diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c5ccd30..f3cb196c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,23 @@ the compatibility and migration notes before upgrading.
   view (`GET /v1/supply-chain/repositories/{id}/component`). No route means no
   outbound license traffic. Migration 034 adds the evidence, enrichment-job,
   and assessment tables.
+- Portfolio read APIs over the caller's authorized repositories: an overview
+  whose every count names its denominator, keyset-paginated unique
+  coordinates with ecosystem, search, license, and assessment filters,
+  bounded facets, a coordinate detail listing authorized occurrences, a CSV
+  export with provenance columns and formula-safe cells, and a snapshot
+  comparison that separates component, declared-license, and edge changes
+  from document metadata changes.
+- Standards-based imports of SPDX 2.3 JSON and CycloneDX 1.6 JSON into
+  declared `import:<subject>:<label>` streams (`POST /v1/supply-chain/imports`),
+  with format detection from the document, explicit rejection of other
+  formats and versions, byte-preserving storage, uploader identity recorded
+  apart from the claimed producer, producer-asserted subject binding,
+  idempotency, per-repository quotas, and administrator-managed upload grants
+  (`PUT /v1/supply-chain/upload-grants`). A derived SPDX export
+  (`GET /v1/supply-chain/exports/{id}/derived.spdx.json`) names GraphNest as
+  creator, links the preserved original, and carries assessments as comments
+  only. Migration 035 adds imports and upload grants.
 
 ## [0.5.0] - 2026-09-18
 
diff --git a/README.md b/README.md
index 6b505aa4..8d569ebc 100644
--- a/README.md
+++ b/README.md
@@ -213,6 +213,8 @@ What the inventory is and is not:
 - A failed refresh (403, 404, rate limit, malformed or oversized document, outage) records a collection attempt and leaves the last successful snapshot in place; the status reports `collection: failed` alongside the retained inventory.
 - Inventory eligibility is repository authorization alone. It works for repositories with no Zoekt index, no SCIP upload, and no graph enrichment, and inventory work never blocks lexical indexing.
 
+SBOMs produced elsewhere (Syft, ORT, or any tool writing SPDX 2.3 JSON or CycloneDX 1.6 JSON) can be imported into separate `import:<subject>:<label>` streams with `POST /v1/supply-chain/imports`; the uploader is recorded apart from the producer the document claims, and a derived SPDX export links back to the preserved original. Portfolio views (`/v1/supply-chain/overview`, `/components`, `/facets`, exports, comparison) aggregate only over the caller's authorized repositories and name every denominator.
+
 Every read resolves the live principal's repository scope before any inventory row is touched; snapshot and job identifiers outside that scope are indistinguishable from missing ones. Manual refresh (`POST /v1/supply-chain/repositories/{id}/refresh`) only enqueues a bounded background job and requires administrator access. The published snapshot is also projected into the existing GitHub-sourced SCIP package mappings; manual mappings are never touched. See [Operations](docs/operations.md#dependencies--licenses-inventory) and [ADR-0017](docs/adr/0017-supply-chain-inventory.md).
 
 ## Durable mode
diff --git a/cmd/graphnest-server/main.go b/cmd/graphnest-server/main.go
index 61f508f9..56166f47 100644
--- a/cmd/graphnest-server/main.go
+++ b/cmd/graphnest-server/main.go
@@ -47,6 +47,7 @@ import (
 	"github.com/balcsida/graphnest/internal/webhook"
 	"github.com/balcsida/graphnest/internal/webui"
 	"github.com/balcsida/graphnest/internal/zoekt"
+	"github.com/jackc/pgx/v5"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"golang.org/x/net/idna"
 )
@@ -470,9 +471,22 @@ func newDurableRuntime(ctx context.Context, settings config.Config, logger *slog
 			License: store, EnrichmentEcosystems: registry.Ecosystems()}
 		supplyChainDone = startSupplyChain(loopCtx, settings.SupplyChain, store, githubClient, registry, metrics, logger)
 		portfolio := &supplychain.Portfolio{Store: store, Snapshots: store, Authorizer: authz.NewPostgres(store), Interval: settings.SupplyChain.Interval, MaxResults: settings.Limits.MaxResults}
+		importer := &supplychain.Importer{Store: store, Authorizer: authz.NewPostgres(store), MaxDocumentBytes: settings.SupplyChain.MaxDocumentBytes, Limits: supplychain.Limits{MaxComponents: settings.SupplyChain.MaxComponents}}
+		if len(registry.Ecosystems()) > 0 {
+			importer.Enricher = &license.Worker{Store: store, Registry: registry}
+		}
+		authorizer := authz.NewPostgres(store)
+		grants := &httpapi.UploadGrants{Set: store.SetSupplyChainUploadGrant, Resolve: func(ctx context.Context, principal authn.Principal, githubID int64) (int64, error) {
+			repo, err := authorizer.AuthorizedRepository(ctx, principal, githubID)
+			if errors.Is(err, pgx.ErrNoRows) {
+				return 0, supplychain.ErrNotFound
+			}
+			return repo.ID, err
+		}}
 		extras = append(extras, func(mux *http.ServeMux) {
 			httpapi.RegisterSupplyChain(mux, auth.requestAuth, supplyChainService, settings.Limits.MaxResults, settings.Limits.MaxResponseBytes)
-			httpapi.RegisterSupplyChainPortfolio(mux, auth.requestAuth, portfolio, settings.Limits.MaxResults, settings.Limits.MaxResponseBytes)
+			httpapi.RegisterSupplyChainPortfolio(mux, auth.requestAuth, portfolio, settings.Limits.MaxResults, settings.Limits.MaxResponseBytes, &httpapi.DerivedExport{Service: supplyChainService, PublicOrigin: auth.requestAuth.PublicOrigin})
+			httpapi.RegisterSupplyChainImports(mux, auth.requestAuth, importer, grants, settings.SupplyChain.MaxDocumentBytes, settings.Limits.MaxResponseBytes)
 		})
 	}
 	handler := newAPIHandler(settings, metrics, auth.requestAuth, searchService, repositoryService, scipService, graphService, graphQueries, webhookSecret, processor, adminService, durableReadiness{pool: pool, zoekt: backend}, auth.providers, auth.sessions, provisioning, scimService, auth.mcpOAuth, extras...)
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 54d69bfb..da0dff8f 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -639,7 +639,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, description: GitHub repository ID, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, description: 'Stream key; only github:source is served in this milestone', schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, description: 'Stream key: github:source (default) or import:<subject>:<label>', schema: {type: string}}
       responses:
         '200': {description: Repository inventory status, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainRepositoryStatus'}}}}
         '400': {$ref: '#/components/responses/InvalidRequest'}
@@ -654,7 +654,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: snapshot_id, in: query, required: false, description: A specific snapshot of this repository (defaults to the stream's latest), schema: {type: integer, format: int64, minimum: 1}}
         - {name: cursor, in: query, required: false, description: next_cursor from a previous truncated response (bound to the snapshot and search term), schema: {type: string, minLength: 1}}
         - {name: limit, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100}}
@@ -674,7 +674,7 @@ paths:
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
         - {name: element, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 512}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: snapshot_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Component evidence detail, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainComponentDetail'}}}}
@@ -689,7 +689,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: limit, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100}}
       responses:
         '200': {description: Snapshot history, newest first, content: {application/json: {schema: {type: object, additionalProperties: false, required: [snapshots], properties: {snapshots: {type: array, items: {$ref: '#/components/schemas/SupplyChainSnapshot'}}}}}}}
@@ -705,7 +705,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: cursor, in: query, required: false, schema: {type: string, minLength: 1}}
         - {name: limit, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100}}
       responses:
@@ -722,7 +722,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
       responses:
         '202': {description: Refresh job queued or already queued, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainRefreshResponse'}}}}
         '400': {$ref: '#/components/responses/InvalidRequest'}
@@ -765,7 +765,7 @@ paths:
       description: Portfolio summary across the caller's authorized repositories for one stream. Every count names its denominator in `denominators`; assessments describe evidence, never compliance. Requested repository_id values outside the caller's scope are silently dropped.
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, description: Repeatable GitHub repository IDs to narrow the scope (at most 200), schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Portfolio overview, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainOverview'}}}}
@@ -779,7 +779,7 @@ paths:
       description: Bounded filter facets (ecosystems, assessment statuses, normalized license expressions) computed inside the caller's scope.
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Facets, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainFacets'}}}}
@@ -793,7 +793,7 @@ paths:
       description: Unique coordinates (ecosystem, namespace, name, version) across the latest snapshots of the caller's authorized repositories, with repository and occurrence counts, keyset-paginated in stable key order. The cursor is bound to the filter set. Filters never reveal repositories outside the scope.
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
         - {name: ecosystem, in: query, required: false, schema: {type: string, maxLength: 64}}
         - {name: q, in: query, required: false, description: Case-insensitive substring of name or purl, schema: {type: string, maxLength: 200}}
@@ -814,7 +814,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: key, in: path, required: true, description: Component key from the component list, schema: {type: string, minLength: 1, maxLength: 4096}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Coordinate detail, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainPortfolioComponentDetail'}}}}
@@ -830,7 +830,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: snapshot_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: CSV attachment with X-GraphNest-Snapshot-ID, content: {text/csv: {schema: {type: string}}}}
@@ -856,6 +856,64 @@ paths:
         '405': {$ref: '#/components/responses/InvalidRequest'}
         '500': {description: Response exceeded the configured byte limit}
         '503': {$ref: '#/components/responses/Unavailable'}
+  /v1/supply-chain/imports:
+    post:
+      description: Import an SBOM produced elsewhere into a declared stream (import:<subject>:<label>) of an authorized repository. Accepts SPDX 2.3 JSON and CycloneDX 1.6 JSON only; the format is detected from the document, and a Content-Type that contradicts it is rejected. The original bytes are preserved and downloadable unchanged. The authenticated uploader is recorded separately from the producer the document claims; an optional subject_revision is recorded as producer_asserted, never verified. Identical bytes into the same stream return the earlier result (repeated=true). Administrators may import anywhere; other principals need a repository-scoped upload grant. Per-repository quotas apply to accepted and rejected attempts. External URLs inside documents are never dereferenced.
+      security: [{bearerAuth: []}, {sessionCookie: []}]
+      parameters:
+        - {name: repository_id, in: query, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: subject, in: query, required: true, schema: {type: string, enum: [source, artifact]}}
+        - {name: label, in: query, required: true, description: Stream label such as ort or syft-image, schema: {type: string, pattern: '^[a-z0-9][a-z0-9._-]{0,63}$'}}
+        - {name: subject_revision, in: query, required: false, schema: {type: string, pattern: '^[0-9a-f]{40}$'}}
+      requestBody:
+        required: true
+        content:
+          application/spdx+json: {schema: {type: object}}
+          application/vnd.cyclonedx+json: {schema: {type: object}}
+          application/json: {schema: {type: object}}
+      responses:
+        '201': {description: Import accepted (published, or unchanged when the stream already serves this document), content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainImportResponse'}}}}
+        '400': {description: Invalid parameters or a document that could not be parsed (malformed_document), content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '401': {$ref: '#/components/responses/Unauthenticated'}
+        '403': {description: No upload grant for this repository, content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '405': {$ref: '#/components/responses/InvalidRequest'}
+        '413': {description: Document exceeds the configured size or component limits, content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '415': {description: Unsupported media type, format, or schema version (unsupported_format), content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '429': {description: Import quota exhausted for this repository (quota_exceeded), content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '500': {description: Response exceeded the configured byte limit}
+        '503': {$ref: '#/components/responses/Unavailable'}
+  /v1/supply-chain/upload-grants:
+    put:
+      description: Administrator-only. Grant or revoke a principal's (by subject) permission to import into one repository. Grants never widen read access.
+      security: [{bearerAuth: []}, {sessionCookie: []}]
+      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [repository_id, subject, allow], properties: {repository_id: {type: integer, format: int64, minimum: 1}, subject: {type: string, minLength: 1, maxLength: 256}, allow: {type: boolean}}}}}}
+      responses:
+        '204': {description: Grant updated}
+        '400': {$ref: '#/components/responses/InvalidRequest'}
+        '401': {$ref: '#/components/responses/Unauthenticated'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '405': {$ref: '#/components/responses/InvalidRequest'}
+        '413': {$ref: '#/components/responses/InvalidRequest'}
+        '415': {$ref: '#/components/responses/InvalidRequest'}
+        '503': {$ref: '#/components/responses/Unavailable'}
+  /v1/supply-chain/exports/{id}/derived.spdx.json:
+    get:
+      description: Derived SPDX 2.3 JSON document for one authorized snapshot with GraphNest as creator. It links the preserved original by URL and SHA-256 (externalDocumentRefs) and carries GraphNest assessments only as licenseComments; licenseConcluded is always NOASSERTION and licenseDeclared holds only values that are valid SPDX expressions or sentinels. Review decisions are not part of the document. The original download is never altered.
+      security: [{bearerAuth: []}, {sessionCookie: []}]
+      parameters:
+        - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: stream, in: query, required: false, schema: {type: string}}
+        - {name: snapshot_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
+      responses:
+        '200': {description: Derived SPDX document (attachment) with X-GraphNest-Derived and X-GraphNest-Snapshot-ID, content: {application/spdx+json: {schema: {type: object}}}}
+        '400': {$ref: '#/components/responses/InvalidRequest'}
+        '401': {$ref: '#/components/responses/Unauthenticated'}
+        '404': {$ref: '#/components/responses/SupplyChainNotFound'}
+        '405': {$ref: '#/components/responses/InvalidRequest'}
+        '413': {description: Export exceeds the response limit}
+        '503': {$ref: '#/components/responses/Unavailable'}
   /v1/auth/config:
     get:
       responses:
@@ -2238,7 +2296,7 @@ components:
     SupplyChainRepositoryStatus:
       type: object
       additionalProperties: false
-      required: [repository_id, repository, stream, producer, subject, collection, freshness_seconds, latest_snapshot, last_collection, active_job, enrichment, enrichment_ecosystems, license_summary, opt_out, notes, documents]
+      required: [repository_id, repository, stream, producer, subject, collection, freshness_seconds, latest_snapshot, last_collection, active_job, enrichment, enrichment_ecosystems, license_summary, opt_out, notes, documents, streams]
       properties:
         repository_id: {type: integer, format: int64}
         repository: {type: string}
@@ -2256,6 +2314,7 @@ components:
         opt_out: {type: boolean}
         notes: {type: array, items: {type: string}}
         documents: {type: array, items: {$ref: '#/components/schemas/SupplyChainDocumentRef'}}
+        streams: {type: array, items: {$ref: '#/components/schemas/SupplyChainStreamRef'}, description: Every stream known for the repository (GitHub observation and imports)}
     SupplyChainDocumentRef:
       type: object
       additionalProperties: false
@@ -2295,6 +2354,8 @@ components:
         document_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
         document_format: {type: string, enum: [spdx-2.3-json, cyclonedx-1.6-json]}
         document_bytes: {type: integer, format: int64, minimum: 0}
+        uploaded_by: {type: string, description: Authenticated uploader of an imported document, distinct from the producer the document claims}
+        upload_label: {type: string}
     SupplyChainWarning:
       type: object
       additionalProperties: false
@@ -2513,6 +2574,33 @@ components:
         edges_removed: {type: integer, minimum: 0}
         metadata_changes: {type: array, items: {type: string}}
         notes: {type: array, items: {type: string}}
+    SupplyChainImportResponse:
+      type: object
+      additionalProperties: false
+      required: [import_id, outcome, repeated, snapshot_id, stream, format, component_count, edge_count, warning_count, warnings, notes]
+      properties:
+        import_id: {type: integer, format: int64}
+        outcome: {type: string, enum: [published, unchanged]}
+        repeated: {type: boolean, description: True when identical bytes were already imported into this stream}
+        snapshot_id: {oneOf: [{type: integer, format: int64}, {type: 'null'}]}
+        stream: {type: string}
+        format: {type: string, enum: [spdx-2.3-json, cyclonedx-1.6-json]}
+        component_count: {type: integer, minimum: 0}
+        edge_count: {type: integer, minimum: 0}
+        warning_count: {type: integer, minimum: 0}
+        warnings: {type: array, items: {$ref: '#/components/schemas/SupplyChainWarning'}}
+        subject_assurance: {type: string, enum: [unknown, producer_asserted, verified]}
+        notes: {type: array, items: {type: string}}
+    SupplyChainStreamRef:
+      type: object
+      additionalProperties: false
+      required: [key, producer, subject, has_inventory]
+      properties:
+        key: {type: string}
+        producer: {type: string, enum: [github, import]}
+        subject: {type: string, enum: [source, artifact]}
+        has_inventory: {type: boolean}
+        last_outcome: {type: string}
     SupplyChainComponentList:
       type: object
       additionalProperties: false
diff --git a/docs/operations.md b/docs/operations.md
index 00c716e1..f5e3c372 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -224,6 +224,74 @@ different expressions, or an expression against `UNLICENSED`/`NONE`),
 An assessment is evidence, not approval; the review workflow records
 conclusions and decisions separately.
 
+### Standards-based imports
+
+`POST /v1/supply-chain/imports?repository_id=<github id>&subject=<source|artifact>&label=<stream label>`
+accepts SPDX 2.3 JSON (`application/spdx+json`) and CycloneDX 1.6 JSON
+(`application/vnd.cyclonedx+json`); `application/json` is accepted and the
+format is detected from the document itself. Other formats and schema
+versions (SPDX 2.2, CycloneDX 1.5, XML, tag-value) are rejected with
+`415 unsupported_format`; GraphNest does not claim universal SBOM
+compatibility. Each `(subject, label)` pair is its own stream
+(`import:source:ort`, `import:artifact:syft-image`), separate from the GitHub
+observation, so a container SBOM never replaces the repository's GitHub
+snapshot and an older artifact upload never becomes the current source
+inventory.
+
+Permission: administrators may import into any authorized repository. Other
+principals need a repository-scoped upload grant
+(`PUT /v1/supply-chain/upload-grants` by an administrator, keyed by the
+principal's subject). A grant never widens read access. Quota: 100 imports
+per repository per 24 hours, counting rejected attempts. Identical bytes into
+the same stream are idempotent (`repeated: true`). Documents are bounded by
+`GRAPHNEST_SUPPLY_CHAIN_MAX_DOCUMENT_BYTES` and `..._MAX_COMPONENTS`.
+
+Trust boundaries: the authenticated uploader is recorded on the snapshot
+(`uploaded_by`) separately from the tool the document names, which is only
+the document's own claim; a `Tool: ORT` string grants nothing. An optional
+`subject_revision` (40-hex commit) is recorded as `producer_asserted`, never
+`verified`. Download locations, license URLs, and external document
+references inside uploads are never dereferenced.
+
+What is and is not carried: original bytes are always preserved and
+downloadable. From SPDX, GraphNest normalizes packages, versions, purls,
+checksums, suppliers, declared/concluded license values (verbatim), and every
+relationship with its direction. From CycloneDX, it flattens nested
+components (with `CONTAINS` edges), keeps `dependencies` as `DEPENDS_ON`,
+hashes, suppliers, purl qualifiers, and license choices as the format carries
+them: one `expression` or SPDX `id` verbatim; a `name`/`url` as a name or
+URL; several license objects as a semicolon list (CycloneDX defines no
+AND/OR meaning for them, so none is invented). CycloneDX component
+`evidence` (license findings, copyright, file occurrences), inline license
+text, ORT's per-file scan results and curations, and Syft's file catalog stay
+only in the stored original and are flagged by coverage warnings
+(`evidence_not_carried`, `license_text_inline`). GraphNest has no native
+ScanCode or Code Insight adapter; it imports what those tools export in the
+two supported formats.
+
+Producer examples (each writes a supported format; the fixtures under
+`test/fixtures/supplychain/` are sanitized shapes of these outputs):
+
+```sh
+# Syft: CycloneDX 1.6 JSON of a built image (artifact subject)
+syft registry.example.internal/acme/widgets:1.4.2 -o cyclonedx-json@1.6 > widgets-image.cdx.json
+curl --fail-with-body -X POST "https://graphnest.example/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image" \
+  -H "Authorization: Bearer $GRAPHNEST_TOKEN" -H 'Content-Type: application/vnd.cyclonedx+json' --data-binary @widgets-image.cdx.json
+
+# ORT: SPDX 2.3 JSON report of the analyzed source tree (source subject)
+ort report -i analyzer-result.yml -o reports -f SpdxDocument -O SpdxDocument=outputFileFormats=JSON
+curl --fail-with-body -X POST "https://graphnest.example/v1/supply-chain/imports?repository_id=101&subject=source&label=ort&subject_revision=$GITHUB_SHA" \
+  -H "Authorization: Bearer $GRAPHNEST_TOKEN" -H 'Content-Type: application/spdx+json' --data-binary @reports/bom.spdx.json
+```
+
+Derived export: `GET /v1/supply-chain/exports/{id}/derived.spdx.json` returns
+an SPDX 2.3 JSON document created by GraphNest that links the preserved
+original by URL and SHA-256 and adds assessments as `licenseComments` only
+(`licenseConcluded` is always `NOASSERTION`). It is validated with
+GraphNest's own reader before it is served and is never presented as the
+producer's document. `GET /v1/supply-chain/exports/{id}/components.csv` is
+the tabular equivalent with provenance columns and formula-safe cells.
+
 ## Break-glass administrator recovery
 
 SSO remains the primary sign-in method. Use the offline command only when an
diff --git a/internal/httpapi/supply_chain_import.go b/internal/httpapi/supply_chain_import.go
new file mode 100644
index 00000000..cf55c629
--- /dev/null
+++ b/internal/httpapi/supply_chain_import.go
@@ -0,0 +1,105 @@
+package httpapi
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/authn"
+	"github.com/balcsida/graphnest/internal/supplychain"
+)
+
+// UploadGrants manages repository-scoped import permissions. Resolve maps an
+// authorized GitHub repository ID to the internal row for the principal.
+type UploadGrants struct {
+	Set     func(ctx context.Context, repositoryID int64, subject, grantedBy string, allow bool) error
+	Resolve func(ctx context.Context, principal authn.Principal, githubID int64) (int64, error)
+}
+
+// RegisterSupplyChainImports mounts the standards-based import route and the
+// administrator-only upload-grant route.
+//
+//	POST /v1/supply-chain/imports?repository_id=101&subject=source&label=ort[&subject_revision=<sha>]
+//	Content-Type: application/spdx+json | application/vnd.cyclonedx+json | application/json
+func RegisterSupplyChainImports(mux *http.ServeMux, authenticator authn.RequestAuthenticator, importer *supplychain.Importer, grants *UploadGrants, maxUploadBytes, maxResponseBytes int64) {
+	mux.Handle("/v1/supply-chain/imports", exactMethod(http.MethodPost, AuthenticateRequest(authenticator, http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		contentType := strings.ToLower(strings.TrimSpace(strings.Split(request.Header.Get("Content-Type"), ";")[0]))
+		switch contentType {
+		case "application/json", "application/spdx+json", "application/vnd.cyclonedx+json":
+		default:
+			writeError(writer, http.StatusUnsupportedMediaType, "invalid_request", "request is invalid", false)
+			return
+		}
+		query := request.URL.Query()
+		repositoryID, err := strconv.ParseInt(query.Get("repository_id"), 10, 64)
+		if err != nil || repositoryID < 1 || len(query["repository_id"]) != 1 || len(query["subject"]) != 1 || len(query["label"]) != 1 {
+			writeError(writer, http.StatusBadRequest, "invalid_request", "request is invalid", false)
+			return
+		}
+		controller := http.NewResponseController(writer)
+		_ = controller.SetReadDeadline(time.Now().Add(2 * time.Minute))
+		data, err := io.ReadAll(http.MaxBytesReader(writer, request.Body, maxUploadBytes))
+		if err != nil {
+			writeError(writer, invalidRequestStatus(err), "invalid_request", "request is invalid", false)
+			return
+		}
+		response, err := importer.Import(request.Context(), PrincipalFromContext(request.Context()), supplychain.ImportRequest{
+			RepositoryID: repositoryID, Subject: supplychain.Subject(query.Get("subject")), Label: query.Get("label"), SubjectRevision: query.Get("subject_revision"),
+			ContentType: contentType, Document: data,
+		})
+		if err != nil {
+			writeSupplyChainImportError(writer, err)
+			return
+		}
+		writeBoundedJSONStatus(writer, http.StatusCreated, response, maxResponseBytes)
+	}))))
+	if grants == nil {
+		return
+	}
+	mux.Handle("/v1/supply-chain/upload-grants", exactMethod(http.MethodPut, AuthenticateRequest(authenticator, jsonSCIPHandler(4<<10, func(writer http.ResponseWriter, request *http.Request, input struct {
+		RepositoryID int64  `json:"repository_id"`
+		Subject      string `json:"subject"`
+		Allow        bool   `json:"allow"`
+	}) {
+		principal := PrincipalFromContext(request.Context())
+		if !principal.Administrator {
+			writeSupplyChainError(writer, supplychain.ErrForbidden)
+			return
+		}
+		if input.RepositoryID < 1 || input.Subject == "" || len(input.Subject) > 256 {
+			writeError(writer, http.StatusBadRequest, "invalid_request", "request is invalid", false)
+			return
+		}
+		internalID, err := grants.Resolve(request.Context(), principal, input.RepositoryID)
+		if err != nil {
+			writeSupplyChainError(writer, err)
+			return
+		}
+		if err := grants.Set(request.Context(), internalID, input.Subject, principal.Subject, input.Allow); err != nil {
+			writeSupplyChainError(writer, err)
+			return
+		}
+		writer.WriteHeader(http.StatusNoContent)
+	}))))
+}
+
+func writeSupplyChainImportError(writer http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, supplychain.ErrUnsupportedFormat), errors.Is(err, supplychain.ErrUnsupportedVersion):
+		writeError(writer, http.StatusUnsupportedMediaType, "unsupported_format", "only SPDX 2.3 JSON and CycloneDX 1.6 JSON documents are accepted", false)
+	case errors.Is(err, supplychain.ErrMalformed):
+		writeError(writer, http.StatusBadRequest, "malformed_document", "document could not be parsed", false)
+	case errors.Is(err, supplychain.ErrTooLarge), errors.Is(err, supplychain.ErrImportTooLarge):
+		writeError(writer, http.StatusRequestEntityTooLarge, "too_large", "document exceeds the configured limits", false)
+	case errors.Is(err, supplychain.ErrQuotaExceeded):
+		writeError(writer, http.StatusTooManyRequests, "quota_exceeded", "import quota for this repository is exhausted", true)
+	case errors.Is(err, supplychain.ErrForbidden):
+		writeError(writer, http.StatusForbidden, "forbidden", "upload permission for this repository is required", false)
+	default:
+		writeSupplyChainError(writer, err)
+	}
+}
diff --git a/internal/httpapi/supply_chain_portfolio.go b/internal/httpapi/supply_chain_portfolio.go
index 3fbb7c08..889bc943 100644
--- a/internal/httpapi/supply_chain_portfolio.go
+++ b/internal/httpapi/supply_chain_portfolio.go
@@ -13,7 +13,18 @@ import (
 // RegisterSupplyChainPortfolio mounts the cross-repository inventory routes.
 // Authorization scope is resolved from the live principal on every request
 // before any aggregate is computed.
-func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.RequestAuthenticator, portfolio *supplychain.Portfolio, maxResults int, maxResponseBytes int64) {
+// DerivedExport is the optional derived SPDX exporter mounted next to the CSV
+// export under /v1/supply-chain/exports/{id}/derived.spdx.json.
+type DerivedExport struct {
+	Service      *supplychain.Service
+	PublicOrigin string
+}
+
+func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.RequestAuthenticator, portfolio *supplychain.Portfolio, maxResults int, maxResponseBytes int64, derived ...*DerivedExport) {
+	var spdxExport *DerivedExport
+	if len(derived) > 0 {
+		spdxExport = derived[0]
+	}
 	authenticated := func(method string, handle func(http.ResponseWriter, *http.Request)) http.Handler {
 		return exactMethod(method, AuthenticateRequest(authenticator, http.HandlerFunc(handle)))
 	}
@@ -91,7 +102,7 @@ func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.Reques
 		githubID, err := strconv.ParseInt(id, 10, 64)
 		query := request.URL.Query()
 		var snapshotID int64
-		ok := err == nil && githubID > 0 && suffix == "components.csv" && supplychain.ValidStream(query.Get("stream"))
+		ok := err == nil && githubID > 0 && (suffix == "components.csv" || suffix == "derived.spdx.json") && supplychain.ValidStream(query.Get("stream"))
 		if value := query.Get("snapshot_id"); value != "" && ok {
 			snapshotID, err = strconv.ParseInt(value, 10, 64)
 			ok = err == nil && snapshotID > 0
@@ -100,6 +111,14 @@ func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.Reques
 			writeError(writer, http.StatusBadRequest, "invalid_request", "request is invalid", false)
 			return
 		}
+		if suffix == "derived.spdx.json" {
+			if spdxExport == nil || spdxExport.Service == nil {
+				writeError(writer, http.StatusNotFound, "not_found", "route not found", false)
+				return
+			}
+			serveDerivedSPDX(writer, request, spdxExport.Service, spdxExport.PublicOrigin, githubID, snapshotID, query.Get("stream"), maxResponseBytes)
+			return
+		}
 		var buffer bytes.Buffer
 		snapshot, err := portfolio.ExportCSV(request.Context(), PrincipalFromContext(request.Context()), githubID, query.Get("stream"), snapshotID, &buffer)
 		if err != nil {
@@ -152,3 +171,29 @@ func repositoryIDsFrom(values []string) ([]int64, bool) {
 	}
 	return ids, true
 }
+
+// serveDerivedSPDX writes the derived SPDX export for one authorized snapshot.
+func serveDerivedSPDX(writer http.ResponseWriter, request *http.Request, service *supplychain.Service, publicOrigin string, githubID, snapshotID int64, stream string, maxResponseBytes int64) {
+	origin := publicOrigin
+	if origin == "" {
+		origin = "https://graphnest.invalid"
+	}
+	document, snapshot, err := service.ExportSPDX(request.Context(), PrincipalFromContext(request.Context()), githubID, stream, snapshotID, origin)
+	if err != nil {
+		writeSupplyChainError(writer, err)
+		return
+	}
+	if int64(len(document)) > maxResponseBytes*64 {
+		writeError(writer, http.StatusRequestEntityTooLarge, "too_large", "export exceeds the response limit", false)
+		return
+	}
+	writer.Header().Set("Content-Type", "application/spdx+json")
+	writer.Header().Set("X-Content-Type-Options", "nosniff")
+	writer.Header().Set("Cache-Control", "private, no-store")
+	writer.Header().Set("Content-Disposition", `attachment; filename="graphnest-derived-repo`+strconv.FormatInt(snapshot.RepositoryID, 10)+`-snapshot`+strconv.FormatInt(snapshot.ID, 10)+`.spdx.json"`)
+	writer.Header().Set("X-GraphNest-Snapshot-ID", strconv.FormatInt(snapshot.ID, 10))
+	writer.Header().Set("X-GraphNest-Derived", "true")
+	writer.Header().Set("Content-Length", strconv.Itoa(len(document)))
+	writer.WriteHeader(http.StatusOK)
+	_, _ = writer.Write(document)
+}
diff --git a/internal/postgres/migrations/035_supply_chain_import.sql b/internal/postgres/migrations/035_supply_chain_import.sql
new file mode 100644
index 00000000..5f8fa9c6
--- /dev/null
+++ b/internal/postgres/migrations/035_supply_chain_import.sql
@@ -0,0 +1,38 @@
+-- Standards-based imports (ADR-0017, Milestone 4). The uploader's identity is
+-- recorded separately from whatever producer the document claims, and the
+-- subject binding is recorded only at the assurance level actually
+-- established (an uploader's assertion is producer_asserted, never verified).
+alter table supply_chain_snapshots
+    add column uploaded_by varchar(256) not null default '',
+    add column upload_label varchar(64) not null default '';
+
+-- Import idempotency and quota: one row per accepted or rejected upload
+-- attempt, keyed by document hash within a repository stream.
+create table supply_chain_imports (
+    id bigint generated always as identity primary key,
+    repository_id bigint not null references repositories(id) on delete cascade,
+    stream_key varchar(200) not null,
+    document_sha256 bytea not null check (octet_length(document_sha256) = 32),
+    format varchar(32) not null check (format in ('spdx-2.3-json', 'cyclonedx-1.6-json')),
+    uploaded_by varchar(256) not null,
+    upload_label varchar(64) not null default '',
+    byte_size bigint not null check (byte_size >= 0),
+    outcome varchar(16) not null check (outcome in ('published', 'unchanged', 'rejected')),
+    snapshot_id bigint references supply_chain_snapshots(id) on delete set null,
+    error_code varchar(64) not null default '',
+    message text not null default '',
+    created_at timestamptz not null default now()
+);
+create index supply_chain_imports_stream on supply_chain_imports (repository_id, stream_key, id desc);
+create index supply_chain_imports_quota on supply_chain_imports (repository_id, created_at desc);
+
+-- Repository-scoped upload permission: which principals (users, by external
+-- identity subject) may import into which repositories. Administrators need
+-- no grant. Empty by default.
+create table supply_chain_upload_grants (
+    repository_id bigint not null references repositories(id) on delete cascade,
+    subject varchar(256) not null,
+    granted_by varchar(256) not null,
+    created_at timestamptz not null default now(),
+    primary key (repository_id, subject)
+);
diff --git a/internal/postgres/supply_chain.go b/internal/postgres/supply_chain.go
index 4c22cbc0..600af1b6 100644
--- a/internal/postgres/supply_chain.go
+++ b/internal/postgres/supply_chain.go
@@ -222,11 +222,11 @@ func insertSupplyChainSnapshot(ctx context.Context, tx pgx.Tx, publication Suppl
 	var snapshotID int64
 	if err := tx.QueryRow(ctx, `insert into supply_chain_snapshots (repository_id, document_id, producer, subject, stream_key, collected_at, created_at_claimed,
 			producer_tool, document_namespace, document_name, spdx_version, data_license, subject_revision, subject_assurance, root_element_ids,
-			parser_version, component_count, edge_count, warning_count, warnings)
-		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20) returning id`,
+			parser_version, component_count, edge_count, warning_count, warnings, uploaded_by, upload_label)
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22) returning id`,
 		publication.RepositoryID, documentID, string(publication.Producer), string(publication.Subject), publication.StreamKey, publication.CollectedAt.UTC(), normalized.CreatedAtClaimed,
 		normalized.ProducerTool, normalized.DocumentNamespace, normalized.DocumentName, normalized.SPDXVersion, normalized.DataLicense, revision, string(assurance), roots,
-		supplychain.ParserVersion, len(normalized.Components), len(normalized.Relationships), normalized.WarningCount, warnings).Scan(&snapshotID); err != nil {
+		supplychain.ParserVersion, len(normalized.Components), len(normalized.Relationships), normalized.WarningCount, warnings, publication.UploadedBy, publication.UploadLabel).Scan(&snapshotID); err != nil {
 		return 0, err
 	}
 	if _, err := tx.CopyFrom(ctx, pgx.Identifier{"supply_chain_components"},
@@ -396,7 +396,8 @@ func (s *Store) SupplyChainStream(ctx context.Context, repositoryID int64, strea
 
 const supplyChainSnapshotColumns = `snap.id, snap.repository_id, snap.document_id, snap.producer, snap.subject, snap.stream_key, snap.collected_at, snap.created_at_claimed,
 	snap.producer_tool, snap.document_namespace, snap.document_name, snap.spdx_version, snap.data_license, coalesce(snap.subject_revision, ''), snap.subject_assurance,
-	snap.root_element_ids, snap.parser_version, snap.component_count, snap.edge_count, snap.warning_count, snap.warnings, snap.published_at, doc.sha256, doc.format, doc.byte_size`
+	snap.root_element_ids, snap.parser_version, snap.component_count, snap.edge_count, snap.warning_count, snap.warnings, snap.published_at, doc.sha256, doc.format, doc.byte_size,
+	snap.uploaded_by, snap.upload_label`
 
 func scanSupplyChainSnapshot(row interface{ Scan(...any) error }) (supplychain.Snapshot, error) {
 	var snapshot supplychain.Snapshot
@@ -405,7 +406,7 @@ func scanSupplyChainSnapshot(row interface{ Scan(...any) error }) (supplychain.S
 	err := row.Scan(&snapshot.ID, &snapshot.RepositoryID, &snapshot.DocumentID, &producer, &subject, &snapshot.StreamKey, &snapshot.CollectedAt, &snapshot.CreatedAtClaimed,
 		&snapshot.ProducerTool, &snapshot.DocumentNamespace, &snapshot.DocumentName, &snapshot.SPDXVersion, &snapshot.DataLicense, &snapshot.SubjectRevision, &assurance,
 		&snapshot.RootElementIDs, &snapshot.ParserVersion, &snapshot.ComponentCount, &snapshot.EdgeCount, &snapshot.WarningCount, &warnings, &snapshot.PublishedAt,
-		&snapshot.DocumentSHA256, &format, &snapshot.DocumentBytes)
+		&snapshot.DocumentSHA256, &format, &snapshot.DocumentBytes, &snapshot.UploadedBy, &snapshot.UploadLabel)
 	if err != nil {
 		return supplychain.Snapshot{}, err
 	}
diff --git a/internal/postgres/supply_chain_import.go b/internal/postgres/supply_chain_import.go
new file mode 100644
index 00000000..3f4bd184
--- /dev/null
+++ b/internal/postgres/supply_chain_import.go
@@ -0,0 +1,77 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/supplychain"
+	"github.com/jackc/pgx/v5"
+)
+
+// SupplyChainUploadAllowed reports whether a non-administrator subject holds
+// an upload grant for the repository.
+func (s *Store) SupplyChainUploadAllowed(ctx context.Context, repositoryID int64, subject string) (bool, error) {
+	var allowed bool
+	err := s.pool.QueryRow(ctx, `select exists(select 1 from supply_chain_upload_grants where repository_id=$1 and subject=$2)`, repositoryID, subject).Scan(&allowed)
+	return allowed, err
+}
+
+// SetSupplyChainUploadGrant adds or removes a repository-scoped upload grant.
+func (s *Store) SetSupplyChainUploadGrant(ctx context.Context, repositoryID int64, subject, grantedBy string, allow bool) error {
+	if !allow {
+		_, err := s.pool.Exec(ctx, `delete from supply_chain_upload_grants where repository_id=$1 and subject=$2`, repositoryID, subject)
+		return err
+	}
+	_, err := s.pool.Exec(ctx, `insert into supply_chain_upload_grants (repository_id, subject, granted_by) values ($1, $2, $3) on conflict do nothing`, repositoryID, subject, grantedBy)
+	return err
+}
+
+func (s *Store) SupplyChainImportCount(ctx context.Context, repositoryID int64, since time.Time) (int, error) {
+	var count int
+	err := s.pool.QueryRow(ctx, `select count(*) from supply_chain_imports where repository_id=$1 and created_at>=$2`, repositoryID, since).Scan(&count)
+	return count, err
+}
+
+func (s *Store) SupplyChainImportByDigest(ctx context.Context, repositoryID int64, streamKey string, digest []byte) (supplychain.ImportRecord, bool, error) {
+	var record supplychain.ImportRecord
+	var format string
+	err := s.pool.QueryRow(ctx, `select id, repository_id, stream_key, document_sha256, format, uploaded_by, upload_label, byte_size, outcome, snapshot_id, error_code, message, created_at
+		from supply_chain_imports where repository_id=$1 and stream_key=$2 and document_sha256=$3 order by id desc limit 1`, repositoryID, streamKey, digest).
+		Scan(&record.ID, &record.RepositoryID, &record.StreamKey, &record.DocumentSHA256, &format, &record.UploadedBy, &record.UploadLabel, &record.ByteSize, &record.Outcome, &record.SnapshotID, &record.ErrorCode, &record.Message, &record.CreatedAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return supplychain.ImportRecord{}, false, nil
+	}
+	record.Format = supplychain.Format(format)
+	return record, err == nil, err
+}
+
+func (s *Store) RecordSupplyChainImport(ctx context.Context, record supplychain.ImportRecord) (int64, error) {
+	var id int64
+	err := s.pool.QueryRow(ctx, `insert into supply_chain_imports (repository_id, stream_key, document_sha256, format, uploaded_by, upload_label, byte_size, outcome, snapshot_id, error_code, message)
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) returning id`, record.RepositoryID, record.StreamKey, record.DocumentSHA256, string(record.Format), record.UploadedBy, record.UploadLabel,
+		record.ByteSize, record.Outcome, record.SnapshotID, record.ErrorCode, record.Message).Scan(&id)
+	return id, err
+}
+
+// SupplyChainStreams lists the streams that exist for a repository so the UI
+// can offer producer/subject selection.
+func (s *Store) SupplyChainStreams(ctx context.Context, repositoryID int64) ([]supplychain.Stream, error) {
+	rows, err := s.pool.Query(ctx, `select repository_id, stream_key, producer, subject, latest_snapshot_id, latest_collection_id, last_success_at, last_attempt_at, last_outcome, opt_out
+		from supply_chain_streams where repository_id=$1 order by stream_key`, repositoryID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	streams := []supplychain.Stream{}
+	for rows.Next() {
+		var stream supplychain.Stream
+		var outcome string
+		if err := rows.Scan(&stream.RepositoryID, &stream.StreamKey, &stream.Producer, &stream.Subject, &stream.LatestSnapshotID, &stream.LatestCollectionID, &stream.LastSuccessAt, &stream.LastAttemptAt, &outcome, &stream.OptOut); err != nil {
+			return nil, err
+		}
+		stream.LastOutcome = supplychain.Outcome(outcome)
+		streams = append(streams, stream)
+	}
+	return streams, rows.Err()
+}
diff --git a/internal/supplychain/cyclonedx.go b/internal/supplychain/cyclonedx.go
new file mode 100644
index 00000000..e2933250
--- /dev/null
+++ b/internal/supplychain/cyclonedx.go
@@ -0,0 +1,325 @@
+package supplychain
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// FormatCycloneDX16JSON is the CycloneDX 1.6 JSON document format.
+const FormatCycloneDX16JSON Format = "cyclonedx-1.6-json"
+
+// cdxLicenseChoice decodes the CycloneDX licenses array, which is either a list
+// of {license:{id|name,url}} objects or a single {expression} object.
+type cdxLicenseChoice struct {
+	License *struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+		URL  string `json:"url"`
+		Text *struct {
+			Content string `json:"content"`
+		} `json:"text"`
+		Acknowledgement string `json:"acknowledgement"`
+	} `json:"license"`
+	Expression      string `json:"expression"`
+	Acknowledgement string `json:"acknowledgement"`
+}
+
+type cdxComponent struct {
+	Type     string                 `json:"type"`
+	BOMRef   string                 `json:"bom-ref"`
+	Group    string                 `json:"group"`
+	Name     string                 `json:"name"`
+	Version  *string                `json:"version"`
+	PURL     string                 `json:"purl"`
+	Supplier *struct{ Name string } `json:"supplier"`
+	Hashes   []struct {
+		Alg     string `json:"alg"`
+		Content string `json:"content"`
+	} `json:"hashes"`
+	Licenses   []cdxLicenseChoice `json:"licenses"`
+	Components []cdxComponent     `json:"components"`
+	Evidence   json.RawMessage    `json:"evidence"`
+}
+
+type cdxDocument struct {
+	BOMFormat    string `json:"bomFormat"`
+	SpecVersion  string `json:"specVersion"`
+	SerialNumber string `json:"serialNumber"`
+	Version      int    `json:"version"`
+	Metadata     struct {
+		Timestamp string          `json:"timestamp"`
+		Tools     json.RawMessage `json:"tools"`
+		Component *cdxComponent   `json:"component"`
+	} `json:"metadata"`
+	Components   []cdxComponent `json:"components"`
+	Dependencies []struct {
+		Ref       string   `json:"ref"`
+		DependsOn []string `json:"dependsOn"`
+		Provides  []string `json:"provides"`
+	} `json:"dependencies"`
+}
+
+// NormalizeCycloneDX16 turns a CycloneDX 1.6 JSON BOM into snapshot content.
+// The metadata.component (if any) is the root; nested components are
+// flattened into occurrences with a CONTAINS edge from their parent;
+// dependencies become DEPENDS_ON edges; license choices are recorded verbatim
+// (an expression, an SPDX id, or a name/url) so nothing is invented.
+func NormalizeCycloneDX16(document []byte, limits Limits) (Normalized, error) {
+	limits = limits.withDefaults()
+	decoder := json.NewDecoder(bytes.NewReader(document))
+	var parsed cdxDocument
+	if err := decoder.Decode(&parsed); err != nil {
+		return Normalized{}, fmt.Errorf("%w: %v", ErrMalformed, safeJSONError(err))
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return Normalized{}, fmt.Errorf("%w: trailing content", ErrMalformed)
+	}
+	if parsed.BOMFormat != "CycloneDX" {
+		return Normalized{}, fmt.Errorf("%w: bomFormat is not CycloneDX", ErrMalformed)
+	}
+	if parsed.SpecVersion != "1.6" {
+		if parsed.SpecVersion == "" {
+			return Normalized{}, fmt.Errorf("%w: missing specVersion", ErrMalformed)
+		}
+		return Normalized{}, fmt.Errorf("%w: CycloneDX %s", ErrUnsupportedVersion, sanitize(parsed.SpecVersion, 16))
+	}
+	result := Normalized{SPDXVersion: "CycloneDX-1.6", DocumentNamespace: parsed.SerialNumber, DocumentSPDXID: "CycloneDX-BOM"}
+	if parsed.Version > 0 {
+		result.DocumentNamespace = strings.TrimSpace(parsed.SerialNumber + "#" + strconv.Itoa(parsed.Version))
+	}
+	warn := func(code, element, detail string) {
+		result.WarningCount++
+		if len(result.Warnings) < limits.MaxWarnings {
+			result.Warnings = append(result.Warnings, Warning{Code: code, Element: sanitize(element, 200), Detail: sanitize(detail, 200)})
+		}
+	}
+	if parsed.Metadata.Timestamp != "" {
+		if created, err := time.Parse(time.RFC3339, parsed.Metadata.Timestamp); err == nil {
+			utc := created.UTC()
+			result.CreatedAtClaimed = &utc
+		} else {
+			warn("created_invalid", "", "metadata.timestamp is not RFC 3339")
+		}
+	} else {
+		warn("created_missing", "", "metadata.timestamp is missing")
+	}
+	result.ProducerTool = cdxTool(parsed.Metadata.Tools)
+	if result.ProducerTool == "" {
+		warn("creator_tool_missing", "", "metadata.tools names no tool")
+	}
+
+	elements := map[string]int{}
+	var flatten func(component cdxComponent, parent string, depth int)
+	ordinal := 0
+	overflow := false
+	flatten = func(component cdxComponent, parent string, depth int) {
+		if len(result.Components) >= limits.MaxComponents {
+			overflow = true
+			return
+		}
+		elementID := component.BOMRef
+		if elementID == "" {
+			elementID = "graphnest-bomref-missing-" + strconv.Itoa(ordinal)
+			warn("package_id_missing", elementID, "component has no bom-ref; a synthetic document-local ID was assigned")
+		}
+		if _, duplicate := elements[elementID]; duplicate {
+			original := elementID
+			elementID = elementID + "#graphnest-duplicate-" + strconv.Itoa(ordinal)
+			warn("package_id_duplicate", original, "duplicate bom-ref kept as a separate occurrence under "+elementID)
+		}
+		occurrence := Component{Ordinal: ordinal, ElementID: elementID, Name: component.Name, Version: component.Version, Qualifiers: map[string]string{}}
+		if component.Group != "" {
+			occurrence.Name = component.Group + "/" + component.Name
+		}
+		if component.Name == "" {
+			occurrence.Name = elementID
+			warn("package_name_missing", elementID, "component has no name; its bom-ref is shown instead")
+		}
+		if component.Version == nil || *component.Version == "" {
+			warn("package_version_missing", elementID, "component has no version")
+		}
+		if component.Type != "" && component.Type != "library" && component.Type != "application" && component.Type != "framework" {
+			occurrence.Qualifiers["cdx:type"] = component.Type
+		}
+		if component.Supplier != nil && component.Supplier.Name != "" {
+			supplier := component.Supplier.Name
+			occurrence.Supplier = &supplier
+		}
+		for _, hash := range component.Hashes {
+			if hash.Alg != "" && hash.Content != "" {
+				occurrence.Checksums = append(occurrence.Checksums, Checksum{Algorithm: hash.Alg, Value: hash.Content})
+			}
+		}
+		if component.PURL != "" {
+			locator := component.PURL
+			occurrence.PURL = &locator
+			if purl, err := ParsePURL(component.PURL); err == nil {
+				occurrence.Ecosystem, occurrence.PURLNamespace, occurrence.PURLName, occurrence.PURLVersion = purl.Type, purl.Namespace, purl.Name, purl.Version
+				for key, value := range purl.Qualifiers {
+					occurrence.Qualifiers[key] = value
+				}
+				if occurrence.Version != nil && purl.Version != "" && *occurrence.Version != purl.Version {
+					warn("package_version_mismatch", elementID, "version differs from the purl version; both are kept")
+				}
+			} else {
+				warn("package_purl_invalid", elementID, "purl could not be parsed and is kept verbatim")
+			}
+		} else {
+			warn("package_purl_missing", elementID, "component has no purl")
+		}
+		if declared, ok := cdxLicenses(component.Licenses, elementID, warn); ok {
+			occurrence.LicenseDeclaredRaw = &declared
+		}
+		if len(component.Evidence) > 0 {
+			warn("evidence_not_carried", elementID, "component evidence (license/copyright/occurrences) is retained only in the stored original document")
+		}
+		elements[elementID] = len(result.Components)
+		result.Components = append(result.Components, occurrence)
+		ordinal++
+		for _, child := range component.Components {
+			if depth >= 32 {
+				warn("nesting_depth_exceeded", elementID, "nested components beyond depth 32 were not flattened")
+				break
+			}
+			childBefore := len(result.Components)
+			flatten(child, elementID, depth+1)
+			if len(result.Components) > childBefore {
+				result.Relationships = append(result.Relationships, Relationship{FromElement: elementID, Type: "CONTAINS", ToElement: result.Components[childBefore].ElementID, Resolved: true})
+			}
+		}
+	}
+	if parsed.Metadata.Component != nil {
+		flatten(*parsed.Metadata.Component, "", 0)
+		if len(result.Components) > 0 {
+			result.Components[0].IsRoot = true
+			result.RootElementIDs = append(result.RootElementIDs, result.Components[0].ElementID)
+			result.DocumentName = result.Components[0].Name
+		}
+	}
+	if len(parsed.Components) > limits.MaxComponents {
+		return Normalized{}, fmt.Errorf("%w: %d components exceed the %d limit", ErrTooLarge, len(parsed.Components), limits.MaxComponents)
+	}
+	for _, component := range parsed.Components {
+		flatten(component, "", 0)
+	}
+	if overflow || len(result.Components) > limits.MaxComponents {
+		return Normalized{}, fmt.Errorf("%w: flattened components exceed the %d limit", ErrTooLarge, limits.MaxComponents)
+	}
+	if len(parsed.Dependencies) > limits.MaxRelationships {
+		return Normalized{}, fmt.Errorf("%w: %d dependencies exceed the %d limit", ErrTooLarge, len(parsed.Dependencies), limits.MaxRelationships)
+	}
+	edgeCount := len(result.Relationships)
+	for _, dependency := range parsed.Dependencies {
+		_, fromKnown := elements[dependency.Ref]
+		if !fromKnown {
+			warn("relationship_unresolved", dependency.Ref, "dependencies entry references a bom-ref that is not a component")
+		}
+		for _, target := range dependency.DependsOn {
+			_, toKnown := elements[target]
+			resolved := fromKnown && toKnown
+			if !resolved && fromKnown {
+				warn("relationship_unresolved", dependency.Ref, "dependsOn references a bom-ref that is not a component")
+			}
+			result.Relationships = append(result.Relationships, Relationship{FromElement: dependency.Ref, Type: "DEPENDS_ON", ToElement: target, Resolved: resolved})
+			edgeCount++
+			if edgeCount > limits.MaxRelationships {
+				return Normalized{}, fmt.Errorf("%w: dependency edges exceed the %d limit", ErrTooLarge, limits.MaxRelationships)
+			}
+		}
+		for _, target := range dependency.Provides {
+			_, toKnown := elements[target]
+			result.Relationships = append(result.Relationships, Relationship{FromElement: dependency.Ref, Type: "PROVIDES", ToElement: target, Resolved: fromKnown && toKnown})
+		}
+	}
+	if len(result.RootElementIDs) == 0 {
+		warn("root_missing", "", "metadata.component is absent; dependency scope (direct vs transitive) is unavailable")
+	}
+	if result.Components == nil {
+		result.Components = []Component{}
+	}
+	if result.Relationships == nil {
+		result.Relationships = []Relationship{}
+	}
+	return result, nil
+}
+
+// cdxLicenses renders the licenses array as one raw declaration string with
+// only the semantics the format carries: a single expression or SPDX id is
+// kept as written. CycloneDX defines no conjunction for several license
+// objects, so a list is kept semicolon-separated (which the expression parser
+// reports as invalid) with a warning naming the ambiguity. Names and URLs stay
+// names and URLs.
+func cdxLicenses(choices []cdxLicenseChoice, element string, warn func(code, element, detail string)) (string, bool) {
+	if len(choices) == 0 {
+		return "", false
+	}
+	var parts []string
+	for _, choice := range choices {
+		switch {
+		case choice.Expression != "":
+			parts = append(parts, choice.Expression)
+		case choice.License != nil && choice.License.ID != "":
+			parts = append(parts, choice.License.ID)
+		case choice.License != nil && choice.License.Name != "":
+			name := choice.License.Name
+			if choice.License.URL != "" {
+				name += " (" + choice.License.URL + ")"
+			}
+			parts = append(parts, name)
+			warn("license_name_not_spdx", element, "license is declared by name/url rather than an SPDX id or expression")
+		case choice.License != nil && choice.License.URL != "":
+			parts = append(parts, choice.License.URL)
+			warn("license_url_only", element, "license is declared by URL only")
+		case choice.License != nil && choice.License.Text != nil:
+			parts = append(parts, "LicenseRef-graphnest-inline-text")
+			warn("license_text_inline", element, "license is declared by inline text; the text is retained only in the stored original document")
+		}
+		if (choice.License != nil && choice.License.Acknowledgement != "") || choice.Acknowledgement != "" {
+			acknowledgement := choice.Acknowledgement
+			if acknowledgement == "" {
+				acknowledgement = choice.License.Acknowledgement
+			}
+			warn("license_acknowledgement", element, "license acknowledgement is "+acknowledgement)
+		}
+	}
+	if len(parts) == 0 {
+		return "", false
+	}
+	if len(parts) > 1 {
+		warn("license_list_ambiguous", element, "several license objects have no defined AND/OR meaning in CycloneDX; the list is kept without invented structure")
+		return strings.Join(parts, "; "), true
+	}
+	return parts[0], true
+}
+
+// cdxTool extracts the first tool name/version from either the 1.5+ object
+// form or the legacy array form.
+func cdxTool(raw json.RawMessage) string {
+	if len(raw) == 0 {
+		return ""
+	}
+	var object struct {
+		Components []struct {
+			Name    string `json:"name"`
+			Version string `json:"version"`
+		} `json:"components"`
+	}
+	if err := json.Unmarshal(raw, &object); err == nil && len(object.Components) > 0 {
+		return strings.TrimSpace(object.Components[0].Name + " " + object.Components[0].Version)
+	}
+	var legacy []struct {
+		Vendor  string `json:"vendor"`
+		Name    string `json:"name"`
+		Version string `json:"version"`
+	}
+	if err := json.Unmarshal(raw, &legacy); err == nil && len(legacy) > 0 {
+		return strings.TrimSpace(strings.TrimSpace(legacy[0].Vendor+" "+legacy[0].Name) + " " + legacy[0].Version)
+	}
+	return ""
+}
diff --git a/internal/supplychain/cyclonedx_test.go b/internal/supplychain/cyclonedx_test.go
new file mode 100644
index 00000000..0826b903
--- /dev/null
+++ b/internal/supplychain/cyclonedx_test.go
@@ -0,0 +1,142 @@
+package supplychain
+
+import (
+	"errors"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+func cdxFixture(t *testing.T) []byte {
+	t.Helper()
+	data, err := os.ReadFile("../../test/fixtures/supplychain/syft-cyclonedx-1.6.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func TestNormalizeCycloneDX16PreservesWhatTheFormatCarries(t *testing.T) {
+	got, err := NormalizeCycloneDX16(cdxFixture(t), Limits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.SPDXVersion != "CycloneDX-1.6" || got.ProducerTool != "syft 1.20.0" || got.DocumentNamespace != "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79#1" || got.DocumentName != "registry.example.internal/acme/widgets" {
+		t.Fatalf("header = %+v", got)
+	}
+	if got.CreatedAtClaimed == nil || !got.CreatedAtClaimed.Equal(time.Date(2026, 9, 21, 14, 3, 11, 0, time.UTC)) {
+		t.Fatalf("created = %v", got.CreatedAtClaimed)
+	}
+	// root + 6 top-level + 1 nested = 8 occurrences; the file component without bom-ref survives with a synthetic ID.
+	if len(got.Components) != 8 || !got.Components[0].IsRoot || got.RootElementIDs[0] != "graphnest-fixture-root" || got.Components[0].Qualifiers["cdx:type"] != "container" {
+		t.Fatalf("components = %d roots=%v", len(got.Components), got.RootElementIDs)
+	}
+	byElement := map[string]Component{}
+	for _, component := range got.Components {
+		byElement[component.ElementID] = component
+	}
+	leftPad := byElement["pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c"]
+	if leftPad.Ecosystem != "npm" || leftPad.PURLNamespace != "@scope" || leftPad.PURLName != "left-pad" || *leftPad.LicenseDeclaredRaw != "MIT" || len(leftPad.Checksums) != 1 || leftPad.Checksums[0].Algorithm != "SHA-512" || leftPad.Name != "@scope/left-pad" {
+		t.Fatalf("left-pad = %+v", leftPad)
+	}
+	if *byElement["pkg:npm/dual@2.0.0?package-id=2b3c4d"].LicenseDeclaredRaw != "(MIT OR Apache-2.0)" {
+		t.Fatalf("expression must be kept verbatim: %+v", byElement["pkg:npm/dual@2.0.0?package-id=2b3c4d"])
+	}
+	libssl := byElement["pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12&package-id=3c4d5e"]
+	if *libssl.LicenseDeclaredRaw != "OpenSSL; Apache-2.0" || libssl.Qualifiers["arch"] != "amd64" || libssl.Qualifiers["distro"] != "debian-12" || libssl.Supplier == nil {
+		t.Fatalf("libssl = %+v", libssl)
+	}
+	nested := byElement["pkg:npm/nested-helper@0.1.0?package-id=5e6f7a"]
+	if *nested.LicenseDeclaredRaw != "Custom Acme License (https://acme.example.internal/license)" {
+		t.Fatalf("nested = %+v", nested)
+	}
+	var synthetic *Component
+	for _, component := range got.Components {
+		if strings.HasPrefix(component.ElementID, "graphnest-bomref-missing-") {
+			synthetic = &component
+		}
+	}
+	if synthetic == nil || synthetic.PURL != nil || synthetic.Name != "/app/config/settings.yaml" || synthetic.Qualifiers["cdx:type"] != "file" {
+		t.Fatalf("bom-ref-less component = %+v", synthetic)
+	}
+	// Edges: 1 CONTAINS (bundle -> nested), 4 + 1 + 2 DEPENDS_ON = 8 total; the missing target is unresolved.
+	edges := map[string]int{}
+	unresolved := 0
+	for _, edge := range got.Relationships {
+		edges[edge.Type]++
+		if !edge.Resolved {
+			unresolved++
+		}
+	}
+	if edges["CONTAINS"] != 1 || edges["DEPENDS_ON"] != 7 || unresolved != 1 {
+		t.Fatalf("edges = %v unresolved=%d", edges, unresolved)
+	}
+	codes := warningCodes(got.Warnings)
+	if codes["license_list_ambiguous"] != 1 || codes["license_name_not_spdx"] != 2 || codes["evidence_not_carried"] != 1 || codes["relationship_unresolved"] != 1 || codes["package_id_missing"] != 1 || codes["license_acknowledgement"] != 1 || codes["package_purl_missing"] != 3 {
+		t.Fatalf("warnings = %v", codes)
+	}
+}
+
+func TestNormalizeCycloneDX16Rejects(t *testing.T) {
+	cases := map[string]struct {
+		document string
+		limits   Limits
+		want     error
+	}{
+		"not json":        {document: `{"bomFormat"`, want: ErrMalformed},
+		"wrong format":    {document: `{"bomFormat":"SPDX","specVersion":"1.6"}`, want: ErrMalformed},
+		"old version":     {document: `{"bomFormat":"CycloneDX","specVersion":"1.4"}`, want: ErrUnsupportedVersion},
+		"missing version": {document: `{"bomFormat":"CycloneDX"}`, want: ErrMalformed},
+		"trailing":        {document: `{"bomFormat":"CycloneDX","specVersion":"1.6"} x`, want: ErrMalformed},
+		"too many":        {document: `{"bomFormat":"CycloneDX","specVersion":"1.6","components":[{"type":"library","name":"a"},{"type":"library","name":"b"}]}`, limits: Limits{MaxComponents: 1}, want: ErrTooLarge},
+		"nested too many": {document: `{"bomFormat":"CycloneDX","specVersion":"1.6","components":[{"type":"library","name":"a","components":[{"type":"library","name":"b"},{"type":"library","name":"c"}]}]}`, limits: Limits{MaxComponents: 2}, want: ErrTooLarge},
+	}
+	for name, test := range cases {
+		t.Run(name, func(t *testing.T) {
+			_, err := NormalizeCycloneDX16([]byte(test.document), test.limits)
+			if !errors.Is(err, test.want) {
+				t.Fatalf("error = %v, want %v", err, test.want)
+			}
+		})
+	}
+}
+
+func TestNormalizeCycloneDX16EmptyAndLegacyTools(t *testing.T) {
+	got, err := NormalizeCycloneDX16([]byte(`{"bomFormat":"CycloneDX","specVersion":"1.6","metadata":{"timestamp":"2026-01-01T00:00:00Z","tools":[{"vendor":"OSS Review Toolkit","name":"ort","version":"45.0.0"}]},"components":[],"dependencies":[]}`), Limits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ProducerTool != "OSS Review Toolkit ort 45.0.0" || len(got.Components) != 0 || len(got.Relationships) != 0 || warningCodes(got.Warnings)["root_missing"] != 1 {
+		t.Fatalf("legacy tools = %+v", got)
+	}
+}
+
+func FuzzNormalizeCycloneDX16(f *testing.F) {
+	f.Add(string(mustRead(f, "../../test/fixtures/supplychain/syft-cyclonedx-1.6.json")))
+	f.Add(`{"bomFormat":"CycloneDX","specVersion":"1.6"}`)
+	f.Fuzz(func(t *testing.T, document string) {
+		got, err := NormalizeCycloneDX16([]byte(document), Limits{MaxComponents: 200, MaxRelationships: 2000})
+		if err != nil {
+			return
+		}
+		if len(got.Components) > 200 {
+			t.Fatalf("components exceeded the limit: %d", len(got.Components))
+		}
+		seen := map[string]bool{}
+		for _, component := range got.Components {
+			if seen[component.ElementID] {
+				t.Fatalf("duplicate element id %q", component.ElementID)
+			}
+			seen[component.ElementID] = true
+		}
+	})
+}
+
+func mustRead(f *testing.F, path string) []byte {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		f.Fatal(err)
+	}
+	return data
+}
diff --git a/internal/supplychain/importer.go b/internal/supplychain/importer.go
new file mode 100644
index 00000000..3697a65b
--- /dev/null
+++ b/internal/supplychain/importer.go
@@ -0,0 +1,246 @@
+package supplychain
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/authn"
+	"github.com/balcsida/graphnest/pkg/api"
+	"github.com/jackc/pgx/v5"
+)
+
+var (
+	ErrUnsupportedFormat = errors.New("unsupported_format")
+	ErrQuotaExceeded     = errors.New("quota_exceeded")
+	ErrImportTooLarge    = errors.New("import_too_large")
+)
+
+// ImportStore is the persistence the importer needs beyond Store.
+type ImportStore interface {
+	SupplyChainUploadAllowed(ctx context.Context, repositoryID int64, subject string) (bool, error)
+	SupplyChainImportCount(ctx context.Context, repositoryID int64, since time.Time) (int, error)
+	SupplyChainImportByDigest(ctx context.Context, repositoryID int64, streamKey string, digest []byte) (ImportRecord, bool, error)
+	RecordSupplyChainImport(ctx context.Context, record ImportRecord) (int64, error)
+	PublishSupplyChainSnapshot(ctx context.Context, publication Publication) (Collection, error)
+	ProjectSupplyChainPackages(ctx context.Context, repositoryID, snapshotID int64) (int, error)
+}
+
+// ImportRecord is one upload attempt.
+type ImportRecord struct {
+	ID             int64
+	RepositoryID   int64
+	StreamKey      string
+	DocumentSHA256 []byte
+	Format         Format
+	UploadedBy     string
+	UploadLabel    string
+	ByteSize       int64
+	Outcome        string
+	SnapshotID     *int64
+	ErrorCode      string
+	Message        string
+	CreatedAt      time.Time
+}
+
+// ImportRequest is an authenticated upload of an SBOM produced elsewhere.
+type ImportRequest struct {
+	RepositoryID int64 // GitHub ID
+	// Subject is "source" or "artifact"; Label distinguishes streams of the
+	// same subject (e.g. "ort", "syft-image"). Stream key: import:<subject>:<label>.
+	Subject Subject
+	Label   string
+	// SubjectRevision is the uploader's claim of the source commit the document
+	// describes. It is recorded as producer_asserted, never verified.
+	SubjectRevision string
+	ContentType     string
+	Document        []byte
+}
+
+// Importer accepts SPDX 2.3 JSON and CycloneDX 1.6 JSON uploads into
+// import streams. Documents are preserved byte-for-byte; publication reuses
+// the same atomic path as GitHub collection.
+type Importer struct {
+	Store            ImportStore
+	Authorizer       Authorizer
+	Enricher         Enricher
+	MaxDocumentBytes int64
+	Limits           Limits
+	// QuotaPerRepository bounds imports per repository per QuotaWindow.
+	QuotaPerRepository int
+	QuotaWindow        time.Duration
+	Now                func() time.Time
+}
+
+var labelPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,63}$`)
+var shaPattern = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
+func (importer *Importer) now() time.Time {
+	if importer.Now != nil {
+		return importer.Now().UTC()
+	}
+	return time.Now().UTC()
+}
+
+// ImportStreamKey builds the stream key for an import subject and label.
+func ImportStreamKey(subject Subject, label string) string {
+	return "import:" + string(subject) + ":" + label
+}
+
+// Import validates, authorizes, deduplicates, normalizes, and publishes.
+func (importer *Importer) Import(ctx context.Context, principal authn.Principal, request ImportRequest) (api.SupplyChainImportResponse, error) {
+	if request.RepositoryID < 1 || (request.Subject != SubjectSource && request.Subject != SubjectArtifact) || !labelPattern.MatchString(request.Label) {
+		return api.SupplyChainImportResponse{}, ErrInvalidRequest
+	}
+	if request.SubjectRevision != "" && !shaPattern.MatchString(request.SubjectRevision) {
+		return api.SupplyChainImportResponse{}, ErrInvalidRequest
+	}
+	maxBytes := importer.MaxDocumentBytes
+	if maxBytes <= 0 {
+		maxBytes = 16 << 20
+	}
+	if int64(len(request.Document)) > maxBytes {
+		return api.SupplyChainImportResponse{}, ErrImportTooLarge
+	}
+	if len(request.Document) == 0 {
+		return api.SupplyChainImportResponse{}, ErrInvalidRequest
+	}
+	repo, err := importer.Authorizer.AuthorizedRepository(ctx, principal, request.RepositoryID)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return api.SupplyChainImportResponse{}, ErrNotFound
+	}
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	if !principal.Administrator {
+		allowed, err := importer.Store.SupplyChainUploadAllowed(ctx, repo.ID, principal.Subject)
+		if err != nil {
+			return api.SupplyChainImportResponse{}, err
+		}
+		if !allowed {
+			return api.SupplyChainImportResponse{}, ErrForbidden
+		}
+	}
+	streamKey := ImportStreamKey(request.Subject, request.Label)
+	digest := sha256.Sum256(request.Document)
+	// Idempotency: the same bytes into the same stream return the earlier result.
+	if previous, ok, err := importer.Store.SupplyChainImportByDigest(ctx, repo.ID, streamKey, digest[:]); err != nil {
+		return api.SupplyChainImportResponse{}, err
+	} else if ok && previous.Outcome != "rejected" {
+		return api.SupplyChainImportResponse{ImportID: previous.ID, Outcome: "unchanged", SnapshotID: previous.SnapshotID, Stream: streamKey, Repeated: true, Format: string(previous.Format)}, nil
+	}
+	window := importer.QuotaWindow
+	if window <= 0 {
+		window = 24 * time.Hour
+	}
+	quota := importer.QuotaPerRepository
+	if quota <= 0 {
+		quota = 100
+	}
+	count, err := importer.Store.SupplyChainImportCount(ctx, repo.ID, importer.now().Add(-window))
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	if count >= quota {
+		return api.SupplyChainImportResponse{}, ErrQuotaExceeded
+	}
+	record := ImportRecord{RepositoryID: repo.ID, StreamKey: streamKey, DocumentSHA256: digest[:], UploadedBy: principal.Subject, UploadLabel: request.Label, ByteSize: int64(len(request.Document)), CreatedAt: importer.now()}
+	format, normalized, err := importer.normalize(request.ContentType, request.Document)
+	record.Format = format
+	if err != nil {
+		record.Outcome = "rejected"
+		record.ErrorCode, record.Message = importErrorCode(err), sanitize(err.Error(), 200)
+		if record.Format == "" {
+			record.Format = FormatSPDX23JSON
+		}
+		if _, recordErr := importer.Store.RecordSupplyChainImport(ctx, record); recordErr != nil {
+			return api.SupplyChainImportResponse{}, recordErr
+		}
+		return api.SupplyChainImportResponse{}, err
+	}
+	assurance := AssuranceUnknown
+	if request.SubjectRevision != "" {
+		assurance = AssuranceProducerAsserted
+	}
+	mediaType := request.ContentType
+	if mediaType == "" {
+		mediaType = "application/json"
+	}
+	collection, err := importer.Store.PublishSupplyChainSnapshot(ctx, Publication{
+		RepositoryID: repo.ID, Producer: ProducerImport, Subject: request.Subject, StreamKey: streamKey, Format: format, MediaType: mediaType, Document: request.Document, Normalized: normalized,
+		CollectedAt: importer.now(), StartedAt: importer.now(), SubjectRevision: request.SubjectRevision, SubjectAssurance: assurance, UploadedBy: principal.Subject, UploadLabel: request.Label,
+	})
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	record.Outcome, record.SnapshotID = string(collection.Outcome), collection.SnapshotID
+	importID, err := importer.Store.RecordSupplyChainImport(ctx, record)
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	response := api.SupplyChainImportResponse{ImportID: importID, Outcome: string(collection.Outcome), SnapshotID: collection.SnapshotID, Stream: streamKey, Format: string(format),
+		ComponentCount: len(normalized.Components), EdgeCount: len(normalized.Relationships), WarningCount: normalized.WarningCount, Warnings: make([]api.SupplyChainWarning, 0, len(normalized.Warnings)),
+		SubjectAssurance: string(assurance), Notes: []string{}}
+	for _, warning := range normalized.Warnings {
+		response.Warnings = append(response.Warnings, api.SupplyChainWarning{Code: warning.Code, Element: warning.Element, Detail: warning.Detail})
+	}
+	if request.SubjectRevision != "" {
+		response.Notes = append(response.Notes, "The subject revision is the uploader's assertion (producer_asserted); GraphNest did not verify it.")
+	}
+	if collection.Outcome == OutcomePublished && collection.SnapshotID != nil && importer.Enricher != nil {
+		if _, err := importer.Enricher.EnqueueSnapshot(ctx, *collection.SnapshotID); err != nil {
+			response.Notes = append(response.Notes, "License enrichment could not be queued; the next publication will retry.")
+		}
+	}
+	return response, nil
+}
+
+// normalize detects the format from content (never from the producer's
+// self-description alone) and normalizes it.
+func (importer *Importer) normalize(contentType string, document []byte) (Format, Normalized, error) {
+	var probe struct {
+		BOMFormat   string `json:"bomFormat"`
+		SpecVersion string `json:"spdxVersion"`
+	}
+	trimmed := bytes.TrimSpace(document)
+	if len(trimmed) == 0 || trimmed[0] != '{' {
+		return "", Normalized{}, ErrMalformed
+	}
+	if err := json.Unmarshal(trimmed, &probe); err != nil {
+		return "", Normalized{}, errors.Join(ErrMalformed, errors.New(safeJSONError(err)))
+	}
+	switch {
+	case probe.BOMFormat == "CycloneDX":
+		if strings.Contains(contentType, "spdx") {
+			return FormatCycloneDX16JSON, Normalized{}, errors.Join(ErrUnsupportedFormat, errors.New("content type says SPDX but the document is CycloneDX"))
+		}
+		normalized, err := NormalizeCycloneDX16(document, importer.Limits)
+		return FormatCycloneDX16JSON, normalized, err
+	case probe.SpecVersion != "":
+		if strings.Contains(contentType, "cyclonedx") {
+			return FormatSPDX23JSON, Normalized{}, errors.Join(ErrUnsupportedFormat, errors.New("content type says CycloneDX but the document is SPDX"))
+		}
+		normalized, err := NormalizeSPDX23(document, importer.Limits)
+		return FormatSPDX23JSON, normalized, err
+	default:
+		return "", Normalized{}, errors.Join(ErrUnsupportedFormat, errors.New("document is neither SPDX 2.3 JSON (spdxVersion) nor CycloneDX 1.6 JSON (bomFormat)"))
+	}
+}
+
+func importErrorCode(err error) string {
+	switch {
+	case errors.Is(err, ErrUnsupportedFormat):
+		return "unsupported_format"
+	case errors.Is(err, ErrUnsupportedVersion):
+		return "unsupported_version"
+	case errors.Is(err, ErrTooLarge):
+		return "too_large"
+	default:
+		return "malformed"
+	}
+}
diff --git a/internal/supplychain/license/evidence.go b/internal/supplychain/license/evidence.go
index 2324c454..2811da71 100644
--- a/internal/supplychain/license/evidence.go
+++ b/internal/supplychain/license/evidence.go
@@ -215,3 +215,21 @@ func ListVersion() string { return spdxexpr.ListVersion }
 var Now = time.Now
 
 func now() time.Time { return Now().UTC() }
+
+// ParseForExport returns the canonical SPDX rendering of a raw value that a
+// derived SPDX document may carry in licenseDeclared: a parsed expression
+// (known or LicenseRef terms), or the NOASSERTION/NONE sentinels. Anything
+// else (unknown identifiers, free text, UNLICENSED, files, URLs) returns ""
+// so callers describe it in comments instead of asserting it.
+func ParseForExport(raw string) string {
+	parsed := spdxexpr.Parse(raw)
+	switch parsed.Status {
+	case spdxexpr.StatusParsed:
+		return parsed.Normalized
+	case spdxexpr.StatusNoAssertion:
+		return "NOASSERTION"
+	case spdxexpr.StatusNone:
+		return "NONE"
+	}
+	return ""
+}
diff --git a/internal/supplychain/model.go b/internal/supplychain/model.go
index f97f176d..6df471af 100644
--- a/internal/supplychain/model.go
+++ b/internal/supplychain/model.go
@@ -74,6 +74,10 @@ type Publication struct {
 	HTTPStatus       *int
 	SubjectRevision  string
 	SubjectAssurance Assurance
+	// UploadedBy and UploadLabel identify an import's uploader separately
+	// from the document's claimed producer.
+	UploadedBy  string
+	UploadLabel string
 }
 
 // Failure records an attempt that produced no new snapshot.
@@ -118,6 +122,8 @@ type Snapshot struct {
 	DocumentSHA256               []byte
 	DocumentFormat               Format
 	DocumentBytes                int64
+	UploadedBy                   string
+	UploadLabel                  string
 }
 
 // Component is one occurrence in one snapshot. Identity is document-scoped:
diff --git a/internal/supplychain/service.go b/internal/supplychain/service.go
index 3f8b8ec8..e50dcdd3 100644
--- a/internal/supplychain/service.go
+++ b/internal/supplychain/service.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -126,10 +127,24 @@ func (service *Service) AuthorizedRepositoryIDs(ctx context.Context, principal a
 	return ids, nil
 }
 
-// ValidStream reports whether a stream selector is one the service serves.
-// Milestone 1 serves the GitHub source stream only.
+var importStreamPattern = regexp.MustCompile(`^import:(source|artifact):[a-z0-9][a-z0-9._-]{0,63}$`)
+
+// ValidStream reports whether a stream selector is one the service serves:
+// the GitHub source stream or an import stream (import:<subject>:<label>).
 func ValidStream(stream string) bool {
-	return stream == "" || stream == StreamGitHubSource
+	return stream == "" || stream == StreamGitHubSource || importStreamPattern.MatchString(stream)
+}
+
+// StreamProducer returns the producer and subject encoded in a stream key.
+func StreamProducer(stream string) (Producer, Subject) {
+	if stream == StreamGitHubSource {
+		return ProducerGitHub, SubjectSource
+	}
+	parts := strings.SplitN(stream, ":", 3)
+	if len(parts) == 3 && parts[0] == "import" {
+		return ProducerImport, Subject(parts[1])
+	}
+	return "", ""
 }
 
 func normalizeStream(stream string) (string, error) {
@@ -151,8 +166,20 @@ func (service *Service) Status(ctx context.Context, principal authn.Principal, g
 	if err != nil {
 		return api.SupplyChainRepositoryStatus{}, err
 	}
-	status := api.SupplyChainRepositoryStatus{RepositoryID: repo.GitHubID, Repository: repo.Name, Stream: streamKey, Producer: string(ProducerGitHub), Subject: string(SubjectSource),
-		Collection: "never", Enrichment: "not_configured", EnrichmentEcosystems: []string{}, LicenseSummary: map[string]int{}, Notes: []string{}, Documents: []api.SupplyChainDocumentRef{}}
+	producer, subject := StreamProducer(streamKey)
+	status := api.SupplyChainRepositoryStatus{RepositoryID: repo.GitHubID, Repository: repo.Name, Stream: streamKey, Producer: string(producer), Subject: string(subject),
+		Collection: "never", Enrichment: "not_configured", EnrichmentEcosystems: []string{}, LicenseSummary: map[string]int{}, Notes: []string{}, Documents: []api.SupplyChainDocumentRef{}, Streams: []api.SupplyChainStreamRef{}}
+	if streams, ok := service.Store.(interface {
+		SupplyChainStreams(context.Context, int64) ([]Stream, error)
+	}); ok {
+		known, err := streams.SupplyChainStreams(ctx, repo.ID)
+		if err != nil {
+			return api.SupplyChainRepositoryStatus{}, err
+		}
+		for _, stream := range known {
+			status.Streams = append(status.Streams, api.SupplyChainStreamRef{Key: stream.StreamKey, Producer: string(stream.Producer), Subject: string(stream.Subject), HasInventory: stream.LatestSnapshotID != nil, LastOutcome: string(stream.LastOutcome)})
+		}
+	}
 	if len(service.EnrichmentEcosystems) > 0 {
 		status.Enrichment = "configured"
 		status.EnrichmentEcosystems = append(status.EnrichmentEcosystems, service.EnrichmentEcosystems...)
@@ -203,8 +230,13 @@ func (service *Service) Status(ctx context.Context, principal authn.Principal, g
 			}
 		}
 	}
-	if status.LatestSnapshot != nil {
+	if status.LatestSnapshot != nil && producer == ProducerGitHub {
 		status.Notes = append(status.Notes, "GitHub dependency-graph exports are timestamped observations of the default branch; they are not bound to a commit and carry no license data.")
+	}
+	if status.LatestSnapshot != nil && producer == ProducerImport {
+		status.Notes = append(status.Notes, "This inventory was uploaded by "+status.LatestSnapshot.UploadedBy+"; the producer named inside the document is its own claim. Subject binding: "+status.LatestSnapshot.SubjectAssurance+".")
+	}
+	if status.LatestSnapshot != nil {
 		if status.LatestSnapshot.WarningCount > 0 {
 			status.Notes = append(status.Notes, fmt.Sprintf("Normalization reported %d coverage warning(s).", status.LatestSnapshot.WarningCount))
 		}
@@ -595,6 +627,7 @@ func (service *Service) Refresh(ctx context.Context, principal authn.Principal,
 		return api.SupplyChainRefreshResponse{}, err
 	}
 	if streamKey != StreamGitHubSource {
+		// Import streams are refreshed by uploading a new document, not by collection.
 		return api.SupplyChainRefreshResponse{}, ErrInvalidRequest
 	}
 	repo, err := service.authorizedRepository(ctx, principal, githubID)
@@ -648,6 +681,7 @@ func snapshotSummary(snapshot Snapshot) api.SupplyChainSnapshot {
 		SubjectAssurance: string(snapshot.SubjectAssurance), RootElementIDs: roots, ParserVersion: snapshot.ParserVersion, ComponentCount: snapshot.ComponentCount,
 		EdgeCount: snapshot.EdgeCount, WarningCount: snapshot.WarningCount, Warnings: warnings, PublishedAt: snapshot.PublishedAt,
 		DocumentSHA256: hex.EncodeToString(snapshot.DocumentSHA256), DocumentFormat: string(snapshot.DocumentFormat), DocumentBytes: snapshot.DocumentBytes,
+		UploadedBy: snapshot.UploadedBy, UploadLabel: snapshot.UploadLabel,
 	}
 }
 
diff --git a/internal/supplychain/spdx_test.go b/internal/supplychain/spdx_test.go
index 2c4797d4..ec1f0051 100644
--- a/internal/supplychain/spdx_test.go
+++ b/internal/supplychain/spdx_test.go
@@ -198,3 +198,28 @@ func TestParsePURL(t *testing.T) {
 		}
 	}
 }
+
+func FuzzNormalizeSPDX23(f *testing.F) {
+	data, err := os.ReadFile("../../test/fixtures/supplychain/ghes-spdx-2.3.json")
+	if err != nil {
+		f.Fatal(err)
+	}
+	f.Add(string(data))
+	f.Add(`{"spdxVersion":"SPDX-2.3","packages":[]}`)
+	f.Fuzz(func(t *testing.T, document string) {
+		got, err := NormalizeSPDX23([]byte(document), Limits{MaxComponents: 200, MaxRelationships: 2000, MaxWarnings: 50})
+		if err != nil {
+			return
+		}
+		if len(got.Components) > 200 || len(got.Warnings) > 50 {
+			t.Fatalf("limits exceeded: %d components, %d warnings", len(got.Components), len(got.Warnings))
+		}
+		seen := map[string]bool{}
+		for _, component := range got.Components {
+			if seen[component.ElementID] {
+				t.Fatalf("duplicate element id %q", component.ElementID)
+			}
+			seen[component.ElementID] = true
+		}
+	})
+}
diff --git a/internal/supplychain/spdxexport.go b/internal/supplychain/spdxexport.go
new file mode 100644
index 00000000..a3ab7c1f
--- /dev/null
+++ b/internal/supplychain/spdxexport.go
@@ -0,0 +1,258 @@
+package supplychain
+
+import (
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/authn"
+	"github.com/balcsida/graphnest/internal/supplychain/license"
+	"github.com/jackc/pgx/v5"
+)
+
+// DerivedSPDXVersion identifies the GraphNest-produced document shape.
+const DerivedSPDXVersion = "SPDX-2.3"
+
+var spdxIDUnsafe = regexp.MustCompile(`[^A-Za-z0-9.-]`)
+
+// ExportSPDX writes a derived SPDX 2.3 JSON document for one authorized
+// snapshot with GraphNest as the creator. It never mutates or re-serves the
+// original: the original stays downloadable as-is, and this document names
+// it (snapshot ID, SHA-256, producer, collected time) as an external
+// reference so the two are never confused. Assessments are emitted as
+// licenseComments, not as licenseConcluded: GraphNest concludes nothing on a
+// publisher's behalf, and review decisions live outside this document.
+func (service *Service) ExportSPDX(ctx context.Context, principal authn.Principal, githubID int64, streamKey string, snapshotID int64, publicOrigin string) ([]byte, Snapshot, error) {
+	streamKey, err := normalizeStream(streamKey)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	repo, err := service.authorizedRepository(ctx, principal, githubID)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	if snapshotID == 0 {
+		stream, err := service.Store.SupplyChainStream(ctx, repo.ID, streamKey)
+		if errors.Is(err, pgx.ErrNoRows) || err == nil && stream.LatestSnapshotID == nil {
+			return nil, Snapshot{}, ErrNoInventory
+		}
+		if err != nil {
+			return nil, Snapshot{}, err
+		}
+		snapshotID = *stream.LatestSnapshotID
+	}
+	snapshot, err := service.Store.SupplyChainSnapshot(ctx, snapshotID, []int64{repo.ID})
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, Snapshot{}, ErrNotFound
+	}
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	components, err := service.Store.SupplyChainComponents(ctx, snapshot.ID, -1, DefaultMaxComponents*2, "")
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	edges, err := service.Store.SupplyChainRelationships(ctx, snapshot.ID, "", snapshot.EdgeCount+1)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	assessments, err := service.assessments(ctx, snapshot.ID, components)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	now := service.now()
+	digest := hex.EncodeToString(snapshot.DocumentSHA256)
+	namespace := strings.TrimSuffix(publicOrigin, "/") + "/spdxdocs/graphnest/repository/" + strconv.FormatInt(repo.GitHubID, 10) + "/snapshot/" + strconv.FormatInt(snapshot.ID, 10) + "-" + digest[:16]
+	type spdxPackage struct {
+		SPDXID           string `json:"SPDXID"`
+		Name             string `json:"name"`
+		VersionInfo      string `json:"versionInfo,omitempty"`
+		DownloadLocation string `json:"downloadLocation"`
+		FilesAnalyzed    bool   `json:"filesAnalyzed"`
+		Supplier         string `json:"supplier,omitempty"`
+		LicenseConcluded string `json:"licenseConcluded"`
+		LicenseDeclared  string `json:"licenseDeclared"`
+		LicenseComments  string `json:"licenseComments,omitempty"`
+		Checksums        []struct {
+			Algorithm string `json:"algorithm"`
+			Value     string `json:"checksumValue"`
+		} `json:"checksums,omitempty"`
+		ExternalRefs []struct {
+			Category string `json:"referenceCategory"`
+			Type     string `json:"referenceType"`
+			Locator  string `json:"referenceLocator"`
+		} `json:"externalRefs,omitempty"`
+	}
+	type spdxRelationship struct {
+		SPDXElementID      string `json:"spdxElementId"`
+		Type               string `json:"relationshipType"`
+		RelatedSPDXElement string `json:"relatedSpdxElement"`
+	}
+	ids := map[string]string{}
+	used := map[string]bool{"SPDXRef-DOCUMENT": true}
+	spdxID := func(element string) string {
+		if id, ok := ids[element]; ok {
+			return id
+		}
+		candidate := "SPDXRef-" + spdxIDUnsafe.ReplaceAllString(element, "-")
+		if strings.HasPrefix(element, "SPDXRef-") {
+			candidate = spdxIDUnsafe.ReplaceAllString(element, "-")
+		}
+		base := candidate
+		for index := 2; used[candidate]; index++ {
+			candidate = base + "-" + strconv.Itoa(index)
+		}
+		used[candidate] = true
+		ids[element] = candidate
+		return candidate
+	}
+	packages := make([]spdxPackage, 0, len(components))
+	var describes []string
+	for _, component := range components {
+		pkg := spdxPackage{SPDXID: spdxID(component.ElementID), Name: component.Name, DownloadLocation: "NOASSERTION", LicenseConcluded: "NOASSERTION", LicenseDeclared: "NOASSERTION"}
+		if component.Version != nil {
+			pkg.VersionInfo = *component.Version
+		}
+		if component.DownloadLocation != nil && *component.DownloadLocation != "" {
+			pkg.DownloadLocation = *component.DownloadLocation
+		}
+		if component.Supplier != nil && *component.Supplier != "" {
+			pkg.Supplier = *component.Supplier
+		}
+		// Only a value that is a valid SPDX expression (or the sentinels) may
+		// stand in licenseDeclared; anything else is described in comments.
+		var comments []string
+		if component.LicenseDeclaredRaw != nil {
+			parsed := license.ParseForExport(*component.LicenseDeclaredRaw)
+			if parsed != "" {
+				pkg.LicenseDeclared = parsed
+			} else {
+				comments = append(comments, "producer declared (not an SPDX expression): "+sanitize(*component.LicenseDeclaredRaw, 300))
+			}
+		}
+		if component.LicenseConcludedRaw != nil {
+			if parsed := license.ParseForExport(*component.LicenseConcludedRaw); parsed != "" && parsed != "NOASSERTION" {
+				comments = append(comments, "producer concluded: "+parsed)
+			}
+		}
+		if assessment, ok := assessments[component.ID]; ok && assessment.Status != "" {
+			line := "GraphNest assessment: " + string(assessment.Status)
+			if assessment.NormalizedExpression != "" {
+				line += " (" + assessment.NormalizedExpression + ")"
+			}
+			if assessment.ConflictDetail != "" {
+				line += "; conflict: " + sanitize(assessment.ConflictDetail, 300)
+			}
+			line += "; evidence fingerprint " + hex.EncodeToString(assessment.EvidenceFingerprint)[:16] + "; evidence is not approval"
+			comments = append(comments, line)
+		}
+		pkg.LicenseComments = strings.Join(comments, " | ")
+		for _, checksum := range component.Checksums {
+			if algorithm := spdxChecksumAlgorithm(checksum.Algorithm); algorithm != "" {
+				pkg.Checksums = append(pkg.Checksums, struct {
+					Algorithm string `json:"algorithm"`
+					Value     string `json:"checksumValue"`
+				}{algorithm, strings.ToLower(checksum.Value)})
+			}
+		}
+		if component.PURL != nil {
+			pkg.ExternalRefs = append(pkg.ExternalRefs, struct {
+				Category string `json:"referenceCategory"`
+				Type     string `json:"referenceType"`
+				Locator  string `json:"referenceLocator"`
+			}{"PACKAGE-MANAGER", "purl", *component.PURL})
+		}
+		if component.IsRoot {
+			describes = append(describes, pkg.SPDXID)
+		}
+		packages = append(packages, pkg)
+	}
+	relationships := []spdxRelationship{}
+	for _, root := range describes {
+		relationships = append(relationships, spdxRelationship{"SPDXRef-DOCUMENT", "DESCRIBES", root})
+	}
+	for _, edge := range edges {
+		if !edge.Resolved || edge.Type == "DESCRIBES" || edge.Type == "DESCRIBED_BY" {
+			continue
+		}
+		relationships = append(relationships, spdxRelationship{spdxID(edge.FromElement), edge.Type, spdxID(edge.ToElement)})
+	}
+	document := map[string]any{
+		"spdxVersion":       DerivedSPDXVersion,
+		"dataLicense":       "CC0-1.0",
+		"SPDXID":            "SPDXRef-DOCUMENT",
+		"name":              "graphnest-derived-inventory-" + strconv.FormatInt(repo.GitHubID, 10) + "-" + strconv.FormatInt(snapshot.ID, 10),
+		"documentNamespace": namespace,
+		"creationInfo": map[string]any{
+			"created":  now.Format(time.RFC3339),
+			"creators": []string{"Tool: GraphNest-supply-chain-" + strconv.Itoa(ParserVersion), "Organization: GraphNest deployment"},
+			"comment": fmt.Sprintf("Derived by GraphNest from snapshot %d of repository %s (%s stream, producer %s, tool %q, collected %s, subject assurance %s). "+
+				"The original document (%s, sha256 %s, %d bytes) is preserved unchanged and is the authoritative source; this document adds GraphNest normalization and license assessments as comments only. Review decisions are not part of this document.",
+				snapshot.ID, repo.Name, snapshot.StreamKey, snapshot.Producer, snapshot.ProducerTool, snapshot.CollectedAt.Format(time.RFC3339), snapshot.SubjectAssurance,
+				snapshot.DocumentFormat, digest, snapshot.DocumentBytes),
+		},
+		"externalDocumentRefs": []map[string]any{{
+			"externalDocumentId": "DocumentRef-graphnest-original-snapshot-" + strconv.FormatInt(snapshot.ID, 10),
+			"spdxDocument":       strings.TrimSuffix(publicOrigin, "/") + "/v1/supply-chain/snapshots/" + strconv.FormatInt(snapshot.ID, 10) + "/document",
+			"checksum":           map[string]string{"algorithm": "SHA256", "checksumValue": digest},
+		}},
+		"documentDescribes": nonNilStrings(describes),
+		"packages":          packages,
+		"relationships":     relationships,
+	}
+	if snapshot.SubjectRevision != "" {
+		document["comment"] = "Subject revision " + snapshot.SubjectRevision + " is " + string(snapshot.SubjectAssurance) + "; GraphNest did not independently verify it."
+	}
+	data, err := json.MarshalIndent(document, "", "  ")
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	// Validate what we produced with our own reader before serving it.
+	if _, err := NormalizeSPDX23(data, Limits{}); err != nil {
+		return nil, Snapshot{}, fmt.Errorf("derived document failed validation: %w", err)
+	}
+	return append(data, '\n'), snapshot, nil
+}
+
+func nonNilStrings(values []string) []string {
+	if values == nil {
+		return []string{}
+	}
+	return values
+}
+
+func spdxChecksumAlgorithm(value string) string {
+	switch strings.ToUpper(strings.ReplaceAll(value, "-", "")) {
+	case "SHA1":
+		return "SHA1"
+	case "SHA256":
+		return "SHA256"
+	case "SHA384":
+		return "SHA384"
+	case "SHA512":
+		return "SHA512"
+	case "MD5":
+		return "MD5"
+	case "SHA3256":
+		return "SHA3-256"
+	case "SHA3384":
+		return "SHA3-384"
+	case "SHA3512":
+		return "SHA3-512"
+	case "BLAKE2B256":
+		return "BLAKE2b-256"
+	case "BLAKE2B384":
+		return "BLAKE2b-384"
+	case "BLAKE2B512":
+		return "BLAKE2b-512"
+	case "BLAKE3":
+		return "BLAKE3"
+	}
+	return ""
+}
diff --git a/pkg/api/supply_chain.go b/pkg/api/supply_chain.go
index cd151a16..ebaa4be2 100644
--- a/pkg/api/supply_chain.go
+++ b/pkg/api/supply_chain.go
@@ -30,6 +30,16 @@ type SupplyChainRepositoryStatus struct {
 	OptOut         bool                     `json:"opt_out"`
 	Notes          []string                 `json:"notes"`
 	Documents      []SupplyChainDocumentRef `json:"documents"`
+	// Streams lists every stream known for the repository (GitHub and imports).
+	Streams []SupplyChainStreamRef `json:"streams"`
+}
+
+type SupplyChainStreamRef struct {
+	Key          string `json:"key"`
+	Producer     string `json:"producer"`
+	Subject      string `json:"subject"`
+	HasInventory bool   `json:"has_inventory"`
+	LastOutcome  string `json:"last_outcome,omitempty"`
 }
 
 // SupplyChainDocumentRef points at a downloadable original document.
@@ -66,6 +76,10 @@ type SupplyChainSnapshot struct {
 	DocumentSHA256   string               `json:"document_sha256"`
 	DocumentFormat   string               `json:"document_format"`
 	DocumentBytes    int64                `json:"document_bytes"`
+	// UploadedBy is the authenticated uploader of an imported document,
+	// recorded separately from the producer the document claims.
+	UploadedBy  string `json:"uploaded_by,omitempty"`
+	UploadLabel string `json:"upload_label,omitempty"`
 }
 
 type SupplyChainWarning struct {
@@ -335,3 +349,19 @@ type SupplyChainLicenseChange struct {
 	From      string `json:"from"`
 	To        string `json:"to"`
 }
+
+// SupplyChainImportResponse reports an accepted upload.
+type SupplyChainImportResponse struct {
+	ImportID         int64                `json:"import_id"`
+	Outcome          string               `json:"outcome"`
+	Repeated         bool                 `json:"repeated"`
+	SnapshotID       *int64               `json:"snapshot_id"`
+	Stream           string               `json:"stream"`
+	Format           string               `json:"format"`
+	ComponentCount   int                  `json:"component_count"`
+	EdgeCount        int                  `json:"edge_count"`
+	WarningCount     int                  `json:"warning_count"`
+	Warnings         []SupplyChainWarning `json:"warnings"`
+	SubjectAssurance string               `json:"subject_assurance,omitempty"`
+	Notes            []string             `json:"notes"`
+}
diff --git a/test/fixtures/supplychain/syft-cyclonedx-1.6.json b/test/fixtures/supplychain/syft-cyclonedx-1.6.json
new file mode 100644
index 00000000..a32b11fc
--- /dev/null
+++ b/test/fixtures/supplychain/syft-cyclonedx-1.6.json
@@ -0,0 +1,84 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2026-09-21T14:03:11Z",
+    "tools": {
+      "components": [
+        {"type": "application", "author": "anchore", "name": "syft", "version": "1.20.0"}
+      ]
+    },
+    "component": {
+      "bom-ref": "graphnest-fixture-root",
+      "type": "container",
+      "name": "registry.example.internal/acme/widgets",
+      "version": "sha256:8d1a3d4c5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f809"
+    }
+  },
+  "components": [
+    {
+      "bom-ref": "pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c",
+      "type": "library",
+      "group": "@scope",
+      "name": "left-pad",
+      "version": "1.3.0",
+      "purl": "pkg:npm/%40scope/left-pad@1.3.0",
+      "licenses": [{"license": {"id": "MIT"}}],
+      "hashes": [{"alg": "SHA-512", "content": "9a2c6b1d4e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f"}]
+    },
+    {
+      "bom-ref": "pkg:npm/dual@2.0.0?package-id=2b3c4d",
+      "type": "library",
+      "name": "dual",
+      "version": "2.0.0",
+      "purl": "pkg:npm/dual@2.0.0",
+      "licenses": [{"expression": "(MIT OR Apache-2.0)", "acknowledgement": "declared"}]
+    },
+    {
+      "bom-ref": "pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12&package-id=3c4d5e",
+      "type": "library",
+      "name": "libssl3",
+      "version": "3.0.11-1~deb12u2",
+      "purl": "pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12",
+      "supplier": {"name": "Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org>"},
+      "licenses": [{"license": {"name": "OpenSSL"}}, {"license": {"id": "Apache-2.0"}}]
+    },
+    {
+      "bom-ref": "pkg:golang/golang.org/x/text@v0.14.0?package-id=4d5e6f",
+      "type": "library",
+      "name": "golang.org/x/text",
+      "version": "v0.14.0",
+      "purl": "pkg:golang/golang.org/x/text@v0.14.0",
+      "licenses": [{"license": {"id": "BSD-3-Clause", "url": "https://go.dev/LICENSE"}}],
+      "evidence": {"licenses": [{"license": {"id": "BSD-3-Clause"}}], "occurrences": [{"location": "/app/vendor/golang.org/x/text/LICENSE"}]}
+    },
+    {
+      "bom-ref": "bundle-1",
+      "type": "application",
+      "name": "widgets-bundle",
+      "version": "4.2.0",
+      "components": [
+        {
+          "bom-ref": "pkg:npm/nested-helper@0.1.0?package-id=5e6f7a",
+          "type": "library",
+          "name": "nested-helper",
+          "version": "0.1.0",
+          "purl": "pkg:npm/nested-helper@0.1.0",
+          "licenses": [{"license": {"name": "Custom Acme License", "url": "https://acme.example.internal/license"}}]
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "/app/config/settings.yaml"
+    }
+  ],
+  "dependencies": [
+    {"ref": "graphnest-fixture-root", "dependsOn": ["pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c", "pkg:npm/dual@2.0.0?package-id=2b3c4d", "pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12&package-id=3c4d5e", "bundle-1"]},
+    {"ref": "pkg:npm/dual@2.0.0?package-id=2b3c4d", "dependsOn": ["pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c"]},
+    {"ref": "bundle-1", "dependsOn": ["pkg:npm/nested-helper@0.1.0?package-id=5e6f7a", "pkg:npm/missing@9.9.9"]}
+  ]
+}
diff --git a/test/integration/supply_chain_test.go b/test/integration/supply_chain_test.go
index e4d9b359..50c0a953 100644
--- a/test/integration/supply_chain_test.go
+++ b/test/integration/supply_chain_test.go
@@ -3,6 +3,7 @@
 package integration
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -659,3 +660,308 @@ func TestSupplyChainPortfolioAuthorization(t *testing.T) {
 		t.Fatalf("compare with foreign snapshot = %d", response.Code)
 	}
 }
+
+// TestSupplyChainImports proves standards-based uploads: real-format round
+// trips for SPDX 2.3 and CycloneDX 1.6, stream separation from the GitHub
+// observation, uploader identity separate from the claimed producer,
+// producer-asserted subject binding, idempotency, quota, repository-scoped
+// permission, and explicit rejection of unsupported versions.
+func TestSupplyChainImports(t *testing.T) {
+	h := newPostgresHarness(t)
+	widgets := h.seedRepository(t, 10, 101)
+	h.seedRepository(t, 10, 102)
+	github, client := newFakeSBOMGitHub(t)
+	envelope := sbomEnvelope(t)
+	github.responses["acme/repo-101"] = func(writer http.ResponseWriter) { fmt.Fprint(writer, envelope) }
+	collector := &supplychain.Collector{Store: h.store, GitHub: client, Owner: "collect", MaxDocumentBytes: 1 << 20}
+	if _, _, err := h.store.EnqueueSupplyChainJob(t.Context(), widgets, supplychain.StreamGitHubSource, "manual", "t", 10, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := collector.RunOnce(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	importer := &supplychain.Importer{Store: h.store, Authorizer: authz.NewPostgres(h.store), MaxDocumentBytes: 1 << 20, QuotaPerRepository: 12, QuotaWindow: time.Hour}
+	service := &supplychain.Service{Store: h.store, Authorizer: authz.NewPostgres(h.store), Interval: time.Hour, MaxResults: 100, License: h.store}
+	authorizer := authz.NewPostgres(h.store)
+	grants := &httpapi.UploadGrants{Set: h.store.SetSupplyChainUploadGrant, Resolve: func(ctx context.Context, principal authn.Principal, githubID int64) (int64, error) {
+		repo, err := authorizer.AuthorizedRepository(ctx, principal, githubID)
+		return repo.ID, err
+	}}
+	authenticator := authn.RequestAuthenticator{Bearer: authn.NewStatic(map[string]authn.Principal{
+		"admin":  {Subject: "admin@acme", Method: "session", Administrator: true},
+		"dev":    {Subject: "dev@acme", Method: "api_token", InstallationID: 10, RepositoryIDs: []int64{101, 102}},
+		"reader": {Subject: "reader@acme", Method: "api_token", InstallationID: 10, RepositoryIDs: []int64{101}},
+	})}
+	mux := http.NewServeMux()
+	httpapi.RegisterSupplyChain(mux, authenticator, service, 100, 256<<10)
+	httpapi.RegisterSupplyChainImports(mux, authenticator, importer, grants, 1<<20, 256<<10)
+	post := func(token, path, contentType string, body []byte) *httptest.ResponseRecorder {
+		request := httptest.NewRequest(http.MethodPost, path, strings.NewReader(string(body)))
+		request.Header.Set("Authorization", "Bearer "+token)
+		request.Header.Set("Content-Type", contentType)
+		recorder := httptest.NewRecorder()
+		mux.ServeHTTP(recorder, request)
+		return recorder
+	}
+	get := func(token, path string) *httptest.ResponseRecorder {
+		request := httptest.NewRequest(http.MethodGet, path, nil)
+		request.Header.Set("Authorization", "Bearer "+token)
+		recorder := httptest.NewRecorder()
+		mux.ServeHTTP(recorder, request)
+		return recorder
+	}
+	cyclonedx, err := os.ReadFile("../fixtures/supplychain/syft-cyclonedx-1.6.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	spdxMember, _ := os.ReadFile("../fixtures/supplychain/ghes-spdx-2.3.json")
+	// An ORT-style SPDX document claiming a different tool and a known commit.
+	ortDocument := strings.Replace(string(spdxMember), `"Tool: GitHub.com-Dependency-Graph"`, `"Tool: ORT-45.0.0"`, 1)
+	sha := strings.Repeat("c", 40)
+
+	// Without a grant, a non-administrator cannot import; administrators can.
+	if response := post("dev", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx); response.Code != http.StatusForbidden {
+		t.Fatalf("ungranted import = %d %s", response.Code, response.Body.String())
+	}
+	response := post("admin", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx)
+	var imported api.SupplyChainImportResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &imported); err != nil || response.Code != http.StatusCreated {
+		t.Fatalf("cyclonedx import = %d %s", response.Code, response.Body.String())
+	}
+	if imported.Outcome != "published" || imported.Format != "cyclonedx-1.6-json" || imported.ComponentCount != 8 || imported.Stream != "import:artifact:syft-image" || imported.SubjectAssurance != "unknown" || imported.SnapshotID == nil {
+		t.Fatalf("cyclonedx import = %+v", imported)
+	}
+	// Idempotent: the same bytes return the earlier result without a new snapshot.
+	response = post("admin", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx)
+	var repeated api.SupplyChainImportResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &repeated); err != nil || response.Code != http.StatusCreated || !repeated.Repeated || repeated.Outcome != "unchanged" || *repeated.SnapshotID != *imported.SnapshotID {
+		t.Fatalf("repeated import = %d %+v", response.Code, repeated)
+	}
+	// The GitHub stream is untouched by the artifact import.
+	response = get("dev", "/v1/supply-chain/repositories/101")
+	var status api.SupplyChainRepositoryStatus
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.Producer != "github" || status.LatestSnapshot == nil || status.LatestSnapshot.ComponentCount != 7 || len(status.Streams) != 2 {
+		t.Fatalf("github stream after import = %d %+v", response.Code, status)
+	}
+	response = get("dev", "/v1/supply-chain/repositories/101?stream=import:artifact:syft-image")
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.Producer != "import" || status.Subject != "artifact" || status.LatestSnapshot == nil || status.LatestSnapshot.ProducerTool != "syft 1.20.0" || status.LatestSnapshot.UploadedBy != "admin@acme" || status.LatestSnapshot.UploadLabel != "syft-image" {
+		t.Fatalf("import stream status = %d %+v", response.Code, status)
+	}
+	found := false
+	for _, note := range status.Notes {
+		found = found || strings.Contains(note, "uploaded by admin@acme")
+	}
+	if !found {
+		t.Fatalf("notes must name the uploader separately from the claimed producer: %v", status.Notes)
+	}
+	response = get("dev", "/v1/supply-chain/repositories/101/components?stream=import:artifact:syft-image&q=libssl")
+	var page api.SupplyChainComponentList
+	if err := json.Unmarshal(response.Body.Bytes(), &page); err != nil || len(page.Components) != 1 || *page.Components[0].LicenseDeclaredRaw != "OpenSSL; Apache-2.0" || page.Components[0].Scope != "direct" || page.Components[0].Qualifiers["distro"] != "debian-12" {
+		t.Fatalf("libssl occurrence = %d %s", response.Code, response.Body.String())
+	}
+	if response := get("dev", *documentPath(&status)); response.Code != http.StatusOK || response.Body.String() != string(cyclonedx) {
+		t.Fatalf("original CycloneDX bytes were not preserved: %d", response.Code)
+	}
+
+	// Grant dev upload rights to 101 only; an SPDX source import with a subject revision is producer_asserted.
+	grantRequest := httptest.NewRequest(http.MethodPut, "/v1/supply-chain/upload-grants", strings.NewReader(`{"repository_id":101,"subject":"dev@acme","allow":true}`))
+	grantRequest.Header.Set("Authorization", "Bearer admin")
+	grantRequest.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	mux.ServeHTTP(recorder, grantRequest)
+	if recorder.Code != http.StatusNoContent {
+		t.Fatalf("grant = %d %s", recorder.Code, recorder.Body.String())
+	}
+	response = post("dev", "/v1/supply-chain/imports?repository_id=101&subject=source&label=ort&subject_revision="+sha, "application/spdx+json", []byte(ortDocument))
+	if err := json.Unmarshal(response.Body.Bytes(), &imported); err != nil || response.Code != http.StatusCreated || imported.Format != "spdx-2.3-json" || imported.SubjectAssurance != "producer_asserted" || imported.ComponentCount != 7 {
+		t.Fatalf("spdx import = %d %s", response.Code, response.Body.String())
+	}
+	response = get("reader", "/v1/supply-chain/repositories/101?stream=import:source:ort")
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.LatestSnapshot.SubjectRevision != sha || status.LatestSnapshot.SubjectAssurance != "producer_asserted" || status.LatestSnapshot.ProducerTool != "ORT-45.0.0" || status.LatestSnapshot.UploadedBy != "dev@acme" {
+		t.Fatalf("ort stream = %d %+v", response.Code, status.LatestSnapshot)
+	}
+	// A spoofed "Tool: GitHub.com-Dependency-Graph" upload never lands in the GitHub stream and is still labelled as an import.
+	response = post("dev", "/v1/supply-chain/imports?repository_id=101&subject=source&label=spoof", "application/json", spdxMember)
+	if err := json.Unmarshal(response.Body.Bytes(), &imported); err != nil || response.Code != http.StatusCreated || imported.Stream != "import:source:spoof" {
+		t.Fatalf("spoof import = %d %s", response.Code, response.Body.String())
+	}
+	response = get("dev", "/v1/supply-chain/repositories/101?stream=import:source:spoof")
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.Producer != "import" || status.LatestSnapshot.ProducerTool != "GitHub.com-Dependency-Graph" || status.LatestSnapshot.UploadedBy != "dev@acme" {
+		t.Fatalf("spoof stream = %+v", status)
+	}
+	// dev has no grant on 102; the reader has no grant at all; an unknown repository is not found.
+	if response := post("dev", "/v1/supply-chain/imports?repository_id=102&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusForbidden {
+		t.Fatalf("import to ungranted repository = %d", response.Code)
+	}
+	if response := post("reader", "/v1/supply-chain/imports?repository_id=101&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusForbidden {
+		t.Fatalf("reader import = %d", response.Code)
+	}
+	if response := post("dev", "/v1/supply-chain/imports?repository_id=999&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusNotFound {
+		t.Fatalf("unknown repository import = %d", response.Code)
+	}
+	// Explicit rejections: unsupported version, wrong format claim, bad label, bad revision, wrong media type, malformed.
+	for name, target := range map[string]struct {
+		path, contentType, body string
+		status                  int
+	}{
+		"old spdx":         {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/spdx+json", strings.Replace(string(spdxMember), "SPDX-2.3", "SPDX-2.2", 1), http.StatusUnsupportedMediaType},
+		"old cyclonedx":    {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/json", strings.Replace(string(cyclonedx), `"specVersion": "1.6"`, `"specVersion": "1.5"`, 1), http.StatusUnsupportedMediaType},
+		"mismatched claim": {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/spdx+json", string(cyclonedx), http.StatusUnsupportedMediaType},
+		"unknown format":   {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/json", `{"hello":"world"}`, http.StatusUnsupportedMediaType},
+		"malformed":        {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/json", `{"spdxVersion":"SPDX-2.3","packages":"x"}`, http.StatusBadRequest},
+		"bad label":        {"/v1/supply-chain/imports?repository_id=101&subject=source&label=Bad%20Label", "application/json", string(spdxMember), http.StatusBadRequest},
+		"bad subject":      {"/v1/supply-chain/imports?repository_id=101&subject=release&label=x", "application/json", string(spdxMember), http.StatusBadRequest},
+		"bad revision":     {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x&subject_revision=HEAD", "application/json", string(spdxMember), http.StatusBadRequest},
+		"wrong media type": {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "text/plain", string(spdxMember), http.StatusUnsupportedMediaType},
+	} {
+		response := post("admin", target.path, target.contentType, []byte(target.body))
+		if response.Code != target.status {
+			t.Fatalf("%s = %d, want %d: %s", name, response.Code, target.status, response.Body.String())
+		}
+	}
+	// Quota counts accepted and rejected attempts per repository per window.
+	count, err := h.store.SupplyChainImportCount(t.Context(), widgets, time.Now().Add(-time.Hour))
+	if err != nil || count < 8 {
+		t.Fatalf("import count = %d %v", count, err)
+	}
+	importer.QuotaPerRepository = count
+	if response := post("admin", "/v1/supply-chain/imports?repository_id=101&subject=source&label=quota", "application/json", []byte(strings.Replace(string(spdxMember), `"name": "com.github.acme/widgets"`, `"name": "quota"`, 1))); response.Code != http.StatusTooManyRequests {
+		t.Fatalf("over quota = %d %s", response.Code, response.Body.String())
+	}
+	// Another repository has its own quota.
+	if response := post("admin", "/v1/supply-chain/imports?repository_id=102&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusCreated {
+		t.Fatalf("other repository import = %d %s", response.Code, response.Body.String())
+	}
+	// Idempotent replay of an accepted document is still answered when over quota (it does no new work).
+	if response := post("admin", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx); response.Code != http.StatusCreated {
+		t.Fatalf("replay over quota = %d", response.Code)
+	}
+}
+
+func documentPath(status *api.SupplyChainRepositoryStatus) *string {
+	if len(status.Documents) == 0 {
+		empty := ""
+		return &empty
+	}
+	return &status.Documents[0].Path
+}
+
+// TestSupplyChainDerivedSPDXExport proves the derived document names
+// GraphNest as creator, links the preserved original by URL and hash, carries
+// assessments only as comments, validates with the SPDX reader, and never
+// alters the original download.
+func TestSupplyChainDerivedSPDXExport(t *testing.T) {
+	h := newPostgresHarness(t)
+	widgets := h.seedRepository(t, 10, 101)
+	github, client := newFakeSBOMGitHub(t)
+	envelope := sbomEnvelope(t)
+	github.responses["acme/repo-101"] = func(writer http.ResponseWriter) { fmt.Fprint(writer, envelope) }
+	collector := &supplychain.Collector{Store: h.store, GitHub: client, Owner: "collect", MaxDocumentBytes: 1 << 20}
+	if _, _, err := h.store.EnqueueSupplyChainJob(t.Context(), widgets, supplychain.StreamGitHubSource, "manual", "t", 10, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := collector.RunOnce(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	leftPad := license.Coordinates{Ecosystem: "npm", Namespace: "@scope", Name: "left-pad", Version: "1.3.0"}
+	if _, _, err := h.store.InsertLicenseEvidence(t.Context(), license.Evidence{Source: license.SourceRegistryNPM, Route: "npm:test", Coordinates: leftPad, Outcome: license.OutcomeResolved, FetchedAt: time.Now(), RawValue: "MIT", RawKind: license.RawExpression,
+		ParseStatus: "parsed", NormalizedExpression: "MIT", ResolverVersion: 1, LicenseListVersion: "3.27.0", ContentSHA256: make([]byte, 32)}); err != nil {
+		t.Fatal(err)
+	}
+	occurrences, _ := h.store.ComponentsForCoordinates(t.Context(), leftPad, 10)
+	evidence, _ := h.store.LatestLicenseEvidence(t.Context(), leftPad)
+	declared, concluded, _ := h.store.ComponentDeclarations(t.Context(), occurrences[0][0])
+	if err := h.store.UpsertAssessment(t.Context(), license.Assess(occurrences[0][0], occurrences[0][1], declared, concluded, evidence, time.Now())); err != nil {
+		t.Fatal(err)
+	}
+	service := &supplychain.Service{Store: h.store, Authorizer: authz.NewPostgres(h.store), Interval: time.Hour, MaxResults: 100, License: h.store}
+	portfolio := &supplychain.Portfolio{Store: h.store, Snapshots: h.store, Authorizer: authz.NewPostgres(h.store), Interval: time.Hour, MaxResults: 100}
+	authenticator := authn.RequestAuthenticator{Bearer: authn.NewStatic(map[string]authn.Principal{
+		"acme":  {Subject: "acme", Method: "api_token", InstallationID: 10, RepositoryIDs: []int64{101}},
+		"other": {Subject: "other", Method: "api_token", InstallationID: 20, RepositoryIDs: []int64{999}},
+	})}
+	mux := http.NewServeMux()
+	httpapi.RegisterSupplyChain(mux, authenticator, service, 100, 256<<10)
+	httpapi.RegisterSupplyChainPortfolio(mux, authenticator, portfolio, 100, 256<<10, &httpapi.DerivedExport{Service: service, PublicOrigin: "https://graphnest.example"})
+	get := func(token, path string) *httptest.ResponseRecorder {
+		request := httptest.NewRequest(http.MethodGet, path, nil)
+		request.Header.Set("Authorization", "Bearer "+token)
+		recorder := httptest.NewRecorder()
+		mux.ServeHTTP(recorder, request)
+		return recorder
+	}
+	response := get("acme", "/v1/supply-chain/exports/101/derived.spdx.json")
+	if response.Code != http.StatusOK || response.Header().Get("Content-Type") != "application/spdx+json" || response.Header().Get("X-GraphNest-Derived") != "true" {
+		t.Fatalf("derived export = %d %v %s", response.Code, response.Header(), response.Body.String())
+	}
+	var derived struct {
+		SPDXVersion  string `json:"spdxVersion"`
+		Name         string `json:"name"`
+		CreationInfo struct {
+			Creators []string `json:"creators"`
+			Comment  string   `json:"comment"`
+		} `json:"creationInfo"`
+		ExternalDocumentRefs []struct {
+			ExternalDocumentID string `json:"externalDocumentId"`
+			SPDXDocument       string `json:"spdxDocument"`
+			Checksum           struct {
+				Algorithm string `json:"algorithm"`
+				Value     string `json:"checksumValue"`
+			} `json:"checksum"`
+		} `json:"externalDocumentRefs"`
+		DocumentDescribes []string `json:"documentDescribes"`
+		Packages          []struct {
+			SPDXID           string `json:"SPDXID"`
+			Name             string `json:"name"`
+			LicenseDeclared  string `json:"licenseDeclared"`
+			LicenseConcluded string `json:"licenseConcluded"`
+			LicenseComments  string `json:"licenseComments"`
+		} `json:"packages"`
+		Relationships []struct {
+			Type string `json:"relationshipType"`
+		} `json:"relationships"`
+	}
+	if err := json.Unmarshal(response.Body.Bytes(), &derived); err != nil {
+		t.Fatal(err)
+	}
+	if derived.SPDXVersion != "SPDX-2.3" || len(derived.CreationInfo.Creators) != 2 || !strings.HasPrefix(derived.CreationInfo.Creators[0], "Tool: GraphNest-supply-chain-") || !strings.Contains(derived.CreationInfo.Comment, "preserved unchanged") {
+		t.Fatalf("creation info = %+v", derived.CreationInfo)
+	}
+	original := get("acme", "/v1/supply-chain/snapshots/1/document")
+	if len(derived.ExternalDocumentRefs) != 1 || derived.ExternalDocumentRefs[0].SPDXDocument != "https://graphnest.example/v1/supply-chain/snapshots/1/document" || derived.ExternalDocumentRefs[0].Checksum.Value != original.Header().Get("X-Content-SHA256") {
+		t.Fatalf("external refs = %+v (original sha %s)", derived.ExternalDocumentRefs, original.Header().Get("X-Content-SHA256"))
+	}
+	if len(derived.Packages) != 7 || len(derived.DocumentDescribes) != 1 || derived.DocumentDescribes[0] != "SPDXRef-com.github.acme-widgets" {
+		t.Fatalf("packages = %d describes = %v", len(derived.Packages), derived.DocumentDescribes)
+	}
+	for _, pkg := range derived.Packages {
+		if pkg.LicenseConcluded != "NOASSERTION" {
+			t.Fatalf("derived export must not conclude licenses: %+v", pkg)
+		}
+		if pkg.LicenseDeclared != "NOASSERTION" {
+			t.Fatalf("GHES NOASSERTION must stay NOASSERTION: %+v", pkg)
+		}
+		if pkg.Name == "npm:@scope/left-pad" && !strings.Contains(pkg.LicenseComments, "GraphNest assessment: resolved (MIT)") {
+			t.Fatalf("assessment must appear as a comment only: %+v", pkg)
+		}
+	}
+	describes, dependsOn := 0, 0
+	for _, relationship := range derived.Relationships {
+		switch relationship.Type {
+		case "DESCRIBES":
+			describes++
+		case "DEPENDS_ON":
+			dependsOn++
+		}
+	}
+	if describes != 1 || dependsOn != 6 {
+		t.Fatalf("relationships = %d DESCRIBES, %d DEPENDS_ON (the unresolved edge must be dropped)", describes, dependsOn)
+	}
+	// The original is still served byte-for-byte and is a different document.
+	if original.Code != http.StatusOK || original.Body.String() != strings.TrimSpace(envelope[len(`{"sbom":`):len(envelope)-1]) {
+		t.Fatalf("original changed: %d", original.Code)
+	}
+	if response := get("other", "/v1/supply-chain/exports/101/derived.spdx.json"); response.Code != http.StatusNotFound {
+		t.Fatalf("unauthorized derived export = %d", response.Code)
+	}
+}