CycloneDxBom, CycloneDxComponent } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/sbom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sbom/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC"}

package/dist/sbom/index.js

@@ -0,0 +1,4 @@
+export { importCycloneDx, } from "./cyclonedx-import";
+export { mapComponent } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl } from "./purl";

package/dist/sbom/known-packages.d.ts

@@ -0,0 +1,13 @@
+import type { BomComponentKind } from "../evidence/types";
+export declare const KNOWN_AI_PACKAGES: Record<string, BomComponentKind>;
+export declare const KNOWN_AI_SCOPES: Record<string, BomComponentKind>;
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export declare function lookupKnownPackage(name: string): BomComponentKind | null;
+//# sourceMappingURL=known-packages.d.ts.map

package/dist/sbom/known-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-packages.d.ts","sourceRoot":"","sources":["../../src/sbom/known-packages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAiG9D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAO5D,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAuBxE"}

package/dist/sbom/known-packages.js

@@ -0,0 +1,129 @@
+export const KNOWN_AI_PACKAGES = {
+    // Models / model runtimes
+    "llama.cpp": "model",
+    "llama-cpp-python": "model",
+    "whisper.cpp": "model",
+    ggml: "model",
+    ctransformers: "model",
+    // AI Frameworks
+    transformers: "ai-framework",
+    torch: "ai-framework",
+    pytorch: "ai-framework",
+    tensorflow: "ai-framework",
+    "tensorflow-gpu": "ai-framework",
+    jax: "ai-framework",
+    keras: "ai-framework",
+    "pytorch-lightning": "ai-framework",
+    "scikit-learn": "ai-framework",
+    sklearn: "ai-framework",
+    xgboost: "ai-framework",
+    lightgbm: "ai-framework",
+    spacy: "ai-framework",
+    "huggingface-hub": "ai-framework",
+    diffusers: "ai-framework",
+    accelerate: "ai-framework",
+    peft: "ai-framework",
+    trl: "ai-framework",
+    onnxruntime: "ai-framework",
+    "onnxruntime-gpu": "ai-framework",
+    mlflow: "ai-framework",
+    // Embeddings
+    "sentence-transformers": "embedding",
+    fastembed: "embedding",
+    "openai-embeddings": "embedding",
+    "cohere-embed": "embedding",
+    // Inference Providers
+    openai: "inference-provider",
+    anthropic: "inference-provider",
+    ollama: "inference-provider",
+    vllm: "inference-provider",
+    "together-ai": "inference-provider",
+    replicate: "inference-provider",
+    groq: "inference-provider",
+    mistralai: "inference-provider",
+    cohere: "inference-provider",
+    "google-generativeai": "inference-provider",
+    ai21: "inference-provider",
+    // Vector Stores
+    pinecone: "vector-store",
+    "pinecone-client": "vector-store",
+    weaviate: "vector-store",
+    "weaviate-client": "vector-store",
+    qdrant: "vector-store",
+    "qdrant-client": "vector-store",
+    milvus: "vector-store",
+    pymilvus: "vector-store",
+    chromadb: "vector-store",
+    "chromadb-client": "vector-store",
+    pgvector: "vector-store",
+    faiss: "vector-store",
+    "faiss-cpu": "vector-store",
+    "faiss-gpu": "vector-store",
+    // Datasets
+    datasets: "dataset",
+    // Tools / Orchestration
+    langchain: "tool",
+    "langchain-core": "tool",
+    "langchain-community": "tool",
+    llamaindex: "tool",
+    "llama-index": "tool",
+    "semantic-kernel": "tool",
+    autogen: "tool",
+    crewai: "tool",
+    dspy: "tool",
+    "haystack-ai": "tool",
+    guidance: "tool",
+    guardrails: "tool",
+    "guardrails-ai": "tool",
+    lmql: "tool",
+    outlines: "tool",
+    // Scoped packages (npm)
+    "@langchain/core": "tool",
+    "@langchain/openai": "tool",
+    "@langchain/community": "tool",
+    "@langchain/anthropic": "tool",
+    "@huggingface/transformers": "ai-framework",
+    "@huggingface/inference": "inference-provider",
+    "@google/generative-ai": "inference-provider",
+    "@anthropic-ai/sdk": "inference-provider",
+    "@pinecone-database/pinecone": "vector-store",
+    "@qdrant/js-client-rest": "vector-store",
+};
+export const KNOWN_AI_SCOPES = {
+    "@langchain": "tool",
+    "@huggingface": "ai-framework",
+    "@tensorflow": "ai-framework",
+    "@anthropic-ai": "inference-provider",
+    "@pinecone-database": "vector-store",
+    "@qdrant": "vector-store",
+};
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export function lookupKnownPackage(name) {
+    const lower = name.toLowerCase();
+    // 1. Exact match
+    const exact = KNOWN_AI_PACKAGES[lower];
+    if (exact)
+        return exact;
+    // Scoped package handling
+    if (lower.startsWith("@") && lower.includes("/")) {
+        const scopeEnd = lower.indexOf("/");
+        const scope = lower.slice(0, scopeEnd);
+        const bareName = lower.slice(scopeEnd + 1);
+        // 2. Known AI scope
+        const scopeKind = KNOWN_AI_SCOPES[scope];
+        if (scopeKind)
+            return scopeKind;
+        // 3. Strip scope, check bare name
+        const bareKind = KNOWN_AI_PACKAGES[bareName];
+        if (bareKind)
+            return bareKind;
+    }
+    return null;
+}

package/dist/sbom/purl.d.ts

@@ -0,0 +1,14 @@
+export interface ParsedPurl {
+    scheme: "pkg";
+    type: string;
+    namespace?: string;
+    name: string;
+    version?: string;
+}
+/**
+ * Parse a Package URL (purl) string into its components.
+ * Follows the purl spec: pkg:type/namespace/name@version?qualifiers#subpath
+ * Returns null for invalid or non-pkg URLs.
+ */
+export declare function parsePurl(purl: string): ParsedPurl | null;
+//# sourceMappingURL=purl.d.ts.map

package/dist/sbom/purl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../src/sbom/purl.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,KAAK,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoDzD"}