Add streaming SBOM inspection

README.md

@@ -32,6 +32,19 @@ for _, p := range doc.Packages {
 
 `Parse` auto-detects the format. `Detect` returns just the type without a full parse, scanning JSON keys, the XML root, or the tag-value document header.
 
+`Inspect` reads the type and specification version from an `io.Reader`. It stops once both values are known and skips unrelated JSON values without building the package model:
+
+```go
+file, _ := os.Open("bom.cdx.json")
+defer file.Close()
+
+metadata, err := sbom.Inspect(file)
+if err != nil {
+    log.Fatal(err)
+}
+fmt.Println(metadata.Type, metadata.SpecVersion)
+```
+
 Packages with different document IDs or PURLs remain separate, even when their names and versions match. `AddPackage` replaces an entry only when its name, version, document ID, and set of PURLs match. `Package.PURL()` returns the first PURL; `Package.ExternalRefs` retains all declared references.
 
 ```go

bench_test.go

@@ -1,6 +1,7 @@
 package sbom
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -129,6 +130,23 @@ func BenchmarkDetect(b *testing.B) {
 	}
 }
 
+func BenchmarkInspect(b *testing.B) {
+	for _, f := range benchFixtures {
+		data := readFixture(b, f.path)
+		b.Run(f.name, func(b *testing.B) {
+			b.ReportAllocs()
+			b.SetBytes(int64(len(data)))
+			b.ResetTimer()
+			for range b.N {
+				_, benchmarkError = Inspect(bytes.NewReader(data))
+			}
+			if benchmarkError != nil {
+				b.Fatal(benchmarkError)
+			}
+		})
+	}
+}
+
 func BenchmarkPackagePURL(b *testing.B) {
 	doc := mustParseBenchmark(b, readFixture(b, "cyclonedx/juice-shop.cdx.json"))
 	b.Run(fmt.Sprintf("%d-pkgs", len(doc.Packages)), func(b *testing.B) {

go.mod

@@ -1,5 +1,5 @@
 module github.com/git-pkgs/sbom
 
-go 1.26
+go 1.27
 
-toolchain go1.26.7
+toolchain go1.27.3