{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:8f5164f3-47fa-45e6-a1ed-9a4a85e1c6be",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-16T01:06:28Z",
    "tools": {
      "components": [
        {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.6",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.6",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.6",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "OWASP Foundation"
      }
    ],
    "lifecycles": [
      {
        "phase": "pre-build"
      }
    ],
    "component": {
      "name": "mastra",
      "group": "@ag-ui",
      "version": "2.0.1",
      "purl": "pkg:npm/%40ag-ui/mastra@2.0.1",
      "bom-ref": "pkg:npm/@ag-ui/mastra@2.0.1",
      "properties": [
        {
          "name": "cdx:npm:scripts",
          "value": "build, dev, clean, typecheck, test, test:coverage, test:watch, test:exports, link:global, unlink:global"
        },
        {
          "name": "cdx:npm:buildScripts",
          "value": "build, test:watch"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "type": "application",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/ag-ui-protocol/ag-ui.git"
        }
      ]
    },
    "properties": [
      {
        "name": "cdx:bom:componentTypes",
        "value": "npm"
      },
      {
        "name": "cdx:bom:componentNamespaces",
        "value": "@ag-ui\\n@ai-sdk\\n@arethetypeswrong\\n@copilotkit\\n@mastra\\n@types\\n@vitest"
      },
      {
        "name": "cdx:bom:componentSrcFiles",
        "value": "examples/node_modules/@ag-ui/mastra/package.json\\nexamples/node_modules/@mastra/client-js/package.json\\nexamples/node_modules/@mastra/core/package.json\\nexamples/node_modules/@mastra/libsql/package.json\\nexamples/node_modules/@mastra/loggers/package.json\\nexamples/node_modules/@mastra/memory/package.json\\nexamples/node_modules/@types/node/package.json\\nexamples/node_modules/mastra/package.json\\nexamples/node_modules/typescript/package.json\\nexamples/node_modules/zod/package.json\\nnode_modules/@ag-ui/a2ui-toolkit/package.json\\nnode_modules/@ag-ui/client/package.json\\nnode_modules/@ag-ui/core/package.json\\nnode_modules/@ai-sdk/ui-utils/package.json\\nnode_modules/@arethetypeswrong/cli/package.json\\nnode_modules/@copilotkit/runtime/package.json\\nnode_modules/@copilotkit/shared/package.json\\nnode_modules/@mastra/client-js/package.json\\nnode_modules/@mastra/core/package.json\\nnode_modules/@types/node/package.json\\nnode_modules/@vitest/coverage-istanbul/package.json\\nnode_modules/fast-json-patch/package.json\\nnode_modules/publint/package.json\\nnode_modules/rxjs/package.json\\nnode_modules/tsdown/package.json\\nnode_modules/typescript/package.json\\nnode_modules/vitest/package.json\\nnode_modules/zod/package.json"
      }
    ]
  },
  "components": [
    {
      "authors": [
        {
          "name": "Colin McDonnell <zod@colinhacks.com>"
        }
      ],
      "group": "",
      "name": "zod",
      "version": "3.25.76",
      "description": "TypeScript-first schema declaration and validation library with static type inference",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/zod@3.25.76",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://zod.dev"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/colinhacks/zod.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/zod@3.25.76",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/zod/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "zod,zod/z"
        },
        {
          "name": "SrcFile",
          "value": "examples/node_modules/zod/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/zod/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/zod/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/a2ui-tool-CD0w1hhG.mjs",
            "line": 1
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 54
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 109
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 110
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 114
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 118
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 125
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 126
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 127
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 128
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 132
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 133
          }
        ]
      },
      "tags": [
        "validation"
      ]
    },
    {
      "authors": [
        {
          "name": "Anthony Fu <anthonyfu117@hotmail.com>"
        }
      ],
      "group": "",
      "name": "vitest",
      "version": "4.0.18",
      "description": "Next generation testing framework powered by Vite",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/vitest@4.0.18",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://vitest.dev"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/vitest-dev/vitest.git"
        }
      ],
      "type": "framework",
      "bom-ref": "pkg:npm/vitest@4.0.18",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/vitest/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/vitest/package.json"
              }
            ],
            "concludedValue": "node_modules/vitest/package.json"
          }
        ]
      },
      "tags": [
        "framework"
      ]
    },
    {
      "authors": [
        {
          "name": "Microsoft Corp."
        }
      ],
      "group": "",
      "name": "typescript",
      "version": "5.9.3",
      "description": "TypeScript is a language for application scale JavaScript development",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/typescript@5.9.3",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://www.typescriptlang.org/"
        },
        {
          "type": "vcs",
          "url": "https://github.com/microsoft/TypeScript.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/typescript@5.9.3",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/typescript/package.json"
        },
        {
          "name": "SrcFile",
          "value": "examples/node_modules/typescript/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/typescript/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/typescript/package.json"
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Kevin Deng <sxzz@sxzz.moe>"
        }
      ],
      "group": "",
      "name": "tsdown",
      "version": "0.20.1",
      "description": "The Elegant Bundler for Libraries",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/tsdown@0.20.1",
      "externalReferences": [
        {
          "type": "website",
          "url": "http://tsdown.dev/"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/rolldown/tsdown.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/tsdown@0.20.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/tsdown/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/tsdown/package.json"
              }
            ],
            "concludedValue": "node_modules/tsdown/package.json"
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Ben Lesh <ben@benlesh.com>"
        }
      ],
      "group": "",
      "name": "rxjs",
      "version": "7.8.1",
      "description": "Reactive Extensions for modern JavaScript",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/rxjs@7.8.1",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://rxjs.dev"
        },
        {
          "type": "vcs",
          "url": "https://github.com/reactivex/rxjs.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/rxjs@7.8.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/rxjs/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "rxjs,Observable,rxjs/Observable,Subscriber,rxjs/Subscriber"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/rxjs/package.json"
              }
            ],
            "concludedValue": "node_modules/rxjs/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 2
          },
          {
            "location": "src/mastra.ts",
            "line": 35
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 4
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Bjorn Lu"
        }
      ],
      "group": "",
      "name": "publint",
      "version": "0.3.17",
      "description": "Lint packaging errors",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/publint@0.3.17",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://publint.dev"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/publint/publint.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/publint@0.3.17",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/publint/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/publint/package.json"
              }
            ],
            "concludedValue": "node_modules/publint/package.json"
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Joachim Wester <joachimwester@me.com> (http://www.starcounter.com/)"
        }
      ],
      "group": "",
      "name": "fast-json-patch",
      "version": "3.1.1",
      "description": "Fast implementation of JSON-Patch (RFC-6902) with duplex (observe changes) capabilities",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/fast-json-patch@3.1.1",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/Starcounter-Jack/JSON-Patch"
        },
        {
          "type": "vcs",
          "url": "git://github.com/Starcounter-Jack/JSON-Patch.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/fast-json-patch@3.1.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/fast-json-patch/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "fast-json-patch"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/fast-json-patch/package.json"
              }
            ],
            "concludedValue": "node_modules/fast-json-patch/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 2
          },
          {
            "location": "src/mastra.ts",
            "line": 33
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Anthony Fu <anthonyfu117@hotmail.com>"
        }
      ],
      "group": "@vitest",
      "name": "coverage-istanbul",
      "version": "4.0.18",
      "description": "Istanbul coverage provider for Vitest",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40vitest/coverage-istanbul@4.0.18",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/vitest-dev/vitest/tree/main/packages/coverage-istanbul#readme"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/vitest-dev/vitest.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@vitest/coverage-istanbul@4.0.18",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@vitest/coverage-istanbul/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@vitest/coverage-istanbul/package.json"
              }
            ],
            "concludedValue": "node_modules/@vitest/coverage-istanbul/package.json"
          }
        ]
      },
      "tags": [
        "test"
      ]
    },
    {
      "group": "@types",
      "name": "node",
      "version": "20.19.21",
      "description": "TypeScript definitions for node",
      "scope": "excluded",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40types/node@20.19.21",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node"
        },
        {
          "type": "vcs",
          "url": "https://github.com/DefinitelyTyped/DefinitelyTyped.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@types/node@20.19.21",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@types/node/package.json"
        },
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@types/node/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@types/node/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@types/node/package.json"
          }
        ]
      }
    },
    {
      "group": "@mastra",
      "name": "core",
      "version": "1.47.0",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40mastra/core@1.47.0",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://mastra.ai"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/mastra-ai/mastra.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@mastra/core@1.47.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@mastra/core/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@mastra/core/tools,createTool,@mastra/core/tools/createTool,@mastra/core/agent,Agent,@mastra/core/agent/Agent,@mastra/core/request-context,MASTRA_RESOURCE_ID_KEY,@mastra/core/request-context/MASTRA_RESOURCE_ID_KEY,RequestContext,@mastra/core/request-context/RequestContext,@mastra/core/server,registerApiRoute,@mastra/core/server/registerApiRoute,ContextWithMastra,@mastra/core/server/ContextWithMastra,@mastra/core,Mastra,@mastra/core/Mastra,@mastra/core/llm,CoreMessage,@mastra/core/llm/CoreMessage"
        },
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@mastra/core/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@mastra/core/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@mastra/core/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/a2ui-tool-CD0w1hhG.mjs",
            "line": 1
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 52
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 261
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 370
          },
          {
            "location": "dist/a2ui-tool-LioaBmzs.d.mts",
            "line": 2
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 53
          },
          {
            "location": "src/mastra.ts",
            "line": 30
          },
          {
            "location": "src/utils.ts",
            "line": 6
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 5
          },
          {
            "location": "dist/copilotkit.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 2
          },
          {
            "location": "src/copilotkit.ts",
            "line": 11
          },
          {
            "location": "src/mastra.ts",
            "line": 31
          },
          {
            "location": "src/utils.ts",
            "line": 7
          },
          {
            "location": "dist/copilotkit.d.mts",
            "line": 3
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 3
          },
          {
            "location": "src/copilotkit.ts",
            "line": 12
          },
          {
            "location": "src/copilotkit.ts",
            "line": 68
          },
          {
            "location": "dist/copilotkit.d.mts",
            "line": 5
          },
          {
            "location": "dist/copilotkit.d.mts",
            "line": 6
          },
          {
            "location": "src/utils.ts",
            "line": 4
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 7
          },
          {
            "location": "src/utils.ts",
            "line": 5
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 8
          }
        ]
      }
    },
    {
      "group": "@mastra",
      "name": "client-js",
      "version": "1.28.0",
      "description": "The official TypeScript library for the Mastra Client API",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40mastra/client-js@1.28.0",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://mastra.ai"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/mastra-ai/mastra.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@mastra/client-js@1.28.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@mastra/client-js/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@mastra/client-js,MastraClient,@mastra/client-js/MastraClient"
        },
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@mastra/client-js/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@mastra/client-js/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@mastra/client-js/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "src/mastra.ts",
            "line": 36
          },
          {
            "location": "src/utils.ts",
            "line": 3
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 6
          }
        ]
      }
    },
    {
      "group": "@copilotkit",
      "name": "shared",
      "version": "1.76.0",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40copilotkit/shared@1.76.0",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/CopilotKit/CopilotKit"
        },
        {
          "type": "vcs",
          "url": "https://github.com/CopilotKit/CopilotKit.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@copilotkit/shared@1.76.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@copilotkit/shared/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@copilotkit/shared/package.json"
              }
            ],
            "concludedValue": "node_modules/@copilotkit/shared/package.json"
          }
        ]
      }
    },
    {
      "group": "@copilotkit",
      "name": "runtime",
      "version": "1.76.0",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40copilotkit/runtime@1.76.0",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/CopilotKit/CopilotKit"
        },
        {
          "type": "vcs",
          "url": "https://github.com/CopilotKit/CopilotKit.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@copilotkit/runtime@1.76.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@copilotkit/runtime/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@copilotkit/runtime/v2,CopilotRuntime,@copilotkit/runtime/v2/CopilotRuntime,createCopilotRuntimeHandler,@copilotkit/runtime/v2/createCopilotRuntimeHandler,AgentsConfig,@copilotkit/runtime/v2/AgentsConfig,CopilotCorsConfig,@copilotkit/runtime/v2/CopilotCorsConfig,CopilotRuntimeOptions,@copilotkit/runtime/v2/CopilotRuntimeOptions"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@copilotkit/runtime/package.json"
              }
            ],
            "concludedValue": "node_modules/@copilotkit/runtime/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/copilotkit.mjs",
            "line": 1
          },
          {
            "location": "src/copilotkit.ts",
            "line": 7
          },
          {
            "location": "src/copilotkit.ts",
            "line": 96
          },
          {
            "location": "dist/copilotkit.d.mts",
            "line": 4
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Andrew Branch & ej-shafran"
        }
      ],
      "group": "@arethetypeswrong",
      "name": "cli",
      "version": "0.17.4",
      "description": "A CLI tool for arethetypeswrong.github.io",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40arethetypeswrong/cli@0.17.4",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/arethetypeswrong/arethetypeswrong.github.io.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@arethetypeswrong/cli@0.17.4",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@arethetypeswrong/cli/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@arethetypeswrong/cli/package.json"
              }
            ],
            "concludedValue": "node_modules/@arethetypeswrong/cli/package.json"
          }
        ]
      },
      "tags": [
        "cli"
      ]
    },
    {
      "group": "@ai-sdk",
      "name": "ui-utils",
      "version": "1.2.11",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40ai-sdk/ui-utils@1.2.11",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://ai-sdk.dev/docs"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/vercel/ai.git"
        }
      ],
      "type": "framework",
      "bom-ref": "pkg:npm/@ai-sdk/ui-utils@1.2.11",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@ai-sdk/ui-utils/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@ai-sdk/ui-utils,parsePartialJson,@ai-sdk/ui-utils/parsePartialJson"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@ai-sdk/ui-utils/package.json"
              }
            ],
            "concludedValue": "node_modules/@ai-sdk/ui-utils/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 2
          },
          {
            "location": "src/mastra.ts",
            "line": 34
          },
          {
            "location": "src/mastra.ts",
            "line": 244
          },
          {
            "location": "src/mastra.ts",
            "line": 255
          }
        ]
      },
      "tags": [
        "framework"
      ]
    },
    {
      "authors": [
        {
          "name": "Markus Ecker <markus.ecker@gmail.com>"
        }
      ],
      "group": "@ag-ui",
      "name": "core",
      "version": "1.0.2",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40ag-ui/core@1.0.2",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/ag-ui-protocol/ag-ui.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@ag-ui/core@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@ag-ui/core/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@ag-ui/core,tokenUsageFromAiSdkUsage,@ag-ui/core/tokenUsageFromAiSdkUsage,TokenUsage,@ag-ui/core/TokenUsage"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@ag-ui/core/package.json"
              }
            ],
            "concludedValue": "node_modules/@ag-ui/core/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 2
          },
          {
            "location": "src/mastra.ts",
            "line": 29
          },
          {
            "location": "src/mastra.ts",
            "line": 1790
          }
        ]
      }
    },
    {
      "authors": [
        {
          "name": "Markus Ecker <markus.ecker@gmail.com>"
        }
      ],
      "group": "@ag-ui",
      "name": "client",
      "version": "1.0.2",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40ag-ui/client@1.0.2",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/ag-ui-protocol/ag-ui.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@ag-ui/client@1.0.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@ag-ui/client/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@ag-ui/client,AbstractAgent,@ag-ui/client/AbstractAgent,EventType,@ag-ui/client/EventType,PROTOCOL_VERSION,@ag-ui/client/PROTOCOL_VERSION,contentToText,@ag-ui/client/contentToText,randomUUID,@ag-ui/client/randomUUID,RunAgentInput,@ag-ui/client/RunAgentInput,ActivityDeltaEvent,@ag-ui/client/ActivityDeltaEvent,ActivitySnapshotEvent,@ag-ui/client/ActivitySnapshotEvent,AgentCapabilities,@ag-ui/client/AgentCapabilities,AgentConfig,@ag-ui/client/AgentConfig,BaseEvent,@ag-ui/client/BaseEvent,Interrupt,@ag-ui/client/Interrupt,Message,@ag-ui/client/Message,ReasoningEncryptedValueEvent,@ag-ui/client/ReasoningEncryptedValueEvent,ReasoningStartEvent,@ag-ui/client/ReasoningStartEvent,ReasoningMessageStartEvent,@ag-ui/client/ReasoningMessageStartEvent,ReasoningMessageContentEvent,@ag-ui/client/ReasoningMessageContentEvent,ReasoningMessageEndEvent,@ag-ui/client/ReasoningMessageEndEvent,ReasoningEndEvent,@ag-ui/client/ReasoningEndEvent,RunErrorEvent,@ag-ui/client/RunErrorEvent,RunFinishedEvent,@ag-ui/client/RunFinishedEvent,RunFinishedOutcome,@ag-ui/client/RunFinishedOutcome,RunStartedEvent,@ag-ui/client/RunStartedEvent,StateDeltaEvent,@ag-ui/client/StateDeltaEvent,StateSnapshotEvent,@ag-ui/client/StateSnapshotEvent,TextMessageChunkEvent,@ag-ui/client/TextMessageChunkEvent,ToolCallArgsEvent,@ag-ui/client/ToolCallArgsEvent,ToolCallEndEvent,@ag-ui/client/ToolCallEndEvent,ToolCallResultEvent,@ag-ui/client/ToolCallResultEvent,ToolCallStartEvent,@ag-ui/client/ToolCallStartEvent,ContentPart,@ag-ui/client/ContentPart,PartSource,@ag-ui/client/PartSource,TextPart,@ag-ui/client/TextPart"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@ag-ui/client/package.json"
              }
            ],
            "concludedValue": "node_modules/@ag-ui/client/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 1
          },
          {
            "location": "dist/mastra-DRjl01F4.mjs",
            "line": 2
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 55
          },
          {
            "location": "src/mastra.ts",
            "line": 27
          },
          {
            "location": "src/mastra.ts",
            "line": 28
          },
          {
            "location": "src/mastra.ts",
            "line": 32
          },
          {
            "location": "src/mastra.ts",
            "line": 451
          },
          {
            "location": "src/mastra.ts",
            "line": 985
          },
          {
            "location": "src/mastra.ts",
            "line": 2023
          },
          {
            "location": "src/mastra.ts",
            "line": 2164
          },
          {
            "location": "src/mastra.ts",
            "line": 2188
          },
          {
            "location": "src/tool-results.ts",
            "line": 1
          },
          {
            "location": "src/utils.ts",
            "line": 1
          },
          {
            "location": "src/utils.ts",
            "line": 2
          },
          {
            "location": "src/utils.ts",
            "line": 486
          },
          {
            "location": "dist/a2ui-tool-LioaBmzs.d.mts",
            "line": 1
          },
          {
            "location": "dist/mastra-O5yyVnrx.d.mts",
            "line": 2
          }
        ]
      },
      "tags": [
        "encrypt"
      ]
    },
    {
      "group": "@ag-ui",
      "name": "a2ui-toolkit",
      "version": "0.0.5",
      "description": "Framework-agnostic helpers for building A2UI subagent tools — op builders, prompt assembly, history walkers, and request/envelope orchestration shared across framework adapters.",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "url": "https://opensource.org/licenses/MIT",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40ag-ui/a2ui-toolkit@0.0.5",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/ag-ui-protocol/ag-ui.git"
        }
      ],
      "type": "framework",
      "bom-ref": "pkg:npm/@ag-ui/a2ui-toolkit@0.0.5",
      "properties": [
        {
          "name": "SrcFile",
          "value": "node_modules/@ag-ui/a2ui-toolkit/package.json"
        },
        {
          "name": "ImportedModules",
          "value": "@ag-ui/a2ui-toolkit,GENERATE_A2UI_ARG_DESCRIPTIONS,@ag-ui/a2ui-toolkit/GENERATE_A2UI_ARG_DESCRIPTIONS,GENERATE_A2UI_TOOL_NAME,@ag-ui/a2ui-toolkit/GENERATE_A2UI_TOOL_NAME,RENDER_A2UI_TOOL_DEF,@ag-ui/a2ui-toolkit/RENDER_A2UI_TOOL_DEF,buildA2UIEnvelope,@ag-ui/a2ui-toolkit/buildA2UIEnvelope,prepareA2UIRequest,@ag-ui/a2ui-toolkit/prepareA2UIRequest,resolveA2UICatalog,@ag-ui/a2ui-toolkit/resolveA2UICatalog,resolveA2UIToolParams,@ag-ui/a2ui-toolkit/resolveA2UIToolParams,runA2UIGenerationWithRecovery,@ag-ui/a2ui-toolkit/runA2UIGenerationWithRecovery,splitA2UISchemaContext,@ag-ui/a2ui-toolkit/splitA2UISchemaContext,wrapErrorEnvelope,@ag-ui/a2ui-toolkit/wrapErrorEnvelope,A2UIGuidelines,@ag-ui/a2ui-toolkit/A2UIGuidelines,A2UIToolParams,@ag-ui/a2ui-toolkit/A2UIToolParams,A2UIAttemptRecord,@ag-ui/a2ui-toolkit/A2UIAttemptRecord,A2UIRecoveryConfig,@ag-ui/a2ui-toolkit/A2UIRecoveryConfig,A2UIValidationCatalog,@ag-ui/a2ui-toolkit/A2UIValidationCatalog"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "node_modules/@ag-ui/a2ui-toolkit/package.json"
              }
            ],
            "concludedValue": "node_modules/@ag-ui/a2ui-toolkit/package.json"
          }
        ],
        "occurrences": [
          {
            "location": "dist/a2ui-tool-CD0w1hhG.mjs",
            "line": 1
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 72
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 367
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 391
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 399
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 407
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 415
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 429
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 568
          },
          {
            "location": "src/a2ui-tool.ts",
            "line": 574
          },
          {
            "location": "dist/a2ui-tool-LioaBmzs.d.mts",
            "line": 3
          }
        ]
      },
      "tags": [
        "framework",
        "tools"
      ]
    },
    {
      "group": "",
      "name": "mastra",
      "version": "1.16.0",
      "description": "cli for mastra",
      "scope": "optional",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/mastra@1.16.0",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://mastra.ai"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/mastra-ai/mastra.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/mastra@1.16.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "examples/node_modules/mastra/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/mastra/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/mastra/package.json"
          }
        ]
      }
    },
    {
      "group": "@mastra",
      "name": "memory",
      "version": "1.21.2",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40mastra/memory@1.21.2",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://mastra.ai"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/mastra-ai/mastra.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@mastra/memory@1.21.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@mastra/memory/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@mastra/memory/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@mastra/memory/package.json"
          }
        ]
      }
    },
    {
      "group": "@mastra",
      "name": "loggers",
      "version": "1.2.0",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40mastra/loggers@1.2.0",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://mastra.ai"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/mastra-ai/mastra.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@mastra/loggers@1.2.0",
      "properties": [
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@mastra/loggers/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@mastra/loggers/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@mastra/loggers/package.json"
          }
        ]
      }
    },
    {
      "group": "@mastra",
      "name": "libsql",
      "version": "1.14.2",
      "description": "Libsql provider for Mastra - includes both vector and db storage capabilities",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40mastra/libsql@1.14.2",
      "externalReferences": [
        {
          "type": "website",
          "url": "https://mastra.ai"
        },
        {
          "type": "vcs",
          "url": "git+https://github.com/mastra-ai/mastra.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@mastra/libsql@1.14.2",
      "properties": [
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@mastra/libsql/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@mastra/libsql/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@mastra/libsql/package.json"
          }
        ]
      }
    },
    {
      "group": "@ag-ui",
      "name": "mastra",
      "version": "2.0.1",
      "scope": "required",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "url": "https://opensource.org/licenses/Apache-2.0",
            "properties": [
              {
                "name": "cdx:license:category",
                "value": "Permissive"
              },
              {
                "name": "cdx:license:foss",
                "value": "true"
              },
              {
                "name": "cdx:license:osiApproved",
                "value": "true"
              },
              {
                "name": "cdx:license:fsfLibre",
                "value": "true"
              },
              {
                "name": "cdx:license:deprecated",
                "value": "false"
              }
            ]
          }
        }
      ],
      "purl": "pkg:npm/%40ag-ui/mastra@2.0.1",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://github.com/ag-ui-protocol/ag-ui.git"
        }
      ],
      "type": "library",
      "bom-ref": "pkg:npm/@ag-ui/mastra@2.0.1",
      "properties": [
        {
          "name": "SrcFile",
          "value": "examples/node_modules/@ag-ui/mastra/package.json"
        },
        {
          "name": "cdx:license:category",
          "value": "Permissive"
        }
      ],
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 0.7,
            "methods": [
              {
                "technique": "manifest-analysis",
                "confidence": 0.7,
                "value": "examples/node_modules/@ag-ui/mastra/package.json"
              }
            ],
            "concludedValue": "examples/node_modules/@ag-ui/mastra/package.json"
          }
        ]
      }
    }
  ],
  "dependencies": [],
  "annotations": [
    {
      "bom-ref": "metadata-annotations",
      "subjects": [
        "pkg:npm/@ag-ui/mastra@2.0.1"
      ],
      "annotator": {
        "component": {
          "group": "@cyclonedx",
          "name": "cdxgen",
          "version": "12.8.6",
          "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.6",
          "type": "application",
          "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.6",
          "publisher": "OWASP Foundation",
          "authors": [
            {
              "name": "OWASP Foundation"
            }
          ]
        }
      },
      "timestamp": "2026-10-16T01:06:28Z",
      "text": "This Software Bill-of-Materials (SBOM) document was created on Friday, October 16, 2026 with cdxgen. The data was captured during the pre-build lifecycle phase without building the application. The document describes an application named 'mastra' with version '2.0.1'. The package type in this SBOM is npm with 7 purl namespaces described under components. The components were identified from 28 source files."
    }
  ]
}