@euconform/core 1.4.0 → 1.6.0

package/tests/sbom/component-mapper.test.ts

@@ -0,0 +1,258 @@
+import { describe, expect, it } from "vitest";
+import { mapComponent } from "../../src/sbom/component-mapper";
+import { lookupKnownPackage } from "../../src/sbom/known-packages";
+import type { CycloneDxComponent } from "../../src/sbom/types";
+
+describe("known-packages", () => {
+  it("recognizes torch as ai-framework", () => {
+    expect(lookupKnownPackage("torch")).toBe("ai-framework");
+  });
+
+  it("recognizes openai as inference-provider", () => {
+    expect(lookupKnownPackage("openai")).toBe("inference-provider");
+  });
+
+  it("recognizes chromadb as vector-store", () => {
+    expect(lookupKnownPackage("chromadb")).toBe("vector-store");
+  });
+
+  it("recognizes langchain as tool", () => {
+    expect(lookupKnownPackage("langchain")).toBe("tool");
+  });
+
+  it("returns null for unknown packages", () => {
+    expect(lookupKnownPackage("express")).toBeNull();
+    expect(lookupKnownPackage("lodash")).toBeNull();
+    expect(lookupKnownPackage("react")).toBeNull();
+  });
+
+  it("is case-insensitive", () => {
+    expect(lookupKnownPackage("Transformers")).toBe("ai-framework");
+    expect(lookupKnownPackage("OPENAI")).toBe("inference-provider");
+  });
+
+  it("recognizes @langchain/core as tool", () => {
+    expect(lookupKnownPackage("@langchain/core")).toBe("tool");
+  });
+
+  it("recognizes @huggingface/transformers as ai-framework", () => {
+    expect(lookupKnownPackage("@huggingface/transformers")).toBe("ai-framework");
+  });
+
+  it("recognizes @google/generative-ai as inference-provider", () => {
+    expect(lookupKnownPackage("@google/generative-ai")).toBe("inference-provider");
+  });
+
+  it("falls back to scope lookup for unknown @langchain/* packages", () => {
+    expect(lookupKnownPackage("@langchain/unknown-new-package")).toBe("tool");
+  });
+
+  it("falls back to stripping scope and checking name", () => {
+    expect(lookupKnownPackage("@someorg/transformers")).toBe("ai-framework");
+  });
+
+  it("returns null for unknown scoped packages", () => {
+    expect(lookupKnownPackage("@types/node")).toBeNull();
+    expect(lookupKnownPackage("@testing-library/react")).toBeNull();
+  });
+});
+
+describe("component-mapper", () => {
+  describe("tier 1: ML-BOM extensions", () => {
+    it("maps component with modelCard to model", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "my-custom-model",
+        modelCard: { modelParameters: {} },
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("model");
+      expect(result?.confidence).toBe("high");
+    });
+
+    it("maps component with data array containing ml type to dataset", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "training-data",
+        data: [{ type: "dataset" }],
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("dataset");
+      expect(result?.confidence).toBe("high");
+    });
+  });
+
+  describe("tier 2: CycloneDX component type", () => {
+    it("maps machine-learning-model to model", () => {
+      const comp: CycloneDxComponent = {
+        type: "machine-learning-model",
+        name: "llama-3",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("model");
+      expect(result?.confidence).toBe("high");
+    });
+
+    it("maps data type to dataset", () => {
+      const comp: CycloneDxComponent = {
+        type: "data",
+        name: "training-corpus",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("dataset");
+      expect(result?.confidence).toBe("medium");
+    });
+
+    it("maps platform type to inference-provider", () => {
+      const comp: CycloneDxComponent = {
+        type: "platform",
+        name: "inference-platform",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("inference-provider");
+      expect(result?.confidence).toBe("medium");
+    });
+
+    it("maps service type to inference-provider", () => {
+      const comp: CycloneDxComponent = {
+        type: "service",
+        name: "model-api",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("inference-provider");
+      expect(result?.confidence).toBe("medium");
+    });
+  });
+
+  describe("tier 3: known-package registry", () => {
+    it("maps known framework-type package to ai-framework", () => {
+      const comp: CycloneDxComponent = {
+        type: "framework",
+        name: "transformers",
+        version: "4.38.0",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("ai-framework");
+      expect(result?.confidence).toBe("high");
+    });
+
+    it("maps known library-type package", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "openai",
+        version: "1.12.0",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("inference-provider");
+      expect(result?.confidence).toBe("high");
+    });
+  });
+
+  describe("non-AI components", () => {
+    it("returns null for unknown library", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "express",
+        version: "4.18.0",
+      };
+      expect(mapComponent(comp)).toBeNull();
+    });
+
+    it("returns null for unknown framework", () => {
+      const comp: CycloneDxComponent = {
+        type: "framework",
+        name: "react",
+        version: "18.2.0",
+      };
+      expect(mapComponent(comp)).toBeNull();
+    });
+  });
+
+  describe("source field", () => {
+    it("always sets source to sbom-import", () => {
+      const comp: CycloneDxComponent = {
+        type: "machine-learning-model",
+        name: "test-model",
+      };
+      const result = mapComponent(comp);
+      expect(result?.source).toBe("sbom-import");
+    });
+  });
+
+  describe("name validation", () => {
+    it("returns null for component with empty name", () => {
+      const comp: CycloneDxComponent = {
+        type: "machine-learning-model",
+        name: "",
+      };
+      expect(mapComponent(comp)).toBeNull();
+    });
+  });
+
+  describe("purl fallback", () => {
+    it("detects AI package via purl when name is unrecognized", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "custom-wrapper",
+        purl: "pkg:pypi/transformers@4.38.0",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("ai-framework");
+    });
+
+    it("detects scoped package via purl namespace/name", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "some-alias",
+        purl: "pkg:npm/%40langchain/core@0.1.22",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("tool");
+    });
+
+    it("does not match purl when name already matched", () => {
+      const comp: CycloneDxComponent = {
+        type: "library",
+        name: "openai",
+        purl: "pkg:pypi/openai@1.0.0",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.kind).toBe("inference-provider");
+      expect(result?.confidence).toBe("high");
+    });
+  });
+
+  describe("version extraction from purl", () => {
+    it("extracts version from purl via purlVersion", () => {
+      const comp: CycloneDxComponent = {
+        type: "machine-learning-model",
+        name: "my-model",
+        purl: "pkg:generic/my-model@3.0.0",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.purlVersion).toBe("3.0.0");
+    });
+
+    it("returns undefined purlVersion when no purl", () => {
+      const comp: CycloneDxComponent = {
+        type: "machine-learning-model",
+        name: "my-model",
+      };
+      const result = mapComponent(comp);
+      expect(result).not.toBeNull();
+      expect(result?.purlVersion).toBeUndefined();
+    });
+  });
+});

package/tests/sbom/cyclonedx-import.test.ts

@@ -0,0 +1,329 @@
+import { describe, expect, it } from "vitest";
+import { importCycloneDx } from "../../src/sbom/cyclonedx-import";
+import minimalBom from "../fixtures/cyclonedx-minimal.json";
+import mixedBom from "../fixtures/cyclonedx-mixed.json";
+import mlBom from "../fixtures/cyclonedx-ml-bom.json";
+
+describe("cyclonedx-import", () => {
+  describe("basic import", () => {
+    it("imports a minimal CycloneDX BOM", () => {
+      const result = importCycloneDx(minimalBom);
+      expect(result.aibom.schemaVersion).toBe("euconform.aibom.v1.1");
+      expect(result.aibom.components).toHaveLength(1);
+      expect(result.aibom.components[0].kind).toBe("model");
+      expect(result.aibom.components[0].name).toBe("llama-3.2-1b");
+      expect(result.aibom.components[0].source).toBe("sbom-import");
+    });
+
+    it("produces a valid aibom", () => {
+      const result = importCycloneDx(minimalBom);
+      expect(result.validation.valid).toBe(true);
+    });
+  });
+
+  describe("filtering", () => {
+    it("filters AI-relevant components from mixed BOM", () => {
+      const result = importCycloneDx(mixedBom);
+      expect(result.summary.totalComponents).toBe(10);
+      expect(result.summary.aiRelevant).toBe(5);
+      expect(result.summary.skipped).toBe(5);
+    });
+
+    it("correctly maps component kinds in mixed BOM", () => {
+      const result = importCycloneDx(mixedBom);
+      const kinds = result.aibom.components.map((c) => c.kind).sort();
+      expect(kinds).toEqual([
+        "ai-framework",
+        "inference-provider",
+        "model",
+        "tool",
+        "vector-store",
+      ]);
+    });
+
+    it("provides byKind summary", () => {
+      const result = importCycloneDx(mixedBom);
+      expect(result.summary.byKind.model).toBe(1);
+      expect(result.summary.byKind["ai-framework"]).toBe(1);
+      expect(result.summary.byKind["inference-provider"]).toBe(1);
+      expect(result.summary.byKind.tool).toBe(1);
+      expect(result.summary.byKind["vector-store"]).toBe(1);
+    });
+  });
+
+  describe("ML-BOM extensions", () => {
+    it("detects modelCard extension", () => {
+      const result = importCycloneDx(mlBom);
+      const model = result.aibom.components.find((c) => c.name === "custom-bert-model");
+      expect(model).toBeDefined();
+      expect(model?.kind).toBe("model");
+    });
+
+    it("detects data extension as dataset", () => {
+      const result = importCycloneDx(mlBom);
+      const dataset = result.aibom.components.find((c) => c.name === "sentiment-dataset");
+      expect(dataset).toBeDefined();
+      expect(dataset?.kind).toBe("dataset");
+    });
+
+    it("skips non-AI components even in ML BOM", () => {
+      const result = importCycloneDx(mlBom);
+      expect(result.summary.totalComponents).toBe(3);
+      expect(result.summary.aiRelevant).toBe(2);
+      expect(result.summary.skipped).toBe(1);
+    });
+  });
+
+  describe("input validation", () => {
+    it("rejects non-CycloneDX input", () => {
+      expect(() => importCycloneDx({ foo: "bar" })).toThrow("bomFormat");
+    });
+
+    it("rejects unsupported specVersion", () => {
+      expect(() =>
+        importCycloneDx({
+          bomFormat: "CycloneDX",
+          specVersion: "1.0",
+          components: [],
+        })
+      ).toThrow("specVersion");
+    });
+
+    it("handles BOM with no components", () => {
+      const result = importCycloneDx({
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [],
+      });
+      expect(result.aibom.components).toEqual([]);
+      expect(result.summary.totalComponents).toBe(0);
+    });
+  });
+
+  describe("scope filtering", () => {
+    it("excludes optional-scope components when scope is production", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [
+          { type: "machine-learning-model", name: "prod-model", scope: "required" },
+          { type: "machine-learning-model", name: "dev-model", scope: "optional" },
+        ],
+      };
+      const result = importCycloneDx(bom, { scope: "production" });
+      expect(result.aibom.components).toHaveLength(1);
+      expect(result.aibom.components[0].name).toBe("prod-model");
+    });
+
+    it("excludes excluded-scope components when scope is production", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [
+          { type: "machine-learning-model", name: "prod-model", scope: "required" },
+          { type: "machine-learning-model", name: "excluded-model", scope: "excluded" },
+        ],
+      };
+      const result = importCycloneDx(bom, { scope: "production" });
+      expect(result.aibom.components).toHaveLength(1);
+      expect(result.aibom.components[0].name).toBe("prod-model");
+    });
+
+    it("includes components without scope in production mode", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [{ type: "machine-learning-model", name: "no-scope-model" }],
+      };
+      const result = importCycloneDx(bom, { scope: "production" });
+      expect(result.aibom.components).toHaveLength(1);
+    });
+  });
+
+  describe("complianceCapabilities", () => {
+    it("sets all capabilities to false for imports", () => {
+      const result = importCycloneDx(minimalBom);
+      const caps = result.aibom.complianceCapabilities;
+      expect(caps.biasEvaluation).toBe(false);
+      expect(caps.jsonExport).toBe(false);
+      expect(caps.pdfExport).toBe(false);
+      expect(caps.loggingInfrastructure).toBe(false);
+      expect(caps.humanReviewFlow).toBe(false);
+      expect(caps.incidentHandling).toBe(false);
+    });
+  });
+
+  describe("component ID generation", () => {
+    it("generates id as kind:name", () => {
+      const result = importCycloneDx(minimalBom);
+      expect(result.aibom.components[0].id).toBe("model:llama-3.2-1b:1.0.0");
+    });
+  });
+
+  describe("deduplication", () => {
+    it("removes exact duplicates (same kind+name+version)", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [
+          { type: "library", name: "openai", version: "1.12.0" },
+          { type: "library", name: "openai", version: "1.12.0" },
+          { type: "library", name: "openai", version: "1.12.0" },
+        ],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.components).toHaveLength(1);
+      expect(result.summary.duplicatesRemoved).toBe(2);
+    });
+
+    it("keeps different versions of the same package", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [
+          { type: "library", name: "torch", version: "2.0.0" },
+          { type: "library", name: "torch", version: "2.2.0" },
+        ],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.components).toHaveLength(2);
+      expect(result.summary.duplicatesRemoved).toBe(0);
+    });
+  });
+
+  describe("ID format", () => {
+    it("uses kind:name:version when version present", () => {
+      const result = importCycloneDx(minimalBom);
+      expect(result.aibom.components[0].id).toBe("model:llama-3.2-1b:1.0.0");
+    });
+
+    it("uses kind:name when version absent", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [{ type: "machine-learning-model", name: "some-model" }],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.components[0].id).toBe("model:some-model");
+    });
+  });
+
+  describe("provenance", () => {
+    it("sets metadata from BOM metadata", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        metadata: {
+          timestamp: "2026-04-17T10:00:00Z",
+          tools: [{ name: "cdxgen", version: "10.0.0" }],
+          component: { type: "application", name: "my-ai-app" },
+        },
+        components: [{ type: "machine-learning-model", name: "test-model", version: "1.0" }],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.metadata).toEqual({
+        importSource: "cyclonedx",
+        importTool: "cdxgen 10.0.0",
+        originalTimestamp: "2026-04-17T10:00:00Z",
+      });
+    });
+
+    it("omits importTool when no tools in metadata", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [{ type: "machine-learning-model", name: "test-model", version: "1.0" }],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.metadata).toEqual({
+        importSource: "cyclonedx",
+      });
+    });
+
+    it("includes source info in summary", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        metadata: {
+          timestamp: "2026-04-17T10:00:00Z",
+          tools: [{ name: "trivy", version: "0.50.0" }],
+        },
+        components: [],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.summary.source.bomFormat).toBe("CycloneDX");
+      expect(result.summary.source.specVersion).toBe("1.5");
+      expect(result.summary.source.importTool).toBe("trivy 0.50.0");
+      expect(result.summary.source.originalTimestamp).toBe("2026-04-17T10:00:00Z");
+    });
+  });
+
+  describe("project name", () => {
+    it("uses metadata.component.name when available", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        metadata: {
+          component: { type: "application", name: "my-ai-app" },
+        },
+        components: [],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.project.name).toBe("my-ai-app");
+      expect(result.summary.source.projectNameSource).toBe("metadata.component.name");
+    });
+
+    it("falls back to sourcePath basename", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [],
+      };
+      const result = importCycloneDx(bom, { sourcePath: "/path/to/cyclonedx-bom.json" });
+      expect(result.aibom.project.name).toBe("cyclonedx-bom");
+      expect(result.summary.source.projectNameSource).toBe("sourcePath");
+    });
+
+    it("falls back to sbom-import when no metadata or sourcePath", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.project.name).toBe("sbom-import");
+      expect(result.summary.source.projectNameSource).toBe("fallback");
+    });
+  });
+
+  describe("filteredByScope in summary", () => {
+    it("counts scope-filtered components", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [
+          { type: "machine-learning-model", name: "prod", scope: "required" },
+          { type: "machine-learning-model", name: "opt", scope: "optional" },
+          { type: "machine-learning-model", name: "excl", scope: "excluded" },
+          { type: "library", name: "express", scope: "required" },
+        ],
+      };
+      const result = importCycloneDx(bom, { scope: "production" });
+      expect(result.summary.totalComponents).toBe(4);
+      expect(result.summary.filteredByScope).toBe(2);
+      expect(result.summary.aiRelevant).toBe(1);
+    });
+  });
+
+  describe("version fallback from purl", () => {
+    it("uses purl version when component version missing", () => {
+      const bom = {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        components: [{ type: "library", name: "openai", purl: "pkg:pypi/openai@1.30.0" }],
+      };
+      const result = importCycloneDx(bom);
+      expect(result.aibom.components[0].version).toBe("1.30.0");
+    });
+  });
+});

package/tests/sbom/purl.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, it } from "vitest";
+import { parsePurl } from "../../src/sbom/purl";
+
+describe("parsePurl", () => {
+  it("parses a simple pypi purl", () => {
+    const result = parsePurl("pkg:pypi/transformers@4.38.0");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "pypi",
+      namespace: undefined,
+      name: "transformers",
+      version: "4.38.0",
+    });
+  });
+
+  it("parses npm purl with namespace", () => {
+    const result = parsePurl("pkg:npm/%40langchain/core@0.1.22");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "npm",
+      namespace: "@langchain",
+      name: "core",
+      version: "0.1.22",
+    });
+  });
+
+  it("parses npm purl with unencoded @ namespace", () => {
+    const result = parsePurl("pkg:npm/@huggingface/transformers@2.0.0");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "npm",
+      namespace: "@huggingface",
+      name: "transformers",
+      version: "2.0.0",
+    });
+  });
+
+  it("parses generic purl without version", () => {
+    const result = parsePurl("pkg:generic/llama-3.2-1b");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "generic",
+      namespace: undefined,
+      name: "llama-3.2-1b",
+      version: undefined,
+    });
+  });
+
+  it("parses purl with qualifiers (ignores them)", () => {
+    const result = parsePurl("pkg:npm/openai@1.12.0?vcs_url=github.com/openai");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "npm",
+      namespace: undefined,
+      name: "openai",
+      version: "1.12.0",
+    });
+  });
+
+  it("parses purl with subpath (ignores it)", () => {
+    const result = parsePurl("pkg:pypi/torch@2.2.0#cuda");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "pypi",
+      namespace: undefined,
+      name: "torch",
+      version: "2.2.0",
+    });
+  });
+
+  it("parses maven purl with deep namespace", () => {
+    const result = parsePurl("pkg:maven/org.tensorflow/tensorflow-core-api@0.5.0");
+    expect(result).toEqual({
+      scheme: "pkg",
+      type: "maven",
+      namespace: "org.tensorflow",
+      name: "tensorflow-core-api",
+      version: "0.5.0",
+    });
+  });
+
+  it("returns null for empty string", () => {
+    expect(parsePurl("")).toBeNull();
+  });
+
+  it("returns null for non-pkg scheme", () => {
+    expect(parsePurl("http://example.com")).toBeNull();
+  });
+
+  it("returns null for malformed purl", () => {
+    expect(parsePurl("pkg:")).toBeNull();
+    expect(parsePurl("pkg:/")).toBeNull();
+  });
+
+  it("returns null for malformed percent-encoding", () => {
+    expect(parsePurl("pkg:npm/%ZZ/bad-encoding@1.0.0")).toBeNull();
+  });
+
+  it("returns null for truncated percent-encoding", () => {
+    expect(parsePurl("pkg:npm/foo%2")).toBeNull();
+  });
+});