@cdxgen/cdxgen 0.0.1 → 13.0.0

package/bin/cdxgen.js

@@ -0,0 +1,2324 @@
+#!/usr/bin/env node
+import { Buffer } from "node:buffer";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+} from "node:path";
+import process from "node:process";
+
+import { parse as _load } from "yaml";
+import yargs from "yargs";
+import { hideBin } from "yargs/helpers";
+
+import {
+  applyAdvancedOptions as applyAdvancedOptionsImpl,
+  buildOptionsFromArgs,
+  isUserProvided,
+  validateSpecVersion,
+} from "../lib/cli/cliOptions.js";
+import { createBom, submitBom } from "../lib/cli/index.js";
+import { TRACE_MODE, thoughtEnd, thoughtLog } from "../lib/core/logger.js";
+import {
+  PROJECT_CONFIG_FILENAMES,
+  sanitizeProjectConfig,
+} from "../lib/core/projectConfig.js";
+import {
+  ui as defaultUi,
+  installConsoleShim,
+  restoreConsole,
+} from "../lib/core/ui.js";
+import { fetchPomXmlAsJson } from "../lib/ecosystems/ecosystems.js";
+import { normalizeHuggingFaceReference } from "../lib/ecosystems/remote/huggingface.js";
+import {
+  commandsExecuted,
+  DEBUG_MODE,
+  getDefaultBomAuditCategories,
+  getTmpDir,
+  isAllowedHttpHost,
+  isBun,
+  isDeno,
+  isDryRun,
+  isMac,
+  isNode,
+  isSecureMode,
+  isWin,
+  readEnvironmentVariable,
+  recordActivity,
+  recordSensitiveFileRead,
+  remoteHostsAccessed,
+  retrieveCdxgenVersion,
+  safeExistsSync,
+  safeMkdirSync,
+  safeSpawnSync,
+  safeWriteSync,
+  setActivityContext,
+  setDryRunMode,
+  shouldRunPredictiveBomAudit,
+} from "../lib/ecosystems/utils.js";
+import { signBom, verifyBom } from "../lib/helpers/bomSigner.js";
+import {
+  createOutputPlan,
+  getOutputDirectory,
+} from "../lib/helpers/exportUtils.js";
+import {
+  DEFAULT_CDX_SPEC_VERSION,
+  getSupportedCycloneDxComponentTypes,
+  isCycloneDxBom,
+  isCycloneDxComponentTypeEnabled,
+  normalizeCycloneDxComponentTypeFilter,
+  toCycloneDxSpecVersionString,
+} from "../lib/inventory/bomUtils.js";
+import {
+  displaySelfThreatModel,
+  printActivitySummary,
+  printCallStack,
+  printDependencyTree,
+  printEnvironmentAuditFindings,
+  printFormulation,
+  printOccurrences,
+  printReachables,
+  printServices,
+  printSponsorBanner,
+  printSummary,
+  printTable,
+} from "../lib/inventory/display.js";
+import {
+  ensureNoMixedHbomProjectTypes,
+  ensureSupportedHbomSpecVersion,
+  hasHbomProjectType,
+  isHbomOnlyProjectTypes,
+} from "../lib/inventory/hbom.js";
+import { resolvePluginBinary } from "../lib/inventory/plugins.js";
+import { importProtobomModule } from "../lib/inventory/protobomLoader.js";
+import {
+  cleanupSourceDir,
+  findGitRefForPurlVersion,
+  gitClone,
+  isAllowedPath,
+  isAllowedWinPath,
+  maybePurlSource,
+  maybeRemotePath,
+  PURL_REGISTRY_LOOKUP_WARNING,
+  resolveGitUrlFromPurl,
+  resolvePurlSourceDirectory,
+  sanitizeRemoteUrlForLogs,
+  validateAndRejectGitSource,
+  validatePurlSource,
+} from "../lib/inventory/source.js";
+import { executeOsQuery } from "../lib/managers/binary.js";
+import { getBomWithOras } from "../lib/managers/oci.js";
+import { postProcess } from "../lib/stages/postgen/postgen.js";
+import { convertCycloneDxToSpdx } from "../lib/stages/postgen/spdxConverter.js";
+import { auditEnvironment } from "../lib/stages/pregen/envAudit.js";
+import { prepareEnv } from "../lib/stages/pregen/pregen.js";
+import { validateSpdx } from "../lib/validator/bomValidator.js";
+import { validateGeneratedBom } from "../lib/validator/index.js";
+
+// Support for config files. The config file lives in the directory under
+// analysis, so it carries that directory's trust level; see
+// sanitizeProjectConfig for the boundary this applies.
+let config = {};
+for (const configPattern of PROJECT_CONFIG_FILENAMES) {
+  const configPath = join(process.cwd(), configPattern);
+  if (!safeExistsSync(configPath)) {
+    continue;
+  }
+  try {
+    if (configPath.endsWith(".yml") || configPath.endsWith(".yaml")) {
+      config = _load(fs.readFileSync(configPath, "utf-8"));
+    } else {
+      config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    }
+    if (isSecureMode || DEBUG_MODE) {
+      console.log(`Config file '${configPath}' loaded successfully.`);
+    }
+    const sanitized = sanitizeProjectConfig(config, dirname(configPath));
+    config = sanitized.config;
+    for (const entry of sanitized.rejected) {
+      console.warn(
+        `\x1b[1;35mConfig file '${configPath}' sets '${entry}', which points outside the project directory. Ignoring it. Pass the option on the command line if this is intentional.\x1b[0m`,
+      );
+    }
+    for (const foundKey of sanitized.announced) {
+      console.warn(
+        `Config file '${configPath}' sets '${foundKey}'. Verify this is intentional.`,
+      );
+    }
+  } catch (_e) {
+    console.log("Invalid config file", configPath);
+  }
+}
+
+const _yargs = yargs(hideBin(process.argv));
+/** Actions accepted by the `cdxgen cache` subcommand. */
+const CACHE_ACTIONS = ["info", "clear"];
+const invokedCommandName = basename(process.argv[1] || "cdxgen").replace(
+  /\.(?:[cm]?js|exe)$/u,
+  "",
+);
+const defaultComponentTypeChoices = getSupportedCycloneDxComponentTypes(
+  DEFAULT_CDX_SPEC_VERSION,
+);
+
+// Intercept --version --verbose BEFORE yargs' built-in --version handler exits.
+if (
+  (process.argv.includes("--version") || process.argv.includes("-v")) &&
+  process.argv.includes("--verbose")
+) {
+  console.log(`cdxgen ${retrieveCdxgenVersion()}`);
+  try {
+    const { cdxrsAvailable } = await import("../lib/inventory/cdxrs.js");
+    const rs = cdxrsAvailable("info");
+    if (rs.available) {
+      console.log(`cdxrs ${rs.version} (available)`);
+    } else {
+      console.log(`cdxrs: not available (${rs.reason})`);
+    }
+  } catch {
+    console.log("cdxrs: bridge not loaded");
+  }
+  process.exit(0);
+}
+
+const args = _yargs
+  .env("CDXGEN")
+  .parserConfiguration({
+    "greedy-arrays": false,
+    "short-option-groups": false,
+    "dot-notation": false,
+    "parse-numbers": true,
+    "boolean-negation": true,
+  })
+  .option("output", {
+    alias: "o",
+    description:
+      "Output file. Default bom.json. Use -o - to write the BOM to stdout.",
+    default: "bom.json",
+    nargs: 1,
+  })
+  .option("evinse-output", {
+    description:
+      "Create bom with evidence as a separate file. Default bom.json",
+    hidden: true,
+  })
+  .option("type", {
+    alias: "t",
+    description:
+      "Project type. Please refer to https://cdxgen.github.io/cdxgen/#/PROJECT_TYPES for supported languages/platforms.",
+  })
+  .option("exclude-type", {
+    description:
+      "Project types to exclude. Please refer to https://cdxgen.github.io/cdxgen/#/PROJECT_TYPES for supported languages/platforms.",
+  })
+  .option("recurse", {
+    alias: "r",
+    type: "boolean",
+    default: true,
+    description:
+      "Recurse mode suitable for mono-repos. Defaults to true. Pass --no-recurse to disable.",
+  })
+  .option("print", {
+    alias: "p",
+    type: "boolean",
+    description: "Print the SBOM as a table with tree.",
+  })
+  .option("resolve-class", {
+    alias: "c",
+    type: "boolean",
+    description: "Resolve class names for packages. jars only for now.",
+  })
+  .option("deep", {
+    type: "boolean",
+    description:
+      "Perform deep searches for components. Useful while scanning C/C++ apps, live OS and oci images.",
+  })
+  .option("git-branch", {
+    description: "Git branch to clone when the source is a git URL or purl",
+    type: "string",
+  })
+  .option("server-url", {
+    description: "Dependency track url. Eg: https://deptrack.cyclonedx.io",
+    type: "string",
+  })
+  .option("skip-dt-tls-check", {
+    type: "boolean",
+    default: false,
+    description: "Skip TLS certificate check when calling Dependency-Track. ",
+  })
+  .option("api-key", {
+    description: "Dependency track api key",
+    type: "string",
+  })
+  .option("tea-fetch", {
+    description:
+      "Fetch upstream SBOMs for a Transparency Exchange Identifier (TEI, e.g. urn:tei:uuid:products.example.com:<uuid>) and merge them into the generated BOM.",
+    type: "string",
+  })
+  .option("tea-publish", {
+    description:
+      "Publish the generated BOM as a TEA Artifact in a Collection at the given TEA server URL (draft publisher API).",
+    type: "string",
+  })
+  .option("tea-leaf-identifier", {
+    description:
+      "UUID of the TEA leaf/release that the published Collection belongs to (required with --tea-publish).",
+    type: "string",
+  })
+  .option("tea-collection-name", {
+    description:
+      "Artifact name used with --tea-publish. Defaults to '<project> sbom'.",
+    type: "string",
+  })
+  .option("tea-reason", {
+    description:
+      "Collection update reason with --tea-publish: INITIAL_RELEASE, ARTIFACT_UPDATED, ARTIFACT_ADDED, ARTIFACT_REMOVED, or VEX_UPDATED.",
+    type: "string",
+    choices: [
+      "INITIAL_RELEASE",
+      "VEX_UPDATED",
+      "ARTIFACT_UPDATED",
+      "ARTIFACT_REMOVED",
+      "ARTIFACT_ADDED",
+    ],
+    default: "INITIAL_RELEASE",
+  })
+  .option("tea-author-name", {
+    description: "Author name recorded in the published TEA Collection.",
+    type: "string",
+  })
+  .option("tea-author-email", {
+    description: "Author email recorded in the published TEA Collection.",
+    type: "string",
+  })
+  .option("tea-artifact-url", {
+    description:
+      "Publicly reachable URL where the published BOM artifact can be downloaded. Defaults to the local output path, which a TEA server will usually not be able to fetch, so supply this whenever the BOM is hosted somewhere.",
+    type: "string",
+  })
+  .option("tea-token", {
+    description:
+      "Bearer token for TEA authentication. Sent only as an Authorization header and never logged. May also be supplied via the TEA_TOKEN environment variable.",
+    type: "string",
+    hidden: true,
+  })
+  .option("project-group", {
+    description: "Dependency track project group",
+  })
+  .option("project-name", {
+    description:
+      "Dependency track project name. Default use the directory name",
+  })
+  .option("project-version", {
+    description: "Dependency track project version",
+    default: "",
+    type: "string",
+  })
+  .option("project-tag", {
+    description: "Dependency track project tag. Multiple values allowed.",
+  })
+  .option("project-id", {
+    description:
+      "Dependency track project id. Either provide the id or the project name and version together",
+    type: "string",
+  })
+  .option("parent-project-id", {
+    description: "Dependency track parent project id",
+    type: "string",
+  })
+  .option("parent-project-name", {
+    description: "Dependency track parent project name",
+    type: "string",
+  })
+  .option("parent-project-version", {
+    description: "Dependency track parent project version",
+    type: "string",
+  })
+  .option("auto-create", {
+    description: "Dependency track autoCreate value for BOM uploads",
+    type: "boolean",
+    hidden: true,
+  })
+  .option("is-latest", {
+    description: "Dependency track isLatest value for BOM uploads",
+    type: "boolean",
+    hidden: true,
+  })
+  .option("required-only", {
+    type: "boolean",
+    description:
+      "Include only the packages with required scope on the SBOM. Would set compositions.aggregate to incomplete unless --no-auto-compositions is passed.",
+  })
+  .option("fail-on-error", {
+    type: "boolean",
+    default: isSecureMode,
+    description: "Fail if any dependency extractor fails.",
+  })
+  .option("dry-run", {
+    type: "boolean",
+    default: isDryRun,
+    description:
+      "Read-only mode. cdxgen only performs file reads and reports blocked writes, command execution, temp creation, network access, and submissions.",
+  })
+  .option("include-runtime", {
+    type: "boolean",
+    default: false,
+    description:
+      "For HBOM runs, also collect OBOM runtime inventory and emit a merged host view with strict hardware/runtime topology links.",
+  })
+  .option("activity-report", {
+    choices: ["json", "jsonl"],
+    description: "Render the activity report as JSON or JSON Lines.",
+    hidden: true,
+    type: "string",
+  })
+  .option("no-babel", {
+    type: "boolean",
+    description:
+      "Do not use babel to perform usage analysis for JavaScript/TypeScript projects.",
+  })
+  .option("generate-key-and-sign", {
+    type: "boolean",
+    description:
+      "Generate an RSA public/private key pair and then sign the generated SBOM using JSON Web Signatures.",
+  })
+  .option("server", {
+    type: "boolean",
+    description: "Run cdxgen as a server",
+  })
+  .option("server-host", {
+    description: "Listen address",
+    default: "127.0.0.1",
+    type: "string",
+  })
+  .option("server-port", {
+    description: "Listen port",
+    default: 9090,
+    type: "number",
+  })
+  .option("install-deps", {
+    type: "boolean",
+    default: !isSecureMode,
+    description:
+      "Install dependencies automatically for some projects. Defaults to true but disabled for containers and oci scans. Use --no-install-deps to disable this feature.",
+  })
+  .option("package-extensions", {
+    type: "boolean",
+    default: true,
+    description:
+      "Apply npm packageExtensions manifest repairs on --deep scans. Defaults to true, matching npm. Pass --no-package-extensions to produce a BOM that reflects manifests as published.",
+  })
+  .option("validate", {
+    type: "boolean",
+    default: true,
+    description:
+      "Validate the generated SBOM using json schema. Defaults to true. Pass --no-validate to disable.",
+  })
+  .option("evidence", {
+    type: "boolean",
+    default: false,
+    description: "Generate SBOM with evidence for supported languages.",
+  })
+  .option("deps-slices-file", {
+    description: "Path for the parsedeps slice file created by atom.",
+    default: "deps.slices.json",
+    hidden: true,
+  })
+  .option("usages-slices-file", {
+    description: "Path for the usages slices file created by atom.",
+    hidden: true,
+  })
+  .option("data-flow-slices-file", {
+    description: "Path for the data-flow slices file created by atom.",
+    hidden: true,
+  })
+  .option("reachables-slices-file", {
+    description: "Path for the reachables slices file created by atom.",
+    hidden: true,
+  })
+  .option("semantics-slices-file", {
+    description: "Path for the semantics slices file.",
+    default: "semantics.slices.json",
+    hidden: true,
+  })
+  .option("openapi-spec-file", {
+    description: "Path for the openapi specification file (SaaSBOM).",
+    hidden: true,
+  })
+  .option("spec-version", {
+    description:
+      "CycloneDX Specification version to use. Defaults to 1.7. Accepted generation targets: 1.6, 1.7, 2.0. (1.4 and 1.5 are rejected as generation targets; downgrade the serialized output if a legacy document is required.)",
+    default: DEFAULT_CDX_SPEC_VERSION,
+    type: "number",
+  })
+  .option("filter", {
+    description:
+      "Filter components containing this word in purl or component.properties.value. Multiple values allowed.",
+  })
+  .option("only", {
+    description:
+      "Include components only containing this word in purl. Useful to generate BOM with first party components alone. Multiple values allowed.",
+  })
+  .option("author", {
+    description:
+      "The person(s) who created the BOM. Set this value if you're intending the modify the BOM and claim authorship.",
+    default: "OWASP Foundation",
+  })
+  .option("profile", {
+    description: "BOM profile to use for generation. Default generic.",
+    default: "generic",
+    choices: [
+      "appsec",
+      "research",
+      "operational",
+      "threat-modeling",
+      "license-compliance",
+      "generic",
+      "machine-learning",
+      "ml",
+      "deep-learning",
+      "ml-deep",
+      "ml-tiny",
+    ],
+  })
+  .option("lifecycle", {
+    description: "Product lifecycle for the generated BOM.",
+    hidden: true,
+    choices: ["pre-build", "build", "post-build"],
+  })
+  .option("include-release-notes", {
+    type: "boolean",
+    default: false,
+    hidden: true,
+    description:
+      "Attach CycloneDX releaseNotes to the cdxgen tool component in metadata.",
+  })
+  .option("release-notes-current-tag", {
+    type: "string",
+    hidden: true,
+    description:
+      "Current git tag used to build CycloneDX releaseNotes for cdxgen metadata.",
+  })
+  .option("release-notes-previous-tag", {
+    type: "string",
+    hidden: true,
+    description:
+      "Previous git tag used to build CycloneDX releaseNotes for cdxgen metadata.",
+  })
+  .option("include-regex", {
+    description:
+      "glob pattern to include. This overrides the default pattern used during auto-detection.",
+    type: "string",
+  })
+  .option("exclude", {
+    alias: "exclude-regex",
+    description: "Additional glob pattern(s) to ignore",
+    nargs: 1,
+    type: "array",
+  })
+  .option("no-ignore", {
+    type: "boolean",
+    default: false,
+    description: "Disable default ignore lists during scanning.",
+  })
+  .option("export-proto", {
+    type: "boolean",
+    default: false,
+    description: "Serialize and export BOM as protobuf binary.",
+  })
+  .option("format", {
+    description:
+      "Export format(s). Supports cyclonedx, spdx, repeated --format flags, or a comma-separated list such as cyclonedx,spdx.",
+  })
+  .option("proto-bin-file", {
+    description: "Path for the serialized protobuf binary.",
+    default: "bom.cdx",
+  })
+  .option("include-formulation", {
+    type: "boolean",
+    default: false,
+    description:
+      "Generate formulation section with git metadata and build tools. Defaults to false.",
+  })
+  .option("include-crypto", {
+    type: "boolean",
+    default: false,
+    description: "Include crypto libraries as components.",
+  })
+  .option("experimental-mcp-pinning", {
+    type: "boolean",
+    default: false,
+    hidden: true,
+    description:
+      "Experimental: record an explicit pinning state (cdx:mcp:pinning) and composition (cdx:mcp:composition) for MCP server components. Off by default; the emitted property names are subject to change until the CycloneDX agent-BOM proposal is ratified.",
+  })
+  .option("license-policy", {
+    type: "string",
+    description: "Path to a license compliance policy YAML file.",
+  })
+  .option("license-ref", {
+    type: "boolean",
+    default: false,
+    description: "Synthesize custom LicenseRef IDs for unresolved licenses.",
+  })
+  .option("standard", {
+    description:
+      "The list of standards which may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to.",
+    choices: [
+      "asvs-5.0",
+      "asvs-4.0.3",
+      "bsimm-v13",
+      "masvs-2.0.0",
+      "nist_ssdf-1.1",
+      "pcissc-secure-slc-1.1",
+      "scvs-1.0.0",
+      "ssaf-DRAFT-2023-11",
+    ],
+  })
+  .option("no-banner", {
+    type: "boolean",
+    default: false,
+    hidden: true,
+    description:
+      "Do not show the donation banner. Set this attribute if you are an active sponsor for OWASP CycloneDX.",
+  })
+  .option("json-pretty", {
+    type: "boolean",
+    default: DEBUG_MODE,
+    description: "Pretty-print the generated BOM json.",
+  })
+  .option("feature-flags", {
+    description: "Experimental feature flags to enable. Advanced users only.",
+    hidden: true,
+    choices: [
+      "safe-pip-install",
+      "suggest-build-tools",
+      "ruby-docker-install",
+      "resolve-gradle-distribution",
+    ],
+  })
+  .option("min-confidence", {
+    description:
+      "Minimum confidence needed for the identity of a component from 0 - 1, where 1 is 100% confidence.",
+    default: 0,
+    type: "number",
+  })
+  .option("technique", {
+    description: "Analysis technique to use",
+    choices: [
+      "auto",
+      "source-code-analysis",
+      "binary-analysis",
+      "manifest-analysis",
+      "hash-comparison",
+      "instrumentation",
+      "filename",
+    ],
+  })
+  .option("component-type", {
+    description:
+      "CycloneDX component type(s) to include. Choices are validated against --spec-version.",
+    choices: defaultComponentTypeChoices,
+    type: "string",
+  })
+  .option("tlp-classification", {
+    description:
+      "Traffic Light Protocol (TLP) classification recorded under metadata.distributionConstraints.tlp (CycloneDX 1.7+). One of: CLEAR, GREEN, AMBER, AMBER_AND_STRICT, RED. See https://www.first.org/tlp/ for guidance.",
+    choices: ["CLEAR", "GREEN", "AMBER", "AMBER_AND_STRICT", "RED"],
+  })
+  .option("env-audit", {
+    type: "boolean",
+    description:
+      "Display a pre-generation environment and configuration security assessment",
+    default: false,
+    hidden: true,
+  })
+  .option("bom-audit", {
+    type: "boolean",
+    description: "Perform post-generation security audit of BOM data",
+    default: false,
+    hidden: true,
+  })
+  .option("bom-audit-rules-dir", {
+    description:
+      "Directory containing additional YAML audit rules (merged with built-in)",
+    type: "string",
+    hidden: true,
+  })
+  .option("bom-audit-categories", {
+    description:
+      "Comma-separated list of rule categories to enable (default: all)",
+    type: "string",
+    hidden: true,
+  })
+  .option("bom-audit-min-severity", {
+    description:
+      "Minimum severity to report: low, medium, or high (default: low)",
+    type: "string",
+    choices: ["low", "medium", "high"],
+    default: "low",
+    hidden: true,
+  })
+  .option("bom-audit-fail-severity", {
+    description: "Severity threshold for secure mode failure (default: high)",
+    type: "string",
+    choices: ["high", "medium", "low"],
+    default: "high",
+    hidden: true,
+  })
+  .option("bom-audit-scope", {
+    description:
+      "Predictive audit target scope. Use 'required' to scan only dependencies with scope=required (missing scope is treated as required).",
+    type: "string",
+    choices: ["all", "required"],
+    default: "all",
+    hidden: true,
+  })
+  .option("bom-audit-max-targets", {
+    description:
+      "Optional upper bound for predictive audit targets. By default cdxgen scans required dependencies first and expands to at least 50 targets.",
+    type: "number",
+    hidden: true,
+  })
+  .option("bom-audit-include-trusted", {
+    description:
+      "Include packages already marked with trusted publishing metadata in predictive BOM audit target selection.",
+    type: "boolean",
+    default: false,
+    hidden: true,
+  })
+  .option("bom-audit-only-trusted", {
+    description:
+      "Restrict predictive BOM audit target selection to packages marked with trusted publishing metadata.",
+    type: "boolean",
+    default: false,
+    hidden: true,
+  })
+  .option("tui", {
+    type: "boolean",
+    description: "Launch the terminal user interface (cdxui)",
+    default: false,
+  })
+  .completion("completion", "Generate bash/zsh completion")
+  .array("type")
+  .array("excludeType")
+  .array("filter")
+  .array("only")
+  .array("author")
+  .array("format")
+  .array("standard")
+  .array("feature-flags")
+  .array("technique")
+  .array("componentType")
+  .check((argv) => {
+    const specVersionError = validateSpecVersion(
+      argv.specVersion,
+      invokedCommandName,
+    );
+    if (specVersionError) {
+      throw new Error(specVersionError);
+    }
+    return true;
+  })
+  .check((argv) => {
+    const requestedComponentTypes = normalizeCycloneDxComponentTypeFilter(
+      argv.componentType,
+    );
+    if (!requestedComponentTypes.length) {
+      return true;
+    }
+    const normalizedSpecVersion =
+      toCycloneDxSpecVersionString(argv.specVersion) ||
+      toCycloneDxSpecVersionString(DEFAULT_CDX_SPEC_VERSION);
+    const supportedComponentTypes = getSupportedCycloneDxComponentTypes(
+      normalizedSpecVersion,
+    );
+    const unsupportedComponentTypes = requestedComponentTypes.filter(
+      (componentType) => !supportedComponentTypes.includes(componentType),
+    );
+    if (unsupportedComponentTypes.length) {
+      throw new Error(
+        `Unsupported --component-type value(s) for CycloneDX ${normalizedSpecVersion}: ${unsupportedComponentTypes.join(", ")}. Supported values: ${supportedComponentTypes.join(", ")}`,
+      );
+    }
+    return true;
+  })
+  .option("auto-compositions", {
+    type: "boolean",
+    default: true,
+    description:
+      "Automatically set compositions when the BOM was filtered. Defaults to true",
+  })
+  .example([
+    ["$0 -t java .", "Generate a Java SBOM for the current directory"],
+    [
+      "$0 -t java -t js .",
+      "Generate a SBOM for Java and JavaScript in the current directory",
+    ],
+    ["$0 -t hbom .", "Generate an HBOM for the current host"],
+    [
+      "$0 -t java --profile ml .",
+      "Generate a Java SBOM for machine learning purposes.",
+    ],
+    [
+      "$0 -t python --profile research .",
+      "Generate a Python SBOM for appsec research.",
+    ],
+    ["$0 --server", "Run cdxgen as a server"],
+  ])
+  .epilogue(
+    `Subcommands:\n  cache <${CACHE_ACTIONS.join("|")}>  Inspect or purge the registry metadata cache.\n\nfor documentation, visit https://cdxgen.github.io/cdxgen`,
+  )
+  .config(config)
+  .scriptName(invokedCommandName || "cdxgen")
+  .version(retrieveCdxgenVersion())
+  .alias("v", "version")
+  .help(false)
+  .option("help", {
+    alias: "h",
+    type: "boolean",
+    description: "Show help",
+  })
+  .option("verbose", {
+    count: true,
+    description:
+      "Increase log verbosity. Repeat for more detail: --verbose shows per-file detail, --verbose --verbose enables debug output. (Env: CDXGEN_LOG_LEVEL, CDXGEN_DEBUG_MODE)",
+  })
+  .option("quiet", {
+    alias: "q",
+    type: "boolean",
+    default: false,
+    description:
+      "Silent mode: show errors only. (Env: CDXGEN_LOG_LEVEL=silent)",
+  })
+  .option("progress", {
+    type: "boolean",
+    default: true,
+    description:
+      "Live progress region. Pass --no-progress to force static output. (Env: CDXGEN_NO_PROGRESS)",
+  })
+  .option("color", {
+    description:
+      "When to colorize output. auto detects the terminal. (Env: CDXGEN_COLOR, NO_COLOR, FORCE_COLOR)",
+    choices: ["auto", "always", "never"],
+    default: "auto",
+  })
+  .option("log-format", {
+    description:
+      "Diagnostic log format. json emits NDJSON records to stderr and disables the live region. (Env: CDXGEN_LOG_FORMAT)",
+    choices: ["text", "json"],
+    default: "text",
+  })
+  .option("rust", {
+    type: "boolean",
+    default: true,
+    description:
+      "Use Rust-native (cdxrs) acceleration where available. Pass --no-rust to force the JS path.",
+  })
+  .option("cache", {
+    type: "boolean",
+    default: true,
+    description:
+      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run.",
+  })
+  .option("cache-ttl", {
+    type: "number",
+    description:
+      "Override the metadata cache TTL in seconds. 0 means never expire. Default: 86400 (24h).",
+  })
+  .wrap(Math.min(120, yargs().terminalWidth())).argv;
+
+if (readEnvironmentVariable("CDXGEN_NODE_OPTIONS")) {
+  process.env.NODE_OPTIONS = `${process.env.NODE_OPTIONS || ""} ${process.env.CDXGEN_NODE_OPTIONS}`;
+}
+
+// `--no-rust` is a front-end for CDXGEN_RS_DISABLE=all: the bridge reads only
+// the env var, so every consumer honours the flag without threading an option
+// through each call site. Declared as `rust` (default true) rather than
+// `no-rust` so yargs' own boolean negation produces the flag.
+if (args.rust === false) {
+  process.env.CDXGEN_RS_DISABLE = "all";
+}
+
+// `--no-cache` and `--cache-ttl` are front-ends for env vars that the fetch
+// bridge reads when constructing cdxrs arguments. Declared as `cache` (default
+// true) so yargs' boolean negation produces `--no-cache`.
+if (args.cache === false) {
+  process.env.CDXGEN_NO_CACHE = "true";
+}
+if (args.cacheTtl != null && Number.isFinite(args.cacheTtl)) {
+  process.env.CDXGEN_CACHE_TTL = String(args.cacheTtl);
+}
+
+// The `cache` subcommand takes its action as a positional word rather than a
+// flag, so an unrecognised action can be rejected instead of silently meaning
+// `info`. A bare `cdxgen cache` is left alone: it is a path, so scanning a
+// directory named `cache` keeps working.
+if (args._[0] === "cache" && args._.length > 1) {
+  const action = String(args._[1]);
+  if (!CACHE_ACTIONS.includes(action)) {
+    console.error(
+      `Unknown cache action "${action}". Expected one of: ${CACHE_ACTIONS.join(", ")}.`,
+    );
+    process.exit(1);
+  }
+  const { runCacheCommand } = await import("../lib/inventory/cacheCommands.js");
+  process.exit(await runCacheCommand(action));
+}
+
+if (args.help) {
+  console.log(`${retrieveCdxgenVersion()}\n`);
+  _yargs.showHelp();
+  process.exit(0);
+}
+if (args.bomAuditIncludeTrusted && args.bomAuditOnlyTrusted) {
+  console.error(
+    "Use either --bom-audit-include-trusted or --bom-audit-only-trusted, not both.",
+  );
+  process.exit(1);
+}
+
+if (args.tui && !readEnvironmentVariable("CI")) {
+  const cdxuiPath = resolvePluginBinary("cdxui");
+  if (cdxuiPath) {
+    const cdxgenArgs = process.argv.slice(2).filter((a) => a !== "--tui");
+    const cdxuiResult = safeSpawnSync(cdxuiPath, ["--generate"], {
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        CDXGEN_CMD:
+          readEnvironmentVariable("CDXGEN_CMD") || process.argv[1] || "cdxgen",
+        CDXGEN_ARGS: cdxgenArgs.join(" "),
+      },
+    });
+    process.exit(cdxuiResult.status || 0);
+  }
+}
+
+// Native Enterprise Network Configuration (Node.js v22.21+, Bun, Deno)
+// https://nodejs.org/en/learn/http/enterprise-network-configuration
+// https://docs.deno.com/runtime/reference/env_variables/#special-environment-variables
+// https://bun.com/docs/guides/http/proxy#environment-variables
+if (
+  readEnvironmentVariable("HTTP_PROXY") ||
+  readEnvironmentVariable("HTTPS_PROXY")
+) {
+  if (isNode && !isBun && !isDeno) {
+    process.env.NODE_USE_ENV_PROXY = "1";
+    try {
+      const proxyEnv = {
+        HTTP_PROXY: readEnvironmentVariable("HTTP_PROXY"),
+        HTTPS_PROXY: readEnvironmentVariable("HTTPS_PROXY"),
+        NO_PROXY: readEnvironmentVariable("NO_PROXY"),
+      };
+      http.globalAgent = new http.Agent({ proxyEnv });
+      https.globalAgent = new https.Agent({ proxyEnv });
+      thoughtLog("Configured native Node.js global agents for HTTP proxy. 🌐");
+    } catch (_e) {
+      console.warn(
+        "Warning: Native proxy configuration failed. Please use Node.js v22.21.0+ for proxy support.",
+      );
+    }
+  } else {
+    thoughtLog("Using runtime-native (Deno/Bun) proxy support. 🌐");
+  }
+}
+
+if (!readEnvironmentVariable("NODE_USE_SYSTEM_CA")) {
+  process.env.NODE_USE_SYSTEM_CA = "1";
+}
+
+const filePath = args._[0] || process.cwd();
+const sourceInputIsRemoteOrPurl =
+  maybeRemotePath(filePath) || maybePurlSource(filePath);
+if (!args.projectName) {
+  if (filePath !== ".") {
+    args.projectName = basename(filePath);
+  } else {
+    args.projectName = basename(resolve(filePath));
+  }
+}
+thoughtLog(`Let's try to generate a CycloneDX BOM for the path '${filePath}'`);
+if (
+  !sourceInputIsRemoteOrPurl &&
+  (filePath.includes(" ") || filePath.includes("\r") || filePath.includes("\n"))
+) {
+  console.log(
+    `'${filePath}' contains spaces. This could lead to bugs when invoking external build tools.`,
+  );
+  if (isSecureMode) {
+    process.exit(1);
+  }
+}
+// Support for obom/cbom aliases
+if (invokedCommandName.includes("obom") && !args.type) {
+  thoughtLog(
+    "Ok, the user wants to generate an Operations Bill-of-Materials (OBOM).",
+  );
+}
+if (invokedCommandName.includes("spdxgen") && !args.format) {
+  thoughtLog("Ok, defaulting the export format to SPDX.");
+}
+if (invokedCommandName.includes("aibom") && !args.type) {
+  thoughtLog(
+    "Ok, the user wants to generate an AI-BOM with direct model metadata and AI-focused inventory defaults.",
+  );
+}
+
+/**
+ * Command line options — built via the extracted buildOptionsFromArgs
+ * function in lib/cli/cliOptions.js. That function handles:
+ * - Command-name alias expansion (obom, spdxgen, aibom)
+ * - Field renames (type→projectType, recurse→multiProject, etc.)
+ * - Derived values (deep, noBabel, output path)
+ * - Post-construction overrides (dedup, cbom/saasbom, secure, dry-run,
+ *   standard→specVersion, HBOM formulation)
+ *
+ * The `userSetSpecVersion` flag solves a subtle bug: yargs always
+ * populates `specVersion` with its default (1.7), so checking
+ * `!options.specVersion` is always false. We compare against the
+ * yargs default to detect explicit user intent.
+ */
+const YARGS_SPEC_VERSION_DEFAULT = DEFAULT_CDX_SPEC_VERSION;
+const userSetSpecVersion = isUserProvided(
+  args.specVersion,
+  YARGS_SPEC_VERSION_DEFAULT,
+);
+const { options, warnings: phase3Warnings } = buildOptionsFromArgs(args, {
+  invokedCommandName,
+  filePath,
+  isRemoteOrPurl: sourceInputIsRemoteOrPurl,
+  userSetSpecVersion,
+  isDryRun,
+  isSecureMode,
+});
+const cliActivityProjectType = Array.isArray(options.projectType)
+  ? options.projectType.join(",")
+  : options.projectType;
+const cliActivityContext = {
+  projectType: cliActivityProjectType,
+  sourcePath: filePath,
+};
+setDryRunMode(options.dryRun);
+setActivityContext(cliActivityContext);
+const outputPlan = createOutputPlan(options);
+const outputIsStdout = options.output === "-";
+for (const outputFile of Object.values(outputPlan.outputs)) {
+  if (outputFile === "-") {
+    continue;
+  }
+  const outputDirectory = getOutputDirectory(outputFile);
+  if (
+    outputDirectory &&
+    outputDirectory !== process.cwd() &&
+    !safeExistsSync(outputDirectory)
+  ) {
+    safeMkdirSync(outputDirectory, { recursive: true });
+  }
+}
+// Configure the live-region UI from the parsed flags, then install the console
+// shim so every existing console.log call site lands on the diagnostic stream
+// (stderr) above the live region. Env equivalents keep working and win when
+// both are set (resolved inside ui.configure).
+{
+  // Verbosity ladder: 0 silent, 1 normal, 2 verbose, 3 debug. `undefined` means
+  // no flag was given, leaving the env vars to decide.
+  let flagLevel;
+  if (args.quiet) {
+    flagLevel = 0;
+  } else if (args.verbose >= 2) {
+    flagLevel = 3;
+  } else if (args.verbose >= 1) {
+    flagLevel = 2;
+  }
+  const colorByFlag = { always: true, never: false };
+  defaultUi.configure({
+    level: flagLevel,
+    format: args.logFormat,
+    noProgress: args.progress === false,
+    color: colorByFlag[args.color],
+  });
+  installConsoleShim(defaultUi);
+  // Restore the original console when the process exits so post-IIFE output
+  // (and any atexit hooks) uses the real streams.
+  process.once("exit", restoreConsole);
+}
+// HBOM validation (side-effects that must stay in the CLI entry point)
+try {
+  ensureNoMixedHbomProjectTypes(options.projectType);
+  if (hasHbomProjectType(options.projectType)) {
+    ensureSupportedHbomSpecVersion(options.specVersion);
+  }
+} catch (error) {
+  console.error(error.message);
+  process.exit(1);
+}
+if (!options.projectType) {
+  thoughtLog(
+    "Ok, the user wants me to identify all the project types and generate a consolidated BOM document.",
+  );
+}
+// Handle dedicated cbom and saasbom commands
+if (["cbom", "saasbom"].includes(invokedCommandName)) {
+  if (invokedCommandName.includes("cbom")) {
+    thoughtLog(
+      "Ok, the user wants to generate Cryptographic Bill-of-Materials (CBOM).",
+    );
+  } else if (invokedCommandName.includes("saasbom")) {
+    thoughtLog(
+      "Ok, the user wants to generate a Software as a Service Bill-of-Materials (SaaSBOM). I should carefully collect the services, endpoints, and data flows.",
+    );
+    if (readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true") {
+      thoughtLog(
+        "Wait, I'm not running in a container. This means the chances of successfully collecting this inventory are quite low. Perhaps this is an advanced user who has set up atom and atom-tools already 🤔?",
+      );
+    }
+  }
+}
+if (invokedCommandName.includes("cdxgen-secure")) {
+  thoughtLog(
+    "Ok, the user wants cdxgen to run in secure mode by default. Let's try and use the permissions api.",
+  );
+  process.env.CDXGEN_SECURE_MODE = true;
+}
+if (isDryRun) {
+  thoughtLog(
+    "Ok, the user wants cdxgen to run in dry-run mode. I must avoid writes, child processes, temp directories, network submissions, and cloning.",
+  );
+}
+for (const warning of phase3Warnings) {
+  if (warning.level === "error") {
+    console.error(warning.message);
+    process.exit(1);
+  } else if (warning.level === "warn") {
+    console.warn(`\x1b[1;35m${warning.message}\x1b[0m`);
+    if (isSecureMode) {
+      process.exit(1);
+    }
+  } else {
+    console.log(warning.message);
+  }
+}
+if (options.includeFormulation && options.serverUrl) {
+  thoughtLog(
+    "Wait, the user specified a server URL and wants to include formulation data. Let's warn about accidentally disclosing sensitive data to a remote server.",
+  );
+} else if (options.includeFormulation) {
+  thoughtLog(
+    "Wait, the user wants to include formulation data. Let's warn about accidentally disclosing sensitive data via the generated BOM.",
+  );
+}
+
+/**
+ * Apply advanced options (profile, lifecycle, technique expansion).
+ */
+if (options?.profile !== "generic") {
+  thoughtLog(`BOM profile to use is '${options.profile}'.`);
+} else {
+  thoughtLog(
+    "The user hasn't specified a profile. Should I suggest one to optimize the BOM for a specific use case or persona 🤔?",
+  );
+}
+if (options.lifecycle) {
+  thoughtLog(`BOM must be generated for the lifecycle '${options.lifecycle}'.`);
+}
+const isHbomOnlyInvocation = isHbomOnlyProjectTypes(options.projectType);
+const advancedWarnings = applyAdvancedOptionsImpl(options, {
+  isSecureMode,
+});
+if (options?.technique && Array.isArray(options.technique)) {
+  if (options.technique.length === 1) {
+    thoughtLog(
+      `Wait, the user wants me to use only the following technique: '${options.technique.join(", ")}'.`,
+    );
+  } else {
+    thoughtLog(
+      `Alright, I will use only the following techniques: '${options.technique.join(", ")}' for the final BOM.`,
+    );
+  }
+}
+if (!options.installDeps) {
+  thoughtLog(
+    "I must avoid any package installations and focus solely on the available artefacts, such as lock files.",
+  );
+}
+if (options.bomAudit && isHbomOnlyInvocation) {
+  thoughtLog(
+    "HBOM-only bom-audit runs should stay focused on hardware inventory. Skipping automatic formulation collection.",
+  );
+}
+// Surface warnings from applyAdvancedOptions
+for (const warning of advancedWarnings) {
+  if (warning.level === "error") {
+    console.log(warning.message);
+    process.exit(1);
+  } else {
+    console.log(warning.message);
+  }
+}
+if (options.bomAudit && !options.bomAuditCategories) {
+  const defaultBomAuditCategories = getDefaultBomAuditCategories(
+    options,
+    process.argv[1],
+  );
+  if (defaultBomAuditCategories) {
+    options.bomAuditCategories = defaultBomAuditCategories;
+    thoughtLog(
+      `Defaulting BOM audit categories to '${defaultBomAuditCategories}' for this OBOM or explicit os-only invocation.`,
+    );
+  }
+}
+
+setActivityContext({
+  projectType: "environment",
+  sourcePath: filePath,
+});
+const envAuditFindings = auditEnvironment(process.env, options);
+setActivityContext(cliActivityContext);
+if (options.envAudit) {
+  displaySelfThreatModel(filePath, config, options, envAuditFindings);
+}
+
+/**
+ * Check for node permission model
+ *
+ * @param {string} filePath File path
+ * @param {Object} options CLI Options
+ * @returns
+ */
+const checkPermissions = (filePath, options) => {
+  const fullFilePath = resolve(filePath);
+  if (
+    process.getuid &&
+    process.getuid() === 0 &&
+    readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true" &&
+    readEnvironmentVariable("RUNNING_IN_SAFER_EXEC_SANDBOX") !== "true"
+  ) {
+    console.log(
+      "\x1b[1;35mSECURE MODE: DO NOT run cdxgen with root privileges.\x1b[0m",
+    );
+  }
+  if (!process.permission) {
+    if (isSecureMode) {
+      console.log(
+        "\x1b[1;35mSecure mode requires permission-related arguments. These can be passed as CLI arguments directly to the node runtime or set the NODE_OPTIONS environment variable as shown below.\x1b[0m",
+      );
+      const childProcessArgs = isDryRun
+        ? ""
+        : options?.lifecycle !== "pre-build"
+          ? " --allow-child-process"
+          : "";
+      const fsWriteArgs = isDryRun
+        ? ""
+        : ` --allow-fs-write="${getTmpDir()}/*" --allow-fs-write="${options.output}"`;
+      const nodeOptionsVal = `--permission --allow-fs-read="${getTmpDir()}/*" --allow-fs-read="${fullFilePath}/*"${fsWriteArgs}${childProcessArgs}`;
+      console.log(
+        `${isWin ? "$env:" : "export "}NODE_OPTIONS='${nodeOptionsVal}'`,
+      );
+      if (readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true") {
+        console.log(
+          "TIP: Run cdxgen using the secure container image 'ghcr.io/cdxgen/cdxgen-secure' for best experience.",
+        );
+      }
+    }
+    return true;
+  }
+  // Secure mode checks
+  if (isSecureMode) {
+    if (readEnvironmentVariable("GITHUB_TOKEN")) {
+      console.log(
+        "Ensure that the GitHub token provided to cdxgen is restricted to read-only scopes.",
+      );
+    }
+    if (process.permission.has("fs.read", "*")) {
+      console.log(
+        "\x1b[1;35mSECURE MODE: DO NOT run cdxgen with FileSystemRead permission set to wildcard.\x1b[0m",
+      );
+    }
+    if (process.permission.has("fs.write", "*")) {
+      console.log(
+        "\x1b[1;35mSECURE MODE: DO NOT run cdxgen with FileSystemWrite permission set to wildcard.\x1b[0m",
+      );
+    }
+    if (process.permission.has("worker")) {
+      console.log(
+        "SECURE MODE: DO NOT run cdxgen with worker thread permission! Remove `--allow-worker` argument.",
+      );
+    }
+    if (filePath !== fullFilePath) {
+      console.log(
+        `\x1b[1;35mSECURE MODE: Invoke cdxgen with an absolute path to improve security. Use '${fullFilePath}' instead of '${filePath}'\x1b[0m`,
+      );
+      if (fullFilePath.includes(" ")) {
+        console.log(
+          "\x1b[1;35mSECURE MODE: Directory names containing spaces are known to cause issues. Rename the directories by replacing spaces with hyphens or underscores.\x1b[0m",
+        );
+      } else if (fullFilePath.length > 255 && isWin) {
+        console.log(
+          "Ensure 'Enable Win32 Long paths' is set to 'Enabled' by using Group Policy Editor.",
+        );
+      }
+      return false;
+    }
+  }
+
+  if (!process.permission.has("fs.read", filePath)) {
+    console.log(
+      `\x1b[1;35mSECURE MODE: FileSystemRead permission required. Please invoke cdxgen with the argument --allow-fs-read="${resolve(
+        filePath,
+      )}"\x1b[0m`,
+    );
+    return false;
+  }
+  if (
+    !isDryRun &&
+    options.output !== "-" &&
+    !process.permission.has("fs.write", options.output)
+  ) {
+    console.log(
+      `\x1b[1;35mSECURE MODE: FileSystemWrite permission is required to create the output BOM file. Please invoke cdxgen with the argument --allow-fs-write="${options.output}"\x1b[0m`,
+    );
+  }
+  if (!isDryRun && options.evidence) {
+    const slicesFilesKeys = [
+      "deps-slices-file",
+      "usages-slices-file",
+      "reachables-slices-file",
+    ];
+    if (options?.type?.includes("swift") || options?.type?.includes("scala")) {
+      slicesFilesKeys.push("semantics-slices-file");
+    }
+    for (const sf of slicesFilesKeys) {
+      let issueFound = false;
+      if (!process.permission.has("fs.write", options[sf])) {
+        console.log(
+          `SECURE MODE: FileSystemWrite permission is required to create the output slices file. Please invoke cdxgen with the argument --allow-fs-write="${options[sf]}"`,
+        );
+        if (!issueFound) {
+          issueFound = true;
+        }
+      }
+      if (issueFound) {
+        return false;
+      }
+    }
+  }
+  if (!isDryRun && !process.permission.has("fs.write", getTmpDir())) {
+    console.log(
+      `FileSystemWrite permission may be required for the TEMP directory. Please invoke cdxgen with the argument --allow-fs-write="${join(getTmpDir(), "*")}" in case of any crashes.`,
+    );
+    if (isMac) {
+      console.log(
+        "TIP: macOS doesn't use the `/tmp` prefix for TEMP directories. Use the argument shown above.",
+      );
+    }
+  }
+  if (!isDryRun && !process.permission.has("child") && !isSecureMode) {
+    console.log(
+      "ChildProcess permission is missing. This is required to spawn commands for some languages. Please invoke cdxgen with the argument --allow-child-process in case of issues.",
+    );
+  }
+  if (
+    !isDryRun &&
+    process.permission.has("child") &&
+    options?.lifecycle === "pre-build"
+  ) {
+    console.log(
+      "SECURE MODE: ChildProcess permission is not required for pre-build SBOM generation. Please invoke cdxgen without the argument --allow-child-process.",
+    );
+    return false;
+  }
+  return true;
+};
+
+const needsBomSigning = ({ generateKeyAndSign }) =>
+  generateKeyAndSign ||
+  (() => {
+    setActivityContext({ projectType: "environment" });
+    const sbomSignAlgorithm = readEnvironmentVariable("SBOM_SIGN_ALGORITHM");
+    const sbomSignPrivateKey = readEnvironmentVariable(
+      "SBOM_SIGN_PRIVATE_KEY",
+      {
+        sensitive: true,
+      },
+    );
+    const sbomSignPrivateKeyBase64 = readEnvironmentVariable(
+      "SBOM_SIGN_PRIVATE_KEY_BASE64",
+      {
+        sensitive: true,
+      },
+    );
+    return (
+      sbomSignAlgorithm &&
+      sbomSignAlgorithm !== "none" &&
+      ((sbomSignPrivateKey && safeExistsSync(sbomSignPrivateKey)) ||
+        sbomSignPrivateKeyBase64)
+    );
+  })();
+
+const stringifyJson = (jsonPayload, jsonPretty) =>
+  typeof jsonPayload === "string" || jsonPayload instanceof String
+    ? jsonPayload
+    : JSON.stringify(jsonPayload, null, jsonPretty ? 2 : null);
+
+const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
+  const jsonPayload = stringifyJson(bomJson, options.jsonPretty);
+  safeWriteSync(jsonFile, jsonPayload);
+  if (jsonFile.endsWith("bom.json")) {
+    thoughtLog(
+      `Let's save the file to "${jsonFile}". Should I suggest the '.cdx.json' file extension for better semantics?`,
+    );
+  } else {
+    thoughtLog(`Let's save the file to "${jsonFile}".`);
+  }
+  if (!jsonPayload || !needsBomSigning(options)) {
+    return jsonPayload;
+  }
+  if (isDryRun) {
+    recordActivity({
+      kind: "sign",
+      reason: "Dry run mode skips BOM signing and key generation.",
+      status: "blocked",
+      target: jsonFile,
+    });
+    return jsonPayload;
+  }
+  const sbomSignAlgorithm = readEnvironmentVariable("SBOM_SIGN_ALGORITHM");
+  const sbomSignPrivateKey = readEnvironmentVariable("SBOM_SIGN_PRIVATE_KEY", {
+    sensitive: true,
+  });
+  const sbomSignPrivateKeyBase64 = readEnvironmentVariable(
+    "SBOM_SIGN_PRIVATE_KEY_BASE64",
+    {
+      sensitive: true,
+    },
+  );
+  const sbomSignPublicKey = readEnvironmentVariable("SBOM_SIGN_PUBLIC_KEY");
+  const sbomSignPublicKeyBase64 = readEnvironmentVariable(
+    "SBOM_SIGN_PUBLIC_KEY_BASE64",
+  );
+  let alg = sbomSignAlgorithm || "RS512";
+  if (alg.includes("none")) {
+    alg = "RS512";
+  }
+  let privateKeyToUse;
+  let jwkPublicKey;
+  let publicKeyFile;
+  if (options.generateKeyAndSign) {
+    const jdirName = dirname(jsonFile);
+    publicKeyFile = join(jdirName, "public.key");
+    const privateKeyFile = join(jdirName, "private.key");
+    const privateKeyB64File = join(jdirName, "private.key.base64");
+    const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
+      modulusLength: 4096,
+      publicKeyEncoding: {
+        type: "spki",
+        format: "pem",
+      },
+      privateKeyEncoding: {
+        type: "pkcs8",
+        format: "pem",
+      },
+    });
+    safeWriteSync(publicKeyFile, publicKey);
+    safeWriteSync(privateKeyFile, privateKey);
+    safeWriteSync(
+      privateKeyB64File,
+      Buffer.from(privateKey, "utf8").toString("base64"),
+    );
+    console.log(
+      "Created public/private key pairs for testing purposes",
+      publicKeyFile,
+      privateKeyFile,
+      privateKeyB64File,
+    );
+    privateKeyToUse = privateKey;
+    jwkPublicKey = crypto.createPublicKey(publicKey).export({ format: "jwk" });
+  } else {
+    if (sbomSignPrivateKey) {
+      recordSensitiveFileRead(sbomSignPrivateKey, {
+        label: "SBOM signing private key",
+      });
+      privateKeyToUse = fs.readFileSync(sbomSignPrivateKey, "utf8");
+    } else if (sbomSignPrivateKeyBase64) {
+      privateKeyToUse = Buffer.from(
+        sbomSignPrivateKeyBase64,
+        "base64",
+      ).toString("utf8");
+    }
+    if (sbomSignPublicKey && safeExistsSync(sbomSignPublicKey)) {
+      jwkPublicKey = crypto
+        .createPublicKey(fs.readFileSync(sbomSignPublicKey, "utf8"))
+        .export({ format: "jwk" });
+    } else if (sbomSignPublicKeyBase64) {
+      jwkPublicKey = Buffer.from(sbomSignPublicKeyBase64, "base64").toString(
+        "utf8",
+      );
+    }
+  }
+  try {
+    const bomJsonUnsignedObj = JSON.parse(jsonPayload);
+    const signOptions = {
+      privateKey: privateKeyToUse,
+      algorithm: alg,
+      publicKeyJwk: jwkPublicKey,
+      mode: readEnvironmentVariable("SBOM_SIGN_MODE") || "replace",
+      signComponents: true,
+      signServices: true,
+      signAnnotations: true,
+    };
+    thoughtLog(`Signing the BOM file "${jsonFile}".`);
+    recordActivity({
+      kind: "sign",
+      status: "completed",
+      target: jsonFile,
+    });
+    const signedBom = signBom(bomJsonUnsignedObj, signOptions);
+    safeWriteSync(
+      jsonFile,
+      JSON.stringify(signedBom, null, options.jsonPretty ? 2 : null),
+    );
+    if (publicKeyFile) {
+      const publicKeyStr = fs.readFileSync(publicKeyFile, "utf8");
+      const signatureVerification = verifyBom(signedBom, publicKeyStr);
+      if (signatureVerification) {
+        console.log(
+          "SBOM signature is verifiable natively with the public key and the algorithm",
+          publicKeyFile,
+          alg,
+        );
+      } else {
+        console.log("SBOM signature verification was unsuccessful");
+        console.log("Check if the public key was exported in PEM format");
+      }
+    }
+  } catch (ex) {
+    console.log("SBOM signing was unsuccessful:", ex.message);
+    console.log(
+      "Check if the private key was exported in PEM format and the algorithm is JSF-compliant.",
+    );
+  }
+  return jsonPayload;
+};
+
+/**
+ * Method to start the bom creation process
+ */
+(async () => {
+  // Display the sponsor banner
+  printSponsorBanner(options);
+  // Our quest to audit and check the SBOM generation environment to prevent our users from getting exploited
+  // during SBOM generation.
+  if (envAuditFindings?.length) {
+    printEnvironmentAuditFindings(envAuditFindings);
+    // Only abort in secure mode for high or critical findings; low/medium are informational.
+    if (
+      isSecureMode &&
+      envAuditFindings.some((f) => ["high", "critical"].includes(f.severity))
+    ) {
+      process.exit(1);
+    }
+  }
+  // Start SBOM server
+  if (options.server) {
+    const serverModule = await import("../lib/server/server.js");
+    return serverModule.start(options);
+  }
+  let sourcePath = filePath;
+  let purlResolution;
+  const directHuggingFaceSource = normalizeHuggingFaceReference(sourcePath);
+  if (isDryRun && directHuggingFaceSource) {
+    recordActivity({
+      kind: "read",
+      reason: "Dry run mode blocks direct Hugging Face metadata resolution.",
+      status: "blocked",
+      target: sourcePath,
+    });
+    console.warn("Dry run mode skips direct Hugging Face metadata resolution.");
+    printActivitySummary(options.activityReport);
+    return;
+  }
+  if (isDryRun && maybePurlSource(sourcePath) && !directHuggingFaceSource) {
+    recordActivity({
+      kind: "clone",
+      reason:
+        "Dry run mode blocks package-url source resolution and repository cloning.",
+      status: "blocked",
+      target: sourcePath,
+    });
+    console.warn("Dry run mode skips purl source resolution.");
+    printActivitySummary(options.activityReport);
+    return;
+  }
+  if (maybePurlSource(sourcePath) && !directHuggingFaceSource) {
+    const purlValidationError = validatePurlSource(sourcePath);
+    if (purlValidationError) {
+      console.error(purlValidationError.error, purlValidationError.details);
+      process.exit(1);
+    }
+    purlResolution = await resolveGitUrlFromPurl(sourcePath, {
+      fetchPomXmlAsJson,
+    });
+    if (!purlResolution?.repoUrl) {
+      console.error(
+        "Unable to resolve the provided package URL to a repository URL.",
+      );
+      process.exit(1);
+    }
+    console.warn(
+      `${PURL_REGISTRY_LOOKUP_WARNING} Registry: ${purlResolution.registry}, purl type: ${purlResolution.type}, resolved URL: ${sanitizeRemoteUrlForLogs(purlResolution.repoUrl)}`,
+    );
+    sourcePath = purlResolution.repoUrl;
+  }
+  if (
+    maybeRemotePath(sourcePath) &&
+    !directHuggingFaceSource &&
+    isSecureMode &&
+    !readEnvironmentVariable("CDXGEN_GIT_ALLOWED_HOSTS") &&
+    !readEnvironmentVariable("CDXGEN_SERVER_ALLOWED_HOSTS")
+  ) {
+    console.error(
+      "SECURE MODE: Configure CDXGEN_GIT_ALLOWED_HOSTS (or CDXGEN_SERVER_ALLOWED_HOSTS) before using git URL or purl sources.",
+    );
+    process.exit(1);
+  }
+  if (!maybeRemotePath(sourcePath) && !isAllowedPath(resolve(sourcePath))) {
+    console.error(
+      "Path is not allowed as per CDXGEN_ALLOWED_PATHS/CDXGEN_SERVER_ALLOWED_PATHS.",
+    );
+    process.exit(1);
+  }
+  if (!maybeRemotePath(sourcePath) && !isAllowedWinPath(resolve(sourcePath))) {
+    console.error("Path is not allowed on this platform.");
+    process.exit(1);
+  }
+  if (maybeRemotePath(sourcePath) && !directHuggingFaceSource) {
+    const validationError = validateAndRejectGitSource(sourcePath);
+    if (validationError) {
+      console.error(validationError.error, validationError.details);
+      process.exit(1);
+    }
+  }
+  const checkPath = directHuggingFaceSource
+    ? process.cwd()
+    : maybeRemotePath(sourcePath)
+      ? getTmpDir()
+      : sourcePath;
+  if (maybeRemotePath(sourcePath) && !directHuggingFaceSource) {
+    options.releaseNotesGitUrl = sourcePath;
+  }
+  if (!checkPermissions(checkPath, options)) {
+    if (isSecureMode) {
+      process.exit(1);
+    }
+    return;
+  }
+  let srcDir = sourcePath;
+  let cleanup = false;
+  let gitRef = options.gitBranch;
+  if (maybeRemotePath(sourcePath) && !directHuggingFaceSource) {
+    if (isDryRun) {
+      recordActivity({
+        kind: "clone",
+        reason: "Dry run mode blocks cloning git URL sources.",
+        status: "blocked",
+        target: sourcePath,
+      });
+      console.warn("Dry run mode skips remote git source cloning.");
+      printActivitySummary(options.activityReport);
+      return;
+    }
+    if (!gitRef && purlResolution?.version) {
+      gitRef = findGitRefForPurlVersion(sourcePath, purlResolution);
+      if (!gitRef) {
+        console.warn(
+          `Unable to find a matching git tag for version '${purlResolution.version}'. Falling back to repository default branch.`,
+        );
+      }
+    }
+    srcDir = gitClone(sourcePath, gitRef);
+    if (purlResolution?.type === "npm") {
+      const cloneRootDir = srcDir;
+      const purlSourceDir = resolvePurlSourceDirectory(srcDir, purlResolution);
+      if (purlSourceDir) {
+        if (purlSourceDir !== cloneRootDir) {
+          const relativeDir = relative(cloneRootDir, purlSourceDir);
+          if (relativeDir.startsWith("..") || isAbsolute(relativeDir)) {
+            console.warn(
+              `Ignoring detected npm package directory outside clone root: ${purlSourceDir}`,
+            );
+          } else {
+            console.warn(
+              `Using npm package directory '${purlSourceDir}' for purl '${purlResolution.namespace ? `${purlResolution.namespace}/` : ""}${purlResolution.name}'.`,
+            );
+            srcDir = purlSourceDir;
+          }
+        }
+      }
+    }
+    cleanup = true;
+  }
+  setActivityContext({ sourcePath: srcDir });
+  if (!hasHbomProjectType(options.projectType)) {
+    const prepPhase = defaultUi.phase("Preparing environment");
+    try {
+      prepareEnv(srcDir, options);
+      prepPhase.succeed("");
+    } catch (err) {
+      prepPhase.fail(err);
+      throw err;
+    }
+  }
+  thoughtLog("Getting ready to generate the BOM ⚡️.");
+  if (DEBUG_MODE) {
+    try {
+      const { cdxrsAvailable } = await import("../lib/inventory/cdxrs.js");
+      const rs = cdxrsAvailable("info");
+      console.log(
+        `cdxrs: ${rs.available ? `available (${rs.version})` : `not available (${rs.reason}) — using JS path`}`,
+      );
+    } catch {
+      console.log("cdxrs: bridge not loaded — using JS path");
+    }
+  }
+  const originalFetchPackageMetadata = readEnvironmentVariable(
+    "CDXGEN_FETCH_PKG_METADATA",
+  );
+  const shouldRunPredictiveAudit = shouldRunPredictiveBomAudit(
+    options,
+    process.argv[1],
+  );
+  if (options.bomAudit && shouldRunPredictiveAudit) {
+    process.env.CDXGEN_FETCH_PKG_METADATA = "true";
+  }
+  let bomNSData;
+  const bomPhase = defaultUi.phase("Generating BOM");
+  try {
+    bomNSData = (await createBom(srcDir, options)) || {};
+    bomPhase.succeed(
+      `${bomNSData?.bomJson?.components?.length || 0} components`,
+    );
+  } catch (err) {
+    bomPhase.fail(err);
+    throw err;
+  } finally {
+    if (originalFetchPackageMetadata === undefined) {
+      delete process.env.CDXGEN_FETCH_PKG_METADATA;
+    } else {
+      process.env.CDXGEN_FETCH_PKG_METADATA = originalFetchPackageMetadata;
+    }
+  }
+  if (bomNSData?.bomJson) {
+    thoughtLog(
+      "Tweaking the generated BOM data with useful annotations and properties.",
+    );
+  }
+  // AI provenance/oversight detection is opt-in during generation via
+  // `-t ai-provenance`. The detected cdx:ai:codegen:* / cdx:ai:oversight:*
+  // properties are written to the BOM document root (bomJson.properties) BEFORE
+  // post-processing so the generated annotation summary can reference them.
+  const isAiProvenanceGeneration =
+    Array.isArray(options.projectType) &&
+    options.projectType.some((t) =>
+      ["ai-provenance", "ai-authorship", "aicode", "ai-codegen"].includes(t),
+    );
+  if (isAiProvenanceGeneration && bomNSData?.bomJson) {
+    const { ensureAiProvenanceProperties, ensureAiOversightProperties } =
+      await import("../lib/stages/postgen/auditBom.js");
+    ensureAiProvenanceProperties(bomNSData.bomJson, options);
+    await ensureAiOversightProperties(bomNSData.bomJson, options);
+  }
+  // TEA upstream SBOM fetch runs BEFORE post-processing so the "upstream wins"
+  // merge and the provenance citations flow through the normal pipeline.
+  if (options.teaFetch) {
+    const { applyTeaFetch } = await import("../lib/ecosystems/tea.js");
+    bomNSData = await applyTeaFetch(bomNSData, options);
+  }
+  // Add extra metadata and annotations with post processing
+  {
+    const postPhase = defaultUi.phase("Post-processing BOM");
+    try {
+      bomNSData = postProcess(
+        bomNSData,
+        { ...options, executeOsQuery },
+        srcDir,
+      );
+      postPhase.succeed("");
+    } catch (err) {
+      postPhase.fail(err);
+      throw err;
+    }
+  }
+  setActivityContext({
+    projectType: Array.isArray(options.projectType)
+      ? options.projectType.join(",")
+      : options.projectType,
+    sourcePath: srcDir,
+  });
+  if (options.bomAudit && bomNSData?.bomJson) {
+    const { finalizeAuditReport, runAuditFromBoms } = await import(
+      "../lib/audit/index.js"
+    );
+    const { createProgressTracker } = await import("../lib/audit/progress.js");
+    const { collectAuditTargets } = await import("../lib/audit/targets.js");
+    const { formatPredictiveAnnotations, renderConsoleReport } = await import(
+      "../lib/audit/reporters.js"
+    );
+    const {
+      auditBom,
+      formatDryRunSupportSummary,
+      formatAnnotations,
+      formatConsoleOutput,
+      getBomAuditDryRunSupportSummary,
+      hasCriticalFindings,
+    } = await import("../lib/stages/postgen/auditBom.js");
+    thoughtLog("Let's run security audit...");
+    const postAuditFindings = await auditBom(bomNSData.bomJson, {
+      ...options,
+      getBomWithOras,
+    });
+    if (postAuditFindings.length) {
+      formatConsoleOutput(postAuditFindings);
+    } else if (DEBUG_MODE) {
+      console.log("BOM audit: No findings");
+    }
+    if (isDryRun) {
+      const dryRunSupportSummary =
+        await getBomAuditDryRunSupportSummary(options);
+      const dryRunSupportMessage =
+        formatDryRunSupportSummary(dryRunSupportSummary);
+      if (dryRunSupportMessage) {
+        console.log(dryRunSupportMessage);
+      }
+    }
+    if (postAuditFindings.length && options.specVersion >= 1.4) {
+      bomNSData.bomJson.annotations = [
+        ...(bomNSData.bomJson.annotations || []),
+        ...formatAnnotations(postAuditFindings, bomNSData.bomJson),
+      ];
+      thoughtLog(
+        `Embedded ${postAuditFindings.length} audit findings as CycloneDX annotations`,
+      );
+    }
+    if (isSecureMode && hasCriticalFindings(postAuditFindings, options)) {
+      console.error("\nSecure mode: Critical audit findings detected.");
+      console.error(
+        "Review findings above or adjust --bom-audit-fail-severity to proceed.",
+      );
+      if (cleanup) {
+        cleanupSourceDir(srcDir);
+      }
+      process.exit(1);
+    }
+
+    if (!shouldRunPredictiveAudit) {
+      thoughtLog(
+        "Skipping predictive dependency audit for this OBOM or explicit os-only invocation.",
+      );
+    } else {
+      thoughtLog("Let's run predictive dependency audit...");
+      const progressTracker = createProgressTracker();
+      const predictiveAuditScope =
+        options.bomAuditScope === "required" ? "required" : undefined;
+      const predictiveAuditTrusted = options.bomAuditOnlyTrusted
+        ? "only"
+        : options.bomAuditIncludeTrusted
+          ? "include"
+          : undefined;
+      const requiredAuditTargetCount = collectAuditTargets(
+        [
+          {
+            bomJson: bomNSData.bomJson,
+            source: filePath,
+          },
+        ],
+        {
+          scope: "required",
+          trusted: predictiveAuditTrusted,
+        },
+      ).targets.length;
+      const predictiveAuditMaxTargets =
+        typeof options.bomAuditMaxTargets === "number" &&
+        options.bomAuditMaxTargets > 0
+          ? options.bomAuditMaxTargets
+          : predictiveAuditScope === "required"
+            ? undefined
+            : Math.max(50, requiredAuditTargetCount);
+      let predictiveReport;
+      try {
+        predictiveReport = await runAuditFromBoms(
+          [
+            {
+              bomJson: bomNSData.bomJson,
+              source: filePath,
+            },
+          ],
+          {
+            categories: options.bomAuditCategories
+              ? options.bomAuditCategories
+                  .split(",")
+                  .map((category) => category.trim())
+                  .filter(Boolean)
+              : undefined,
+            failSeverity: options.bomAuditFailSeverity,
+            maxTargets: predictiveAuditMaxTargets,
+            minSeverity: options.bomAuditMinSeverity,
+            onProgress: progressTracker.onProgress,
+            scope: predictiveAuditScope,
+            trusted: predictiveAuditTrusted,
+            trustedSelectionHelp:
+              "Use --bom-audit-include-trusted to include them or --bom-audit-only-trusted to audit just those packages.",
+          },
+        );
+      } finally {
+        progressTracker.stop();
+      }
+      if (predictiveReport.summary.totalTargets > 0) {
+        process.stderr.write(
+          renderConsoleReport(predictiveReport, {
+            minSeverity: options.bomAuditMinSeverity,
+          }),
+        );
+      } else if (DEBUG_MODE) {
+        console.log(
+          "Predictive BOM audit: No supported npm/PyPI targets found",
+        );
+      }
+      const predictiveAnnotations = formatPredictiveAnnotations(
+        predictiveReport,
+        bomNSData.bomJson,
+        {
+          minSeverity: options.bomAuditMinSeverity,
+        },
+      );
+      if (predictiveAnnotations.length && options.specVersion >= 1.4) {
+        bomNSData.bomJson.annotations = [
+          ...(bomNSData.bomJson.annotations || []),
+          ...predictiveAnnotations,
+        ];
+        thoughtLog(
+          `Embedded ${predictiveAnnotations.length} predictive audit annotations`,
+        );
+      }
+      const predictiveResult = finalizeAuditReport(predictiveReport, {
+        failSeverity: options.bomAuditFailSeverity,
+        minSeverity: options.bomAuditMinSeverity,
+        report: "console",
+      });
+      if (isSecureMode && predictiveResult.exitCode === 3) {
+        console.error(
+          "\nSecure mode: Predictive audit findings exceeded the configured threshold.",
+        );
+        console.error(
+          "Review findings above or adjust --bom-audit-fail-severity to proceed.",
+        );
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+    }
+  }
+  let internalCycloneDxInputPath = outputPlan.outputs.cyclonedx;
+  if ((options.evidence || options.includeCrypto) && bomNSData?.bomJson) {
+    if (!internalCycloneDxInputPath) {
+      internalCycloneDxInputPath = join(
+        getTmpDir(),
+        `cdxgen-${Date.now()}-${basename(filePath)}.cdx.json`,
+      );
+    }
+    if (isDryRun) {
+      recordActivity({
+        kind: "write",
+        reason:
+          "Dry run mode skips evidence input materialization because it writes a temporary BOM file.",
+        status: "blocked",
+        target: internalCycloneDxInputPath,
+      });
+    } else {
+      safeWriteSync(
+        internalCycloneDxInputPath,
+        stringifyJson(bomNSData.bomJson, options.jsonPretty),
+      );
+    }
+  }
+  // Evidence generation
+  if (options.evidence || options.includeCrypto) {
+    if (isDryRun) {
+      recordActivity({
+        kind: "write",
+        reason:
+          "Dry run mode skips evidence and crypto enrichment because those flows require temp files and additional processing.",
+        status: "blocked",
+        target: options.evinseOutput || options.output || "evinse",
+      });
+    } else {
+      // Set the evinse output file to be the same as output file
+      if (!options.evinseOutput) {
+        options.evinseOutput = options.output;
+      }
+      setActivityContext({
+        projectType: "evinse",
+        sourcePath: filePath,
+      });
+      const evinserModule = await import("../lib/evinser/evinser.js");
+      options.projectType = options.projectType || ["java"];
+      const evinseOptions = {
+        _: args._,
+        input: internalCycloneDxInputPath || options.output,
+        output: options.evinseOutput,
+        language: options.projectType,
+        skipMavenCollector: false,
+        force: false,
+        withReachables: options.deep,
+        usagesSlicesFile: options.usagesSlicesFile,
+        dataFlowSlicesFile: options.dataFlowSlicesFile,
+        reachablesSlicesFile: options.reachablesSlicesFile,
+        semanticsSlicesFile: options.semanticsSlicesFile,
+        openapiSpecFile: options.openapiSpecFile,
+        componentType: options.componentType,
+        includeCrypto:
+          options.includeCrypto &&
+          isCycloneDxComponentTypeEnabled("cryptographic-asset", options),
+        specVersion: options.specVersion,
+        profile: options.profile,
+        jsonPretty: options.jsonPretty,
+      };
+      const dbObjMap = await evinserModule.prepareDB(evinseOptions);
+      if (dbObjMap) {
+        const sliceArtefacts = await evinserModule.analyzeProject(
+          dbObjMap,
+          evinseOptions,
+        );
+        const evinseJson = evinserModule.createEvinseFile(
+          sliceArtefacts,
+          evinseOptions,
+        );
+        bomNSData.bomJson = evinseJson;
+        if (options.print && evinseJson) {
+          printOccurrences(evinseJson);
+          printCallStack(evinseJson);
+          printReachables(sliceArtefacts);
+          printServices(evinseJson);
+        }
+      }
+    }
+  }
+  // Perform automatic validation
+  if (options.validate && bomNSData?.bomJson) {
+    thoughtLog("Wait, let's check the generated BOM file for any issues.");
+    const validatePhase = defaultUi.phase("Validating BOM");
+    const validation = await validateGeneratedBom(bomNSData.bomJson);
+    const validationTarget = `cyclonedx-${bomNSData.bomJson.specVersion || options.specVersion}`;
+    if (!validation.valid) {
+      validatePhase.fail("schema validation failed");
+      recordActivity({
+        kind: "validate",
+        reason: `The BOM failed schema validation using the ${validation.source} validator.`,
+        status: "failed",
+        target: validationTarget,
+      });
+      if (cleanup) {
+        cleanupSourceDir(srcDir);
+      }
+      process.exit(1);
+    } else {
+      validatePhase.succeed(`valid (${validation.source})`);
+      recordActivity({
+        kind: "validate",
+        reason: `Validated the BOM against the CycloneDX schema using the ${validation.source} validator.`,
+        status: "completed",
+        target: validationTarget,
+      });
+      thoughtLog("✅ BOM file looks valid.");
+    }
+  } else if (bomNSData?.bomJson) {
+    recordActivity({
+      kind: "validate",
+      reason: "Validation is disabled with --no-validate.",
+      status: "blocked",
+      target: `cyclonedx-${bomNSData.bomJson.specVersion || options.specVersion}`,
+    });
+  }
+  if (
+    outputPlan.formats.has("spdx") &&
+    bomNSData?.bomJson &&
+    isCycloneDxBom(bomNSData.bomJson)
+  ) {
+    thoughtLog(
+      "Preparing the SPDX 3.0.1 export from the validated CycloneDX BOM.",
+    );
+    if (isDryRun) {
+      recordActivity({
+        kind: "convert",
+        reason:
+          "Dry run mode skips SPDX conversion because the export path is read-only.",
+        status: "blocked",
+        target: "spdx",
+      });
+    } else {
+      bomNSData.spdxJson = convertCycloneDxToSpdx(bomNSData.bomJson, options);
+      recordActivity({
+        kind: "convert",
+        status: "completed",
+        target: "spdx",
+      });
+      if (options.validate && !validateSpdx(bomNSData.spdxJson)) {
+        process.exit(1);
+      }
+    }
+  }
+  if (outputIsStdout) {
+    if (!isDryRun && bomNSData.bomJson) {
+      const payload =
+        outputPlan.formats.has("spdx") && bomNSData.spdxJson
+          ? stringifyJson(bomNSData.spdxJson, options.jsonPretty)
+          : stringifyJson(bomNSData.bomJson, options.jsonPretty);
+      process.stdout.write(payload);
+    } else if (isDryRun) {
+      recordActivity({
+        kind: "write",
+        reason: "Dry run mode skips stdout BOM output.",
+        status: "blocked",
+        target: "stdout",
+      });
+    }
+  } else if (
+    options.output &&
+    (typeof options.output === "string" || options.output instanceof String)
+  ) {
+    if (!isDryRun && outputPlan.outputs.cyclonedx && bomNSData.bomJson) {
+      writeCycloneDxOutput(
+        outputPlan.outputs.cyclonedx,
+        bomNSData.bomJson,
+        options,
+      );
+      if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
+        const nsFile = `${outputPlan.outputs.cyclonedx}.map`;
+        safeWriteSync(nsFile, JSON.stringify(bomNSData.nsMapping));
+      }
+    } else if (isDryRun && outputPlan.outputs.cyclonedx) {
+      recordActivity({
+        kind: "write",
+        reason: "Dry run mode skips CycloneDX file output.",
+        status: "blocked",
+        target: outputPlan.outputs.cyclonedx,
+      });
+    }
+    if (!isDryRun && outputPlan.outputs.spdx && bomNSData.spdxJson) {
+      safeWriteSync(
+        outputPlan.outputs.spdx,
+        stringifyJson(bomNSData.spdxJson, options.jsonPretty),
+      );
+      thoughtLog(`Let's save the SPDX file to "${outputPlan.outputs.spdx}".`);
+    } else if (isDryRun && outputPlan.outputs.spdx) {
+      recordActivity({
+        kind: "write",
+        reason: "Dry run mode skips SPDX file output.",
+        status: "blocked",
+        target: outputPlan.outputs.spdx,
+      });
+    }
+  } else if (!options.print) {
+    if (outputPlan.formats.has("spdx") && bomNSData?.spdxJson) {
+      console.log(stringifyJson(bomNSData.spdxJson, options.jsonPretty));
+    } else if (bomNSData.bomJson) {
+      console.log(stringifyJson(bomNSData.bomJson, options.jsonPretty));
+    } else {
+      console.log("Unable to produce BOM for", filePath);
+      console.log("Try running the command with -t <type> or -r argument");
+    }
+  }
+  thoughtEnd();
+  // Automatically submit the bom data
+  // biome-ignore lint/suspicious/noDoubleEquals: yargs passes true for empty values
+  if (options.serverUrl && options.serverUrl != true && options.apiKey) {
+    if (isSecureMode) {
+      let serverHostname;
+      try {
+        serverHostname = new URL(options.serverUrl).hostname;
+      } catch (err) {
+        console.log("Invalid Dependency-Track server URL", err);
+        process.exit(1);
+      }
+      if (!isAllowedHttpHost(serverHostname)) {
+        recordActivity({
+          kind: "submit",
+          reason: "The URL host is not allowed as per the allowlist.",
+          status: "blocked",
+          target: options.serverUrl,
+        });
+        console.log(
+          `Dependency-Track server host '${serverHostname}' is not allowed by CDXGEN_ALLOWED_HOSTS.`,
+        );
+        process.exit(1);
+      }
+    }
+    if (isDryRun) {
+      recordActivity({
+        kind: "submit",
+        reason: "Dry run mode skips remote BOM submission.",
+        status: "blocked",
+        target: options.serverUrl,
+      });
+    } else {
+      try {
+        recordActivity({
+          kind: "submit",
+          status: "completed",
+          target: options.serverUrl,
+        });
+        await submitBom(options, bomNSData.bomJson);
+      } catch (err) {
+        console.log(err);
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+    }
+  }
+  // TEA publish (draft publisher API). The CycloneDX BOM is already written to
+  // disk above, so a publish failure never costs the user their SBOM: the
+  // failure is reported and the process exits with a distinct status (3).
+  if (options.teaPublish && bomNSData?.bomJson) {
+    if (!options.teaLeafIdentifier) {
+      console.error(
+        "cdxgen: --tea-publish requires --tea-leaf-identifier (UUID of the TEA leaf/release).",
+      );
+      process.exit(3);
+    }
+    if (isDryRun) {
+      recordActivity({
+        kind: "submit",
+        reason: "Dry run mode skips TEA collection publishing.",
+        status: "blocked",
+        target: options.teaPublish,
+      });
+    } else {
+      try {
+        const { buildPublishCollectionPayload, publishTeaCollection } =
+          await import("../lib/ecosystems/tea.js");
+        const parentComponent = bomNSData.bomJson.metadata?.component || {};
+        const projectName =
+          options.teaCollectionName ||
+          parentComponent.name ||
+          basename(resolve(srcDir));
+        // The checksum has to describe the bytes a consumer will download, so
+        // it is taken from the file that was written rather than from a fresh
+        // re-serialisation of the in-memory BOM.
+        const bomFile = outputPlan.outputs.cyclonedx;
+        const artifactContent = bomFile
+          ? fs.readFileSync(bomFile, "utf-8")
+          : JSON.stringify(bomNSData.bomJson);
+        const payload = buildPublishCollectionPayload({
+          leafIdentifier: options.teaLeafIdentifier,
+          productName: projectName,
+          // The product's own version, not bomJson.version, which counts
+          // revisions of the document.
+          productVersion: parentComponent.version || "unknown",
+          authorName: options.teaAuthorName || "cdxgen",
+          authorEmail: options.teaAuthorEmail,
+          reasonType: options.teaReason,
+          artifactName: `${projectName} sbom`,
+          artifactUrl: options.teaArtifactUrl || bomFile || "bom.json",
+          artifactContent,
+        });
+        const result = await publishTeaCollection(
+          options.teaPublish,
+          payload,
+          options,
+        );
+        recordActivity({
+          kind: "submit",
+          status: "completed",
+          target: options.teaPublish,
+        });
+        console.log(
+          `cdxgen: published TEA collection to ${options.teaPublish} (collection version ${result.body?.version ?? "assigned by server"}).`,
+        );
+      } catch (err) {
+        console.error(
+          `cdxgen: failed to publish TEA collection to ${options.teaPublish}: ${err?.message || err}. The local BOM was written regardless.`,
+        );
+        process.exit(3);
+      }
+    }
+  }
+  // Protobuf serialization
+  if (options.exportProto) {
+    if (isDryRun) {
+      recordActivity({
+        kind: "write",
+        reason: "Dry run mode skips protobuf export.",
+        status: "blocked",
+        target: options.protoBinFile,
+      });
+    } else {
+      const protobomModule = await importProtobomModule(
+        invokedCommandName || "cdxgen",
+        "protobuf export",
+      );
+      try {
+        protobomModule.assertProtoSupportedSpecVersion(
+          bomNSData?.bomJson?.specVersion || options.specVersion,
+          "protobuf export",
+        );
+      } catch (error) {
+        console.error(error.message);
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+      protobomModule.writeBinary(bomNSData.bomJson, options.protoBinFile);
+      thoughtLog("BOM file is also available in .proto format!");
+    }
+  }
+  if (options.print && bomNSData.bomJson?.components) {
+    printSummary(bomNSData.bomJson);
+    if (options.includeFormulation) {
+      printFormulation(bomNSData.bomJson);
+    }
+    printDependencyTree(bomNSData.bomJson);
+    printTable(bomNSData.bomJson);
+    // CBOM related print
+    if (options.includeCrypto) {
+      printTable(bomNSData.bomJson, ["cryptographic-asset"]);
+      printDependencyTree(bomNSData.bomJson, "provides");
+    }
+  }
+  if (isDryRun || DEBUG_MODE) {
+    printActivitySummary(options.activityReport);
+  }
+  if (
+    (DEBUG_MODE || TRACE_MODE) &&
+    (!readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS") ||
+      !readEnvironmentVariable("CDXGEN_ALLOWED_COMMANDS"))
+  ) {
+    let allowListSuggestion = "";
+    const envPrefix = isWin ? "set $env:" : "export ";
+    if (remoteHostsAccessed.size) {
+      allowListSuggestion = `${envPrefix}CDXGEN_ALLOWED_HOSTS="${Array.from(remoteHostsAccessed).join(",")}"\n`;
+    }
+    if (commandsExecuted.size) {
+      allowListSuggestion = `${allowListSuggestion}${envPrefix}CDXGEN_ALLOWED_COMMANDS="${Array.from(commandsExecuted).join(",")}"\n`;
+    }
+    if (allowListSuggestion) {
+      console.log(
+        "SECURE MODE: cdxgen supports allowlists for remote hosts and external commands. Set the following environment variables to get started.",
+      );
+      console.log(allowListSuggestion);
+    }
+  }
+  if (cleanup) {
+    cleanupSourceDir(srcDir);
+  }
+})();