@euconform/core 1.4.0 → 1.6.0

package/dist/sbom/component-mapper.js

@@ -0,0 +1,83 @@
+import { lookupKnownPackage } from "./known-packages";
+import { parsePurl } from "./purl";
+const CYCLONEDX_TYPE_MAP = {
+    "machine-learning-model": { kind: "model", confidence: "high" },
+    data: { kind: "dataset", confidence: "medium" },
+    platform: { kind: "inference-provider", confidence: "medium" },
+    service: { kind: "inference-provider", confidence: "medium" },
+};
+/** Tiers 7-8: Try to find a kind via purl namespace/name and name-only lookups. */
+function lookupViaPurl(parsed) {
+    if (!parsed)
+        return null;
+    // Tier 7: namespace/name (e.g. @langchain/core)
+    if (parsed.namespace) {
+        const scopedName = `${parsed.namespace}/${parsed.name}`;
+        const scopedKind = lookupKnownPackage(scopedName);
+        if (scopedKind)
+            return { kind: scopedKind, confidence: "high" };
+    }
+    // Tier 8: purl name only
+    const purlKind = lookupKnownPackage(parsed.name);
+    if (purlKind)
+        return { kind: purlKind, confidence: "medium" };
+    return null;
+}
+/**
+ * Map a CycloneDX component to an EuConform aibom component kind.
+ *
+ * 8-tier detection (descending priority):
+ * 1. ML-BOM extensions (modelCard, data)
+ * 2. CycloneDX component type mapping
+ * 3. Exact package name in registry
+ * 4. Explicit scoped name in registry (@langchain/core)
+ * 5. Scope mapping via KNOWN_AI_SCOPES (@langchain -> tool)
+ * 6. Scope-stripped name in registry (@huggingface/transformers -> transformers)
+ * 7. Purl namespace/name against registry
+ * 8. Purl name-only against registry
+ *
+ * Steps 3-6 are handled by lookupKnownPackage().
+ * Returns null if the component is not AI-relevant or has empty name.
+ */
+export function mapComponent(component) {
+    // Name validation
+    if (!component.name || component.name.trim() === "") {
+        return null;
+    }
+    // Extract purl info (used for fallback and version)
+    const parsed = component.purl ? parsePurl(component.purl) : null;
+    const purlVersion = parsed?.version;
+    // Tier 1: ML-BOM extensions
+    if (component.modelCard != null) {
+        return { kind: "model", source: "sbom-import", confidence: "high", purlVersion };
+    }
+    if (Array.isArray(component.data) && component.data.some((d) => d.type === "dataset")) {
+        return { kind: "dataset", source: "sbom-import", confidence: "high", purlVersion };
+    }
+    // Tier 2: CycloneDX component type
+    const typeMapping = CYCLONEDX_TYPE_MAP[component.type];
+    if (typeMapping) {
+        return {
+            kind: typeMapping.kind,
+            source: "sbom-import",
+            confidence: typeMapping.confidence,
+            purlVersion,
+        };
+    }
+    // Tiers 3-6: Known-package registry (handles exact, scoped, scope-fallback, scope-stripped)
+    const knownKind = lookupKnownPackage(component.name);
+    if (knownKind) {
+        return { kind: knownKind, source: "sbom-import", confidence: "high", purlVersion };
+    }
+    // Tiers 7-8: Purl fallback
+    const purlMatch = lookupViaPurl(parsed);
+    if (purlMatch) {
+        return {
+            kind: purlMatch.kind,
+            source: "sbom-import",
+            confidence: purlMatch.confidence,
+            purlVersion,
+        };
+    }
+    return null;
+}

package/dist/sbom/cyclonedx-import.d.ts

@@ -0,0 +1,34 @@
+import type { AiBillOfMaterials } from "../evidence/types";
+import type { ValidationResult } from "../validation/schema-validator";
+export interface ImportWarning {
+    component: string;
+    message: string;
+}
+export interface ImportSourceInfo {
+    bomFormat: "CycloneDX";
+    specVersion: string;
+    projectNameSource: "metadata.component.name" | "sourcePath" | "fallback";
+    importTool?: string;
+    originalTimestamp?: string;
+}
+export interface ImportSummary {
+    totalComponents: number;
+    filteredByScope: number;
+    aiRelevant: number;
+    skipped: number;
+    duplicatesRemoved: number;
+    byKind: Record<string, number>;
+    warnings: ImportWarning[];
+    source: ImportSourceInfo;
+}
+export interface ImportOptions {
+    scope?: "all" | "production";
+    sourcePath?: string;
+}
+export interface CycloneDxImportResult {
+    aibom: AiBillOfMaterials;
+    summary: ImportSummary;
+    validation: ValidationResult;
+}
+export declare function importCycloneDx(sbom: unknown, options?: ImportOptions): CycloneDxImportResult;
+//# sourceMappingURL=cyclonedx-import.d.ts.map

package/dist/sbom/cyclonedx-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx-import.d.ts","sourceRoot":"","sources":["../../src/sbom/cyclonedx-import.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAA+B,MAAM,mBAAmB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMvE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,yBAAyB,GAAG,YAAY,GAAG,UAAU,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,qBAAqB,CA2F7F"}

package/dist/sbom/cyclonedx-import.js

@@ -0,0 +1,131 @@
+import { basename, extname } from "node:path";
+import { validate } from "../validation/schema-validator";
+import { mapComponent } from "./component-mapper";
+import { SUPPORTED_SPEC_VERSIONS } from "./types";
+export function importCycloneDx(sbom, options) {
+    const bom = parseBom(sbom);
+    const scope = options?.scope ?? "all";
+    const allComponents = bom.components ?? [];
+    const warnings = [];
+    const totalComponents = allComponents.length;
+    const inScope = scope === "production"
+        ? allComponents.filter((c) => c.scope !== "optional" && c.scope !== "excluded")
+        : allComponents;
+    const filteredByScope = totalComponents - inScope.length;
+    const mapped = [];
+    for (const comp of inScope) {
+        const mapping = mapComponent(comp);
+        if (!mapping) {
+            if (!comp.name || comp.name.trim() === "") {
+                warnings.push({ component: "(empty)", message: "Skipped: missing or empty name" });
+            }
+            continue;
+        }
+        const version = comp.version || mapping.purlVersion;
+        if (!version) {
+            warnings.push({ component: comp.name, message: "Missing version field" });
+        }
+        mapped.push({
+            id: version ? `${mapping.kind}:${comp.name}:${version}` : `${mapping.kind}:${comp.name}`,
+            kind: mapping.kind,
+            name: comp.name,
+            ...(version ? { version } : {}),
+            source: "sbom-import",
+        });
+    }
+    const seen = new Set();
+    let duplicatesRemoved = 0;
+    const deduped = [];
+    for (const comp of mapped) {
+        if (seen.has(comp.id)) {
+            duplicatesRemoved++;
+            continue;
+        }
+        seen.add(comp.id);
+        deduped.push(comp);
+    }
+    const byKind = {};
+    for (const comp of deduped) {
+        byKind[comp.kind] = (byKind[comp.kind] ?? 0) + 1;
+    }
+    const { projectName, projectNameSource } = resolveProjectName(bom, options?.sourcePath);
+    const importTool = extractToolString(bom);
+    const originalTimestamp = bom.metadata?.timestamp;
+    const aibom = {
+        schemaVersion: "euconform.aibom.v1.1",
+        generatedAt: new Date().toISOString(),
+        project: { name: projectName, rootPath: "." },
+        components: deduped,
+        complianceCapabilities: {
+            biasEvaluation: false,
+            jsonExport: false,
+            pdfExport: false,
+            loggingInfrastructure: false,
+            humanReviewFlow: false,
+            incidentHandling: false,
+        },
+        metadata: buildMetadata(importTool, originalTimestamp),
+    };
+    const validation = validate(aibom);
+    return {
+        aibom,
+        summary: {
+            totalComponents,
+            filteredByScope,
+            aiRelevant: deduped.length,
+            skipped: inScope.length - mapped.length,
+            duplicatesRemoved,
+            byKind,
+            warnings,
+            source: buildSourceInfo(bom.specVersion, projectNameSource, importTool, originalTimestamp),
+        },
+        validation,
+    };
+}
+function resolveProjectName(bom, sourcePath) {
+    const metaName = bom.metadata?.component?.name;
+    if (metaName) {
+        return { projectName: metaName, projectNameSource: "metadata.component.name" };
+    }
+    if (sourcePath) {
+        const name = basename(sourcePath, extname(sourcePath));
+        return { projectName: name, projectNameSource: "sourcePath" };
+    }
+    return { projectName: "sbom-import", projectNameSource: "fallback" };
+}
+function extractToolString(bom) {
+    const tool = bom.metadata?.tools?.[0];
+    if (!tool?.name)
+        return undefined;
+    return tool.version ? `${tool.name} ${tool.version}` : tool.name;
+}
+function buildMetadata(importTool, originalTimestamp) {
+    const meta = { importSource: "cyclonedx" };
+    if (importTool)
+        meta.importTool = importTool;
+    if (originalTimestamp)
+        meta.originalTimestamp = originalTimestamp;
+    return meta;
+}
+function buildSourceInfo(specVersion, projectNameSource, importTool, originalTimestamp) {
+    const info = { bomFormat: "CycloneDX", specVersion, projectNameSource };
+    if (importTool)
+        info.importTool = importTool;
+    if (originalTimestamp)
+        info.originalTimestamp = originalTimestamp;
+    return info;
+}
+function parseBom(sbom) {
+    if (typeof sbom !== "object" || sbom === null) {
+        throw new Error("Input must be a JSON object");
+    }
+    const record = sbom;
+    if (record.bomFormat !== "CycloneDX") {
+        throw new Error(`Invalid bomFormat: expected "CycloneDX", got "${String(record.bomFormat)}"`);
+    }
+    const specVersion = String(record.specVersion ?? "");
+    if (!SUPPORTED_SPEC_VERSIONS.includes(specVersion)) {
+        throw new Error(`Unsupported specVersion "${specVersion}". Supported: ${SUPPORTED_SPEC_VERSIONS.join(", ")}`);
+    }
+    return sbom;
+}

package/dist/sbom/index.d.ts

@@ -0,0 +1,6 @@
+export { importCycloneDx, type CycloneDxImportResult, type ImportSummary, type ImportWarning, type ImportOptions, type ImportSourceInfo, } from "./cyclonedx-import";
+export { mapComponent, type ComponentMapping } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl, type ParsedPurl } from "./purl";
+export type { CycloneDxBom, CycloneDxComponent } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/sbom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sbom/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC"}

package/dist/sbom/index.js

@@ -0,0 +1,4 @@
+export { importCycloneDx, } from "./cyclonedx-import";
+export { mapComponent } from "./component-mapper";
+export { lookupKnownPackage, KNOWN_AI_PACKAGES, KNOWN_AI_SCOPES } from "./known-packages";
+export { parsePurl } from "./purl";

package/dist/sbom/known-packages.d.ts

@@ -0,0 +1,13 @@
+import type { BomComponentKind } from "../evidence/types";
+export declare const KNOWN_AI_PACKAGES: Record<string, BomComponentKind>;
+export declare const KNOWN_AI_SCOPES: Record<string, BomComponentKind>;
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export declare function lookupKnownPackage(name: string): BomComponentKind | null;
+//# sourceMappingURL=known-packages.d.ts.map

package/dist/sbom/known-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-packages.d.ts","sourceRoot":"","sources":["../../src/sbom/known-packages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAiG9D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAO5D,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAuBxE"}

package/dist/sbom/known-packages.js

@@ -0,0 +1,129 @@
+export const KNOWN_AI_PACKAGES = {
+    // Models / model runtimes
+    "llama.cpp": "model",
+    "llama-cpp-python": "model",
+    "whisper.cpp": "model",
+    ggml: "model",
+    ctransformers: "model",
+    // AI Frameworks
+    transformers: "ai-framework",
+    torch: "ai-framework",
+    pytorch: "ai-framework",
+    tensorflow: "ai-framework",
+    "tensorflow-gpu": "ai-framework",
+    jax: "ai-framework",
+    keras: "ai-framework",
+    "pytorch-lightning": "ai-framework",
+    "scikit-learn": "ai-framework",
+    sklearn: "ai-framework",
+    xgboost: "ai-framework",
+    lightgbm: "ai-framework",
+    spacy: "ai-framework",
+    "huggingface-hub": "ai-framework",
+    diffusers: "ai-framework",
+    accelerate: "ai-framework",
+    peft: "ai-framework",
+    trl: "ai-framework",
+    onnxruntime: "ai-framework",
+    "onnxruntime-gpu": "ai-framework",
+    mlflow: "ai-framework",
+    // Embeddings
+    "sentence-transformers": "embedding",
+    fastembed: "embedding",
+    "openai-embeddings": "embedding",
+    "cohere-embed": "embedding",
+    // Inference Providers
+    openai: "inference-provider",
+    anthropic: "inference-provider",
+    ollama: "inference-provider",
+    vllm: "inference-provider",
+    "together-ai": "inference-provider",
+    replicate: "inference-provider",
+    groq: "inference-provider",
+    mistralai: "inference-provider",
+    cohere: "inference-provider",
+    "google-generativeai": "inference-provider",
+    ai21: "inference-provider",
+    // Vector Stores
+    pinecone: "vector-store",
+    "pinecone-client": "vector-store",
+    weaviate: "vector-store",
+    "weaviate-client": "vector-store",
+    qdrant: "vector-store",
+    "qdrant-client": "vector-store",
+    milvus: "vector-store",
+    pymilvus: "vector-store",
+    chromadb: "vector-store",
+    "chromadb-client": "vector-store",
+    pgvector: "vector-store",
+    faiss: "vector-store",
+    "faiss-cpu": "vector-store",
+    "faiss-gpu": "vector-store",
+    // Datasets
+    datasets: "dataset",
+    // Tools / Orchestration
+    langchain: "tool",
+    "langchain-core": "tool",
+    "langchain-community": "tool",
+    llamaindex: "tool",
+    "llama-index": "tool",
+    "semantic-kernel": "tool",
+    autogen: "tool",
+    crewai: "tool",
+    dspy: "tool",
+    "haystack-ai": "tool",
+    guidance: "tool",
+    guardrails: "tool",
+    "guardrails-ai": "tool",
+    lmql: "tool",
+    outlines: "tool",
+    // Scoped packages (npm)
+    "@langchain/core": "tool",
+    "@langchain/openai": "tool",
+    "@langchain/community": "tool",
+    "@langchain/anthropic": "tool",
+    "@huggingface/transformers": "ai-framework",
+    "@huggingface/inference": "inference-provider",
+    "@google/generative-ai": "inference-provider",
+    "@anthropic-ai/sdk": "inference-provider",
+    "@pinecone-database/pinecone": "vector-store",
+    "@qdrant/js-client-rest": "vector-store",
+};
+export const KNOWN_AI_SCOPES = {
+    "@langchain": "tool",
+    "@huggingface": "ai-framework",
+    "@tensorflow": "ai-framework",
+    "@anthropic-ai": "inference-provider",
+    "@pinecone-database": "vector-store",
+    "@qdrant": "vector-store",
+};
+/**
+ * Look up a package name in the known AI packages registry.
+ * For scoped packages, tries:
+ *   1. Exact match (e.g. @langchain/core)
+ *   2. Scope match via KNOWN_AI_SCOPES (e.g. @langchain -> tool)
+ *   3. Strip scope, check bare name (e.g. @huggingface/transformers -> transformers)
+ * Returns the BomComponentKind if found, null otherwise.
+ */
+export function lookupKnownPackage(name) {
+    const lower = name.toLowerCase();
+    // 1. Exact match
+    const exact = KNOWN_AI_PACKAGES[lower];
+    if (exact)
+        return exact;
+    // Scoped package handling
+    if (lower.startsWith("@") && lower.includes("/")) {
+        const scopeEnd = lower.indexOf("/");
+        const scope = lower.slice(0, scopeEnd);
+        const bareName = lower.slice(scopeEnd + 1);
+        // 2. Known AI scope
+        const scopeKind = KNOWN_AI_SCOPES[scope];
+        if (scopeKind)
+            return scopeKind;
+        // 3. Strip scope, check bare name
+        const bareKind = KNOWN_AI_PACKAGES[bareName];
+        if (bareKind)
+            return bareKind;
+    }
+    return null;
+}

package/dist/sbom/purl.d.ts

@@ -0,0 +1,14 @@
+export interface ParsedPurl {
+    scheme: "pkg";
+    type: string;
+    namespace?: string;
+    name: string;
+    version?: string;
+}
+/**
+ * Parse a Package URL (purl) string into its components.
+ * Follows the purl spec: pkg:type/namespace/name@version?qualifiers#subpath
+ * Returns null for invalid or non-pkg URLs.
+ */
+export declare function parsePurl(purl: string): ParsedPurl | null;
+//# sourceMappingURL=purl.d.ts.map

package/dist/sbom/purl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../src/sbom/purl.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,KAAK,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoDzD"}

package/dist/sbom/purl.js

@@ -0,0 +1,56 @@
+/**
+ * Parse a Package URL (purl) string into its components.
+ * Follows the purl spec: pkg:type/namespace/name@version?qualifiers#subpath
+ * Returns null for invalid or non-pkg URLs.
+ */
+export function parsePurl(purl) {
+    if (!purl || !purl.startsWith("pkg:"))
+        return null;
+    // Strip qualifiers and subpath
+    let rest = purl.slice(4); // remove "pkg:"
+    const hashIdx = rest.indexOf("#");
+    if (hashIdx !== -1)
+        rest = rest.slice(0, hashIdx);
+    const queryIdx = rest.indexOf("?");
+    if (queryIdx !== -1)
+        rest = rest.slice(0, queryIdx);
+    // Split type from the rest: type/...
+    const slashIdx = rest.indexOf("/");
+    if (slashIdx <= 0)
+        return null;
+    const type = rest.slice(0, slashIdx);
+    let remainder = rest.slice(slashIdx + 1);
+    try {
+        remainder = decodeURIComponent(remainder);
+    }
+    catch {
+        return null;
+    }
+    // Extract version
+    let version;
+    const atIdx = remainder.lastIndexOf("@");
+    if (atIdx !== -1) {
+        version = remainder.slice(atIdx + 1);
+        remainder = remainder.slice(0, atIdx);
+    }
+    // Split namespace/name (last segment is name, rest is namespace)
+    const lastSlash = remainder.lastIndexOf("/");
+    let namespace;
+    let name;
+    if (lastSlash !== -1) {
+        namespace = remainder.slice(0, lastSlash);
+        name = remainder.slice(lastSlash + 1);
+    }
+    else {
+        name = remainder;
+    }
+    if (!name)
+        return null;
+    return {
+        scheme: "pkg",
+        type,
+        namespace: namespace || undefined,
+        name,
+        version: version || undefined,
+    };
+}

package/dist/sbom/types.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Minimal CycloneDX types covering fields relevant to AI component detection.
+ * Supports CycloneDX JSON format versions 1.4, 1.5, 1.6.
+ */
+export interface CycloneDxBom {
+    bomFormat: "CycloneDX";
+    specVersion: string;
+    version?: number;
+    metadata?: CycloneDxMetadata;
+    components?: CycloneDxComponent[];
+}
+export interface CycloneDxMetadata {
+    timestamp?: string;
+    tools?: Array<{
+        name?: string;
+        version?: string;
+    }>;
+    component?: CycloneDxComponent;
+}
+export interface CycloneDxComponent {
+    type: string;
+    name: string;
+    version?: string;
+    purl?: string;
+    group?: string;
+    description?: string;
+    scope?: "required" | "optional" | "excluded";
+    properties?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** CycloneDX ML-BOM extensions (1.5+) */
+    modelCard?: unknown;
+    data?: Array<{
+        type?: string;
+    }>;
+}
+export declare const SUPPORTED_SPEC_VERSIONS: readonly ["1.4", "1.5", "1.6"];
+//# sourceMappingURL=types.d.ts.map

package/dist/sbom/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sbom/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAC7C,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,yCAAyC;IACzC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjC;AAED,eAAO,MAAM,uBAAuB,gCAAiC,CAAC"}

package/dist/sbom/types.js

@@ -0,0 +1,5 @@
+/**
+ * Minimal CycloneDX types covering fields relevant to AI component detection.
+ * Supports CycloneDX JSON format versions 1.4, 1.5, 1.6.
+ */
+export const SUPPORTED_SPEC_VERSIONS = ["1.4", "1.5", "1.6"];

package/dist/scanner/detectors/ai-framework-detector.js

@@ -18,7 +18,7 @@ const FRAMEWORK_IMPORTS = [
     {
         id: "ai-framework-transformers",
         name: "Transformers.js",
-        importPattern: /(?:from\s+['"]@xenova\/transformers['"]|require\s*\(\s*['"]@xenova\/transformers['"])/,
+        importPattern: /(?:from\s+['"](?:@xenova|@huggingface)\/transformers['"]|require\s*\(\s*['"](?:@xenova|@huggingface)\/transformers['"])/,
     },
     {
         id: "ai-framework-vercel-ai",

package/dist/scanner/detectors/local-inference-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-inference-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/local-inference-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAEhB,MAAM,sBAAsB,CAAC;AAoG9B,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAkBlF"}
+{"version":3,"file":"local-inference-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/local-inference-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,EAEhB,MAAM,sBAAsB,CAAC;AAqG9B,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAkBlF"}

package/dist/scanner/detectors/local-inference-detector.js

@@ -19,7 +19,7 @@ const RULES = [
     {
         id: "local-inference-transformers-browser",
         name: "Transformers.js (browser inference)",
-        pattern: /(?:from\s+['"]@xenova\/transformers['"]|\.pipeline\s*\(|env\.allowLocalModels)/,
+        pattern: /(?:from\s+['"](?:@xenova|@huggingface)\/transformers['"]|\.pipeline\s*\(|env\.allowLocalModels)/,
         confidence: "medium",
         extensions: [".ts", ".tsx", ".js", ".jsx"],
     },

package/dist/scanner/detectors/package-json-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-json-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/package-json-detector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AA6E5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAY/E"}
+{"version":3,"file":"package-json-detector.d.ts","sourceRoot":"","sources":["../../../src/scanner/detectors/package-json-detector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AA8E5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,eAAe,GAAG,cAAc,EAAE,CAY/E"}

package/dist/scanner/detectors/package-json-detector.js

@@ -12,6 +12,7 @@ const AI_PACKAGES = {
     "@langchain/core": { category: "ai-framework", label: "LangChain Core" },
     llamaindex: { category: "ai-framework", label: "LlamaIndex" },
     "@xenova/transformers": { category: "ai-framework", label: "Transformers.js" },
+    "@huggingface/transformers": { category: "ai-framework", label: "Transformers.js" },
     ai: { category: "ai-framework", label: "Vercel AI SDK" },
     "@huggingface/inference": { category: "ai-framework", label: "HuggingFace Inference" },
     // Local inference