@databricks/appkit 0.34.1 → 0.35.1

package/docs/plugins/lakebase.md

@@ -115,6 +115,95 @@ await createApp({
 
 ```
 
+## On-Behalf-Of (OBO) — per-user connections[​](#on-behalf-of-obo--per-user-connections "Direct link to On-Behalf-Of (OBO) — per-user connections")
+
+When your app needs Row-Level Security (RLS) or per-user data isolation, use `asUser(req)` to execute queries using a per-user Lakebase connection pool. Each user's pool is authenticated with their Databricks identity, so PostgreSQL's `current_user` reflects the actual user.
+
+### Prerequisites[​](#prerequisites-1 "Direct link to Prerequisites")
+
+1. **Enable user authorization** in your Databricks App with the **`postgres`** scope. See [User authorization](https://docs.databricks.com/aws/en/dev-tools/databricks-apps/auth#user-authorization) for setup instructions. In your `databricks.yml`:
+
+   ```yaml
+   resources:
+     apps:
+       app:
+         user_api_scopes:
+           - postgres
+
+   ```
+
+   Apps scaffolded with `databricks apps init` and the Lakebase plugin include this automatically.
+
+2. Each app user needs a **Postgres role** in Lakebase. Create one with the Databricks CLI:
+
+   ```bash
+   databricks postgres create-role "projects/{project_id}/branches/{branch_id}" \
+     --json '{"spec": {"identity_type": "USER", "postgres_role": "user@example.com"}}'
+
+   ```
+
+   Alternatively, create roles in the Lakebase UI under **Branch Overview** → **Add role**.
+
+   note
+
+   Do not grant `databricks_superuser` to OBO users — superusers bypass RLS. Use [fine-grained grants](#fine-grained-permissions) instead.
+
+### Usage[​](#usage "Direct link to Usage")
+
+No configuration needed — just call `asUser(req)`:
+
+```ts
+const AppKit = await createApp({
+  plugins: [server(), lakebase()],
+});
+
+// Service principal query (default — bypasses RLS as table owner)
+const all = await AppKit.lakebase.query("SELECT * FROM app.orders");
+
+// User-scoped query (per-user pool, RLS enforced)
+app.get("/api/my-orders", async (req, res) => {
+  const result = await AppKit.lakebase
+    .asUser(req)
+    .query("SELECT * FROM app.orders ORDER BY created_at DESC");
+  res.json(result.rows);
+});
+
+```
+
+When `asUser(req)` is called:
+
+1. The user's token and identity are extracted from `x-forwarded-access-token` and `x-forwarded-email` headers (set automatically by Databricks Apps).
+2. A per-user `pg.Pool` is created (or reused) with the user's OAuth credentials.
+3. `query()` and `pool` use the user's pool — `current_user` in PostgreSQL reflects the user's identity.
+
+### Row-Level Security example[​](#row-level-security-example "Direct link to Row-Level Security example")
+
+```sql
+-- As the service principal (during app setup):
+ALTER TABLE app.orders ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY user_orders ON app.orders
+  FOR ALL TO PUBLIC
+  USING (owner = current_user);
+
+-- Grant access so OBO users can query
+GRANT USAGE ON SCHEMA app TO PUBLIC;
+GRANT SELECT, INSERT ON ALL TABLES IN SCHEMA app TO PUBLIC;
+
+```
+
+### How it works[​](#how-it-works "Direct link to How it works")
+
+* The **service principal pool** (`AppKit.lakebase.pool`) is always created and used for DDL operations, seeding, and admin queries.
+* **Per-user pools** are created on the first `asUser(req)` call and cached by user identity. Each pool has its own OAuth token refresh cycle.
+* Idle connections within per-user pools close automatically (30s idle timeout). Empty pool objects are cleaned up periodically.
+* On shutdown, all pools (SP + user) are closed gracefully.
+* In development mode (`NODE_ENV=development`), if no user token is available, `asUser(req)` falls back to the SP pool with a warning.
+
+RLS and superusers
+
+PostgreSQL superusers bypass Row-Level Security entirely. Users with the `databricks_superuser` role will see all rows regardless of RLS policies. For RLS enforcement, use [fine-grained grants](#fine-grained-permissions) instead of the superuser role.
+
 ## Database Permissions[​](#database-permissions "Direct link to Database Permissions")
 
 When you create the app with the Lakebase resource using the [Getting started](#getting-started-with-the-lakebase) guide, the Service Principal is automatically granted `CONNECT_AND_CREATE` permission on the `postgres` resource. This lets the Service Principal connect to the database and create new objects, but **not access any existing schemas or tables.**
@@ -125,15 +214,30 @@ To develop locally against a deployed Lakebase database:
 
 1. **Deploy the app first.** The Service Principal creates the database schema and tables on first deploy. Apps generated from `databricks apps init` handle this automatically - they check if tables exist on startup and skip creation if they do.
 
-2. **Grant `databricks_superuser` via the Lakebase UI:**
+2. **Grant `databricks_superuser`** (skip if you are the Lakebase project owner — you already have full access):
+
+   ```bash
+   # Create a new role with databricks_superuser
+   databricks postgres create-role "projects/{project_id}/branches/{branch_id}" \
+     --json '{"spec": {"identity_type": "USER", "postgres_role": "user@example.com", "membership_roles": ["DATABRICKS_SUPERUSER"]}}'
 
-   1. Open the Lakebase Autoscaling UI and navigate to your project's **Branch Overview** page.
-   2. Click **Add role** (or **Edit role** if your OAuth role already exists).
-   3. Select your Databricks identity as the principal and check the **`databricks_superuser`** system role.
+   ```
+
+   To grant superuser to an existing role, use [`update-role`](https://docs.databricks.com/aws/en/dev-tools/cli/reference/postgres-commands#databricks-postgres-update-role):
+
+   ```bash
+   databricks postgres update-role \
+     "projects/{project_id}/branches/{branch_id}/roles/{role_id}" \
+     "spec.membership_roles" \
+     --json '{"spec": {"membership_roles": ["DATABRICKS_SUPERUSER"]}}'
+
+   ```
+
+   Alternatively, you can manage roles in the Lakebase Autoscaling UI under your project's **Branch Overview** page → **Add role** / **Edit role**.
 
 3. **Run locally** - your Databricks user identity (email) is used for OAuth authentication. The `databricks_superuser` role gives full **DML access** (read/write data) but **not DDL** (creating schemas or tables) - that's why deploying first matters (see note below).
 
-For other users, use the same **Add role** flow in the Lakebase UI to create an OAuth role with `databricks_superuser` for each user.
+For other users, repeat step 2 to create an OAuth role with `databricks_superuser` for each user.
 
 tip
 
@@ -141,7 +245,9 @@ tip
 
 Why deploy first?
 
-When the app is deployed, the Service Principal creates schemas and tables and becomes their owner. A `databricks_superuser` has full **DML access** (SELECT, INSERT, UPDATE, DELETE) to these objects, but **cannot run DDL** (CREATE SCHEMA, CREATE TABLE) on schemas owned by the Service Principal. Deploying first ensures all objects exist before local development begins.
+When the app is deployed, the Service Principal creates schemas and tables and becomes their owner. `databricks_superuser` gives full DML access (read/write) but not DDL, so local development works only after the schema exists.
+
+If you run `npm run dev` first, your credentials own the schema and the deployed app hits `permission denied`. To recover, export any data first (`pg_dump` or a temporary schema copy), then drop the schema and redeploy. After redeploying, the Service Principal recreates the schema on startup. (PostgreSQL schema ownership is tied to the role that created it and cannot be reassigned by regular users.)
 
 ### Fine-grained permissions[​](#fine-grained-permissions "Direct link to Fine-grained permissions")
 

package/llms.txt

@@ -83,6 +83,7 @@ npx @databricks/appkit docs <query>
 - [Function: createAgent()](./docs/api/appkit/Function.createAgent.md): Pure factory for agent definitions. Returns the passed-in definition after
 - [Function: createApp()](./docs/api/appkit/Function.createApp.md): Bootstraps AppKit with the provided configuration.
 - [Function: createLakebasePool()](./docs/api/appkit/Function.createLakebasePool.md): Create a Lakebase pool with appkit's logger integration.
+- [Function: createLakebasePoolManager()](./docs/api/appkit/Function.createLakebasePoolManager.md): Create a pool manager that maintains per-key Lakebase connection pools.
 - [Function: defineTool()](./docs/api/appkit/Function.defineTool.md): Defines a single tool entry for a plugin's internal registry.
 - [Function: executeFromRegistry()](./docs/api/appkit/Function.executeFromRegistry.md): Validates tool-call arguments against the entry's schema and invokes its
 - [Function: extractServingEndpoints()](./docs/api/appkit/Function.extractServingEndpoints.md): Extract serving endpoint config from a server file by AST-parsing it.
@@ -128,7 +129,9 @@ npx @databricks/appkit docs <query>
 - [Interface: JobAPI](./docs/api/appkit/Interface.JobAPI.md): User-facing API for a single configured job.
 - [Interface: JobConfig](./docs/api/appkit/Interface.JobConfig.md): Per-job configuration options.
 - [Interface: JobsConnectorConfig](./docs/api/appkit/Interface.JobsConnectorConfig.md): Properties
+- [Interface: LakebasePool](./docs/api/appkit/Interface.LakebasePool.md): Subset of pg.Pool exposed by the Lakebase plugin.
 - [Interface: LakebasePoolConfig](./docs/api/appkit/Interface.LakebasePoolConfig.md): Configuration for creating a Lakebase connection pool
+- [Interface: LakebasePoolManager](./docs/api/appkit/Interface.LakebasePoolManager.md): Manages multiple Lakebase connection pools keyed by an identifier (e.g. userId).
 - [Interface: McpConnectAllResult](./docs/api/appkit/Interface.McpConnectAllResult.md): Per-endpoint outcome of AppKitMcpClient.connectAll. Callers (the
 - [Interface: Message](./docs/api/appkit/Interface.Message.md): Properties
 - [Interface: PluginManifest<TName>](./docs/api/appkit/Interface.PluginManifest.md): Plugin manifest that declares metadata and resource requirements.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@databricks/appkit",
   "type": "module",
-  "version": "0.34.1",
+  "version": "0.35.1",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "packageManager": "pnpm@10.21.0",

package/sbom.cdx.json

@@ -1 +1 @@
-{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:e5010603-604d-4cbe-bf40-1accb35b7744","version":1,"metadata":{"timestamp":"2026-05-13T18:55:49Z","tools":{"components":[{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"appkit","group":"@databricks","version":"0.34.1","purl":"pkg:npm/%40databricks/appkit@0.34.1","bom-ref":"pkg:npm/@databricks/appkit@0.34.1","type":"application","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}]},"properties":[{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"cdx:bom:componentNamespaces","value":"@ast-grep\\n@databricks\\n@opentelemetry"},{"name":"cdx:bom:componentSrcFiles","value":"packages/appkit/node_modules/@ast-grep/napi/package.json\\npackages/appkit/node_modules/@databricks/lakebase/package.json\\npackages/appkit/node_modules/@databricks/sdk-experimental/package.json\\npackages/appkit/node_modules/@opentelemetry/api-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/api/package.json\\npackages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation/package.json\\npackages/appkit/node_modules/@opentelemetry/resources/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-node/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json\\npackages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json\\npackages/appkit/node_modules/dotenv/package.json\\npackages/appkit/node_modules/express/package.json\\npackages/appkit/node_modules/get-port/package.json\\npackages/appkit/node_modules/js-yaml/package.json\\npackages/appkit/node_modules/obug/package.json\\npackages/appkit/node_modules/pg/package.json\\npackages/appkit/node_modules/picocolors/package.json\\npackages/appkit/node_modules/semver/package.json\\npackages/appkit/node_modules/shared/package.json\\npackages/appkit/node_modules/ws/package.json\\npackages/appkit/node_modules/zod/package.json"}]},"components":[{"group":"@ast-grep","name":"napi","version":"0.37.0","description":"Search and Rewrite code at large scale using precise AST pattern","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/%40ast-grep/napi@0.37.0","externalReferences":[{"type":"vcs","url":"https://ast-grep.github.io"}],"type":"library","bom-ref":"pkg:npm/@ast-grep/napi@0.37.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@ast-grep/napi/package.json"},{"name":"ImportedModules","value":"@ast-grep/napi,Lang,@ast-grep/napi/Lang,parse,@ast-grep/napi/parse,SgNode,@ast-grep/napi/SgNode"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"concludedValue":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"occurrences":[{"location":"dist/type-generator/serving/server-file-extractor.js#4"},{"location":"tmp/dist/cli/commands/codemod/on-plugins-ready.js#4"},{"location":"tmp/dist/cli/commands/lint.js#4"},{"location":"tmp/dist/cli/commands/plugin/sync/sync.js#7"},{"location":"tmp/dist/type-generator/serving/server-file-extractor.js#4"},{"location":"src/type-generator/serving/server-file-extractor.ts#3"}]}},{"group":"@databricks","name":"lakebase","version":"0.3.0","description":"PostgreSQL driver for Databricks Lakebase Autoscaling with automatic OAuth token refresh","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40databricks/lakebase@0.3.0","externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}],"type":"library","bom-ref":"pkg:npm/@databricks/lakebase@0.3.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@databricks/lakebase/package.json"},{"name":"ExportedModules","value":"@databricks/lakebase,DatabaseCredential,@databricks/lakebase/DatabaseCredential,GenerateDatabaseCredentialRequest,@databricks/lakebase/GenerateDatabaseCredentialRequest,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig,RequestedClaims,@databricks/lakebase/RequestedClaims,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,RequestedResource,@databricks/lakebase/RequestedResource"},{"name":"ImportedModules","value":"@databricks/lakebase,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,createLakebasePool,@databricks/lakebase/createLakebasePool,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"concludedValue":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"occurrences":[{"location":"dist/connectors/lakebase/index.js#2"},{"location":"tmp/dist/connectors/lakebase/index.js#2"},{"location":"src/connectors/lakebase/index.ts#4"},{"location":"src/connectors/lakebase/index.ts#37"}]},"tags":["token"]},{"group":"@databricks","name":"sdk-experimental","version":"0.17.0","description":"Databricks SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40databricks/sdk-experimental@0.17.0","externalReferences":[{"type":"vcs","url":"https://github.com/databricks/databricks-sdk-js"},{"type":"vcs","url":"git+https://github.com/databricks/databricks-sdk-js.git#main"}],"type":"library","bom-ref":"pkg:npm/@databricks/sdk-experimental@0.17.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@databricks/sdk-experimental/package.json"},{"name":"ImportedModules","value":"@databricks/sdk-experimental,ApiError,@databricks/sdk-experimental/ApiError,WorkspaceClient,@databricks/sdk-experimental/WorkspaceClient,Context,@databricks/sdk-experimental/Context,ConfigError,@databricks/sdk-experimental/ConfigError,jobs,@databricks/sdk-experimental/jobs,ApiClient,@databricks/sdk-experimental/ApiClient,Config,@databricks/sdk-experimental/Config,CancellationToken,@databricks/sdk-experimental/CancellationToken,serving,@databricks/sdk-experimental/serving,@databricks/sdk-experimental/sql,ClientOptions,@databricks/sdk-experimental/ClientOptions,files,@databricks/sdk-experimental/files,@databricks/sdk-experimental/dist/apis/dashboards,GenieMessage,@databricks/sdk-experimental/dist/apis/dashboards/GenieMessage,@databricks/sdk-experimental/dist/wait,Waiter,@databricks/sdk-experimental/dist/wait/Waiter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@databricks/sdk-experimental/package.json"}],"concludedValue":"packages/appkit/node_modules/@databricks/sdk-experimental/package.json"}],"occurrences":[{"location":"dist/cache/index.js#15"},{"location":"dist/connectors/files/client.js#5"},{"location":"dist/connectors/genie/client.js#5"},{"location":"dist/connectors/jobs/client.js#7"},{"location":"dist/connectors/lakebase-v1/client.js#6"},{"location":"dist/connectors/serving/client.js#2"},{"location":"dist/connectors/sql-warehouse/client.js#11"},{"location":"dist/context/service-context.js#7"},{"location":"dist/plugins/files/plugin.js#21"},{"location":"dist/type-generator/query-registry.js#5"},{"location":"dist/type-generator/serving/fetcher.js#2"},{"location":"dist/type-generator/serving/generator.js#7"},{"location":"tmp/dist/cache/index.js#15"},{"location":"tmp/dist/connectors/files/client.js#5"},{"location":"tmp/dist/connectors/genie/client.js#5"},{"location":"tmp/dist/connectors/jobs/client.js#7"},{"location":"tmp/dist/connectors/lakebase-v1/client.js#6"},{"location":"tmp/dist/connectors/serving/client.js#2"},{"location":"tmp/dist/connectors/sql-warehouse/client.js#11"},{"location":"tmp/dist/context/service-context.js#7"},{"location":"tmp/dist/plugins/files/plugin.js#21"},{"location":"tmp/dist/type-generator/query-registry.js#5"},{"location":"tmp/dist/type-generator/serving/fetcher.js#2"},{"location":"tmp/dist/type-generator/serving/generator.js#7"},{"location":"src/cache/index.ts#2"},{"location":"src/connectors/files/client.ts#1"},{"location":"src/connectors/genie/client.ts#1"},{"location":"src/connectors/genie/client.ts#2"},{"location":"src/connectors/jobs/client.ts#5"},{"location":"src/connectors/lakebase-v1/client.ts#2"},{"location":"src/connectors/lakebase-v1/client.ts#3"},{"location":"src/connectors/lakebase-v1/types.ts#1"},{"location":"src/connectors/serving/client.ts#5"},{"location":"src/connectors/serving/client.ts#6"},{"location":"src/connectors/sql-warehouse/client.ts#5"},{"location":"src/connectors/sql-warehouse/defaults.ts#1"},{"location":"src/connectors/vector-search/client.ts#1"},{"location":"src/context/service-context.ts#6"},{"location":"src/core/appkit.ts#1"},{"location":"src/internal-telemetry/reporter.ts#1"},{"location":"src/plugins/analytics/analytics.ts#1"},{"location":"src/plugins/analytics/query.ts#2"},{"location":"src/plugins/files/plugin.ts#3"},{"location":"src/plugins/files/types.ts#1"},{"location":"src/plugins/jobs/plugin.ts#2"},{"location":"src/plugins/jobs/types.ts#1"},{"location":"src/stream/arrow-stream-processor.ts#1"},{"location":"src/type-generator/query-registry.ts#3"},{"location":"src/type-generator/serving/fetcher.ts#1"},{"location":"src/type-generator/serving/generator.ts#3"},{"location":"src/connectors/genie/client.ts#3"},{"location":"src/connectors/genie/client.ts#4"}]},"tags":["sql"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api-logs","version":"0.208.0","description":"Public logs API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api-logs@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/api-logs"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api-logs@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api-logs"},{"name":"ImportedModules","value":"@opentelemetry/api-logs,SeverityNumber,@opentelemetry/api-logs/SeverityNumber,logs,@opentelemetry/api-logs/logs,NOOP_LOGGER,@opentelemetry/api-logs/NOOP_LOGGER,Logger,@opentelemetry/api-logs/Logger,LogRecord,@opentelemetry/api-logs/LogRecord"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"occurrences":[{"location":"dist/logging/wide-event-emitter.js#1"},{"location":"dist/telemetry/index.js#6"},{"location":"dist/telemetry/noop.js#2"},{"location":"dist/telemetry/telemetry-provider.js#4"},{"location":"tmp/dist/logging/wide-event-emitter.js#1"},{"location":"tmp/dist/telemetry/index.js#6"},{"location":"tmp/dist/telemetry/noop.js#2"},{"location":"tmp/dist/telemetry/telemetry-provider.js#4"},{"location":"src/logging/wide-event-emitter.ts#1"},{"location":"src/telemetry/index.ts#7"},{"location":"src/telemetry/noop.ts#97"},{"location":"src/telemetry/telemetry-provider.ts#3"},{"location":"src/telemetry/types.ts#2"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api","version":"1.9.0","description":"Public API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api@1.9.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/api"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api@1.9.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api,@opentelemetry/api-logs,Counter,@opentelemetry/api/Counter,Histogram,@opentelemetry/api/Histogram,Span,@opentelemetry/api/Span,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode"},{"name":"ImportedModules","value":"@opentelemetry/api,trace,@opentelemetry/api/trace,context,@opentelemetry/api/context,createContextKey,@opentelemetry/api/createContextKey,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode,INVALID_SPAN_CONTEXT,@opentelemetry/api/INVALID_SPAN_CONTEXT,createNoopMeter,@opentelemetry/api/createNoopMeter,metrics,@opentelemetry/api/metrics,Context,@opentelemetry/api/Context,Span,@opentelemetry/api/Span,SpanContext,@opentelemetry/api/SpanContext,SpanOptions,@opentelemetry/api/SpanOptions,Tracer,@opentelemetry/api/Tracer,Meter,@opentelemetry/api/Meter,Attributes,@opentelemetry/api/Attributes,Link,@opentelemetry/api/Link"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#6"},{"location":"dist/plugin/plugin.js#21"},{"location":"dist/stream/stream-manager.js#9"},{"location":"dist/telemetry/index.js#5"},{"location":"dist/telemetry/noop.js#1"},{"location":"dist/telemetry/telemetry-provider.js#3"},{"location":"tmp/dist/logging/logger.js#6"},{"location":"tmp/dist/plugin/plugin.js#21"},{"location":"tmp/dist/stream/stream-manager.js#9"},{"location":"tmp/dist/telemetry/index.js#5"},{"location":"tmp/dist/telemetry/noop.js#1"},{"location":"tmp/dist/telemetry/telemetry-provider.js#3"},{"location":"src/logging/logger.ts#3"},{"location":"src/plugin/plugin.ts#1"},{"location":"src/stream/stream-manager.ts#2"},{"location":"src/stream/types.ts#1"},{"location":"src/telemetry/index.ts#5"},{"location":"src/telemetry/index.ts#6"},{"location":"src/telemetry/noop.ts#17"},{"location":"src/telemetry/noop.ts#22"},{"location":"src/telemetry/telemetry-provider.ts#1"},{"location":"src/telemetry/telemetry-provider.ts#2"},{"location":"src/telemetry/trace-sampler.ts#1"},{"location":"src/telemetry/types.ts#1"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"auto-instrumentations-node","version":"0.67.2","description":"Metapackage which bundles opentelemetry node core and contrib instrumentations","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/auto-instrumentations-node@0.67.2","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/auto-instrumentations-node#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/auto-instrumentations-node@0.67.2","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/auto-instrumentations-node,getNodeAutoInstrumentations,@opentelemetry/auto-instrumentations-node/getNodeAutoInstrumentations"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#4"},{"location":"tmp/dist/telemetry/telemetry-manager.js#4"},{"location":"src/telemetry/telemetry-manager.ts#1"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-logs-otlp-proto","version":"0.208.0","description":"An OTLP exporter to send logs using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-logs-otlp-proto@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-logs-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-logs-otlp-proto@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-logs-otlp-proto,OTLPLogExporter,@opentelemetry/exporter-logs-otlp-proto/OTLPLogExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#5"},{"location":"tmp/dist/telemetry/telemetry-manager.js#5"},{"location":"src/telemetry/telemetry-manager.ts#2"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-metrics-otlp-proto","version":"0.208.0","description":"OpenTelemetry Collector Metrics Exporter allows user to send collected metrics to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-metrics-otlp-proto@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-metrics-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-metrics-otlp-proto@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-metrics-otlp-proto,OTLPMetricExporter,@opentelemetry/exporter-metrics-otlp-proto/OTLPMetricExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#6"},{"location":"tmp/dist/telemetry/telemetry-manager.js#6"},{"location":"src/telemetry/telemetry-manager.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-trace-otlp-proto","version":"0.208.0","description":"OpenTelemetry Collector Exporter allows user to send collected traces to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-trace-otlp-proto@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-trace-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-trace-otlp-proto@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-trace-otlp-proto,OTLPTraceExporter,@opentelemetry/exporter-trace-otlp-proto/OTLPTraceExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#7"},{"location":"tmp/dist/telemetry/telemetry-manager.js#7"},{"location":"src/telemetry/telemetry-manager.ts#4"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-express","version":"0.57.0","description":"OpenTelemetry instrumentation for `express` http web application framework","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-express@0.57.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-express#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"framework","bom-ref":"pkg:npm/@opentelemetry/instrumentation-express@0.57.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-express,ExpressInstrumentation,@opentelemetry/instrumentation-express/ExpressInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#2"},{"location":"tmp/dist/telemetry/instrumentations.js#2"},{"location":"src/telemetry/instrumentations.ts#2"}]},"tags":["framework","web"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-http","version":"0.208.0","description":"OpenTelemetry instrumentation for `node:http` and `node:https` http client and server modules","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-http@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation-http"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation-http@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-http,HttpInstrumentation,@opentelemetry/instrumentation-http/HttpInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#3"},{"location":"tmp/dist/telemetry/instrumentations.js#3"},{"location":"src/telemetry/instrumentations.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation","version":"0.208.0","description":"Base class for node which OpenTelemetry instrumentation modules extend","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation,registerInstrumentations,@opentelemetry/instrumentation/registerInstrumentations,Instrumentation,@opentelemetry/instrumentation/Instrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#8"},{"location":"tmp/dist/telemetry/telemetry-manager.js#8"},{"location":"src/telemetry/instrumentations.ts#1"},{"location":"src/telemetry/telemetry-manager.ts#8"},{"location":"src/telemetry/telemetry-provider.ts#4"},{"location":"src/telemetry/types.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"resources","version":"2.2.0","description":"OpenTelemetry SDK resources","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/resources@2.2.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/resources@2.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"},{"name":"ImportedModules","value":"@opentelemetry/resources,detectResources,@opentelemetry/resources/detectResources,envDetector,@opentelemetry/resources/envDetector,hostDetector,@opentelemetry/resources/hostDetector,processDetector,@opentelemetry/resources/processDetector,resourceFromAttributes,@opentelemetry/resources/resourceFromAttributes,Resource,@opentelemetry/resources/Resource"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#9"},{"location":"tmp/dist/telemetry/telemetry-manager.js#9"},{"location":"src/telemetry/telemetry-manager.ts#16"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-logs","version":"0.208.0","description":"OpenTelemetry logs SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-logs@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/sdk-logs"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-logs@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-logs,BatchLogRecordProcessor,@opentelemetry/sdk-logs/BatchLogRecordProcessor"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#10"},{"location":"tmp/dist/telemetry/telemetry-manager.js#10"},{"location":"src/telemetry/telemetry-manager.ts#17"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-metrics","version":"2.2.0","description":"OpenTelemetry metrics SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-metrics@2.2.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-metrics"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-metrics@2.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-metrics,PeriodicExportingMetricReader,@opentelemetry/sdk-metrics/PeriodicExportingMetricReader"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#11"},{"location":"tmp/dist/telemetry/telemetry-manager.js#11"},{"location":"src/telemetry/telemetry-manager.ts#18"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-node","version":"0.208.0","description":"OpenTelemetry SDK for Node.js","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-node@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-node@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-node,NodeSDK,@opentelemetry/sdk-node/NodeSDK"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#12"},{"location":"tmp/dist/telemetry/telemetry-manager.js#12"},{"location":"src/telemetry/telemetry-manager.ts#19"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-trace-base","version":"2.6.0","description":"OpenTelemetry Tracing","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-trace-base@2.6.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-trace-base@2.6.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-trace-base,SamplingDecision,@opentelemetry/sdk-trace-base/SamplingDecision,Sampler,@opentelemetry/sdk-trace-base/Sampler,SamplingResult,@opentelemetry/sdk-trace-base/SamplingResult"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"occurrences":[{"location":"dist/telemetry/trace-sampler.js#2"},{"location":"tmp/dist/telemetry/trace-sampler.js#2"},{"location":"src/telemetry/trace-sampler.ts#2"},{"location":"src/telemetry/trace-sampler.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"semantic-conventions","version":"1.38.0","description":"OpenTelemetry semantic conventions","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/semantic-conventions@1.38.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/semantic-conventions"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/semantic-conventions@1.38.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"},{"name":"ImportedModules","value":"@opentelemetry/semantic-conventions,ATTR_SERVICE_NAME,@opentelemetry/semantic-conventions/ATTR_SERVICE_NAME,ATTR_SERVICE_VERSION,@opentelemetry/semantic-conventions/ATTR_SERVICE_VERSION"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#13"},{"location":"tmp/dist/telemetry/telemetry-manager.js#13"},{"location":"src/telemetry/telemetry-manager.ts#23"}]}},{"group":"","name":"dotenv","version":"16.6.1","description":"Loads environment variables from .env file","scope":"required","licenses":[{"license":{"id":"BSD-2-Clause","url":"https://opensource.org/licenses/BSD-2-Clause"}}],"purl":"pkg:npm/dotenv@16.6.1","externalReferences":[{"type":"vcs","url":"https://github.com/motdotla/dotenv#readme"},{"type":"vcs","url":"git://github.com/motdotla/dotenv.git"}],"type":"library","bom-ref":"pkg:npm/dotenv@16.6.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/dotenv/package.json"},{"name":"ImportedModules","value":"dotenv,dotenv/config"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/dotenv/package.json"}],"concludedValue":"packages/appkit/node_modules/dotenv/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#19"},{"location":"dist/type-generator/index.js#7"},{"location":"tmp/dist/cli/index.js#8"},{"location":"tmp/dist/plugins/server/index.js#19"},{"location":"tmp/dist/type-generator/index.js#7"},{"location":"src/plugins/server/index.ts#4"},{"location":"src/type-generator/index.ts#3"},{"location":"tmp/dist/cli/index.js#8"}]}},{"authors":[{"name":"TJ Holowaychuk <tj@vision-media.ca>"}],"group":"","name":"express","version":"4.22.0","description":"Fast, unopinionated, minimalist web framework","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/express@4.22.0","externalReferences":[{"type":"website","url":"http://expressjs.com/"}],"type":"framework","bom-ref":"pkg:npm/express@4.22.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/express/package.json"},{"name":"ImportedModules","value":"express,NextFunction,express/NextFunction,Request,express/Request,Response,express/Response"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/express/package.json"}],"concludedValue":"packages/appkit/node_modules/express/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#20"},{"location":"dist/plugins/server/static-server.js#4"},{"location":"tmp/dist/plugins/server/index.js#20"},{"location":"tmp/dist/plugins/server/static-server.js#4"},{"location":"src/core/plugin-context.ts#1"},{"location":"src/logging/logger.ts#4"},{"location":"src/plugin/plugin.ts#2"},{"location":"src/plugins/agents/agents.ts#3"},{"location":"src/plugins/analytics/analytics.ts#2"},{"location":"src/plugins/files/plugin.ts#4"},{"location":"src/plugins/genie/genie.ts#2"},{"location":"src/plugins/jobs/plugin.ts#3"},{"location":"src/plugins/server/base-server.ts#1"},{"location":"src/plugins/server/index.ts#5"},{"location":"src/plugins/server/remote-tunnel/gate.ts#1"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-controller.ts#2"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#6"},{"location":"src/plugins/server/static-server.ts#3"},{"location":"src/plugins/server/static-server.ts#4"},{"location":"src/plugins/server/vite-dev-server.ts#3"},{"location":"src/plugins/serving/serving.ts#4"},{"location":"src/plugins/vector-search/vector-search.ts#1"}]},"tags":["framework","web"]},{"authors":[{"name":"Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)"}],"group":"","name":"get-port","version":"7.2.0","description":"Get an available port","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/get-port@7.2.0","type":"library","bom-ref":"pkg:npm/get-port@7.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/get-port/package.json"},{"name":"ImportedModules","value":"get-port,portNumbers,get-port/portNumbers"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/get-port/package.json"}],"concludedValue":"packages/appkit/node_modules/get-port/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#21"},{"location":"tmp/dist/plugins/server/index.js#21"},{"location":"src/plugins/server/index.ts#6"}]}},{"authors":[{"name":"Vladimir Zapparov <dervus.grim@gmail.com>"}],"group":"","name":"js-yaml","version":"4.1.1","description":"YAML 1.2 parser and serializer","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/js-yaml@4.1.1","type":"library","bom-ref":"pkg:npm/js-yaml@4.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/js-yaml/package.json"},{"name":"ImportedModules","value":"js-yaml"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/js-yaml/package.json"}],"concludedValue":"packages/appkit/node_modules/js-yaml/package.json"}],"occurrences":[{"location":"dist/core/agent/load-agents.js#5"},{"location":"tmp/dist/core/agent/load-agents.js#5"},{"location":"src/core/agent/load-agents.ts#4"}]}},{"authors":[{"name":"Kevin Deng <sxzz@sxzz.moe>"}],"group":"","name":"obug","version":"2.1.1","description":"A lightweight JavaScript debugging utility, forked from debug, featuring TypeScript and ESM support.","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/obug@2.1.1","externalReferences":[{"type":"vcs","url":"https://github.com/sxzz/obug#readme"},{"type":"vcs","url":"git+https://github.com/sxzz/obug.git"}],"type":"library","bom-ref":"pkg:npm/obug@2.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/obug/package.json"},{"name":"ImportedModules","value":"obug,createDebug,obug/createDebug"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/obug/package.json"}],"concludedValue":"packages/appkit/node_modules/obug/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#7"},{"location":"tmp/dist/logging/logger.js#7"},{"location":"src/logging/logger.ts#5"}]}},{"authors":[{"name":"Brian Carlson <brian.m.carlson@gmail.com>"}],"group":"","name":"pg","version":"8.18.0","description":"PostgreSQL client - pure javascript & libpq with the same API","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/pg@8.18.0","externalReferences":[{"type":"vcs","url":"https://github.com/brianc/node-postgres"},{"type":"vcs","url":"git://github.com/brianc/node-postgres.git"}],"type":"library","bom-ref":"pkg:npm/pg@8.18.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/pg/package.json"},{"name":"ImportedModules","value":"pg,Pool,pg/Pool,QueryResult,pg/QueryResult,QueryResultRow,pg/QueryResultRow"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/pg/package.json"}],"concludedValue":"packages/appkit/node_modules/pg/package.json"}],"occurrences":[{"location":"dist/connectors/lakebase-v1/client.js#7"},{"location":"tmp/dist/connectors/lakebase-v1/client.js#7"},{"location":"src/cache/storage/persistent.ts#2"},{"location":"src/connectors/lakebase/index.ts#5"},{"location":"src/connectors/lakebase-v1/client.ts#4"},{"location":"src/plugins/lakebase/lakebase.ts#1"}]}},{"authors":[{"name":"Alexey Raspopov"}],"group":"","name":"picocolors","version":"1.1.1","description":"The tiniest and the fastest library for terminal output formatting with ANSI colors","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/picocolors@1.1.1","type":"library","bom-ref":"pkg:npm/picocolors@1.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/picocolors/package.json"},{"name":"ImportedModules","value":"picocolors"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/picocolors/package.json"}],"concludedValue":"packages/appkit/node_modules/picocolors/package.json"}],"occurrences":[{"location":"dist/errors/configuration.js#3"},{"location":"dist/plugins/agents/agents.js#26"},{"location":"dist/plugins/server/client-config-sanitizer.js#2"},{"location":"dist/plugins/server/utils.js#2"},{"location":"dist/type-generator/migration.js#2"},{"location":"dist/type-generator/query-registry.js#6"},{"location":"dist/type-generator/serving/generator.js#8"},{"location":"tmp/dist/errors/configuration.js#3"},{"location":"tmp/dist/plugins/agents/agents.js#26"},{"location":"tmp/dist/plugins/server/client-config-sanitizer.js#2"},{"location":"tmp/dist/plugins/server/utils.js#2"},{"location":"tmp/dist/type-generator/migration.js#2"},{"location":"tmp/dist/type-generator/query-registry.js#6"},{"location":"tmp/dist/type-generator/serving/generator.js#8"},{"location":"src/errors/configuration.ts#1"},{"location":"src/plugins/agents/agents.ts#4"},{"location":"src/plugins/server/client-config-sanitizer.ts#1"},{"location":"src/plugins/server/utils.ts#5"},{"location":"src/type-generator/migration.ts#4"},{"location":"src/type-generator/query-registry.ts#4"},{"location":"src/type-generator/serving/generator.ts#4"}]}},{"authors":[{"name":"GitHub Inc."}],"group":"","name":"semver","version":"7.7.3","description":"The semantic version parser used by npm.","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/semver@7.7.3","externalReferences":[{"type":"vcs","url":"git+https://github.com/npm/node-semver.git"}],"type":"library","bom-ref":"pkg:npm/semver@7.7.3","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/semver/package.json"},{"name":"ImportedModules","value":"semver,coerce,semver/coerce"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/semver/package.json"}],"concludedValue":"packages/appkit/node_modules/semver/package.json"}],"occurrences":[{"location":"dist/context/service-context.js#8"},{"location":"tmp/dist/context/service-context.js#8"},{"location":"src/context/service-context.ts#7"}]}},{"group":"","name":"shared","version":"0.0.1","scope":"required","purl":"pkg:npm/shared@0.0.1","type":"library","bom-ref":"pkg:npm/shared@0.0.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/shared/package.json"},{"name":"ExportedModules","value":"shared,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,Message,shared/Message,Thread,shared/Thread,ThreadStore,shared/ThreadStore,ToolAnnotations,shared/ToolAnnotations,ToolProvider,shared/ToolProvider,GenieAttachmentResponse,shared/GenieAttachmentResponse,GenieMessageResponse,shared/GenieMessageResponse,GenieStatementResponse,shared/GenieStatementResponse,GenieStreamEvent,shared/GenieStreamEvent,BasePluginConfig,shared/BasePluginConfig,CacheConfig,shared/CacheConfig,IAppRouter,shared/IAppRouter,PluginData,shared/PluginData,StreamExecutionSettings,shared/StreamExecutionSettings,isSQLTypeMarker,shared/isSQLTypeMarker,shared/sql"},{"name":"ImportedModules","value":"shared,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,CacheConfig,shared/CacheConfig,CacheEntry,shared/CacheEntry,CacheStorage,shared/CacheStorage,TelemetryOptions,shared/TelemetryOptions,GenieMessageResponse,shared/GenieMessageResponse,Message,shared/Message,PluginConstructor,shared/PluginConstructor,PluginData,shared/PluginData,ToolProvider,shared/ToolProvider,ToolAnnotations,shared/ToolAnnotations,BasePluginConfig,shared/BasePluginConfig,ThreadStore,shared/ThreadStore,BasePlugin,shared/BasePlugin,InputPluginMap,shared/InputPluginMap,OptionalConfigPluginDef,shared/OptionalConfigPluginDef,PluginMap,shared/PluginMap,IAppRequest,shared/IAppRequest,TunnelConnection,shared/TunnelConnection,RetryConfig,shared/RetryConfig,TelemetryConfig,shared/TelemetryConfig,IAppResponse,shared/IAppResponse,PluginEndpointMap,shared/PluginEndpointMap,PluginExecuteConfig,shared/PluginExecuteConfig,PluginExecutionSettings,shared/PluginExecutionSettings,PluginPhase,shared/PluginPhase,RouteConfig,shared/RouteConfig,StreamExecuteHandler,shared/StreamExecuteHandler,StreamExecutionSettings,shared/StreamExecutionSettings,ToPlugin,shared/ToPlugin,IAppRouter,shared/IAppRouter,ResponseStreamEvent,shared/ResponseStreamEvent,Thread,shared/Thread,ResponseFunctionCallOutput,shared/ResponseFunctionCallOutput,ResponseFunctionToolCall,shared/ResponseFunctionToolCall,ResponseOutputMessage,shared/ResponseOutputMessage,SQLTypeMarker,shared/SQLTypeMarker,isSQLTypeMarker,shared/isSQLTypeMarker,shared/sql,PluginClientConfigs,shared/PluginClientConfigs,PluginEndpoints,shared/PluginEndpoints,PluginManifest,shared/PluginManifest,ResourceRequirement,shared/ResourceRequirement,StreamConfig,shared/StreamConfig"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/shared/package.json"}],"concludedValue":"packages/appkit/node_modules/shared/package.json"}],"occurrences":[{"location":"src/agents/databricks.ts#7"},{"location":"src/beta.ts#20"},{"location":"src/cache/defaults.ts#1"},{"location":"src/cache/index.ts#3"},{"location":"src/cache/storage/memory.ts#1"},{"location":"src/cache/storage/persistent.ts#3"},{"location":"src/connectors/files/client.ts#2"},{"location":"src/connectors/genie/types.ts#3"},{"location":"src/connectors/genie/types.ts#10"},{"location":"src/connectors/jobs/types.ts#1"},{"location":"src/connectors/lakebase-v1/types.ts#2"},{"location":"src/connectors/mcp/client.ts#25"},{"location":"src/connectors/sql-warehouse/client.ts#6"},{"location":"src/connectors/vector-search/types.ts#1"},{"location":"src/core/agent/build-toolkit.ts#1"},{"location":"src/core/agent/consume-adapter-stream.ts#1"},{"location":"src/core/agent/load-agents.ts#5"},{"location":"src/core/agent/run-agent.ts#10"},{"location":"src/core/agent/toolkit-resolver.ts#1"},{"location":"src/core/agent/tools/define-tool.ts#1"},{"location":"src/core/agent/tools/function-tool.ts#1"},{"location":"src/core/agent/tools/tool.ts#1"},{"location":"src/core/agent/types.ts#7"},{"location":"src/core/appkit.ts#10"},{"location":"src/core/plugin-context.ts#2"},{"location":"src/index.ts#15"},{"location":"src/index.ts#16"},{"location":"src/plugin/dev-reader.ts#2"},{"location":"src/plugin/index.ts#1"},{"location":"src/plugin/interceptors/cache.ts#1"},{"location":"src/plugin/interceptors/retry.ts#1"},{"location":"src/plugin/interceptors/telemetry.ts#1"},{"location":"src/plugin/plugin.ts#14"},{"location":"src/plugin/to-plugin.ts#1"},{"location":"src/plugins/agents/agents.ts#17"},{"location":"src/plugins/agents/defaults.ts#1"},{"location":"src/plugins/agents/event-translator.ts#8"},{"location":"src/plugins/agents/thread-store.ts#2"},{"location":"src/plugins/analytics/analytics.ts#10"},{"location":"src/plugins/analytics/defaults.ts#1"},{"location":"src/plugins/analytics/query.ts#3"},{"location":"src/plugins/analytics/types.ts#1"},{"location":"src/plugins/files/defaults.ts#1"},{"location":"src/plugins/files/plugin.ts#10"},{"location":"src/plugins/files/types.ts#2"},{"location":"src/plugins/genie/defaults.ts#1"},{"location":"src/plugins/genie/genie.ts#8"},{"location":"src/plugins/genie/types.ts#1"},{"location":"src/plugins/genie/types.ts#4"},{"location":"src/plugins/jobs/defaults.ts#1"},{"location":"src/plugins/jobs/plugin.ts#9"},{"location":"src/plugins/jobs/types.ts#2"},{"location":"src/plugins/lakebase/lakebase.ts#2"},{"location":"src/plugins/lakebase/types.ts#1"},{"location":"src/plugins/server/index.ts#7"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#7"},{"location":"src/plugins/server/types.ts#1"},{"location":"src/plugins/server/utils.ts#6"},{"location":"src/plugins/serving/serving.ts#5"},{"location":"src/plugins/serving/types.ts#1"},{"location":"src/plugins/vector-search/defaults.ts#1"},{"location":"src/plugins/vector-search/types.ts#1"},{"location":"src/plugins/vector-search/vector-search.ts#2"},{"location":"src/registry/manifest-loader.ts#1"},{"location":"src/registry/resource-registry.ts#13"},{"location":"src/registry/types.ts#33"},{"location":"src/registry/types.ts#39"},{"location":"src/stream/sse-writer.ts#1"},{"location":"src/stream/stream-manager.ts#3"},{"location":"src/stream/types.ts#2"},{"location":"src/telemetry/telemetry-manager.ts#24"},{"location":"src/telemetry/telemetry-provider.ts#5"}]},"tags":["sql"]},{"authors":[{"name":"Einar Otto Stangvik <einaros@gmail.com> (http://2x.io)"}],"group":"","name":"ws","version":"8.18.3","description":"Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/ws@8.18.3","externalReferences":[{"type":"vcs","url":"https://github.com/websockets/ws"},{"type":"vcs","url":"git+https://github.com/websockets/ws.git"}],"type":"library","bom-ref":"pkg:npm/ws@8.18.3","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/ws/package.json"},{"name":"ImportedModules","value":"ws,WebSocketServer,ws/WebSocketServer"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/ws/package.json"}],"concludedValue":"packages/appkit/node_modules/ws/package.json"}],"occurrences":[{"location":"dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"tmp/dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#8"}]}},{"authors":[{"name":"Colin McDonnell <zod@colinhacks.com>"}],"group":"","name":"zod","version":"4.3.6","description":"TypeScript-first schema declaration and validation library with static type inference","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/zod@4.3.6","externalReferences":[{"type":"website","url":"https://zod.dev"},{"type":"vcs","url":"git+https://github.com/colinhacks/zod.git"}],"type":"library","bom-ref":"pkg:npm/zod@4.3.6","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/zod/package.json"},{"name":"ImportedModules","value":"zod,toJSONSchema,zod/toJSONSchema,zod/z"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/zod/package.json"}],"concludedValue":"packages/appkit/node_modules/zod/package.json"}],"occurrences":[{"location":"dist/core/agent/tools/json-schema.js#1"},{"location":"dist/plugins/agents/schemas.js#1"},{"location":"dist/plugins/analytics/analytics.js#16"},{"location":"dist/plugins/files/plugin.js#22"},{"location":"dist/plugins/genie/genie.js#15"},{"location":"dist/plugins/jobs/plugin.js#17"},{"location":"dist/plugins/lakebase/lakebase.js#10"},{"location":"tmp/dist/core/agent/tools/json-schema.js#1"},{"location":"tmp/dist/plugins/agents/schemas.js#1"},{"location":"tmp/dist/plugins/analytics/analytics.js#16"},{"location":"tmp/dist/plugins/files/plugin.js#22"},{"location":"tmp/dist/plugins/genie/genie.js#15"},{"location":"tmp/dist/plugins/jobs/plugin.js#17"},{"location":"tmp/dist/plugins/lakebase/lakebase.js#10"},{"location":"src/core/agent/tools/define-tool.ts#2"},{"location":"src/core/agent/tools/json-schema.ts#1"},{"location":"src/core/agent/tools/tool.ts#2"},{"location":"src/plugins/agents/schemas.ts#1"},{"location":"src/plugins/analytics/analytics.ts#11"},{"location":"src/plugins/files/plugin.ts#11"},{"location":"src/plugins/genie/genie.ts#9"},{"location":"src/plugins/jobs/plugin.ts#10"},{"location":"src/plugins/jobs/types.ts#3"},{"location":"src/plugins/lakebase/lakebase.ts#3"}]},"tags":["validation"]}],"dependencies":[],"compositions":[{"bom-ref":"pkg:npm/@databricks/appkit@0.34.1","aggregate":"incomplete"}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/@databricks/appkit@0.34.1"],"annotator":{"component":{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-05-13T18:55:49Z","text":"This Software Bill-of-Materials (SBOM) document was created on Wednesday, May 13, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'appkit' with version '0.34.1'. There are 29 components. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 29 source files."}]}
+{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:dccfbb9d-9fa2-440b-ad7e-e2d6bb65dc35","version":1,"metadata":{"timestamp":"2026-05-15T14:25:50Z","tools":{"components":[{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"appkit","group":"@databricks","version":"0.35.1","purl":"pkg:npm/%40databricks/appkit@0.35.1","bom-ref":"pkg:npm/@databricks/appkit@0.35.1","type":"application","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}]},"properties":[{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"cdx:bom:componentNamespaces","value":"@ast-grep\\n@databricks\\n@opentelemetry"},{"name":"cdx:bom:componentSrcFiles","value":"packages/appkit/node_modules/@ast-grep/napi/package.json\\npackages/appkit/node_modules/@databricks/lakebase/package.json\\npackages/appkit/node_modules/@databricks/sdk-experimental/package.json\\npackages/appkit/node_modules/@opentelemetry/api-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/api/package.json\\npackages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation/package.json\\npackages/appkit/node_modules/@opentelemetry/resources/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-node/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json\\npackages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json\\npackages/appkit/node_modules/dotenv/package.json\\npackages/appkit/node_modules/express/package.json\\npackages/appkit/node_modules/get-port/package.json\\npackages/appkit/node_modules/js-yaml/package.json\\npackages/appkit/node_modules/obug/package.json\\npackages/appkit/node_modules/pg/package.json\\npackages/appkit/node_modules/picocolors/package.json\\npackages/appkit/node_modules/semver/package.json\\npackages/appkit/node_modules/shared/package.json\\npackages/appkit/node_modules/ws/package.json\\npackages/appkit/node_modules/zod/package.json"}]},"components":[{"group":"@ast-grep","name":"napi","version":"0.37.0","description":"Search and Rewrite code at large scale using precise AST pattern","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/%40ast-grep/napi@0.37.0","externalReferences":[{"type":"vcs","url":"https://ast-grep.github.io"}],"type":"library","bom-ref":"pkg:npm/@ast-grep/napi@0.37.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@ast-grep/napi/package.json"},{"name":"ImportedModules","value":"@ast-grep/napi,Lang,@ast-grep/napi/Lang,parse,@ast-grep/napi/parse,SgNode,@ast-grep/napi/SgNode"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"concludedValue":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"occurrences":[{"location":"dist/type-generator/serving/server-file-extractor.js#4"},{"location":"tmp/dist/cli/commands/codemod/on-plugins-ready.js#4"},{"location":"tmp/dist/cli/commands/lint.js#4"},{"location":"tmp/dist/cli/commands/plugin/sync/sync.js#7"},{"location":"tmp/dist/type-generator/serving/server-file-extractor.js#4"},{"location":"src/type-generator/serving/server-file-extractor.ts#3"}]}},{"group":"@databricks","name":"lakebase","version":"0.3.0","description":"PostgreSQL driver for Databricks Lakebase Autoscaling with automatic OAuth token refresh","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40databricks/lakebase@0.3.0","externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}],"type":"library","bom-ref":"pkg:npm/@databricks/lakebase@0.3.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@databricks/lakebase/package.json"},{"name":"ExportedModules","value":"@databricks/lakebase,DatabaseCredential,@databricks/lakebase/DatabaseCredential,GenerateDatabaseCredentialRequest,@databricks/lakebase/GenerateDatabaseCredentialRequest,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig,RequestedClaims,@databricks/lakebase/RequestedClaims,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,RequestedResource,@databricks/lakebase/RequestedResource"},{"name":"ImportedModules","value":"@databricks/lakebase,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,createLakebasePool,@databricks/lakebase/createLakebasePool,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"concludedValue":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"occurrences":[{"location":"dist/connectors/lakebase/index.js#4"},{"location":"tmp/dist/connectors/lakebase/index.js#4"},{"location":"src/connectors/lakebase/index.ts#4"},{"location":"src/connectors/lakebase/index.ts#37"},{"location":"src/connectors/lakebase/pool-manager.ts#1"}]},"tags":["token"]},{"group":"@databricks","name":"sdk-experimental","version":"0.17.0","description":"Databricks SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40databricks/sdk-experimental@0.17.0","externalReferences":[{"type":"vcs","url":"https://github.com/databricks/databricks-sdk-js"},{"type":"vcs","url":"git+https://github.com/databricks/databricks-sdk-js.git#main"}],"type":"library","bom-ref":"pkg:npm/@databricks/sdk-experimental@0.17.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@databricks/sdk-experimental/package.json"},{"name":"ImportedModules","value":"@databricks/sdk-experimental,ApiError,@databricks/sdk-experimental/ApiError,WorkspaceClient,@databricks/sdk-experimental/WorkspaceClient,Context,@databricks/sdk-experimental/Context,ConfigError,@databricks/sdk-experimental/ConfigError,jobs,@databricks/sdk-experimental/jobs,ApiClient,@databricks/sdk-experimental/ApiClient,Config,@databricks/sdk-experimental/Config,CancellationToken,@databricks/sdk-experimental/CancellationToken,serving,@databricks/sdk-experimental/serving,@databricks/sdk-experimental/sql,ClientOptions,@databricks/sdk-experimental/ClientOptions,files,@databricks/sdk-experimental/files,@databricks/sdk-experimental/dist/apis/dashboards,GenieMessage,@databricks/sdk-experimental/dist/apis/dashboards/GenieMessage,@databricks/sdk-experimental/dist/wait,Waiter,@databricks/sdk-experimental/dist/wait/Waiter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@databricks/sdk-experimental/package.json"}],"concludedValue":"packages/appkit/node_modules/@databricks/sdk-experimental/package.json"}],"occurrences":[{"location":"dist/cache/index.js#15"},{"location":"dist/connectors/files/client.js#5"},{"location":"dist/connectors/genie/client.js#5"},{"location":"dist/connectors/jobs/client.js#7"},{"location":"dist/connectors/lakebase-v1/client.js#6"},{"location":"dist/connectors/serving/client.js#2"},{"location":"dist/connectors/sql-warehouse/client.js#11"},{"location":"dist/context/service-context.js#8"},{"location":"dist/plugins/files/plugin.js#21"},{"location":"dist/type-generator/query-registry.js#5"},{"location":"dist/type-generator/serving/fetcher.js#2"},{"location":"dist/type-generator/serving/generator.js#7"},{"location":"tmp/dist/cache/index.js#15"},{"location":"tmp/dist/connectors/files/client.js#5"},{"location":"tmp/dist/connectors/genie/client.js#5"},{"location":"tmp/dist/connectors/jobs/client.js#7"},{"location":"tmp/dist/connectors/lakebase-v1/client.js#6"},{"location":"tmp/dist/connectors/serving/client.js#2"},{"location":"tmp/dist/connectors/sql-warehouse/client.js#11"},{"location":"tmp/dist/context/service-context.js#8"},{"location":"tmp/dist/plugins/files/plugin.js#21"},{"location":"tmp/dist/type-generator/query-registry.js#5"},{"location":"tmp/dist/type-generator/serving/fetcher.js#2"},{"location":"tmp/dist/type-generator/serving/generator.js#7"},{"location":"src/cache/index.ts#2"},{"location":"src/connectors/files/client.ts#1"},{"location":"src/connectors/genie/client.ts#1"},{"location":"src/connectors/genie/client.ts#2"},{"location":"src/connectors/jobs/client.ts#5"},{"location":"src/connectors/lakebase-v1/client.ts#2"},{"location":"src/connectors/lakebase-v1/client.ts#3"},{"location":"src/connectors/lakebase-v1/types.ts#1"},{"location":"src/connectors/serving/client.ts#5"},{"location":"src/connectors/serving/client.ts#6"},{"location":"src/connectors/sql-warehouse/client.ts#5"},{"location":"src/connectors/sql-warehouse/defaults.ts#1"},{"location":"src/connectors/vector-search/client.ts#1"},{"location":"src/context/service-context.ts#7"},{"location":"src/core/appkit.ts#1"},{"location":"src/internal-telemetry/reporter.ts#1"},{"location":"src/plugins/analytics/analytics.ts#1"},{"location":"src/plugins/analytics/query.ts#2"},{"location":"src/plugins/files/plugin.ts#3"},{"location":"src/plugins/files/types.ts#1"},{"location":"src/plugins/jobs/plugin.ts#2"},{"location":"src/plugins/jobs/types.ts#1"},{"location":"src/stream/arrow-stream-processor.ts#1"},{"location":"src/type-generator/query-registry.ts#3"},{"location":"src/type-generator/serving/fetcher.ts#1"},{"location":"src/type-generator/serving/generator.ts#3"},{"location":"src/connectors/genie/client.ts#3"},{"location":"src/connectors/genie/client.ts#4"}]},"tags":["sql"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api-logs","version":"0.208.0","description":"Public logs API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api-logs@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/api-logs"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api-logs@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api-logs"},{"name":"ImportedModules","value":"@opentelemetry/api-logs,SeverityNumber,@opentelemetry/api-logs/SeverityNumber,logs,@opentelemetry/api-logs/logs,NOOP_LOGGER,@opentelemetry/api-logs/NOOP_LOGGER,Logger,@opentelemetry/api-logs/Logger,LogRecord,@opentelemetry/api-logs/LogRecord"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"occurrences":[{"location":"dist/logging/wide-event-emitter.js#1"},{"location":"dist/telemetry/index.js#6"},{"location":"dist/telemetry/noop.js#2"},{"location":"dist/telemetry/telemetry-provider.js#4"},{"location":"tmp/dist/logging/wide-event-emitter.js#1"},{"location":"tmp/dist/telemetry/index.js#6"},{"location":"tmp/dist/telemetry/noop.js#2"},{"location":"tmp/dist/telemetry/telemetry-provider.js#4"},{"location":"src/logging/wide-event-emitter.ts#1"},{"location":"src/telemetry/index.ts#7"},{"location":"src/telemetry/noop.ts#97"},{"location":"src/telemetry/telemetry-provider.ts#3"},{"location":"src/telemetry/types.ts#2"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api","version":"1.9.0","description":"Public API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api@1.9.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/api"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api@1.9.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api,@opentelemetry/api-logs,Counter,@opentelemetry/api/Counter,Histogram,@opentelemetry/api/Histogram,Span,@opentelemetry/api/Span,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode"},{"name":"ImportedModules","value":"@opentelemetry/api,trace,@opentelemetry/api/trace,context,@opentelemetry/api/context,createContextKey,@opentelemetry/api/createContextKey,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode,INVALID_SPAN_CONTEXT,@opentelemetry/api/INVALID_SPAN_CONTEXT,createNoopMeter,@opentelemetry/api/createNoopMeter,metrics,@opentelemetry/api/metrics,Context,@opentelemetry/api/Context,Span,@opentelemetry/api/Span,SpanContext,@opentelemetry/api/SpanContext,SpanOptions,@opentelemetry/api/SpanOptions,Tracer,@opentelemetry/api/Tracer,Meter,@opentelemetry/api/Meter,Attributes,@opentelemetry/api/Attributes,Link,@opentelemetry/api/Link"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#6"},{"location":"dist/plugin/plugin.js#21"},{"location":"dist/stream/stream-manager.js#9"},{"location":"dist/telemetry/index.js#5"},{"location":"dist/telemetry/noop.js#1"},{"location":"dist/telemetry/telemetry-provider.js#3"},{"location":"tmp/dist/logging/logger.js#6"},{"location":"tmp/dist/plugin/plugin.js#21"},{"location":"tmp/dist/stream/stream-manager.js#9"},{"location":"tmp/dist/telemetry/index.js#5"},{"location":"tmp/dist/telemetry/noop.js#1"},{"location":"tmp/dist/telemetry/telemetry-provider.js#3"},{"location":"src/logging/logger.ts#3"},{"location":"src/plugin/plugin.ts#1"},{"location":"src/stream/stream-manager.ts#2"},{"location":"src/stream/types.ts#1"},{"location":"src/telemetry/index.ts#5"},{"location":"src/telemetry/index.ts#6"},{"location":"src/telemetry/noop.ts#17"},{"location":"src/telemetry/noop.ts#22"},{"location":"src/telemetry/telemetry-provider.ts#1"},{"location":"src/telemetry/telemetry-provider.ts#2"},{"location":"src/telemetry/trace-sampler.ts#1"},{"location":"src/telemetry/types.ts#1"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"auto-instrumentations-node","version":"0.67.2","description":"Metapackage which bundles opentelemetry node core and contrib instrumentations","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/auto-instrumentations-node@0.67.2","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/auto-instrumentations-node#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/auto-instrumentations-node@0.67.2","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/auto-instrumentations-node,getNodeAutoInstrumentations,@opentelemetry/auto-instrumentations-node/getNodeAutoInstrumentations"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#4"},{"location":"tmp/dist/telemetry/telemetry-manager.js#4"},{"location":"src/telemetry/telemetry-manager.ts#1"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-logs-otlp-proto","version":"0.208.0","description":"An OTLP exporter to send logs using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-logs-otlp-proto@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-logs-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-logs-otlp-proto@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-logs-otlp-proto,OTLPLogExporter,@opentelemetry/exporter-logs-otlp-proto/OTLPLogExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#5"},{"location":"tmp/dist/telemetry/telemetry-manager.js#5"},{"location":"src/telemetry/telemetry-manager.ts#2"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-metrics-otlp-proto","version":"0.208.0","description":"OpenTelemetry Collector Metrics Exporter allows user to send collected metrics to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-metrics-otlp-proto@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-metrics-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-metrics-otlp-proto@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-metrics-otlp-proto,OTLPMetricExporter,@opentelemetry/exporter-metrics-otlp-proto/OTLPMetricExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#6"},{"location":"tmp/dist/telemetry/telemetry-manager.js#6"},{"location":"src/telemetry/telemetry-manager.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-trace-otlp-proto","version":"0.208.0","description":"OpenTelemetry Collector Exporter allows user to send collected traces to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-trace-otlp-proto@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-trace-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-trace-otlp-proto@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-trace-otlp-proto,OTLPTraceExporter,@opentelemetry/exporter-trace-otlp-proto/OTLPTraceExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#7"},{"location":"tmp/dist/telemetry/telemetry-manager.js#7"},{"location":"src/telemetry/telemetry-manager.ts#4"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-express","version":"0.57.0","description":"OpenTelemetry instrumentation for `express` http web application framework","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-express@0.57.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-express#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"framework","bom-ref":"pkg:npm/@opentelemetry/instrumentation-express@0.57.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-express,ExpressInstrumentation,@opentelemetry/instrumentation-express/ExpressInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#2"},{"location":"tmp/dist/telemetry/instrumentations.js#2"},{"location":"src/telemetry/instrumentations.ts#2"}]},"tags":["framework","web"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-http","version":"0.208.0","description":"OpenTelemetry instrumentation for `node:http` and `node:https` http client and server modules","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-http@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation-http"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation-http@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-http,HttpInstrumentation,@opentelemetry/instrumentation-http/HttpInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#3"},{"location":"tmp/dist/telemetry/instrumentations.js#3"},{"location":"src/telemetry/instrumentations.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation","version":"0.208.0","description":"Base class for node which OpenTelemetry instrumentation modules extend","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation,registerInstrumentations,@opentelemetry/instrumentation/registerInstrumentations,Instrumentation,@opentelemetry/instrumentation/Instrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#8"},{"location":"tmp/dist/telemetry/telemetry-manager.js#8"},{"location":"src/telemetry/instrumentations.ts#1"},{"location":"src/telemetry/telemetry-manager.ts#8"},{"location":"src/telemetry/telemetry-provider.ts#4"},{"location":"src/telemetry/types.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"resources","version":"2.2.0","description":"OpenTelemetry SDK resources","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/resources@2.2.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/resources@2.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"},{"name":"ImportedModules","value":"@opentelemetry/resources,detectResources,@opentelemetry/resources/detectResources,envDetector,@opentelemetry/resources/envDetector,hostDetector,@opentelemetry/resources/hostDetector,processDetector,@opentelemetry/resources/processDetector,resourceFromAttributes,@opentelemetry/resources/resourceFromAttributes,Resource,@opentelemetry/resources/Resource"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#9"},{"location":"tmp/dist/telemetry/telemetry-manager.js#9"},{"location":"src/telemetry/telemetry-manager.ts#16"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-logs","version":"0.208.0","description":"OpenTelemetry logs SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-logs@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/sdk-logs"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-logs@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-logs,BatchLogRecordProcessor,@opentelemetry/sdk-logs/BatchLogRecordProcessor"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#10"},{"location":"tmp/dist/telemetry/telemetry-manager.js#10"},{"location":"src/telemetry/telemetry-manager.ts#17"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-metrics","version":"2.2.0","description":"OpenTelemetry metrics SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-metrics@2.2.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-metrics"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-metrics@2.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-metrics,PeriodicExportingMetricReader,@opentelemetry/sdk-metrics/PeriodicExportingMetricReader"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#11"},{"location":"tmp/dist/telemetry/telemetry-manager.js#11"},{"location":"src/telemetry/telemetry-manager.ts#18"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-node","version":"0.208.0","description":"OpenTelemetry SDK for Node.js","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-node@0.208.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-node@0.208.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-node,NodeSDK,@opentelemetry/sdk-node/NodeSDK"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#12"},{"location":"tmp/dist/telemetry/telemetry-manager.js#12"},{"location":"src/telemetry/telemetry-manager.ts#19"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-trace-base","version":"2.6.0","description":"OpenTelemetry Tracing","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-trace-base@2.6.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-trace-base@2.6.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-trace-base,SamplingDecision,@opentelemetry/sdk-trace-base/SamplingDecision,Sampler,@opentelemetry/sdk-trace-base/Sampler,SamplingResult,@opentelemetry/sdk-trace-base/SamplingResult"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"occurrences":[{"location":"dist/telemetry/trace-sampler.js#2"},{"location":"tmp/dist/telemetry/trace-sampler.js#2"},{"location":"src/telemetry/trace-sampler.ts#2"},{"location":"src/telemetry/trace-sampler.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"semantic-conventions","version":"1.38.0","description":"OpenTelemetry semantic conventions","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/semantic-conventions@1.38.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/semantic-conventions"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/semantic-conventions@1.38.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"},{"name":"ImportedModules","value":"@opentelemetry/semantic-conventions,ATTR_SERVICE_NAME,@opentelemetry/semantic-conventions/ATTR_SERVICE_NAME,ATTR_SERVICE_VERSION,@opentelemetry/semantic-conventions/ATTR_SERVICE_VERSION"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#13"},{"location":"tmp/dist/telemetry/telemetry-manager.js#13"},{"location":"src/telemetry/telemetry-manager.ts#23"}]}},{"group":"","name":"dotenv","version":"16.6.1","description":"Loads environment variables from .env file","scope":"required","licenses":[{"license":{"id":"BSD-2-Clause","url":"https://opensource.org/licenses/BSD-2-Clause"}}],"purl":"pkg:npm/dotenv@16.6.1","externalReferences":[{"type":"vcs","url":"https://github.com/motdotla/dotenv#readme"},{"type":"vcs","url":"git://github.com/motdotla/dotenv.git"}],"type":"library","bom-ref":"pkg:npm/dotenv@16.6.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/dotenv/package.json"},{"name":"ImportedModules","value":"dotenv,dotenv/config"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/dotenv/package.json"}],"concludedValue":"packages/appkit/node_modules/dotenv/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#19"},{"location":"dist/type-generator/index.js#7"},{"location":"tmp/dist/cli/index.js#8"},{"location":"tmp/dist/plugins/server/index.js#19"},{"location":"tmp/dist/type-generator/index.js#7"},{"location":"src/plugins/server/index.ts#4"},{"location":"src/type-generator/index.ts#3"},{"location":"tmp/dist/cli/index.js#8"}]}},{"authors":[{"name":"TJ Holowaychuk <tj@vision-media.ca>"}],"group":"","name":"express","version":"4.22.0","description":"Fast, unopinionated, minimalist web framework","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/express@4.22.0","externalReferences":[{"type":"website","url":"http://expressjs.com/"}],"type":"framework","bom-ref":"pkg:npm/express@4.22.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/express/package.json"},{"name":"ImportedModules","value":"express,NextFunction,express/NextFunction,Request,express/Request,Response,express/Response"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/express/package.json"}],"concludedValue":"packages/appkit/node_modules/express/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#20"},{"location":"dist/plugins/server/static-server.js#4"},{"location":"tmp/dist/plugins/server/index.js#20"},{"location":"tmp/dist/plugins/server/static-server.js#4"},{"location":"src/core/plugin-context.ts#1"},{"location":"src/logging/logger.ts#4"},{"location":"src/plugin/plugin.ts#2"},{"location":"src/plugins/agents/agents.ts#3"},{"location":"src/plugins/analytics/analytics.ts#2"},{"location":"src/plugins/files/plugin.ts#4"},{"location":"src/plugins/genie/genie.ts#2"},{"location":"src/plugins/jobs/plugin.ts#3"},{"location":"src/plugins/server/base-server.ts#1"},{"location":"src/plugins/server/index.ts#5"},{"location":"src/plugins/server/remote-tunnel/gate.ts#1"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-controller.ts#2"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#6"},{"location":"src/plugins/server/static-server.ts#3"},{"location":"src/plugins/server/static-server.ts#4"},{"location":"src/plugins/server/vite-dev-server.ts#3"},{"location":"src/plugins/serving/serving.ts#4"},{"location":"src/plugins/vector-search/vector-search.ts#1"}]},"tags":["framework","web"]},{"authors":[{"name":"Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)"}],"group":"","name":"get-port","version":"7.2.0","description":"Get an available port","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/get-port@7.2.0","type":"library","bom-ref":"pkg:npm/get-port@7.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/get-port/package.json"},{"name":"ImportedModules","value":"get-port,portNumbers,get-port/portNumbers"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/get-port/package.json"}],"concludedValue":"packages/appkit/node_modules/get-port/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#21"},{"location":"tmp/dist/plugins/server/index.js#21"},{"location":"src/plugins/server/index.ts#6"}]}},{"authors":[{"name":"Vladimir Zapparov <dervus.grim@gmail.com>"}],"group":"","name":"js-yaml","version":"4.1.1","description":"YAML 1.2 parser and serializer","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/js-yaml@4.1.1","type":"library","bom-ref":"pkg:npm/js-yaml@4.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/js-yaml/package.json"},{"name":"ImportedModules","value":"js-yaml"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/js-yaml/package.json"}],"concludedValue":"packages/appkit/node_modules/js-yaml/package.json"}],"occurrences":[{"location":"dist/core/agent/load-agents.js#5"},{"location":"tmp/dist/core/agent/load-agents.js#5"},{"location":"src/core/agent/load-agents.ts#4"}]}},{"authors":[{"name":"Kevin Deng <sxzz@sxzz.moe>"}],"group":"","name":"obug","version":"2.1.1","description":"A lightweight JavaScript debugging utility, forked from debug, featuring TypeScript and ESM support.","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/obug@2.1.1","externalReferences":[{"type":"vcs","url":"https://github.com/sxzz/obug#readme"},{"type":"vcs","url":"git+https://github.com/sxzz/obug.git"}],"type":"library","bom-ref":"pkg:npm/obug@2.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/obug/package.json"},{"name":"ImportedModules","value":"obug,createDebug,obug/createDebug"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/obug/package.json"}],"concludedValue":"packages/appkit/node_modules/obug/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#7"},{"location":"tmp/dist/logging/logger.js#7"},{"location":"src/logging/logger.ts#5"}]}},{"authors":[{"name":"Brian Carlson <brian.m.carlson@gmail.com>"}],"group":"","name":"pg","version":"8.18.0","description":"PostgreSQL client - pure javascript & libpq with the same API","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/pg@8.18.0","externalReferences":[{"type":"vcs","url":"https://github.com/brianc/node-postgres"},{"type":"vcs","url":"git://github.com/brianc/node-postgres.git"}],"type":"library","bom-ref":"pkg:npm/pg@8.18.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/pg/package.json"},{"name":"ImportedModules","value":"pg,Pool,pg/Pool,PoolClient,pg/PoolClient,QueryResult,pg/QueryResult,QueryResultRow,pg/QueryResultRow"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/pg/package.json"}],"concludedValue":"packages/appkit/node_modules/pg/package.json"}],"occurrences":[{"location":"dist/connectors/lakebase-v1/client.js#7"},{"location":"tmp/dist/connectors/lakebase-v1/client.js#7"},{"location":"src/cache/storage/persistent.ts#2"},{"location":"src/connectors/lakebase/index.ts#5"},{"location":"src/connectors/lakebase/pool-manager.ts#2"},{"location":"src/connectors/lakebase/routing-pool.ts#1"},{"location":"src/connectors/lakebase-v1/client.ts#4"},{"location":"src/plugins/lakebase/lakebase.ts#1"}]}},{"authors":[{"name":"Alexey Raspopov"}],"group":"","name":"picocolors","version":"1.1.1","description":"The tiniest and the fastest library for terminal output formatting with ANSI colors","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/picocolors@1.1.1","type":"library","bom-ref":"pkg:npm/picocolors@1.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/picocolors/package.json"},{"name":"ImportedModules","value":"picocolors"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/picocolors/package.json"}],"concludedValue":"packages/appkit/node_modules/picocolors/package.json"}],"occurrences":[{"location":"dist/errors/configuration.js#3"},{"location":"dist/plugins/agents/agents.js#26"},{"location":"dist/plugins/server/client-config-sanitizer.js#2"},{"location":"dist/plugins/server/utils.js#2"},{"location":"dist/type-generator/migration.js#2"},{"location":"dist/type-generator/query-registry.js#6"},{"location":"dist/type-generator/serving/generator.js#8"},{"location":"tmp/dist/errors/configuration.js#3"},{"location":"tmp/dist/plugins/agents/agents.js#26"},{"location":"tmp/dist/plugins/server/client-config-sanitizer.js#2"},{"location":"tmp/dist/plugins/server/utils.js#2"},{"location":"tmp/dist/type-generator/migration.js#2"},{"location":"tmp/dist/type-generator/query-registry.js#6"},{"location":"tmp/dist/type-generator/serving/generator.js#8"},{"location":"src/errors/configuration.ts#1"},{"location":"src/plugins/agents/agents.ts#4"},{"location":"src/plugins/server/client-config-sanitizer.ts#1"},{"location":"src/plugins/server/utils.ts#5"},{"location":"src/type-generator/migration.ts#4"},{"location":"src/type-generator/query-registry.ts#4"},{"location":"src/type-generator/serving/generator.ts#4"}]}},{"authors":[{"name":"GitHub Inc."}],"group":"","name":"semver","version":"7.7.3","description":"The semantic version parser used by npm.","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/semver@7.7.3","externalReferences":[{"type":"vcs","url":"git+https://github.com/npm/node-semver.git"}],"type":"library","bom-ref":"pkg:npm/semver@7.7.3","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/semver/package.json"},{"name":"ImportedModules","value":"semver,coerce,semver/coerce"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/semver/package.json"}],"concludedValue":"packages/appkit/node_modules/semver/package.json"}],"occurrences":[{"location":"dist/context/service-context.js#9"},{"location":"tmp/dist/context/service-context.js#9"},{"location":"src/context/service-context.ts#8"}]}},{"group":"","name":"shared","version":"0.0.1","scope":"required","purl":"pkg:npm/shared@0.0.1","type":"library","bom-ref":"pkg:npm/shared@0.0.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/shared/package.json"},{"name":"ExportedModules","value":"shared,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,Message,shared/Message,Thread,shared/Thread,ThreadStore,shared/ThreadStore,ToolAnnotations,shared/ToolAnnotations,ToolProvider,shared/ToolProvider,GenieAttachmentResponse,shared/GenieAttachmentResponse,GenieMessageResponse,shared/GenieMessageResponse,GenieStatementResponse,shared/GenieStatementResponse,GenieStreamEvent,shared/GenieStreamEvent,BasePluginConfig,shared/BasePluginConfig,CacheConfig,shared/CacheConfig,IAppRouter,shared/IAppRouter,PluginData,shared/PluginData,StreamExecutionSettings,shared/StreamExecutionSettings,isSQLTypeMarker,shared/isSQLTypeMarker,shared/sql"},{"name":"ImportedModules","value":"shared,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,CacheConfig,shared/CacheConfig,CacheEntry,shared/CacheEntry,CacheStorage,shared/CacheStorage,TelemetryOptions,shared/TelemetryOptions,GenieMessageResponse,shared/GenieMessageResponse,Message,shared/Message,PluginConstructor,shared/PluginConstructor,PluginData,shared/PluginData,ToolProvider,shared/ToolProvider,ToolAnnotations,shared/ToolAnnotations,BasePluginConfig,shared/BasePluginConfig,ThreadStore,shared/ThreadStore,BasePlugin,shared/BasePlugin,InputPluginMap,shared/InputPluginMap,OptionalConfigPluginDef,shared/OptionalConfigPluginDef,PluginMap,shared/PluginMap,IAppRequest,shared/IAppRequest,TunnelConnection,shared/TunnelConnection,RetryConfig,shared/RetryConfig,TelemetryConfig,shared/TelemetryConfig,IAppResponse,shared/IAppResponse,PluginEndpointMap,shared/PluginEndpointMap,PluginExecuteConfig,shared/PluginExecuteConfig,PluginExecutionSettings,shared/PluginExecutionSettings,PluginPhase,shared/PluginPhase,RouteConfig,shared/RouteConfig,StreamExecuteHandler,shared/StreamExecuteHandler,StreamExecutionSettings,shared/StreamExecutionSettings,ToPlugin,shared/ToPlugin,IAppRouter,shared/IAppRouter,ResponseStreamEvent,shared/ResponseStreamEvent,Thread,shared/Thread,ResponseFunctionCallOutput,shared/ResponseFunctionCallOutput,ResponseFunctionToolCall,shared/ResponseFunctionToolCall,ResponseOutputMessage,shared/ResponseOutputMessage,SQLTypeMarker,shared/SQLTypeMarker,isSQLTypeMarker,shared/isSQLTypeMarker,shared/sql,PluginClientConfigs,shared/PluginClientConfigs,PluginEndpoints,shared/PluginEndpoints,PluginManifest,shared/PluginManifest,ResourceRequirement,shared/ResourceRequirement,StreamConfig,shared/StreamConfig"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/shared/package.json"}],"concludedValue":"packages/appkit/node_modules/shared/package.json"}],"occurrences":[{"location":"src/agents/databricks.ts#7"},{"location":"src/beta.ts#20"},{"location":"src/cache/defaults.ts#1"},{"location":"src/cache/index.ts#3"},{"location":"src/cache/storage/memory.ts#1"},{"location":"src/cache/storage/persistent.ts#3"},{"location":"src/connectors/files/client.ts#2"},{"location":"src/connectors/genie/types.ts#3"},{"location":"src/connectors/genie/types.ts#10"},{"location":"src/connectors/jobs/types.ts#1"},{"location":"src/connectors/lakebase-v1/types.ts#2"},{"location":"src/connectors/mcp/client.ts#25"},{"location":"src/connectors/sql-warehouse/client.ts#6"},{"location":"src/connectors/vector-search/types.ts#1"},{"location":"src/core/agent/build-toolkit.ts#1"},{"location":"src/core/agent/consume-adapter-stream.ts#1"},{"location":"src/core/agent/load-agents.ts#5"},{"location":"src/core/agent/run-agent.ts#10"},{"location":"src/core/agent/toolkit-resolver.ts#1"},{"location":"src/core/agent/tools/define-tool.ts#1"},{"location":"src/core/agent/tools/function-tool.ts#1"},{"location":"src/core/agent/tools/tool.ts#1"},{"location":"src/core/agent/types.ts#7"},{"location":"src/core/appkit.ts#10"},{"location":"src/core/plugin-context.ts#2"},{"location":"src/index.ts#15"},{"location":"src/index.ts#16"},{"location":"src/plugin/dev-reader.ts#2"},{"location":"src/plugin/index.ts#1"},{"location":"src/plugin/interceptors/cache.ts#1"},{"location":"src/plugin/interceptors/retry.ts#1"},{"location":"src/plugin/interceptors/telemetry.ts#1"},{"location":"src/plugin/plugin.ts#14"},{"location":"src/plugin/to-plugin.ts#1"},{"location":"src/plugins/agents/agents.ts#17"},{"location":"src/plugins/agents/defaults.ts#1"},{"location":"src/plugins/agents/event-translator.ts#8"},{"location":"src/plugins/agents/thread-store.ts#2"},{"location":"src/plugins/analytics/analytics.ts#10"},{"location":"src/plugins/analytics/defaults.ts#1"},{"location":"src/plugins/analytics/query.ts#3"},{"location":"src/plugins/analytics/types.ts#1"},{"location":"src/plugins/files/defaults.ts#1"},{"location":"src/plugins/files/plugin.ts#10"},{"location":"src/plugins/files/types.ts#2"},{"location":"src/plugins/genie/defaults.ts#1"},{"location":"src/plugins/genie/genie.ts#8"},{"location":"src/plugins/genie/types.ts#1"},{"location":"src/plugins/genie/types.ts#4"},{"location":"src/plugins/jobs/defaults.ts#1"},{"location":"src/plugins/jobs/plugin.ts#9"},{"location":"src/plugins/jobs/types.ts#2"},{"location":"src/plugins/lakebase/lakebase.ts#2"},{"location":"src/plugins/lakebase/types.ts#1"},{"location":"src/plugins/server/index.ts#7"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#7"},{"location":"src/plugins/server/types.ts#1"},{"location":"src/plugins/server/utils.ts#6"},{"location":"src/plugins/serving/serving.ts#5"},{"location":"src/plugins/serving/types.ts#1"},{"location":"src/plugins/vector-search/defaults.ts#1"},{"location":"src/plugins/vector-search/types.ts#1"},{"location":"src/plugins/vector-search/vector-search.ts#2"},{"location":"src/registry/manifest-loader.ts#1"},{"location":"src/registry/resource-registry.ts#13"},{"location":"src/registry/types.ts#33"},{"location":"src/registry/types.ts#39"},{"location":"src/stream/sse-writer.ts#1"},{"location":"src/stream/stream-manager.ts#3"},{"location":"src/stream/types.ts#2"},{"location":"src/telemetry/telemetry-manager.ts#24"},{"location":"src/telemetry/telemetry-provider.ts#5"}]},"tags":["sql"]},{"authors":[{"name":"Einar Otto Stangvik <einaros@gmail.com> (http://2x.io)"}],"group":"","name":"ws","version":"8.18.3","description":"Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/ws@8.18.3","externalReferences":[{"type":"vcs","url":"https://github.com/websockets/ws"},{"type":"vcs","url":"git+https://github.com/websockets/ws.git"}],"type":"library","bom-ref":"pkg:npm/ws@8.18.3","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/ws/package.json"},{"name":"ImportedModules","value":"ws,WebSocketServer,ws/WebSocketServer"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/ws/package.json"}],"concludedValue":"packages/appkit/node_modules/ws/package.json"}],"occurrences":[{"location":"dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"tmp/dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#8"}]}},{"authors":[{"name":"Colin McDonnell <zod@colinhacks.com>"}],"group":"","name":"zod","version":"4.3.6","description":"TypeScript-first schema declaration and validation library with static type inference","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/zod@4.3.6","externalReferences":[{"type":"website","url":"https://zod.dev"},{"type":"vcs","url":"git+https://github.com/colinhacks/zod.git"}],"type":"library","bom-ref":"pkg:npm/zod@4.3.6","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/zod/package.json"},{"name":"ImportedModules","value":"zod,toJSONSchema,zod/toJSONSchema,zod/z"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/zod/package.json"}],"concludedValue":"packages/appkit/node_modules/zod/package.json"}],"occurrences":[{"location":"dist/core/agent/tools/json-schema.js#1"},{"location":"dist/plugins/agents/schemas.js#1"},{"location":"dist/plugins/analytics/analytics.js#16"},{"location":"dist/plugins/files/plugin.js#22"},{"location":"dist/plugins/genie/genie.js#15"},{"location":"dist/plugins/jobs/plugin.js#17"},{"location":"dist/plugins/lakebase/lakebase.js#13"},{"location":"tmp/dist/core/agent/tools/json-schema.js#1"},{"location":"tmp/dist/plugins/agents/schemas.js#1"},{"location":"tmp/dist/plugins/analytics/analytics.js#16"},{"location":"tmp/dist/plugins/files/plugin.js#22"},{"location":"tmp/dist/plugins/genie/genie.js#15"},{"location":"tmp/dist/plugins/jobs/plugin.js#17"},{"location":"tmp/dist/plugins/lakebase/lakebase.js#13"},{"location":"src/core/agent/tools/define-tool.ts#2"},{"location":"src/core/agent/tools/json-schema.ts#1"},{"location":"src/core/agent/tools/tool.ts#2"},{"location":"src/plugins/agents/schemas.ts#1"},{"location":"src/plugins/analytics/analytics.ts#11"},{"location":"src/plugins/files/plugin.ts#11"},{"location":"src/plugins/genie/genie.ts#9"},{"location":"src/plugins/jobs/plugin.ts#10"},{"location":"src/plugins/jobs/types.ts#3"},{"location":"src/plugins/lakebase/lakebase.ts#3"}]},"tags":["validation"]}],"dependencies":[],"compositions":[{"bom-ref":"pkg:npm/@databricks/appkit@0.35.1","aggregate":"incomplete"}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/@databricks/appkit@0.35.1"],"annotator":{"component":{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-05-15T14:25:50Z","text":"This Software Bill-of-Materials (SBOM) document was created on Friday, May 15, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'appkit' with version '0.35.1'. There are 29 components. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 29 source files."}]}