@databricks/appkit 0.69.1 → 0.69.2

package/dist/appkit/package.js

@@ -1,6 +1,6 @@
 //#region package.json
 var name = "@databricks/appkit";
-var version = "0.69.1";
+var version = "0.69.2";
 
 //#endregion
 export { name, version };

package/dist/shared/src/schemas/manifest.d.ts

@@ -12,12 +12,12 @@ declare const resourceFieldEntrySchema: z.ZodObject<{
   discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"kind">;
     resourceKind: z.ZodEnum<{
-      warehouse: "warehouse";
+      volume: "volume";
       genie_space: "genie_space";
+      warehouse: "warehouse";
       postgres_project: "postgres_project";
       postgres_branch: "postgres_branch";
       postgres_database: "postgres_database";
-      volume: "volume";
     }>;
     select: z.ZodOptional<z.ZodString>;
     display: z.ZodOptional<z.ZodString>;
@@ -58,12 +58,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -99,12 +99,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -139,12 +139,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -180,12 +180,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -220,12 +220,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -259,12 +259,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -298,12 +298,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -337,12 +337,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -376,12 +376,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -415,12 +415,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -457,12 +457,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -498,12 +498,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -537,12 +537,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -579,12 +579,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -620,12 +620,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -660,12 +660,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -701,12 +701,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -741,12 +741,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -780,12 +780,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -819,12 +819,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -858,12 +858,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -897,12 +897,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -936,12 +936,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -978,12 +978,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -1019,12 +1019,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;
@@ -1058,12 +1058,12 @@ declare const pluginManifestSchema: z.ZodObject<{
         discovery: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
           type: z.ZodLiteral<"kind">;
           resourceKind: z.ZodEnum<{
-            warehouse: "warehouse";
+            volume: "volume";
             genie_space: "genie_space";
+            warehouse: "warehouse";
             postgres_project: "postgres_project";
             postgres_branch: "postgres_branch";
             postgres_database: "postgres_database";
-            volume: "volume";
           }>;
           select: z.ZodOptional<z.ZodString>;
           display: z.ZodOptional<z.ZodString>;

package/dist/stream/defaults.js

@@ -1,7 +1,7 @@
 //#region src/stream/defaults.ts
 const streamDefaults = {
 	bufferSize: 100,
-	maxEventSize: 1 * 1024 * 1024,
+	maxEventSize: 5 * 1024 * 1024,
 	bufferTTL: 600 * 1e3,
 	heartbeatInterval: 10 * 1e3,
 	maxActiveStreams: 1e3,

package/dist/stream/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","names":[],"sources":["../../src/stream/defaults.ts"],"sourcesContent":["export const streamDefaults = {\n  bufferSize: 100,\n  // 1 MiB. SSE carries only short JSON control messages — JSON_ARRAY result\n  // rows (already row-size-bounded by the warehouse) plus warehouse-readiness\n  // and error events. ARROW_STREAM never uses SSE: the raw Arrow IPC bytes\n  // stream back on the query response body (`_handleArrowStreamQuery`).\n  maxEventSize: 1 * 1024 * 1024,\n  bufferTTL: 10 * 60 * 1000, // 10 minutes\n  heartbeatInterval: 10 * 1000, // 10 seconds\n  maxActiveStreams: 1000, // 1000 streams\n  disconnectGraceMs: 15_000, // 15 seconds\n} as const;\n"],"mappings":";AAAA,MAAa,iBAAiB;CAC5B,YAAY;CAKZ,cAAc,IAAI,OAAO;CACzB,WAAW,MAAU;CACrB,mBAAmB,KAAK;CACxB,kBAAkB;CAClB,mBAAmB;CACpB"}
+{"version":3,"file":"defaults.js","names":[],"sources":["../../src/stream/defaults.ts"],"sourcesContent":["export const streamDefaults = {\n  bufferSize: 100,\n  // Bounds the JSON_ARRAY path only: ARROW_STREAM bytes stream back on the\n  // query response body (`_handleArrowStreamQuery`), never over SSE.\n  // Keep in sync with `connectSSE`'s `maxBufferSize` default.\n  maxEventSize: 5 * 1024 * 1024,\n  bufferTTL: 10 * 60 * 1000, // 10 minutes\n  heartbeatInterval: 10 * 1000, // 10 seconds\n  maxActiveStreams: 1000, // 1000 streams\n  disconnectGraceMs: 15_000, // 15 seconds\n} as const;\n"],"mappings":";AAAA,MAAa,iBAAiB;CAC5B,YAAY;CAIZ,cAAc,IAAI,OAAO;CACzB,WAAW,MAAU;CACrB,mBAAmB,KAAK;CACxB,kBAAkB;CAClB,mBAAmB;CACpB"}

package/dist/stream/stream-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-manager.d.ts","names":[],"sources":["../../src/stream/stream-manager.ts"],"mappings":";;;;;cAmBa,aAAA;EAAA,QACH,gBAAA;EAAA,QACA,cAAA;EAAA,QACA,SAAA;EAAA,QACA,YAAA;EAAA,QACA,SAAA;EAAA,QACA,iBAAA;cAEI,OAAA,GAAU,YAAA;EAahB,MAAA,CACJ,GAAA,EAAK,YAAA,EACL,OAAA,GAAU,MAAA,EAAQ,WAAA,KAAgB,cAAA,sBAClC,OAAA,GAAU,YAAA,EACV,QAAA,YACC,OAAA;EAsCH,QAAA,CAAA;EAaA,cAAA,CAAA;EAAA,QAKc,uBAAA;EAAA,QA+EA,gBAAA;EAAA,QAiFA,6BAAA;EAAA,QAwGN,eAAA;EAAA,QA6BA,yBAAA;EAAA,QAaA,wBAAA;EAAA,QAwBA,eAAA;EAAA,QAYA,gBAAA;EAAA,QAUA,mBAAA;EAAA,QAuBA,wBAAA;EAAA,QA8BA,gBAAA;AAAA"}
+{"version":3,"file":"stream-manager.d.ts","names":[],"sources":["../../src/stream/stream-manager.ts"],"mappings":";;;;;cAmBa,aAAA;EAAA,QACH,gBAAA;EAAA,QACA,cAAA;EAAA,QACA,SAAA;EAAA,QACA,YAAA;EAAA,QACA,SAAA;EAAA,QACA,iBAAA;cAEI,OAAA,GAAU,YAAA;EAahB,MAAA,CACJ,GAAA,EAAK,YAAA,EACL,OAAA,GAAU,MAAA,EAAQ,WAAA,KAAgB,cAAA,sBAClC,OAAA,GAAU,YAAA,EACV,QAAA,YACC,OAAA;EAsCH,QAAA,CAAA;EAaA,cAAA,CAAA;EAAA,QAKc,uBAAA;EAAA,QA+EA,gBAAA;EAAA,QAmFA,6BAAA;EAAA,QA0GN,eAAA;EAAA,QA6BA,yBAAA;EAAA,QAaA,wBAAA;EAAA,QAwBA,eAAA;EAAA,QAYA,gBAAA;EAAA,QAUA,mBAAA;EAAA,QAuBA,wBAAA;EAAA,QA8BA,gBAAA;AAAA"}

package/dist/stream/stream-manager.js

@@ -100,6 +100,7 @@ var StreamManager = class {
 		if (res.writableEnded || res.destroyed) return;
 		const abortController = new AbortController();
 		const eventBuffer = new EventRingBuffer(options?.bufferSize ?? streamDefaults.bufferSize);
+		const maxEventSize = options?.maxEventSize ?? this.maxEventSize;
 		const combinedSignal = this._combineSignals(abortController.signal, options?.userSignal);
 		const heartbeat = this.sseWriter.startHeartbeat(res, combinedSignal);
 		const traceContext = context.active();
@@ -116,7 +117,8 @@ var StreamManager = class {
 			isCompleted: false,
 			lastAccess: Date.now(),
 			abortController,
-			traceContext
+			traceContext,
+			maxEventSize
 		};
 		this.streamRegistry.add(streamEntry);
 		const streamOperation = {
@@ -143,8 +145,9 @@ var StreamManager = class {
 					if (streamEntry.abortController.signal.aborted) break;
 					const eventId = randomUUID();
 					const eventData = JSON.stringify(event);
-					if (eventData.length > this.maxEventSize) {
-						const errorMsg = `Event exceeds max size of ${this.maxEventSize} bytes`;
+					const { maxEventSize } = streamEntry;
+					if (Buffer.byteLength(eventData, "utf8") > maxEventSize) {
+						const errorMsg = `Event exceeds max size of ${maxEventSize} bytes`;
 						const errorCode = SSEErrorCode.INVALID_REQUEST;
 						this._broadcastErrorToClients(streamEntry, eventId, errorMsg, errorCode);
 						continue;

package/dist/stream/stream-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"stream-manager.js","names":[],"sources":["../../src/stream/stream-manager.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nimport { context } from \"@opentelemetry/api\";\nimport type { IAppResponse, StreamConfig } from \"shared\";\n\nimport { AppKitError } from \"../errors/base\";\nimport { ExecutionError } from \"../errors/execution\";\nimport { createLogger } from \"../logging/logger\";\nimport { EventRingBuffer } from \"./buffers\";\nimport { streamDefaults } from \"./defaults\";\nimport { SSEWriter } from \"./sse-writer\";\nimport { StreamRegistry } from \"./stream-registry\";\nimport { clearGraceTimer, clearRemovalTimer } from \"./timers\";\nimport { SSEErrorCode, type StreamEntry, type StreamOperation } from \"./types\";\nimport { StreamValidator } from \"./validator\";\n\nconst logger = createLogger(\"stream\");\n\n// main entry point for Server-Sent events streaming\nexport class StreamManager {\n  private activeOperations: Set<StreamOperation>;\n  private streamRegistry: StreamRegistry;\n  private sseWriter: SSEWriter;\n  private maxEventSize: number;\n  private bufferTTL: number;\n  private disconnectGraceMs: number;\n\n  constructor(options?: StreamConfig) {\n    this.streamRegistry = new StreamRegistry(\n      options?.maxActiveStreams ?? streamDefaults.maxActiveStreams,\n    );\n    this.sseWriter = new SSEWriter();\n    this.maxEventSize = options?.maxEventSize ?? streamDefaults.maxEventSize;\n    this.bufferTTL = options?.bufferTTL ?? streamDefaults.bufferTTL;\n    this.disconnectGraceMs =\n      options?.disconnectGraceMs ?? streamDefaults.disconnectGraceMs;\n    this.activeOperations = new Set();\n  }\n\n  // main streaming method - handles new connection and reconnection\n  async stream(\n    res: IAppResponse,\n    handler: (signal: AbortSignal) => AsyncGenerator<any, void, unknown>,\n    options?: StreamConfig,\n    ownerKey?: string,\n  ): Promise<void> {\n    const { streamId } = options || {};\n\n    // check if response is already closed\n    if (res.writableEnded || res.destroyed) {\n      return;\n    }\n\n    // setup SSE headers\n    this.sseWriter.setupHeaders(res);\n\n    // handle reconnection\n    if (streamId && StreamValidator.validateStreamId(streamId)) {\n      const existingStream = this.streamRegistry.get(streamId);\n      if (existingStream) {\n        // Enforce per-user binding: the stream's owner key must match the\n        // requesting caller's owner key. This prevents cross-user stream\n        // takeover via guessed/leaked stream IDs (the SSE registry was\n        // previously a global lookup with no authorization step).\n        if (existingStream.ownerKey !== ownerKey) {\n          this.sseWriter.writeError(\n            res,\n            randomUUID(),\n            \"Stream not found or access denied\",\n            SSEErrorCode.STREAM_FORBIDDEN,\n          );\n          res.end();\n          return;\n        }\n        return this._attachToExistingStream(res, existingStream, options);\n      }\n    }\n\n    // if stream does not exist, create a new one\n    return this._createNewStream(res, handler, options, ownerKey);\n  }\n\n  // abort all active operations\n  abortAll(): void {\n    // pending disconnect-grace timers are cleared by streamRegistry.clear() below\n    this.activeOperations.forEach((operation) => {\n      if (operation.heartbeat) clearInterval(operation.heartbeat);\n      operation.controller.abort(\n        new DOMException(\"Server shutdown\", \"AbortError\"),\n      );\n    });\n    this.activeOperations.clear();\n    this.streamRegistry.clear();\n  }\n\n  // get the number of active operations\n  getActiveCount(): number {\n    return this.activeOperations.size;\n  }\n\n  // attach to existing stream\n  private async _attachToExistingStream(\n    res: IAppResponse,\n    streamEntry: StreamEntry,\n    options?: StreamConfig,\n  ): Promise<void> {\n    // handle reconnection - replay missed events\n    const lastEventId = res.req?.headers[\"last-event-id\"];\n\n    if (StreamValidator.validateEventId(lastEventId)) {\n      // cast to string after validation\n      const validEventId = lastEventId as string;\n      if (streamEntry.eventBuffer.has(validEventId)) {\n        const missedEvents =\n          streamEntry.eventBuffer.getEventsSince(validEventId);\n        // broadcast missed events to client\n        for (const event of missedEvents) {\n          if (options?.userSignal?.aborted) break;\n          this.sseWriter.writeBufferedEvent(res, event);\n        }\n      } else {\n        // buffer overflow - send warning\n        this.sseWriter.writeBufferOverflowWarning(res, validEventId);\n      }\n    }\n\n    // a reconnecting client cancels the pending disconnect-grace abort\n    clearGraceTimer(streamEntry);\n\n    // a reconnect cancels any pending registry removal so the entry isn't\n    // pulled out from under the newly attached client\n    clearRemovalTimer(streamEntry);\n\n    // add client to stream entry\n    streamEntry.clients.add(res);\n    streamEntry.lastAccess = Date.now();\n\n    // start heartbeat\n    const combinedSignal = this._combineSignals(\n      streamEntry.abortController.signal,\n      options?.userSignal,\n    );\n    const heartbeat = this.sseWriter.startHeartbeat(res, combinedSignal);\n\n    // track operation\n    const streamOperation: StreamOperation = {\n      controller: streamEntry.abortController,\n      type: \"stream\",\n      heartbeat,\n    };\n    this.activeOperations.add(streamOperation);\n\n    // handle client disconnect\n    res.on(\"close\", () => {\n      clearInterval(heartbeat);\n      streamEntry.clients.delete(res);\n      this.activeOperations.delete(streamOperation);\n\n      // grace-abort instead of aborting now, so a reconnect can resume\n      if (streamEntry.clients.size === 0 && !streamEntry.isCompleted) {\n        this._scheduleGraceAbort(streamEntry);\n      }\n\n      // cleanup if stream is completed and no clients are connected\n      this._scheduleRemovalAfterTTL(streamEntry);\n    });\n\n    // if stream is completed, close connection\n    if (streamEntry.isCompleted) {\n      res.end();\n      // cleanup operation\n      this.activeOperations.delete(streamOperation);\n      clearInterval(heartbeat);\n      // we deliberately ended this client, so drop it from the entry and\n      // schedule removal now instead of relying on the transport's `close`\n      // event (the close handler's later delete is a safe no-op)\n      streamEntry.clients.delete(res);\n      this._scheduleRemovalAfterTTL(streamEntry);\n    }\n  }\n  private async _createNewStream(\n    res: IAppResponse,\n    handler: (signal: AbortSignal) => AsyncGenerator<any, void, unknown>,\n    options?: StreamConfig,\n    ownerKey?: string,\n  ): Promise<void> {\n    const streamId = options?.streamId ?? randomUUID();\n\n    // abort stream if response is closed\n    if (res.writableEnded || res.destroyed) {\n      return;\n    }\n\n    const abortController = new AbortController();\n\n    // create event buffer\n    const eventBuffer = new EventRingBuffer(\n      options?.bufferSize ?? streamDefaults.bufferSize,\n    );\n\n    // setup signals and heartbeat\n    const combinedSignal = this._combineSignals(\n      abortController.signal,\n      options?.userSignal,\n    );\n    const heartbeat = this.sseWriter.startHeartbeat(res, combinedSignal);\n\n    // capture the current trace context at stream creation time\n    const traceContext = context.active();\n\n    // abort stream if response is closed\n    if (res.writableEnded || res.destroyed) {\n      clearInterval(heartbeat);\n      return;\n    }\n\n    // create stream entry\n    const streamEntry: StreamEntry = {\n      streamId,\n      ownerKey,\n      generator: handler(combinedSignal),\n      eventBuffer,\n      clients: new Set([res]),\n      isCompleted: false,\n      lastAccess: Date.now(),\n      abortController,\n      traceContext,\n    };\n    this.streamRegistry.add(streamEntry);\n\n    // track operation\n    const streamOperation: StreamOperation = {\n      controller: abortController,\n      type: \"stream\",\n      heartbeat,\n    };\n    this.activeOperations.add(streamOperation);\n\n    res.on(\"close\", () => {\n      clearInterval(heartbeat);\n      this.activeOperations.delete(streamOperation);\n      streamEntry.clients.delete(res);\n\n      // grace-abort instead of aborting now, so a reconnect can resume\n      if (streamEntry.clients.size === 0 && !streamEntry.isCompleted) {\n        this._scheduleGraceAbort(streamEntry);\n      }\n\n      // if the stream already finished (completed or errored), schedule\n      // registry removal once the buffer TTL elapses so completed streams\n      // don't accumulate in the registry forever\n      this._scheduleRemovalAfterTTL(streamEntry);\n    });\n\n    await this._processGeneratorInBackground(streamEntry);\n\n    // cleanup\n    clearInterval(heartbeat);\n    this.activeOperations.delete(streamOperation);\n  }\n\n  private async _processGeneratorInBackground(\n    streamEntry: StreamEntry,\n  ): Promise<void> {\n    // run the entire generator processing within the captured trace context\n    return context.with(streamEntry.traceContext, async () => {\n      try {\n        // retrieve all events from generator\n        for await (const event of streamEntry.generator) {\n          if (streamEntry.abortController.signal.aborted) break;\n          const eventId = randomUUID();\n          const eventData = JSON.stringify(event);\n\n          // validate event size\n          if (eventData.length > this.maxEventSize) {\n            const errorMsg = `Event exceeds max size of ${this.maxEventSize} bytes`;\n            const errorCode = SSEErrorCode.INVALID_REQUEST;\n            // broadcast error to all connected clients\n            this._broadcastErrorToClients(\n              streamEntry,\n              eventId,\n              errorMsg,\n              errorCode,\n            );\n            continue;\n          }\n\n          // buffer event for reconnection\n          streamEntry.eventBuffer.add({\n            id: eventId,\n            type: event.type,\n            data: eventData,\n            timestamp: Date.now(),\n          });\n\n          // broadcast to all connected clients\n          this._broadcastEventsToClients(streamEntry, eventId, event);\n          streamEntry.lastAccess = Date.now();\n        }\n\n        this._finalizeStream(streamEntry);\n      } catch (error) {\n        // Two distinct messages: a *raw* one for server-side logs (full\n        // detail, statement fragments, correlation IDs) and a *client*\n        // one for the SSE payload (sanitized, stable, safe to render in\n        // a UI). Mixing them leaks upstream wording to anyone connected\n        // to the stream — see CWE-209.\n        const rawMsg =\n          error instanceof Error ? error.message : \"Internal server error\";\n        const clientMsg =\n          error instanceof AppKitError\n            ? error.clientMessage\n            : \"Internal server error\";\n        // Upstream structured code (e.g. RESULT_TOO_LARGE_FOR_JSON_FALLBACK,\n        // NOT_IMPLEMENTED). UI should branch on this, not on `error`.\n        const upstreamCode =\n          error instanceof ExecutionError ? error.errorCode : undefined;\n        const errorEventId = randomUUID();\n        const errorCode = this._categorizeError(error);\n\n        // client cancellation is a normal control-flow signal, not a failure\n        if (errorCode === SSEErrorCode.STREAM_ABORTED) {\n          logger.info(\"Stream aborted by client (code=%s)\", errorCode);\n          this._finalizeStream(streamEntry);\n          return;\n        }\n\n        logger.error(\n          \"Stream execution failed: %s (code=%s upstreamCode=%s)\",\n          rawMsg,\n          errorCode,\n          upstreamCode ?? \"n/a\",\n        );\n\n        const payload: Record<string, unknown> = {\n          error: clientMsg,\n          code: errorCode,\n        };\n        if (upstreamCode) payload.errorCode = upstreamCode;\n\n        // buffer error event\n        streamEntry.eventBuffer.add({\n          id: errorEventId,\n          type: \"error\",\n          data: JSON.stringify(payload),\n          timestamp: Date.now(),\n        });\n\n        // send error event to all connected clients\n        this._broadcastErrorToClients(\n          streamEntry,\n          errorEventId,\n          clientMsg,\n          errorCode,\n          true,\n          upstreamCode,\n        );\n        // the broadcast above already ended the connected clients; finalize\n        // still detaches them so removal is scheduled without waiting on a\n        // transport `close` event\n        this._finalizeStream(streamEntry);\n      }\n    });\n  }\n\n  private _combineSignals(\n    internalSignal?: AbortSignal,\n    userSignal?: AbortSignal,\n  ): AbortSignal {\n    if (!userSignal) return internalSignal || new AbortController().signal;\n\n    const signals = [internalSignal, userSignal].filter(\n      Boolean,\n    ) as AbortSignal[];\n    const controller = new AbortController();\n\n    signals.forEach((signal) => {\n      if (signal?.aborted) {\n        controller.abort(signal.reason);\n        return;\n      }\n\n      signal?.addEventListener(\n        \"abort\",\n        () => {\n          controller.abort(signal.reason);\n        },\n        { once: true },\n      );\n    });\n    return controller.signal;\n  }\n\n  // broadcast events to all connected clients\n  private _broadcastEventsToClients(\n    streamEntry: StreamEntry,\n    eventId: string,\n    event: any,\n  ): void {\n    for (const client of streamEntry.clients) {\n      if (!client.writableEnded) {\n        this.sseWriter.writeEvent(client, eventId, event);\n      }\n    }\n  }\n\n  // broadcast error to all connected clients\n  private _broadcastErrorToClients(\n    streamEntry: StreamEntry,\n    eventId: string,\n    errorMessage: string,\n    errorCode: SSEErrorCode,\n    closeClients: boolean = false,\n    upstreamCode?: string,\n  ): void {\n    for (const client of streamEntry.clients) {\n      if (!client.writableEnded) {\n        this.sseWriter.writeError(\n          client,\n          eventId,\n          errorMessage,\n          errorCode,\n          upstreamCode,\n        );\n        if (closeClients) {\n          client.end();\n        }\n      }\n    }\n  }\n\n  private _finalizeStream(streamEntry: StreamEntry): void {\n    streamEntry.isCompleted = true;\n    clearGraceTimer(streamEntry);\n    this._closeAllClients(streamEntry);\n    this._scheduleRemovalAfterTTL(streamEntry);\n  }\n\n  // close all connected clients and remove them from the stream entry.\n  // We are deliberately terminating these connections, so cleanup must not\n  // depend on the transport emitting a `close` event for each client (it may\n  // never fire). The close handlers' later `clients.delete(...)` calls remain\n  // safe no-ops.\n  private _closeAllClients(streamEntry: StreamEntry): void {\n    for (const client of streamEntry.clients) {\n      if (!client.writableEnded) {\n        client.end();\n      }\n    }\n    streamEntry.clients.clear();\n  }\n\n  // abort the generator after the grace window unless a client reconnects first\n  private _scheduleGraceAbort(streamEntry: StreamEntry): void {\n    // clear any existing timer to avoid stacking\n    clearGraceTimer(streamEntry);\n\n    const timer = setTimeout(() => {\n      streamEntry.disconnectGraceTimer = undefined;\n      if (streamEntry.clients.size === 0 && !streamEntry.isCompleted) {\n        streamEntry.abortController.abort(\n          new DOMException(\"Client disconnected (grace expired)\", \"AbortError\"),\n        );\n      }\n    }, this.disconnectGraceMs);\n\n    // never keep the process alive solely for a grace timer\n    timer.unref?.();\n    streamEntry.disconnectGraceTimer = timer;\n  }\n\n  // schedule registry removal once a finished (completed or errored) stream\n  // has no connected clients. The event buffer stays available for\n  // reconnect replay for `bufferTTL` after the last client disconnects;\n  // after that the stream entry is removed from the registry so it can be\n  // garbage collected.\n  private _scheduleRemovalAfterTTL(streamEntry: StreamEntry): void {\n    if (!streamEntry.isCompleted || streamEntry.clients.size > 0) {\n      return;\n    }\n\n    // at most one removal timer per stream: rescheduling replaces any\n    // pending timer instead of stacking a new one (each pending timer pins\n    // the entry's buffer/generator/trace context for the full TTL)\n    clearRemovalTimer(streamEntry);\n\n    // mark the moment the stream became idle so a reconnect during the TTL\n    // window (which refreshes lastAccess) makes the pending timer a no-op\n    streamEntry.lastAccess = Date.now();\n\n    streamEntry.removalTimer = setTimeout(() => {\n      streamEntry.removalTimer = undefined;\n      // safety net: no-op if a client reconnected during the TTL window;\n      // a fresh removal is scheduled when that client disconnects\n      if (\n        streamEntry.clients.size === 0 &&\n        Date.now() - streamEntry.lastAccess >= this.bufferTTL\n      ) {\n        this.streamRegistry.remove(streamEntry.streamId);\n      }\n    }, this.bufferTTL);\n\n    // don't keep the process alive just to clean up finished streams\n    streamEntry.removalTimer.unref?.();\n  }\n\n  private _categorizeError(error: unknown): SSEErrorCode {\n    if (error instanceof Error) {\n      const message = error.message.toLowerCase();\n      if (message.includes(\"timeout\") || message.includes(\"timed out\")) {\n        return SSEErrorCode.TIMEOUT;\n      }\n\n      if (message.includes(\"unavailable\") || message.includes(\"econnrefused\")) {\n        return SSEErrorCode.TEMPORARY_UNAVAILABLE;\n      }\n\n      if (error.name === \"AbortError\") {\n        return SSEErrorCode.STREAM_ABORTED;\n      }\n\n      // Defense-in-depth: upstream layers (SQL client, cache) may wrap an\n      // AbortError into ExecutionError, losing `name` but keeping the message.\n      if (\n        message.includes(\"operation was aborted\") ||\n        message.includes(\"the request was aborted\") ||\n        message.includes(\"statement was canceled\")\n      ) {\n        return SSEErrorCode.STREAM_ABORTED;\n      }\n\n      // Detect upstream API errors (e.g., from Databricks SDK ApiError)\n      if (\n        \"statusCode\" in error &&\n        typeof (error as any).statusCode === \"number\"\n      ) {\n        return SSEErrorCode.UPSTREAM_ERROR;\n      }\n    }\n\n    return SSEErrorCode.INTERNAL_ERROR;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAM,SAAS,aAAa,SAAS;AAGrC,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,SAAwB;AAClC,OAAK,iBAAiB,IAAI,eACxB,SAAS,oBAAoB,eAAe,iBAC7C;AACD,OAAK,YAAY,IAAI,WAAW;AAChC,OAAK,eAAe,SAAS,gBAAgB,eAAe;AAC5D,OAAK,YAAY,SAAS,aAAa,eAAe;AACtD,OAAK,oBACH,SAAS,qBAAqB,eAAe;AAC/C,OAAK,mCAAmB,IAAI,KAAK;;CAInC,MAAM,OACJ,KACA,SACA,SACA,UACe;EACf,MAAM,EAAE,aAAa,WAAW,EAAE;AAGlC,MAAI,IAAI,iBAAiB,IAAI,UAC3B;AAIF,OAAK,UAAU,aAAa,IAAI;AAGhC,MAAI,YAAY,gBAAgB,iBAAiB,SAAS,EAAE;GAC1D,MAAM,iBAAiB,KAAK,eAAe,IAAI,SAAS;AACxD,OAAI,gBAAgB;AAKlB,QAAI,eAAe,aAAa,UAAU;AACxC,UAAK,UAAU,WACb,KACA,YAAY,EACZ,qCACA,aAAa,iBACd;AACD,SAAI,KAAK;AACT;;AAEF,WAAO,KAAK,wBAAwB,KAAK,gBAAgB,QAAQ;;;AAKrE,SAAO,KAAK,iBAAiB,KAAK,SAAS,SAAS,SAAS;;CAI/D,WAAiB;AAEf,OAAK,iBAAiB,SAAS,cAAc;AAC3C,OAAI,UAAU,UAAW,eAAc,UAAU,UAAU;AAC3D,aAAU,WAAW,MACnB,IAAI,aAAa,mBAAmB,aAAa,CAClD;IACD;AACF,OAAK,iBAAiB,OAAO;AAC7B,OAAK,eAAe,OAAO;;CAI7B,iBAAyB;AACvB,SAAO,KAAK,iBAAiB;;CAI/B,MAAc,wBACZ,KACA,aACA,SACe;EAEf,MAAM,cAAc,IAAI,KAAK,QAAQ;AAErC,MAAI,gBAAgB,gBAAgB,YAAY,EAAE;GAEhD,MAAM,eAAe;AACrB,OAAI,YAAY,YAAY,IAAI,aAAa,EAAE;IAC7C,MAAM,eACJ,YAAY,YAAY,eAAe,aAAa;AAEtD,SAAK,MAAM,SAAS,cAAc;AAChC,SAAI,SAAS,YAAY,QAAS;AAClC,UAAK,UAAU,mBAAmB,KAAK,MAAM;;SAI/C,MAAK,UAAU,2BAA2B,KAAK,aAAa;;AAKhE,kBAAgB,YAAY;AAI5B,oBAAkB,YAAY;AAG9B,cAAY,QAAQ,IAAI,IAAI;AAC5B,cAAY,aAAa,KAAK,KAAK;EAGnC,MAAM,iBAAiB,KAAK,gBAC1B,YAAY,gBAAgB,QAC5B,SAAS,WACV;EACD,MAAM,YAAY,KAAK,UAAU,eAAe,KAAK,eAAe;EAGpE,MAAM,kBAAmC;GACvC,YAAY,YAAY;GACxB,MAAM;GACN;GACD;AACD,OAAK,iBAAiB,IAAI,gBAAgB;AAG1C,MAAI,GAAG,eAAe;AACpB,iBAAc,UAAU;AACxB,eAAY,QAAQ,OAAO,IAAI;AAC/B,QAAK,iBAAiB,OAAO,gBAAgB;AAG7C,OAAI,YAAY,QAAQ,SAAS,KAAK,CAAC,YAAY,YACjD,MAAK,oBAAoB,YAAY;AAIvC,QAAK,yBAAyB,YAAY;IAC1C;AAGF,MAAI,YAAY,aAAa;AAC3B,OAAI,KAAK;AAET,QAAK,iBAAiB,OAAO,gBAAgB;AAC7C,iBAAc,UAAU;AAIxB,eAAY,QAAQ,OAAO,IAAI;AAC/B,QAAK,yBAAyB,YAAY;;;CAG9C,MAAc,iBACZ,KACA,SACA,SACA,UACe;EACf,MAAM,WAAW,SAAS,YAAY,YAAY;AAGlD,MAAI,IAAI,iBAAiB,IAAI,UAC3B;EAGF,MAAM,kBAAkB,IAAI,iBAAiB;EAG7C,MAAM,cAAc,IAAI,gBACtB,SAAS,cAAc,eAAe,WACvC;EAGD,MAAM,iBAAiB,KAAK,gBAC1B,gBAAgB,QAChB,SAAS,WACV;EACD,MAAM,YAAY,KAAK,UAAU,eAAe,KAAK,eAAe;EAGpE,MAAM,eAAe,QAAQ,QAAQ;AAGrC,MAAI,IAAI,iBAAiB,IAAI,WAAW;AACtC,iBAAc,UAAU;AACxB;;EAIF,MAAM,cAA2B;GAC/B;GACA;GACA,WAAW,QAAQ,eAAe;GAClC;GACA,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;GACvB,aAAa;GACb,YAAY,KAAK,KAAK;GACtB;GACA;GACD;AACD,OAAK,eAAe,IAAI,YAAY;EAGpC,MAAM,kBAAmC;GACvC,YAAY;GACZ,MAAM;GACN;GACD;AACD,OAAK,iBAAiB,IAAI,gBAAgB;AAE1C,MAAI,GAAG,eAAe;AACpB,iBAAc,UAAU;AACxB,QAAK,iBAAiB,OAAO,gBAAgB;AAC7C,eAAY,QAAQ,OAAO,IAAI;AAG/B,OAAI,YAAY,QAAQ,SAAS,KAAK,CAAC,YAAY,YACjD,MAAK,oBAAoB,YAAY;AAMvC,QAAK,yBAAyB,YAAY;IAC1C;AAEF,QAAM,KAAK,8BAA8B,YAAY;AAGrD,gBAAc,UAAU;AACxB,OAAK,iBAAiB,OAAO,gBAAgB;;CAG/C,MAAc,8BACZ,aACe;AAEf,SAAO,QAAQ,KAAK,YAAY,cAAc,YAAY;AACxD,OAAI;AAEF,eAAW,MAAM,SAAS,YAAY,WAAW;AAC/C,SAAI,YAAY,gBAAgB,OAAO,QAAS;KAChD,MAAM,UAAU,YAAY;KAC5B,MAAM,YAAY,KAAK,UAAU,MAAM;AAGvC,SAAI,UAAU,SAAS,KAAK,cAAc;MACxC,MAAM,WAAW,6BAA6B,KAAK,aAAa;MAChE,MAAM,YAAY,aAAa;AAE/B,WAAK,yBACH,aACA,SACA,UACA,UACD;AACD;;AAIF,iBAAY,YAAY,IAAI;MAC1B,IAAI;MACJ,MAAM,MAAM;MACZ,MAAM;MACN,WAAW,KAAK,KAAK;MACtB,CAAC;AAGF,UAAK,0BAA0B,aAAa,SAAS,MAAM;AAC3D,iBAAY,aAAa,KAAK,KAAK;;AAGrC,SAAK,gBAAgB,YAAY;YAC1B,OAAO;IAMd,MAAM,SACJ,iBAAiB,QAAQ,MAAM,UAAU;IAC3C,MAAM,YACJ,iBAAiB,cACb,MAAM,gBACN;IAGN,MAAM,eACJ,iBAAiB,iBAAiB,MAAM,YAAY;IACtD,MAAM,eAAe,YAAY;IACjC,MAAM,YAAY,KAAK,iBAAiB,MAAM;AAG9C,QAAI,cAAc,aAAa,gBAAgB;AAC7C,YAAO,KAAK,sCAAsC,UAAU;AAC5D,UAAK,gBAAgB,YAAY;AACjC;;AAGF,WAAO,MACL,yDACA,QACA,WACA,gBAAgB,MACjB;IAED,MAAM,UAAmC;KACvC,OAAO;KACP,MAAM;KACP;AACD,QAAI,aAAc,SAAQ,YAAY;AAGtC,gBAAY,YAAY,IAAI;KAC1B,IAAI;KACJ,MAAM;KACN,MAAM,KAAK,UAAU,QAAQ;KAC7B,WAAW,KAAK,KAAK;KACtB,CAAC;AAGF,SAAK,yBACH,aACA,cACA,WACA,WACA,MACA,aACD;AAID,SAAK,gBAAgB,YAAY;;IAEnC;;CAGJ,AAAQ,gBACN,gBACA,YACa;AACb,MAAI,CAAC,WAAY,QAAO,kBAAkB,IAAI,iBAAiB,CAAC;EAEhE,MAAM,UAAU,CAAC,gBAAgB,WAAW,CAAC,OAC3C,QACD;EACD,MAAM,aAAa,IAAI,iBAAiB;AAExC,UAAQ,SAAS,WAAW;AAC1B,OAAI,QAAQ,SAAS;AACnB,eAAW,MAAM,OAAO,OAAO;AAC/B;;AAGF,WAAQ,iBACN,eACM;AACJ,eAAW,MAAM,OAAO,OAAO;MAEjC,EAAE,MAAM,MAAM,CACf;IACD;AACF,SAAO,WAAW;;CAIpB,AAAQ,0BACN,aACA,SACA,OACM;AACN,OAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,CAAC,OAAO,cACV,MAAK,UAAU,WAAW,QAAQ,SAAS,MAAM;;CAMvD,AAAQ,yBACN,aACA,SACA,cACA,WACA,eAAwB,OACxB,cACM;AACN,OAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,CAAC,OAAO,eAAe;AACzB,QAAK,UAAU,WACb,QACA,SACA,cACA,WACA,aACD;AACD,OAAI,aACF,QAAO,KAAK;;;CAMpB,AAAQ,gBAAgB,aAAgC;AACtD,cAAY,cAAc;AAC1B,kBAAgB,YAAY;AAC5B,OAAK,iBAAiB,YAAY;AAClC,OAAK,yBAAyB,YAAY;;CAQ5C,AAAQ,iBAAiB,aAAgC;AACvD,OAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,CAAC,OAAO,cACV,QAAO,KAAK;AAGhB,cAAY,QAAQ,OAAO;;CAI7B,AAAQ,oBAAoB,aAAgC;AAE1D,kBAAgB,YAAY;EAE5B,MAAM,QAAQ,iBAAiB;AAC7B,eAAY,uBAAuB;AACnC,OAAI,YAAY,QAAQ,SAAS,KAAK,CAAC,YAAY,YACjD,aAAY,gBAAgB,MAC1B,IAAI,aAAa,uCAAuC,aAAa,CACtE;KAEF,KAAK,kBAAkB;AAG1B,QAAM,SAAS;AACf,cAAY,uBAAuB;;CAQrC,AAAQ,yBAAyB,aAAgC;AAC/D,MAAI,CAAC,YAAY,eAAe,YAAY,QAAQ,OAAO,EACzD;AAMF,oBAAkB,YAAY;AAI9B,cAAY,aAAa,KAAK,KAAK;AAEnC,cAAY,eAAe,iBAAiB;AAC1C,eAAY,eAAe;AAG3B,OACE,YAAY,QAAQ,SAAS,KAC7B,KAAK,KAAK,GAAG,YAAY,cAAc,KAAK,UAE5C,MAAK,eAAe,OAAO,YAAY,SAAS;KAEjD,KAAK,UAAU;AAGlB,cAAY,aAAa,SAAS;;CAGpC,AAAQ,iBAAiB,OAA8B;AACrD,MAAI,iBAAiB,OAAO;GAC1B,MAAM,UAAU,MAAM,QAAQ,aAAa;AAC3C,OAAI,QAAQ,SAAS,UAAU,IAAI,QAAQ,SAAS,YAAY,CAC9D,QAAO,aAAa;AAGtB,OAAI,QAAQ,SAAS,cAAc,IAAI,QAAQ,SAAS,eAAe,CACrE,QAAO,aAAa;AAGtB,OAAI,MAAM,SAAS,aACjB,QAAO,aAAa;AAKtB,OACE,QAAQ,SAAS,wBAAwB,IACzC,QAAQ,SAAS,0BAA0B,IAC3C,QAAQ,SAAS,yBAAyB,CAE1C,QAAO,aAAa;AAItB,OACE,gBAAgB,SAChB,OAAQ,MAAc,eAAe,SAErC,QAAO,aAAa;;AAIxB,SAAO,aAAa"}
+{"version":3,"file":"stream-manager.js","names":[],"sources":["../../src/stream/stream-manager.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\n\nimport { context } from \"@opentelemetry/api\";\nimport type { IAppResponse, StreamConfig } from \"shared\";\n\nimport { AppKitError } from \"../errors/base\";\nimport { ExecutionError } from \"../errors/execution\";\nimport { createLogger } from \"../logging/logger\";\nimport { EventRingBuffer } from \"./buffers\";\nimport { streamDefaults } from \"./defaults\";\nimport { SSEWriter } from \"./sse-writer\";\nimport { StreamRegistry } from \"./stream-registry\";\nimport { clearGraceTimer, clearRemovalTimer } from \"./timers\";\nimport { SSEErrorCode, type StreamEntry, type StreamOperation } from \"./types\";\nimport { StreamValidator } from \"./validator\";\n\nconst logger = createLogger(\"stream\");\n\n// main entry point for Server-Sent events streaming\nexport class StreamManager {\n  private activeOperations: Set<StreamOperation>;\n  private streamRegistry: StreamRegistry;\n  private sseWriter: SSEWriter;\n  private maxEventSize: number;\n  private bufferTTL: number;\n  private disconnectGraceMs: number;\n\n  constructor(options?: StreamConfig) {\n    this.streamRegistry = new StreamRegistry(\n      options?.maxActiveStreams ?? streamDefaults.maxActiveStreams,\n    );\n    this.sseWriter = new SSEWriter();\n    this.maxEventSize = options?.maxEventSize ?? streamDefaults.maxEventSize;\n    this.bufferTTL = options?.bufferTTL ?? streamDefaults.bufferTTL;\n    this.disconnectGraceMs =\n      options?.disconnectGraceMs ?? streamDefaults.disconnectGraceMs;\n    this.activeOperations = new Set();\n  }\n\n  // main streaming method - handles new connection and reconnection\n  async stream(\n    res: IAppResponse,\n    handler: (signal: AbortSignal) => AsyncGenerator<any, void, unknown>,\n    options?: StreamConfig,\n    ownerKey?: string,\n  ): Promise<void> {\n    const { streamId } = options || {};\n\n    // check if response is already closed\n    if (res.writableEnded || res.destroyed) {\n      return;\n    }\n\n    // setup SSE headers\n    this.sseWriter.setupHeaders(res);\n\n    // handle reconnection\n    if (streamId && StreamValidator.validateStreamId(streamId)) {\n      const existingStream = this.streamRegistry.get(streamId);\n      if (existingStream) {\n        // Enforce per-user binding: the stream's owner key must match the\n        // requesting caller's owner key. This prevents cross-user stream\n        // takeover via guessed/leaked stream IDs (the SSE registry was\n        // previously a global lookup with no authorization step).\n        if (existingStream.ownerKey !== ownerKey) {\n          this.sseWriter.writeError(\n            res,\n            randomUUID(),\n            \"Stream not found or access denied\",\n            SSEErrorCode.STREAM_FORBIDDEN,\n          );\n          res.end();\n          return;\n        }\n        return this._attachToExistingStream(res, existingStream, options);\n      }\n    }\n\n    // if stream does not exist, create a new one\n    return this._createNewStream(res, handler, options, ownerKey);\n  }\n\n  // abort all active operations\n  abortAll(): void {\n    // pending disconnect-grace timers are cleared by streamRegistry.clear() below\n    this.activeOperations.forEach((operation) => {\n      if (operation.heartbeat) clearInterval(operation.heartbeat);\n      operation.controller.abort(\n        new DOMException(\"Server shutdown\", \"AbortError\"),\n      );\n    });\n    this.activeOperations.clear();\n    this.streamRegistry.clear();\n  }\n\n  // get the number of active operations\n  getActiveCount(): number {\n    return this.activeOperations.size;\n  }\n\n  // attach to existing stream\n  private async _attachToExistingStream(\n    res: IAppResponse,\n    streamEntry: StreamEntry,\n    options?: StreamConfig,\n  ): Promise<void> {\n    // handle reconnection - replay missed events\n    const lastEventId = res.req?.headers[\"last-event-id\"];\n\n    if (StreamValidator.validateEventId(lastEventId)) {\n      // cast to string after validation\n      const validEventId = lastEventId as string;\n      if (streamEntry.eventBuffer.has(validEventId)) {\n        const missedEvents =\n          streamEntry.eventBuffer.getEventsSince(validEventId);\n        // broadcast missed events to client\n        for (const event of missedEvents) {\n          if (options?.userSignal?.aborted) break;\n          this.sseWriter.writeBufferedEvent(res, event);\n        }\n      } else {\n        // buffer overflow - send warning\n        this.sseWriter.writeBufferOverflowWarning(res, validEventId);\n      }\n    }\n\n    // a reconnecting client cancels the pending disconnect-grace abort\n    clearGraceTimer(streamEntry);\n\n    // a reconnect cancels any pending registry removal so the entry isn't\n    // pulled out from under the newly attached client\n    clearRemovalTimer(streamEntry);\n\n    // add client to stream entry\n    streamEntry.clients.add(res);\n    streamEntry.lastAccess = Date.now();\n\n    // start heartbeat\n    const combinedSignal = this._combineSignals(\n      streamEntry.abortController.signal,\n      options?.userSignal,\n    );\n    const heartbeat = this.sseWriter.startHeartbeat(res, combinedSignal);\n\n    // track operation\n    const streamOperation: StreamOperation = {\n      controller: streamEntry.abortController,\n      type: \"stream\",\n      heartbeat,\n    };\n    this.activeOperations.add(streamOperation);\n\n    // handle client disconnect\n    res.on(\"close\", () => {\n      clearInterval(heartbeat);\n      streamEntry.clients.delete(res);\n      this.activeOperations.delete(streamOperation);\n\n      // grace-abort instead of aborting now, so a reconnect can resume\n      if (streamEntry.clients.size === 0 && !streamEntry.isCompleted) {\n        this._scheduleGraceAbort(streamEntry);\n      }\n\n      // cleanup if stream is completed and no clients are connected\n      this._scheduleRemovalAfterTTL(streamEntry);\n    });\n\n    // if stream is completed, close connection\n    if (streamEntry.isCompleted) {\n      res.end();\n      // cleanup operation\n      this.activeOperations.delete(streamOperation);\n      clearInterval(heartbeat);\n      // we deliberately ended this client, so drop it from the entry and\n      // schedule removal now instead of relying on the transport's `close`\n      // event (the close handler's later delete is a safe no-op)\n      streamEntry.clients.delete(res);\n      this._scheduleRemovalAfterTTL(streamEntry);\n    }\n  }\n  private async _createNewStream(\n    res: IAppResponse,\n    handler: (signal: AbortSignal) => AsyncGenerator<any, void, unknown>,\n    options?: StreamConfig,\n    ownerKey?: string,\n  ): Promise<void> {\n    const streamId = options?.streamId ?? randomUUID();\n\n    // abort stream if response is closed\n    if (res.writableEnded || res.destroyed) {\n      return;\n    }\n\n    const abortController = new AbortController();\n\n    // create event buffer\n    const eventBuffer = new EventRingBuffer(\n      options?.bufferSize ?? streamDefaults.bufferSize,\n    );\n    const maxEventSize = options?.maxEventSize ?? this.maxEventSize;\n\n    // setup signals and heartbeat\n    const combinedSignal = this._combineSignals(\n      abortController.signal,\n      options?.userSignal,\n    );\n    const heartbeat = this.sseWriter.startHeartbeat(res, combinedSignal);\n\n    // capture the current trace context at stream creation time\n    const traceContext = context.active();\n\n    // abort stream if response is closed\n    if (res.writableEnded || res.destroyed) {\n      clearInterval(heartbeat);\n      return;\n    }\n\n    // create stream entry\n    const streamEntry: StreamEntry = {\n      streamId,\n      ownerKey,\n      generator: handler(combinedSignal),\n      eventBuffer,\n      clients: new Set([res]),\n      isCompleted: false,\n      lastAccess: Date.now(),\n      abortController,\n      traceContext,\n      maxEventSize,\n    };\n    this.streamRegistry.add(streamEntry);\n\n    // track operation\n    const streamOperation: StreamOperation = {\n      controller: abortController,\n      type: \"stream\",\n      heartbeat,\n    };\n    this.activeOperations.add(streamOperation);\n\n    res.on(\"close\", () => {\n      clearInterval(heartbeat);\n      this.activeOperations.delete(streamOperation);\n      streamEntry.clients.delete(res);\n\n      // grace-abort instead of aborting now, so a reconnect can resume\n      if (streamEntry.clients.size === 0 && !streamEntry.isCompleted) {\n        this._scheduleGraceAbort(streamEntry);\n      }\n\n      // if the stream already finished (completed or errored), schedule\n      // registry removal once the buffer TTL elapses so completed streams\n      // don't accumulate in the registry forever\n      this._scheduleRemovalAfterTTL(streamEntry);\n    });\n\n    await this._processGeneratorInBackground(streamEntry);\n\n    // cleanup\n    clearInterval(heartbeat);\n    this.activeOperations.delete(streamOperation);\n  }\n\n  private async _processGeneratorInBackground(\n    streamEntry: StreamEntry,\n  ): Promise<void> {\n    // run the entire generator processing within the captured trace context\n    return context.with(streamEntry.traceContext, async () => {\n      try {\n        // retrieve all events from generator\n        for await (const event of streamEntry.generator) {\n          if (streamEntry.abortController.signal.aborted) break;\n          const eventId = randomUUID();\n          const eventData = JSON.stringify(event);\n          const { maxEventSize } = streamEntry;\n\n          // UTF-8 bytes, not `String.length`: non-ASCII payloads used to slip\n          // past a limit they exceeded on the wire.\n          if (Buffer.byteLength(eventData, \"utf8\") > maxEventSize) {\n            const errorMsg = `Event exceeds max size of ${maxEventSize} bytes`;\n            const errorCode = SSEErrorCode.INVALID_REQUEST;\n            // broadcast error to all connected clients\n            this._broadcastErrorToClients(\n              streamEntry,\n              eventId,\n              errorMsg,\n              errorCode,\n            );\n            continue;\n          }\n\n          // buffer event for reconnection\n          streamEntry.eventBuffer.add({\n            id: eventId,\n            type: event.type,\n            data: eventData,\n            timestamp: Date.now(),\n          });\n\n          // broadcast to all connected clients\n          this._broadcastEventsToClients(streamEntry, eventId, event);\n          streamEntry.lastAccess = Date.now();\n        }\n\n        this._finalizeStream(streamEntry);\n      } catch (error) {\n        // Two distinct messages: a *raw* one for server-side logs (full\n        // detail, statement fragments, correlation IDs) and a *client*\n        // one for the SSE payload (sanitized, stable, safe to render in\n        // a UI). Mixing them leaks upstream wording to anyone connected\n        // to the stream — see CWE-209.\n        const rawMsg =\n          error instanceof Error ? error.message : \"Internal server error\";\n        const clientMsg =\n          error instanceof AppKitError\n            ? error.clientMessage\n            : \"Internal server error\";\n        // Upstream structured code (e.g. RESULT_TOO_LARGE_FOR_JSON_FALLBACK,\n        // NOT_IMPLEMENTED). UI should branch on this, not on `error`.\n        const upstreamCode =\n          error instanceof ExecutionError ? error.errorCode : undefined;\n        const errorEventId = randomUUID();\n        const errorCode = this._categorizeError(error);\n\n        // client cancellation is a normal control-flow signal, not a failure\n        if (errorCode === SSEErrorCode.STREAM_ABORTED) {\n          logger.info(\"Stream aborted by client (code=%s)\", errorCode);\n          this._finalizeStream(streamEntry);\n          return;\n        }\n\n        logger.error(\n          \"Stream execution failed: %s (code=%s upstreamCode=%s)\",\n          rawMsg,\n          errorCode,\n          upstreamCode ?? \"n/a\",\n        );\n\n        const payload: Record<string, unknown> = {\n          error: clientMsg,\n          code: errorCode,\n        };\n        if (upstreamCode) payload.errorCode = upstreamCode;\n\n        // buffer error event\n        streamEntry.eventBuffer.add({\n          id: errorEventId,\n          type: \"error\",\n          data: JSON.stringify(payload),\n          timestamp: Date.now(),\n        });\n\n        // send error event to all connected clients\n        this._broadcastErrorToClients(\n          streamEntry,\n          errorEventId,\n          clientMsg,\n          errorCode,\n          true,\n          upstreamCode,\n        );\n        // the broadcast above already ended the connected clients; finalize\n        // still detaches them so removal is scheduled without waiting on a\n        // transport `close` event\n        this._finalizeStream(streamEntry);\n      }\n    });\n  }\n\n  private _combineSignals(\n    internalSignal?: AbortSignal,\n    userSignal?: AbortSignal,\n  ): AbortSignal {\n    if (!userSignal) return internalSignal || new AbortController().signal;\n\n    const signals = [internalSignal, userSignal].filter(\n      Boolean,\n    ) as AbortSignal[];\n    const controller = new AbortController();\n\n    signals.forEach((signal) => {\n      if (signal?.aborted) {\n        controller.abort(signal.reason);\n        return;\n      }\n\n      signal?.addEventListener(\n        \"abort\",\n        () => {\n          controller.abort(signal.reason);\n        },\n        { once: true },\n      );\n    });\n    return controller.signal;\n  }\n\n  // broadcast events to all connected clients\n  private _broadcastEventsToClients(\n    streamEntry: StreamEntry,\n    eventId: string,\n    event: any,\n  ): void {\n    for (const client of streamEntry.clients) {\n      if (!client.writableEnded) {\n        this.sseWriter.writeEvent(client, eventId, event);\n      }\n    }\n  }\n\n  // broadcast error to all connected clients\n  private _broadcastErrorToClients(\n    streamEntry: StreamEntry,\n    eventId: string,\n    errorMessage: string,\n    errorCode: SSEErrorCode,\n    closeClients: boolean = false,\n    upstreamCode?: string,\n  ): void {\n    for (const client of streamEntry.clients) {\n      if (!client.writableEnded) {\n        this.sseWriter.writeError(\n          client,\n          eventId,\n          errorMessage,\n          errorCode,\n          upstreamCode,\n        );\n        if (closeClients) {\n          client.end();\n        }\n      }\n    }\n  }\n\n  private _finalizeStream(streamEntry: StreamEntry): void {\n    streamEntry.isCompleted = true;\n    clearGraceTimer(streamEntry);\n    this._closeAllClients(streamEntry);\n    this._scheduleRemovalAfterTTL(streamEntry);\n  }\n\n  // close all connected clients and remove them from the stream entry.\n  // We are deliberately terminating these connections, so cleanup must not\n  // depend on the transport emitting a `close` event for each client (it may\n  // never fire). The close handlers' later `clients.delete(...)` calls remain\n  // safe no-ops.\n  private _closeAllClients(streamEntry: StreamEntry): void {\n    for (const client of streamEntry.clients) {\n      if (!client.writableEnded) {\n        client.end();\n      }\n    }\n    streamEntry.clients.clear();\n  }\n\n  // abort the generator after the grace window unless a client reconnects first\n  private _scheduleGraceAbort(streamEntry: StreamEntry): void {\n    // clear any existing timer to avoid stacking\n    clearGraceTimer(streamEntry);\n\n    const timer = setTimeout(() => {\n      streamEntry.disconnectGraceTimer = undefined;\n      if (streamEntry.clients.size === 0 && !streamEntry.isCompleted) {\n        streamEntry.abortController.abort(\n          new DOMException(\"Client disconnected (grace expired)\", \"AbortError\"),\n        );\n      }\n    }, this.disconnectGraceMs);\n\n    // never keep the process alive solely for a grace timer\n    timer.unref?.();\n    streamEntry.disconnectGraceTimer = timer;\n  }\n\n  // schedule registry removal once a finished (completed or errored) stream\n  // has no connected clients. The event buffer stays available for\n  // reconnect replay for `bufferTTL` after the last client disconnects;\n  // after that the stream entry is removed from the registry so it can be\n  // garbage collected.\n  private _scheduleRemovalAfterTTL(streamEntry: StreamEntry): void {\n    if (!streamEntry.isCompleted || streamEntry.clients.size > 0) {\n      return;\n    }\n\n    // at most one removal timer per stream: rescheduling replaces any\n    // pending timer instead of stacking a new one (each pending timer pins\n    // the entry's buffer/generator/trace context for the full TTL)\n    clearRemovalTimer(streamEntry);\n\n    // mark the moment the stream became idle so a reconnect during the TTL\n    // window (which refreshes lastAccess) makes the pending timer a no-op\n    streamEntry.lastAccess = Date.now();\n\n    streamEntry.removalTimer = setTimeout(() => {\n      streamEntry.removalTimer = undefined;\n      // safety net: no-op if a client reconnected during the TTL window;\n      // a fresh removal is scheduled when that client disconnects\n      if (\n        streamEntry.clients.size === 0 &&\n        Date.now() - streamEntry.lastAccess >= this.bufferTTL\n      ) {\n        this.streamRegistry.remove(streamEntry.streamId);\n      }\n    }, this.bufferTTL);\n\n    // don't keep the process alive just to clean up finished streams\n    streamEntry.removalTimer.unref?.();\n  }\n\n  private _categorizeError(error: unknown): SSEErrorCode {\n    if (error instanceof Error) {\n      const message = error.message.toLowerCase();\n      if (message.includes(\"timeout\") || message.includes(\"timed out\")) {\n        return SSEErrorCode.TIMEOUT;\n      }\n\n      if (message.includes(\"unavailable\") || message.includes(\"econnrefused\")) {\n        return SSEErrorCode.TEMPORARY_UNAVAILABLE;\n      }\n\n      if (error.name === \"AbortError\") {\n        return SSEErrorCode.STREAM_ABORTED;\n      }\n\n      // Defense-in-depth: upstream layers (SQL client, cache) may wrap an\n      // AbortError into ExecutionError, losing `name` but keeping the message.\n      if (\n        message.includes(\"operation was aborted\") ||\n        message.includes(\"the request was aborted\") ||\n        message.includes(\"statement was canceled\")\n      ) {\n        return SSEErrorCode.STREAM_ABORTED;\n      }\n\n      // Detect upstream API errors (e.g., from Databricks SDK ApiError)\n      if (\n        \"statusCode\" in error &&\n        typeof (error as any).statusCode === \"number\"\n      ) {\n        return SSEErrorCode.UPSTREAM_ERROR;\n      }\n    }\n\n    return SSEErrorCode.INTERNAL_ERROR;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAM,SAAS,aAAa,SAAS;AAGrC,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAY,SAAwB;AAClC,OAAK,iBAAiB,IAAI,eACxB,SAAS,oBAAoB,eAAe,iBAC7C;AACD,OAAK,YAAY,IAAI,WAAW;AAChC,OAAK,eAAe,SAAS,gBAAgB,eAAe;AAC5D,OAAK,YAAY,SAAS,aAAa,eAAe;AACtD,OAAK,oBACH,SAAS,qBAAqB,eAAe;AAC/C,OAAK,mCAAmB,IAAI,KAAK;;CAInC,MAAM,OACJ,KACA,SACA,SACA,UACe;EACf,MAAM,EAAE,aAAa,WAAW,EAAE;AAGlC,MAAI,IAAI,iBAAiB,IAAI,UAC3B;AAIF,OAAK,UAAU,aAAa,IAAI;AAGhC,MAAI,YAAY,gBAAgB,iBAAiB,SAAS,EAAE;GAC1D,MAAM,iBAAiB,KAAK,eAAe,IAAI,SAAS;AACxD,OAAI,gBAAgB;AAKlB,QAAI,eAAe,aAAa,UAAU;AACxC,UAAK,UAAU,WACb,KACA,YAAY,EACZ,qCACA,aAAa,iBACd;AACD,SAAI,KAAK;AACT;;AAEF,WAAO,KAAK,wBAAwB,KAAK,gBAAgB,QAAQ;;;AAKrE,SAAO,KAAK,iBAAiB,KAAK,SAAS,SAAS,SAAS;;CAI/D,WAAiB;AAEf,OAAK,iBAAiB,SAAS,cAAc;AAC3C,OAAI,UAAU,UAAW,eAAc,UAAU,UAAU;AAC3D,aAAU,WAAW,MACnB,IAAI,aAAa,mBAAmB,aAAa,CAClD;IACD;AACF,OAAK,iBAAiB,OAAO;AAC7B,OAAK,eAAe,OAAO;;CAI7B,iBAAyB;AACvB,SAAO,KAAK,iBAAiB;;CAI/B,MAAc,wBACZ,KACA,aACA,SACe;EAEf,MAAM,cAAc,IAAI,KAAK,QAAQ;AAErC,MAAI,gBAAgB,gBAAgB,YAAY,EAAE;GAEhD,MAAM,eAAe;AACrB,OAAI,YAAY,YAAY,IAAI,aAAa,EAAE;IAC7C,MAAM,eACJ,YAAY,YAAY,eAAe,aAAa;AAEtD,SAAK,MAAM,SAAS,cAAc;AAChC,SAAI,SAAS,YAAY,QAAS;AAClC,UAAK,UAAU,mBAAmB,KAAK,MAAM;;SAI/C,MAAK,UAAU,2BAA2B,KAAK,aAAa;;AAKhE,kBAAgB,YAAY;AAI5B,oBAAkB,YAAY;AAG9B,cAAY,QAAQ,IAAI,IAAI;AAC5B,cAAY,aAAa,KAAK,KAAK;EAGnC,MAAM,iBAAiB,KAAK,gBAC1B,YAAY,gBAAgB,QAC5B,SAAS,WACV;EACD,MAAM,YAAY,KAAK,UAAU,eAAe,KAAK,eAAe;EAGpE,MAAM,kBAAmC;GACvC,YAAY,YAAY;GACxB,MAAM;GACN;GACD;AACD,OAAK,iBAAiB,IAAI,gBAAgB;AAG1C,MAAI,GAAG,eAAe;AACpB,iBAAc,UAAU;AACxB,eAAY,QAAQ,OAAO,IAAI;AAC/B,QAAK,iBAAiB,OAAO,gBAAgB;AAG7C,OAAI,YAAY,QAAQ,SAAS,KAAK,CAAC,YAAY,YACjD,MAAK,oBAAoB,YAAY;AAIvC,QAAK,yBAAyB,YAAY;IAC1C;AAGF,MAAI,YAAY,aAAa;AAC3B,OAAI,KAAK;AAET,QAAK,iBAAiB,OAAO,gBAAgB;AAC7C,iBAAc,UAAU;AAIxB,eAAY,QAAQ,OAAO,IAAI;AAC/B,QAAK,yBAAyB,YAAY;;;CAG9C,MAAc,iBACZ,KACA,SACA,SACA,UACe;EACf,MAAM,WAAW,SAAS,YAAY,YAAY;AAGlD,MAAI,IAAI,iBAAiB,IAAI,UAC3B;EAGF,MAAM,kBAAkB,IAAI,iBAAiB;EAG7C,MAAM,cAAc,IAAI,gBACtB,SAAS,cAAc,eAAe,WACvC;EACD,MAAM,eAAe,SAAS,gBAAgB,KAAK;EAGnD,MAAM,iBAAiB,KAAK,gBAC1B,gBAAgB,QAChB,SAAS,WACV;EACD,MAAM,YAAY,KAAK,UAAU,eAAe,KAAK,eAAe;EAGpE,MAAM,eAAe,QAAQ,QAAQ;AAGrC,MAAI,IAAI,iBAAiB,IAAI,WAAW;AACtC,iBAAc,UAAU;AACxB;;EAIF,MAAM,cAA2B;GAC/B;GACA;GACA,WAAW,QAAQ,eAAe;GAClC;GACA,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;GACvB,aAAa;GACb,YAAY,KAAK,KAAK;GACtB;GACA;GACA;GACD;AACD,OAAK,eAAe,IAAI,YAAY;EAGpC,MAAM,kBAAmC;GACvC,YAAY;GACZ,MAAM;GACN;GACD;AACD,OAAK,iBAAiB,IAAI,gBAAgB;AAE1C,MAAI,GAAG,eAAe;AACpB,iBAAc,UAAU;AACxB,QAAK,iBAAiB,OAAO,gBAAgB;AAC7C,eAAY,QAAQ,OAAO,IAAI;AAG/B,OAAI,YAAY,QAAQ,SAAS,KAAK,CAAC,YAAY,YACjD,MAAK,oBAAoB,YAAY;AAMvC,QAAK,yBAAyB,YAAY;IAC1C;AAEF,QAAM,KAAK,8BAA8B,YAAY;AAGrD,gBAAc,UAAU;AACxB,OAAK,iBAAiB,OAAO,gBAAgB;;CAG/C,MAAc,8BACZ,aACe;AAEf,SAAO,QAAQ,KAAK,YAAY,cAAc,YAAY;AACxD,OAAI;AAEF,eAAW,MAAM,SAAS,YAAY,WAAW;AAC/C,SAAI,YAAY,gBAAgB,OAAO,QAAS;KAChD,MAAM,UAAU,YAAY;KAC5B,MAAM,YAAY,KAAK,UAAU,MAAM;KACvC,MAAM,EAAE,iBAAiB;AAIzB,SAAI,OAAO,WAAW,WAAW,OAAO,GAAG,cAAc;MACvD,MAAM,WAAW,6BAA6B,aAAa;MAC3D,MAAM,YAAY,aAAa;AAE/B,WAAK,yBACH,aACA,SACA,UACA,UACD;AACD;;AAIF,iBAAY,YAAY,IAAI;MAC1B,IAAI;MACJ,MAAM,MAAM;MACZ,MAAM;MACN,WAAW,KAAK,KAAK;MACtB,CAAC;AAGF,UAAK,0BAA0B,aAAa,SAAS,MAAM;AAC3D,iBAAY,aAAa,KAAK,KAAK;;AAGrC,SAAK,gBAAgB,YAAY;YAC1B,OAAO;IAMd,MAAM,SACJ,iBAAiB,QAAQ,MAAM,UAAU;IAC3C,MAAM,YACJ,iBAAiB,cACb,MAAM,gBACN;IAGN,MAAM,eACJ,iBAAiB,iBAAiB,MAAM,YAAY;IACtD,MAAM,eAAe,YAAY;IACjC,MAAM,YAAY,KAAK,iBAAiB,MAAM;AAG9C,QAAI,cAAc,aAAa,gBAAgB;AAC7C,YAAO,KAAK,sCAAsC,UAAU;AAC5D,UAAK,gBAAgB,YAAY;AACjC;;AAGF,WAAO,MACL,yDACA,QACA,WACA,gBAAgB,MACjB;IAED,MAAM,UAAmC;KACvC,OAAO;KACP,MAAM;KACP;AACD,QAAI,aAAc,SAAQ,YAAY;AAGtC,gBAAY,YAAY,IAAI;KAC1B,IAAI;KACJ,MAAM;KACN,MAAM,KAAK,UAAU,QAAQ;KAC7B,WAAW,KAAK,KAAK;KACtB,CAAC;AAGF,SAAK,yBACH,aACA,cACA,WACA,WACA,MACA,aACD;AAID,SAAK,gBAAgB,YAAY;;IAEnC;;CAGJ,AAAQ,gBACN,gBACA,YACa;AACb,MAAI,CAAC,WAAY,QAAO,kBAAkB,IAAI,iBAAiB,CAAC;EAEhE,MAAM,UAAU,CAAC,gBAAgB,WAAW,CAAC,OAC3C,QACD;EACD,MAAM,aAAa,IAAI,iBAAiB;AAExC,UAAQ,SAAS,WAAW;AAC1B,OAAI,QAAQ,SAAS;AACnB,eAAW,MAAM,OAAO,OAAO;AAC/B;;AAGF,WAAQ,iBACN,eACM;AACJ,eAAW,MAAM,OAAO,OAAO;MAEjC,EAAE,MAAM,MAAM,CACf;IACD;AACF,SAAO,WAAW;;CAIpB,AAAQ,0BACN,aACA,SACA,OACM;AACN,OAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,CAAC,OAAO,cACV,MAAK,UAAU,WAAW,QAAQ,SAAS,MAAM;;CAMvD,AAAQ,yBACN,aACA,SACA,cACA,WACA,eAAwB,OACxB,cACM;AACN,OAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,CAAC,OAAO,eAAe;AACzB,QAAK,UAAU,WACb,QACA,SACA,cACA,WACA,aACD;AACD,OAAI,aACF,QAAO,KAAK;;;CAMpB,AAAQ,gBAAgB,aAAgC;AACtD,cAAY,cAAc;AAC1B,kBAAgB,YAAY;AAC5B,OAAK,iBAAiB,YAAY;AAClC,OAAK,yBAAyB,YAAY;;CAQ5C,AAAQ,iBAAiB,aAAgC;AACvD,OAAK,MAAM,UAAU,YAAY,QAC/B,KAAI,CAAC,OAAO,cACV,QAAO,KAAK;AAGhB,cAAY,QAAQ,OAAO;;CAI7B,AAAQ,oBAAoB,aAAgC;AAE1D,kBAAgB,YAAY;EAE5B,MAAM,QAAQ,iBAAiB;AAC7B,eAAY,uBAAuB;AACnC,OAAI,YAAY,QAAQ,SAAS,KAAK,CAAC,YAAY,YACjD,aAAY,gBAAgB,MAC1B,IAAI,aAAa,uCAAuC,aAAa,CACtE;KAEF,KAAK,kBAAkB;AAG1B,QAAM,SAAS;AACf,cAAY,uBAAuB;;CAQrC,AAAQ,yBAAyB,aAAgC;AAC/D,MAAI,CAAC,YAAY,eAAe,YAAY,QAAQ,OAAO,EACzD;AAMF,oBAAkB,YAAY;AAI9B,cAAY,aAAa,KAAK,KAAK;AAEnC,cAAY,eAAe,iBAAiB;AAC1C,eAAY,eAAe;AAG3B,OACE,YAAY,QAAQ,SAAS,KAC7B,KAAK,KAAK,GAAG,YAAY,cAAc,KAAK,UAE5C,MAAK,eAAe,OAAO,YAAY,SAAS;KAEjD,KAAK,UAAU;AAGlB,cAAY,aAAa,SAAS;;CAGpC,AAAQ,iBAAiB,OAA8B;AACrD,MAAI,iBAAiB,OAAO;GAC1B,MAAM,UAAU,MAAM,QAAQ,aAAa;AAC3C,OAAI,QAAQ,SAAS,UAAU,IAAI,QAAQ,SAAS,YAAY,CAC9D,QAAO,aAAa;AAGtB,OAAI,QAAQ,SAAS,cAAc,IAAI,QAAQ,SAAS,eAAe,CACrE,QAAO,aAAa;AAGtB,OAAI,MAAM,SAAS,aACjB,QAAO,aAAa;AAKtB,OACE,QAAQ,SAAS,wBAAwB,IACzC,QAAQ,SAAS,0BAA0B,IAC3C,QAAQ,SAAS,yBAAyB,CAE1C,QAAO,aAAa;AAItB,OACE,gBAAgB,SAChB,OAAQ,MAAc,eAAe,SAErC,QAAO,aAAa;;AAIxB,SAAO,aAAa"}

package/dist/stream/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../../src/stream/types.ts"],"sourcesContent":["import type { Context } from \"@opentelemetry/api\";\nimport type { IAppResponse } from \"shared\";\n\nimport type { EventRingBuffer } from \"./buffers\";\n\nexport const SSEWarningCode = {\n  BUFFER_OVERFLOW_RESTART: \"BUFFER_OVERFLOW_RESTART\",\n} as const satisfies Record<string, string>;\n\nexport type SSEWarningCode =\n  (typeof SSEWarningCode)[keyof typeof SSEWarningCode];\n\nexport const SSEErrorCode = {\n  TEMPORARY_UNAVAILABLE: \"TEMPORARY_UNAVAILABLE\",\n  TIMEOUT: \"TIMEOUT\",\n  INTERNAL_ERROR: \"INTERNAL_ERROR\",\n  INVALID_REQUEST: \"INVALID_REQUEST\",\n  STREAM_ABORTED: \"STREAM_ABORTED\",\n  STREAM_EVICTED: \"STREAM_EVICTED\",\n  STREAM_FORBIDDEN: \"STREAM_FORBIDDEN\",\n  UPSTREAM_ERROR: \"UPSTREAM_ERROR\",\n} as const satisfies Record<string, string>;\n\nexport type SSEErrorCode = (typeof SSEErrorCode)[keyof typeof SSEErrorCode];\n\nexport interface SSEError {\n  error: string;\n  code: SSEErrorCode;\n  /**\n   * Upstream-domain structured code (e.g. `RESULT_TOO_LARGE_FOR_JSON_FALLBACK`,\n   * `NOT_IMPLEMENTED`). UI code should branch on this instead of parsing\n   * the human-readable `error` string.\n   */\n  errorCode?: string;\n}\n\nexport interface BufferedEvent {\n  id: string;\n  type: string;\n  data: string;\n  timestamp: number;\n}\n\nexport interface StreamEntry {\n  streamId: string;\n  /**\n   * Identifier of the principal that created the stream (e.g. end-user ID\n   * or service principal user ID). When set, only requests sharing the\n   * same owner key may reconnect to the stream.\n   */\n  ownerKey?: string;\n  generator: AsyncGenerator<any, void, unknown>;\n  eventBuffer: EventRingBuffer;\n  clients: Set<IAppResponse>;\n  isCompleted: boolean;\n  lastAccess: number;\n  abortController: AbortController;\n  traceContext: Context;\n  // pending grace-window abort, set while the last client is disconnected\n  disconnectGraceTimer?: NodeJS.Timeout;\n  /**\n   * Pending registry-removal timer. At most one removal timer exists per\n   * stream; scheduling a new one clears any previous timer first.\n   */\n  removalTimer?: NodeJS.Timeout;\n}\n\nexport interface StreamOperation {\n  controller: AbortController;\n  type: \"query\" | \"stream\";\n  heartbeat?: NodeJS.Timeout;\n}\n"],"mappings":";AAKA,MAAa,iBAAiB,EAC5B,yBAAyB,2BAC1B;AAKD,MAAa,eAAe;CAC1B,uBAAuB;CACvB,SAAS;CACT,gBAAgB;CAChB,iBAAiB;CACjB,gBAAgB;CAChB,gBAAgB;CAChB,kBAAkB;CAClB,gBAAgB;CACjB"}
+{"version":3,"file":"types.js","names":[],"sources":["../../src/stream/types.ts"],"sourcesContent":["import type { Context } from \"@opentelemetry/api\";\nimport type { IAppResponse } from \"shared\";\n\nimport type { EventRingBuffer } from \"./buffers\";\n\nexport const SSEWarningCode = {\n  BUFFER_OVERFLOW_RESTART: \"BUFFER_OVERFLOW_RESTART\",\n} as const satisfies Record<string, string>;\n\nexport type SSEWarningCode =\n  (typeof SSEWarningCode)[keyof typeof SSEWarningCode];\n\nexport const SSEErrorCode = {\n  TEMPORARY_UNAVAILABLE: \"TEMPORARY_UNAVAILABLE\",\n  TIMEOUT: \"TIMEOUT\",\n  INTERNAL_ERROR: \"INTERNAL_ERROR\",\n  INVALID_REQUEST: \"INVALID_REQUEST\",\n  STREAM_ABORTED: \"STREAM_ABORTED\",\n  STREAM_EVICTED: \"STREAM_EVICTED\",\n  STREAM_FORBIDDEN: \"STREAM_FORBIDDEN\",\n  UPSTREAM_ERROR: \"UPSTREAM_ERROR\",\n} as const satisfies Record<string, string>;\n\nexport type SSEErrorCode = (typeof SSEErrorCode)[keyof typeof SSEErrorCode];\n\nexport interface SSEError {\n  error: string;\n  code: SSEErrorCode;\n  /**\n   * Upstream-domain structured code (e.g. `RESULT_TOO_LARGE_FOR_JSON_FALLBACK`,\n   * `NOT_IMPLEMENTED`). UI code should branch on this instead of parsing\n   * the human-readable `error` string.\n   */\n  errorCode?: string;\n}\n\nexport interface BufferedEvent {\n  id: string;\n  type: string;\n  data: string;\n  timestamp: number;\n}\n\nexport interface StreamEntry {\n  streamId: string;\n  /**\n   * Identifier of the principal that created the stream (e.g. end-user ID\n   * or service principal user ID). When set, only requests sharing the\n   * same owner key may reconnect to the stream.\n   */\n  ownerKey?: string;\n  generator: AsyncGenerator<any, void, unknown>;\n  eventBuffer: EventRingBuffer;\n  clients: Set<IAppResponse>;\n  isCompleted: boolean;\n  lastAccess: number;\n  abortController: AbortController;\n  traceContext: Context;\n  /**\n   * UTF-8 bytes. Lives on the entry, not on `StreamManager`: one manager is\n   * shared by every stream a plugin opens, so reading it off the instance made\n   * per-call overrides silently ineffective.\n   */\n  maxEventSize: number;\n  // pending grace-window abort, set while the last client is disconnected\n  disconnectGraceTimer?: NodeJS.Timeout;\n  /**\n   * Pending registry-removal timer. At most one removal timer exists per\n   * stream; scheduling a new one clears any previous timer first.\n   */\n  removalTimer?: NodeJS.Timeout;\n}\n\nexport interface StreamOperation {\n  controller: AbortController;\n  type: \"query\" | \"stream\";\n  heartbeat?: NodeJS.Timeout;\n}\n"],"mappings":";AAKA,MAAa,iBAAiB,EAC5B,yBAAyB,2BAC1B;AAKD,MAAa,eAAe;CAC1B,uBAAuB;CACvB,SAAS;CACT,gBAAgB;CAChB,iBAAiB;CACjB,gBAAgB;CAChB,gBAAgB;CAChB,kBAAkB;CAClB,gBAAgB;CACjB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@databricks/appkit",
   "type": "module",
-  "version": "0.69.1",
+  "version": "0.69.2",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {

package/sbom.cdx.json

@@ -1 +1 @@
-{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:c1ee1d2c-0feb-40a1-9eca-760c4d99d24b","version":1,"metadata":{"timestamp":"2026-09-01T10:40:58Z","tools":{"components":[{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"appkit","group":"@databricks","version":"0.69.1","purl":"pkg:npm/%40databricks/appkit@0.69.1","bom-ref":"pkg:npm/@databricks/appkit@0.69.1","type":"application","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}]},"properties":[{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"cdx:bom:componentNamespaces","value":"@ast-grep\\n@databricks\\n@opentelemetry"},{"name":"cdx:bom:componentSrcFiles","value":"packages/appkit/node_modules/@ast-grep/napi/package.json\\npackages/appkit/node_modules/@databricks/lakebase/package.json\\npackages/appkit/node_modules/@opentelemetry/api-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/api/package.json\\npackages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation/package.json\\npackages/appkit/node_modules/@opentelemetry/resources/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-node/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json\\npackages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json\\npackages/appkit/node_modules/apache-arrow/package.json\\npackages/appkit/node_modules/dotenv/package.json\\npackages/appkit/node_modules/drizzle-orm/package.json\\npackages/appkit/node_modules/express/package.json\\npackages/appkit/node_modules/get-port/package.json\\npackages/appkit/node_modules/js-yaml/package.json\\npackages/appkit/node_modules/magic-string/package.json\\npackages/appkit/node_modules/obug/package.json\\npackages/appkit/node_modules/pg/package.json\\npackages/appkit/node_modules/picocolors/package.json\\npackages/appkit/node_modules/semver/package.json\\npackages/appkit/node_modules/shared/package.json\\npackages/appkit/node_modules/vitest/package.json\\npackages/appkit/node_modules/ws/package.json\\npackages/appkit/node_modules/zod/package.json"}]},"components":[{"group":"@ast-grep","name":"napi","version":"0.37.0","description":"Search and Rewrite code at large scale using precise AST pattern","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/%40ast-grep/napi@0.37.0","externalReferences":[{"type":"vcs","url":"https://ast-grep.github.io"}],"type":"library","bom-ref":"pkg:npm/@ast-grep/napi@0.37.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@ast-grep/napi/package.json"},{"name":"ImportedModules","value":"@ast-grep/napi,Lang,@ast-grep/napi/Lang,parse,@ast-grep/napi/parse,SgNode,@ast-grep/napi/SgNode"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"concludedValue":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"occurrences":[{"location":"dist/plugins/server/react-source-loc-vite-plugin.js#2"},{"location":"dist/type-generator/serving/server-file-extractor.js#4"},{"location":"tmp/dist/cli/commands/codemod/on-plugins-ready.js#4"},{"location":"tmp/dist/cli/commands/lint.js#4"},{"location":"tmp/dist/cli/commands/plugin/sync/sync.js#8"},{"location":"tmp/dist/cli/commands/registry/server-register.js#4"},{"location":"tmp/dist/plugins/server/react-source-loc-vite-plugin.js#2"},{"location":"tmp/dist/type-generator/serving/server-file-extractor.js#4"},{"location":"src/plugins/server/react-source-loc-vite-plugin.ts#3"},{"location":"src/type-generator/serving/server-file-extractor.ts#4"}]}},{"group":"@databricks","name":"lakebase","version":"0.5.0","description":"PostgreSQL driver for Databricks Lakebase Autoscaling with automatic OAuth token refresh","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40databricks/lakebase@0.5.0","externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}],"type":"library","bom-ref":"pkg:npm/@databricks/lakebase@0.5.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@databricks/lakebase/package.json"},{"name":"ExportedModules","value":"@databricks/lakebase,DatabaseCredential,@databricks/lakebase/DatabaseCredential,GenerateDatabaseCredentialRequest,@databricks/lakebase/GenerateDatabaseCredentialRequest,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig,RequestedClaims,@databricks/lakebase/RequestedClaims,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,RequestedResource,@databricks/lakebase/RequestedResource"},{"name":"ImportedModules","value":"@databricks/lakebase,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,createLakebasePool,@databricks/lakebase/createLakebasePool,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"concludedValue":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"occurrences":[{"location":"dist/connectors/lakebase/index.js#4"},{"location":"tmp/dist/connectors/lakebase/index.js#4"},{"location":"src/connectors/lakebase/index.ts#4"},{"location":"src/connectors/lakebase/index.ts#36"},{"location":"src/connectors/lakebase/pool-manager.ts#1"}]},"tags":["token"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api-logs","version":"0.219.0","description":"Public logs API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api-logs@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/api-logs"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api-logs@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api-logs"},{"name":"ImportedModules","value":"@opentelemetry/api-logs,SeverityNumber,@opentelemetry/api-logs/SeverityNumber,logs,@opentelemetry/api-logs/logs,createNoopLogger,@opentelemetry/api-logs/createNoopLogger,Logger,@opentelemetry/api-logs/Logger,LogRecord,@opentelemetry/api-logs/LogRecord"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"occurrences":[{"location":"dist/logging/wide-event-emitter.js#1"},{"location":"dist/telemetry/index.js#6"},{"location":"dist/telemetry/noop.js#2"},{"location":"dist/telemetry/telemetry-provider.js#4"},{"location":"tmp/dist/logging/wide-event-emitter.js#1"},{"location":"tmp/dist/telemetry/index.js#6"},{"location":"tmp/dist/telemetry/noop.js#2"},{"location":"tmp/dist/telemetry/telemetry-provider.js#4"},{"location":"src/logging/wide-event-emitter.ts#1"},{"location":"src/telemetry/index.ts#3"},{"location":"src/telemetry/noop.ts#23"},{"location":"src/telemetry/telemetry-provider.ts#3"},{"location":"src/telemetry/types.ts#2"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api","version":"1.9.0","description":"Public API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api@1.9.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/api"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api@1.9.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api,@opentelemetry/api-logs,Counter,@opentelemetry/api/Counter,Histogram,@opentelemetry/api/Histogram,Span,@opentelemetry/api/Span,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode"},{"name":"ImportedModules","value":"@opentelemetry/api,trace,@opentelemetry/api/trace,context,@opentelemetry/api/context,createContextKey,@opentelemetry/api/createContextKey,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode,INVALID_SPAN_CONTEXT,@opentelemetry/api/INVALID_SPAN_CONTEXT,createNoopMeter,@opentelemetry/api/createNoopMeter,metrics,@opentelemetry/api/metrics,Context,@opentelemetry/api/Context,Span,@opentelemetry/api/Span,SpanContext,@opentelemetry/api/SpanContext,SpanOptions,@opentelemetry/api/SpanOptions,Tracer,@opentelemetry/api/Tracer,Meter,@opentelemetry/api/Meter,Attributes,@opentelemetry/api/Attributes,Link,@opentelemetry/api/Link"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#6"},{"location":"dist/plugin/plugin.js#23"},{"location":"dist/stream/stream-manager.js#12"},{"location":"dist/telemetry/index.js#5"},{"location":"dist/telemetry/noop.js#1"},{"location":"dist/telemetry/telemetry-provider.js#3"},{"location":"tmp/dist/logging/logger.js#6"},{"location":"tmp/dist/plugin/plugin.js#23"},{"location":"tmp/dist/stream/stream-manager.js#12"},{"location":"tmp/dist/telemetry/index.js#5"},{"location":"tmp/dist/telemetry/noop.js#1"},{"location":"tmp/dist/telemetry/telemetry-provider.js#3"},{"location":"src/logging/logger.ts#4"},{"location":"src/plugin/plugin.ts#1"},{"location":"src/stream/stream-manager.ts#3"},{"location":"src/stream/types.ts#1"},{"location":"src/telemetry/index.ts#1"},{"location":"src/telemetry/index.ts#2"},{"location":"src/telemetry/noop.ts#17"},{"location":"src/telemetry/noop.ts#22"},{"location":"src/telemetry/telemetry-provider.ts#1"},{"location":"src/telemetry/telemetry-provider.ts#2"},{"location":"src/telemetry/trace-sampler.ts#1"},{"location":"src/telemetry/types.ts#1"},{"location":"src/testing/fixtures.ts#1"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"auto-instrumentations-node","version":"0.77.0","description":"Metapackage which bundles opentelemetry node core and contrib instrumentations","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/auto-instrumentations-node@0.77.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/auto-instrumentations-node#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/auto-instrumentations-node@0.77.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/auto-instrumentations-node,getNodeAutoInstrumentations,@opentelemetry/auto-instrumentations-node/getNodeAutoInstrumentations"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#4"},{"location":"tmp/dist/telemetry/telemetry-manager.js#4"},{"location":"src/telemetry/telemetry-manager.ts#1"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-logs-otlp-proto","version":"0.219.0","description":"An OTLP exporter to send logs using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-logs-otlp-proto@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-logs-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-logs-otlp-proto@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-logs-otlp-proto,OTLPLogExporter,@opentelemetry/exporter-logs-otlp-proto/OTLPLogExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#5"},{"location":"tmp/dist/telemetry/telemetry-manager.js#5"},{"location":"src/telemetry/telemetry-manager.ts#2"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-metrics-otlp-proto","version":"0.219.0","description":"OpenTelemetry Collector Metrics Exporter allows user to send collected metrics to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-metrics-otlp-proto@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-metrics-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-metrics-otlp-proto@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-metrics-otlp-proto,OTLPMetricExporter,@opentelemetry/exporter-metrics-otlp-proto/OTLPMetricExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#6"},{"location":"tmp/dist/telemetry/telemetry-manager.js#6"},{"location":"src/telemetry/telemetry-manager.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-trace-otlp-proto","version":"0.219.0","description":"OpenTelemetry Collector Exporter allows user to send collected traces to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-trace-otlp-proto@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-trace-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-trace-otlp-proto@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-trace-otlp-proto,OTLPTraceExporter,@opentelemetry/exporter-trace-otlp-proto/OTLPTraceExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#7"},{"location":"tmp/dist/telemetry/telemetry-manager.js#7"},{"location":"src/telemetry/telemetry-manager.ts#4"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-express","version":"0.67.0","description":"OpenTelemetry instrumentation for `express` http web application framework","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-express@0.67.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-express#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"framework","bom-ref":"pkg:npm/@opentelemetry/instrumentation-express@0.67.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-express,ExpressInstrumentation,@opentelemetry/instrumentation-express/ExpressInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#2"},{"location":"tmp/dist/telemetry/instrumentations.js#2"},{"location":"src/telemetry/instrumentations.ts#2"}]},"tags":["framework","web"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-http","version":"0.219.0","description":"OpenTelemetry instrumentation for `node:http` and `node:https` http client and server modules","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-http@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation-http"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation-http@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-http,HttpInstrumentation,@opentelemetry/instrumentation-http/HttpInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#3"},{"location":"tmp/dist/telemetry/instrumentations.js#3"},{"location":"src/telemetry/instrumentations.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation","version":"0.219.0","description":"Base class for node which OpenTelemetry instrumentation modules extend","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation,registerInstrumentations,@opentelemetry/instrumentation/registerInstrumentations,Instrumentation,@opentelemetry/instrumentation/Instrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#8"},{"location":"tmp/dist/telemetry/telemetry-manager.js#8"},{"location":"src/telemetry/instrumentations.ts#1"},{"location":"src/telemetry/telemetry-manager.ts#8"},{"location":"src/telemetry/telemetry-provider.ts#4"},{"location":"src/telemetry/types.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"resources","version":"2.8.0","description":"OpenTelemetry SDK resources","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/resources@2.8.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/resources@2.8.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"},{"name":"ImportedModules","value":"@opentelemetry/resources,detectResources,@opentelemetry/resources/detectResources,envDetector,@opentelemetry/resources/envDetector,hostDetector,@opentelemetry/resources/hostDetector,processDetector,@opentelemetry/resources/processDetector,resourceFromAttributes,@opentelemetry/resources/resourceFromAttributes,Resource,@opentelemetry/resources/Resource"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#9"},{"location":"tmp/dist/telemetry/telemetry-manager.js#9"},{"location":"src/telemetry/telemetry-manager.ts#16"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-logs","version":"0.219.0","description":"OpenTelemetry logs SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-logs@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/sdk-logs"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-logs@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-logs,BatchLogRecordProcessor,@opentelemetry/sdk-logs/BatchLogRecordProcessor"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#10"},{"location":"tmp/dist/telemetry/telemetry-manager.js#10"},{"location":"src/telemetry/telemetry-manager.ts#17"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-metrics","version":"2.8.0","description":"OpenTelemetry metrics SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-metrics@2.8.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-metrics"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-metrics@2.8.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-metrics,PeriodicExportingMetricReader,@opentelemetry/sdk-metrics/PeriodicExportingMetricReader"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#11"},{"location":"tmp/dist/telemetry/telemetry-manager.js#11"},{"location":"src/telemetry/telemetry-manager.ts#18"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-node","version":"0.219.0","description":"OpenTelemetry SDK for Node.js","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-node@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-node@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-node,NodeSDK,@opentelemetry/sdk-node/NodeSDK"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#12"},{"location":"tmp/dist/telemetry/telemetry-manager.js#12"},{"location":"src/telemetry/telemetry-manager.ts#19"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-trace-base","version":"2.8.0","description":"OpenTelemetry Tracing","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-trace-base@2.8.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-trace-base@2.8.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-trace-base,SamplingDecision,@opentelemetry/sdk-trace-base/SamplingDecision,Sampler,@opentelemetry/sdk-trace-base/Sampler,SamplingResult,@opentelemetry/sdk-trace-base/SamplingResult"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"occurrences":[{"location":"dist/telemetry/trace-sampler.js#2"},{"location":"tmp/dist/telemetry/trace-sampler.js#2"},{"location":"src/telemetry/trace-sampler.ts#2"},{"location":"src/telemetry/trace-sampler.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"semantic-conventions","version":"1.38.0","description":"OpenTelemetry semantic conventions","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/semantic-conventions@1.38.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/semantic-conventions"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/semantic-conventions@1.38.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"},{"name":"ImportedModules","value":"@opentelemetry/semantic-conventions,ATTR_SERVICE_NAME,@opentelemetry/semantic-conventions/ATTR_SERVICE_NAME,ATTR_SERVICE_VERSION,@opentelemetry/semantic-conventions/ATTR_SERVICE_VERSION"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#13"},{"location":"tmp/dist/telemetry/telemetry-manager.js#13"},{"location":"src/telemetry/telemetry-manager.ts#23"}]}},{"authors":[{"name":"Apache Software Foundation"}],"group":"","name":"apache-arrow","version":"21.1.0","description":"Apache Arrow columnar in-memory format","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/apache-arrow@21.1.0","externalReferences":[{"type":"website","url":"https://arrow.apache.org/js/"},{"type":"vcs","url":"git+https://github.com/apache/arrow-js.git"}],"type":"library","bom-ref":"pkg:npm/apache-arrow@21.1.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/apache-arrow/package.json"},{"name":"ImportedModules","value":"apache-arrow,Binary,apache-arrow/Binary,Bool,apache-arrow/Bool,DateDay,apache-arrow/DateDay,Decimal,apache-arrow/Decimal,DurationMicrosecond,apache-arrow/DurationMicrosecond,Field,apache-arrow/Field,Float32,apache-arrow/Float32,Float64,apache-arrow/Float64,Int16,apache-arrow/Int16,Int32,apache-arrow/Int32,Int64,apache-arrow/Int64,Int8,apache-arrow/Int8,IntervalYearMonth,apache-arrow/IntervalYearMonth,List,apache-arrow/List,Map_,apache-arrow/Map_,Null,apache-arrow/Null,Schema,apache-arrow/Schema,Struct,apache-arrow/Struct,Table,apache-arrow/Table,TimestampMicrosecond,apache-arrow/TimestampMicrosecond,Utf8,apache-arrow/Utf8,tableToIPC,apache-arrow/tableToIPC,Type,apache-arrow/Type,tableFromIPC,apache-arrow/tableFromIPC,DataType,apache-arrow/DataType"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/apache-arrow/package.json"}],"concludedValue":"packages/appkit/node_modules/apache-arrow/package.json"}],"occurrences":[{"location":"dist/connectors/sql-warehouse/arrow-schema.js#1"},{"location":"dist/plugins/analytics/result-delivery.js#4"},{"location":"dist/type-generator/query-registry.js#13"},{"location":"tmp/dist/connectors/sql-warehouse/arrow-schema.js#1"},{"location":"tmp/dist/plugins/analytics/result-delivery.js#4"},{"location":"tmp/dist/type-generator/query-registry.js#13"},{"location":"src/connectors/sql-warehouse/arrow-schema.ts#25"},{"location":"src/plugins/analytics/result-delivery.ts#1"},{"location":"src/type-generator/query-registry.ts#4"}]}},{"group":"","name":"dotenv","version":"16.6.1","description":"Loads environment variables from .env file","scope":"required","licenses":[{"license":{"id":"BSD-2-Clause","url":"https://opensource.org/licenses/BSD-2-Clause"}}],"purl":"pkg:npm/dotenv@16.6.1","externalReferences":[{"type":"vcs","url":"https://github.com/motdotla/dotenv#readme"},{"type":"vcs","url":"git://github.com/motdotla/dotenv.git"}],"type":"library","bom-ref":"pkg:npm/dotenv@16.6.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/dotenv/package.json"},{"name":"ImportedModules","value":"dotenv,dotenv/config"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/dotenv/package.json"}],"concludedValue":"packages/appkit/node_modules/dotenv/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#23"},{"location":"dist/type-generator/index.js#21"},{"location":"tmp/dist/cli/commands/doctor/index.js#6"},{"location":"tmp/dist/cli/commands/registry/env-reconcile.js#2"},{"location":"tmp/dist/cli/index.js#11"},{"location":"tmp/dist/plugins/server/index.js#23"},{"location":"tmp/dist/type-generator/index.js#21"},{"location":"src/plugins/server/index.ts#5"},{"location":"src/type-generator/index.ts#5"},{"location":"tmp/dist/cli/index.js#11"}]}},{"authors":[{"name":"Drizzle Team"}],"group":"","name":"drizzle-orm","version":"0.45.2","description":"Drizzle ORM package for SQL databases","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/drizzle-orm@0.45.2","externalReferences":[{"type":"website","url":"https://orm.drizzle.team"},{"type":"vcs","url":"git+https://github.com/drizzle-team/drizzle-orm.git"}],"type":"library","bom-ref":"pkg:npm/drizzle-orm@0.45.2","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/drizzle-orm/package.json"},{"name":"ImportedModules","value":"drizzle-orm,drizzle-orm/and,drizzle-orm/eq,isSQLWrapper,drizzle-orm/isSQLWrapper,drizzle-orm/sql,drizzle-orm/node-postgres,drizzle,drizzle-orm/node-postgres/drizzle,drizzle-orm/asc,desc,drizzle-orm/desc,drizzle-orm/gt,drizzle-orm/gte,ilike,drizzle-orm/ilike,inArray,drizzle-orm/inArray,isNull,drizzle-orm/isNull,like,drizzle-orm/like,drizzle-orm/lt,drizzle-orm/lte,drizzle-orm/ne,drizzle-orm/or,relations,drizzle-orm/relations,drizzle-orm/pg-core,bigint,drizzle-orm/pg-core/bigint,boolean,drizzle-orm/pg-core/boolean,integer,drizzle-orm/pg-core/integer,jsonb,drizzle-orm/pg-core/jsonb,pgEnum,drizzle-orm/pg-core/pgEnum,pgSchema,drizzle-orm/pg-core/pgSchema,pgTable,drizzle-orm/pg-core/pgTable,text,drizzle-orm/pg-core/text,timestamp,drizzle-orm/pg-core/timestamp,uuid,drizzle-orm/pg-core/uuid,varchar,drizzle-orm/pg-core/varchar,drizzle-orm/SQL,NodePgDatabase,drizzle-orm/node-postgres/NodePgDatabase,PgTable,drizzle-orm/pg-core/PgTable,AnyPgColumn,drizzle-orm/pg-core/AnyPgColumn,Relation,drizzle-orm/Relation,PgColumnBuilderBase,drizzle-orm/pg-core/PgColumnBuilderBase,PgEnum,drizzle-orm/pg-core/PgEnum"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/drizzle-orm/package.json"}],"concludedValue":"packages/appkit/node_modules/drizzle-orm/package.json"}],"occurrences":[{"location":"dist/database/runtime/engine/drizzle-data-path.js#7"},{"location":"dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"dist/database/runtime/engine/translate.js#7"},{"location":"dist/database/schema-builder/engine/relations.js#2"},{"location":"dist/database/schema-builder/engine/tables.js#2"},{"location":"tmp/dist/database/runtime/engine/drizzle-data-path.js#7"},{"location":"tmp/dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"tmp/dist/database/runtime/engine/translate.js#7"},{"location":"tmp/dist/database/schema-builder/engine/relations.js#2"},{"location":"tmp/dist/database/schema-builder/engine/tables.js#2"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#1"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#2"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#3"},{"location":"src/database/runtime/engine/translate.ts#18"},{"location":"src/database/runtime/engine/translate.ts#19"},{"location":"src/database/schema-builder/engine/relations.ts#1"},{"location":"src/database/schema-builder/engine/relations.ts#2"},{"location":"src/database/schema-builder/engine/tables.ts#16"},{"location":"dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"tmp/dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#2"},{"location":"dist/database/schema-builder/engine/tables.js#2"},{"location":"tmp/dist/database/schema-builder/engine/tables.js#2"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#3"},{"location":"src/database/runtime/engine/translate.ts#19"},{"location":"src/database/schema-builder/engine/relations.ts#2"},{"location":"src/database/schema-builder/engine/tables.ts#16"}]},"tags":["orm","sql"]},{"authors":[{"name":"TJ Holowaychuk <tj@vision-media.ca>"}],"group":"","name":"express","version":"4.22.2","description":"Fast, unopinionated, minimalist web framework","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/express@4.22.2","externalReferences":[{"type":"website","url":"http://expressjs.com/"}],"type":"framework","bom-ref":"pkg:npm/express@4.22.2","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/express/package.json"},{"name":"ImportedModules","value":"express,NextFunction,express/NextFunction,Request,express/Request,Response,express/Response"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/express/package.json"}],"concludedValue":"packages/appkit/node_modules/express/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#24"},{"location":"dist/plugins/server/static-server.js#4"},{"location":"tmp/dist/plugins/server/index.js#24"},{"location":"tmp/dist/plugins/server/static-server.js#4"},{"location":"src/core/plugin-context.ts#1"},{"location":"src/logging/logger.ts#5"},{"location":"src/plugin/plugin.ts#2"},{"location":"src/plugins/agents/agents.ts#5"},{"location":"src/plugins/agents/tool-dispatch.ts#3"},{"location":"src/plugins/ai-search/ai-search.ts#3"},{"location":"src/plugins/analytics/analytics.ts#1"},{"location":"src/plugins/database/crud/routes.ts#1"},{"location":"src/plugins/database/database.ts#1"},{"location":"src/plugins/files/plugin.ts#4"},{"location":"src/plugins/genie/genie.ts#3"},{"location":"src/plugins/jobs/plugin.ts#3"},{"location":"src/plugins/server/base-server.ts#1"},{"location":"src/plugins/server/index.ts#6"},{"location":"src/plugins/server/remote-tunnel/gate.ts#1"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-controller.ts#3"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#7"},{"location":"src/plugins/server/static-server.ts#4"},{"location":"src/plugins/server/static-server.ts#5"},{"location":"src/plugins/server/vite-dev-server.ts#4"},{"location":"src/plugins/serving/serving.ts#5"},{"location":"src/testing/test-plugin-context.ts#1"},{"location":"src/utils/safe-handler.ts#1"}]},"tags":["framework","web"]},{"authors":[{"name":"Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)"}],"group":"","name":"get-port","version":"7.2.0","description":"Get an available port","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/get-port@7.2.0","type":"library","bom-ref":"pkg:npm/get-port@7.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/get-port/package.json"},{"name":"ImportedModules","value":"get-port,portNumbers,get-port/portNumbers"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/get-port/package.json"}],"concludedValue":"packages/appkit/node_modules/get-port/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#25"},{"location":"tmp/dist/plugins/server/index.js#25"},{"location":"src/plugins/server/index.ts#7"}]}},{"authors":[{"name":"Vladimir Zapparov <dervus.grim@gmail.com>"}],"group":"","name":"js-yaml","version":"4.3.1","description":"YAML 1.2 parser and serializer","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/js-yaml@4.3.1","type":"library","bom-ref":"pkg:npm/js-yaml@4.3.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/js-yaml/package.json"},{"name":"ImportedModules","value":"js-yaml"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/js-yaml/package.json"}],"concludedValue":"packages/appkit/node_modules/js-yaml/package.json"}],"occurrences":[{"location":"dist/core/agent/load-agents.js#7"},{"location":"dist/core/agent/skills/parse-skill.js#3"},{"location":"tmp/dist/cli/commands/doctor/bundle.js#5"},{"location":"tmp/dist/core/agent/load-agents.js#7"},{"location":"tmp/dist/core/agent/skills/parse-skill.js#3"},{"location":"src/core/agent/load-agents.ts#5"},{"location":"src/core/agent/skills/parse-skill.ts#1"}]}},{"authors":[{"name":"Rich Harris"}],"group":"","name":"magic-string","version":"0.30.21","description":"Modify strings, generate sourcemaps","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/magic-string@0.30.21","externalReferences":[{"type":"vcs","url":"git+https://github.com/Rich-Harris/magic-string.git"}],"type":"library","bom-ref":"pkg:npm/magic-string@0.30.21","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/magic-string/package.json"},{"name":"ImportedModules","value":"magic-string"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/magic-string/package.json"}],"concludedValue":"packages/appkit/node_modules/magic-string/package.json"}],"occurrences":[{"location":"dist/plugins/server/react-source-loc-vite-plugin.js#3"},{"location":"tmp/dist/plugins/server/react-source-loc-vite-plugin.js#3"},{"location":"src/plugins/server/react-source-loc-vite-plugin.ts#4"}]}},{"authors":[{"name":"Kevin Deng <sxzz@sxzz.moe>"}],"group":"","name":"obug","version":"2.1.1","description":"A lightweight JavaScript debugging utility, forked from debug, featuring TypeScript and ESM support.","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/obug@2.1.1","externalReferences":[{"type":"vcs","url":"https://github.com/sxzz/obug#readme"},{"type":"vcs","url":"git+https://github.com/sxzz/obug.git"}],"type":"library","bom-ref":"pkg:npm/obug@2.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/obug/package.json"},{"name":"ImportedModules","value":"obug,createDebug,obug/createDebug"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/obug/package.json"}],"concludedValue":"packages/appkit/node_modules/obug/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#7"},{"location":"tmp/dist/logging/logger.js#7"},{"location":"src/logging/logger.ts#6"}]}},{"authors":[{"name":"Brian Carlson <brian.m.carlson@gmail.com>"}],"group":"","name":"pg","version":"8.18.0","description":"PostgreSQL client - pure javascript & libpq with the same API","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/pg@8.18.0","externalReferences":[{"type":"vcs","url":"https://github.com/brianc/node-postgres"},{"type":"vcs","url":"git://github.com/brianc/node-postgres.git"}],"type":"library","bom-ref":"pkg:npm/pg@8.18.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/pg/package.json"},{"name":"ImportedModules","value":"pg,Pool,pg/Pool,PoolClient,pg/PoolClient,QueryResult,pg/QueryResult,QueryResultRow,pg/QueryResultRow"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/pg/package.json"}],"concludedValue":"packages/appkit/node_modules/pg/package.json"}],"occurrences":[{"location":"src/cache/storage/persistent.ts#3"},{"location":"src/connectors/lakebase/index.ts#5"},{"location":"src/connectors/lakebase/pool-manager.ts#2"},{"location":"src/connectors/lakebase/routing-pool.ts#1"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#4"},{"location":"src/plugins/lakebase/lakebase.ts#1"}]}},{"authors":[{"name":"Alexey Raspopov"}],"group":"","name":"picocolors","version":"1.1.1","description":"The tiniest and the fastest library for terminal output formatting with ANSI colors","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/picocolors@1.1.1","type":"library","bom-ref":"pkg:npm/picocolors@1.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/picocolors/package.json"},{"name":"ImportedModules","value":"picocolors"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/picocolors/package.json"}],"concludedValue":"packages/appkit/node_modules/picocolors/package.json"}],"occurrences":[{"location":"dist/errors/configuration.js#2"},{"location":"dist/plugins/agents/agents.js#40"},{"location":"dist/plugins/server/client-config-sanitizer.js#2"},{"location":"dist/plugins/server/utils.js#2"},{"location":"dist/type-generator/index.js#17"},{"location":"dist/type-generator/migration.js#2"},{"location":"dist/type-generator/query-registry.js#10"},{"location":"dist/type-generator/serving/generator.js#8"},{"location":"tmp/dist/cli/commands/doctor/report.js#2"},{"location":"tmp/dist/cli/commands/registry/add.js#11"},{"location":"tmp/dist/cli/commands/registry/config-writer.js#5"},{"location":"tmp/dist/cli/commands/registry/env-writer.js#5"},{"location":"tmp/dist/cli/commands/registry/info.js#6"},{"location":"tmp/dist/cli/commands/registry/list.js#5"},{"location":"tmp/dist/cli/commands/registry/requirements.js#3"},{"location":"tmp/dist/errors/configuration.js#2"},{"location":"tmp/dist/plugins/agents/agents.js#40"},{"location":"tmp/dist/plugins/server/client-config-sanitizer.js#2"},{"location":"tmp/dist/plugins/server/utils.js#2"},{"location":"tmp/dist/type-generator/index.js#17"},{"location":"tmp/dist/type-generator/migration.js#2"},{"location":"tmp/dist/type-generator/query-registry.js#10"},{"location":"tmp/dist/type-generator/serving/generator.js#8"},{"location":"src/errors/configuration.ts#1"},{"location":"src/plugins/agents/agents.ts#6"},{"location":"src/plugins/server/client-config-sanitizer.ts#1"},{"location":"src/plugins/server/utils.ts#6"},{"location":"src/type-generator/index.ts#6"},{"location":"src/type-generator/migration.ts#5"},{"location":"src/type-generator/query-registry.ts#5"},{"location":"src/type-generator/serving/generator.ts#4"}]}},{"authors":[{"name":"GitHub Inc."}],"group":"","name":"semver","version":"7.7.3","description":"The semantic version parser used by npm.","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/semver@7.7.3","externalReferences":[{"type":"vcs","url":"git+https://github.com/npm/node-semver.git"}],"type":"library","bom-ref":"pkg:npm/semver@7.7.3","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/semver/package.json"},{"name":"ImportedModules","value":"semver,coerce,semver/coerce"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/semver/package.json"}],"concludedValue":"packages/appkit/node_modules/semver/package.json"}],"occurrences":[{"location":"dist/context/client-options.js#2"},{"location":"tmp/dist/context/client-options.js#2"},{"location":"src/context/client-options.ts#1"}]}},{"group":"","name":"shared","version":"0.0.1","scope":"required","purl":"pkg:npm/shared@0.0.1","type":"library","bom-ref":"pkg:npm/shared@0.0.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/shared/package.json"},{"name":"ExportedModules","value":"shared,shared/workspace-client,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,Message,shared/Message,Thread,shared/Thread,ThreadStore,shared/ThreadStore,ToolAnnotations,shared/ToolAnnotations,ToolProvider,shared/ToolProvider,GenieAttachmentResponse,shared/GenieAttachmentResponse,GenieMessageResponse,shared/GenieMessageResponse,GenieStatementResponse,shared/GenieStatementResponse,GenieStreamEvent,shared/GenieStreamEvent,BasePluginConfig,shared/BasePluginConfig,CacheConfig,shared/CacheConfig,IAppRouter,shared/IAppRouter,PluginData,shared/PluginData,StreamExecutionSettings,shared/StreamExecutionSettings,isSQLTypeMarker,shared/isSQLTypeMarker,shared/sql,MetricFilter,shared/MetricFilter,MetricFilterOperatorName,shared/MetricFilterOperatorName,MetricOrderBy,shared/MetricOrderBy,MetricPredicate,shared/MetricPredicate,ApiError,shared/ApiError,ConfigError,shared/ConfigError,Context,shared/Context,createWorkspaceClient,shared/createWorkspaceClient,Time,shared/Time,TimeUnits,shared/TimeUnits,CancellationToken,shared/workspace-client/CancellationToken,ClientOptions,shared/workspace-client/ClientOptions,files,shared/workspace-client/files,GenieMessage,shared/workspace-client/GenieMessage,jobs,shared/workspace-client/jobs,serving,shared/workspace-client/serving,shared/workspace-client/sql,Waiter,shared/workspace-client/Waiter,WorkspaceClient,shared/workspace-client/WorkspaceClient,WorkspaceClientOptions,shared/workspace-client/WorkspaceClientOptions"},{"name":"ImportedModules","value":"shared,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,Message,shared/Message,ResponseStreamEvent,shared/ResponseStreamEvent,CacheConfig,shared/CacheConfig,CacheEntry,shared/CacheEntry,CacheStorage,shared/CacheStorage,TelemetryOptions,shared/TelemetryOptions,GenieMessageResponse,shared/GenieMessageResponse,PluginConstructor,shared/PluginConstructor,PluginData,shared/PluginData,ToolProvider,shared/ToolProvider,ToolAnnotations,shared/ToolAnnotations,BasePluginConfig,shared/BasePluginConfig,ThreadStore,shared/ThreadStore,BasePlugin,shared/BasePlugin,InputPluginMap,shared/InputPluginMap,OptionalConfigPluginDef,shared/OptionalConfigPluginDef,PluginMap,shared/PluginMap,IAppRequest,shared/IAppRequest,TunnelConnection,shared/TunnelConnection,RetryConfig,shared/RetryConfig,TelemetryConfig,shared/TelemetryConfig,IAppResponse,shared/IAppResponse,PluginEndpointMap,shared/PluginEndpointMap,PluginExecuteConfig,shared/PluginExecuteConfig,PluginExecutionSettings,shared/PluginExecutionSettings,PluginPhase,shared/PluginPhase,RouteConfig,shared/RouteConfig,StreamExecuteHandler,shared/StreamExecuteHandler,StreamExecutionSettings,shared/StreamExecutionSettings,camelToKebab,shared/camelToKebab,ToPlugin,shared/ToPlugin,IAppRouter,shared/IAppRouter,ResponseOutputMessage,shared/ResponseOutputMessage,Thread,shared/Thread,ResponseFunctionCallOutput,shared/ResponseFunctionCallOutput,ResponseFunctionToolCall,shared/ResponseFunctionToolCall,AnalyticsSseMessage,shared/AnalyticsSseMessage,makeResultMessage,shared/makeResultMessage,SQLTypeMarker,shared/SQLTypeMarker,MetricFilterOperatorName,shared/MetricFilterOperatorName,MetricOrderDirection,shared/MetricOrderDirection,shared/sql,MetricViewColumnDisplay,shared/MetricViewColumnDisplay,MetricViewsMetadata,shared/MetricViewsMetadata,isSQLTypeMarker,shared/isSQLTypeMarker,MetricFilter,shared/MetricFilter,MetricOrderBy,shared/MetricOrderBy,PluginClientConfigs,shared/PluginClientConfigs,PluginEndpoints,shared/PluginEndpoints,pluginManifestSchema,shared/pluginManifestSchema,ResourceFieldEntry,shared/ResourceFieldEntry,PluginManifest,shared/PluginManifest,StreamConfig,shared/StreamConfig,shared/workspace-client"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/shared/package.json"}],"concludedValue":"packages/appkit/node_modules/shared/package.json"}],"occurrences":[{"location":"src/agents/databricks.ts#7"},{"location":"src/agents/supervisor-api.ts#8"},{"location":"src/beta.ts#20"},{"location":"src/cache/defaults.ts#1"},{"location":"src/cache/index.ts#3"},{"location":"src/cache/storage/memory.ts#1"},{"location":"src/cache/storage/persistent.ts#4"},{"location":"src/connectors/ai-search/types.ts#1"},{"location":"src/connectors/files/client.ts#3"},{"location":"src/connectors/genie/types.ts#3"},{"location":"src/connectors/genie/types.ts#10"},{"location":"src/connectors/jobs/types.ts#1"},{"location":"src/connectors/mcp/client.ts#25"},{"location":"src/connectors/sql-warehouse/client.ts#1"},{"location":"src/core/agent/build-toolkit.ts#1"},{"location":"src/core/agent/consume-adapter-stream.ts#1"},{"location":"src/core/agent/load-agents.ts#6"},{"location":"src/core/agent/run-agent.ts#11"},{"location":"src/core/agent/toolkit-resolver.ts#1"},{"location":"src/core/agent/tools/define-tool.ts#1"},{"location":"src/core/agent/tools/function-tool.ts#1"},{"location":"src/core/agent/tools/tool.ts#1"},{"location":"src/core/agent/types.ts#7"},{"location":"src/core/appkit.ts#9"},{"location":"src/core/lifecycle-manager.ts#1"},{"location":"src/core/plugin-context.ts#2"},{"location":"src/index.ts#15"},{"location":"src/index.ts#16"},{"location":"src/plugin/dev-reader.ts#3"},{"location":"src/plugin/index.ts#1"},{"location":"src/plugin/interceptors/cache.ts#1"},{"location":"src/plugin/interceptors/retry.ts#1"},{"location":"src/plugin/interceptors/telemetry.ts#1"},{"location":"src/plugin/plugin.ts#14"},{"location":"src/plugin/plugin.ts#15"},{"location":"src/plugin/to-plugin.ts#1"},{"location":"src/plugins/agents/adapter-extensions.ts#1"},{"location":"src/plugins/agents/agents.ts#17"},{"location":"src/plugins/agents/approval.ts#1"},{"location":"src/plugins/agents/builtin-tools.ts#1"},{"location":"src/plugins/agents/defaults.ts#1"},{"location":"src/plugins/agents/event-translator.ts#9"},{"location":"src/plugins/agents/thread-store.ts#3"},{"location":"src/plugins/agents/tool-dispatch.ts#4"},{"location":"src/plugins/ai-search/ai-search.ts#4"},{"location":"src/plugins/ai-search/defaults.ts#1"},{"location":"src/plugins/ai-search/types.ts#1"},{"location":"src/plugins/analytics/analytics.ts#11"},{"location":"src/plugins/analytics/defaults.ts#1"},{"location":"src/plugins/analytics/mv/constants.ts#1"},{"location":"src/plugins/analytics/mv/formatters.ts#1"},{"location":"src/plugins/analytics/mv/metadata.ts#1"},{"location":"src/plugins/analytics/query.ts#3"},{"location":"src/plugins/analytics/result-delivery.ts#2"},{"location":"src/plugins/analytics/types.ts#7"},{"location":"src/plugins/analytics/types.ts#14"},{"location":"src/plugins/database/database.ts#2"},{"location":"src/plugins/database/defaults.ts#1"},{"location":"src/plugins/database/entity-client.ts#1"},{"location":"src/plugins/files/defaults.ts#1"},{"location":"src/plugins/files/plugin.ts#10"},{"location":"src/plugins/files/types.ts#1"},{"location":"src/plugins/genie/defaults.ts#1"},{"location":"src/plugins/genie/genie.ts#9"},{"location":"src/plugins/genie/types.ts#1"},{"location":"src/plugins/genie/types.ts#4"},{"location":"src/plugins/jobs/defaults.ts#1"},{"location":"src/plugins/jobs/plugin.ts#8"},{"location":"src/plugins/jobs/types.ts#1"},{"location":"src/plugins/lakebase/lakebase.ts#2"},{"location":"src/plugins/lakebase/types.ts#1"},{"location":"src/plugins/server/index.ts#8"},{"location":"src/plugins/server/index.ts#9"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#8"},{"location":"src/plugins/server/types.ts#1"},{"location":"src/plugins/server/utils.ts#7"},{"location":"src/plugins/serving/serving.ts#6"},{"location":"src/plugins/serving/types.ts#1"},{"location":"src/plugins/ui-variants/index.ts#1"},{"location":"src/registry/manifest-loader.ts#1"},{"location":"src/registry/resource-registry.ts#13"},{"location":"src/registry/types.ts#33"},{"location":"src/registry/types.ts#39"},{"location":"src/stream/sse-writer.ts#1"},{"location":"src/stream/stream-manager.ts#4"},{"location":"src/stream/types.ts#2"},{"location":"src/telemetry/telemetry-manager.ts#24"},{"location":"src/telemetry/telemetry-provider.ts#5"},{"location":"src/testing/fixtures.ts#2"},{"location":"src/testing/test-plugin-context.ts#7"},{"location":"src/workspace-client/index.ts#15"},{"location":"src/workspace-client/index.ts#27"},{"location":"src/workspace-client/index.ts#27"}]},"tags":["sql"]},{"authors":[{"name":"Anthony Fu <anthonyfu117@hotmail.com>"}],"group":"","name":"vitest","version":"3.2.4","description":"Next generation testing framework powered by Vite","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/vitest@3.2.4","externalReferences":[{"type":"vcs","url":"https://github.com/vitest-dev/vitest#readme"},{"type":"vcs","url":"git+https://github.com/vitest-dev/vitest.git"}],"type":"framework","bom-ref":"pkg:npm/vitest@3.2.4","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/vitest/package.json"},{"name":"ImportedModules","value":"vitest,afterEach,vitest/afterEach,beforeEach,vitest/beforeEach,vitest/vi"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/vitest/package.json"}],"concludedValue":"packages/appkit/node_modules/vitest/package.json"}],"occurrences":[{"location":"dist/testing/fixtures.js#3"},{"location":"tmp/dist/testing/fixtures.js#3"},{"location":"src/testing/fixtures.ts#3"}]},"tags":["framework"]},{"authors":[{"name":"Einar Otto Stangvik <einaros@gmail.com> (http://2x.io)"}],"group":"","name":"ws","version":"8.21.0","description":"Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/ws@8.21.0","externalReferences":[{"type":"vcs","url":"https://github.com/websockets/ws"},{"type":"vcs","url":"git+https://github.com/websockets/ws.git"}],"type":"library","bom-ref":"pkg:npm/ws@8.21.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/ws/package.json"},{"name":"ImportedModules","value":"ws,WebSocketServer,ws/WebSocketServer"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/ws/package.json"}],"concludedValue":"packages/appkit/node_modules/ws/package.json"}],"occurrences":[{"location":"dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"tmp/dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#9"}]}},{"authors":[{"name":"Colin McDonnell <zod@colinhacks.com>"}],"group":"","name":"zod","version":"4.3.6","description":"TypeScript-first schema declaration and validation library with static type inference","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/zod@4.3.6","externalReferences":[{"type":"website","url":"https://zod.dev"},{"type":"vcs","url":"git+https://github.com/colinhacks/zod.git"}],"type":"library","bom-ref":"pkg:npm/zod@4.3.6","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/zod/package.json"},{"name":"ImportedModules","value":"zod,toJSONSchema,zod/toJSONSchema,zod/z,ZodType,zod/ZodType"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/zod/package.json"}],"concludedValue":"packages/appkit/node_modules/zod/package.json"}],"occurrences":[{"location":"dist/core/agent/tools/json-schema.js#1"},{"location":"dist/database/schema-builder/validators.js#1"},{"location":"dist/plugins/agents/schemas.js#1"},{"location":"dist/plugins/analytics/analytics.js#30"},{"location":"dist/plugins/analytics/mv/schemas.js#6"},{"location":"dist/plugins/files/plugin.js#24"},{"location":"dist/plugins/genie/genie.js#16"},{"location":"dist/plugins/jobs/plugin.js#18"},{"location":"dist/plugins/lakebase/lakebase.js#17"},{"location":"dist/shared/src/schemas/manifest.js#2"},{"location":"dist/shared/src/schemas/metric-metadata-bundle.js#2"},{"location":"dist/shared/src/schemas/metric-source.js#2"},{"location":"dist/shared/src/sse/analytics.js#1"},{"location":"tmp/dist/core/agent/tools/json-schema.js#1"},{"location":"tmp/dist/database/schema-builder/validators.js#1"},{"location":"tmp/dist/plugins/agents/schemas.js#1"},{"location":"tmp/dist/plugins/analytics/analytics.js#30"},{"location":"tmp/dist/plugins/analytics/mv/schemas.js#6"},{"location":"tmp/dist/plugins/files/plugin.js#24"},{"location":"tmp/dist/plugins/genie/genie.js#16"},{"location":"tmp/dist/plugins/jobs/plugin.js#18"},{"location":"tmp/dist/plugins/lakebase/lakebase.js#17"},{"location":"tmp/dist/schemas/manifest.js#2"},{"location":"tmp/dist/shared/src/schemas/manifest.js#2"},{"location":"tmp/dist/shared/src/schemas/metric-metadata-bundle.js#2"},{"location":"tmp/dist/shared/src/schemas/metric-source.js#2"},{"location":"tmp/dist/shared/src/sse/analytics.js#1"},{"location":"src/core/agent/tools/define-tool.ts#2"},{"location":"src/core/agent/tools/json-schema.ts#1"},{"location":"src/core/agent/tools/tool.ts#2"},{"location":"src/database/schema-builder/validators.ts#1"},{"location":"src/database/schema-builder/validators.ts#2"},{"location":"src/plugins/agents/schemas.ts#1"},{"location":"src/plugins/analytics/analytics.ts#12"},{"location":"src/plugins/analytics/mv/schemas.ts#1"},{"location":"src/plugins/files/plugin.ts#11"},{"location":"src/plugins/genie/genie.ts#10"},{"location":"src/plugins/jobs/plugin.ts#9"},{"location":"src/plugins/jobs/types.ts#2"},{"location":"src/plugins/lakebase/lakebase.ts#3"}]},"tags":["validation"]}],"dependencies":[],"compositions":[{"bom-ref":"pkg:npm/@databricks/appkit@0.69.1","aggregate":"incomplete"}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/@databricks/appkit@0.69.1"],"annotator":{"component":{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-09-01T10:40:58Z","text":"This Software Bill-of-Materials (SBOM) document was created on Tuesday, September 1, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'appkit' with version '0.69.1'. There are 32 components. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 32 source files."}]}
+{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:f763f574-cbe8-4dd9-8e4c-fbf291c18c8f","version":1,"metadata":{"timestamp":"2026-09-02T13:05:12Z","tools":{"components":[{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"appkit","group":"@databricks","version":"0.69.2","purl":"pkg:npm/%40databricks/appkit@0.69.2","bom-ref":"pkg:npm/@databricks/appkit@0.69.2","type":"application","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}]},"properties":[{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"cdx:bom:componentNamespaces","value":"@ast-grep\\n@databricks\\n@opentelemetry"},{"name":"cdx:bom:componentSrcFiles","value":"packages/appkit/node_modules/@ast-grep/napi/package.json\\npackages/appkit/node_modules/@databricks/lakebase/package.json\\npackages/appkit/node_modules/@opentelemetry/api-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/api/package.json\\npackages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json\\npackages/appkit/node_modules/@opentelemetry/instrumentation/package.json\\npackages/appkit/node_modules/@opentelemetry/resources/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-logs/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-node/package.json\\npackages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json\\npackages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json\\npackages/appkit/node_modules/apache-arrow/package.json\\npackages/appkit/node_modules/dotenv/package.json\\npackages/appkit/node_modules/drizzle-orm/package.json\\npackages/appkit/node_modules/express/package.json\\npackages/appkit/node_modules/get-port/package.json\\npackages/appkit/node_modules/js-yaml/package.json\\npackages/appkit/node_modules/magic-string/package.json\\npackages/appkit/node_modules/obug/package.json\\npackages/appkit/node_modules/pg/package.json\\npackages/appkit/node_modules/picocolors/package.json\\npackages/appkit/node_modules/semver/package.json\\npackages/appkit/node_modules/shared/package.json\\npackages/appkit/node_modules/vitest/package.json\\npackages/appkit/node_modules/ws/package.json\\npackages/appkit/node_modules/zod/package.json"}]},"components":[{"group":"@ast-grep","name":"napi","version":"0.37.0","description":"Search and Rewrite code at large scale using precise AST pattern","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/%40ast-grep/napi@0.37.0","externalReferences":[{"type":"vcs","url":"https://ast-grep.github.io"}],"type":"library","bom-ref":"pkg:npm/@ast-grep/napi@0.37.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@ast-grep/napi/package.json"},{"name":"ImportedModules","value":"@ast-grep/napi,Lang,@ast-grep/napi/Lang,parse,@ast-grep/napi/parse,SgNode,@ast-grep/napi/SgNode"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"concludedValue":"packages/appkit/node_modules/@ast-grep/napi/package.json"}],"occurrences":[{"location":"dist/plugins/server/react-source-loc-vite-plugin.js#2"},{"location":"dist/type-generator/serving/server-file-extractor.js#4"},{"location":"tmp/dist/cli/commands/codemod/on-plugins-ready.js#4"},{"location":"tmp/dist/cli/commands/lint.js#4"},{"location":"tmp/dist/cli/commands/plugin/sync/sync.js#8"},{"location":"tmp/dist/cli/commands/registry/server-register.js#4"},{"location":"tmp/dist/plugins/server/react-source-loc-vite-plugin.js#2"},{"location":"tmp/dist/type-generator/serving/server-file-extractor.js#4"},{"location":"src/plugins/server/react-source-loc-vite-plugin.ts#3"},{"location":"src/type-generator/serving/server-file-extractor.ts#4"}]}},{"group":"@databricks","name":"lakebase","version":"0.5.0","description":"PostgreSQL driver for Databricks Lakebase Autoscaling with automatic OAuth token refresh","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40databricks/lakebase@0.5.0","externalReferences":[{"type":"vcs","url":"git+https://github.com/databricks/appkit.git"}],"type":"library","bom-ref":"pkg:npm/@databricks/lakebase@0.5.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@databricks/lakebase/package.json"},{"name":"ExportedModules","value":"@databricks/lakebase,DatabaseCredential,@databricks/lakebase/DatabaseCredential,GenerateDatabaseCredentialRequest,@databricks/lakebase/GenerateDatabaseCredentialRequest,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig,RequestedClaims,@databricks/lakebase/RequestedClaims,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,RequestedResource,@databricks/lakebase/RequestedResource"},{"name":"ImportedModules","value":"@databricks/lakebase,RequestedClaimsPermissionSet,@databricks/lakebase/RequestedClaimsPermissionSet,createLakebasePool,@databricks/lakebase/createLakebasePool,generateDatabaseCredential,@databricks/lakebase/generateDatabaseCredential,getLakebaseOrmConfig,@databricks/lakebase/getLakebaseOrmConfig,getLakebasePgConfig,@databricks/lakebase/getLakebasePgConfig,getUsernameWithApiLookup,@databricks/lakebase/getUsernameWithApiLookup,getWorkspaceClient,@databricks/lakebase/getWorkspaceClient,LakebasePoolConfig,@databricks/lakebase/LakebasePoolConfig"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"concludedValue":"packages/appkit/node_modules/@databricks/lakebase/package.json"}],"occurrences":[{"location":"dist/connectors/lakebase/index.js#4"},{"location":"tmp/dist/connectors/lakebase/index.js#4"},{"location":"src/connectors/lakebase/index.ts#4"},{"location":"src/connectors/lakebase/index.ts#36"},{"location":"src/connectors/lakebase/pool-manager.ts#1"}]},"tags":["token"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api-logs","version":"0.219.0","description":"Public logs API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api-logs@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/api-logs"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api-logs@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api-logs"},{"name":"ImportedModules","value":"@opentelemetry/api-logs,SeverityNumber,@opentelemetry/api-logs/SeverityNumber,logs,@opentelemetry/api-logs/logs,createNoopLogger,@opentelemetry/api-logs/createNoopLogger,Logger,@opentelemetry/api-logs/Logger,LogRecord,@opentelemetry/api-logs/LogRecord"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api-logs/package.json"}],"occurrences":[{"location":"dist/logging/wide-event-emitter.js#1"},{"location":"dist/telemetry/index.js#6"},{"location":"dist/telemetry/noop.js#2"},{"location":"dist/telemetry/telemetry-provider.js#4"},{"location":"tmp/dist/logging/wide-event-emitter.js#1"},{"location":"tmp/dist/telemetry/index.js#6"},{"location":"tmp/dist/telemetry/noop.js#2"},{"location":"tmp/dist/telemetry/telemetry-provider.js#4"},{"location":"src/logging/wide-event-emitter.ts#1"},{"location":"src/telemetry/index.ts#3"},{"location":"src/telemetry/noop.ts#23"},{"location":"src/telemetry/telemetry-provider.ts#3"},{"location":"src/telemetry/types.ts#2"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"api","version":"1.9.0","description":"Public API for OpenTelemetry","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/api@1.9.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/api"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/api@1.9.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/api/package.json"},{"name":"ExportedModules","value":"@opentelemetry/api,@opentelemetry/api-logs,Counter,@opentelemetry/api/Counter,Histogram,@opentelemetry/api/Histogram,Span,@opentelemetry/api/Span,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode"},{"name":"ImportedModules","value":"@opentelemetry/api,trace,@opentelemetry/api/trace,context,@opentelemetry/api/context,createContextKey,@opentelemetry/api/createContextKey,SpanKind,@opentelemetry/api/SpanKind,SpanStatusCode,@opentelemetry/api/SpanStatusCode,INVALID_SPAN_CONTEXT,@opentelemetry/api/INVALID_SPAN_CONTEXT,createNoopMeter,@opentelemetry/api/createNoopMeter,metrics,@opentelemetry/api/metrics,Context,@opentelemetry/api/Context,Span,@opentelemetry/api/Span,SpanContext,@opentelemetry/api/SpanContext,SpanOptions,@opentelemetry/api/SpanOptions,Tracer,@opentelemetry/api/Tracer,Meter,@opentelemetry/api/Meter,Attributes,@opentelemetry/api/Attributes,Link,@opentelemetry/api/Link"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/api/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#6"},{"location":"dist/plugin/plugin.js#23"},{"location":"dist/stream/stream-manager.js#12"},{"location":"dist/telemetry/index.js#5"},{"location":"dist/telemetry/noop.js#1"},{"location":"dist/telemetry/telemetry-provider.js#3"},{"location":"tmp/dist/logging/logger.js#6"},{"location":"tmp/dist/plugin/plugin.js#23"},{"location":"tmp/dist/stream/stream-manager.js#12"},{"location":"tmp/dist/telemetry/index.js#5"},{"location":"tmp/dist/telemetry/noop.js#1"},{"location":"tmp/dist/telemetry/telemetry-provider.js#3"},{"location":"src/logging/logger.ts#4"},{"location":"src/plugin/plugin.ts#1"},{"location":"src/stream/stream-manager.ts#3"},{"location":"src/stream/types.ts#1"},{"location":"src/telemetry/index.ts#1"},{"location":"src/telemetry/index.ts#2"},{"location":"src/telemetry/noop.ts#17"},{"location":"src/telemetry/noop.ts#22"},{"location":"src/telemetry/telemetry-provider.ts#1"},{"location":"src/telemetry/telemetry-provider.ts#2"},{"location":"src/telemetry/trace-sampler.ts#1"},{"location":"src/telemetry/types.ts#1"},{"location":"src/testing/fixtures.ts#1"}]},"tags":["api"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"auto-instrumentations-node","version":"0.77.0","description":"Metapackage which bundles opentelemetry node core and contrib instrumentations","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/auto-instrumentations-node@0.77.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/auto-instrumentations-node#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/auto-instrumentations-node@0.77.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/auto-instrumentations-node,getNodeAutoInstrumentations,@opentelemetry/auto-instrumentations-node/getNodeAutoInstrumentations"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/auto-instrumentations-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#4"},{"location":"tmp/dist/telemetry/telemetry-manager.js#4"},{"location":"src/telemetry/telemetry-manager.ts#1"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-logs-otlp-proto","version":"0.219.0","description":"An OTLP exporter to send logs using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-logs-otlp-proto@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-logs-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-logs-otlp-proto@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-logs-otlp-proto,OTLPLogExporter,@opentelemetry/exporter-logs-otlp-proto/OTLPLogExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-logs-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#5"},{"location":"tmp/dist/telemetry/telemetry-manager.js#5"},{"location":"src/telemetry/telemetry-manager.ts#2"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-metrics-otlp-proto","version":"0.219.0","description":"OpenTelemetry Collector Metrics Exporter allows user to send collected metrics to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-metrics-otlp-proto@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-metrics-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-metrics-otlp-proto@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-metrics-otlp-proto,OTLPMetricExporter,@opentelemetry/exporter-metrics-otlp-proto/OTLPMetricExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-metrics-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#6"},{"location":"tmp/dist/telemetry/telemetry-manager.js#6"},{"location":"src/telemetry/telemetry-manager.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"exporter-trace-otlp-proto","version":"0.219.0","description":"OpenTelemetry Collector Exporter allows user to send collected traces to the OpenTelemetry Collector using protobuf over HTTP","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/exporter-trace-otlp-proto@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-trace-otlp-proto"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/exporter-trace-otlp-proto@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"},{"name":"ImportedModules","value":"@opentelemetry/exporter-trace-otlp-proto,OTLPTraceExporter,@opentelemetry/exporter-trace-otlp-proto/OTLPTraceExporter"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/exporter-trace-otlp-proto/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#7"},{"location":"tmp/dist/telemetry/telemetry-manager.js#7"},{"location":"src/telemetry/telemetry-manager.ts#4"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-express","version":"0.67.0","description":"OpenTelemetry instrumentation for `express` http web application framework","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-express@0.67.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-express#readme"},{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js-contrib.git"}],"type":"framework","bom-ref":"pkg:npm/@opentelemetry/instrumentation-express@0.67.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-express,ExpressInstrumentation,@opentelemetry/instrumentation-express/ExpressInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-express/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#2"},{"location":"tmp/dist/telemetry/instrumentations.js#2"},{"location":"src/telemetry/instrumentations.ts#2"}]},"tags":["framework","web"]},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation-http","version":"0.219.0","description":"OpenTelemetry instrumentation for `node:http` and `node:https` http client and server modules","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation-http@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation-http"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation-http@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation-http,HttpInstrumentation,@opentelemetry/instrumentation-http/HttpInstrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation-http/package.json"}],"occurrences":[{"location":"dist/telemetry/instrumentations.js#3"},{"location":"tmp/dist/telemetry/instrumentations.js#3"},{"location":"src/telemetry/instrumentations.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"instrumentation","version":"0.219.0","description":"Base class for node which OpenTelemetry instrumentation modules extend","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/instrumentation@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/instrumentation@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"},{"name":"ImportedModules","value":"@opentelemetry/instrumentation,registerInstrumentations,@opentelemetry/instrumentation/registerInstrumentations,Instrumentation,@opentelemetry/instrumentation/Instrumentation"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/instrumentation/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#8"},{"location":"tmp/dist/telemetry/telemetry-manager.js#8"},{"location":"src/telemetry/instrumentations.ts#1"},{"location":"src/telemetry/telemetry-manager.ts#8"},{"location":"src/telemetry/telemetry-provider.ts#4"},{"location":"src/telemetry/types.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"resources","version":"2.8.0","description":"OpenTelemetry SDK resources","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/resources@2.8.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/resources@2.8.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"},{"name":"ImportedModules","value":"@opentelemetry/resources,detectResources,@opentelemetry/resources/detectResources,envDetector,@opentelemetry/resources/envDetector,hostDetector,@opentelemetry/resources/hostDetector,processDetector,@opentelemetry/resources/processDetector,resourceFromAttributes,@opentelemetry/resources/resourceFromAttributes,Resource,@opentelemetry/resources/Resource"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/resources/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#9"},{"location":"tmp/dist/telemetry/telemetry-manager.js#9"},{"location":"src/telemetry/telemetry-manager.ts#16"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-logs","version":"0.219.0","description":"OpenTelemetry logs SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-logs@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/sdk-logs"},{"type":"vcs","url":"git+https://github.com/open-telemetry/opentelemetry-js.git"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-logs@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-logs,BatchLogRecordProcessor,@opentelemetry/sdk-logs/BatchLogRecordProcessor"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-logs/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#10"},{"location":"tmp/dist/telemetry/telemetry-manager.js#10"},{"location":"src/telemetry/telemetry-manager.ts#17"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-metrics","version":"2.8.0","description":"OpenTelemetry metrics SDK","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-metrics@2.8.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-metrics"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-metrics@2.8.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-metrics,PeriodicExportingMetricReader,@opentelemetry/sdk-metrics/PeriodicExportingMetricReader"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-metrics/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#11"},{"location":"tmp/dist/telemetry/telemetry-manager.js#11"},{"location":"src/telemetry/telemetry-manager.ts#18"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-node","version":"0.219.0","description":"OpenTelemetry SDK for Node.js","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-node@0.219.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-node@0.219.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-node,NodeSDK,@opentelemetry/sdk-node/NodeSDK"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-node/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#12"},{"location":"tmp/dist/telemetry/telemetry-manager.js#12"},{"location":"src/telemetry/telemetry-manager.ts#19"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"sdk-trace-base","version":"2.8.0","description":"OpenTelemetry Tracing","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/sdk-trace-base@2.8.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/sdk-trace-base@2.8.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"},{"name":"ImportedModules","value":"@opentelemetry/sdk-trace-base,SamplingDecision,@opentelemetry/sdk-trace-base/SamplingDecision,Sampler,@opentelemetry/sdk-trace-base/Sampler,SamplingResult,@opentelemetry/sdk-trace-base/SamplingResult"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/sdk-trace-base/package.json"}],"occurrences":[{"location":"dist/telemetry/trace-sampler.js#2"},{"location":"tmp/dist/telemetry/trace-sampler.js#2"},{"location":"src/telemetry/trace-sampler.ts#2"},{"location":"src/telemetry/trace-sampler.ts#3"}]}},{"authors":[{"name":"OpenTelemetry Authors"}],"group":"@opentelemetry","name":"semantic-conventions","version":"1.38.0","description":"OpenTelemetry semantic conventions","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/%40opentelemetry/semantic-conventions@1.38.0","externalReferences":[{"type":"vcs","url":"https://github.com/open-telemetry/opentelemetry-js/tree/main/semantic-conventions"}],"type":"library","bom-ref":"pkg:npm/@opentelemetry/semantic-conventions@1.38.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"},{"name":"ImportedModules","value":"@opentelemetry/semantic-conventions,ATTR_SERVICE_NAME,@opentelemetry/semantic-conventions/ATTR_SERVICE_NAME,ATTR_SERVICE_VERSION,@opentelemetry/semantic-conventions/ATTR_SERVICE_VERSION"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"concludedValue":"packages/appkit/node_modules/@opentelemetry/semantic-conventions/package.json"}],"occurrences":[{"location":"dist/telemetry/telemetry-manager.js#13"},{"location":"tmp/dist/telemetry/telemetry-manager.js#13"},{"location":"src/telemetry/telemetry-manager.ts#23"}]}},{"authors":[{"name":"Apache Software Foundation"}],"group":"","name":"apache-arrow","version":"21.1.0","description":"Apache Arrow columnar in-memory format","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/apache-arrow@21.1.0","externalReferences":[{"type":"website","url":"https://arrow.apache.org/js/"},{"type":"vcs","url":"git+https://github.com/apache/arrow-js.git"}],"type":"library","bom-ref":"pkg:npm/apache-arrow@21.1.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/apache-arrow/package.json"},{"name":"ImportedModules","value":"apache-arrow,Binary,apache-arrow/Binary,Bool,apache-arrow/Bool,DateDay,apache-arrow/DateDay,Decimal,apache-arrow/Decimal,DurationMicrosecond,apache-arrow/DurationMicrosecond,Field,apache-arrow/Field,Float32,apache-arrow/Float32,Float64,apache-arrow/Float64,Int16,apache-arrow/Int16,Int32,apache-arrow/Int32,Int64,apache-arrow/Int64,Int8,apache-arrow/Int8,IntervalYearMonth,apache-arrow/IntervalYearMonth,List,apache-arrow/List,Map_,apache-arrow/Map_,Null,apache-arrow/Null,Schema,apache-arrow/Schema,Struct,apache-arrow/Struct,Table,apache-arrow/Table,TimestampMicrosecond,apache-arrow/TimestampMicrosecond,Utf8,apache-arrow/Utf8,tableToIPC,apache-arrow/tableToIPC,Type,apache-arrow/Type,tableFromIPC,apache-arrow/tableFromIPC,DataType,apache-arrow/DataType"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/apache-arrow/package.json"}],"concludedValue":"packages/appkit/node_modules/apache-arrow/package.json"}],"occurrences":[{"location":"dist/connectors/sql-warehouse/arrow-schema.js#1"},{"location":"dist/plugins/analytics/result-delivery.js#4"},{"location":"dist/type-generator/query-registry.js#13"},{"location":"tmp/dist/connectors/sql-warehouse/arrow-schema.js#1"},{"location":"tmp/dist/plugins/analytics/result-delivery.js#4"},{"location":"tmp/dist/type-generator/query-registry.js#13"},{"location":"src/connectors/sql-warehouse/arrow-schema.ts#25"},{"location":"src/plugins/analytics/result-delivery.ts#1"},{"location":"src/type-generator/query-registry.ts#4"}]}},{"group":"","name":"dotenv","version":"16.6.1","description":"Loads environment variables from .env file","scope":"required","licenses":[{"license":{"id":"BSD-2-Clause","url":"https://opensource.org/licenses/BSD-2-Clause"}}],"purl":"pkg:npm/dotenv@16.6.1","externalReferences":[{"type":"vcs","url":"https://github.com/motdotla/dotenv#readme"},{"type":"vcs","url":"git://github.com/motdotla/dotenv.git"}],"type":"library","bom-ref":"pkg:npm/dotenv@16.6.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/dotenv/package.json"},{"name":"ImportedModules","value":"dotenv,dotenv/config"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/dotenv/package.json"}],"concludedValue":"packages/appkit/node_modules/dotenv/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#23"},{"location":"dist/type-generator/index.js#21"},{"location":"tmp/dist/cli/commands/doctor/index.js#6"},{"location":"tmp/dist/cli/commands/registry/env-reconcile.js#2"},{"location":"tmp/dist/cli/index.js#11"},{"location":"tmp/dist/plugins/server/index.js#23"},{"location":"tmp/dist/type-generator/index.js#21"},{"location":"src/plugins/server/index.ts#5"},{"location":"src/type-generator/index.ts#5"},{"location":"tmp/dist/cli/index.js#11"}]}},{"authors":[{"name":"Drizzle Team"}],"group":"","name":"drizzle-orm","version":"0.45.2","description":"Drizzle ORM package for SQL databases","scope":"required","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/drizzle-orm@0.45.2","externalReferences":[{"type":"website","url":"https://orm.drizzle.team"},{"type":"vcs","url":"git+https://github.com/drizzle-team/drizzle-orm.git"}],"type":"library","bom-ref":"pkg:npm/drizzle-orm@0.45.2","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/drizzle-orm/package.json"},{"name":"ImportedModules","value":"drizzle-orm,drizzle-orm/and,drizzle-orm/eq,isSQLWrapper,drizzle-orm/isSQLWrapper,drizzle-orm/sql,drizzle-orm/node-postgres,drizzle,drizzle-orm/node-postgres/drizzle,drizzle-orm/asc,desc,drizzle-orm/desc,drizzle-orm/gt,drizzle-orm/gte,ilike,drizzle-orm/ilike,inArray,drizzle-orm/inArray,isNull,drizzle-orm/isNull,like,drizzle-orm/like,drizzle-orm/lt,drizzle-orm/lte,drizzle-orm/ne,drizzle-orm/or,relations,drizzle-orm/relations,drizzle-orm/pg-core,bigint,drizzle-orm/pg-core/bigint,boolean,drizzle-orm/pg-core/boolean,integer,drizzle-orm/pg-core/integer,jsonb,drizzle-orm/pg-core/jsonb,pgEnum,drizzle-orm/pg-core/pgEnum,pgSchema,drizzle-orm/pg-core/pgSchema,pgTable,drizzle-orm/pg-core/pgTable,text,drizzle-orm/pg-core/text,timestamp,drizzle-orm/pg-core/timestamp,uuid,drizzle-orm/pg-core/uuid,varchar,drizzle-orm/pg-core/varchar,drizzle-orm/SQL,NodePgDatabase,drizzle-orm/node-postgres/NodePgDatabase,PgTable,drizzle-orm/pg-core/PgTable,AnyPgColumn,drizzle-orm/pg-core/AnyPgColumn,Relation,drizzle-orm/Relation,PgColumnBuilderBase,drizzle-orm/pg-core/PgColumnBuilderBase,PgEnum,drizzle-orm/pg-core/PgEnum"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/drizzle-orm/package.json"}],"concludedValue":"packages/appkit/node_modules/drizzle-orm/package.json"}],"occurrences":[{"location":"dist/database/runtime/engine/drizzle-data-path.js#7"},{"location":"dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"dist/database/runtime/engine/translate.js#7"},{"location":"dist/database/schema-builder/engine/relations.js#2"},{"location":"dist/database/schema-builder/engine/tables.js#2"},{"location":"tmp/dist/database/runtime/engine/drizzle-data-path.js#7"},{"location":"tmp/dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"tmp/dist/database/runtime/engine/translate.js#7"},{"location":"tmp/dist/database/schema-builder/engine/relations.js#2"},{"location":"tmp/dist/database/schema-builder/engine/tables.js#2"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#1"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#2"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#3"},{"location":"src/database/runtime/engine/translate.ts#18"},{"location":"src/database/runtime/engine/translate.ts#19"},{"location":"src/database/schema-builder/engine/relations.ts#1"},{"location":"src/database/schema-builder/engine/relations.ts#2"},{"location":"src/database/schema-builder/engine/tables.ts#16"},{"location":"dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"tmp/dist/database/runtime/engine/drizzle-data-path.js#8"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#2"},{"location":"dist/database/schema-builder/engine/tables.js#2"},{"location":"tmp/dist/database/schema-builder/engine/tables.js#2"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#3"},{"location":"src/database/runtime/engine/translate.ts#19"},{"location":"src/database/schema-builder/engine/relations.ts#2"},{"location":"src/database/schema-builder/engine/tables.ts#16"}]},"tags":["orm","sql"]},{"authors":[{"name":"TJ Holowaychuk <tj@vision-media.ca>"}],"group":"","name":"express","version":"4.22.2","description":"Fast, unopinionated, minimalist web framework","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/express@4.22.2","externalReferences":[{"type":"website","url":"http://expressjs.com/"}],"type":"framework","bom-ref":"pkg:npm/express@4.22.2","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/express/package.json"},{"name":"ImportedModules","value":"express,NextFunction,express/NextFunction,Request,express/Request,Response,express/Response"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/express/package.json"}],"concludedValue":"packages/appkit/node_modules/express/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#24"},{"location":"dist/plugins/server/static-server.js#4"},{"location":"tmp/dist/plugins/server/index.js#24"},{"location":"tmp/dist/plugins/server/static-server.js#4"},{"location":"src/core/plugin-context.ts#1"},{"location":"src/logging/logger.ts#5"},{"location":"src/plugin/plugin.ts#2"},{"location":"src/plugins/agents/agents.ts#5"},{"location":"src/plugins/agents/tool-dispatch.ts#3"},{"location":"src/plugins/ai-search/ai-search.ts#3"},{"location":"src/plugins/analytics/analytics.ts#1"},{"location":"src/plugins/database/crud/routes.ts#1"},{"location":"src/plugins/database/database.ts#1"},{"location":"src/plugins/files/plugin.ts#4"},{"location":"src/plugins/genie/genie.ts#3"},{"location":"src/plugins/jobs/plugin.ts#3"},{"location":"src/plugins/server/base-server.ts#1"},{"location":"src/plugins/server/index.ts#6"},{"location":"src/plugins/server/remote-tunnel/gate.ts#1"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-controller.ts#3"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#7"},{"location":"src/plugins/server/static-server.ts#4"},{"location":"src/plugins/server/static-server.ts#5"},{"location":"src/plugins/server/vite-dev-server.ts#4"},{"location":"src/plugins/serving/serving.ts#5"},{"location":"src/testing/test-plugin-context.ts#1"},{"location":"src/utils/safe-handler.ts#1"}]},"tags":["framework","web"]},{"authors":[{"name":"Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)"}],"group":"","name":"get-port","version":"7.2.0","description":"Get an available port","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/get-port@7.2.0","type":"library","bom-ref":"pkg:npm/get-port@7.2.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/get-port/package.json"},{"name":"ImportedModules","value":"get-port,portNumbers,get-port/portNumbers"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/get-port/package.json"}],"concludedValue":"packages/appkit/node_modules/get-port/package.json"}],"occurrences":[{"location":"dist/plugins/server/index.js#25"},{"location":"tmp/dist/plugins/server/index.js#25"},{"location":"src/plugins/server/index.ts#7"}]}},{"authors":[{"name":"Vladimir Zapparov <dervus.grim@gmail.com>"}],"group":"","name":"js-yaml","version":"4.3.1","description":"YAML 1.2 parser and serializer","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/js-yaml@4.3.1","type":"library","bom-ref":"pkg:npm/js-yaml@4.3.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/js-yaml/package.json"},{"name":"ImportedModules","value":"js-yaml"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/js-yaml/package.json"}],"concludedValue":"packages/appkit/node_modules/js-yaml/package.json"}],"occurrences":[{"location":"dist/core/agent/load-agents.js#7"},{"location":"dist/core/agent/skills/parse-skill.js#3"},{"location":"tmp/dist/cli/commands/doctor/bundle.js#5"},{"location":"tmp/dist/core/agent/load-agents.js#7"},{"location":"tmp/dist/core/agent/skills/parse-skill.js#3"},{"location":"src/core/agent/load-agents.ts#5"},{"location":"src/core/agent/skills/parse-skill.ts#1"}]}},{"authors":[{"name":"Rich Harris"}],"group":"","name":"magic-string","version":"0.30.21","description":"Modify strings, generate sourcemaps","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/magic-string@0.30.21","externalReferences":[{"type":"vcs","url":"git+https://github.com/Rich-Harris/magic-string.git"}],"type":"library","bom-ref":"pkg:npm/magic-string@0.30.21","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/magic-string/package.json"},{"name":"ImportedModules","value":"magic-string"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/magic-string/package.json"}],"concludedValue":"packages/appkit/node_modules/magic-string/package.json"}],"occurrences":[{"location":"dist/plugins/server/react-source-loc-vite-plugin.js#3"},{"location":"tmp/dist/plugins/server/react-source-loc-vite-plugin.js#3"},{"location":"src/plugins/server/react-source-loc-vite-plugin.ts#4"}]}},{"authors":[{"name":"Kevin Deng <sxzz@sxzz.moe>"}],"group":"","name":"obug","version":"2.1.1","description":"A lightweight JavaScript debugging utility, forked from debug, featuring TypeScript and ESM support.","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/obug@2.1.1","externalReferences":[{"type":"vcs","url":"https://github.com/sxzz/obug#readme"},{"type":"vcs","url":"git+https://github.com/sxzz/obug.git"}],"type":"library","bom-ref":"pkg:npm/obug@2.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/obug/package.json"},{"name":"ImportedModules","value":"obug,createDebug,obug/createDebug"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/obug/package.json"}],"concludedValue":"packages/appkit/node_modules/obug/package.json"}],"occurrences":[{"location":"dist/logging/logger.js#7"},{"location":"tmp/dist/logging/logger.js#7"},{"location":"src/logging/logger.ts#6"}]}},{"authors":[{"name":"Brian Carlson <brian.m.carlson@gmail.com>"}],"group":"","name":"pg","version":"8.18.0","description":"PostgreSQL client - pure javascript & libpq with the same API","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/pg@8.18.0","externalReferences":[{"type":"vcs","url":"https://github.com/brianc/node-postgres"},{"type":"vcs","url":"git://github.com/brianc/node-postgres.git"}],"type":"library","bom-ref":"pkg:npm/pg@8.18.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/pg/package.json"},{"name":"ImportedModules","value":"pg,Pool,pg/Pool,PoolClient,pg/PoolClient,QueryResult,pg/QueryResult,QueryResultRow,pg/QueryResultRow"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/pg/package.json"}],"concludedValue":"packages/appkit/node_modules/pg/package.json"}],"occurrences":[{"location":"src/cache/storage/persistent.ts#3"},{"location":"src/connectors/lakebase/index.ts#5"},{"location":"src/connectors/lakebase/pool-manager.ts#2"},{"location":"src/connectors/lakebase/routing-pool.ts#1"},{"location":"src/database/runtime/engine/drizzle-data-path.ts#4"},{"location":"src/plugins/lakebase/lakebase.ts#1"}]}},{"authors":[{"name":"Alexey Raspopov"}],"group":"","name":"picocolors","version":"1.1.1","description":"The tiniest and the fastest library for terminal output formatting with ANSI colors","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/picocolors@1.1.1","type":"library","bom-ref":"pkg:npm/picocolors@1.1.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/picocolors/package.json"},{"name":"ImportedModules","value":"picocolors"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/picocolors/package.json"}],"concludedValue":"packages/appkit/node_modules/picocolors/package.json"}],"occurrences":[{"location":"dist/errors/configuration.js#2"},{"location":"dist/plugins/agents/agents.js#40"},{"location":"dist/plugins/server/client-config-sanitizer.js#2"},{"location":"dist/plugins/server/utils.js#2"},{"location":"dist/type-generator/index.js#17"},{"location":"dist/type-generator/migration.js#2"},{"location":"dist/type-generator/query-registry.js#10"},{"location":"dist/type-generator/serving/generator.js#8"},{"location":"tmp/dist/cli/commands/doctor/report.js#2"},{"location":"tmp/dist/cli/commands/registry/add.js#11"},{"location":"tmp/dist/cli/commands/registry/config-writer.js#5"},{"location":"tmp/dist/cli/commands/registry/env-writer.js#5"},{"location":"tmp/dist/cli/commands/registry/info.js#6"},{"location":"tmp/dist/cli/commands/registry/list.js#5"},{"location":"tmp/dist/cli/commands/registry/requirements.js#3"},{"location":"tmp/dist/errors/configuration.js#2"},{"location":"tmp/dist/plugins/agents/agents.js#40"},{"location":"tmp/dist/plugins/server/client-config-sanitizer.js#2"},{"location":"tmp/dist/plugins/server/utils.js#2"},{"location":"tmp/dist/type-generator/index.js#17"},{"location":"tmp/dist/type-generator/migration.js#2"},{"location":"tmp/dist/type-generator/query-registry.js#10"},{"location":"tmp/dist/type-generator/serving/generator.js#8"},{"location":"src/errors/configuration.ts#1"},{"location":"src/plugins/agents/agents.ts#6"},{"location":"src/plugins/server/client-config-sanitizer.ts#1"},{"location":"src/plugins/server/utils.ts#6"},{"location":"src/type-generator/index.ts#6"},{"location":"src/type-generator/migration.ts#5"},{"location":"src/type-generator/query-registry.ts#5"},{"location":"src/type-generator/serving/generator.ts#4"}]}},{"authors":[{"name":"GitHub Inc."}],"group":"","name":"semver","version":"7.7.3","description":"The semantic version parser used by npm.","scope":"required","licenses":[{"license":{"id":"ISC","url":"https://opensource.org/licenses/ISC"}}],"purl":"pkg:npm/semver@7.7.3","externalReferences":[{"type":"vcs","url":"git+https://github.com/npm/node-semver.git"}],"type":"library","bom-ref":"pkg:npm/semver@7.7.3","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/semver/package.json"},{"name":"ImportedModules","value":"semver,coerce,semver/coerce"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/semver/package.json"}],"concludedValue":"packages/appkit/node_modules/semver/package.json"}],"occurrences":[{"location":"dist/context/client-options.js#2"},{"location":"tmp/dist/context/client-options.js#2"},{"location":"src/context/client-options.ts#1"}]}},{"group":"","name":"shared","version":"0.0.1","scope":"required","purl":"pkg:npm/shared@0.0.1","type":"library","bom-ref":"pkg:npm/shared@0.0.1","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/shared/package.json"},{"name":"ExportedModules","value":"shared,shared/workspace-client,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,Message,shared/Message,Thread,shared/Thread,ThreadStore,shared/ThreadStore,ToolAnnotations,shared/ToolAnnotations,ToolProvider,shared/ToolProvider,GenieAttachmentResponse,shared/GenieAttachmentResponse,GenieMessageResponse,shared/GenieMessageResponse,GenieStatementResponse,shared/GenieStatementResponse,GenieStreamEvent,shared/GenieStreamEvent,BasePluginConfig,shared/BasePluginConfig,CacheConfig,shared/CacheConfig,IAppRouter,shared/IAppRouter,PluginData,shared/PluginData,StreamExecutionSettings,shared/StreamExecutionSettings,isSQLTypeMarker,shared/isSQLTypeMarker,shared/sql,MetricFilter,shared/MetricFilter,MetricFilterOperatorName,shared/MetricFilterOperatorName,MetricOrderBy,shared/MetricOrderBy,MetricPredicate,shared/MetricPredicate,ApiError,shared/ApiError,ConfigError,shared/ConfigError,Context,shared/Context,createWorkspaceClient,shared/createWorkspaceClient,Time,shared/Time,TimeUnits,shared/TimeUnits,CancellationToken,shared/workspace-client/CancellationToken,ClientOptions,shared/workspace-client/ClientOptions,files,shared/workspace-client/files,GenieMessage,shared/workspace-client/GenieMessage,jobs,shared/workspace-client/jobs,serving,shared/workspace-client/serving,shared/workspace-client/sql,Waiter,shared/workspace-client/Waiter,WorkspaceClient,shared/workspace-client/WorkspaceClient,WorkspaceClientOptions,shared/workspace-client/WorkspaceClientOptions"},{"name":"ImportedModules","value":"shared,AgentAdapter,shared/AgentAdapter,AgentEvent,shared/AgentEvent,AgentInput,shared/AgentInput,AgentRunContext,shared/AgentRunContext,AgentToolDefinition,shared/AgentToolDefinition,Message,shared/Message,ResponseStreamEvent,shared/ResponseStreamEvent,CacheConfig,shared/CacheConfig,CacheEntry,shared/CacheEntry,CacheStorage,shared/CacheStorage,TelemetryOptions,shared/TelemetryOptions,GenieMessageResponse,shared/GenieMessageResponse,PluginConstructor,shared/PluginConstructor,PluginData,shared/PluginData,ToolProvider,shared/ToolProvider,ToolAnnotations,shared/ToolAnnotations,BasePluginConfig,shared/BasePluginConfig,ThreadStore,shared/ThreadStore,BasePlugin,shared/BasePlugin,InputPluginMap,shared/InputPluginMap,OptionalConfigPluginDef,shared/OptionalConfigPluginDef,PluginMap,shared/PluginMap,IAppRequest,shared/IAppRequest,TunnelConnection,shared/TunnelConnection,RetryConfig,shared/RetryConfig,TelemetryConfig,shared/TelemetryConfig,IAppResponse,shared/IAppResponse,PluginEndpointMap,shared/PluginEndpointMap,PluginExecuteConfig,shared/PluginExecuteConfig,PluginExecutionSettings,shared/PluginExecutionSettings,PluginPhase,shared/PluginPhase,RouteConfig,shared/RouteConfig,StreamExecuteHandler,shared/StreamExecuteHandler,StreamExecutionSettings,shared/StreamExecutionSettings,camelToKebab,shared/camelToKebab,ToPlugin,shared/ToPlugin,IAppRouter,shared/IAppRouter,ResponseOutputMessage,shared/ResponseOutputMessage,Thread,shared/Thread,ResponseFunctionCallOutput,shared/ResponseFunctionCallOutput,ResponseFunctionToolCall,shared/ResponseFunctionToolCall,AnalyticsSseMessage,shared/AnalyticsSseMessage,makeResultMessage,shared/makeResultMessage,SQLTypeMarker,shared/SQLTypeMarker,MetricFilterOperatorName,shared/MetricFilterOperatorName,MetricOrderDirection,shared/MetricOrderDirection,shared/sql,MetricViewColumnDisplay,shared/MetricViewColumnDisplay,MetricViewsMetadata,shared/MetricViewsMetadata,isSQLTypeMarker,shared/isSQLTypeMarker,MetricFilter,shared/MetricFilter,MetricOrderBy,shared/MetricOrderBy,PluginClientConfigs,shared/PluginClientConfigs,PluginEndpoints,shared/PluginEndpoints,pluginManifestSchema,shared/pluginManifestSchema,ResourceFieldEntry,shared/ResourceFieldEntry,PluginManifest,shared/PluginManifest,StreamConfig,shared/StreamConfig,shared/workspace-client"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/shared/package.json"}],"concludedValue":"packages/appkit/node_modules/shared/package.json"}],"occurrences":[{"location":"src/agents/databricks.ts#7"},{"location":"src/agents/supervisor-api.ts#8"},{"location":"src/beta.ts#20"},{"location":"src/cache/defaults.ts#1"},{"location":"src/cache/index.ts#3"},{"location":"src/cache/storage/memory.ts#1"},{"location":"src/cache/storage/persistent.ts#4"},{"location":"src/connectors/ai-search/types.ts#1"},{"location":"src/connectors/files/client.ts#3"},{"location":"src/connectors/genie/types.ts#3"},{"location":"src/connectors/genie/types.ts#10"},{"location":"src/connectors/jobs/types.ts#1"},{"location":"src/connectors/mcp/client.ts#25"},{"location":"src/connectors/sql-warehouse/client.ts#1"},{"location":"src/core/agent/build-toolkit.ts#1"},{"location":"src/core/agent/consume-adapter-stream.ts#1"},{"location":"src/core/agent/load-agents.ts#6"},{"location":"src/core/agent/run-agent.ts#11"},{"location":"src/core/agent/toolkit-resolver.ts#1"},{"location":"src/core/agent/tools/define-tool.ts#1"},{"location":"src/core/agent/tools/function-tool.ts#1"},{"location":"src/core/agent/tools/tool.ts#1"},{"location":"src/core/agent/types.ts#7"},{"location":"src/core/appkit.ts#9"},{"location":"src/core/lifecycle-manager.ts#1"},{"location":"src/core/plugin-context.ts#2"},{"location":"src/index.ts#15"},{"location":"src/index.ts#16"},{"location":"src/plugin/dev-reader.ts#3"},{"location":"src/plugin/index.ts#1"},{"location":"src/plugin/interceptors/cache.ts#1"},{"location":"src/plugin/interceptors/retry.ts#1"},{"location":"src/plugin/interceptors/telemetry.ts#1"},{"location":"src/plugin/plugin.ts#14"},{"location":"src/plugin/plugin.ts#15"},{"location":"src/plugin/to-plugin.ts#1"},{"location":"src/plugins/agents/adapter-extensions.ts#1"},{"location":"src/plugins/agents/agents.ts#17"},{"location":"src/plugins/agents/approval.ts#1"},{"location":"src/plugins/agents/builtin-tools.ts#1"},{"location":"src/plugins/agents/defaults.ts#1"},{"location":"src/plugins/agents/event-translator.ts#9"},{"location":"src/plugins/agents/thread-store.ts#3"},{"location":"src/plugins/agents/tool-dispatch.ts#4"},{"location":"src/plugins/ai-search/ai-search.ts#4"},{"location":"src/plugins/ai-search/defaults.ts#1"},{"location":"src/plugins/ai-search/types.ts#1"},{"location":"src/plugins/analytics/analytics.ts#11"},{"location":"src/plugins/analytics/defaults.ts#1"},{"location":"src/plugins/analytics/mv/constants.ts#1"},{"location":"src/plugins/analytics/mv/formatters.ts#1"},{"location":"src/plugins/analytics/mv/metadata.ts#1"},{"location":"src/plugins/analytics/query.ts#3"},{"location":"src/plugins/analytics/result-delivery.ts#2"},{"location":"src/plugins/analytics/types.ts#7"},{"location":"src/plugins/analytics/types.ts#14"},{"location":"src/plugins/database/database.ts#2"},{"location":"src/plugins/database/defaults.ts#1"},{"location":"src/plugins/database/entity-client.ts#1"},{"location":"src/plugins/files/defaults.ts#1"},{"location":"src/plugins/files/plugin.ts#10"},{"location":"src/plugins/files/types.ts#1"},{"location":"src/plugins/genie/defaults.ts#1"},{"location":"src/plugins/genie/genie.ts#9"},{"location":"src/plugins/genie/types.ts#1"},{"location":"src/plugins/genie/types.ts#4"},{"location":"src/plugins/jobs/defaults.ts#1"},{"location":"src/plugins/jobs/plugin.ts#8"},{"location":"src/plugins/jobs/types.ts#1"},{"location":"src/plugins/lakebase/lakebase.ts#2"},{"location":"src/plugins/lakebase/types.ts#1"},{"location":"src/plugins/server/index.ts#8"},{"location":"src/plugins/server/index.ts#9"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#8"},{"location":"src/plugins/server/types.ts#1"},{"location":"src/plugins/server/utils.ts#7"},{"location":"src/plugins/serving/serving.ts#6"},{"location":"src/plugins/serving/types.ts#1"},{"location":"src/plugins/ui-variants/index.ts#1"},{"location":"src/registry/manifest-loader.ts#1"},{"location":"src/registry/resource-registry.ts#13"},{"location":"src/registry/types.ts#33"},{"location":"src/registry/types.ts#39"},{"location":"src/stream/sse-writer.ts#1"},{"location":"src/stream/stream-manager.ts#4"},{"location":"src/stream/types.ts#2"},{"location":"src/telemetry/telemetry-manager.ts#24"},{"location":"src/telemetry/telemetry-provider.ts#5"},{"location":"src/testing/fixtures.ts#2"},{"location":"src/testing/test-plugin-context.ts#7"},{"location":"src/workspace-client/index.ts#15"},{"location":"src/workspace-client/index.ts#27"},{"location":"src/workspace-client/index.ts#27"}]},"tags":["sql"]},{"authors":[{"name":"Anthony Fu <anthonyfu117@hotmail.com>"}],"group":"","name":"vitest","version":"3.2.4","description":"Next generation testing framework powered by Vite","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/vitest@3.2.4","externalReferences":[{"type":"vcs","url":"https://github.com/vitest-dev/vitest#readme"},{"type":"vcs","url":"git+https://github.com/vitest-dev/vitest.git"}],"type":"framework","bom-ref":"pkg:npm/vitest@3.2.4","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/vitest/package.json"},{"name":"ImportedModules","value":"vitest,afterEach,vitest/afterEach,beforeEach,vitest/beforeEach,vitest/vi"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/vitest/package.json"}],"concludedValue":"packages/appkit/node_modules/vitest/package.json"}],"occurrences":[{"location":"dist/testing/fixtures.js#3"},{"location":"tmp/dist/testing/fixtures.js#3"},{"location":"src/testing/fixtures.ts#3"}]},"tags":["framework"]},{"authors":[{"name":"Einar Otto Stangvik <einaros@gmail.com> (http://2x.io)"}],"group":"","name":"ws","version":"8.21.0","description":"Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/ws@8.21.0","externalReferences":[{"type":"vcs","url":"https://github.com/websockets/ws"},{"type":"vcs","url":"git+https://github.com/websockets/ws.git"}],"type":"library","bom-ref":"pkg:npm/ws@8.21.0","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/ws/package.json"},{"name":"ImportedModules","value":"ws,WebSocketServer,ws/WebSocketServer"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/ws/package.json"}],"concludedValue":"packages/appkit/node_modules/ws/package.json"}],"occurrences":[{"location":"dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"tmp/dist/plugins/server/remote-tunnel/remote-tunnel-manager.js#8"},{"location":"src/plugins/server/remote-tunnel/remote-tunnel-manager.ts#9"}]}},{"authors":[{"name":"Colin McDonnell <zod@colinhacks.com>"}],"group":"","name":"zod","version":"4.3.6","description":"TypeScript-first schema declaration and validation library with static type inference","scope":"required","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/zod@4.3.6","externalReferences":[{"type":"website","url":"https://zod.dev"},{"type":"vcs","url":"git+https://github.com/colinhacks/zod.git"}],"type":"library","bom-ref":"pkg:npm/zod@4.3.6","properties":[{"name":"SrcFile","value":"packages/appkit/node_modules/zod/package.json"},{"name":"ImportedModules","value":"zod,toJSONSchema,zod/toJSONSchema,zod/z,ZodType,zod/ZodType"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/appkit/node_modules/zod/package.json"}],"concludedValue":"packages/appkit/node_modules/zod/package.json"}],"occurrences":[{"location":"dist/core/agent/tools/json-schema.js#1"},{"location":"dist/database/schema-builder/validators.js#1"},{"location":"dist/plugins/agents/schemas.js#1"},{"location":"dist/plugins/analytics/analytics.js#30"},{"location":"dist/plugins/analytics/mv/schemas.js#6"},{"location":"dist/plugins/files/plugin.js#24"},{"location":"dist/plugins/genie/genie.js#16"},{"location":"dist/plugins/jobs/plugin.js#18"},{"location":"dist/plugins/lakebase/lakebase.js#17"},{"location":"dist/shared/src/schemas/manifest.js#2"},{"location":"dist/shared/src/schemas/metric-metadata-bundle.js#2"},{"location":"dist/shared/src/schemas/metric-source.js#2"},{"location":"dist/shared/src/sse/analytics.js#1"},{"location":"tmp/dist/core/agent/tools/json-schema.js#1"},{"location":"tmp/dist/database/schema-builder/validators.js#1"},{"location":"tmp/dist/plugins/agents/schemas.js#1"},{"location":"tmp/dist/plugins/analytics/analytics.js#30"},{"location":"tmp/dist/plugins/analytics/mv/schemas.js#6"},{"location":"tmp/dist/plugins/files/plugin.js#24"},{"location":"tmp/dist/plugins/genie/genie.js#16"},{"location":"tmp/dist/plugins/jobs/plugin.js#18"},{"location":"tmp/dist/plugins/lakebase/lakebase.js#17"},{"location":"tmp/dist/schemas/manifest.js#2"},{"location":"tmp/dist/shared/src/schemas/manifest.js#2"},{"location":"tmp/dist/shared/src/schemas/metric-metadata-bundle.js#2"},{"location":"tmp/dist/shared/src/schemas/metric-source.js#2"},{"location":"tmp/dist/shared/src/sse/analytics.js#1"},{"location":"src/core/agent/tools/define-tool.ts#2"},{"location":"src/core/agent/tools/json-schema.ts#1"},{"location":"src/core/agent/tools/tool.ts#2"},{"location":"src/database/schema-builder/validators.ts#1"},{"location":"src/database/schema-builder/validators.ts#2"},{"location":"src/plugins/agents/schemas.ts#1"},{"location":"src/plugins/analytics/analytics.ts#12"},{"location":"src/plugins/analytics/mv/schemas.ts#1"},{"location":"src/plugins/files/plugin.ts#11"},{"location":"src/plugins/genie/genie.ts#10"},{"location":"src/plugins/jobs/plugin.ts#9"},{"location":"src/plugins/jobs/types.ts#2"},{"location":"src/plugins/lakebase/lakebase.ts#3"}]},"tags":["validation"]}],"dependencies":[],"compositions":[{"bom-ref":"pkg:npm/@databricks/appkit@0.69.2","aggregate":"incomplete"}],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/@databricks/appkit@0.69.2"],"annotator":{"component":{"group":"@cyclonedx","name":"cdxgen","version":"12.1.2","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.2","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.2","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-09-02T13:05:12Z","text":"This Software Bill-of-Materials (SBOM) document was created on Wednesday, September 2, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'appkit' with version '0.69.2'. There are 32 components. The package type in this SBOM is npm with 3 purl namespaces described under components. The components were identified from 32 source files."}]}