@sebastienrousseau/crypto-cbom 0.0.0-stage → 0.0.7

package/LICENSE

@@ -0,0 +1,8 @@
+This project is dual-licensed under either of:
+
+  * Apache License, Version 2.0 — see LICENSE-APACHE
+  * MIT license — see LICENSE-MIT
+
+at your option.
+
+SPDX-License-Identifier: Apache-2.0 OR MIT

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# `@sebastienrousseau/crypto-cbom`
+
+> Cryptographic Bill of Materials (CBOM) generator and auditor: CycloneDX 1.6 and SPDX 3.0 output, plus a heuristic quantum-readiness score.
+
+[![Version](https://img.shields.io/npm/v/@sebastienrousseau/crypto-cbom.svg)](https://www.npmjs.com/package/@sebastienrousseau/crypto-cbom)
+[![License](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue.svg)](https://opensource.org/licenses/MIT)
+
+---
+
+## Overview
+
+`@sebastienrousseau/crypto-cbom` provides automated inventory, specification, and auditing of cryptographic assets across codebases and enterprise systems. It maps algorithms, protocols, key lengths, cipher modes, and certificates into standardized machine-readable CycloneDX 1.6 Cryptographic BOM and SPDX 3.0 formats.
+
+The auditor classifies each asset by algorithm name and returns a posture score (0–100), a `PASS` / `REVIEW` / `FAIL` status and findings that cite the guidance they draw on:
+
+- **NIST SP 800-131A**: broken or disallowed primitives (MD5, SHA-1, DES, RC4, ECB).
+- **NIST IR 8547** (draft): quantum-vulnerable public-key algorithms (RSA, ECC, Ed25519).
+- **CNSA 2.0**: symmetric keys below 256 bits.
+
+The result is a heuristic over names found in code or a CBOM. It is evidence you can use in a DORA or CRA assessment, not a compliance verdict.
+
+## CLI Usage
+
+```bash
+# Generate CycloneDX 1.6 CBOM from source directory
+crypto-cbom scan ./src --format cyclonedx --output cbom.json
+
+# Generate SPDX 3.0 CBOM
+crypto-cbom scan ./src --format spdx --output cbom-spdx.json
+
+# Audit an existing CBOM (exit code 1 when the status is FAIL)
+crypto-cbom audit cbom.json
+```
+
+## Programmatic API
+
+```typescript
+import {
+  scanDirectory,
+  generateCycloneDxCbom,
+  auditCbom,
+} from "@sebastienrousseau/crypto-cbom";
+
+// 1. Scan codebase for cryptographic assets
+const assets = scanDirectory("./src");
+
+// 2. Generate standard CycloneDX 1.6 CBOM
+const cbomDoc = generateCycloneDxCbom(assets, {
+  componentName: "financial-payment-engine",
+  componentVersion: "1.0.0",
+});
+
+// 3. Score the cryptographic posture (heuristic; not a compliance verdict)
+const audit = auditCbom(cbomDoc);
+console.log(`Posture: ${audit.status}, score ${audit.score}/100`);
+console.log(`Quantum Safe Assets: ${audit.quantumSafeRatio * 100}%`);
+```
+
+---
+
+## Development
+
+```bash
+pnpm --filter @sebastienrousseau/crypto-cbom run build
+pnpm --filter @sebastienrousseau/crypto-cbom run test
+pnpm --filter @sebastienrousseau/crypto-cbom run lint
+pnpm --filter @sebastienrousseau/crypto-cbom run format
+```
+
+All 18 packages in the Crypto Service workspace maintain a **100% coverage floor** across statements, branches, functions, and lines.
+
+---
+
+## Documentation
+
+- [Full Suite Documentation](https://docs.crypto-service.co/)
+- [API Reference (TypeDoc)](https://docs.crypto-service.co/packages/crypto-cbom/)
+- [Developer Guide](../../DEVELOPMENT.md)
+- [Security Policy](../../SECURITY.md)
+- [Architecture & Design](../../ARCHITECTURE.md)
+
+---
+
+## Stability guarantees
+
+Versions advance strictly one step at a time on the `0.0.x` line (`v0.0.1` → `v0.0.2` → `v0.0.3` ... → `v0.0.999` → `v0.1.0`). Work for every release iteration begins on a dedicated `feat/v<version>` branch.
+
+All 18 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by [POLICIES.md](../../docs/POLICIES.md).
+
+---
+
+## License
+
+Dual-licensed under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) or [MIT](https://opensource.org/licenses/MIT), at your option.
+
+Copyright (c) 2022-2026 Sebastien Rousseau and The Crypto Service Suite contributors.

package/dist/audit.d.ts

@@ -0,0 +1,5 @@
+import { CbomAuditResult, CryptoAsset, CycloneDxCbom, QuantumResistanceLevel } from "./types";
+export declare const AUDIT_DISCLAIMER = "Heuristic cryptographic posture score derived from algorithm names; it is not a DORA or CRA compliance assessment.";
+export declare function classifyPrimitive(primitive: string): QuantumResistanceLevel;
+export declare function auditCbom(input: CycloneDxCbom | CryptoAsset[]): CbomAuditResult;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,eAAe,EACf,WAAW,EACX,aAAa,EACb,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAGjB,eAAO,MAAM,gBAAgB,uHACyF,CAAC;AAgBvH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAO3E;AAkGD,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,GAAG,WAAW,EAAE,GACnC,eAAe,CA+BjB"}

package/dist/audit.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDIT_DISCLAIMER = void 0;
+exports.classifyPrimitive = classifyPrimitive;
+exports.auditCbom = auditCbom;
+exports.AUDIT_DISCLAIMER = "Heuristic cryptographic posture score derived from algorithm names; it is not a DORA or CRA compliance assessment.";
+const BROKEN_MARKERS = ["MD5", "SHA-1", "DES", "RC4", "ECB"];
+const QUANTUM_VULNERABLE_MARKERS = ["RSA", "ECC", "ECDSA", "ED25519"];
+const TRANSITIONAL_MARKERS = ["AES-128", "CBC"];
+function classifyPrimitive(primitive) {
+    const upper = primitive.toUpperCase();
+    const has = (markers) => markers.some((m) => upper.includes(m));
+    if (has(BROKEN_MARKERS))
+        return "DEPRECATED_BROKEN";
+    if (has(QUANTUM_VULNERABLE_MARKERS))
+        return "VULNERABLE_CRQC";
+    if (has(TRANSITIONAL_MARKERS))
+        return "TRANSITIONAL_HYBRID";
+    return "QUANTUM_SAFE";
+}
+function toAssets(input) {
+    if (Array.isArray(input))
+        return input;
+    return input.components.map((c) => ({
+        name: c.name,
+        resistanceLevel: classifyPrimitive(c["crypto-properties"]?.algorithmProperties?.primitive || c.name),
+    }));
+}
+const DEDUCTIONS = {
+    DEPRECATED_BROKEN: 25,
+    VULNERABLE_CRQC: 10,
+    TRANSITIONAL_HYBRID: 5,
+    QUANTUM_SAFE: 0,
+};
+function findingFor(asset) {
+    switch (asset.resistanceLevel) {
+        case "DEPRECATED_BROKEN":
+            return {
+                severity: "CRITICAL",
+                asset: asset.name,
+                rule: "DEPRECATED_BROKEN_PRIMITIVE",
+                reference: "NIST_SP_800_131A",
+                description: `${asset.name} is broken or disallowed for new use (NIST SP 800-131A).`,
+                remediation: "Replace with SHA-256 or AES-256-GCM.",
+            };
+        case "VULNERABLE_CRQC":
+            return {
+                severity: "HIGH",
+                asset: asset.name,
+                rule: "CRQC_HNDL_EXPOSURE",
+                reference: "NIST_IR_8547",
+                description: `${asset.name} can be broken by a cryptographically relevant quantum computer, so data protected today is exposed to harvest-now-decrypt-later (NIST IR 8547 draft: deprecated after 2030, disallowed after 2035).`,
+                remediation: "Deploy hybrid classical/post-quantum KEM (ML-KEM-768) and signatures (ML-DSA-65).",
+            };
+        case "TRANSITIONAL_HYBRID":
+            return {
+                severity: "MEDIUM",
+                asset: asset.name,
+                rule: "TRANSITIONAL_CRYPTOGRAPHY",
+                reference: "CNSA_2_0",
+                description: `${asset.name} has a reduced security margin against quantum search; CNSA 2.0 requires AES-256.`,
+                remediation: "Upgrade to AES-256-GCM or ChaCha20-Poly1305.",
+            };
+        default:
+            return undefined;
+    }
+}
+function postureStatus(score, deprecatedCount, vulnerableCount) {
+    if (deprecatedCount > 0 || score < 50)
+        return "FAIL";
+    if (vulnerableCount > 0 || score < 85)
+        return "REVIEW";
+    return "PASS";
+}
+function migrationRoadmap(deprecatedCount, vulnerableCount) {
+    const steps = [];
+    if (deprecatedCount > 0) {
+        steps.push("Phase 1 (Immediate / 30 Days): Eliminate all deprecated ciphers and broken hash functions.");
+    }
+    if (vulnerableCount > 0) {
+        steps.push("Phase 2 (Near-Term / 90 Days): Implement hybrid post-quantum key encapsulation ML-KEM-768.", "Phase 3 (Mid-Term / 180 Days): Transition authentication and code signing to ML-DSA-65 / SLH-DSA.");
+    }
+    if (steps.length === 0) {
+        steps.push("Continuous Monitoring: Maintain automated CBOM tracking across CI/CD supply chain pipelines.");
+    }
+    return steps;
+}
+function auditCbom(input) {
+    const assets = toAssets(input);
+    const count = (level) => assets.filter((a) => a.resistanceLevel === level).length;
+    const deprecatedCount = count("DEPRECATED_BROKEN");
+    const vulnerableCount = count("VULNERABLE_CRQC");
+    const quantumSafeCount = count("QUANTUM_SAFE");
+    const deductions = assets.reduce((sum, a) => sum + DEDUCTIONS[a.resistanceLevel], 0);
+    const score = Math.max(0, 100 - deductions);
+    const totalAssets = assets.length;
+    return {
+        score,
+        status: postureStatus(score, deprecatedCount, vulnerableCount),
+        disclaimer: exports.AUDIT_DISCLAIMER,
+        totalAssets,
+        quantumSafeCount,
+        vulnerableCount,
+        deprecatedCount,
+        quantumSafeRatio: totalAssets === 0
+            ? 1
+            : Number((quantumSafeCount / totalAssets).toFixed(2)),
+        findings: assets
+            .map(findingFor)
+            .filter((f) => f !== undefined),
+        migrationRoadmap: migrationRoadmap(deprecatedCount, vulnerableCount),
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function run(args?: string[]): number;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAmEA,wBAAgB,GAAG,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,MAAM,CAOlE"}

package/dist/cli.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_process_1 = __importDefault(require("node:process"));
+const scanner_1 = require("./scanner");
+const cyclonedx_1 = require("./cyclonedx");
+const spdx_1 = require("./spdx");
+const audit_1 = require("./audit");
+const validator_1 = require("./validator");
+function printHelp() {
+    node_process_1.default.stdout.write("Usage: crypto-cbom <scan|audit> [options]\n");
+    node_process_1.default.stdout.write("Commands:\n");
+    node_process_1.default.stdout.write("  scan <dir> [--format cyclonedx|spdx] [--output <file>]\n");
+    node_process_1.default.stdout.write("  audit <file.json>\n");
+    return 0;
+}
+function optionValue(args, flag) {
+    const idx = args.indexOf(flag);
+    return idx !== -1 ? args[idx + 1] || undefined : undefined;
+}
+function runScan(args) {
+    const targetDir = args[1] || ".";
+    const format = optionValue(args, "--format") ?? "cyclonedx";
+    const outFile = optionValue(args, "--output");
+    const assets = (0, scanner_1.scanDirectory)(targetDir);
+    const cbom = format === "spdx"
+        ? (0, spdx_1.generateSpdxCbom)(assets)
+        : (0, cyclonedx_1.generateCycloneDxCbom)(assets);
+    const json = JSON.stringify(cbom, null, 2);
+    if (outFile) {
+        node_fs_1.default.writeFileSync(outFile, json, "utf8");
+    }
+    else {
+        node_process_1.default.stdout.write(json + "\n");
+    }
+    return 0;
+}
+function runAudit(args) {
+    const filePath = args[1];
+    if (!filePath || !node_fs_1.default.existsSync(filePath)) {
+        node_process_1.default.stderr.write(`Error: file not found '${String(filePath)}'\n`);
+        return 1;
+    }
+    const parsed = JSON.parse(node_fs_1.default.readFileSync(filePath, "utf8"));
+    const val = (0, validator_1.validateCbom)(parsed);
+    if (!val.valid) {
+        node_process_1.default.stderr.write(`Validation failed: ${val.errors.join(", ")}\n`);
+        return 1;
+    }
+    const result = (0, audit_1.auditCbom)(parsed);
+    node_process_1.default.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return result.status === "FAIL" ? 1 : 0;
+}
+function run(args = node_process_1.default.argv.slice(2)) {
+    const command = args[0];
+    if (!command || command === "--help" || command === "-h")
+        return printHelp();
+    if (command === "scan")
+        return runScan(args);
+    if (command === "audit")
+        return runAudit(args);
+    node_process_1.default.stderr.write(`Unknown command '${command}'\n`);
+    return 1;
+}
+if (require.main === module) {
+    node_process_1.default.exit(run());
+}
+//# sourceMappingURL=cli.js.map

package/dist/cyclonedx.d.ts

@@ -0,0 +1,8 @@
+import { CryptoAsset, CycloneDxCbom } from "./types";
+export interface CycloneDxOptions {
+    componentName?: string;
+    componentVersion?: string;
+    componentType?: string;
+}
+export declare function generateCycloneDxCbom(assets: CryptoAsset[], options?: CycloneDxOptions): CycloneDxCbom;
+//# sourceMappingURL=cyclonedx.d.ts.map

package/dist/cyclonedx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cyclonedx.d.ts","sourceRoot":"","sources":["../src/cyclonedx.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAsB,MAAM,SAAS,CAAC;AAGzE,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,EAAE,EACrB,OAAO,GAAE,gBAAqB,GAC7B,aAAa,CAoDf"}

package/dist/cyclonedx.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateCycloneDxCbom = generateCycloneDxCbom;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const version_1 = require("./version");
+function generateCycloneDxCbom(assets, options = {}) {
+    const serialNumber = `urn:uuid:${node_crypto_1.default.randomUUID()}`;
+    const timestamp = new Date().toISOString();
+    const components = assets.map((asset) => {
+        return {
+            type: "cryptographic-asset",
+            name: asset.name,
+            version: asset.standard,
+            "crypto-properties": {
+                assetType: asset.type,
+                algorithmProperties: {
+                    primitive: asset.algorithm,
+                    mode: asset.mode,
+                    classicalSecurityLevel: asset.keySize,
+                    nistQuantumSecurityLevel: asset.quantumResistant
+                        ? asset.keySize && asset.keySize >= 1024
+                            ? 5
+                            : 3
+                        : 0,
+                    cryptoFunctions: [asset.type],
+                },
+            },
+        };
+    });
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.6",
+        serialNumber,
+        version: 1,
+        metadata: {
+            timestamp,
+            tools: [
+                {
+                    vendor: "Sebastien Rousseau",
+                    name: "@sebastienrousseau/crypto-cbom",
+                    version: version_1.VERSION,
+                },
+            ],
+            component: {
+                name: options.componentName || "cryptographic-application",
+                ...(options.componentVersion
+                    ? { version: options.componentVersion }
+                    : {}),
+                type: options.componentType || "application",
+            },
+        },
+        components,
+    };
+}
+//# sourceMappingURL=cyclonedx.js.map

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./types";
+export * from "./scanner";
+export * from "./cyclonedx";
+export * from "./spdx";
+export * from "./audit";
+export * from "./validator";
+export * from "./cli";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC"}

package/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./scanner"), exports);
+__exportStar(require("./cyclonedx"), exports);
+__exportStar(require("./spdx"), exports);
+__exportStar(require("./audit"), exports);
+__exportStar(require("./validator"), exports);
+__exportStar(require("./cli"), exports);
+//# sourceMappingURL=index.js.map

package/dist/scanner.d.ts

@@ -0,0 +1,4 @@
+import { CryptoAsset } from "./types";
+export declare function scanCode(sourceText: string, filename?: string): CryptoAsset[];
+export declare function scanDirectory(dirPath: string): CryptoAsset[];
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EAGZ,MAAM,SAAS,CAAC;AA8OjB,wBAAgB,QAAQ,CACtB,UAAU,EAAE,MAAM,EAClB,QAAQ,SAAY,GACnB,WAAW,EAAE,CA8Bf;AAKD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CA6C5D"}

package/dist/scanner.js

@@ -0,0 +1,289 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanCode = scanCode;
+exports.scanDirectory = scanDirectory;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const ASSET_RULES = [
+    {
+        pattern: /\bml[-_]?kem[-_]?512\b/i,
+        name: "ML-KEM-512",
+        algorithm: "ML-KEM",
+        type: "kem",
+        keySize: 512,
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 203",
+    },
+    {
+        pattern: /\bml[-_]?kem[-_]?768\b/i,
+        name: "ML-KEM-768",
+        algorithm: "ML-KEM",
+        type: "kem",
+        keySize: 768,
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 203",
+    },
+    {
+        pattern: /\bml[-_]?kem[-_]?1024\b/i,
+        name: "ML-KEM-1024",
+        algorithm: "ML-KEM",
+        type: "kem",
+        keySize: 1024,
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 203",
+    },
+    {
+        pattern: /\bml[-_]?dsa[-_]?44\b/i,
+        name: "ML-DSA-44",
+        algorithm: "ML-DSA",
+        type: "signature",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 204",
+    },
+    {
+        pattern: /\bml[-_]?dsa[-_]?65\b/i,
+        name: "ML-DSA-65",
+        algorithm: "ML-DSA",
+        type: "signature",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 204",
+    },
+    {
+        pattern: /\bml[-_]?dsa[-_]?87\b/i,
+        name: "ML-DSA-87",
+        algorithm: "ML-DSA",
+        type: "signature",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 204",
+    },
+    {
+        pattern: /\bslh[-_]?dsa\b/i,
+        name: "SLH-DSA",
+        algorithm: "SLH-DSA",
+        type: "signature",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 205",
+    },
+    {
+        pattern: /\baes[-_]?256[-_]?gcm\b/i,
+        name: "AES-256-GCM",
+        algorithm: "AES",
+        type: "cipher",
+        keySize: 256,
+        mode: "GCM",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST SP 800-38D",
+    },
+    {
+        pattern: /\baes[-_]?128[-_]?gcm\b/i,
+        name: "AES-128-GCM",
+        algorithm: "AES",
+        type: "cipher",
+        keySize: 128,
+        mode: "GCM",
+        resistanceLevel: "TRANSITIONAL_HYBRID",
+        standard: "NIST SP 800-38D",
+    },
+    {
+        pattern: /\baes[-_]?(?:128|256)[-_]?cbc\b/i,
+        name: "AES-CBC",
+        algorithm: "AES",
+        type: "cipher",
+        mode: "CBC",
+        resistanceLevel: "TRANSITIONAL_HYBRID",
+        standard: "NIST SP 800-38A",
+    },
+    {
+        pattern: /\baes[-_]?(?:128|256)[-_]?ecb\b/i,
+        name: "AES-ECB",
+        algorithm: "AES",
+        type: "cipher",
+        mode: "ECB",
+        resistanceLevel: "DEPRECATED_BROKEN",
+        standard: "INSECURE (NIST Disallowed)",
+    },
+    {
+        pattern: /\bchacha20[-_]?poly1305\b/i,
+        name: "ChaCha20-Poly1305",
+        algorithm: "ChaCha20",
+        type: "cipher",
+        keySize: 256,
+        mode: "Poly1305",
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "RFC 8439",
+    },
+    {
+        pattern: /\b(?:3des|des[-_]?ede3)\b/i,
+        name: "Triple-DES",
+        algorithm: "3DES",
+        type: "cipher",
+        resistanceLevel: "DEPRECATED_BROKEN",
+        standard: "DEPRECATED (NIST SP 800-131A)",
+    },
+    {
+        pattern: /\b(?:des|rc4|blowfish)\b/i,
+        name: "Legacy Cipher",
+        algorithm: "Legacy",
+        type: "cipher",
+        resistanceLevel: "DEPRECATED_BROKEN",
+        standard: "DEPRECATED (Broken)",
+    },
+    {
+        pattern: /\bed25519\b/i,
+        name: "Ed25519",
+        algorithm: "Ed25519",
+        type: "signature",
+        keySize: 256,
+        resistanceLevel: "VULNERABLE_CRQC",
+        standard: "RFC 8032",
+    },
+    {
+        pattern: /\b(?:ecdsa|ecdh|prime256v1|secp256r1|secp384r1)\b/i,
+        name: "ECDSA / ECDH",
+        algorithm: "ECC",
+        type: "signature",
+        resistanceLevel: "VULNERABLE_CRQC",
+        standard: "NIST FIPS 186-5",
+    },
+    {
+        pattern: /\brsa\b/i,
+        name: "RSA",
+        algorithm: "RSA",
+        type: "cipher",
+        resistanceLevel: "VULNERABLE_CRQC",
+        standard: "PKCS #1",
+    },
+    {
+        pattern: /\bsha[-_]?256\b/i,
+        name: "SHA-256",
+        algorithm: "SHA-2",
+        type: "hash",
+        keySize: 256,
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 180-4",
+    },
+    {
+        pattern: /\bsha[-_]?512\b/i,
+        name: "SHA-512",
+        algorithm: "SHA-2",
+        type: "hash",
+        keySize: 512,
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 180-4",
+    },
+    {
+        pattern: /\bsha[-_]?3[-_]?256\b/i,
+        name: "SHA3-256",
+        algorithm: "SHA-3",
+        type: "hash",
+        keySize: 256,
+        resistanceLevel: "QUANTUM_SAFE",
+        standard: "NIST FIPS 202",
+    },
+    {
+        pattern: /\b(?:md5|md4|ripemd160)\b/i,
+        name: "Broken Hash",
+        algorithm: "MD5/MD4",
+        type: "hash",
+        resistanceLevel: "DEPRECATED_BROKEN",
+        standard: "DEPRECATED (RFC 6151)",
+    },
+    {
+        pattern: /\bsha[-_]?1\b/i,
+        name: "SHA-1",
+        algorithm: "SHA-1",
+        type: "hash",
+        keySize: 160,
+        resistanceLevel: "DEPRECATED_BROKEN",
+        standard: "DEPRECATED (NIST SP 800-131A)",
+    },
+    {
+        pattern: /-----BEGIN CERTIFICATE-----/,
+        name: "X.509 Certificate",
+        algorithm: "X.509",
+        type: "certificate",
+        resistanceLevel: "VULNERABLE_CRQC",
+        standard: "RFC 5280",
+    },
+    {
+        pattern: /-----BEGIN (?:RSA|EC) PRIVATE KEY-----/,
+        name: "Private Key Material",
+        algorithm: "PKCS",
+        type: "key",
+        resistanceLevel: "VULNERABLE_CRQC",
+        standard: "RFC 7468",
+    },
+];
+function scanCode(sourceText, filename = "unknown") {
+    const assets = [];
+    const lines = sourceText.split(/\r?\n/);
+    const seenOnLine = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        for (const rule of ASSET_RULES) {
+            if (rule.pattern.test(line)) {
+                const dedupeKey = `${i}:${rule.name}`;
+                if (!seenOnLine.has(dedupeKey)) {
+                    seenOnLine.add(dedupeKey);
+                    assets.push({
+                        name: rule.name,
+                        algorithm: rule.algorithm,
+                        type: rule.type,
+                        keySize: rule.keySize,
+                        mode: rule.mode,
+                        quantumResistant: rule.resistanceLevel === "QUANTUM_SAFE",
+                        resistanceLevel: rule.resistanceLevel,
+                        standard: rule.standard,
+                        file: filename,
+                        line: i + 1,
+                    });
+                }
+            }
+        }
+    }
+    return assets;
+}
+function scanDirectory(dirPath) {
+    const assets = [];
+    if (!node_fs_1.default.existsSync(dirPath)) {
+        return assets;
+    }
+    const stat = node_fs_1.default.statSync(dirPath);
+    if (!stat.isDirectory()) {
+        const content = node_fs_1.default.readFileSync(dirPath, "utf8");
+        return scanCode(content, dirPath);
+    }
+    const entries = node_fs_1.default.readdirSync(dirPath, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.name === "node_modules" ||
+            entry.name === ".git" ||
+            entry.name === "dist") {
+            continue;
+        }
+        const fullPath = node_path_1.default.join(dirPath, entry.name);
+        if (entry.isDirectory()) {
+            assets.push(...scanDirectory(fullPath));
+        }
+        else {
+            const ext = node_path_1.default.extname(entry.name).toLowerCase();
+            if ([
+                ".ts",
+                ".js",
+                ".mjs",
+                ".cjs",
+                ".json",
+                ".pem",
+                ".crt",
+                ".key",
+            ].includes(ext)) {
+                const content = node_fs_1.default.readFileSync(fullPath, "utf8");
+                assets.push(...scanCode(content, fullPath));
+            }
+        }
+    }
+    return assets;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/spdx.d.ts

@@ -0,0 +1,7 @@
+import { CryptoAsset, SpdxCbom } from "./types";
+export interface SpdxOptions {
+    name?: string;
+    creator?: string;
+}
+export declare function generateSpdxCbom(assets: CryptoAsset[], options?: SpdxOptions): SpdxCbom;
+//# sourceMappingURL=spdx.d.ts.map

package/dist/spdx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdx.d.ts","sourceRoot":"","sources":["../src/spdx.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAe,MAAM,SAAS,CAAC;AAG7D,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,WAAW,EAAE,EACrB,OAAO,GAAE,WAAgB,GACxB,QAAQ,CA2BV"}

package/dist/spdx.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSpdxCbom = generateSpdxCbom;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const version_1 = require("./version");
+function generateSpdxCbom(assets, options = {}) {
+    const spdxId = `SPDXRef-CBOM-${node_crypto_1.default.randomUUID()}`;
+    const created = new Date().toISOString();
+    const elements = assets.map((asset, index) => {
+        return {
+            spdxId: `SPDXRef-CryptoAsset-${index + 1}`,
+            name: asset.name,
+            type: asset.type,
+            algorithm: asset.algorithm,
+            quantumSafe: asset.quantumResistant,
+            standard: asset.standard,
+        };
+    });
+    return {
+        spdxVersion: "SPDX-3.0.0",
+        spdxId,
+        name: options.name || "Crypto-Service-CBOM",
+        creationInfo: {
+            created,
+            creators: [
+                options.creator || `Tool: @sebastienrousseau/crypto-cbom-${version_1.VERSION}`,
+            ],
+        },
+        elements,
+    };
+}
+//# sourceMappingURL=spdx.js.map

package/dist/types.d.ts

@@ -0,0 +1,99 @@
+export type CryptographicAssetType = "algorithm" | "cipher" | "signature" | "kem" | "hash" | "key" | "certificate" | "protocol";
+export type QuantumResistanceLevel = "QUANTUM_SAFE" | "TRANSITIONAL_HYBRID" | "VULNERABLE_CRQC" | "DEPRECATED_BROKEN";
+export interface CryptoAsset {
+    name: string;
+    algorithm: string;
+    type: CryptographicAssetType;
+    keySize?: number | undefined;
+    mode?: string | undefined;
+    padding?: string | undefined;
+    quantumResistant: boolean;
+    resistanceLevel: QuantumResistanceLevel;
+    standard?: string | undefined;
+    file?: string | undefined;
+    line?: number | undefined;
+}
+export interface CycloneDxCryptoProperties {
+    assetType: CryptographicAssetType;
+    algorithmProperties?: {
+        primitive: string;
+        parameterSetIdentifier?: string | undefined;
+        curve?: string | undefined;
+        executionEnvironment?: string | undefined;
+        implementationPlatform?: string | undefined;
+        certificationLevel?: string | undefined;
+        mode?: string | undefined;
+        padding?: string | undefined;
+        cryptoFunctions?: string[] | undefined;
+        classicalSecurityLevel?: number | undefined;
+        nistQuantumSecurityLevel?: number | undefined;
+    } | undefined;
+    oid?: string | undefined;
+}
+export interface CycloneDxComponent {
+    type: "cryptographic-asset";
+    name: string;
+    version?: string | undefined;
+    purl?: string | undefined;
+    "crypto-properties": CycloneDxCryptoProperties;
+}
+export interface CycloneDxCbom {
+    bomFormat: "CycloneDX";
+    specVersion: "1.6";
+    serialNumber: string;
+    version: number;
+    metadata: {
+        timestamp: string;
+        tools: Array<{
+            vendor: string;
+            name: string;
+            version: string;
+        }>;
+        component?: {
+            name: string;
+            version?: string | undefined;
+            type: string;
+        } | undefined;
+    };
+    components: CycloneDxComponent[];
+}
+export interface SpdxElement {
+    spdxId: string;
+    name: string;
+    type: string;
+    algorithm: string;
+    quantumSafe: boolean;
+    standard?: string | undefined;
+}
+export interface SpdxCbom {
+    spdxVersion: "SPDX-3.0.0";
+    spdxId: string;
+    creationInfo: {
+        created: string;
+        creators: string[];
+    };
+    name: string;
+    elements: SpdxElement[];
+}
+export interface AuditFinding {
+    severity: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
+    asset: string;
+    rule: string;
+    reference: "NIST_SP_800_131A" | "NIST_IR_8547" | "CNSA_2_0";
+    description: string;
+    remediation: string;
+}
+export interface CbomAuditResult {
+    score: number;
+    status: "PASS" | "REVIEW" | "FAIL";
+    disclaimer: string;
+    totalAssets: number;
+    quantumSafeCount: number;
+    vulnerableCount: number;
+    deprecatedCount: number;
+    quantumSafeRatio: number;
+    findings: AuditFinding[];
+    migrationRoadmap: string[];
+}
+export type DoraAuditResult = CbomAuditResult;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,sBAAsB,GAC9B,WAAW,GACX,QAAQ,GACR,WAAW,GACX,KAAK,GACL,MAAM,GACN,KAAK,GACL,aAAa,GACb,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B,cAAc,GACd,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,sBAAsB,CAAC;IAClC,mBAAmB,CAAC,EAChB;QACE,SAAS,EAAE,MAAM,CAAC;QAClB,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5C,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1C,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5C,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QACvC,sBAAsB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5C,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/C,GACD,SAAS,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mBAAmB,EAAE,yBAAyB,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChE,SAAS,CAAC,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC7B,IAAI,EAAE,MAAM,CAAC;SACd,GACD,SAAS,CAAC;KACf,CAAC;IACF,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,YAAY,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,EAAE,kBAAkB,GAAG,cAAc,GAAG,UAAU,CAAC;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEnC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAGD,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/validator.d.ts

@@ -0,0 +1,6 @@
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+export declare function validateCbom(doc: unknown): ValidationResult;
+//# sourceMappingURL=validator.d.ts.map

package/dist/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../src/validator.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAKD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAuD3D"}

package/dist/validator.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCbom = validateCbom;
+function validateCbom(doc) {
+    const errors = [];
+    if (typeof doc !== "object" || doc === null) {
+        return { valid: false, errors: ["Document must be a non-null object"] };
+    }
+    const record = doc;
+    if (record.bomFormat === "CycloneDX") {
+        if (record.specVersion !== "1.6") {
+            errors.push(`Expected specVersion '1.6', got '${String(record.specVersion)}'`);
+        }
+        if (!record.serialNumber || typeof record.serialNumber !== "string") {
+            errors.push("Missing or invalid 'serialNumber'");
+        }
+        if (!Array.isArray(record.components)) {
+            errors.push("Missing or invalid 'components' array");
+        }
+        else {
+            for (let i = 0; i < record.components.length; i++) {
+                const comp = record.components[i];
+                if (!comp || comp.type !== "cryptographic-asset") {
+                    errors.push(`Component at index ${i} must have type 'cryptographic-asset'`);
+                }
+                if (!comp || !comp.name) {
+                    errors.push(`Component at index ${i} is missing 'name'`);
+                }
+            }
+        }
+        return { valid: errors.length === 0, errors };
+    }
+    if (typeof record.spdxVersion === "string" &&
+        record.spdxVersion.startsWith("SPDX-")) {
+        if (!record.spdxId || typeof record.spdxId !== "string") {
+            errors.push("Missing or invalid 'spdxId'");
+        }
+        if (!Array.isArray(record.elements)) {
+            errors.push("Missing or invalid 'elements' array");
+        }
+        return { valid: errors.length === 0, errors };
+    }
+    return {
+        valid: false,
+        errors: ["Unsupported document format. Expected CycloneDX 1.6 or SPDX 3.0"],
+    };
+}
+//# sourceMappingURL=validator.js.map

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,OAAO,EAAE,MAIb,CAAC"}

package/dist/version.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERSION = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.VERSION = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, "..", "package.json"), "utf8")).version;
+//# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@sebastienrousseau/crypto-cbom",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.7",
+  "description": "Cryptographic Bill of Materials (CBOM) generator and auditor compliant with CycloneDX 1.6, SPDX 3.0, EU DORA Articles 9/13, and CRA Article 14.",
+  "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
+  "license": "MIT OR Apache-2.0",
+  "homepage": "https://crypto-service.co",
+  "repository": {
+    "directory": "packages/crypto-cbom",
+    "type": "git",
+    "url": "git@github.com:sebastienrousseau/crypto-service.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sebastienrousseau/crypto-service/issues"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "bin": {
+    "crypto-cbom": "./dist/cli.js"
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map"
+  ],
+  "dependencies": {
+    "@sebastienrousseau/crypto-lib": "0.0.7"
+  },
+  "devDependencies": {
+    "@types/chai": "^4.3.7",
+    "@types/chai-as-promised": "^8.0.2",
+    "@types/mocha": "^10.0.2",
+    "@types/node": "^26.4.1",
+    "c8": "^12.0.0",
+    "chai": "^4.5.0",
+    "chai-as-promised": "^7.1.2",
+    "mocha": "^10.8.2",
+    "rimraf": "^6.1.3",
+    "ts-node": "^10.9.2",
+    "typedoc": "^0.28.20",
+    "typescript": "~5.9.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.json",
+    "clean": "rimraf ./coverage ./dist ./docs",
+    "lint": "eslint --ext .ts src __tests__",
+    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "format": "prettier --write src/**/*.ts",
+    "format:check": "prettier --check \"src/**/*.ts\"",
+    "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
+    "docs": "typedoc"
+  }
 }