@mitre/hdf-schema 3.3.1 → 3.4.0

package/dist/ts/hdf.ts

@@ -383,9 +383,11 @@ export interface Integrity {
 /**
  * The hash algorithm used for the checksum.
  *
- * Supported cryptographic hash algorithms for checksums and integrity verification.
+ * Supported cryptographic hash algorithms for checksums and integrity verification. blake3
+ * covers container-image and other artifact digests that use it.
  */
 export enum HashAlgorithm {
+    Blake3 = "blake3",
     Sha256 = "sha256",
     Sha384 = "sha384",
     Sha512 = "sha512",
@@ -416,6 +418,8 @@ export enum HashAlgorithm {
  * for the first amendment.
  *
  * Cryptographic checksum for verifying the referenced document's integrity.
+ *
+ * Cryptographic checksum of the referenced artifact for integrity verification.
  */
 export interface Checksum {
     /**
@@ -981,8 +985,12 @@ export interface Identity {
     identifier: string;
     /**
      * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
-     * 'system' for automated systems, 'simple' for basic string identifiers without additional
-     * classification, or 'other' for custom identity systems.
+     * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
+     * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
+     * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
+     * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
+     * 'simple' for basic string identifiers without additional classification, or 'other' for
+     * custom identity systems.
      */
     type: IdentityType;
     [property: string]: any;
@@ -990,10 +998,15 @@ export interface Identity {
 
 /**
  * The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
- * 'system' for automated systems, 'simple' for basic string identifiers without additional
- * classification, or 'other' for custom identity systems.
+ * 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
+ * for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
+ * apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
+ * satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
+ * 'simple' for basic string identifiers without additional classification, or 'other' for
+ * custom identity systems.
  */
 export enum IdentityType {
+    Agent = "agent",
     Email = "email",
     Other = "other",
     Simple = "simple",
@@ -1499,9 +1512,11 @@ export interface SupportedPlatform {
  * A physical or virtual server, workstation, or network device.
  *
  * Base properties shared by all component types. Extends the Target concept with stable
- * identity, external references, and SBOM embedding.
+ * identity, external references, generalized BOM attachment (boms[]), and unified artifact
+ * integrity (integrity[]).
  *
- * A static container image (not running).
+ * A static container image (not running). Image integrity — formerly the 'digest' field —
+ * is expressed via the shared Base_Component.integrity array.
  *
  * A running container instance.
  *
@@ -1515,17 +1530,33 @@ export interface SupportedPlatform {
  *
  * A running application or API (for DAST tools).
  *
- * A software artifact or dependency (for SCA tools).
+ * A software artifact or dependency (for SCA tools). Package integrity — formerly the
+ * 'checksum' field — is expressed via the shared Base_Component.integrity array.
  *
  * A network segment or network device.
  *
  * A database instance.
+ *
+ * A thin AI-model component: identity and correlation only (parallel to Host_Component's
+ * fqdn/ip). All model detail — architecture, parameter count, serialization format, lineage
+ * — lives in an attached ai-model BOM (boms[]), never on the component itself.
+ *
+ * A thin dataset component: identity and correlation only, symmetric with
+ * AI_Model_Component. All dataset detail — record count, format, classification, lineage —
+ * lives in an attached dataset BOM (boms[]), never on the component itself.
  */
 export interface Component {
     /**
      * Names of baselines that apply to this component.
      */
     baselineRefs?: string[];
+    /**
+     * Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType),
+     * each carried by passthrough (ref/document) or normalized. Replaces the former
+     * sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an
+     * ai-model BOM). See primitives/bom.schema.json.
+     */
+    boms?: BillOfMaterials[];
     /**
      * Stable UUID (RFC 4122) for this component. Required in hdf-system documents, optional in
      * hdf-results. Enables cross-document correlation, diffing, and data flow references.
@@ -1545,6 +1576,15 @@ export interface Component {
      * System-specific overrides for baseline input values.
      */
     inputOverrides?: InputOverride[];
+    /**
+     * Cryptographic integrity of this component's underlying artifact — model weights or
+     * shards, dataset archive, container image, or package bytes. An array supports
+     * multi-file/sharded artifacts. This is the single, generic home for artifact/subject
+     * integrity across all component types (it replaced the former per-type Container_Image
+     * digest and Artifact checksum fields). Distinct from BOM-document integrity (Bom.hashes[])
+     * and from the document tamper-evidence Integrity type.
+     */
+    integrity?: Checksum[];
     /**
      * Optional key-value labels for flexible grouping. Well-known keys: system, component,
      * environment, region, team. Values must be strings.
@@ -1559,33 +1599,37 @@ export interface Component {
      * different teams manage different parts of a system.
      */
     owner?: Identity;
-    /**
-     * Embedded CycloneDX or SPDX SBOM document representing this component's software
-     * inventory. The sbomFormat field determines which format constraints apply.
-     */
-    sbom?: any;
-    /**
-     * Format of the SBOM (embedded or referenced). Required when sbom or sbomRef is present.
-     */
-    sbomFormat?: SBOMFormat;
-    /**
-     * URI reference to an external CycloneDX or SPDX SBOM document for this component. May be a
-     * relative path, absolute URI, or fragment identifier.
-     */
-    sbomRef?: string;
     /**
      * Label selector to match targets belonging to this component during migration. Targets
      * with matching labels are automatically included.
      */
     targetSelector?: { [key: string]: string };
     /**
-     * Component type discriminator. Same values as Target types.
+     * Component type discriminator. Same values as Target types, plus aiModel and dataset (thin
+     * AI subject components whose detail lives in an attached ai-model / dataset BOM).
      */
     type: TargetType;
     /**
-     * Fully qualified domain name.
+     * Directory domain the host is a member of — Active Directory / NetBIOS / LDAP domain (ECS
+     * host.domain semantics), NOT necessarily the DNS suffix of the FQDN. A standalone or
+     * workgroup host has a hostname but no domain. Not derivable from the FQDN; populate only
+     * from a source that carries directory membership.
+     */
+    domain?: string;
+    /**
+     * Fully qualified domain name (e.g. 'web01.prod.example.com'). Distinct from 'hostname'
+     * (short) and 'domain' (directory domain). ECS recommends storing this lowercase; the
+     * schema does not enforce case so source fidelity is preserved on round-trip.
      */
     fqdn?: string;
+    /**
+     * Short, OS-reported host name (the unqualified machine name, e.g. 'web01'). Kept distinct
+     * from 'fqdn' because an FQDN is not reliably decomposable into hostname + domain
+     * (standalone/workgroup hosts have no domain; a directory domain is not the FQDN's DNS
+     * suffix). Aligns with ECS host.hostname and DISA STIG CKL HOST_NAME. Store the short name
+     * the source reports; do not derive it from the FQDN.
+     */
+    hostname?: string;
     /**
      * IP address of the host.
      */
@@ -1602,10 +1646,6 @@ export interface Component {
      * Operating system version.
      */
     osVersion?: string;
-    /**
-     * Image digest for immutable reference.
-     */
-    digest?: string;
     /**
      * Container image ID.
      */
@@ -1654,6 +1694,11 @@ export interface Component {
      * Package version.
      *
      * Database version.
+     *
+     * Model version, revision, or checkpoint tag.
+     *
+     * Dataset version, release identifier, or — for highly dynamic datasets — a timestamped
+     * release marker.
      */
     version?: string;
     /**
@@ -1700,10 +1745,6 @@ export interface Component {
      * Environment. Example: 'production', 'staging', 'development'.
      */
     environment?: string;
-    /**
-     * Package checksum for verification.
-     */
-    checksum?: string;
     /**
      * Package manager. Example: 'npm', 'maven', 'pip', 'nuget'.
      */
@@ -1732,6 +1773,318 @@ export interface Component {
      * Database port.
      */
     port?: number;
+    /**
+     * Provider/registry identifier for the model. Examples: a Hugging Face repo id
+     * ('meta-llama/Llama-2-7b-hf') or a model purl. Correlates the component to its ai-model
+     * BOM(s) and to lineage references from other models.
+     */
+    modelId?: string;
+    /**
+     * Provider/registry identifier for the dataset. Examples: a Hugging Face dataset repo id
+     * ('HuggingFaceH4/ultrachat_200k'), a DOI, or a dataset purl. Correlates the component to
+     * its dataset BOM(s) and to datasetRefs from ai-model components.
+     */
+    datasetId?: string;
+    [property: string]: any;
+}
+
+export interface BillOfMaterials {
+    /**
+     * The manifest kind. Determines which normalized type-extension (model/dataset/packages)
+     * may appear.
+     */
+    bomType: string;
+    /**
+     * Normalized dataset extension. Permitted only when bomType is dataset.
+     */
+    dataset?: DatasetBOMExtension;
+    /**
+     * Passthrough by embedding: the native manifest carried opaquely (e.g. a raw CycloneDX or
+     * SPDX object). HDF does not constrain its internal shape — full manifest validation is a
+     * tool-level concern.
+     */
+    document?: { [key: string]: any };
+    /**
+     * Source manifest format the BOM was produced from or references. Examples: cyclonedx,
+     * cyclonedx-ml, spdx, spdx-ai, huggingface, croissant. Free-form so new formats need no
+     * schema change; the converter that emits the BOM owns the value.
+     */
+    format: string;
+    /**
+     * Integrity of the carried BOM *document* itself (the referenced/embedded manifest file),
+     * NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model
+     * weights, dataset archive) is a component-level concern, not carried here. Subject
+     * identity is inherited from the host component/system; per-node identity lives in the
+     * type-extension.
+     */
+    hashes?: Checksum[];
+    /**
+     * Optional license of the BOM document as a whole (SPDX license expression). Nullable and
+     * often meaningless (CBOM algorithms, many HBOM parts have no license); per-node licenses
+     * live in the type-extension, not here.
+     */
+    license?: null | string;
+    /**
+     * Normalized ai-model extension. Permitted only when bomType is ai-model.
+     */
+    model?: AIModelBOMExtension;
+    /**
+     * Normalized sbom extension: the flattened software package inventory. Permitted only when
+     * bomType is sbom.
+     */
+    packages?: SBOMPackage[];
+    /**
+     * Passthrough by reference: URI (relative path, absolute URI, or fragment) to the native
+     * manifest document. Present for externally-hosted BOMs.
+     */
+    ref?: string;
+    /**
+     * Optional stable identifier for this BOM document (e.g. CycloneDX serialNumber, SPDX
+     * documentNamespace). Correlates the same BOM across evidence packages.
+     */
+    uniqueId?: string;
+}
+
+/**
+ * Normalized dataset extension. Permitted only when bomType is dataset.
+ *
+ * Normalized dataset fields (SPDX 3.0 Dataset profile / MLCommons Croissant aligned). All
+ * optional; open for partial-fidelity passthrough of unmapped native fields. Symmetric with
+ * AI_Model_Extension: carries the dataset's own lineage (baseDatasetRefs/derivation) just
+ * as the model extension carries baseModelRef/adaptationType.
+ */
+export interface DatasetBOMExtension {
+    /**
+     * References to the source dataset(s) this one was derived from — a dataset componentId, or
+     * a dataset BOM uniqueId/URI when no component exists. The lineage edge parallel to
+     * ai-model's baseModelRef; the base dataset may carry its own dataset BOM.
+     */
+    baseDatasetRefs?: string[];
+    /**
+     * Sensitivity/classification of the data. Examples: public, internal, confidential, pii,
+     * phi.
+     */
+    dataClassification?: string;
+    /**
+     * Physical format of the dataset. Examples: parquet, csv, jsonl, tfrecord, webdataset.
+     */
+    datasetFormat?: string;
+    /**
+     * Relationship of this dataset to baseDatasetRefs, parallel to the model extension's
+     * adaptationType. Minimal + extensible: filtered (subset by rule), augmented
+     * (added/synthesized records), merged (union of sources), sampled (statistical draw).
+     */
+    derivation?: DatasetDerivationType;
+    /**
+     * Free-text statement of the dataset's intended use (CISA/G7 minimum element).
+     */
+    intendedUse?: string;
+    /**
+     * Content modality/kind of the data (CISA/G7 'Dataset content: modality'). Examples: text,
+     * image, tabular, timeseries, audio. DISTINCT from datasetFormat, which is the physical
+     * encoding (parquet/csv). Resolves SPDX 3.0 dataset_datasetType, which is content-kind, not
+     * physical format. String or array of strings.
+     */
+    modality?: string[] | string;
+    /**
+     * Free-text description of the dataset's origin and collection process (CISA/G7 'Dataset
+     * provenance'; SPDX 3.0 dataset_dataCollectionProcess).
+     */
+    provenance?: string;
+    /**
+     * Number of records/examples in the dataset.
+     */
+    recordCount?: number;
+    /**
+     * Free-text summary of the dataset's statistical properties (CISA/G7 minimum element;
+     * open-ended by design). Intentionally free-text and will remain so permanently:
+     * recordCount is the one structured statistic, and restructuring this into an object later
+     * would break existing consumers, so it stays a string (additive-only).
+     */
+    statisticalProperties?: string;
+    [property: string]: any;
+}
+
+/**
+ * Relationship of this dataset to baseDatasetRefs, parallel to the model extension's
+ * adaptationType. Minimal + extensible: filtered (subset by rule), augmented
+ * (added/synthesized records), merged (union of sources), sampled (statistical draw).
+ */
+export enum DatasetDerivationType {
+    Augmented = "augmented",
+    Filtered = "filtered",
+    Merged = "merged",
+    Sampled = "sampled",
+}
+
+/**
+ * Normalized ai-model extension. Permitted only when bomType is ai-model.
+ *
+ * Normalized AI-model fields, aligned to the CISA/G7 'SBOM for AI' minimum elements. All
+ * fields optional (standards-correct; only the EU AI Act makes a subset binding for
+ * high-risk/GPAI). Left open (additionalProperties: true) so a converter can carry unmapped
+ * native fields opaquely (partial-fidelity pattern). Subject name/version are inherited
+ * from the host aiModel component, not repeated here.
+ */
+export interface AIModelBOMExtension {
+    /**
+     * Lineage relationship to baseModelRef, adopting Hugging Face's base_model_relation
+     * vocabulary (the only typed lineage enum in the ecosystem).
+     */
+    adaptationType?: ModelAdaptationType;
+    /**
+     * Reference to the base model this one was adapted from (e.g. a Hugging Face repo id or
+     * purl). Correlates the lineage edge; the base model itself may carry its own ai-model BOM.
+     */
+    baseModelRef?: string;
+    /**
+     * References to the training/evaluation datasets this model was produced from — preferably
+     * a dataset component's componentId (correlating to a first-class dataset subject rather
+     * than duplicating dataset detail, per ADR §10), or a dataset BOM uniqueId/URI when no
+     * component exists.
+     */
+    datasetRefs?: string[];
+    /**
+     * Training hyper-parameters as name/value pairs (epochs, learning-rate, batch-size). This
+     * is the set of training knobs, NOT the model's trainable parameterCount — the two are
+     * routinely conflated. CISA/G7 'Model properties: hyper-parameters'; SPDX 3.0
+     * ai_hyperparameter.
+     */
+    hyperparameters?: Hyperparameter[];
+    /**
+     * Model input/output properties (CISA/G7 minimum element): I/O data types, modality,
+     * context/sequence length, and tokenizer. Sourced from CycloneDX
+     * modelParameters.inputs[].format / outputs[].format. All sub-fields optional.
+     */
+    inputOutput?: InputOutput;
+    /**
+     * Free-text statement of intended use and out-of-scope uses (CISA/G7 minimum element).
+     */
+    intendedUse?: string;
+    /**
+     * Model's learning/training paradigm. Free-text because the value set varies across
+     * standards. Examples: supervised, self-supervised, semi-supervised, reinforcement.
+     * Cross-standard intersection: SPDX 3.0 ai_typeOfModel ∩ CycloneDX
+     * modelParameters.approach.type ∩ CISA/G7 learning type.
+     */
+    learningApproach?: string;
+    /**
+     * Model architecture family. Examples: transformer, cnn, diffusion, mixture-of-experts.
+     */
+    modelArchitecture?: string;
+    /**
+     * Total trainable parameter count. No native CycloneDX/SPDX field exists; first-class here
+     * because the EU AI Act keys GPAI obligations off model scale.
+     */
+    parameterCount?: number;
+    /**
+     * Reported evaluation metrics as name/value pairs. Values are free-text because metrics are
+     * heterogeneous (accuracy, f1, BLEU, latency). The item stays open (additionalProperties:
+     * true) to carry native CycloneDX slice/confidenceInterval detail opaquely. Cross-standard
+     * intersection: SPDX 3.0 ai_metric ∩ CycloneDX quantitativeAnalysis.performanceMetrics ∩
+     * CISA/G7 KPI cluster.
+     */
+    performanceMetrics?: PerformanceMetric[];
+    /**
+     * On-disk weight serialization format. Security-critical yet under-modeled by BOM specs:
+     * pickle/pytorch permits arbitrary code execution on load; safetensors does not. Examples:
+     * safetensors, pytorch, gguf, onnx, tensorflow.
+     */
+    serializationFormat?: string;
+    /**
+     * The ML task the model performs. Free-text. Examples: text-classification,
+     * sentiment-analysis, object-detection, translation. Sourced from CycloneDX
+     * modelParameters.task (SPDX 3.0 ai_domain is domain-level/adjacent, not the task); CISA/G7
+     * intended-application.
+     */
+    task?: string;
+    [property: string]: any;
+}
+
+/**
+ * Lineage relationship to baseModelRef, adopting Hugging Face's base_model_relation
+ * vocabulary (the only typed lineage enum in the ecosystem).
+ */
+export enum ModelAdaptationType {
+    Adapter = "adapter",
+    Finetune = "finetune",
+    Merge = "merge",
+    Quantized = "quantized",
+}
+
+export interface Hyperparameter {
+    /**
+     * Hyper-parameter name. Examples: epochs, learning-rate, batch-size.
+     */
+    name?: string;
+    /**
+     * Hyper-parameter value (free-text).
+     */
+    value?: string;
+    [property: string]: any;
+}
+
+/**
+ * Model input/output properties (CISA/G7 minimum element): I/O data types, modality,
+ * context/sequence length, and tokenizer. Sourced from CycloneDX
+ * modelParameters.inputs[].format / outputs[].format. All sub-fields optional.
+ */
+export interface InputOutput {
+    /**
+     * Maximum context/sequence length the model accepts, in tokens.
+     */
+    contextLength?: number;
+    /**
+     * Input/output data types. Examples: string, byte[], float32, image.
+     */
+    dataTypes?: string[];
+    /**
+     * Input/output modalities. String or array of strings. Examples: text, image, audio.
+     * Symmetric with Dataset_Extension.modality.
+     */
+    modality?: string[] | string;
+    /**
+     * Tokenizer used for the model's input encoding. Examples: BPE, SentencePiece, tiktoken.
+     */
+    tokenizer?: string;
+    [property: string]: any;
+}
+
+export interface PerformanceMetric {
+    /**
+     * Metric name. Examples: accuracy, f1, BLEU, latency.
+     */
+    name?: string;
+    /**
+     * Reported metric value, free-text because metrics are heterogeneous (percentages, scores,
+     * milliseconds).
+     */
+    value?: string;
+    [property: string]: any;
+}
+
+/**
+ * A single normalized software package entry within an sbom BOM. Minimal identity + version
+ * for querying/diffing; the full native record remains available via passthrough
+ * (document/ref).
+ */
+export interface SBOMPackage {
+    /**
+     * SPDX license identifiers/expressions for this package.
+     */
+    licenses?: string[];
+    /**
+     * Package name.
+     */
+    name: string;
+    /**
+     * Package URL (purl) — the preferred cross-BOM identity key when present.
+     */
+    purl?: string;
+    /**
+     * Package version.
+     */
+    version?: string;
     [property: string]: any;
 }
 
@@ -1773,17 +2126,11 @@ export enum CloudProvider {
 }
 
 /**
- * Format of the SBOM (embedded or referenced). Required when sbom or sbomRef is present.
- */
-export enum SBOMFormat {
-    Cyclonedx = "cyclonedx",
-    Spdx = "spdx",
-}
-
-/**
- * Component type discriminator. Same values as Target types.
+ * Component type discriminator. Same values as Target types, plus aiModel and dataset (thin
+ * AI subject components whose detail lives in an attached ai-model / dataset BOM).
  */
 export enum TargetType {
+    AIModel = "aiModel",
     Application = "application",
     Artifact = "artifact",
     CloudAccount = "cloudAccount",
@@ -1792,6 +2139,7 @@ export enum TargetType {
     ContainerInstance = "containerInstance",
     ContainerPlatform = "containerPlatform",
     Database = "database",
+    Dataset = "dataset",
     Host = "host",
     Network = "network",
     Repository = "repository",
@@ -1875,7 +2223,18 @@ export interface Runner {
      */
     containerImage?: string;
     /**
-     * The hostname of the runner system. Example: 'ci-runner-01', 'jenkins-agent-03',
+     * The directory domain the runner system belongs to (Active Directory / NetBIOS / LDAP),
+     * NOT the DNS suffix of the FQDN. Example: 'CORP'.
+     */
+    domain?: string;
+    /**
+     * The fully qualified domain name of the runner system, when known. Distinct from the short
+     * 'hostname'; kept separate for the same reason as on host components (an FQDN is not
+     * reliably decomposable). Example: 'ci-runner-01.build.example.com'.
+     */
+    fqdn?: string;
+    /**
+     * The short hostname of the runner system. Example: 'ci-runner-01', 'jenkins-agent-03',
      * 'k8s-node-worker-03'.
      */
     hostname?: string;
@@ -2175,7 +2534,8 @@ export interface HDFComparison {
      */
     comparisonMode: ComparisonMode;
     /**
-     * Comparison of components between two system documents. Used in systemDrift mode.
+     * Comparison of components between two system documents. Used in systemDrift mode. A
+     * component's BOM changes surface as a field change on its boms[] here.
      */
     componentDiffs?: ComponentDiff[];
     /**
@@ -2203,7 +2563,11 @@ export interface HDFComparison {
      */
     matching?: MatchingConfig;
     /**
-     * Comparison of packages between two SBOMs. Used in systemDrift mode for SBOM comparison.
+     * RESERVED — not emitted by the current systemDrift comparison. systemDrift now reports a
+     * component's BOM changes as a field change on its boms[] (see componentDiffs), and
+     * standalone SBOM package diffing is a separate `hdf diff <sbom> <sbom>` output shape. This
+     * field is retained for a future normalized package-level diff; consumers must not expect
+     * it from today's systemDrift output.
      */
     packageDiffs?: PackageDiff[];
     /**
@@ -2615,15 +2979,22 @@ export interface MatchingConfig {
 }
 
 /**
- * Comparison of a single package between two SBOM versions, matched by purl.
+ * Comparison of a single BOM node between two BOM versions, matched by purl (software) or
+ * identifier (models, datasets, hardware, crypto).
  */
 export interface PackageDiff {
+    /**
+     * Generic identity key for matching a BOM node across versions when no purl applies — e.g.
+     * a Hugging Face model ref, dataset uniqueId, crypto algorithm OID, or hardware part
+     * number. At least one of purl or identifier is required.
+     */
+    identifier?: string;
     /**
      * License identifiers for this package.
      */
     licenses?: string[];
     /**
-     * Human-readable package name.
+     * Human-readable node name.
      */
     name?: string;
     /**
@@ -2635,9 +3006,11 @@ export interface PackageDiff {
      */
     oldVersion?: string;
     /**
-     * Package URL (purl) used as the identity key for matching across SBOMs.
+     * Package URL (purl) — the preferred identity key for matching software packages across
+     * BOMs. Optional: BOM nodes without a purl (AI models, datasets, hardware parts, crypto
+     * algorithms) key on identifier instead.
      */
-    purl: string;
+    purl?: string;
     /**
      * The state of this package: added (new in new SBOM), removed (absent from new SBOM),
      * updated (version changed), unchanged.
@@ -2938,6 +3311,13 @@ export interface HDFSystem {
      * Current Authorization to Operate (ATO) status.
      */
     authorizationStatus?: AuthorizationStatus;
+    /**
+     * System-scoped Bills of Materials whose subject is the authorization boundary rather than
+     * a single component (e.g. a SaaSBOM of services, a KBOM of cluster inventory, an OBOM).
+     * Component-scoped BOMs (SBOM, ai-model) attach on the component instead. See
+     * primitives/bom.schema.json.
+     */
+    boms?: BillOfMaterials[];
     /**
      * Description of the system's authorization boundary. Example: network CIDR blocks, cloud
      * VPC IDs, physical locations.
@@ -2949,7 +3329,8 @@ export interface HDFSystem {
     categorizationLevel?: CategorizationLevel;
     /**
      * System components within the authorization boundary. Uses the full polymorphic Component
-     * type with stable identity (componentId), external references, and SBOM support.
+     * type with stable identity (componentId), external references, and generalized BOM
+     * attachment (boms[]).
      */
     components: Component[];
     /**
@@ -3476,6 +3857,13 @@ export interface HDFEvidencePackage {
      * Description of the evidence package's purpose and scope.
      */
     description?: string;
+    /**
+     * References to external native-format evidence (log/telemetry corpora and other artifacts)
+     * carried by URI + integrity hash + format discriminator, without recreating the data
+     * inside HDF. Logs in ECS/OCSF/etc. are legitimate accreditation evidence; HDF indexes them
+     * here rather than transcoding them.
+     */
+    externalEvidence?: ExternalEvidenceReference[];
     /**
      * Information about the tool that generated this document.
      */
@@ -3580,7 +3968,7 @@ export interface SBOMCoverage {
 }
 
 /**
- * A reference to an HDF document or SBOM included in the evidence package.
+ * A reference to an HDF document or BOM/manifest included in the evidence package.
  */
 export interface ContentReference {
     /**
@@ -3610,14 +3998,100 @@ export interface ContentReference {
 /**
  * The type of HDF document being referenced.
  *
- * The type of document referenced in the evidence package.
+ * The type of document referenced in the evidence package. 'bom' covers any
+ * Bill-of-Materials/manifest document (SBOM, AI model/dataset, and reserved future kinds) —
+ * its specific kind is carried by the referenced document's bomType, not by a per-kind
+ * Content_Type value.
  */
 export enum ContentType {
+    BOM = "bom",
     HdfAmendments = "hdf-amendments",
     HdfBaseline = "hdf-baseline",
     HdfComparison = "hdf-comparison",
     HdfPlan = "hdf-plan",
     HdfResults = "hdf-results",
     HdfSystem = "hdf-system",
-    Sbom = "sbom",
+}
+
+/**
+ * A reference to external native-format evidence (log/telemetry corpus or other artifact)
+ * carried by URI + integrity hash + format discriminator. Reference-only: the artifact is
+ * never embedded (corpora can be huge) or transcoded (that would be lossy) — it stays
+ * canonical in its native format and HDF acts as the structured index.
+ */
+export interface ExternalEvidenceReference {
+    /**
+     * Cryptographic checksum of the referenced artifact for integrity verification.
+     */
+    checksum?: Checksum;
+    /**
+     * Optional human-readable description of this evidence entry.
+     */
+    description?: string;
+    /**
+     * The native format discriminator of the referenced artifact.
+     */
+    format: string;
+    /**
+     * Optional producer-declared version of the format (e.g. ECS '9.4.0', OCSF '1.8.0').
+     * Free-text and untrusted — HDF does not validate it against a registry.
+     */
+    formatVersion?: string;
+    /**
+     * Optional IANA media type describing the on-disk serialization, orthogonal to 'format'
+     * (the semantic standard). Examples: application/x-ndjson, application/json,
+     * application/vnd.apache.parquet, text/csv.
+     */
+    mediaType?: string;
+    /**
+     * Optional descriptive metadata about the referenced corpus. Does not affect integrity.
+     */
+    metadata?: ExternalEvidenceMetadata;
+    /**
+     * URI to the external native-format evidence artifact (log/telemetry corpus, etc.). Can be
+     * a relative path or absolute URL. The data stays canonical in its native format — HDF
+     * references it, never parses or transcodes it.
+     */
+    uri: string;
+    [property: string]: any;
+}
+
+/**
+ * Optional descriptive metadata about the referenced corpus. Does not affect integrity.
+ *
+ * Descriptive metadata about a referenced external evidence corpus. Does not affect
+ * integrity.
+ */
+export interface ExternalEvidenceMetadata {
+    /**
+     * The tool/pipeline that collected or produced the corpus. Example: 'aws-security-lake',
+     * 'elastic-agent'.
+     */
+    collector?: string;
+    /**
+     * Approximate number of records/events in the referenced corpus.
+     */
+    recordCount?: number;
+    /**
+     * The time window the referenced evidence covers.
+     */
+    timeRange?: ExternalEvidenceTimeRange;
+    [property: string]: any;
+}
+
+/**
+ * The time window the referenced evidence covers.
+ *
+ * The time window a referenced external evidence corpus covers.
+ */
+export interface ExternalEvidenceTimeRange {
+    /**
+     * End of the time window the corpus covers (ISO 8601).
+     */
+    end?: Date;
+    /**
+     * Start of the time window the corpus covers (ISO 8601).
+     */
+    start?: Date;
+    [property: string]: any;
 }