tesla-technologies/PurlWatch ? reverse-engineered prompt

Build me a Python tool that takes a software bill of materials and tells me what it can learn about each dependency from public package metadata.

I want a command I can run locally on an SBOM file that prints, for every component, its Package URL, the repository it points to, how confident the match is, and the version history it can see from the registry. It should work offline when I point it at saved registry data, and it should handle both npm and crates.io to start.

Please include the local library code behind it too, not just the command, so the same logic can be reused later for signals and signed attestations. Use the example SBOMs in the repo as guidance, and make sure the output is clear and easy to read for a normal person. If you need to check current docs for CycloneDX, SPDX, or package metadata formats, look them up online.