{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": {
    "component": {
      "type": "application",
      "name": "riskrouter",
      "bom-ref": "riskrouter",
      "version": "edd7438f15280bf20665a50d258e889dd6bfcb17"
    },
    "properties": [
      {
        "name": "riskrouter:statement",
        "value": "No third-party package runs in production. Each Worker is built only from the files listed, and their SHA-256 hashes identify the exact source. GET /api/v1/health names the deployed commit."
      }
    ]
  },
  "components": [
    {
      "type": "application",
      "bom-ref": "riskrouter-api",
      "name": "riskrouter-api",
      "description": "Public API: pricing, ledger, evidence log",
      "properties": [
        {
          "name": "riskrouter:modules",
          "value": "worker.js tools/merkle.mjs"
        },
        {
          "name": "riskrouter:third-party-runtime-dependencies",
          "value": "0"
        }
      ]
    },
    {
      "type": "application",
      "bom-ref": "riskrouter-admin",
      "name": "riskrouter-admin",
      "description": "Admin console behind Cloudflare Access",
      "properties": [
        {
          "name": "riskrouter:modules",
          "value": "admin-worker.js admin-summary.js"
        },
        {
          "name": "riskrouter:third-party-runtime-dependencies",
          "value": "0"
        }
      ]
    },
    {
      "type": "application",
      "bom-ref": "riskrouter-notify",
      "name": "riskrouter-notify",
      "description": "Cron-only notifier for contact enquiries",
      "properties": [
        {
          "name": "riskrouter:modules",
          "value": "notify-worker.js"
        },
        {
          "name": "riskrouter:third-party-runtime-dependencies",
          "value": "0"
        }
      ]
    },
    {
      "type": "file",
      "bom-ref": "file:worker.js",
      "name": "worker.js",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "2c9b0b2a9b7411f5727dc64c6e57c3ef91e434e5105d28584a2ccb856aa37f9a"
        }
      ]
    },
    {
      "type": "file",
      "bom-ref": "file:tools/merkle.mjs",
      "name": "tools/merkle.mjs",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "c32ba3e6d7b573c312ad9ab089a4d78b199079717e4cbf66ea0fcee6bdb47df4"
        }
      ]
    },
    {
      "type": "file",
      "bom-ref": "file:admin-worker.js",
      "name": "admin-worker.js",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "a07503aac80b6413b06f821187dd771d6a2032a2be90a29e74b722ddf5fbcd50"
        }
      ]
    },
    {
      "type": "file",
      "bom-ref": "file:admin-summary.js",
      "name": "admin-summary.js",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "9e0bd63b1b426ec458c09ec974cceba2ad60b0a333055dabf52862611acc9f4f"
        }
      ]
    },
    {
      "type": "file",
      "bom-ref": "file:notify-worker.js",
      "name": "notify-worker.js",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "57d815bbfd65079ce05df1e72f1a6edd0c451e7f86e97caf5b5e5657d8dd9a2b"
        }
      ]
    },
    {
      "type": "library",
      "name": "wrangler",
      "version": "4.137.0",
      "purl": "pkg:npm/wrangler@4.137.0",
      "scope": "excluded",
      "description": "Deploy tool. Bundles and uploads the Workers; not part of them."
    },
    {
      "type": "library",
      "name": "tailwindcss",
      "version": "3.4.19",
      "purl": "pkg:npm/tailwindcss@3.4.19",
      "scope": "excluded",
      "description": "Build tool. Produces the site stylesheet at build time."
    },
    {
      "type": "library",
      "name": "axe-core",
      "version": "4.13.0",
      "purl": "pkg:npm/axe-core@4.13.0",
      "scope": "excluded",
      "description": "Test tool. Checks every page against WCAG 2.1 AA in CI; never deployed."
    },
    {
      "type": "library",
      "name": "playwright",
      "version": "1.63.0",
      "purl": "pkg:npm/playwright@1.63.0",
      "scope": "excluded",
      "description": "Test tool. Drives the console in a browser in CI; never deployed."
    }
  ],
  "dependencies": [
    {
      "ref": "riskrouter-api",
      "dependsOn": [
        "file:worker.js",
        "file:tools/merkle.mjs"
      ]
    },
    {
      "ref": "riskrouter-admin",
      "dependsOn": [
        "file:admin-worker.js",
        "file:admin-summary.js"
      ]
    },
    {
      "ref": "riskrouter-notify",
      "dependsOn": [
        "file:notify-worker.js"
      ]
    }
  ]
}