From 6133776f15af60c650f2a2cfed162ec448312e8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Balatoni?= <balcsida@gmail.com>
Date: Tue, 22 Sep 2026 22:08:20 +0200
Subject: [PATCH 1/2] feat(supply-chain): import SPDX and CycloneDX documents
 and export derived SPDX

Accept authenticated SPDX 2.3 JSON and CycloneDX 1.6 JSON uploads into
declared import streams of an authorized repository. The format is
detected from the document, unsupported versions and contradictory
content types are rejected explicitly, original bytes are preserved, the
uploader is recorded separately from the claimed producer, and a
supplied subject revision is bound only as producer_asserted. Identical
bytes are idempotent, per-repository quotas apply, and non-administrators
need a repository-scoped upload grant. The CycloneDX normalizer keeps
nested components, dependencies, hashes, and license choices as the
format carries them and warns about evidence it cannot carry. A derived
SPDX export names GraphNest as creator, links the preserved original by
URL and hash, carries assessments as comments only, and is validated by
the same reader. Migration 035 adds imports and upload grants.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 cmd/graphnest-server/main.go                  |  16 +-
 docs/openapi.yaml                             | 112 +++++-
 internal/httpapi/supply_chain_import.go       | 105 ++++++
 internal/httpapi/supply_chain_portfolio.go    |  49 ++-
 .../migrations/035_supply_chain_import.sql    |  38 ++
 internal/postgres/supply_chain.go             |  11 +-
 internal/postgres/supply_chain_import.go      |  77 +++++
 internal/supplychain/cyclonedx.go             | 325 ++++++++++++++++++
 internal/supplychain/cyclonedx_test.go        | 142 ++++++++
 internal/supplychain/importer.go              | 246 +++++++++++++
 internal/supplychain/license/evidence.go      |  18 +
 internal/supplychain/model.go                 |   6 +
 internal/supplychain/service.go               |  46 ++-
 internal/supplychain/spdx_test.go             |  25 ++
 internal/supplychain/spdxexport.go            | 258 ++++++++++++++
 pkg/api/supply_chain.go                       |  30 ++
 .../supplychain/syft-cyclonedx-1.6.json       |  84 +++++
 test/integration/supply_chain_test.go         | 306 +++++++++++++++++
 18 files changed, 1868 insertions(+), 26 deletions(-)
 create mode 100644 internal/httpapi/supply_chain_import.go
 create mode 100644 internal/postgres/migrations/035_supply_chain_import.sql
 create mode 100644 internal/postgres/supply_chain_import.go
 create mode 100644 internal/supplychain/cyclonedx.go
 create mode 100644 internal/supplychain/cyclonedx_test.go
 create mode 100644 internal/supplychain/importer.go
 create mode 100644 internal/supplychain/spdxexport.go
 create mode 100644 test/fixtures/supplychain/syft-cyclonedx-1.6.json

diff --git a/cmd/graphnest-server/main.go b/cmd/graphnest-server/main.go
index 61f508f9..56166f47 100644
--- a/cmd/graphnest-server/main.go
+++ b/cmd/graphnest-server/main.go
@@ -47,6 +47,7 @@ import (
 	"github.com/balcsida/graphnest/internal/webhook"
 	"github.com/balcsida/graphnest/internal/webui"
 	"github.com/balcsida/graphnest/internal/zoekt"
+	"github.com/jackc/pgx/v5"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"golang.org/x/net/idna"
 )
@@ -470,9 +471,22 @@ func newDurableRuntime(ctx context.Context, settings config.Config, logger *slog
 			License: store, EnrichmentEcosystems: registry.Ecosystems()}
 		supplyChainDone = startSupplyChain(loopCtx, settings.SupplyChain, store, githubClient, registry, metrics, logger)
 		portfolio := &supplychain.Portfolio{Store: store, Snapshots: store, Authorizer: authz.NewPostgres(store), Interval: settings.SupplyChain.Interval, MaxResults: settings.Limits.MaxResults}
+		importer := &supplychain.Importer{Store: store, Authorizer: authz.NewPostgres(store), MaxDocumentBytes: settings.SupplyChain.MaxDocumentBytes, Limits: supplychain.Limits{MaxComponents: settings.SupplyChain.MaxComponents}}
+		if len(registry.Ecosystems()) > 0 {
+			importer.Enricher = &license.Worker{Store: store, Registry: registry}
+		}
+		authorizer := authz.NewPostgres(store)
+		grants := &httpapi.UploadGrants{Set: store.SetSupplyChainUploadGrant, Resolve: func(ctx context.Context, principal authn.Principal, githubID int64) (int64, error) {
+			repo, err := authorizer.AuthorizedRepository(ctx, principal, githubID)
+			if errors.Is(err, pgx.ErrNoRows) {
+				return 0, supplychain.ErrNotFound
+			}
+			return repo.ID, err
+		}}
 		extras = append(extras, func(mux *http.ServeMux) {
 			httpapi.RegisterSupplyChain(mux, auth.requestAuth, supplyChainService, settings.Limits.MaxResults, settings.Limits.MaxResponseBytes)
-			httpapi.RegisterSupplyChainPortfolio(mux, auth.requestAuth, portfolio, settings.Limits.MaxResults, settings.Limits.MaxResponseBytes)
+			httpapi.RegisterSupplyChainPortfolio(mux, auth.requestAuth, portfolio, settings.Limits.MaxResults, settings.Limits.MaxResponseBytes, &httpapi.DerivedExport{Service: supplyChainService, PublicOrigin: auth.requestAuth.PublicOrigin})
+			httpapi.RegisterSupplyChainImports(mux, auth.requestAuth, importer, grants, settings.SupplyChain.MaxDocumentBytes, settings.Limits.MaxResponseBytes)
 		})
 	}
 	handler := newAPIHandler(settings, metrics, auth.requestAuth, searchService, repositoryService, scipService, graphService, graphQueries, webhookSecret, processor, adminService, durableReadiness{pool: pool, zoekt: backend}, auth.providers, auth.sessions, provisioning, scimService, auth.mcpOAuth, extras...)
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 54d69bfb..da0dff8f 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -639,7 +639,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, description: GitHub repository ID, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, description: 'Stream key; only github:source is served in this milestone', schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, description: 'Stream key: github:source (default) or import:<subject>:<label>', schema: {type: string}}
       responses:
         '200': {description: Repository inventory status, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainRepositoryStatus'}}}}
         '400': {$ref: '#/components/responses/InvalidRequest'}
@@ -654,7 +654,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: snapshot_id, in: query, required: false, description: A specific snapshot of this repository (defaults to the stream's latest), schema: {type: integer, format: int64, minimum: 1}}
         - {name: cursor, in: query, required: false, description: next_cursor from a previous truncated response (bound to the snapshot and search term), schema: {type: string, minLength: 1}}
         - {name: limit, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100}}
@@ -674,7 +674,7 @@ paths:
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
         - {name: element, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 512}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: snapshot_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Component evidence detail, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainComponentDetail'}}}}
@@ -689,7 +689,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: limit, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100}}
       responses:
         '200': {description: Snapshot history, newest first, content: {application/json: {schema: {type: object, additionalProperties: false, required: [snapshots], properties: {snapshots: {type: array, items: {$ref: '#/components/schemas/SupplyChainSnapshot'}}}}}}}
@@ -705,7 +705,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: cursor, in: query, required: false, schema: {type: string, minLength: 1}}
         - {name: limit, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100}}
       responses:
@@ -722,7 +722,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
       responses:
         '202': {description: Refresh job queued or already queued, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainRefreshResponse'}}}}
         '400': {$ref: '#/components/responses/InvalidRequest'}
@@ -765,7 +765,7 @@ paths:
       description: Portfolio summary across the caller's authorized repositories for one stream. Every count names its denominator in `denominators`; assessments describe evidence, never compliance. Requested repository_id values outside the caller's scope are silently dropped.
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, description: Repeatable GitHub repository IDs to narrow the scope (at most 200), schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Portfolio overview, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainOverview'}}}}
@@ -779,7 +779,7 @@ paths:
       description: Bounded filter facets (ecosystems, assessment statuses, normalized license expressions) computed inside the caller's scope.
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Facets, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainFacets'}}}}
@@ -793,7 +793,7 @@ paths:
       description: Unique coordinates (ecosystem, namespace, name, version) across the latest snapshots of the caller's authorized repositories, with repository and occurrence counts, keyset-paginated in stable key order. The cursor is bound to the filter set. Filters never reveal repositories outside the scope.
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
         - {name: ecosystem, in: query, required: false, schema: {type: string, maxLength: 64}}
         - {name: q, in: query, required: false, description: Case-insensitive substring of name or purl, schema: {type: string, maxLength: 200}}
@@ -814,7 +814,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: key, in: path, required: true, description: Component key from the component list, schema: {type: string, minLength: 1, maxLength: 4096}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: repository_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: Coordinate detail, content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainPortfolioComponentDetail'}}}}
@@ -830,7 +830,7 @@ paths:
       security: [{bearerAuth: []}, {sessionCookie: []}]
       parameters:
         - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: stream, in: query, required: false, schema: {type: string, enum: ['github:source']}}
+        - {name: stream, in: query, required: false, schema: {type: string, description: 'github:source or import:<subject>:<label>'}}
         - {name: snapshot_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
       responses:
         '200': {description: CSV attachment with X-GraphNest-Snapshot-ID, content: {text/csv: {schema: {type: string}}}}
@@ -856,6 +856,64 @@ paths:
         '405': {$ref: '#/components/responses/InvalidRequest'}
         '500': {description: Response exceeded the configured byte limit}
         '503': {$ref: '#/components/responses/Unavailable'}
+  /v1/supply-chain/imports:
+    post:
+      description: Import an SBOM produced elsewhere into a declared stream (import:<subject>:<label>) of an authorized repository. Accepts SPDX 2.3 JSON and CycloneDX 1.6 JSON only; the format is detected from the document, and a Content-Type that contradicts it is rejected. The original bytes are preserved and downloadable unchanged. The authenticated uploader is recorded separately from the producer the document claims; an optional subject_revision is recorded as producer_asserted, never verified. Identical bytes into the same stream return the earlier result (repeated=true). Administrators may import anywhere; other principals need a repository-scoped upload grant. Per-repository quotas apply to accepted and rejected attempts. External URLs inside documents are never dereferenced.
+      security: [{bearerAuth: []}, {sessionCookie: []}]
+      parameters:
+        - {name: repository_id, in: query, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: subject, in: query, required: true, schema: {type: string, enum: [source, artifact]}}
+        - {name: label, in: query, required: true, description: Stream label such as ort or syft-image, schema: {type: string, pattern: '^[a-z0-9][a-z0-9._-]{0,63}$'}}
+        - {name: subject_revision, in: query, required: false, schema: {type: string, pattern: '^[0-9a-f]{40}$'}}
+      requestBody:
+        required: true
+        content:
+          application/spdx+json: {schema: {type: object}}
+          application/vnd.cyclonedx+json: {schema: {type: object}}
+          application/json: {schema: {type: object}}
+      responses:
+        '201': {description: Import accepted (published, or unchanged when the stream already serves this document), content: {application/json: {schema: {$ref: '#/components/schemas/SupplyChainImportResponse'}}}}
+        '400': {description: Invalid parameters or a document that could not be parsed (malformed_document), content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '401': {$ref: '#/components/responses/Unauthenticated'}
+        '403': {description: No upload grant for this repository, content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '405': {$ref: '#/components/responses/InvalidRequest'}
+        '413': {description: Document exceeds the configured size or component limits, content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '415': {description: Unsupported media type, format, or schema version (unsupported_format), content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '429': {description: Import quota exhausted for this repository (quota_exceeded), content: {application/json: {schema: {$ref: '#/components/schemas/ErrorResponse'}}}}
+        '500': {description: Response exceeded the configured byte limit}
+        '503': {$ref: '#/components/responses/Unavailable'}
+  /v1/supply-chain/upload-grants:
+    put:
+      description: Administrator-only. Grant or revoke a principal's (by subject) permission to import into one repository. Grants never widen read access.
+      security: [{bearerAuth: []}, {sessionCookie: []}]
+      requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [repository_id, subject, allow], properties: {repository_id: {type: integer, format: int64, minimum: 1}, subject: {type: string, minLength: 1, maxLength: 256}, allow: {type: boolean}}}}}}
+      responses:
+        '204': {description: Grant updated}
+        '400': {$ref: '#/components/responses/InvalidRequest'}
+        '401': {$ref: '#/components/responses/Unauthenticated'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '405': {$ref: '#/components/responses/InvalidRequest'}
+        '413': {$ref: '#/components/responses/InvalidRequest'}
+        '415': {$ref: '#/components/responses/InvalidRequest'}
+        '503': {$ref: '#/components/responses/Unavailable'}
+  /v1/supply-chain/exports/{id}/derived.spdx.json:
+    get:
+      description: Derived SPDX 2.3 JSON document for one authorized snapshot with GraphNest as creator. It links the preserved original by URL and SHA-256 (externalDocumentRefs) and carries GraphNest assessments only as licenseComments; licenseConcluded is always NOASSERTION and licenseDeclared holds only values that are valid SPDX expressions or sentinels. Review decisions are not part of the document. The original download is never altered.
+      security: [{bearerAuth: []}, {sessionCookie: []}]
+      parameters:
+        - {name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: stream, in: query, required: false, schema: {type: string}}
+        - {name: snapshot_id, in: query, required: false, schema: {type: integer, format: int64, minimum: 1}}
+      responses:
+        '200': {description: Derived SPDX document (attachment) with X-GraphNest-Derived and X-GraphNest-Snapshot-ID, content: {application/spdx+json: {schema: {type: object}}}}
+        '400': {$ref: '#/components/responses/InvalidRequest'}
+        '401': {$ref: '#/components/responses/Unauthenticated'}
+        '404': {$ref: '#/components/responses/SupplyChainNotFound'}
+        '405': {$ref: '#/components/responses/InvalidRequest'}
+        '413': {description: Export exceeds the response limit}
+        '503': {$ref: '#/components/responses/Unavailable'}
   /v1/auth/config:
     get:
       responses:
@@ -2238,7 +2296,7 @@ components:
     SupplyChainRepositoryStatus:
       type: object
       additionalProperties: false
-      required: [repository_id, repository, stream, producer, subject, collection, freshness_seconds, latest_snapshot, last_collection, active_job, enrichment, enrichment_ecosystems, license_summary, opt_out, notes, documents]
+      required: [repository_id, repository, stream, producer, subject, collection, freshness_seconds, latest_snapshot, last_collection, active_job, enrichment, enrichment_ecosystems, license_summary, opt_out, notes, documents, streams]
       properties:
         repository_id: {type: integer, format: int64}
         repository: {type: string}
@@ -2256,6 +2314,7 @@ components:
         opt_out: {type: boolean}
         notes: {type: array, items: {type: string}}
         documents: {type: array, items: {$ref: '#/components/schemas/SupplyChainDocumentRef'}}
+        streams: {type: array, items: {$ref: '#/components/schemas/SupplyChainStreamRef'}, description: Every stream known for the repository (GitHub observation and imports)}
     SupplyChainDocumentRef:
       type: object
       additionalProperties: false
@@ -2295,6 +2354,8 @@ components:
         document_sha256: {type: string, pattern: '^[0-9a-f]{64}$'}
         document_format: {type: string, enum: [spdx-2.3-json, cyclonedx-1.6-json]}
         document_bytes: {type: integer, format: int64, minimum: 0}
+        uploaded_by: {type: string, description: Authenticated uploader of an imported document, distinct from the producer the document claims}
+        upload_label: {type: string}
     SupplyChainWarning:
       type: object
       additionalProperties: false
@@ -2513,6 +2574,33 @@ components:
         edges_removed: {type: integer, minimum: 0}
         metadata_changes: {type: array, items: {type: string}}
         notes: {type: array, items: {type: string}}
+    SupplyChainImportResponse:
+      type: object
+      additionalProperties: false
+      required: [import_id, outcome, repeated, snapshot_id, stream, format, component_count, edge_count, warning_count, warnings, notes]
+      properties:
+        import_id: {type: integer, format: int64}
+        outcome: {type: string, enum: [published, unchanged]}
+        repeated: {type: boolean, description: True when identical bytes were already imported into this stream}
+        snapshot_id: {oneOf: [{type: integer, format: int64}, {type: 'null'}]}
+        stream: {type: string}
+        format: {type: string, enum: [spdx-2.3-json, cyclonedx-1.6-json]}
+        component_count: {type: integer, minimum: 0}
+        edge_count: {type: integer, minimum: 0}
+        warning_count: {type: integer, minimum: 0}
+        warnings: {type: array, items: {$ref: '#/components/schemas/SupplyChainWarning'}}
+        subject_assurance: {type: string, enum: [unknown, producer_asserted, verified]}
+        notes: {type: array, items: {type: string}}
+    SupplyChainStreamRef:
+      type: object
+      additionalProperties: false
+      required: [key, producer, subject, has_inventory]
+      properties:
+        key: {type: string}
+        producer: {type: string, enum: [github, import]}
+        subject: {type: string, enum: [source, artifact]}
+        has_inventory: {type: boolean}
+        last_outcome: {type: string}
     SupplyChainComponentList:
       type: object
       additionalProperties: false
diff --git a/internal/httpapi/supply_chain_import.go b/internal/httpapi/supply_chain_import.go
new file mode 100644
index 00000000..cf55c629
--- /dev/null
+++ b/internal/httpapi/supply_chain_import.go
@@ -0,0 +1,105 @@
+package httpapi
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/authn"
+	"github.com/balcsida/graphnest/internal/supplychain"
+)
+
+// UploadGrants manages repository-scoped import permissions. Resolve maps an
+// authorized GitHub repository ID to the internal row for the principal.
+type UploadGrants struct {
+	Set     func(ctx context.Context, repositoryID int64, subject, grantedBy string, allow bool) error
+	Resolve func(ctx context.Context, principal authn.Principal, githubID int64) (int64, error)
+}
+
+// RegisterSupplyChainImports mounts the standards-based import route and the
+// administrator-only upload-grant route.
+//
+//	POST /v1/supply-chain/imports?repository_id=101&subject=source&label=ort[&subject_revision=<sha>]
+//	Content-Type: application/spdx+json | application/vnd.cyclonedx+json | application/json
+func RegisterSupplyChainImports(mux *http.ServeMux, authenticator authn.RequestAuthenticator, importer *supplychain.Importer, grants *UploadGrants, maxUploadBytes, maxResponseBytes int64) {
+	mux.Handle("/v1/supply-chain/imports", exactMethod(http.MethodPost, AuthenticateRequest(authenticator, http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		contentType := strings.ToLower(strings.TrimSpace(strings.Split(request.Header.Get("Content-Type"), ";")[0]))
+		switch contentType {
+		case "application/json", "application/spdx+json", "application/vnd.cyclonedx+json":
+		default:
+			writeError(writer, http.StatusUnsupportedMediaType, "invalid_request", "request is invalid", false)
+			return
+		}
+		query := request.URL.Query()
+		repositoryID, err := strconv.ParseInt(query.Get("repository_id"), 10, 64)
+		if err != nil || repositoryID < 1 || len(query["repository_id"]) != 1 || len(query["subject"]) != 1 || len(query["label"]) != 1 {
+			writeError(writer, http.StatusBadRequest, "invalid_request", "request is invalid", false)
+			return
+		}
+		controller := http.NewResponseController(writer)
+		_ = controller.SetReadDeadline(time.Now().Add(2 * time.Minute))
+		data, err := io.ReadAll(http.MaxBytesReader(writer, request.Body, maxUploadBytes))
+		if err != nil {
+			writeError(writer, invalidRequestStatus(err), "invalid_request", "request is invalid", false)
+			return
+		}
+		response, err := importer.Import(request.Context(), PrincipalFromContext(request.Context()), supplychain.ImportRequest{
+			RepositoryID: repositoryID, Subject: supplychain.Subject(query.Get("subject")), Label: query.Get("label"), SubjectRevision: query.Get("subject_revision"),
+			ContentType: contentType, Document: data,
+		})
+		if err != nil {
+			writeSupplyChainImportError(writer, err)
+			return
+		}
+		writeBoundedJSONStatus(writer, http.StatusCreated, response, maxResponseBytes)
+	}))))
+	if grants == nil {
+		return
+	}
+	mux.Handle("/v1/supply-chain/upload-grants", exactMethod(http.MethodPut, AuthenticateRequest(authenticator, jsonSCIPHandler(4<<10, func(writer http.ResponseWriter, request *http.Request, input struct {
+		RepositoryID int64  `json:"repository_id"`
+		Subject      string `json:"subject"`
+		Allow        bool   `json:"allow"`
+	}) {
+		principal := PrincipalFromContext(request.Context())
+		if !principal.Administrator {
+			writeSupplyChainError(writer, supplychain.ErrForbidden)
+			return
+		}
+		if input.RepositoryID < 1 || input.Subject == "" || len(input.Subject) > 256 {
+			writeError(writer, http.StatusBadRequest, "invalid_request", "request is invalid", false)
+			return
+		}
+		internalID, err := grants.Resolve(request.Context(), principal, input.RepositoryID)
+		if err != nil {
+			writeSupplyChainError(writer, err)
+			return
+		}
+		if err := grants.Set(request.Context(), internalID, input.Subject, principal.Subject, input.Allow); err != nil {
+			writeSupplyChainError(writer, err)
+			return
+		}
+		writer.WriteHeader(http.StatusNoContent)
+	}))))
+}
+
+func writeSupplyChainImportError(writer http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, supplychain.ErrUnsupportedFormat), errors.Is(err, supplychain.ErrUnsupportedVersion):
+		writeError(writer, http.StatusUnsupportedMediaType, "unsupported_format", "only SPDX 2.3 JSON and CycloneDX 1.6 JSON documents are accepted", false)
+	case errors.Is(err, supplychain.ErrMalformed):
+		writeError(writer, http.StatusBadRequest, "malformed_document", "document could not be parsed", false)
+	case errors.Is(err, supplychain.ErrTooLarge), errors.Is(err, supplychain.ErrImportTooLarge):
+		writeError(writer, http.StatusRequestEntityTooLarge, "too_large", "document exceeds the configured limits", false)
+	case errors.Is(err, supplychain.ErrQuotaExceeded):
+		writeError(writer, http.StatusTooManyRequests, "quota_exceeded", "import quota for this repository is exhausted", true)
+	case errors.Is(err, supplychain.ErrForbidden):
+		writeError(writer, http.StatusForbidden, "forbidden", "upload permission for this repository is required", false)
+	default:
+		writeSupplyChainError(writer, err)
+	}
+}
diff --git a/internal/httpapi/supply_chain_portfolio.go b/internal/httpapi/supply_chain_portfolio.go
index 3fbb7c08..889bc943 100644
--- a/internal/httpapi/supply_chain_portfolio.go
+++ b/internal/httpapi/supply_chain_portfolio.go
@@ -13,7 +13,18 @@ import (
 // RegisterSupplyChainPortfolio mounts the cross-repository inventory routes.
 // Authorization scope is resolved from the live principal on every request
 // before any aggregate is computed.
-func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.RequestAuthenticator, portfolio *supplychain.Portfolio, maxResults int, maxResponseBytes int64) {
+// DerivedExport is the optional derived SPDX exporter mounted next to the CSV
+// export under /v1/supply-chain/exports/{id}/derived.spdx.json.
+type DerivedExport struct {
+	Service      *supplychain.Service
+	PublicOrigin string
+}
+
+func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.RequestAuthenticator, portfolio *supplychain.Portfolio, maxResults int, maxResponseBytes int64, derived ...*DerivedExport) {
+	var spdxExport *DerivedExport
+	if len(derived) > 0 {
+		spdxExport = derived[0]
+	}
 	authenticated := func(method string, handle func(http.ResponseWriter, *http.Request)) http.Handler {
 		return exactMethod(method, AuthenticateRequest(authenticator, http.HandlerFunc(handle)))
 	}
@@ -91,7 +102,7 @@ func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.Reques
 		githubID, err := strconv.ParseInt(id, 10, 64)
 		query := request.URL.Query()
 		var snapshotID int64
-		ok := err == nil && githubID > 0 && suffix == "components.csv" && supplychain.ValidStream(query.Get("stream"))
+		ok := err == nil && githubID > 0 && (suffix == "components.csv" || suffix == "derived.spdx.json") && supplychain.ValidStream(query.Get("stream"))
 		if value := query.Get("snapshot_id"); value != "" && ok {
 			snapshotID, err = strconv.ParseInt(value, 10, 64)
 			ok = err == nil && snapshotID > 0
@@ -100,6 +111,14 @@ func RegisterSupplyChainPortfolio(mux *http.ServeMux, authenticator authn.Reques
 			writeError(writer, http.StatusBadRequest, "invalid_request", "request is invalid", false)
 			return
 		}
+		if suffix == "derived.spdx.json" {
+			if spdxExport == nil || spdxExport.Service == nil {
+				writeError(writer, http.StatusNotFound, "not_found", "route not found", false)
+				return
+			}
+			serveDerivedSPDX(writer, request, spdxExport.Service, spdxExport.PublicOrigin, githubID, snapshotID, query.Get("stream"), maxResponseBytes)
+			return
+		}
 		var buffer bytes.Buffer
 		snapshot, err := portfolio.ExportCSV(request.Context(), PrincipalFromContext(request.Context()), githubID, query.Get("stream"), snapshotID, &buffer)
 		if err != nil {
@@ -152,3 +171,29 @@ func repositoryIDsFrom(values []string) ([]int64, bool) {
 	}
 	return ids, true
 }
+
+// serveDerivedSPDX writes the derived SPDX export for one authorized snapshot.
+func serveDerivedSPDX(writer http.ResponseWriter, request *http.Request, service *supplychain.Service, publicOrigin string, githubID, snapshotID int64, stream string, maxResponseBytes int64) {
+	origin := publicOrigin
+	if origin == "" {
+		origin = "https://graphnest.invalid"
+	}
+	document, snapshot, err := service.ExportSPDX(request.Context(), PrincipalFromContext(request.Context()), githubID, stream, snapshotID, origin)
+	if err != nil {
+		writeSupplyChainError(writer, err)
+		return
+	}
+	if int64(len(document)) > maxResponseBytes*64 {
+		writeError(writer, http.StatusRequestEntityTooLarge, "too_large", "export exceeds the response limit", false)
+		return
+	}
+	writer.Header().Set("Content-Type", "application/spdx+json")
+	writer.Header().Set("X-Content-Type-Options", "nosniff")
+	writer.Header().Set("Cache-Control", "private, no-store")
+	writer.Header().Set("Content-Disposition", `attachment; filename="graphnest-derived-repo`+strconv.FormatInt(snapshot.RepositoryID, 10)+`-snapshot`+strconv.FormatInt(snapshot.ID, 10)+`.spdx.json"`)
+	writer.Header().Set("X-GraphNest-Snapshot-ID", strconv.FormatInt(snapshot.ID, 10))
+	writer.Header().Set("X-GraphNest-Derived", "true")
+	writer.Header().Set("Content-Length", strconv.Itoa(len(document)))
+	writer.WriteHeader(http.StatusOK)
+	_, _ = writer.Write(document)
+}
diff --git a/internal/postgres/migrations/035_supply_chain_import.sql b/internal/postgres/migrations/035_supply_chain_import.sql
new file mode 100644
index 00000000..5f8fa9c6
--- /dev/null
+++ b/internal/postgres/migrations/035_supply_chain_import.sql
@@ -0,0 +1,38 @@
+-- Standards-based imports (ADR-0017, Milestone 4). The uploader's identity is
+-- recorded separately from whatever producer the document claims, and the
+-- subject binding is recorded only at the assurance level actually
+-- established (an uploader's assertion is producer_asserted, never verified).
+alter table supply_chain_snapshots
+    add column uploaded_by varchar(256) not null default '',
+    add column upload_label varchar(64) not null default '';
+
+-- Import idempotency and quota: one row per accepted or rejected upload
+-- attempt, keyed by document hash within a repository stream.
+create table supply_chain_imports (
+    id bigint generated always as identity primary key,
+    repository_id bigint not null references repositories(id) on delete cascade,
+    stream_key varchar(200) not null,
+    document_sha256 bytea not null check (octet_length(document_sha256) = 32),
+    format varchar(32) not null check (format in ('spdx-2.3-json', 'cyclonedx-1.6-json')),
+    uploaded_by varchar(256) not null,
+    upload_label varchar(64) not null default '',
+    byte_size bigint not null check (byte_size >= 0),
+    outcome varchar(16) not null check (outcome in ('published', 'unchanged', 'rejected')),
+    snapshot_id bigint references supply_chain_snapshots(id) on delete set null,
+    error_code varchar(64) not null default '',
+    message text not null default '',
+    created_at timestamptz not null default now()
+);
+create index supply_chain_imports_stream on supply_chain_imports (repository_id, stream_key, id desc);
+create index supply_chain_imports_quota on supply_chain_imports (repository_id, created_at desc);
+
+-- Repository-scoped upload permission: which principals (users, by external
+-- identity subject) may import into which repositories. Administrators need
+-- no grant. Empty by default.
+create table supply_chain_upload_grants (
+    repository_id bigint not null references repositories(id) on delete cascade,
+    subject varchar(256) not null,
+    granted_by varchar(256) not null,
+    created_at timestamptz not null default now(),
+    primary key (repository_id, subject)
+);
diff --git a/internal/postgres/supply_chain.go b/internal/postgres/supply_chain.go
index 4c22cbc0..600af1b6 100644
--- a/internal/postgres/supply_chain.go
+++ b/internal/postgres/supply_chain.go
@@ -222,11 +222,11 @@ func insertSupplyChainSnapshot(ctx context.Context, tx pgx.Tx, publication Suppl
 	var snapshotID int64
 	if err := tx.QueryRow(ctx, `insert into supply_chain_snapshots (repository_id, document_id, producer, subject, stream_key, collected_at, created_at_claimed,
 			producer_tool, document_namespace, document_name, spdx_version, data_license, subject_revision, subject_assurance, root_element_ids,
-			parser_version, component_count, edge_count, warning_count, warnings)
-		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20) returning id`,
+			parser_version, component_count, edge_count, warning_count, warnings, uploaded_by, upload_label)
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22) returning id`,
 		publication.RepositoryID, documentID, string(publication.Producer), string(publication.Subject), publication.StreamKey, publication.CollectedAt.UTC(), normalized.CreatedAtClaimed,
 		normalized.ProducerTool, normalized.DocumentNamespace, normalized.DocumentName, normalized.SPDXVersion, normalized.DataLicense, revision, string(assurance), roots,
-		supplychain.ParserVersion, len(normalized.Components), len(normalized.Relationships), normalized.WarningCount, warnings).Scan(&snapshotID); err != nil {
+		supplychain.ParserVersion, len(normalized.Components), len(normalized.Relationships), normalized.WarningCount, warnings, publication.UploadedBy, publication.UploadLabel).Scan(&snapshotID); err != nil {
 		return 0, err
 	}
 	if _, err := tx.CopyFrom(ctx, pgx.Identifier{"supply_chain_components"},
@@ -396,7 +396,8 @@ func (s *Store) SupplyChainStream(ctx context.Context, repositoryID int64, strea
 
 const supplyChainSnapshotColumns = `snap.id, snap.repository_id, snap.document_id, snap.producer, snap.subject, snap.stream_key, snap.collected_at, snap.created_at_claimed,
 	snap.producer_tool, snap.document_namespace, snap.document_name, snap.spdx_version, snap.data_license, coalesce(snap.subject_revision, ''), snap.subject_assurance,
-	snap.root_element_ids, snap.parser_version, snap.component_count, snap.edge_count, snap.warning_count, snap.warnings, snap.published_at, doc.sha256, doc.format, doc.byte_size`
+	snap.root_element_ids, snap.parser_version, snap.component_count, snap.edge_count, snap.warning_count, snap.warnings, snap.published_at, doc.sha256, doc.format, doc.byte_size,
+	snap.uploaded_by, snap.upload_label`
 
 func scanSupplyChainSnapshot(row interface{ Scan(...any) error }) (supplychain.Snapshot, error) {
 	var snapshot supplychain.Snapshot
@@ -405,7 +406,7 @@ func scanSupplyChainSnapshot(row interface{ Scan(...any) error }) (supplychain.S
 	err := row.Scan(&snapshot.ID, &snapshot.RepositoryID, &snapshot.DocumentID, &producer, &subject, &snapshot.StreamKey, &snapshot.CollectedAt, &snapshot.CreatedAtClaimed,
 		&snapshot.ProducerTool, &snapshot.DocumentNamespace, &snapshot.DocumentName, &snapshot.SPDXVersion, &snapshot.DataLicense, &snapshot.SubjectRevision, &assurance,
 		&snapshot.RootElementIDs, &snapshot.ParserVersion, &snapshot.ComponentCount, &snapshot.EdgeCount, &snapshot.WarningCount, &warnings, &snapshot.PublishedAt,
-		&snapshot.DocumentSHA256, &format, &snapshot.DocumentBytes)
+		&snapshot.DocumentSHA256, &format, &snapshot.DocumentBytes, &snapshot.UploadedBy, &snapshot.UploadLabel)
 	if err != nil {
 		return supplychain.Snapshot{}, err
 	}
diff --git a/internal/postgres/supply_chain_import.go b/internal/postgres/supply_chain_import.go
new file mode 100644
index 00000000..3f4bd184
--- /dev/null
+++ b/internal/postgres/supply_chain_import.go
@@ -0,0 +1,77 @@
+package postgres
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/supplychain"
+	"github.com/jackc/pgx/v5"
+)
+
+// SupplyChainUploadAllowed reports whether a non-administrator subject holds
+// an upload grant for the repository.
+func (s *Store) SupplyChainUploadAllowed(ctx context.Context, repositoryID int64, subject string) (bool, error) {
+	var allowed bool
+	err := s.pool.QueryRow(ctx, `select exists(select 1 from supply_chain_upload_grants where repository_id=$1 and subject=$2)`, repositoryID, subject).Scan(&allowed)
+	return allowed, err
+}
+
+// SetSupplyChainUploadGrant adds or removes a repository-scoped upload grant.
+func (s *Store) SetSupplyChainUploadGrant(ctx context.Context, repositoryID int64, subject, grantedBy string, allow bool) error {
+	if !allow {
+		_, err := s.pool.Exec(ctx, `delete from supply_chain_upload_grants where repository_id=$1 and subject=$2`, repositoryID, subject)
+		return err
+	}
+	_, err := s.pool.Exec(ctx, `insert into supply_chain_upload_grants (repository_id, subject, granted_by) values ($1, $2, $3) on conflict do nothing`, repositoryID, subject, grantedBy)
+	return err
+}
+
+func (s *Store) SupplyChainImportCount(ctx context.Context, repositoryID int64, since time.Time) (int, error) {
+	var count int
+	err := s.pool.QueryRow(ctx, `select count(*) from supply_chain_imports where repository_id=$1 and created_at>=$2`, repositoryID, since).Scan(&count)
+	return count, err
+}
+
+func (s *Store) SupplyChainImportByDigest(ctx context.Context, repositoryID int64, streamKey string, digest []byte) (supplychain.ImportRecord, bool, error) {
+	var record supplychain.ImportRecord
+	var format string
+	err := s.pool.QueryRow(ctx, `select id, repository_id, stream_key, document_sha256, format, uploaded_by, upload_label, byte_size, outcome, snapshot_id, error_code, message, created_at
+		from supply_chain_imports where repository_id=$1 and stream_key=$2 and document_sha256=$3 order by id desc limit 1`, repositoryID, streamKey, digest).
+		Scan(&record.ID, &record.RepositoryID, &record.StreamKey, &record.DocumentSHA256, &format, &record.UploadedBy, &record.UploadLabel, &record.ByteSize, &record.Outcome, &record.SnapshotID, &record.ErrorCode, &record.Message, &record.CreatedAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return supplychain.ImportRecord{}, false, nil
+	}
+	record.Format = supplychain.Format(format)
+	return record, err == nil, err
+}
+
+func (s *Store) RecordSupplyChainImport(ctx context.Context, record supplychain.ImportRecord) (int64, error) {
+	var id int64
+	err := s.pool.QueryRow(ctx, `insert into supply_chain_imports (repository_id, stream_key, document_sha256, format, uploaded_by, upload_label, byte_size, outcome, snapshot_id, error_code, message)
+		values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) returning id`, record.RepositoryID, record.StreamKey, record.DocumentSHA256, string(record.Format), record.UploadedBy, record.UploadLabel,
+		record.ByteSize, record.Outcome, record.SnapshotID, record.ErrorCode, record.Message).Scan(&id)
+	return id, err
+}
+
+// SupplyChainStreams lists the streams that exist for a repository so the UI
+// can offer producer/subject selection.
+func (s *Store) SupplyChainStreams(ctx context.Context, repositoryID int64) ([]supplychain.Stream, error) {
+	rows, err := s.pool.Query(ctx, `select repository_id, stream_key, producer, subject, latest_snapshot_id, latest_collection_id, last_success_at, last_attempt_at, last_outcome, opt_out
+		from supply_chain_streams where repository_id=$1 order by stream_key`, repositoryID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	streams := []supplychain.Stream{}
+	for rows.Next() {
+		var stream supplychain.Stream
+		var outcome string
+		if err := rows.Scan(&stream.RepositoryID, &stream.StreamKey, &stream.Producer, &stream.Subject, &stream.LatestSnapshotID, &stream.LatestCollectionID, &stream.LastSuccessAt, &stream.LastAttemptAt, &outcome, &stream.OptOut); err != nil {
+			return nil, err
+		}
+		stream.LastOutcome = supplychain.Outcome(outcome)
+		streams = append(streams, stream)
+	}
+	return streams, rows.Err()
+}
diff --git a/internal/supplychain/cyclonedx.go b/internal/supplychain/cyclonedx.go
new file mode 100644
index 00000000..e2933250
--- /dev/null
+++ b/internal/supplychain/cyclonedx.go
@@ -0,0 +1,325 @@
+package supplychain
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// FormatCycloneDX16JSON is the CycloneDX 1.6 JSON document format.
+const FormatCycloneDX16JSON Format = "cyclonedx-1.6-json"
+
+// cdxLicenseChoice decodes the CycloneDX licenses array, which is either a list
+// of {license:{id|name,url}} objects or a single {expression} object.
+type cdxLicenseChoice struct {
+	License *struct {
+		ID   string `json:"id"`
+		Name string `json:"name"`
+		URL  string `json:"url"`
+		Text *struct {
+			Content string `json:"content"`
+		} `json:"text"`
+		Acknowledgement string `json:"acknowledgement"`
+	} `json:"license"`
+	Expression      string `json:"expression"`
+	Acknowledgement string `json:"acknowledgement"`
+}
+
+type cdxComponent struct {
+	Type     string                 `json:"type"`
+	BOMRef   string                 `json:"bom-ref"`
+	Group    string                 `json:"group"`
+	Name     string                 `json:"name"`
+	Version  *string                `json:"version"`
+	PURL     string                 `json:"purl"`
+	Supplier *struct{ Name string } `json:"supplier"`
+	Hashes   []struct {
+		Alg     string `json:"alg"`
+		Content string `json:"content"`
+	} `json:"hashes"`
+	Licenses   []cdxLicenseChoice `json:"licenses"`
+	Components []cdxComponent     `json:"components"`
+	Evidence   json.RawMessage    `json:"evidence"`
+}
+
+type cdxDocument struct {
+	BOMFormat    string `json:"bomFormat"`
+	SpecVersion  string `json:"specVersion"`
+	SerialNumber string `json:"serialNumber"`
+	Version      int    `json:"version"`
+	Metadata     struct {
+		Timestamp string          `json:"timestamp"`
+		Tools     json.RawMessage `json:"tools"`
+		Component *cdxComponent   `json:"component"`
+	} `json:"metadata"`
+	Components   []cdxComponent `json:"components"`
+	Dependencies []struct {
+		Ref       string   `json:"ref"`
+		DependsOn []string `json:"dependsOn"`
+		Provides  []string `json:"provides"`
+	} `json:"dependencies"`
+}
+
+// NormalizeCycloneDX16 turns a CycloneDX 1.6 JSON BOM into snapshot content.
+// The metadata.component (if any) is the root; nested components are
+// flattened into occurrences with a CONTAINS edge from their parent;
+// dependencies become DEPENDS_ON edges; license choices are recorded verbatim
+// (an expression, an SPDX id, or a name/url) so nothing is invented.
+func NormalizeCycloneDX16(document []byte, limits Limits) (Normalized, error) {
+	limits = limits.withDefaults()
+	decoder := json.NewDecoder(bytes.NewReader(document))
+	var parsed cdxDocument
+	if err := decoder.Decode(&parsed); err != nil {
+		return Normalized{}, fmt.Errorf("%w: %v", ErrMalformed, safeJSONError(err))
+	}
+	if err := decoder.Decode(&struct{}{}); !errors.Is(err, io.EOF) {
+		return Normalized{}, fmt.Errorf("%w: trailing content", ErrMalformed)
+	}
+	if parsed.BOMFormat != "CycloneDX" {
+		return Normalized{}, fmt.Errorf("%w: bomFormat is not CycloneDX", ErrMalformed)
+	}
+	if parsed.SpecVersion != "1.6" {
+		if parsed.SpecVersion == "" {
+			return Normalized{}, fmt.Errorf("%w: missing specVersion", ErrMalformed)
+		}
+		return Normalized{}, fmt.Errorf("%w: CycloneDX %s", ErrUnsupportedVersion, sanitize(parsed.SpecVersion, 16))
+	}
+	result := Normalized{SPDXVersion: "CycloneDX-1.6", DocumentNamespace: parsed.SerialNumber, DocumentSPDXID: "CycloneDX-BOM"}
+	if parsed.Version > 0 {
+		result.DocumentNamespace = strings.TrimSpace(parsed.SerialNumber + "#" + strconv.Itoa(parsed.Version))
+	}
+	warn := func(code, element, detail string) {
+		result.WarningCount++
+		if len(result.Warnings) < limits.MaxWarnings {
+			result.Warnings = append(result.Warnings, Warning{Code: code, Element: sanitize(element, 200), Detail: sanitize(detail, 200)})
+		}
+	}
+	if parsed.Metadata.Timestamp != "" {
+		if created, err := time.Parse(time.RFC3339, parsed.Metadata.Timestamp); err == nil {
+			utc := created.UTC()
+			result.CreatedAtClaimed = &utc
+		} else {
+			warn("created_invalid", "", "metadata.timestamp is not RFC 3339")
+		}
+	} else {
+		warn("created_missing", "", "metadata.timestamp is missing")
+	}
+	result.ProducerTool = cdxTool(parsed.Metadata.Tools)
+	if result.ProducerTool == "" {
+		warn("creator_tool_missing", "", "metadata.tools names no tool")
+	}
+
+	elements := map[string]int{}
+	var flatten func(component cdxComponent, parent string, depth int)
+	ordinal := 0
+	overflow := false
+	flatten = func(component cdxComponent, parent string, depth int) {
+		if len(result.Components) >= limits.MaxComponents {
+			overflow = true
+			return
+		}
+		elementID := component.BOMRef
+		if elementID == "" {
+			elementID = "graphnest-bomref-missing-" + strconv.Itoa(ordinal)
+			warn("package_id_missing", elementID, "component has no bom-ref; a synthetic document-local ID was assigned")
+		}
+		if _, duplicate := elements[elementID]; duplicate {
+			original := elementID
+			elementID = elementID + "#graphnest-duplicate-" + strconv.Itoa(ordinal)
+			warn("package_id_duplicate", original, "duplicate bom-ref kept as a separate occurrence under "+elementID)
+		}
+		occurrence := Component{Ordinal: ordinal, ElementID: elementID, Name: component.Name, Version: component.Version, Qualifiers: map[string]string{}}
+		if component.Group != "" {
+			occurrence.Name = component.Group + "/" + component.Name
+		}
+		if component.Name == "" {
+			occurrence.Name = elementID
+			warn("package_name_missing", elementID, "component has no name; its bom-ref is shown instead")
+		}
+		if component.Version == nil || *component.Version == "" {
+			warn("package_version_missing", elementID, "component has no version")
+		}
+		if component.Type != "" && component.Type != "library" && component.Type != "application" && component.Type != "framework" {
+			occurrence.Qualifiers["cdx:type"] = component.Type
+		}
+		if component.Supplier != nil && component.Supplier.Name != "" {
+			supplier := component.Supplier.Name
+			occurrence.Supplier = &supplier
+		}
+		for _, hash := range component.Hashes {
+			if hash.Alg != "" && hash.Content != "" {
+				occurrence.Checksums = append(occurrence.Checksums, Checksum{Algorithm: hash.Alg, Value: hash.Content})
+			}
+		}
+		if component.PURL != "" {
+			locator := component.PURL
+			occurrence.PURL = &locator
+			if purl, err := ParsePURL(component.PURL); err == nil {
+				occurrence.Ecosystem, occurrence.PURLNamespace, occurrence.PURLName, occurrence.PURLVersion = purl.Type, purl.Namespace, purl.Name, purl.Version
+				for key, value := range purl.Qualifiers {
+					occurrence.Qualifiers[key] = value
+				}
+				if occurrence.Version != nil && purl.Version != "" && *occurrence.Version != purl.Version {
+					warn("package_version_mismatch", elementID, "version differs from the purl version; both are kept")
+				}
+			} else {
+				warn("package_purl_invalid", elementID, "purl could not be parsed and is kept verbatim")
+			}
+		} else {
+			warn("package_purl_missing", elementID, "component has no purl")
+		}
+		if declared, ok := cdxLicenses(component.Licenses, elementID, warn); ok {
+			occurrence.LicenseDeclaredRaw = &declared
+		}
+		if len(component.Evidence) > 0 {
+			warn("evidence_not_carried", elementID, "component evidence (license/copyright/occurrences) is retained only in the stored original document")
+		}
+		elements[elementID] = len(result.Components)
+		result.Components = append(result.Components, occurrence)
+		ordinal++
+		for _, child := range component.Components {
+			if depth >= 32 {
+				warn("nesting_depth_exceeded", elementID, "nested components beyond depth 32 were not flattened")
+				break
+			}
+			childBefore := len(result.Components)
+			flatten(child, elementID, depth+1)
+			if len(result.Components) > childBefore {
+				result.Relationships = append(result.Relationships, Relationship{FromElement: elementID, Type: "CONTAINS", ToElement: result.Components[childBefore].ElementID, Resolved: true})
+			}
+		}
+	}
+	if parsed.Metadata.Component != nil {
+		flatten(*parsed.Metadata.Component, "", 0)
+		if len(result.Components) > 0 {
+			result.Components[0].IsRoot = true
+			result.RootElementIDs = append(result.RootElementIDs, result.Components[0].ElementID)
+			result.DocumentName = result.Components[0].Name
+		}
+	}
+	if len(parsed.Components) > limits.MaxComponents {
+		return Normalized{}, fmt.Errorf("%w: %d components exceed the %d limit", ErrTooLarge, len(parsed.Components), limits.MaxComponents)
+	}
+	for _, component := range parsed.Components {
+		flatten(component, "", 0)
+	}
+	if overflow || len(result.Components) > limits.MaxComponents {
+		return Normalized{}, fmt.Errorf("%w: flattened components exceed the %d limit", ErrTooLarge, limits.MaxComponents)
+	}
+	if len(parsed.Dependencies) > limits.MaxRelationships {
+		return Normalized{}, fmt.Errorf("%w: %d dependencies exceed the %d limit", ErrTooLarge, len(parsed.Dependencies), limits.MaxRelationships)
+	}
+	edgeCount := len(result.Relationships)
+	for _, dependency := range parsed.Dependencies {
+		_, fromKnown := elements[dependency.Ref]
+		if !fromKnown {
+			warn("relationship_unresolved", dependency.Ref, "dependencies entry references a bom-ref that is not a component")
+		}
+		for _, target := range dependency.DependsOn {
+			_, toKnown := elements[target]
+			resolved := fromKnown && toKnown
+			if !resolved && fromKnown {
+				warn("relationship_unresolved", dependency.Ref, "dependsOn references a bom-ref that is not a component")
+			}
+			result.Relationships = append(result.Relationships, Relationship{FromElement: dependency.Ref, Type: "DEPENDS_ON", ToElement: target, Resolved: resolved})
+			edgeCount++
+			if edgeCount > limits.MaxRelationships {
+				return Normalized{}, fmt.Errorf("%w: dependency edges exceed the %d limit", ErrTooLarge, limits.MaxRelationships)
+			}
+		}
+		for _, target := range dependency.Provides {
+			_, toKnown := elements[target]
+			result.Relationships = append(result.Relationships, Relationship{FromElement: dependency.Ref, Type: "PROVIDES", ToElement: target, Resolved: fromKnown && toKnown})
+		}
+	}
+	if len(result.RootElementIDs) == 0 {
+		warn("root_missing", "", "metadata.component is absent; dependency scope (direct vs transitive) is unavailable")
+	}
+	if result.Components == nil {
+		result.Components = []Component{}
+	}
+	if result.Relationships == nil {
+		result.Relationships = []Relationship{}
+	}
+	return result, nil
+}
+
+// cdxLicenses renders the licenses array as one raw declaration string with
+// only the semantics the format carries: a single expression or SPDX id is
+// kept as written. CycloneDX defines no conjunction for several license
+// objects, so a list is kept semicolon-separated (which the expression parser
+// reports as invalid) with a warning naming the ambiguity. Names and URLs stay
+// names and URLs.
+func cdxLicenses(choices []cdxLicenseChoice, element string, warn func(code, element, detail string)) (string, bool) {
+	if len(choices) == 0 {
+		return "", false
+	}
+	var parts []string
+	for _, choice := range choices {
+		switch {
+		case choice.Expression != "":
+			parts = append(parts, choice.Expression)
+		case choice.License != nil && choice.License.ID != "":
+			parts = append(parts, choice.License.ID)
+		case choice.License != nil && choice.License.Name != "":
+			name := choice.License.Name
+			if choice.License.URL != "" {
+				name += " (" + choice.License.URL + ")"
+			}
+			parts = append(parts, name)
+			warn("license_name_not_spdx", element, "license is declared by name/url rather than an SPDX id or expression")
+		case choice.License != nil && choice.License.URL != "":
+			parts = append(parts, choice.License.URL)
+			warn("license_url_only", element, "license is declared by URL only")
+		case choice.License != nil && choice.License.Text != nil:
+			parts = append(parts, "LicenseRef-graphnest-inline-text")
+			warn("license_text_inline", element, "license is declared by inline text; the text is retained only in the stored original document")
+		}
+		if (choice.License != nil && choice.License.Acknowledgement != "") || choice.Acknowledgement != "" {
+			acknowledgement := choice.Acknowledgement
+			if acknowledgement == "" {
+				acknowledgement = choice.License.Acknowledgement
+			}
+			warn("license_acknowledgement", element, "license acknowledgement is "+acknowledgement)
+		}
+	}
+	if len(parts) == 0 {
+		return "", false
+	}
+	if len(parts) > 1 {
+		warn("license_list_ambiguous", element, "several license objects have no defined AND/OR meaning in CycloneDX; the list is kept without invented structure")
+		return strings.Join(parts, "; "), true
+	}
+	return parts[0], true
+}
+
+// cdxTool extracts the first tool name/version from either the 1.5+ object
+// form or the legacy array form.
+func cdxTool(raw json.RawMessage) string {
+	if len(raw) == 0 {
+		return ""
+	}
+	var object struct {
+		Components []struct {
+			Name    string `json:"name"`
+			Version string `json:"version"`
+		} `json:"components"`
+	}
+	if err := json.Unmarshal(raw, &object); err == nil && len(object.Components) > 0 {
+		return strings.TrimSpace(object.Components[0].Name + " " + object.Components[0].Version)
+	}
+	var legacy []struct {
+		Vendor  string `json:"vendor"`
+		Name    string `json:"name"`
+		Version string `json:"version"`
+	}
+	if err := json.Unmarshal(raw, &legacy); err == nil && len(legacy) > 0 {
+		return strings.TrimSpace(strings.TrimSpace(legacy[0].Vendor+" "+legacy[0].Name) + " " + legacy[0].Version)
+	}
+	return ""
+}
diff --git a/internal/supplychain/cyclonedx_test.go b/internal/supplychain/cyclonedx_test.go
new file mode 100644
index 00000000..0826b903
--- /dev/null
+++ b/internal/supplychain/cyclonedx_test.go
@@ -0,0 +1,142 @@
+package supplychain
+
+import (
+	"errors"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+func cdxFixture(t *testing.T) []byte {
+	t.Helper()
+	data, err := os.ReadFile("../../test/fixtures/supplychain/syft-cyclonedx-1.6.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func TestNormalizeCycloneDX16PreservesWhatTheFormatCarries(t *testing.T) {
+	got, err := NormalizeCycloneDX16(cdxFixture(t), Limits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.SPDXVersion != "CycloneDX-1.6" || got.ProducerTool != "syft 1.20.0" || got.DocumentNamespace != "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79#1" || got.DocumentName != "registry.example.internal/acme/widgets" {
+		t.Fatalf("header = %+v", got)
+	}
+	if got.CreatedAtClaimed == nil || !got.CreatedAtClaimed.Equal(time.Date(2026, 9, 21, 14, 3, 11, 0, time.UTC)) {
+		t.Fatalf("created = %v", got.CreatedAtClaimed)
+	}
+	// root + 6 top-level + 1 nested = 8 occurrences; the file component without bom-ref survives with a synthetic ID.
+	if len(got.Components) != 8 || !got.Components[0].IsRoot || got.RootElementIDs[0] != "graphnest-fixture-root" || got.Components[0].Qualifiers["cdx:type"] != "container" {
+		t.Fatalf("components = %d roots=%v", len(got.Components), got.RootElementIDs)
+	}
+	byElement := map[string]Component{}
+	for _, component := range got.Components {
+		byElement[component.ElementID] = component
+	}
+	leftPad := byElement["pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c"]
+	if leftPad.Ecosystem != "npm" || leftPad.PURLNamespace != "@scope" || leftPad.PURLName != "left-pad" || *leftPad.LicenseDeclaredRaw != "MIT" || len(leftPad.Checksums) != 1 || leftPad.Checksums[0].Algorithm != "SHA-512" || leftPad.Name != "@scope/left-pad" {
+		t.Fatalf("left-pad = %+v", leftPad)
+	}
+	if *byElement["pkg:npm/dual@2.0.0?package-id=2b3c4d"].LicenseDeclaredRaw != "(MIT OR Apache-2.0)" {
+		t.Fatalf("expression must be kept verbatim: %+v", byElement["pkg:npm/dual@2.0.0?package-id=2b3c4d"])
+	}
+	libssl := byElement["pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12&package-id=3c4d5e"]
+	if *libssl.LicenseDeclaredRaw != "OpenSSL; Apache-2.0" || libssl.Qualifiers["arch"] != "amd64" || libssl.Qualifiers["distro"] != "debian-12" || libssl.Supplier == nil {
+		t.Fatalf("libssl = %+v", libssl)
+	}
+	nested := byElement["pkg:npm/nested-helper@0.1.0?package-id=5e6f7a"]
+	if *nested.LicenseDeclaredRaw != "Custom Acme License (https://acme.example.internal/license)" {
+		t.Fatalf("nested = %+v", nested)
+	}
+	var synthetic *Component
+	for _, component := range got.Components {
+		if strings.HasPrefix(component.ElementID, "graphnest-bomref-missing-") {
+			synthetic = &component
+		}
+	}
+	if synthetic == nil || synthetic.PURL != nil || synthetic.Name != "/app/config/settings.yaml" || synthetic.Qualifiers["cdx:type"] != "file" {
+		t.Fatalf("bom-ref-less component = %+v", synthetic)
+	}
+	// Edges: 1 CONTAINS (bundle -> nested), 4 + 1 + 2 DEPENDS_ON = 8 total; the missing target is unresolved.
+	edges := map[string]int{}
+	unresolved := 0
+	for _, edge := range got.Relationships {
+		edges[edge.Type]++
+		if !edge.Resolved {
+			unresolved++
+		}
+	}
+	if edges["CONTAINS"] != 1 || edges["DEPENDS_ON"] != 7 || unresolved != 1 {
+		t.Fatalf("edges = %v unresolved=%d", edges, unresolved)
+	}
+	codes := warningCodes(got.Warnings)
+	if codes["license_list_ambiguous"] != 1 || codes["license_name_not_spdx"] != 2 || codes["evidence_not_carried"] != 1 || codes["relationship_unresolved"] != 1 || codes["package_id_missing"] != 1 || codes["license_acknowledgement"] != 1 || codes["package_purl_missing"] != 3 {
+		t.Fatalf("warnings = %v", codes)
+	}
+}
+
+func TestNormalizeCycloneDX16Rejects(t *testing.T) {
+	cases := map[string]struct {
+		document string
+		limits   Limits
+		want     error
+	}{
+		"not json":        {document: `{"bomFormat"`, want: ErrMalformed},
+		"wrong format":    {document: `{"bomFormat":"SPDX","specVersion":"1.6"}`, want: ErrMalformed},
+		"old version":     {document: `{"bomFormat":"CycloneDX","specVersion":"1.4"}`, want: ErrUnsupportedVersion},
+		"missing version": {document: `{"bomFormat":"CycloneDX"}`, want: ErrMalformed},
+		"trailing":        {document: `{"bomFormat":"CycloneDX","specVersion":"1.6"} x`, want: ErrMalformed},
+		"too many":        {document: `{"bomFormat":"CycloneDX","specVersion":"1.6","components":[{"type":"library","name":"a"},{"type":"library","name":"b"}]}`, limits: Limits{MaxComponents: 1}, want: ErrTooLarge},
+		"nested too many": {document: `{"bomFormat":"CycloneDX","specVersion":"1.6","components":[{"type":"library","name":"a","components":[{"type":"library","name":"b"},{"type":"library","name":"c"}]}]}`, limits: Limits{MaxComponents: 2}, want: ErrTooLarge},
+	}
+	for name, test := range cases {
+		t.Run(name, func(t *testing.T) {
+			_, err := NormalizeCycloneDX16([]byte(test.document), test.limits)
+			if !errors.Is(err, test.want) {
+				t.Fatalf("error = %v, want %v", err, test.want)
+			}
+		})
+	}
+}
+
+func TestNormalizeCycloneDX16EmptyAndLegacyTools(t *testing.T) {
+	got, err := NormalizeCycloneDX16([]byte(`{"bomFormat":"CycloneDX","specVersion":"1.6","metadata":{"timestamp":"2026-01-01T00:00:00Z","tools":[{"vendor":"OSS Review Toolkit","name":"ort","version":"45.0.0"}]},"components":[],"dependencies":[]}`), Limits{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ProducerTool != "OSS Review Toolkit ort 45.0.0" || len(got.Components) != 0 || len(got.Relationships) != 0 || warningCodes(got.Warnings)["root_missing"] != 1 {
+		t.Fatalf("legacy tools = %+v", got)
+	}
+}
+
+func FuzzNormalizeCycloneDX16(f *testing.F) {
+	f.Add(string(mustRead(f, "../../test/fixtures/supplychain/syft-cyclonedx-1.6.json")))
+	f.Add(`{"bomFormat":"CycloneDX","specVersion":"1.6"}`)
+	f.Fuzz(func(t *testing.T, document string) {
+		got, err := NormalizeCycloneDX16([]byte(document), Limits{MaxComponents: 200, MaxRelationships: 2000})
+		if err != nil {
+			return
+		}
+		if len(got.Components) > 200 {
+			t.Fatalf("components exceeded the limit: %d", len(got.Components))
+		}
+		seen := map[string]bool{}
+		for _, component := range got.Components {
+			if seen[component.ElementID] {
+				t.Fatalf("duplicate element id %q", component.ElementID)
+			}
+			seen[component.ElementID] = true
+		}
+	})
+}
+
+func mustRead(f *testing.F, path string) []byte {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		f.Fatal(err)
+	}
+	return data
+}
diff --git a/internal/supplychain/importer.go b/internal/supplychain/importer.go
new file mode 100644
index 00000000..3697a65b
--- /dev/null
+++ b/internal/supplychain/importer.go
@@ -0,0 +1,246 @@
+package supplychain
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/authn"
+	"github.com/balcsida/graphnest/pkg/api"
+	"github.com/jackc/pgx/v5"
+)
+
+var (
+	ErrUnsupportedFormat = errors.New("unsupported_format")
+	ErrQuotaExceeded     = errors.New("quota_exceeded")
+	ErrImportTooLarge    = errors.New("import_too_large")
+)
+
+// ImportStore is the persistence the importer needs beyond Store.
+type ImportStore interface {
+	SupplyChainUploadAllowed(ctx context.Context, repositoryID int64, subject string) (bool, error)
+	SupplyChainImportCount(ctx context.Context, repositoryID int64, since time.Time) (int, error)
+	SupplyChainImportByDigest(ctx context.Context, repositoryID int64, streamKey string, digest []byte) (ImportRecord, bool, error)
+	RecordSupplyChainImport(ctx context.Context, record ImportRecord) (int64, error)
+	PublishSupplyChainSnapshot(ctx context.Context, publication Publication) (Collection, error)
+	ProjectSupplyChainPackages(ctx context.Context, repositoryID, snapshotID int64) (int, error)
+}
+
+// ImportRecord is one upload attempt.
+type ImportRecord struct {
+	ID             int64
+	RepositoryID   int64
+	StreamKey      string
+	DocumentSHA256 []byte
+	Format         Format
+	UploadedBy     string
+	UploadLabel    string
+	ByteSize       int64
+	Outcome        string
+	SnapshotID     *int64
+	ErrorCode      string
+	Message        string
+	CreatedAt      time.Time
+}
+
+// ImportRequest is an authenticated upload of an SBOM produced elsewhere.
+type ImportRequest struct {
+	RepositoryID int64 // GitHub ID
+	// Subject is "source" or "artifact"; Label distinguishes streams of the
+	// same subject (e.g. "ort", "syft-image"). Stream key: import:<subject>:<label>.
+	Subject Subject
+	Label   string
+	// SubjectRevision is the uploader's claim of the source commit the document
+	// describes. It is recorded as producer_asserted, never verified.
+	SubjectRevision string
+	ContentType     string
+	Document        []byte
+}
+
+// Importer accepts SPDX 2.3 JSON and CycloneDX 1.6 JSON uploads into
+// import streams. Documents are preserved byte-for-byte; publication reuses
+// the same atomic path as GitHub collection.
+type Importer struct {
+	Store            ImportStore
+	Authorizer       Authorizer
+	Enricher         Enricher
+	MaxDocumentBytes int64
+	Limits           Limits
+	// QuotaPerRepository bounds imports per repository per QuotaWindow.
+	QuotaPerRepository int
+	QuotaWindow        time.Duration
+	Now                func() time.Time
+}
+
+var labelPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,63}$`)
+var shaPattern = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
+func (importer *Importer) now() time.Time {
+	if importer.Now != nil {
+		return importer.Now().UTC()
+	}
+	return time.Now().UTC()
+}
+
+// ImportStreamKey builds the stream key for an import subject and label.
+func ImportStreamKey(subject Subject, label string) string {
+	return "import:" + string(subject) + ":" + label
+}
+
+// Import validates, authorizes, deduplicates, normalizes, and publishes.
+func (importer *Importer) Import(ctx context.Context, principal authn.Principal, request ImportRequest) (api.SupplyChainImportResponse, error) {
+	if request.RepositoryID < 1 || (request.Subject != SubjectSource && request.Subject != SubjectArtifact) || !labelPattern.MatchString(request.Label) {
+		return api.SupplyChainImportResponse{}, ErrInvalidRequest
+	}
+	if request.SubjectRevision != "" && !shaPattern.MatchString(request.SubjectRevision) {
+		return api.SupplyChainImportResponse{}, ErrInvalidRequest
+	}
+	maxBytes := importer.MaxDocumentBytes
+	if maxBytes <= 0 {
+		maxBytes = 16 << 20
+	}
+	if int64(len(request.Document)) > maxBytes {
+		return api.SupplyChainImportResponse{}, ErrImportTooLarge
+	}
+	if len(request.Document) == 0 {
+		return api.SupplyChainImportResponse{}, ErrInvalidRequest
+	}
+	repo, err := importer.Authorizer.AuthorizedRepository(ctx, principal, request.RepositoryID)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return api.SupplyChainImportResponse{}, ErrNotFound
+	}
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	if !principal.Administrator {
+		allowed, err := importer.Store.SupplyChainUploadAllowed(ctx, repo.ID, principal.Subject)
+		if err != nil {
+			return api.SupplyChainImportResponse{}, err
+		}
+		if !allowed {
+			return api.SupplyChainImportResponse{}, ErrForbidden
+		}
+	}
+	streamKey := ImportStreamKey(request.Subject, request.Label)
+	digest := sha256.Sum256(request.Document)
+	// Idempotency: the same bytes into the same stream return the earlier result.
+	if previous, ok, err := importer.Store.SupplyChainImportByDigest(ctx, repo.ID, streamKey, digest[:]); err != nil {
+		return api.SupplyChainImportResponse{}, err
+	} else if ok && previous.Outcome != "rejected" {
+		return api.SupplyChainImportResponse{ImportID: previous.ID, Outcome: "unchanged", SnapshotID: previous.SnapshotID, Stream: streamKey, Repeated: true, Format: string(previous.Format)}, nil
+	}
+	window := importer.QuotaWindow
+	if window <= 0 {
+		window = 24 * time.Hour
+	}
+	quota := importer.QuotaPerRepository
+	if quota <= 0 {
+		quota = 100
+	}
+	count, err := importer.Store.SupplyChainImportCount(ctx, repo.ID, importer.now().Add(-window))
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	if count >= quota {
+		return api.SupplyChainImportResponse{}, ErrQuotaExceeded
+	}
+	record := ImportRecord{RepositoryID: repo.ID, StreamKey: streamKey, DocumentSHA256: digest[:], UploadedBy: principal.Subject, UploadLabel: request.Label, ByteSize: int64(len(request.Document)), CreatedAt: importer.now()}
+	format, normalized, err := importer.normalize(request.ContentType, request.Document)
+	record.Format = format
+	if err != nil {
+		record.Outcome = "rejected"
+		record.ErrorCode, record.Message = importErrorCode(err), sanitize(err.Error(), 200)
+		if record.Format == "" {
+			record.Format = FormatSPDX23JSON
+		}
+		if _, recordErr := importer.Store.RecordSupplyChainImport(ctx, record); recordErr != nil {
+			return api.SupplyChainImportResponse{}, recordErr
+		}
+		return api.SupplyChainImportResponse{}, err
+	}
+	assurance := AssuranceUnknown
+	if request.SubjectRevision != "" {
+		assurance = AssuranceProducerAsserted
+	}
+	mediaType := request.ContentType
+	if mediaType == "" {
+		mediaType = "application/json"
+	}
+	collection, err := importer.Store.PublishSupplyChainSnapshot(ctx, Publication{
+		RepositoryID: repo.ID, Producer: ProducerImport, Subject: request.Subject, StreamKey: streamKey, Format: format, MediaType: mediaType, Document: request.Document, Normalized: normalized,
+		CollectedAt: importer.now(), StartedAt: importer.now(), SubjectRevision: request.SubjectRevision, SubjectAssurance: assurance, UploadedBy: principal.Subject, UploadLabel: request.Label,
+	})
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	record.Outcome, record.SnapshotID = string(collection.Outcome), collection.SnapshotID
+	importID, err := importer.Store.RecordSupplyChainImport(ctx, record)
+	if err != nil {
+		return api.SupplyChainImportResponse{}, err
+	}
+	response := api.SupplyChainImportResponse{ImportID: importID, Outcome: string(collection.Outcome), SnapshotID: collection.SnapshotID, Stream: streamKey, Format: string(format),
+		ComponentCount: len(normalized.Components), EdgeCount: len(normalized.Relationships), WarningCount: normalized.WarningCount, Warnings: make([]api.SupplyChainWarning, 0, len(normalized.Warnings)),
+		SubjectAssurance: string(assurance), Notes: []string{}}
+	for _, warning := range normalized.Warnings {
+		response.Warnings = append(response.Warnings, api.SupplyChainWarning{Code: warning.Code, Element: warning.Element, Detail: warning.Detail})
+	}
+	if request.SubjectRevision != "" {
+		response.Notes = append(response.Notes, "The subject revision is the uploader's assertion (producer_asserted); GraphNest did not verify it.")
+	}
+	if collection.Outcome == OutcomePublished && collection.SnapshotID != nil && importer.Enricher != nil {
+		if _, err := importer.Enricher.EnqueueSnapshot(ctx, *collection.SnapshotID); err != nil {
+			response.Notes = append(response.Notes, "License enrichment could not be queued; the next publication will retry.")
+		}
+	}
+	return response, nil
+}
+
+// normalize detects the format from content (never from the producer's
+// self-description alone) and normalizes it.
+func (importer *Importer) normalize(contentType string, document []byte) (Format, Normalized, error) {
+	var probe struct {
+		BOMFormat   string `json:"bomFormat"`
+		SpecVersion string `json:"spdxVersion"`
+	}
+	trimmed := bytes.TrimSpace(document)
+	if len(trimmed) == 0 || trimmed[0] != '{' {
+		return "", Normalized{}, ErrMalformed
+	}
+	if err := json.Unmarshal(trimmed, &probe); err != nil {
+		return "", Normalized{}, errors.Join(ErrMalformed, errors.New(safeJSONError(err)))
+	}
+	switch {
+	case probe.BOMFormat == "CycloneDX":
+		if strings.Contains(contentType, "spdx") {
+			return FormatCycloneDX16JSON, Normalized{}, errors.Join(ErrUnsupportedFormat, errors.New("content type says SPDX but the document is CycloneDX"))
+		}
+		normalized, err := NormalizeCycloneDX16(document, importer.Limits)
+		return FormatCycloneDX16JSON, normalized, err
+	case probe.SpecVersion != "":
+		if strings.Contains(contentType, "cyclonedx") {
+			return FormatSPDX23JSON, Normalized{}, errors.Join(ErrUnsupportedFormat, errors.New("content type says CycloneDX but the document is SPDX"))
+		}
+		normalized, err := NormalizeSPDX23(document, importer.Limits)
+		return FormatSPDX23JSON, normalized, err
+	default:
+		return "", Normalized{}, errors.Join(ErrUnsupportedFormat, errors.New("document is neither SPDX 2.3 JSON (spdxVersion) nor CycloneDX 1.6 JSON (bomFormat)"))
+	}
+}
+
+func importErrorCode(err error) string {
+	switch {
+	case errors.Is(err, ErrUnsupportedFormat):
+		return "unsupported_format"
+	case errors.Is(err, ErrUnsupportedVersion):
+		return "unsupported_version"
+	case errors.Is(err, ErrTooLarge):
+		return "too_large"
+	default:
+		return "malformed"
+	}
+}
diff --git a/internal/supplychain/license/evidence.go b/internal/supplychain/license/evidence.go
index 2324c454..2811da71 100644
--- a/internal/supplychain/license/evidence.go
+++ b/internal/supplychain/license/evidence.go
@@ -215,3 +215,21 @@ func ListVersion() string { return spdxexpr.ListVersion }
 var Now = time.Now
 
 func now() time.Time { return Now().UTC() }
+
+// ParseForExport returns the canonical SPDX rendering of a raw value that a
+// derived SPDX document may carry in licenseDeclared: a parsed expression
+// (known or LicenseRef terms), or the NOASSERTION/NONE sentinels. Anything
+// else (unknown identifiers, free text, UNLICENSED, files, URLs) returns ""
+// so callers describe it in comments instead of asserting it.
+func ParseForExport(raw string) string {
+	parsed := spdxexpr.Parse(raw)
+	switch parsed.Status {
+	case spdxexpr.StatusParsed:
+		return parsed.Normalized
+	case spdxexpr.StatusNoAssertion:
+		return "NOASSERTION"
+	case spdxexpr.StatusNone:
+		return "NONE"
+	}
+	return ""
+}
diff --git a/internal/supplychain/model.go b/internal/supplychain/model.go
index f97f176d..6df471af 100644
--- a/internal/supplychain/model.go
+++ b/internal/supplychain/model.go
@@ -74,6 +74,10 @@ type Publication struct {
 	HTTPStatus       *int
 	SubjectRevision  string
 	SubjectAssurance Assurance
+	// UploadedBy and UploadLabel identify an import's uploader separately
+	// from the document's claimed producer.
+	UploadedBy  string
+	UploadLabel string
 }
 
 // Failure records an attempt that produced no new snapshot.
@@ -118,6 +122,8 @@ type Snapshot struct {
 	DocumentSHA256               []byte
 	DocumentFormat               Format
 	DocumentBytes                int64
+	UploadedBy                   string
+	UploadLabel                  string
 }
 
 // Component is one occurrence in one snapshot. Identity is document-scoped:
diff --git a/internal/supplychain/service.go b/internal/supplychain/service.go
index 3f8b8ec8..e50dcdd3 100644
--- a/internal/supplychain/service.go
+++ b/internal/supplychain/service.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -126,10 +127,24 @@ func (service *Service) AuthorizedRepositoryIDs(ctx context.Context, principal a
 	return ids, nil
 }
 
-// ValidStream reports whether a stream selector is one the service serves.
-// Milestone 1 serves the GitHub source stream only.
+var importStreamPattern = regexp.MustCompile(`^import:(source|artifact):[a-z0-9][a-z0-9._-]{0,63}$`)
+
+// ValidStream reports whether a stream selector is one the service serves:
+// the GitHub source stream or an import stream (import:<subject>:<label>).
 func ValidStream(stream string) bool {
-	return stream == "" || stream == StreamGitHubSource
+	return stream == "" || stream == StreamGitHubSource || importStreamPattern.MatchString(stream)
+}
+
+// StreamProducer returns the producer and subject encoded in a stream key.
+func StreamProducer(stream string) (Producer, Subject) {
+	if stream == StreamGitHubSource {
+		return ProducerGitHub, SubjectSource
+	}
+	parts := strings.SplitN(stream, ":", 3)
+	if len(parts) == 3 && parts[0] == "import" {
+		return ProducerImport, Subject(parts[1])
+	}
+	return "", ""
 }
 
 func normalizeStream(stream string) (string, error) {
@@ -151,8 +166,20 @@ func (service *Service) Status(ctx context.Context, principal authn.Principal, g
 	if err != nil {
 		return api.SupplyChainRepositoryStatus{}, err
 	}
-	status := api.SupplyChainRepositoryStatus{RepositoryID: repo.GitHubID, Repository: repo.Name, Stream: streamKey, Producer: string(ProducerGitHub), Subject: string(SubjectSource),
-		Collection: "never", Enrichment: "not_configured", EnrichmentEcosystems: []string{}, LicenseSummary: map[string]int{}, Notes: []string{}, Documents: []api.SupplyChainDocumentRef{}}
+	producer, subject := StreamProducer(streamKey)
+	status := api.SupplyChainRepositoryStatus{RepositoryID: repo.GitHubID, Repository: repo.Name, Stream: streamKey, Producer: string(producer), Subject: string(subject),
+		Collection: "never", Enrichment: "not_configured", EnrichmentEcosystems: []string{}, LicenseSummary: map[string]int{}, Notes: []string{}, Documents: []api.SupplyChainDocumentRef{}, Streams: []api.SupplyChainStreamRef{}}
+	if streams, ok := service.Store.(interface {
+		SupplyChainStreams(context.Context, int64) ([]Stream, error)
+	}); ok {
+		known, err := streams.SupplyChainStreams(ctx, repo.ID)
+		if err != nil {
+			return api.SupplyChainRepositoryStatus{}, err
+		}
+		for _, stream := range known {
+			status.Streams = append(status.Streams, api.SupplyChainStreamRef{Key: stream.StreamKey, Producer: string(stream.Producer), Subject: string(stream.Subject), HasInventory: stream.LatestSnapshotID != nil, LastOutcome: string(stream.LastOutcome)})
+		}
+	}
 	if len(service.EnrichmentEcosystems) > 0 {
 		status.Enrichment = "configured"
 		status.EnrichmentEcosystems = append(status.EnrichmentEcosystems, service.EnrichmentEcosystems...)
@@ -203,8 +230,13 @@ func (service *Service) Status(ctx context.Context, principal authn.Principal, g
 			}
 		}
 	}
-	if status.LatestSnapshot != nil {
+	if status.LatestSnapshot != nil && producer == ProducerGitHub {
 		status.Notes = append(status.Notes, "GitHub dependency-graph exports are timestamped observations of the default branch; they are not bound to a commit and carry no license data.")
+	}
+	if status.LatestSnapshot != nil && producer == ProducerImport {
+		status.Notes = append(status.Notes, "This inventory was uploaded by "+status.LatestSnapshot.UploadedBy+"; the producer named inside the document is its own claim. Subject binding: "+status.LatestSnapshot.SubjectAssurance+".")
+	}
+	if status.LatestSnapshot != nil {
 		if status.LatestSnapshot.WarningCount > 0 {
 			status.Notes = append(status.Notes, fmt.Sprintf("Normalization reported %d coverage warning(s).", status.LatestSnapshot.WarningCount))
 		}
@@ -595,6 +627,7 @@ func (service *Service) Refresh(ctx context.Context, principal authn.Principal,
 		return api.SupplyChainRefreshResponse{}, err
 	}
 	if streamKey != StreamGitHubSource {
+		// Import streams are refreshed by uploading a new document, not by collection.
 		return api.SupplyChainRefreshResponse{}, ErrInvalidRequest
 	}
 	repo, err := service.authorizedRepository(ctx, principal, githubID)
@@ -648,6 +681,7 @@ func snapshotSummary(snapshot Snapshot) api.SupplyChainSnapshot {
 		SubjectAssurance: string(snapshot.SubjectAssurance), RootElementIDs: roots, ParserVersion: snapshot.ParserVersion, ComponentCount: snapshot.ComponentCount,
 		EdgeCount: snapshot.EdgeCount, WarningCount: snapshot.WarningCount, Warnings: warnings, PublishedAt: snapshot.PublishedAt,
 		DocumentSHA256: hex.EncodeToString(snapshot.DocumentSHA256), DocumentFormat: string(snapshot.DocumentFormat), DocumentBytes: snapshot.DocumentBytes,
+		UploadedBy: snapshot.UploadedBy, UploadLabel: snapshot.UploadLabel,
 	}
 }
 
diff --git a/internal/supplychain/spdx_test.go b/internal/supplychain/spdx_test.go
index 2c4797d4..ec1f0051 100644
--- a/internal/supplychain/spdx_test.go
+++ b/internal/supplychain/spdx_test.go
@@ -198,3 +198,28 @@ func TestParsePURL(t *testing.T) {
 		}
 	}
 }
+
+func FuzzNormalizeSPDX23(f *testing.F) {
+	data, err := os.ReadFile("../../test/fixtures/supplychain/ghes-spdx-2.3.json")
+	if err != nil {
+		f.Fatal(err)
+	}
+	f.Add(string(data))
+	f.Add(`{"spdxVersion":"SPDX-2.3","packages":[]}`)
+	f.Fuzz(func(t *testing.T, document string) {
+		got, err := NormalizeSPDX23([]byte(document), Limits{MaxComponents: 200, MaxRelationships: 2000, MaxWarnings: 50})
+		if err != nil {
+			return
+		}
+		if len(got.Components) > 200 || len(got.Warnings) > 50 {
+			t.Fatalf("limits exceeded: %d components, %d warnings", len(got.Components), len(got.Warnings))
+		}
+		seen := map[string]bool{}
+		for _, component := range got.Components {
+			if seen[component.ElementID] {
+				t.Fatalf("duplicate element id %q", component.ElementID)
+			}
+			seen[component.ElementID] = true
+		}
+	})
+}
diff --git a/internal/supplychain/spdxexport.go b/internal/supplychain/spdxexport.go
new file mode 100644
index 00000000..a3ab7c1f
--- /dev/null
+++ b/internal/supplychain/spdxexport.go
@@ -0,0 +1,258 @@
+package supplychain
+
+import (
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/balcsida/graphnest/internal/authn"
+	"github.com/balcsida/graphnest/internal/supplychain/license"
+	"github.com/jackc/pgx/v5"
+)
+
+// DerivedSPDXVersion identifies the GraphNest-produced document shape.
+const DerivedSPDXVersion = "SPDX-2.3"
+
+var spdxIDUnsafe = regexp.MustCompile(`[^A-Za-z0-9.-]`)
+
+// ExportSPDX writes a derived SPDX 2.3 JSON document for one authorized
+// snapshot with GraphNest as the creator. It never mutates or re-serves the
+// original: the original stays downloadable as-is, and this document names
+// it (snapshot ID, SHA-256, producer, collected time) as an external
+// reference so the two are never confused. Assessments are emitted as
+// licenseComments, not as licenseConcluded: GraphNest concludes nothing on a
+// publisher's behalf, and review decisions live outside this document.
+func (service *Service) ExportSPDX(ctx context.Context, principal authn.Principal, githubID int64, streamKey string, snapshotID int64, publicOrigin string) ([]byte, Snapshot, error) {
+	streamKey, err := normalizeStream(streamKey)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	repo, err := service.authorizedRepository(ctx, principal, githubID)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	if snapshotID == 0 {
+		stream, err := service.Store.SupplyChainStream(ctx, repo.ID, streamKey)
+		if errors.Is(err, pgx.ErrNoRows) || err == nil && stream.LatestSnapshotID == nil {
+			return nil, Snapshot{}, ErrNoInventory
+		}
+		if err != nil {
+			return nil, Snapshot{}, err
+		}
+		snapshotID = *stream.LatestSnapshotID
+	}
+	snapshot, err := service.Store.SupplyChainSnapshot(ctx, snapshotID, []int64{repo.ID})
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, Snapshot{}, ErrNotFound
+	}
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	components, err := service.Store.SupplyChainComponents(ctx, snapshot.ID, -1, DefaultMaxComponents*2, "")
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	edges, err := service.Store.SupplyChainRelationships(ctx, snapshot.ID, "", snapshot.EdgeCount+1)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	assessments, err := service.assessments(ctx, snapshot.ID, components)
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	now := service.now()
+	digest := hex.EncodeToString(snapshot.DocumentSHA256)
+	namespace := strings.TrimSuffix(publicOrigin, "/") + "/spdxdocs/graphnest/repository/" + strconv.FormatInt(repo.GitHubID, 10) + "/snapshot/" + strconv.FormatInt(snapshot.ID, 10) + "-" + digest[:16]
+	type spdxPackage struct {
+		SPDXID           string `json:"SPDXID"`
+		Name             string `json:"name"`
+		VersionInfo      string `json:"versionInfo,omitempty"`
+		DownloadLocation string `json:"downloadLocation"`
+		FilesAnalyzed    bool   `json:"filesAnalyzed"`
+		Supplier         string `json:"supplier,omitempty"`
+		LicenseConcluded string `json:"licenseConcluded"`
+		LicenseDeclared  string `json:"licenseDeclared"`
+		LicenseComments  string `json:"licenseComments,omitempty"`
+		Checksums        []struct {
+			Algorithm string `json:"algorithm"`
+			Value     string `json:"checksumValue"`
+		} `json:"checksums,omitempty"`
+		ExternalRefs []struct {
+			Category string `json:"referenceCategory"`
+			Type     string `json:"referenceType"`
+			Locator  string `json:"referenceLocator"`
+		} `json:"externalRefs,omitempty"`
+	}
+	type spdxRelationship struct {
+		SPDXElementID      string `json:"spdxElementId"`
+		Type               string `json:"relationshipType"`
+		RelatedSPDXElement string `json:"relatedSpdxElement"`
+	}
+	ids := map[string]string{}
+	used := map[string]bool{"SPDXRef-DOCUMENT": true}
+	spdxID := func(element string) string {
+		if id, ok := ids[element]; ok {
+			return id
+		}
+		candidate := "SPDXRef-" + spdxIDUnsafe.ReplaceAllString(element, "-")
+		if strings.HasPrefix(element, "SPDXRef-") {
+			candidate = spdxIDUnsafe.ReplaceAllString(element, "-")
+		}
+		base := candidate
+		for index := 2; used[candidate]; index++ {
+			candidate = base + "-" + strconv.Itoa(index)
+		}
+		used[candidate] = true
+		ids[element] = candidate
+		return candidate
+	}
+	packages := make([]spdxPackage, 0, len(components))
+	var describes []string
+	for _, component := range components {
+		pkg := spdxPackage{SPDXID: spdxID(component.ElementID), Name: component.Name, DownloadLocation: "NOASSERTION", LicenseConcluded: "NOASSERTION", LicenseDeclared: "NOASSERTION"}
+		if component.Version != nil {
+			pkg.VersionInfo = *component.Version
+		}
+		if component.DownloadLocation != nil && *component.DownloadLocation != "" {
+			pkg.DownloadLocation = *component.DownloadLocation
+		}
+		if component.Supplier != nil && *component.Supplier != "" {
+			pkg.Supplier = *component.Supplier
+		}
+		// Only a value that is a valid SPDX expression (or the sentinels) may
+		// stand in licenseDeclared; anything else is described in comments.
+		var comments []string
+		if component.LicenseDeclaredRaw != nil {
+			parsed := license.ParseForExport(*component.LicenseDeclaredRaw)
+			if parsed != "" {
+				pkg.LicenseDeclared = parsed
+			} else {
+				comments = append(comments, "producer declared (not an SPDX expression): "+sanitize(*component.LicenseDeclaredRaw, 300))
+			}
+		}
+		if component.LicenseConcludedRaw != nil {
+			if parsed := license.ParseForExport(*component.LicenseConcludedRaw); parsed != "" && parsed != "NOASSERTION" {
+				comments = append(comments, "producer concluded: "+parsed)
+			}
+		}
+		if assessment, ok := assessments[component.ID]; ok && assessment.Status != "" {
+			line := "GraphNest assessment: " + string(assessment.Status)
+			if assessment.NormalizedExpression != "" {
+				line += " (" + assessment.NormalizedExpression + ")"
+			}
+			if assessment.ConflictDetail != "" {
+				line += "; conflict: " + sanitize(assessment.ConflictDetail, 300)
+			}
+			line += "; evidence fingerprint " + hex.EncodeToString(assessment.EvidenceFingerprint)[:16] + "; evidence is not approval"
+			comments = append(comments, line)
+		}
+		pkg.LicenseComments = strings.Join(comments, " | ")
+		for _, checksum := range component.Checksums {
+			if algorithm := spdxChecksumAlgorithm(checksum.Algorithm); algorithm != "" {
+				pkg.Checksums = append(pkg.Checksums, struct {
+					Algorithm string `json:"algorithm"`
+					Value     string `json:"checksumValue"`
+				}{algorithm, strings.ToLower(checksum.Value)})
+			}
+		}
+		if component.PURL != nil {
+			pkg.ExternalRefs = append(pkg.ExternalRefs, struct {
+				Category string `json:"referenceCategory"`
+				Type     string `json:"referenceType"`
+				Locator  string `json:"referenceLocator"`
+			}{"PACKAGE-MANAGER", "purl", *component.PURL})
+		}
+		if component.IsRoot {
+			describes = append(describes, pkg.SPDXID)
+		}
+		packages = append(packages, pkg)
+	}
+	relationships := []spdxRelationship{}
+	for _, root := range describes {
+		relationships = append(relationships, spdxRelationship{"SPDXRef-DOCUMENT", "DESCRIBES", root})
+	}
+	for _, edge := range edges {
+		if !edge.Resolved || edge.Type == "DESCRIBES" || edge.Type == "DESCRIBED_BY" {
+			continue
+		}
+		relationships = append(relationships, spdxRelationship{spdxID(edge.FromElement), edge.Type, spdxID(edge.ToElement)})
+	}
+	document := map[string]any{
+		"spdxVersion":       DerivedSPDXVersion,
+		"dataLicense":       "CC0-1.0",
+		"SPDXID":            "SPDXRef-DOCUMENT",
+		"name":              "graphnest-derived-inventory-" + strconv.FormatInt(repo.GitHubID, 10) + "-" + strconv.FormatInt(snapshot.ID, 10),
+		"documentNamespace": namespace,
+		"creationInfo": map[string]any{
+			"created":  now.Format(time.RFC3339),
+			"creators": []string{"Tool: GraphNest-supply-chain-" + strconv.Itoa(ParserVersion), "Organization: GraphNest deployment"},
+			"comment": fmt.Sprintf("Derived by GraphNest from snapshot %d of repository %s (%s stream, producer %s, tool %q, collected %s, subject assurance %s). "+
+				"The original document (%s, sha256 %s, %d bytes) is preserved unchanged and is the authoritative source; this document adds GraphNest normalization and license assessments as comments only. Review decisions are not part of this document.",
+				snapshot.ID, repo.Name, snapshot.StreamKey, snapshot.Producer, snapshot.ProducerTool, snapshot.CollectedAt.Format(time.RFC3339), snapshot.SubjectAssurance,
+				snapshot.DocumentFormat, digest, snapshot.DocumentBytes),
+		},
+		"externalDocumentRefs": []map[string]any{{
+			"externalDocumentId": "DocumentRef-graphnest-original-snapshot-" + strconv.FormatInt(snapshot.ID, 10),
+			"spdxDocument":       strings.TrimSuffix(publicOrigin, "/") + "/v1/supply-chain/snapshots/" + strconv.FormatInt(snapshot.ID, 10) + "/document",
+			"checksum":           map[string]string{"algorithm": "SHA256", "checksumValue": digest},
+		}},
+		"documentDescribes": nonNilStrings(describes),
+		"packages":          packages,
+		"relationships":     relationships,
+	}
+	if snapshot.SubjectRevision != "" {
+		document["comment"] = "Subject revision " + snapshot.SubjectRevision + " is " + string(snapshot.SubjectAssurance) + "; GraphNest did not independently verify it."
+	}
+	data, err := json.MarshalIndent(document, "", "  ")
+	if err != nil {
+		return nil, Snapshot{}, err
+	}
+	// Validate what we produced with our own reader before serving it.
+	if _, err := NormalizeSPDX23(data, Limits{}); err != nil {
+		return nil, Snapshot{}, fmt.Errorf("derived document failed validation: %w", err)
+	}
+	return append(data, '\n'), snapshot, nil
+}
+
+func nonNilStrings(values []string) []string {
+	if values == nil {
+		return []string{}
+	}
+	return values
+}
+
+func spdxChecksumAlgorithm(value string) string {
+	switch strings.ToUpper(strings.ReplaceAll(value, "-", "")) {
+	case "SHA1":
+		return "SHA1"
+	case "SHA256":
+		return "SHA256"
+	case "SHA384":
+		return "SHA384"
+	case "SHA512":
+		return "SHA512"
+	case "MD5":
+		return "MD5"
+	case "SHA3256":
+		return "SHA3-256"
+	case "SHA3384":
+		return "SHA3-384"
+	case "SHA3512":
+		return "SHA3-512"
+	case "BLAKE2B256":
+		return "BLAKE2b-256"
+	case "BLAKE2B384":
+		return "BLAKE2b-384"
+	case "BLAKE2B512":
+		return "BLAKE2b-512"
+	case "BLAKE3":
+		return "BLAKE3"
+	}
+	return ""
+}
diff --git a/pkg/api/supply_chain.go b/pkg/api/supply_chain.go
index cd151a16..ebaa4be2 100644
--- a/pkg/api/supply_chain.go
+++ b/pkg/api/supply_chain.go
@@ -30,6 +30,16 @@ type SupplyChainRepositoryStatus struct {
 	OptOut         bool                     `json:"opt_out"`
 	Notes          []string                 `json:"notes"`
 	Documents      []SupplyChainDocumentRef `json:"documents"`
+	// Streams lists every stream known for the repository (GitHub and imports).
+	Streams []SupplyChainStreamRef `json:"streams"`
+}
+
+type SupplyChainStreamRef struct {
+	Key          string `json:"key"`
+	Producer     string `json:"producer"`
+	Subject      string `json:"subject"`
+	HasInventory bool   `json:"has_inventory"`
+	LastOutcome  string `json:"last_outcome,omitempty"`
 }
 
 // SupplyChainDocumentRef points at a downloadable original document.
@@ -66,6 +76,10 @@ type SupplyChainSnapshot struct {
 	DocumentSHA256   string               `json:"document_sha256"`
 	DocumentFormat   string               `json:"document_format"`
 	DocumentBytes    int64                `json:"document_bytes"`
+	// UploadedBy is the authenticated uploader of an imported document,
+	// recorded separately from the producer the document claims.
+	UploadedBy  string `json:"uploaded_by,omitempty"`
+	UploadLabel string `json:"upload_label,omitempty"`
 }
 
 type SupplyChainWarning struct {
@@ -335,3 +349,19 @@ type SupplyChainLicenseChange struct {
 	From      string `json:"from"`
 	To        string `json:"to"`
 }
+
+// SupplyChainImportResponse reports an accepted upload.
+type SupplyChainImportResponse struct {
+	ImportID         int64                `json:"import_id"`
+	Outcome          string               `json:"outcome"`
+	Repeated         bool                 `json:"repeated"`
+	SnapshotID       *int64               `json:"snapshot_id"`
+	Stream           string               `json:"stream"`
+	Format           string               `json:"format"`
+	ComponentCount   int                  `json:"component_count"`
+	EdgeCount        int                  `json:"edge_count"`
+	WarningCount     int                  `json:"warning_count"`
+	Warnings         []SupplyChainWarning `json:"warnings"`
+	SubjectAssurance string               `json:"subject_assurance,omitempty"`
+	Notes            []string             `json:"notes"`
+}
diff --git a/test/fixtures/supplychain/syft-cyclonedx-1.6.json b/test/fixtures/supplychain/syft-cyclonedx-1.6.json
new file mode 100644
index 00000000..a32b11fc
--- /dev/null
+++ b/test/fixtures/supplychain/syft-cyclonedx-1.6.json
@@ -0,0 +1,84 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2026-09-21T14:03:11Z",
+    "tools": {
+      "components": [
+        {"type": "application", "author": "anchore", "name": "syft", "version": "1.20.0"}
+      ]
+    },
+    "component": {
+      "bom-ref": "graphnest-fixture-root",
+      "type": "container",
+      "name": "registry.example.internal/acme/widgets",
+      "version": "sha256:8d1a3d4c5e6f708192a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e7f809"
+    }
+  },
+  "components": [
+    {
+      "bom-ref": "pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c",
+      "type": "library",
+      "group": "@scope",
+      "name": "left-pad",
+      "version": "1.3.0",
+      "purl": "pkg:npm/%40scope/left-pad@1.3.0",
+      "licenses": [{"license": {"id": "MIT"}}],
+      "hashes": [{"alg": "SHA-512", "content": "9a2c6b1d4e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f"}]
+    },
+    {
+      "bom-ref": "pkg:npm/dual@2.0.0?package-id=2b3c4d",
+      "type": "library",
+      "name": "dual",
+      "version": "2.0.0",
+      "purl": "pkg:npm/dual@2.0.0",
+      "licenses": [{"expression": "(MIT OR Apache-2.0)", "acknowledgement": "declared"}]
+    },
+    {
+      "bom-ref": "pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12&package-id=3c4d5e",
+      "type": "library",
+      "name": "libssl3",
+      "version": "3.0.11-1~deb12u2",
+      "purl": "pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12",
+      "supplier": {"name": "Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org>"},
+      "licenses": [{"license": {"name": "OpenSSL"}}, {"license": {"id": "Apache-2.0"}}]
+    },
+    {
+      "bom-ref": "pkg:golang/golang.org/x/text@v0.14.0?package-id=4d5e6f",
+      "type": "library",
+      "name": "golang.org/x/text",
+      "version": "v0.14.0",
+      "purl": "pkg:golang/golang.org/x/text@v0.14.0",
+      "licenses": [{"license": {"id": "BSD-3-Clause", "url": "https://go.dev/LICENSE"}}],
+      "evidence": {"licenses": [{"license": {"id": "BSD-3-Clause"}}], "occurrences": [{"location": "/app/vendor/golang.org/x/text/LICENSE"}]}
+    },
+    {
+      "bom-ref": "bundle-1",
+      "type": "application",
+      "name": "widgets-bundle",
+      "version": "4.2.0",
+      "components": [
+        {
+          "bom-ref": "pkg:npm/nested-helper@0.1.0?package-id=5e6f7a",
+          "type": "library",
+          "name": "nested-helper",
+          "version": "0.1.0",
+          "purl": "pkg:npm/nested-helper@0.1.0",
+          "licenses": [{"license": {"name": "Custom Acme License", "url": "https://acme.example.internal/license"}}]
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "/app/config/settings.yaml"
+    }
+  ],
+  "dependencies": [
+    {"ref": "graphnest-fixture-root", "dependsOn": ["pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c", "pkg:npm/dual@2.0.0?package-id=2b3c4d", "pkg:deb/debian/libssl3@3.0.11-1~deb12u2?arch=amd64&distro=debian-12&package-id=3c4d5e", "bundle-1"]},
+    {"ref": "pkg:npm/dual@2.0.0?package-id=2b3c4d", "dependsOn": ["pkg:npm/%40scope/left-pad@1.3.0?package-id=1a2b3c"]},
+    {"ref": "bundle-1", "dependsOn": ["pkg:npm/nested-helper@0.1.0?package-id=5e6f7a", "pkg:npm/missing@9.9.9"]}
+  ]
+}
diff --git a/test/integration/supply_chain_test.go b/test/integration/supply_chain_test.go
index e4d9b359..50c0a953 100644
--- a/test/integration/supply_chain_test.go
+++ b/test/integration/supply_chain_test.go
@@ -3,6 +3,7 @@
 package integration
 
 import (
+	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
@@ -659,3 +660,308 @@ func TestSupplyChainPortfolioAuthorization(t *testing.T) {
 		t.Fatalf("compare with foreign snapshot = %d", response.Code)
 	}
 }
+
+// TestSupplyChainImports proves standards-based uploads: real-format round
+// trips for SPDX 2.3 and CycloneDX 1.6, stream separation from the GitHub
+// observation, uploader identity separate from the claimed producer,
+// producer-asserted subject binding, idempotency, quota, repository-scoped
+// permission, and explicit rejection of unsupported versions.
+func TestSupplyChainImports(t *testing.T) {
+	h := newPostgresHarness(t)
+	widgets := h.seedRepository(t, 10, 101)
+	h.seedRepository(t, 10, 102)
+	github, client := newFakeSBOMGitHub(t)
+	envelope := sbomEnvelope(t)
+	github.responses["acme/repo-101"] = func(writer http.ResponseWriter) { fmt.Fprint(writer, envelope) }
+	collector := &supplychain.Collector{Store: h.store, GitHub: client, Owner: "collect", MaxDocumentBytes: 1 << 20}
+	if _, _, err := h.store.EnqueueSupplyChainJob(t.Context(), widgets, supplychain.StreamGitHubSource, "manual", "t", 10, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := collector.RunOnce(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	importer := &supplychain.Importer{Store: h.store, Authorizer: authz.NewPostgres(h.store), MaxDocumentBytes: 1 << 20, QuotaPerRepository: 12, QuotaWindow: time.Hour}
+	service := &supplychain.Service{Store: h.store, Authorizer: authz.NewPostgres(h.store), Interval: time.Hour, MaxResults: 100, License: h.store}
+	authorizer := authz.NewPostgres(h.store)
+	grants := &httpapi.UploadGrants{Set: h.store.SetSupplyChainUploadGrant, Resolve: func(ctx context.Context, principal authn.Principal, githubID int64) (int64, error) {
+		repo, err := authorizer.AuthorizedRepository(ctx, principal, githubID)
+		return repo.ID, err
+	}}
+	authenticator := authn.RequestAuthenticator{Bearer: authn.NewStatic(map[string]authn.Principal{
+		"admin":  {Subject: "admin@acme", Method: "session", Administrator: true},
+		"dev":    {Subject: "dev@acme", Method: "api_token", InstallationID: 10, RepositoryIDs: []int64{101, 102}},
+		"reader": {Subject: "reader@acme", Method: "api_token", InstallationID: 10, RepositoryIDs: []int64{101}},
+	})}
+	mux := http.NewServeMux()
+	httpapi.RegisterSupplyChain(mux, authenticator, service, 100, 256<<10)
+	httpapi.RegisterSupplyChainImports(mux, authenticator, importer, grants, 1<<20, 256<<10)
+	post := func(token, path, contentType string, body []byte) *httptest.ResponseRecorder {
+		request := httptest.NewRequest(http.MethodPost, path, strings.NewReader(string(body)))
+		request.Header.Set("Authorization", "Bearer "+token)
+		request.Header.Set("Content-Type", contentType)
+		recorder := httptest.NewRecorder()
+		mux.ServeHTTP(recorder, request)
+		return recorder
+	}
+	get := func(token, path string) *httptest.ResponseRecorder {
+		request := httptest.NewRequest(http.MethodGet, path, nil)
+		request.Header.Set("Authorization", "Bearer "+token)
+		recorder := httptest.NewRecorder()
+		mux.ServeHTTP(recorder, request)
+		return recorder
+	}
+	cyclonedx, err := os.ReadFile("../fixtures/supplychain/syft-cyclonedx-1.6.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	spdxMember, _ := os.ReadFile("../fixtures/supplychain/ghes-spdx-2.3.json")
+	// An ORT-style SPDX document claiming a different tool and a known commit.
+	ortDocument := strings.Replace(string(spdxMember), `"Tool: GitHub.com-Dependency-Graph"`, `"Tool: ORT-45.0.0"`, 1)
+	sha := strings.Repeat("c", 40)
+
+	// Without a grant, a non-administrator cannot import; administrators can.
+	if response := post("dev", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx); response.Code != http.StatusForbidden {
+		t.Fatalf("ungranted import = %d %s", response.Code, response.Body.String())
+	}
+	response := post("admin", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx)
+	var imported api.SupplyChainImportResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &imported); err != nil || response.Code != http.StatusCreated {
+		t.Fatalf("cyclonedx import = %d %s", response.Code, response.Body.String())
+	}
+	if imported.Outcome != "published" || imported.Format != "cyclonedx-1.6-json" || imported.ComponentCount != 8 || imported.Stream != "import:artifact:syft-image" || imported.SubjectAssurance != "unknown" || imported.SnapshotID == nil {
+		t.Fatalf("cyclonedx import = %+v", imported)
+	}
+	// Idempotent: the same bytes return the earlier result without a new snapshot.
+	response = post("admin", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx)
+	var repeated api.SupplyChainImportResponse
+	if err := json.Unmarshal(response.Body.Bytes(), &repeated); err != nil || response.Code != http.StatusCreated || !repeated.Repeated || repeated.Outcome != "unchanged" || *repeated.SnapshotID != *imported.SnapshotID {
+		t.Fatalf("repeated import = %d %+v", response.Code, repeated)
+	}
+	// The GitHub stream is untouched by the artifact import.
+	response = get("dev", "/v1/supply-chain/repositories/101")
+	var status api.SupplyChainRepositoryStatus
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.Producer != "github" || status.LatestSnapshot == nil || status.LatestSnapshot.ComponentCount != 7 || len(status.Streams) != 2 {
+		t.Fatalf("github stream after import = %d %+v", response.Code, status)
+	}
+	response = get("dev", "/v1/supply-chain/repositories/101?stream=import:artifact:syft-image")
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.Producer != "import" || status.Subject != "artifact" || status.LatestSnapshot == nil || status.LatestSnapshot.ProducerTool != "syft 1.20.0" || status.LatestSnapshot.UploadedBy != "admin@acme" || status.LatestSnapshot.UploadLabel != "syft-image" {
+		t.Fatalf("import stream status = %d %+v", response.Code, status)
+	}
+	found := false
+	for _, note := range status.Notes {
+		found = found || strings.Contains(note, "uploaded by admin@acme")
+	}
+	if !found {
+		t.Fatalf("notes must name the uploader separately from the claimed producer: %v", status.Notes)
+	}
+	response = get("dev", "/v1/supply-chain/repositories/101/components?stream=import:artifact:syft-image&q=libssl")
+	var page api.SupplyChainComponentList
+	if err := json.Unmarshal(response.Body.Bytes(), &page); err != nil || len(page.Components) != 1 || *page.Components[0].LicenseDeclaredRaw != "OpenSSL; Apache-2.0" || page.Components[0].Scope != "direct" || page.Components[0].Qualifiers["distro"] != "debian-12" {
+		t.Fatalf("libssl occurrence = %d %s", response.Code, response.Body.String())
+	}
+	if response := get("dev", *documentPath(&status)); response.Code != http.StatusOK || response.Body.String() != string(cyclonedx) {
+		t.Fatalf("original CycloneDX bytes were not preserved: %d", response.Code)
+	}
+
+	// Grant dev upload rights to 101 only; an SPDX source import with a subject revision is producer_asserted.
+	grantRequest := httptest.NewRequest(http.MethodPut, "/v1/supply-chain/upload-grants", strings.NewReader(`{"repository_id":101,"subject":"dev@acme","allow":true}`))
+	grantRequest.Header.Set("Authorization", "Bearer admin")
+	grantRequest.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	mux.ServeHTTP(recorder, grantRequest)
+	if recorder.Code != http.StatusNoContent {
+		t.Fatalf("grant = %d %s", recorder.Code, recorder.Body.String())
+	}
+	response = post("dev", "/v1/supply-chain/imports?repository_id=101&subject=source&label=ort&subject_revision="+sha, "application/spdx+json", []byte(ortDocument))
+	if err := json.Unmarshal(response.Body.Bytes(), &imported); err != nil || response.Code != http.StatusCreated || imported.Format != "spdx-2.3-json" || imported.SubjectAssurance != "producer_asserted" || imported.ComponentCount != 7 {
+		t.Fatalf("spdx import = %d %s", response.Code, response.Body.String())
+	}
+	response = get("reader", "/v1/supply-chain/repositories/101?stream=import:source:ort")
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.LatestSnapshot.SubjectRevision != sha || status.LatestSnapshot.SubjectAssurance != "producer_asserted" || status.LatestSnapshot.ProducerTool != "ORT-45.0.0" || status.LatestSnapshot.UploadedBy != "dev@acme" {
+		t.Fatalf("ort stream = %d %+v", response.Code, status.LatestSnapshot)
+	}
+	// A spoofed "Tool: GitHub.com-Dependency-Graph" upload never lands in the GitHub stream and is still labelled as an import.
+	response = post("dev", "/v1/supply-chain/imports?repository_id=101&subject=source&label=spoof", "application/json", spdxMember)
+	if err := json.Unmarshal(response.Body.Bytes(), &imported); err != nil || response.Code != http.StatusCreated || imported.Stream != "import:source:spoof" {
+		t.Fatalf("spoof import = %d %s", response.Code, response.Body.String())
+	}
+	response = get("dev", "/v1/supply-chain/repositories/101?stream=import:source:spoof")
+	if err := json.Unmarshal(response.Body.Bytes(), &status); err != nil || status.Producer != "import" || status.LatestSnapshot.ProducerTool != "GitHub.com-Dependency-Graph" || status.LatestSnapshot.UploadedBy != "dev@acme" {
+		t.Fatalf("spoof stream = %+v", status)
+	}
+	// dev has no grant on 102; the reader has no grant at all; an unknown repository is not found.
+	if response := post("dev", "/v1/supply-chain/imports?repository_id=102&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusForbidden {
+		t.Fatalf("import to ungranted repository = %d", response.Code)
+	}
+	if response := post("reader", "/v1/supply-chain/imports?repository_id=101&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusForbidden {
+		t.Fatalf("reader import = %d", response.Code)
+	}
+	if response := post("dev", "/v1/supply-chain/imports?repository_id=999&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusNotFound {
+		t.Fatalf("unknown repository import = %d", response.Code)
+	}
+	// Explicit rejections: unsupported version, wrong format claim, bad label, bad revision, wrong media type, malformed.
+	for name, target := range map[string]struct {
+		path, contentType, body string
+		status                  int
+	}{
+		"old spdx":         {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/spdx+json", strings.Replace(string(spdxMember), "SPDX-2.3", "SPDX-2.2", 1), http.StatusUnsupportedMediaType},
+		"old cyclonedx":    {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/json", strings.Replace(string(cyclonedx), `"specVersion": "1.6"`, `"specVersion": "1.5"`, 1), http.StatusUnsupportedMediaType},
+		"mismatched claim": {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/spdx+json", string(cyclonedx), http.StatusUnsupportedMediaType},
+		"unknown format":   {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/json", `{"hello":"world"}`, http.StatusUnsupportedMediaType},
+		"malformed":        {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "application/json", `{"spdxVersion":"SPDX-2.3","packages":"x"}`, http.StatusBadRequest},
+		"bad label":        {"/v1/supply-chain/imports?repository_id=101&subject=source&label=Bad%20Label", "application/json", string(spdxMember), http.StatusBadRequest},
+		"bad subject":      {"/v1/supply-chain/imports?repository_id=101&subject=release&label=x", "application/json", string(spdxMember), http.StatusBadRequest},
+		"bad revision":     {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x&subject_revision=HEAD", "application/json", string(spdxMember), http.StatusBadRequest},
+		"wrong media type": {"/v1/supply-chain/imports?repository_id=101&subject=source&label=x", "text/plain", string(spdxMember), http.StatusUnsupportedMediaType},
+	} {
+		response := post("admin", target.path, target.contentType, []byte(target.body))
+		if response.Code != target.status {
+			t.Fatalf("%s = %d, want %d: %s", name, response.Code, target.status, response.Body.String())
+		}
+	}
+	// Quota counts accepted and rejected attempts per repository per window.
+	count, err := h.store.SupplyChainImportCount(t.Context(), widgets, time.Now().Add(-time.Hour))
+	if err != nil || count < 8 {
+		t.Fatalf("import count = %d %v", count, err)
+	}
+	importer.QuotaPerRepository = count
+	if response := post("admin", "/v1/supply-chain/imports?repository_id=101&subject=source&label=quota", "application/json", []byte(strings.Replace(string(spdxMember), `"name": "com.github.acme/widgets"`, `"name": "quota"`, 1))); response.Code != http.StatusTooManyRequests {
+		t.Fatalf("over quota = %d %s", response.Code, response.Body.String())
+	}
+	// Another repository has its own quota.
+	if response := post("admin", "/v1/supply-chain/imports?repository_id=102&subject=source&label=ort", "application/spdx+json", []byte(ortDocument)); response.Code != http.StatusCreated {
+		t.Fatalf("other repository import = %d %s", response.Code, response.Body.String())
+	}
+	// Idempotent replay of an accepted document is still answered when over quota (it does no new work).
+	if response := post("admin", "/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image", "application/vnd.cyclonedx+json", cyclonedx); response.Code != http.StatusCreated {
+		t.Fatalf("replay over quota = %d", response.Code)
+	}
+}
+
+func documentPath(status *api.SupplyChainRepositoryStatus) *string {
+	if len(status.Documents) == 0 {
+		empty := ""
+		return &empty
+	}
+	return &status.Documents[0].Path
+}
+
+// TestSupplyChainDerivedSPDXExport proves the derived document names
+// GraphNest as creator, links the preserved original by URL and hash, carries
+// assessments only as comments, validates with the SPDX reader, and never
+// alters the original download.
+func TestSupplyChainDerivedSPDXExport(t *testing.T) {
+	h := newPostgresHarness(t)
+	widgets := h.seedRepository(t, 10, 101)
+	github, client := newFakeSBOMGitHub(t)
+	envelope := sbomEnvelope(t)
+	github.responses["acme/repo-101"] = func(writer http.ResponseWriter) { fmt.Fprint(writer, envelope) }
+	collector := &supplychain.Collector{Store: h.store, GitHub: client, Owner: "collect", MaxDocumentBytes: 1 << 20}
+	if _, _, err := h.store.EnqueueSupplyChainJob(t.Context(), widgets, supplychain.StreamGitHubSource, "manual", "t", 10, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := collector.RunOnce(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	leftPad := license.Coordinates{Ecosystem: "npm", Namespace: "@scope", Name: "left-pad", Version: "1.3.0"}
+	if _, _, err := h.store.InsertLicenseEvidence(t.Context(), license.Evidence{Source: license.SourceRegistryNPM, Route: "npm:test", Coordinates: leftPad, Outcome: license.OutcomeResolved, FetchedAt: time.Now(), RawValue: "MIT", RawKind: license.RawExpression,
+		ParseStatus: "parsed", NormalizedExpression: "MIT", ResolverVersion: 1, LicenseListVersion: "3.27.0", ContentSHA256: make([]byte, 32)}); err != nil {
+		t.Fatal(err)
+	}
+	occurrences, _ := h.store.ComponentsForCoordinates(t.Context(), leftPad, 10)
+	evidence, _ := h.store.LatestLicenseEvidence(t.Context(), leftPad)
+	declared, concluded, _ := h.store.ComponentDeclarations(t.Context(), occurrences[0][0])
+	if err := h.store.UpsertAssessment(t.Context(), license.Assess(occurrences[0][0], occurrences[0][1], declared, concluded, evidence, time.Now())); err != nil {
+		t.Fatal(err)
+	}
+	service := &supplychain.Service{Store: h.store, Authorizer: authz.NewPostgres(h.store), Interval: time.Hour, MaxResults: 100, License: h.store}
+	portfolio := &supplychain.Portfolio{Store: h.store, Snapshots: h.store, Authorizer: authz.NewPostgres(h.store), Interval: time.Hour, MaxResults: 100}
+	authenticator := authn.RequestAuthenticator{Bearer: authn.NewStatic(map[string]authn.Principal{
+		"acme":  {Subject: "acme", Method: "api_token", InstallationID: 10, RepositoryIDs: []int64{101}},
+		"other": {Subject: "other", Method: "api_token", InstallationID: 20, RepositoryIDs: []int64{999}},
+	})}
+	mux := http.NewServeMux()
+	httpapi.RegisterSupplyChain(mux, authenticator, service, 100, 256<<10)
+	httpapi.RegisterSupplyChainPortfolio(mux, authenticator, portfolio, 100, 256<<10, &httpapi.DerivedExport{Service: service, PublicOrigin: "https://graphnest.example"})
+	get := func(token, path string) *httptest.ResponseRecorder {
+		request := httptest.NewRequest(http.MethodGet, path, nil)
+		request.Header.Set("Authorization", "Bearer "+token)
+		recorder := httptest.NewRecorder()
+		mux.ServeHTTP(recorder, request)
+		return recorder
+	}
+	response := get("acme", "/v1/supply-chain/exports/101/derived.spdx.json")
+	if response.Code != http.StatusOK || response.Header().Get("Content-Type") != "application/spdx+json" || response.Header().Get("X-GraphNest-Derived") != "true" {
+		t.Fatalf("derived export = %d %v %s", response.Code, response.Header(), response.Body.String())
+	}
+	var derived struct {
+		SPDXVersion  string `json:"spdxVersion"`
+		Name         string `json:"name"`
+		CreationInfo struct {
+			Creators []string `json:"creators"`
+			Comment  string   `json:"comment"`
+		} `json:"creationInfo"`
+		ExternalDocumentRefs []struct {
+			ExternalDocumentID string `json:"externalDocumentId"`
+			SPDXDocument       string `json:"spdxDocument"`
+			Checksum           struct {
+				Algorithm string `json:"algorithm"`
+				Value     string `json:"checksumValue"`
+			} `json:"checksum"`
+		} `json:"externalDocumentRefs"`
+		DocumentDescribes []string `json:"documentDescribes"`
+		Packages          []struct {
+			SPDXID           string `json:"SPDXID"`
+			Name             string `json:"name"`
+			LicenseDeclared  string `json:"licenseDeclared"`
+			LicenseConcluded string `json:"licenseConcluded"`
+			LicenseComments  string `json:"licenseComments"`
+		} `json:"packages"`
+		Relationships []struct {
+			Type string `json:"relationshipType"`
+		} `json:"relationships"`
+	}
+	if err := json.Unmarshal(response.Body.Bytes(), &derived); err != nil {
+		t.Fatal(err)
+	}
+	if derived.SPDXVersion != "SPDX-2.3" || len(derived.CreationInfo.Creators) != 2 || !strings.HasPrefix(derived.CreationInfo.Creators[0], "Tool: GraphNest-supply-chain-") || !strings.Contains(derived.CreationInfo.Comment, "preserved unchanged") {
+		t.Fatalf("creation info = %+v", derived.CreationInfo)
+	}
+	original := get("acme", "/v1/supply-chain/snapshots/1/document")
+	if len(derived.ExternalDocumentRefs) != 1 || derived.ExternalDocumentRefs[0].SPDXDocument != "https://graphnest.example/v1/supply-chain/snapshots/1/document" || derived.ExternalDocumentRefs[0].Checksum.Value != original.Header().Get("X-Content-SHA256") {
+		t.Fatalf("external refs = %+v (original sha %s)", derived.ExternalDocumentRefs, original.Header().Get("X-Content-SHA256"))
+	}
+	if len(derived.Packages) != 7 || len(derived.DocumentDescribes) != 1 || derived.DocumentDescribes[0] != "SPDXRef-com.github.acme-widgets" {
+		t.Fatalf("packages = %d describes = %v", len(derived.Packages), derived.DocumentDescribes)
+	}
+	for _, pkg := range derived.Packages {
+		if pkg.LicenseConcluded != "NOASSERTION" {
+			t.Fatalf("derived export must not conclude licenses: %+v", pkg)
+		}
+		if pkg.LicenseDeclared != "NOASSERTION" {
+			t.Fatalf("GHES NOASSERTION must stay NOASSERTION: %+v", pkg)
+		}
+		if pkg.Name == "npm:@scope/left-pad" && !strings.Contains(pkg.LicenseComments, "GraphNest assessment: resolved (MIT)") {
+			t.Fatalf("assessment must appear as a comment only: %+v", pkg)
+		}
+	}
+	describes, dependsOn := 0, 0
+	for _, relationship := range derived.Relationships {
+		switch relationship.Type {
+		case "DESCRIBES":
+			describes++
+		case "DEPENDS_ON":
+			dependsOn++
+		}
+	}
+	if describes != 1 || dependsOn != 6 {
+		t.Fatalf("relationships = %d DESCRIBES, %d DEPENDS_ON (the unresolved edge must be dropped)", describes, dependsOn)
+	}
+	// The original is still served byte-for-byte and is a different document.
+	if original.Code != http.StatusOK || original.Body.String() != strings.TrimSpace(envelope[len(`{"sbom":`):len(envelope)-1]) {
+		t.Fatalf("original changed: %d", original.Code)
+	}
+	if response := get("other", "/v1/supply-chain/exports/101/derived.spdx.json"); response.Code != http.StatusNotFound {
+		t.Fatalf("unauthorized derived export = %d", response.Code)
+	}
+}

From 26fbe2045eb6a10e0a84cb8522379e50fd2590c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?D=C3=A1vid=20Balatoni?= <balcsida@gmail.com>
Date: Tue, 22 Sep 2026 22:09:10 +0200
Subject: [PATCH 2/2] docs(supply-chain): describe imports, producer examples,
 and derived exports

Co-Authored-By: Claude <noreply@anthropic.com>
---
 CHANGELOG.md       | 17 ++++++++++++
 README.md          |  2 ++
 docs/operations.md | 68 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 87 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c5ccd30..f3cb196c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,6 +28,23 @@ the compatibility and migration notes before upgrading.
   view (`GET /v1/supply-chain/repositories/{id}/component`). No route means no
   outbound license traffic. Migration 034 adds the evidence, enrichment-job,
   and assessment tables.
+- Portfolio read APIs over the caller's authorized repositories: an overview
+  whose every count names its denominator, keyset-paginated unique
+  coordinates with ecosystem, search, license, and assessment filters,
+  bounded facets, a coordinate detail listing authorized occurrences, a CSV
+  export with provenance columns and formula-safe cells, and a snapshot
+  comparison that separates component, declared-license, and edge changes
+  from document metadata changes.
+- Standards-based imports of SPDX 2.3 JSON and CycloneDX 1.6 JSON into
+  declared `import:<subject>:<label>` streams (`POST /v1/supply-chain/imports`),
+  with format detection from the document, explicit rejection of other
+  formats and versions, byte-preserving storage, uploader identity recorded
+  apart from the claimed producer, producer-asserted subject binding,
+  idempotency, per-repository quotas, and administrator-managed upload grants
+  (`PUT /v1/supply-chain/upload-grants`). A derived SPDX export
+  (`GET /v1/supply-chain/exports/{id}/derived.spdx.json`) names GraphNest as
+  creator, links the preserved original, and carries assessments as comments
+  only. Migration 035 adds imports and upload grants.
 
 ## [0.5.0] - 2026-09-18
 
diff --git a/README.md b/README.md
index 6b505aa4..8d569ebc 100644
--- a/README.md
+++ b/README.md
@@ -213,6 +213,8 @@ What the inventory is and is not:
 - A failed refresh (403, 404, rate limit, malformed or oversized document, outage) records a collection attempt and leaves the last successful snapshot in place; the status reports `collection: failed` alongside the retained inventory.
 - Inventory eligibility is repository authorization alone. It works for repositories with no Zoekt index, no SCIP upload, and no graph enrichment, and inventory work never blocks lexical indexing.
 
+SBOMs produced elsewhere (Syft, ORT, or any tool writing SPDX 2.3 JSON or CycloneDX 1.6 JSON) can be imported into separate `import:<subject>:<label>` streams with `POST /v1/supply-chain/imports`; the uploader is recorded apart from the producer the document claims, and a derived SPDX export links back to the preserved original. Portfolio views (`/v1/supply-chain/overview`, `/components`, `/facets`, exports, comparison) aggregate only over the caller's authorized repositories and name every denominator.
+
 Every read resolves the live principal's repository scope before any inventory row is touched; snapshot and job identifiers outside that scope are indistinguishable from missing ones. Manual refresh (`POST /v1/supply-chain/repositories/{id}/refresh`) only enqueues a bounded background job and requires administrator access. The published snapshot is also projected into the existing GitHub-sourced SCIP package mappings; manual mappings are never touched. See [Operations](docs/operations.md#dependencies--licenses-inventory) and [ADR-0017](docs/adr/0017-supply-chain-inventory.md).
 
 ## Durable mode
diff --git a/docs/operations.md b/docs/operations.md
index 00c716e1..f5e3c372 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -224,6 +224,74 @@ different expressions, or an expression against `UNLICENSED`/`NONE`),
 An assessment is evidence, not approval; the review workflow records
 conclusions and decisions separately.
 
+### Standards-based imports
+
+`POST /v1/supply-chain/imports?repository_id=<github id>&subject=<source|artifact>&label=<stream label>`
+accepts SPDX 2.3 JSON (`application/spdx+json`) and CycloneDX 1.6 JSON
+(`application/vnd.cyclonedx+json`); `application/json` is accepted and the
+format is detected from the document itself. Other formats and schema
+versions (SPDX 2.2, CycloneDX 1.5, XML, tag-value) are rejected with
+`415 unsupported_format`; GraphNest does not claim universal SBOM
+compatibility. Each `(subject, label)` pair is its own stream
+(`import:source:ort`, `import:artifact:syft-image`), separate from the GitHub
+observation, so a container SBOM never replaces the repository's GitHub
+snapshot and an older artifact upload never becomes the current source
+inventory.
+
+Permission: administrators may import into any authorized repository. Other
+principals need a repository-scoped upload grant
+(`PUT /v1/supply-chain/upload-grants` by an administrator, keyed by the
+principal's subject). A grant never widens read access. Quota: 100 imports
+per repository per 24 hours, counting rejected attempts. Identical bytes into
+the same stream are idempotent (`repeated: true`). Documents are bounded by
+`GRAPHNEST_SUPPLY_CHAIN_MAX_DOCUMENT_BYTES` and `..._MAX_COMPONENTS`.
+
+Trust boundaries: the authenticated uploader is recorded on the snapshot
+(`uploaded_by`) separately from the tool the document names, which is only
+the document's own claim; a `Tool: ORT` string grants nothing. An optional
+`subject_revision` (40-hex commit) is recorded as `producer_asserted`, never
+`verified`. Download locations, license URLs, and external document
+references inside uploads are never dereferenced.
+
+What is and is not carried: original bytes are always preserved and
+downloadable. From SPDX, GraphNest normalizes packages, versions, purls,
+checksums, suppliers, declared/concluded license values (verbatim), and every
+relationship with its direction. From CycloneDX, it flattens nested
+components (with `CONTAINS` edges), keeps `dependencies` as `DEPENDS_ON`,
+hashes, suppliers, purl qualifiers, and license choices as the format carries
+them: one `expression` or SPDX `id` verbatim; a `name`/`url` as a name or
+URL; several license objects as a semicolon list (CycloneDX defines no
+AND/OR meaning for them, so none is invented). CycloneDX component
+`evidence` (license findings, copyright, file occurrences), inline license
+text, ORT's per-file scan results and curations, and Syft's file catalog stay
+only in the stored original and are flagged by coverage warnings
+(`evidence_not_carried`, `license_text_inline`). GraphNest has no native
+ScanCode or Code Insight adapter; it imports what those tools export in the
+two supported formats.
+
+Producer examples (each writes a supported format; the fixtures under
+`test/fixtures/supplychain/` are sanitized shapes of these outputs):
+
+```sh
+# Syft: CycloneDX 1.6 JSON of a built image (artifact subject)
+syft registry.example.internal/acme/widgets:1.4.2 -o cyclonedx-json@1.6 > widgets-image.cdx.json
+curl --fail-with-body -X POST "https://graphnest.example/v1/supply-chain/imports?repository_id=101&subject=artifact&label=syft-image" \
+  -H "Authorization: Bearer $GRAPHNEST_TOKEN" -H 'Content-Type: application/vnd.cyclonedx+json' --data-binary @widgets-image.cdx.json
+
+# ORT: SPDX 2.3 JSON report of the analyzed source tree (source subject)
+ort report -i analyzer-result.yml -o reports -f SpdxDocument -O SpdxDocument=outputFileFormats=JSON
+curl --fail-with-body -X POST "https://graphnest.example/v1/supply-chain/imports?repository_id=101&subject=source&label=ort&subject_revision=$GITHUB_SHA" \
+  -H "Authorization: Bearer $GRAPHNEST_TOKEN" -H 'Content-Type: application/spdx+json' --data-binary @reports/bom.spdx.json
+```
+
+Derived export: `GET /v1/supply-chain/exports/{id}/derived.spdx.json` returns
+an SPDX 2.3 JSON document created by GraphNest that links the preserved
+original by URL and SHA-256 and adds assessments as `licenseComments` only
+(`licenseConcluded` is always `NOASSERTION`). It is validated with
+GraphNest's own reader before it is served and is never presented as the
+producer's document. `GET /v1/supply-chain/exports/{id}/components.csv` is
+the tabular equivalent with provenance columns and formula-safe cells.
+
 ## Break-glass administrator recovery
 
 SSO remains the primary sign-in method. Use the offline command only when an