{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0373903f-5d50-8176-91ed-50052ed88f53",
  "version": 1,
  "metadata": {
    "timestamp": "2026-09-29T08:58:24Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "awa-sbom",
          "version": "0.1.0"
        }
      ]
    },
    "manufacturer": {
      "name": "AwaCloud"
    },
    "component": {
      "type": "library",
      "bom-ref": "awacloud-tool-fw-codegen",
      "group": "@awacloud",
      "name": "tool-fw-codegen",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/tool-fw-codegen@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "tools/fw-codegen/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "Apache-2.0"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/tool-fw-codegen].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L2"
        }
      ]
    },
    "properties": [
      {
        "name": "awa:git:commit",
        "value": "3db192243e60d589e0a96d5d76c347bf213f8a00"
      },
      {
        "name": "awa:paths:relative-to",
        "value": "repository root at the generation commit"
      },
      {
        "name": "awa:scope",
        "value": "full: @awacloud/facturx + @awacloud/fonts + @awacloud/fw + @awacloud/fw-wasm-crypto + @awacloud/md + @awacloud/oconv + @awacloud/oconv-fonts + @awacloud/odf + @awacloud/ooxml + @awacloud/pdf + @awacloud/tool-convert + @awacloud/tool-facturx-rules + @awacloud/tool-facturx-validate + @awacloud/tool-fw-bundler + @awacloud/tool-fw-codegen + @awacloud/tool-wasm-crypto (+ 7 vendored trees) — the 16 awf.config.json distribution rows"
      },
      {
        "name": "awa:timestamp:source",
        "value": "committer date of the generation commit (git show -s --format=%ct)"
      }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "awacloud-facturx",
      "group": "@awacloud",
      "name": "facturx",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/facturx@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/facturx/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/facturx].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L0"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-fonts",
      "group": "@awacloud",
      "name": "fonts",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/fonts@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/fonts/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/fonts].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L4"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-fw",
      "group": "@awacloud",
      "name": "fw",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/fw@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/fw/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/fw-wasm-crypto workspace:* — 22 committed .wasm under src/crypto/wasm/ are built from it (root package.json quality:wasm-drift)"
        },
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-bundler workspace:*"
        },
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "Apache-2.0"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/fw].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L3"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-fw-wasm-crypto",
      "group": "@awacloud",
      "name": "fw-wasm-crypto",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/fw-wasm-crypto@0.1.0",
      "externalReferences": [
        {
          "type": "license",
          "url": "packages/front/fw-wasm-crypto/vendor/NOTICE"
        },
        {
          "type": "other",
          "url": "packages/front/fw-wasm-crypto/package.json",
          "comment": "source manifest at the generation commit"
        },
        {
          "type": "other",
          "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
          "comment": "6 vendored trees, version 1"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-wasm-crypto workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "Apache-2.0"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/fw-wasm-crypto].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L3"
        },
        {
          "name": "awa:role",
          "value": "build-asset"
        }
      ],
      "components": [
        {
          "type": "library",
          "bom-ref": "vendor-bearssl",
          "name": "bearssl",
          "version": "v0.6",
          "supplier": {
            "name": "AwaCloud"
          },
          "authors": [
            {
              "name": "Thomas Pornin",
              "email": "pornin@bolet.org"
            }
          ],
          "licenses": [
            {
              "expression": "MIT",
              "acknowledgement": "declared"
            }
          ],
          "copyright": "Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>",
          "externalReferences": [
            {
              "type": "distribution",
              "url": "https://bearssl.org/bearssl-0.6.tar.gz"
            },
            {
              "type": "license",
              "url": "packages/front/fw-wasm-crypto/vendor/NOTICE-bearssl"
            },
            {
              "type": "other",
              "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
              "comment": "trees[id=bearssl]"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:provenance:id",
              "value": "bearssl"
            },
            {
              "name": "awa:provenance:notice",
              "value": "BearSSL v0.6 (Thomas Pornin, bearssl.org). v0.6 beta, Aug 2018, never formally audited (accepted-debt per plan risk 2). See vendor/NOTICE-bearssl."
            },
            {
              "name": "awa:provenance:ref",
              "value": "v0.6"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "759d09cd1e850657301e60d6179fba4b1d11d743f7f34de821a5f6dffbb82a1f"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/fw-wasm-crypto/vendor/ (see packages/front/fw-wasm-crypto/vendor/NOTICE-bearssl for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-bearssl § Files vendored"
            }
          ]
        },
        {
          "type": "library",
          "bom-ref": "vendor-fiat-crypto",
          "name": "fiat-crypto",
          "version": "v0.1.6",
          "supplier": {
            "name": "AwaCloud"
          },
          "manufacturer": {
            "name": "the fiat-crypto authors"
          },
          "licenses": [
            {
              "expression": "MIT AND BSD-1-Clause AND Apache-2.0",
              "acknowledgement": "declared"
            }
          ],
          "copyright": "Copyright (c) 2015-2020 the fiat-crypto authors\nCopyright 2015-2020 the fiat-crypto authors\nCopyright (c) 2015-2020 the fiat-crypto authors",
          "externalReferences": [
            {
              "type": "distribution",
              "url": "https://github.com/mit-plv/fiat-crypto/archive/refs/tags/v0.1.6.tar.gz"
            },
            {
              "type": "license",
              "url": "packages/front/fw-wasm-crypto/vendor/NOTICE-fiat-crypto"
            },
            {
              "type": "other",
              "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
              "comment": "trees[id=fiat-crypto]"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:provenance:id",
              "value": "fiat-crypto"
            },
            {
              "name": "awa:provenance:notice",
              "value": "fiat-crypto machine-verified P-256/P-384/P-521 field arithmetic. See vendor/NOTICE-fiat-crypto."
            },
            {
              "name": "awa:provenance:ref",
              "value": "v0.1.6"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "b6a4a6ce5563b5b86ba1161801e0bbba60dd0c689b5b06abde36d91ab84b979a"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/fw-wasm-crypto/vendor/ (see packages/front/fw-wasm-crypto/vendor/NOTICE-fiat-crypto for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-fiat-crypto § Files vendored"
            }
          ]
        },
        {
          "type": "library",
          "bom-ref": "vendor-libsodium",
          "name": "libsodium",
          "version": "1.0.22-RELEASE",
          "supplier": {
            "name": "AwaCloud"
          },
          "manufacturer": {
            "name": "Frank Denis and contributors"
          },
          "licenses": [
            {
              "expression": "ISC",
              "acknowledgement": "declared"
            }
          ],
          "copyright": "Copyright (c) 2013-2024\nFrank Denis and contributors",
          "externalReferences": [
            {
              "type": "distribution",
              "url": "https://github.com/jedisct1/libsodium/archive/refs/tags/1.0.22-RELEASE.tar.gz"
            },
            {
              "type": "license",
              "url": "packages/front/fw-wasm-crypto/vendor/NOTICE-libsodium"
            },
            {
              "type": "other",
              "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
              "comment": "trees[id=libsodium]"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:provenance:id",
              "value": "libsodium"
            },
            {
              "name": "awa:provenance:notice",
              "value": "libsodium 1.0.22 ed25519 + curve25519 ref10 closure (jedisct1/libsodium, ISC). Field path fe_25_5 (32-bit); SHA-512+randombytes+sodium-utils seamed to the package's own csrc. See vendor/NOTICE-libsodium."
            },
            {
              "name": "awa:provenance:ref",
              "value": "1.0.22-RELEASE"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "acb6837051b26fd4cb80405d9a2a9d96b25184c3e65ac04bc4894008e6554688"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/fw-wasm-crypto/vendor/ (see packages/front/fw-wasm-crypto/vendor/NOTICE-libsodium for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-libsodium § Files vendored"
            }
          ]
        },
        {
          "type": "library",
          "bom-ref": "vendor-mlkem-native",
          "name": "mlkem-native",
          "version": "v1.2.0",
          "supplier": {
            "name": "AwaCloud"
          },
          "manufacturer": {
            "name": "The mlkem-native project authors"
          },
          "licenses": [
            {
              "expression": "Apache-2.0 AND MIT AND ISC AND CC0-1.0",
              "acknowledgement": "declared"
            }
          ],
          "copyright": "Copyright (c) The mlkem-native project authors\nCopyright (c) 2020 Dougall Johnson\nCopyright (c) 2022 Arm Limited",
          "externalReferences": [
            {
              "type": "distribution",
              "url": "https://github.com/pq-code-package/mlkem-native/archive/refs/tags/v1.2.0.tar.gz"
            },
            {
              "type": "license",
              "url": "packages/front/fw-wasm-crypto/vendor/NOTICE-mlkem-native"
            },
            {
              "type": "other",
              "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
              "comment": "trees[id=mlkem-native]"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:provenance:id",
              "value": "mlkem-native"
            },
            {
              "name": "awa:provenance:notice",
              "value": "mlkem-native v1.2.0 (PQ Code Package / PQCA). See vendor/NOTICE-mlkem-native."
            },
            {
              "name": "awa:provenance:ref",
              "value": "v1.2.0"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "377f0960ebab767ab2e4ad4bdb10d615dfcd530d575feeb572feb83e4aecbd33"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/fw-wasm-crypto/vendor/ (see packages/front/fw-wasm-crypto/vendor/NOTICE-mlkem-native for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-mlkem-native § Files vendored"
            }
          ]
        },
        {
          "type": "library",
          "bom-ref": "vendor-openssl-slh-dsa",
          "name": "openssl-slh-dsa",
          "version": "openssl-3.5.0",
          "supplier": {
            "name": "AwaCloud"
          },
          "manufacturer": {
            "name": "The OpenSSL Project Authors"
          },
          "licenses": [
            {
              "expression": "Apache-2.0",
              "acknowledgement": "declared"
            }
          ],
          "copyright": "Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.",
          "externalReferences": [
            {
              "type": "distribution",
              "url": "https://github.com/openssl/openssl/archive/refs/tags/openssl-3.5.0.tar.gz"
            },
            {
              "type": "license",
              "url": "packages/front/fw-wasm-crypto/vendor/NOTICE-openssl-slh-dsa"
            },
            {
              "type": "other",
              "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
              "comment": "trees[id=openssl-slh-dsa]"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:provenance:id",
              "value": "openssl-slh-dsa"
            },
            {
              "name": "awa:provenance:notice",
              "value": "OpenSSL FIPS-205 SLH-DSA core (crypto/slh_dsa, openssl-3.5.0). Apache-2.0; see vendor/NOTICE-openssl-slh-dsa."
            },
            {
              "name": "awa:provenance:ref",
              "value": "openssl-3.5.0"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "20a5f860014d4008b95084cb40c5df85c5e6694dbef89ac755136be5396ef7a0"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/fw-wasm-crypto/vendor/ (see packages/front/fw-wasm-crypto/vendor/NOTICE-openssl-slh-dsa for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-openssl-slh-dsa § Files vendored"
            }
          ]
        },
        {
          "type": "library",
          "bom-ref": "vendor-pqclean",
          "name": "pqclean",
          "version": "202a8f96315f9ed219387a50f7e40d04af037ea8",
          "supplier": {
            "name": "AwaCloud"
          },
          "licenses": [
            {
              "expression": "CC0-1.0",
              "acknowledgement": "declared"
            }
          ],
          "externalReferences": [
            {
              "type": "license",
              "url": "packages/front/fw-wasm-crypto/vendor/NOTICE-pqclean"
            },
            {
              "type": "other",
              "url": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json",
              "comment": "trees[id=pqclean]"
            },
            {
              "type": "vcs",
              "url": "https://github.com/PQClean/PQClean"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:copyright",
              "value": "NOTICE-pqclean carries no copyright line"
            },
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:gap:originator",
              "value": "NOTICE-pqclean names no author or copyright holder"
            },
            {
              "name": "awa:provenance:id",
              "value": "pqclean"
            },
            {
              "name": "awa:provenance:notice",
              "value": "PQClean (rolling, commit 202a8f9). Per-file SPDX; see vendor/NOTICE-pqclean."
            },
            {
              "name": "awa:provenance:ref",
              "value": "202a8f96315f9ed219387a50f7e40d04af037ea8"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "517bffa8694b3e50f9ce5a68c316b6a24c4e1067a543c03083e77190b038b2c0"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/fw-wasm-crypto/vendor/ (see packages/front/fw-wasm-crypto/vendor/NOTICE-pqclean for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-pqclean § Files vendored"
            }
          ]
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-md",
      "group": "@awacloud",
      "name": "md",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/md@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/md/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/md].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L4"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-oconv",
      "group": "@awacloud",
      "name": "oconv",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/oconv@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/oconv/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/oconv].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L3"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-oconv-fonts",
      "group": "@awacloud",
      "name": "oconv-fonts",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/oconv-fonts@0.1.0",
      "externalReferences": [
        {
          "type": "license",
          "url": "packages/front/office/oconv-fonts/vendor/NOTICE"
        },
        {
          "type": "other",
          "url": "packages/front/office/oconv-fonts/package.json",
          "comment": "source manifest at the generation commit"
        },
        {
          "type": "other",
          "url": "packages/front/office/oconv-fonts/vendor/PROVENANCE.json",
          "comment": "1 vendored trees, version 1"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/oconv-fonts].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L3"
        }
      ],
      "components": [
        {
          "type": "library",
          "bom-ref": "vendor-liberation",
          "name": "liberation",
          "version": "2.1.5",
          "supplier": {
            "name": "AwaCloud"
          },
          "manufacturer": {
            "name": "Red Hat, Inc."
          },
          "licenses": [
            {
              "expression": "OFL-1.1",
              "acknowledgement": "declared"
            }
          ],
          "copyright": "Copyright (c) 2012 Red Hat, Inc.",
          "externalReferences": [
            {
              "type": "distribution",
              "url": "https://github.com/liberationfonts/liberation-fonts/files/7261482/liberation-fonts-ttf-2.1.5.tar.gz"
            },
            {
              "type": "license",
              "url": "packages/front/office/oconv-fonts/vendor/NOTICE-liberation"
            },
            {
              "type": "other",
              "url": "packages/front/office/oconv-fonts/vendor/PROVENANCE.json",
              "comment": "trees[id=liberation]"
            }
          ],
          "properties": [
            {
              "name": "awa:gap:license-concluded",
              "value": "no owner conclusion recorded (acknowledgement stays declared)"
            },
            {
              "name": "awa:provenance:id",
              "value": "liberation"
            },
            {
              "name": "awa:provenance:notice",
              "value": "Liberation Fonts 2.1.5 (Red Hat, Inc.; digitized data (c) 2010 Google Corporation). SIL OFL 1.1 with Reserved Font Names Liberation, Arimo, Tinos, Cousine. See vendor/NOTICE-liberation and vendor/OFL.txt."
            },
            {
              "name": "awa:provenance:ref",
              "value": "2.1.5"
            },
            {
              "name": "awa:provenance:sha256",
              "value": "7191c669bf38899f73a2094ed00f7b800553364f90e2637010a69c0e268f25d0"
            },
            {
              "name": "awa:provenance:sha256-semantics",
              "value": "digest of the committed subset under packages/front/office/oconv-fonts/vendor/ (see packages/front/office/oconv-fonts/vendor/NOTICE-liberation for the tree's own notice), not an archive hash — not emitted as hashes[] (gap:sha256-semantics)"
            },
            {
              "name": "awa:vendored-subset",
              "value": "see vendor/NOTICE-liberation § Files vendored"
            }
          ]
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-odf",
      "group": "@awacloud",
      "name": "odf",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/odf@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/odf/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/odf].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L4"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-ooxml",
      "group": "@awacloud",
      "name": "ooxml",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/ooxml@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/ooxml/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/ooxml].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L4"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-pdf",
      "group": "@awacloud",
      "name": "pdf",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/pdf@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "packages/front/office/pdf/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:devDependency",
          "value": "@awacloud/tool-fw-codegen workspace:*"
        },
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/pdf].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L4"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-tool-convert",
      "group": "@awacloud",
      "name": "tool-convert",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/tool-convert@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "tools/convert/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/tool-convert].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L3"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-tool-facturx-rules",
      "group": "@awacloud",
      "name": "tool-facturx-rules",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/tool-facturx-rules@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "tools/facturx-rules/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/tool-facturx-rules].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L1"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-tool-facturx-validate",
      "group": "@awacloud",
      "name": "tool-facturx-validate",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/tool-facturx-validate@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "tools/facturx-validate/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "AGPL-3.0-only"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/tool-facturx-validate].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L1"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-tool-fw-bundler",
      "group": "@awacloud",
      "name": "tool-fw-bundler",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/tool-fw-bundler@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "tools/fw-bundler/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "Apache-2.0"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/tool-fw-bundler].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L2"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "awacloud-tool-wasm-crypto",
      "group": "@awacloud",
      "name": "tool-wasm-crypto",
      "version": "0.1.0",
      "supplier": {
        "name": "AwaCloud"
      },
      "manufacturer": {
        "name": "AwaCloud"
      },
      "purl": "pkg:npm/%40awacloud/tool-wasm-crypto@0.1.0",
      "externalReferences": [
        {
          "type": "other",
          "url": "tools/wasm-crypto/package.json",
          "comment": "source manifest at the generation commit"
        }
      ],
      "properties": [
        {
          "name": "awa:gap:copyright",
          "value": "no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted"
        },
        {
          "name": "awa:gap:download-location",
          "value": "not published (package.json private:true, 0.1.0); acted repository https://github.com/awacloud/awa cited, not asserted"
        },
        {
          "name": "awa:license:ruled",
          "value": "Apache-2.0"
        },
        {
          "name": "awa:license:ruled-source",
          "value": "awf.config.json#distribution.packages[name=@awacloud/tool-wasm-crypto].license <- ai/program/PUBLICATION-DECISIONS.md § Rulings recorded, #2 (2026-08-20)"
        },
        {
          "name": "awa:maturity",
          "value": "L2"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "awacloud-facturx",
      "dependsOn": [
        "awacloud-fw",
        "awacloud-pdf"
      ]
    },
    {
      "ref": "awacloud-fonts",
      "dependsOn": [
        "awacloud-fw"
      ]
    },
    {
      "ref": "awacloud-fw",
      "dependsOn": []
    },
    {
      "ref": "awacloud-fw-wasm-crypto",
      "dependsOn": []
    },
    {
      "ref": "awacloud-md",
      "dependsOn": [
        "awacloud-fw"
      ]
    },
    {
      "ref": "awacloud-oconv",
      "dependsOn": [
        "awacloud-fonts",
        "awacloud-fw",
        "awacloud-md",
        "awacloud-odf",
        "awacloud-ooxml",
        "awacloud-pdf"
      ]
    },
    {
      "ref": "awacloud-oconv-fonts",
      "dependsOn": []
    },
    {
      "ref": "awacloud-odf",
      "dependsOn": [
        "awacloud-fw"
      ]
    },
    {
      "ref": "awacloud-ooxml",
      "dependsOn": [
        "awacloud-fw"
      ]
    },
    {
      "ref": "awacloud-pdf",
      "dependsOn": [
        "awacloud-fonts",
        "awacloud-fw"
      ]
    },
    {
      "ref": "awacloud-tool-convert",
      "dependsOn": [
        "awacloud-fw",
        "awacloud-md",
        "awacloud-oconv"
      ]
    },
    {
      "ref": "awacloud-tool-facturx-rules",
      "dependsOn": [
        "awacloud-facturx"
      ]
    },
    {
      "ref": "awacloud-tool-facturx-validate",
      "dependsOn": [
        "awacloud-facturx"
      ]
    },
    {
      "ref": "awacloud-tool-fw-bundler",
      "dependsOn": []
    },
    {
      "ref": "awacloud-tool-fw-codegen",
      "dependsOn": [
        "awacloud-tool-fw-bundler"
      ]
    },
    {
      "ref": "awacloud-tool-wasm-crypto",
      "dependsOn": []
    }
  ],
  "compositions": [
    {
      "aggregate": "complete",
      "dependencies": [
        "awacloud-facturx",
        "awacloud-fonts",
        "awacloud-fw",
        "awacloud-fw-wasm-crypto",
        "awacloud-md",
        "awacloud-oconv",
        "awacloud-oconv-fonts",
        "awacloud-odf",
        "awacloud-ooxml",
        "awacloud-pdf",
        "awacloud-tool-convert",
        "awacloud-tool-facturx-rules",
        "awacloud-tool-facturx-validate",
        "awacloud-tool-fw-bundler",
        "awacloud-tool-wasm-crypto"
      ]
    }
  ]
}