Yangjunjie-Lin · Sep 13, 2026 · Sep 13, 2026 · Sep 13, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -27,5 +27,6 @@ release/stable/v*/artifacts/android/*.aar binary
 release/stable/v*/artifacts/npm/*.tgz binary
 release/stable/v2.1.0/evidence/** text eol=lf
 release/stable/v2.1.0/artifacts/provenance/*.json text eol=lf
+release/stable/v2.1.0/publication-recovery/** text eol=lf
 device-lab/test-targets/sha256.json text eol=lf
 fixtures/alpha5/external-open-license/pdf417/ZXING-APACHE-2.0.txt text eol=lf
diff --git a/docs/releases/v2.1.0.md b/docs/releases/v2.1.0.md
@@ -31,3 +31,11 @@ All software, browser, API/package, security, Native, SBOM/license, artifact/rep
 The Stable manifest generator refuses new-version generation without `STABLE_QUALIFICATION_RECORD`: an exact-source `scanly-release-qualification-1` record with version, sourceCommit, sourceTree and content-addressed PASS evidence (`path`, `sha256`, `sourceCommit`) for software, apiAbi, security, sbom, licenses, native, npmReproducibility, signing, publicationCredentials and deployment. Fresh public signing metadata and two independent npm build/hash maps are required. Legacy 2.0.x GO/credential/reproducibility claims cannot be inherited.
 
 For the new `@scanly/url-safety` package only, the qualified first-publication path uses npm's official `--provenance-file` support: exact release tarball bytes carry a GitHub-hosted build's verified Sigstore provenance, while an authenticated owner completes npm's interactive 2FA locally. No npm credential is sent to CI, no placeholder version is published, and no provenance or signing requirement is waived. Existing packages continue using their verified OIDC workflow. Dependencies publish before the new package; a deferred bootstrap is reported as incomplete, never as full release success. The new package's Trusted Publisher can be initialized after its first genuine release.
+
+### Additive provenance compatibility correction
+
+The first Registry submission was rejected with E422: although the original Sigstore signatures and artifact subjects verified cryptographically, npm requires `resolvedDependencies[0]` to match the GitHub certificate's source repository ref and commit. The original bundles listed the separately checked-out product source first. The rejected submission did not publish the new package.
+
+[The additive recovery record](../../release/stable/v2.1.0/v2.1.0-provenance-recovery.json) preserves this failure and binds replacement proofs to two fresh independent GitHub-hosted builds. All 11 rebuilt tarballs match the frozen release byte-for-byte; all 22 replacement bundles are signature-, identity-, and subject-verified. The workflow source is now first and the exact product source remains a separate explicit dependency. The signed tag, original manifest, original provenance, and frozen artifacts remain unchanged.
+
+Use `npm run stable:bootstrap -- --qualified-provenance-recovery` only with this verified additive record. The command rechecks the live successful workflow, both independent signed URL Safety bundles, exact artifact hashes, original qualification, and owner authentication before requesting publication. A completed build or local signature check is not proof of Registry acceptance; post-publication checks remain mandatory.
diff --git a/release/stable/v2.1.0/publication-recovery/build-A.json b/release/stable/v2.1.0/publication-recovery/build-A.json
@@ -0,0 +1,150 @@
+{
+  "schemaVersion": "scanly-v2.1-npm-build-1",
+  "version": "2.1.0",
+  "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734",
+  "sourceTree": "c72430a2ab0a2d47e7cd095325088f1e053a5c41",
+  "workflowDefinitionCommit": "e22d100163565164e2149f99ab54d11a6111932b",
+  "workflowRef": "Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery",
+  "buildLabel": "A",
+  "runId": 34754673547,
+  "runAttempt": 1,
+  "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/attempts/1",
+  "nodeVersion": "v24.20.0",
+  "npmVersion": "11.12.1",
+  "repositoryDirty": false,
+  "published": false,
+  "artifacts": [
+    {
+      "name": "@scanly/benchmark",
+      "version": "2.1.0",
+      "filename": "scanly-benchmark-2.1.0.tgz",
+      "size": 12489,
+      "sha256": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd",
+      "sha512": "6e262c1f70df8cc03d30f8d096d7cf3fcfbaf392d5e9e7fea4ac3da4d3d098f95c9f064b6a75c738b49e984b4176b1e2b7a0d648e877bc6261962bcbec60d5cf",
+      "integrity": "sha512-biYsH3DfjMA9MPjQltfPP8+685LV6ef+pKw9pNPQmPlcnwZLanXHOLSemEtBdrHit6DWSOh3vGJhlivL7GDVzw==",
+      "provenanceFile": "scanly-benchmark-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "9ca8c601edf25db755ac9773a0e208cfad29eb62e24489a34edd9d17bd466d93",
+      "purl": "pkg:npm/%40scanly/benchmark@2.1.0"
+    },
+    {
+      "name": "@scanly/browser",
+      "version": "2.1.0",
+      "filename": "scanly-browser-2.1.0.tgz",
+      "size": 112845,
+      "sha256": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727",
+      "sha512": "07ffa207aa2a82609b0e808ae9221c3c773590406b3fe11dd45e4cf9840fc162170e42efda8d82ef72b39b9f33308e84db818a0239e563b37c66d008c768cf3e",
+      "integrity": "sha512-B/+iB6oqgmCbDoCK6SIcPHc1kEBrP+Ed1F5M+YQPwWIXDkLv2o2C73Kzm58zMI6E24GKAjnlY7N8ZtAIx2jPPg==",
+      "provenanceFile": "scanly-browser-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "bfe37937da67ce98d45bccc4aca2a7200040cf13860ff9d5b139d220c3be138a",
+      "purl": "pkg:npm/%40scanly/browser@2.1.0"
+    },
+    {
+      "name": "@scanly/core",
+      "version": "2.1.0",
+      "filename": "scanly-core-2.1.0.tgz",
+      "size": 133351,
+      "sha256": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416",
+      "sha512": "c6a81231287f8c9b7a7e30481f65d497496771b003d7d3114a0bc7cdec03baac801baa6c095978b91d77f48ec489a03205508289cdfcdee9b72a5e8ead10e2bd",
+      "integrity": "sha512-xqgSMSh/jJt6fjBIH2XUl0lncbAD19MRSgvHzewDuqyAG6psCVl4uR139I7EiaAyBVCCic383um3Kl6OrRDivQ==",
+      "provenanceFile": "scanly-core-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "2ed45b23d5f2fb1248f007c53a02af0498cfe065df353d583e439f0c4558e5f2",
+      "purl": "pkg:npm/%40scanly/core@2.1.0"
+    },
+    {
+      "name": "@scanly/engine-jsqr",
+      "version": "2.1.0",
+      "filename": "scanly-engine-jsqr-2.1.0.tgz",
+      "size": 2737,
+      "sha256": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b",
+      "sha512": "4550a7b56196e3f686de41cf278f9f28c9a9d57ccb6e6277a0ff707ecd8422c24d0ba53f63851d181b4b08b62026fc5d2b3191c522bc9c38d7745a0d58854d35",
+      "integrity": "sha512-RVCntWGW4/aG3kHPJ4+fKMmp1XzLbmJ3oP9wfs2EIsJNC6U/Y4UdGBtLCLYgJvxdKzGRxSK8nDjXdFoNWIVNNQ==",
+      "provenanceFile": "scanly-engine-jsqr-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "2dc6df190d4e04822c61c8eed2412a814154772671de71c5c530863ea71528cd",
+      "purl": "pkg:npm/%40scanly/engine-jsqr@2.1.0"
+    },
+    {
+      "name": "@scanly/engine-zxing-cpp-wasm",
+      "version": "2.1.0",
+      "filename": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz",
+      "size": 472873,
+      "sha256": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c",
+      "sha512": "46734c49cc0776b26edc1fa6261f78a028a6dd0ec97a7433cd22101648836faeba04c547e90510372fa7da4133d0303f85118cec2b17100581a160cb047bbc39",
+      "integrity": "sha512-RnNMScwHdrJu3B+mJh94oCim3Q7JenQzzSIQFkiDb666BMVH6QUQNy+n2kEz0DA/hRGM7CsXEAWBoWDLBHu8OQ==",
+      "provenanceFile": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "e97c51ce77400e173ab5623bba5864cf9a6ea6e4a706b6c8808fdc113090158d",
+      "purl": "pkg:npm/%40scanly/engine-zxing-cpp-wasm@2.1.0"
+    },
+    {
+      "name": "@scanly/engine-zxing-js",
+      "version": "2.1.0",
+      "filename": "scanly-engine-zxing-js-2.1.0.tgz",
+      "size": 3188,
+      "sha256": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf",
+      "sha512": "49a7c63ddf6317b9662f1be45d92b8ea9289fbb51d4d364a5c1e3e899e82101afd268d26a8af25cb8a739bd4d213f23ea499d4cb5b00e95fff6dc7cfcf0d0fda",
+      "integrity": "sha512-SafGPd9jF7lmLxvkXZK46pKJ+7UdTTZKXB4+iZ6CEBr9Jo0mqK8ly4pzm9TSE/I+pJnUy1sA6V//bcfPzw0P2g==",
+      "provenanceFile": "scanly-engine-zxing-js-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "ddea3326749fde9c41cb5f64f8764ab1d2b5ddc39bb80b05c96eebcfdee8f2f7",
+      "purl": "pkg:npm/%40scanly/engine-zxing-js@2.1.0"
+    },
+    {
+      "name": "@scanly/node",
+      "version": "2.1.0",
+      "filename": "scanly-node-2.1.0.tgz",
+      "size": 4163,
+      "sha256": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573",
+      "sha512": "88f404c159d400a4a03eff00294ad2076dc17dbc84b253c33fc8b742b975becc35d602e9fa529ff0ca91dc635148a8078d5564880973a63c49a2a7c6d1dc337e",
+      "integrity": "sha512-iPQEwVnUAKSgPv8AKUrSB23BfbyEslPDP8i3Qrl1vsw11gLp+lKf8MqR3GNRSKgHjVVkiAlzpjxJoqfG0dwzfg==",
+      "provenanceFile": "scanly-node-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "940ca61b1285dbf2462d3a3a05a8774298c0f7b965d0790b7660192daa9e5a15",
+      "purl": "pkg:npm/%40scanly/node@2.1.0"
+    },
+    {
+      "name": "@scanly/parsers",
+      "version": "2.1.0",
+      "filename": "scanly-parsers-2.1.0.tgz",
+      "size": 5415,
+      "sha256": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868",
+      "sha512": "1aa6833407e9d26ad02b160f253796e73d9517c5c9aa5d6d64795fccc37591f4d1997f443ff5ba34f0c05fea35c9bb217b23916f4b2418ef04f099a88b594755",
+      "integrity": "sha512-GqaDNAfp0mrQKxYPJTeW5z2VF8XJql1tZHlfzMN1kfTRmX9EP/W6NPDAX+o1ybsheyORb0skGO8E8Jmoi1lHVQ==",
+      "provenanceFile": "scanly-parsers-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "dfd7825c577634ec9846b2c4d056b19948a82292c28c35e6ce914238b4cd5076",
+      "purl": "pkg:npm/%40scanly/parsers@2.1.0"
+    },
+    {
+      "name": "@scanly/react",
+      "version": "2.1.0",
+      "filename": "scanly-react-2.1.0.tgz",
+      "size": 2873,
+      "sha256": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff",
+      "sha512": "8c2b8ee908aa097ce7c132a4fbd3671e1264665ed4cd34a7de3cc52188e800acbd2dd8d255cdb10f786b68638310d8301a11fb6c8c71b7e080bda88741f0a497",
+      "integrity": "sha512-jCuO6QiqCXznwTKk+9NnHhJkZl7UzTSn3jzFIYjoAKy9LdjSVc2xD3hraGODENgwGhH7bIxxt+CAvaiHQfCklw==",
+      "provenanceFile": "scanly-react-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "7c58ddb012647412971c5d3acbb904cd8961d3bf440b75db5aded7c8321a14a8",
+      "purl": "pkg:npm/%40scanly/react@2.1.0"
+    },
+    {
+      "name": "@scanly/scenario-schema",
+      "version": "2.1.0",
+      "filename": "scanly-scenario-schema-2.1.0.tgz",
+      "size": 10376,
+      "sha256": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1",
+      "sha512": "973fc3a387a978f8f52e63a82f574cf829c2bdd12bb5b0ad7f5766206e8610269d0e69aae90eb45f560f794a9223f9422010d54bc8a40e82ae32c027468eddbe",
+      "integrity": "sha512-lz/Do4epePj1LmOoL1dM+CnCvdErtbCtf1dmIG6GECadDmmq6Q60X1YPeUqSI/lCIBDVS8ikDoKuMsAnRo7dvg==",
+      "provenanceFile": "scanly-scenario-schema-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "f77c63558cca55d8b8e7aad1bfc4f322085230ab73136915c418e864839b4c90",
+      "purl": "pkg:npm/%40scanly/scenario-schema@2.1.0"
+    },
+    {
+      "name": "@scanly/url-safety",
+      "version": "2.1.0",
+      "filename": "scanly-url-safety-2.1.0.tgz",
+      "size": 35468,
+      "sha256": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87",
+      "sha512": "269e2f2ed7dbb71926b1eaf33e06df8ed17cf1a0aa16b741252fa2c59a3929588d7549e5aa6655d142bff1b19803db8ad5bf3949562df4d65eba53a84d531c5e",
+      "integrity": "sha512-Jp4vLtfbtxkmserzPgbfjtF88aCqFrdBJS+ixZo5KViNdUnlqmZV0UK/8bGYA9uK1b85SVYt9NZeulOoTVMcXg==",
+      "provenanceFile": "scanly-url-safety-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "30717ca382475727d43bd9fe08a9d3766901997bdf1c5393e98ec5e55c9f455a",
+      "purl": "pkg:npm/%40scanly/url-safety@2.1.0"
+    }
+  ]
+}
diff --git a/release/stable/v2.1.0/publication-recovery/build-B.json b/release/stable/v2.1.0/publication-recovery/build-B.json
@@ -0,0 +1,150 @@
+{
+  "schemaVersion": "scanly-v2.1-npm-build-1",
+  "version": "2.1.0",
+  "sourceCommit": "6b017b53a4404f4feab776ac111b0ea9dacf2734",
+  "sourceTree": "c72430a2ab0a2d47e7cd095325088f1e053a5c41",
+  "workflowDefinitionCommit": "e22d100163565164e2149f99ab54d11a6111932b",
+  "workflowRef": "Yangjunjie-Lin/Scanly/.github/workflows/v2.1-artifact-qualification.yml@refs/heads/codex/v2.1-npm-provenance-recovery",
+  "buildLabel": "B",
+  "runId": 34754673547,
+  "runAttempt": 1,
+  "invocationId": "https://github.com/Yangjunjie-Lin/Scanly/actions/runs/34754673547/attempts/1",
+  "nodeVersion": "v24.20.0",
+  "npmVersion": "11.12.1",
+  "repositoryDirty": false,
+  "published": false,
+  "artifacts": [
+    {
+      "name": "@scanly/benchmark",
+      "version": "2.1.0",
+      "filename": "scanly-benchmark-2.1.0.tgz",
+      "size": 12489,
+      "sha256": "468b1cf37bf229029651fa1e6d6ec63414902578ea1f34b1f8632704ee47e9dd",
+      "sha512": "6e262c1f70df8cc03d30f8d096d7cf3fcfbaf392d5e9e7fea4ac3da4d3d098f95c9f064b6a75c738b49e984b4176b1e2b7a0d648e877bc6261962bcbec60d5cf",
+      "integrity": "sha512-biYsH3DfjMA9MPjQltfPP8+685LV6ef+pKw9pNPQmPlcnwZLanXHOLSemEtBdrHit6DWSOh3vGJhlivL7GDVzw==",
+      "provenanceFile": "scanly-benchmark-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "3f7cdd525bd73d8ae0c189053ffcc232015862d657f0ac82d2ece6f238ba7b9a",
+      "purl": "pkg:npm/%40scanly/benchmark@2.1.0"
+    },
+    {
+      "name": "@scanly/browser",
+      "version": "2.1.0",
+      "filename": "scanly-browser-2.1.0.tgz",
+      "size": 112845,
+      "sha256": "c173f88dab2a0402ee549c9e609868c2b50145a8096ecc3c0c668a2823b92727",
+      "sha512": "07ffa207aa2a82609b0e808ae9221c3c773590406b3fe11dd45e4cf9840fc162170e42efda8d82ef72b39b9f33308e84db818a0239e563b37c66d008c768cf3e",
+      "integrity": "sha512-B/+iB6oqgmCbDoCK6SIcPHc1kEBrP+Ed1F5M+YQPwWIXDkLv2o2C73Kzm58zMI6E24GKAjnlY7N8ZtAIx2jPPg==",
+      "provenanceFile": "scanly-browser-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "fd1d643c44e53c18d448e639da02eca5684b980f4dec9d309316850a897ec1ca",
+      "purl": "pkg:npm/%40scanly/browser@2.1.0"
+    },
+    {
+      "name": "@scanly/core",
+      "version": "2.1.0",
+      "filename": "scanly-core-2.1.0.tgz",
+      "size": 133351,
+      "sha256": "7a529c1c940ace1d961bd1df668f668623bcbac1527827579433efffeb10e416",
+      "sha512": "c6a81231287f8c9b7a7e30481f65d497496771b003d7d3114a0bc7cdec03baac801baa6c095978b91d77f48ec489a03205508289cdfcdee9b72a5e8ead10e2bd",
+      "integrity": "sha512-xqgSMSh/jJt6fjBIH2XUl0lncbAD19MRSgvHzewDuqyAG6psCVl4uR139I7EiaAyBVCCic383um3Kl6OrRDivQ==",
+      "provenanceFile": "scanly-core-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "686e2b5d3fce4ef890e0abf982a85ad2b860e5074c9347f427cd3b70fbd06dab",
+      "purl": "pkg:npm/%40scanly/core@2.1.0"
+    },
+    {
+      "name": "@scanly/engine-jsqr",
+      "version": "2.1.0",
+      "filename": "scanly-engine-jsqr-2.1.0.tgz",
+      "size": 2737,
+      "sha256": "b530dcb7949290f068fa3dd3805c0ee23b26d4554cc920f058f1c6c6f3afc68b",
+      "sha512": "4550a7b56196e3f686de41cf278f9f28c9a9d57ccb6e6277a0ff707ecd8422c24d0ba53f63851d181b4b08b62026fc5d2b3191c522bc9c38d7745a0d58854d35",
+      "integrity": "sha512-RVCntWGW4/aG3kHPJ4+fKMmp1XzLbmJ3oP9wfs2EIsJNC6U/Y4UdGBtLCLYgJvxdKzGRxSK8nDjXdFoNWIVNNQ==",
+      "provenanceFile": "scanly-engine-jsqr-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "1d7bb45f10a318e2911e75802412e24b1d1e1eec477a491f35b2467acfe06b21",
+      "purl": "pkg:npm/%40scanly/engine-jsqr@2.1.0"
+    },
+    {
+      "name": "@scanly/engine-zxing-cpp-wasm",
+      "version": "2.1.0",
+      "filename": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz",
+      "size": 472873,
+      "sha256": "5215d8e09ff67ea07cececae51d34a975ae0396723ab235c627081568b1b796c",
+      "sha512": "46734c49cc0776b26edc1fa6261f78a028a6dd0ec97a7433cd22101648836faeba04c547e90510372fa7da4133d0303f85118cec2b17100581a160cb047bbc39",
+      "integrity": "sha512-RnNMScwHdrJu3B+mJh94oCim3Q7JenQzzSIQFkiDb666BMVH6QUQNy+n2kEz0DA/hRGM7CsXEAWBoWDLBHu8OQ==",
+      "provenanceFile": "scanly-engine-zxing-cpp-wasm-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "d3e591883cb3a7c92e22b08c851009a17adfe5e5645e7045aea4da7e81f5a5c5",
+      "purl": "pkg:npm/%40scanly/engine-zxing-cpp-wasm@2.1.0"
+    },
+    {
+      "name": "@scanly/engine-zxing-js",
+      "version": "2.1.0",
+      "filename": "scanly-engine-zxing-js-2.1.0.tgz",
+      "size": 3188,
+      "sha256": "420c12ac6a7170c004cee7ce25af9e69f56165b1d50e31ebb1acf4eb03b2eecf",
+      "sha512": "49a7c63ddf6317b9662f1be45d92b8ea9289fbb51d4d364a5c1e3e899e82101afd268d26a8af25cb8a739bd4d213f23ea499d4cb5b00e95fff6dc7cfcf0d0fda",
+      "integrity": "sha512-SafGPd9jF7lmLxvkXZK46pKJ+7UdTTZKXB4+iZ6CEBr9Jo0mqK8ly4pzm9TSE/I+pJnUy1sA6V//bcfPzw0P2g==",
+      "provenanceFile": "scanly-engine-zxing-js-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "ace7b5a4fee1553aec49599231dd84b1622744356414b6df09f4d40325a9304e",
+      "purl": "pkg:npm/%40scanly/engine-zxing-js@2.1.0"
+    },
+    {
+      "name": "@scanly/node",
+      "version": "2.1.0",
+      "filename": "scanly-node-2.1.0.tgz",
+      "size": 4163,
+      "sha256": "13207d6afba9038cf721bb9462ff096aedaa658ed22596c10f5529eb08fc3573",
+      "sha512": "88f404c159d400a4a03eff00294ad2076dc17dbc84b253c33fc8b742b975becc35d602e9fa529ff0ca91dc635148a8078d5564880973a63c49a2a7c6d1dc337e",
+      "integrity": "sha512-iPQEwVnUAKSgPv8AKUrSB23BfbyEslPDP8i3Qrl1vsw11gLp+lKf8MqR3GNRSKgHjVVkiAlzpjxJoqfG0dwzfg==",
+      "provenanceFile": "scanly-node-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "b71e17f7b53fc943b23cd92df8dd9220b6d33a2d5d8bd331ba4b892d86cbec53",
+      "purl": "pkg:npm/%40scanly/node@2.1.0"
+    },
+    {
+      "name": "@scanly/parsers",
+      "version": "2.1.0",
+      "filename": "scanly-parsers-2.1.0.tgz",
+      "size": 5415,
+      "sha256": "2d71b9713d1b8d084b8c9bdeb0ffbe079b3df54a16488e50dabe857c374cb868",
+      "sha512": "1aa6833407e9d26ad02b160f253796e73d9517c5c9aa5d6d64795fccc37591f4d1997f443ff5ba34f0c05fea35c9bb217b23916f4b2418ef04f099a88b594755",
+      "integrity": "sha512-GqaDNAfp0mrQKxYPJTeW5z2VF8XJql1tZHlfzMN1kfTRmX9EP/W6NPDAX+o1ybsheyORb0skGO8E8Jmoi1lHVQ==",
+      "provenanceFile": "scanly-parsers-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "839823dca1ee698002dbfa39de7507ce8e8c6d53089801cae3a04c06722f9c29",
+      "purl": "pkg:npm/%40scanly/parsers@2.1.0"
+    },
+    {
+      "name": "@scanly/react",
+      "version": "2.1.0",
+      "filename": "scanly-react-2.1.0.tgz",
+      "size": 2873,
+      "sha256": "e709ec6f963a91f593a55efcda65e5cf524774154496a1011d8474bb7ab9b8ff",
+      "sha512": "8c2b8ee908aa097ce7c132a4fbd3671e1264665ed4cd34a7de3cc52188e800acbd2dd8d255cdb10f786b68638310d8301a11fb6c8c71b7e080bda88741f0a497",
+      "integrity": "sha512-jCuO6QiqCXznwTKk+9NnHhJkZl7UzTSn3jzFIYjoAKy9LdjSVc2xD3hraGODENgwGhH7bIxxt+CAvaiHQfCklw==",
+      "provenanceFile": "scanly-react-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "e88519b2bef24d11b953a4c7e9c6c6670f7b9038a63abc62e17213cce1da9e2c",
+      "purl": "pkg:npm/%40scanly/react@2.1.0"
+    },
+    {
+      "name": "@scanly/scenario-schema",
+      "version": "2.1.0",
+      "filename": "scanly-scenario-schema-2.1.0.tgz",
+      "size": 10376,
+      "sha256": "b55e951e1fcd5e129200beab60ee057dee23d4694409df75d007c0953a7e90b1",
+      "sha512": "973fc3a387a978f8f52e63a82f574cf829c2bdd12bb5b0ad7f5766206e8610269d0e69aae90eb45f560f794a9223f9422010d54bc8a40e82ae32c027468eddbe",
+      "integrity": "sha512-lz/Do4epePj1LmOoL1dM+CnCvdErtbCtf1dmIG6GECadDmmq6Q60X1YPeUqSI/lCIBDVS8ikDoKuMsAnRo7dvg==",
+      "provenanceFile": "scanly-scenario-schema-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "50be2740712a76e80ee0059dc57b0a3f73a90b8072cc20b6e99a8c8f0abc0e0d",
+      "purl": "pkg:npm/%40scanly/scenario-schema@2.1.0"
+    },
+    {
+      "name": "@scanly/url-safety",
+      "version": "2.1.0",
+      "filename": "scanly-url-safety-2.1.0.tgz",
+      "size": 35468,
+      "sha256": "72bbd5974b2a0b0c2c1ded6098c249084df0fbffe50a937ef96e68902b914a87",
+      "sha512": "269e2f2ed7dbb71926b1eaf33e06df8ed17cf1a0aa16b741252fa2c59a3929588d7549e5aa6655d142bff1b19803db8ad5bf3949562df4d65eba53a84d531c5e",
+      "integrity": "sha512-Jp4vLtfbtxkmserzPgbfjtF88aCqFrdBJS+ixZo5KViNdUnlqmZV0UK/8bGYA9uK1b85SVYt9NZeulOoTVMcXg==",
+      "provenanceFile": "scanly-url-safety-2.1.0.tgz.sigstore.json",
+      "provenanceSha256": "bb9366faafef9d3541c0129facc15e66a3d56ca8ee20c676add6275872a1921b",
+      "purl": "pkg:npm/%40scanly/url-safety@2.1.0"
+    }
+  ]
+}