{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "orchard-gateway-4.2.0",
  "documentNamespace": "https://sbom.orchard.example/spdx/9811ac3c-6be1-42b1-ac48-de93651066b3",
  "creationInfo": {
    "created": "2026-01-01T00:00:00Z",
    "creators": [
      "Organization: Example Softworks (fictional)",
      "Tool: novus-sbom-fixture-1.0.0"
    ],
    "licenseListVersion": "3.22",
    "comment": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
  },
  "packages": [
    {
      "SPDXID": "SPDXRef-Package-orchard-example-gateway",
      "name": "@orchard-example/gateway",
      "versionInfo": "4.2.0",
      "downloadLocation": "https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/%40orchard-example/gateway@4.2.0"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-orchard-example-router",
      "name": "@orchard-example/router",
      "versionInfo": "2.1.3",
      "downloadLocation": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/%40orchard-example/router@2.1.3"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-orchard-example-http-core",
      "name": "@orchard-example/http-core",
      "versionInfo": "1.8.0",
      "downloadLocation": "https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/%40orchard-example/http-core@1.8.0"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-metrics",
      "name": "example-metrics",
      "versionInfo": "4.0.0",
      "downloadLocation": "https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-metrics@4.0.0"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-cache",
      "name": "example-cache",
      "versionInfo": "0.9.2",
      "downloadLocation": "https://registry.orchard.example/example-cache/-/example-cache-0.9.2.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "BSD-3-Clause",
      "licenseDeclared": "BSD-3-Clause",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-cache@0.9.2"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-crypto-shim",
      "name": "example-crypto-shim",
      "versionInfo": "1.2.0",
      "downloadLocation": "https://registry.orchard.example/example-crypto-shim/-/example-crypto-shim-1.2.0.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "25b4571f3faedb8df3979d9e509e331b6b88503d8d0057e6414e936e084a56cb"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-crypto-shim@1.2.0"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-logger",
      "name": "example-logger",
      "versionInfo": "3.4.1",
      "downloadLocation": "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-logger@3.4.1"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-retry",
      "name": "example-retry",
      "versionInfo": "1.0.4",
      "downloadLocation": "https://registry.orchard.example/example-retry/-/example-retry-1.0.4.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "ISC",
      "licenseDeclared": "ISC",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "4f2a78f8fb4883a2efd6b73b447f632599790c08e25bb7184f501b5f2b9af33f"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-retry@1.0.4"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-json-path",
      "name": "example-json-path",
      "versionInfo": "2.0.5",
      "downloadLocation": "https://registry.orchard.example/example-json-path/-/example-json-path-2.0.5.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "74e30e4812a0cc92bd7c1a965e6f953f5d92b9eaf3cd77d90663a7344e939b63"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-json-path@2.0.5"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-example-yaml-lite",
      "name": "example-yaml-lite",
      "versionInfo": "1.1.7",
      "downloadLocation": "https://registry.orchard.example/example-yaml-lite/-/example-yaml-lite-1.1.7.tgz",
      "filesAnalyzed": false,
      "supplier": "Organization: Example Softworks (fictional)",
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "NOASSERTION",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "d7094de3c8e15621381e5f9f02c0eecb9977d249a8a06ab2b0a34f5344a039af"
        }
      ],
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/example-yaml-lite@1.1.7"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Package-orchard-example-gateway",
      "relationshipType": "DESCRIBES"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-gateway",
      "relatedSpdxElement": "SPDXRef-Package-orchard-example-router",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-gateway",
      "relatedSpdxElement": "SPDXRef-Package-orchard-example-http-core",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-gateway",
      "relatedSpdxElement": "SPDXRef-Package-example-metrics",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-gateway",
      "relatedSpdxElement": "SPDXRef-Package-example-cache",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-gateway",
      "relatedSpdxElement": "SPDXRef-Package-example-crypto-shim",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-router",
      "relatedSpdxElement": "SPDXRef-Package-example-logger",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-router",
      "relatedSpdxElement": "SPDXRef-Package-example-retry",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-http-core",
      "relatedSpdxElement": "SPDXRef-Package-example-logger",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-orchard-example-http-core",
      "relatedSpdxElement": "SPDXRef-Package-example-json-path",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-example-metrics",
      "relatedSpdxElement": "SPDXRef-Package-example-logger",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-example-cache",
      "relatedSpdxElement": "SPDXRef-Package-example-yaml-lite",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-example-yaml-lite",
      "relatedSpdxElement": "SPDXRef-Package-example-json-path",
      "relationshipType": "DEPENDS_ON"
    }
  ],
  "documentDescribes": [
    "SPDXRef-Package-orchard-example-gateway"
  ],
  "files": [
    {
      "SPDXID": "SPDXRef-File-gateway-js",
      "fileName": "./dist/gateway.js",
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "1ebfca75b2b7ef03d6deb5a8cb9271a6de6c0bd8"
        }
      ],
      "licenseConcluded": "Apache-2.0",
      "copyrightText": "NOASSERTION"
    }
  ],
  "snippets": [
    {
      "SPDXID": "SPDXRef-Snippet-1",
      "snippetFromFile": "SPDXRef-File-gateway-js",
      "ranges": [
        {
          "startPointer": {
            "reference": "SPDXRef-File-gateway-js",
            "offset": 310
          },
          "endPointer": {
            "reference": "SPDXRef-File-gateway-js",
            "offset": 420
          },
          "startPointer_type": "BYTE"
        },
        {
          "startPointer": {
            "reference": "SPDXRef-File-gateway-js",
            "lineNumber": 12
          },
          "endPointer": {
            "reference": "SPDXRef-File-gateway-js",
            "lineNumber": 18
          }
        }
      ],
      "licenseConcluded": "MIT",
      "copyrightText": "NOASSERTION",
      "comment": "SAMPLE snippet — a fictional vendored fragment inside a fictional file."
    }
  ]
}