{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0d72f4bf-93df-4c1a-893b-6e7c39d2d005",
  "version": 1,
  "metadata": {
    "timestamp": "2026-08-02T00:00:00Z",
    "component": {
      "type": "application",
      "bom-ref": "application:payments-api",
      "name": "payments-api",
      "version": "example"
    },
    "properties": [
      {
        "name": "ciphertron:sample",
        "value": "true"
      }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:rsa-oaep:auth-token",
      "name": "RSA-OAEP",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "pke",
          "padding": "oaep",
          "cryptoFunctions": ["encrypt", "decrypt"],
          "nistQuantumSecurityLevel": 0
        }
      },
      "properties": [
        { "name": "ciphertron:source:location", "value": "auth/token.ts" },
        { "name": "ciphertron:usage", "value": "Key transport" },
        { "name": "ciphertron:migration-state", "value": "Migrate" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:aes-256-gcm:vault-envelope",
      "name": "AES-256-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "parameterSetIdentifier": "256",
          "mode": "gcm",
          "cryptoFunctions": ["encrypt", "decrypt"]
        }
      },
      "properties": [
        { "name": "ciphertron:source:location", "value": "vault/envelope.go" },
        { "name": "ciphertron:usage", "value": "Data at rest" },
        { "name": "ciphertron:migration-state", "value": "Retain" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:ecdsa-p256:signing-receipt",
      "name": "ECDSA P-256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "parameterSetIdentifier": "P-256",
          "curve": "secp256r1",
          "cryptoFunctions": ["sign", "verify"],
          "nistQuantumSecurityLevel": 0
        }
      },
      "properties": [
        { "name": "ciphertron:source:location", "value": "signing/receipt.py" },
        { "name": "ciphertron:usage", "value": "Signatures" },
        { "name": "ciphertron:migration-state", "value": "Plan" }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:sha-256:audit-chain",
      "name": "SHA-256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "hash",
          "parameterSetIdentifier": "256",
          "cryptoFunctions": ["digest"]
        }
      },
      "properties": [
        { "name": "ciphertron:source:location", "value": "audit/chain.rs" },
        { "name": "ciphertron:usage", "value": "Integrity" },
        { "name": "ciphertron:migration-state", "value": "Retain" }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "application:payments-api",
      "dependsOn": [
        "crypto:rsa-oaep:auth-token",
        "crypto:aes-256-gcm:vault-envelope",
        "crypto:ecdsa-p256:signing-receipt",
        "crypto:sha-256:audit-chain"
      ]
    }
  ]
}