<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Supply Chain Threat Modeling — API Reference

## agent.js CLI

```bash
node scripts/agent.js --action enumerate --input sbom.json
node scripts/agent.js --action threats --input components.json
node scripts/agent.js --action slsa --input pipeline.json
node scripts/agent.js --action report --input threats.json --output report.json
```

## Supply Chain Threat Categories

| Category | Example Threats |
|----------|----------------|
| dependency | Confusion, typosquatting, CVEs |
| build | System compromise, unsigned artifacts |
| registry | Account compromise, cache poisoning |
| third_party | Compromised SaaS, unvetted code |

## SLSA Levels

| Level | Key Requirements |
|-------|-----------------|
| 1 | Documented build process |
| 2 | Hosted + authenticated build, signed provenance |
| 3 | Hardened platform, non-falsifiable provenance |
| 4 | Hermetic, reproducible, two-person review |
