cra-audit 0.1.0 → 1.1.0

package/README.md

@@ -1,9 +1,11 @@
 # cra-audit
 
+[![npm](https://img.shields.io/npm/v/cra-audit)](https://www.npmjs.com/package/cra-audit) [![CI](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml) [![license](https://img.shields.io/npm/l/cra-audit)](LICENSE)
+
 > Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline, for npm projects.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
-
+It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned.
 ```bash
 # Run ALL the law's checks (Vulnerabilities + Licenses + SBOM)
 npx cra-audit
@@ -24,13 +26,30 @@ Under the hood, the package runs the checks derived from the CRA legal obligatio
 
 ### 1. Automatic SBOM validation
 
-Generates and validates a **Software Bill of Materials (SBOM)** in a machine-readable format —**CycloneDX 1.5** or **SPDX 2.3**— from the `package-lock.json` / `npm-shrinkwrap.json`. It verifies the **minimum elements** required by TR-03183 §6 for every component: name, version, unique identifier (`purl`), cryptographic integrity hash and license.
+Generates and validates a **Software Bill of Materials (SBOM)** in a machine-readable format —**CycloneDX 1.6** (default) or **SPDX 2.3**— from the `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` or `pnpm-lock.yaml`, following the field mapping of **BSI TR-03183-2 v2.1.0**:
+
+| TR-03183-2 data field | Where it comes from | CycloneDX 1.6 field |
+| --- | --- | --- |
+| Creator of the SBOM (email or URL) | `--creator`, `sbomCreator` policy, or the project's `author` / `homepage` / `repository` | `metadata.manufacturer` |
+| Timestamp | generation time (UTC) | `metadata.timestamp` |
+| Component creator (email or URL) | installed `package.json`: `author`, `maintainers`, `homepage`, `repository` | `components[].manufacturer` |
+| Name, version, purl | lockfile | `name`, `version`, `purl` |
+| Filename | tarball name (`left-pad-1.3.0.tgz`) | property `bsi:component:filename` |
+| SHA-512 of the deployable component | lockfile `integrity` | `externalReferences[distribution].hashes` |
+| Executable / archive / structured | npm tarball: `non-executable`, `archive`, `structured` | properties `bsi:component:*` |
+| Dependencies + completeness | lockfile dependency graph (npm v1–v3, Yarn classic/Berry, pnpm v5–v9) | `dependencies`, `compositions[].aggregate` |
+| Distribution / original licences | lockfile or installed `package.json` | `licenses[]` with `acknowledgement` `concluded` / `declared` |
+| Source code URI | `repository` | `externalReferences[source-distribution]` |
+
+`sbom check` verifies every one of those fields for every component. Licenses (for Yarn/pnpm) and component creators are read from `node_modules`, so **run it after installing dependencies** (e.g. after `npm ci` in CI).
+
+Known limits: Yarn Berry lockfiles only store Yarn's own cache checksum, not the npm tarball SHA-512, so Berry projects fail the hash check. TR-03183-2 v2.1 requires **SPDX ≥ 3.0.1**; the SPDX output is still 2.3, so use CycloneDX for a conforming SBOM.
 
 > CRA Annex I · TR-03183 Part 2 — *"Transparency through SBOM"*.
 
 ### 2. "Zero known vulnerabilities" audit
 
-Scans **direct and transitive** dependencies (from the lockfile) with `npm audit` and blocks the audit if there are exploitable vulnerabilities above the configured threshold.
+Scans **direct and transitive** dependencies (from the lockfile) with `npm audit` and blocks the audit if there are exploitable vulnerabilities above the configured threshold. For Yarn/pnpm projects (which have no npm lockfile), `cra-audit` synthesizes a temporary `package-lock.json` from the exact versions pinned in `yarn.lock` / `pnpm-lock.yaml` and runs `npm audit --package-lock-only` against it, so the scanned versions match what the package manager actually resolved.
 
 > CRA Art. 13 — *products must be placed on the market without known exploitable vulnerabilities*.
 
@@ -44,7 +63,7 @@ Identifies every third-party open-source library present in the dependency tree
 
 Verifies that **all** dependencies have their license documented and compliant with the policy (allowlist / denylist), and that they carry unique identifiers (`purl`) and integrity hashes (SHA-512/384/256) as recommended by TR-03183.
 
-> TR-03183 §6 — license governance and hash integrity.
+> TR-03183-2 §5.2 — license governance and hash integrity.
 
 ### 5. Visualization (`--visualize`)
 
@@ -102,7 +121,7 @@ cra-audit --help
 | `cra-audit` / `cra-audit audit` | Full CRA compliance audit (vulnerabilities + SBOM + licenses). **Default.** |
 | `cra-audit visualize` (aliases `view`, `report`) | Interactive HTML report with SBOM, licenses, versions and maintenance. |
 | `cra-audit sbom generate` | Generate an SBOM (CycloneDX/SPDX). |
-| `cra-audit sbom check` | Validate the SBOM against the TR-03183 minimum elements. |
+| `cra-audit sbom check` | Validate the SBOM against the TR-03183-2 v2.1 data fields. |
 | `cra-audit vulnerabilities` (alias `vuln`) | Vulnerability analysis only. |
 | `cra-audit licenses` | License analysis only. |
 | `cra-audit help` | Show help. |
@@ -117,6 +136,7 @@ cra-audit --help
 | `--no-open` | Do not open the HTML report in the browser automatically. |
 | `--sbom` | Shortcut equivalent to `sbom check`. |
 | `--format <fmt>` | SBOM format: `cyclonedx` (default) or `spdx`. |
+| `--creator <contact>` | Email or URL of the SBOM creator (TR-03183-2 §5.2.1). Defaults to the project's `package.json` `author` / `homepage` / `repository`. |
 | `--fail-on <sev>` | Minimum severity that fails the audit: `info`, `low`, `moderate`, `high`, `critical`. |
 | `--production`, `--prod` | Audit production dependencies only. |
 | `--no-sbom` | Do not require an SBOM in the full audit. |
@@ -172,6 +192,7 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
   "failOn": "high",
   "requireSbom": true,
   "sbomFormat": "cyclonedx",
+  "sbomCreator": "security@example.com",
   "productionOnly": false,
   "vulnerabilities": {
     "allowlist": []
@@ -185,8 +206,9 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```
 
 - `failOn`: minimum severity that blocks the audit.
-- `requireSbom`: require the SBOM to meet the TR-03183 minimum elements.
+- `requireSbom`: require the SBOM to meet the TR-03183-2 required data fields.
 - `sbomFormat`: `cyclonedx` or `spdx`.
+- `sbomCreator`: email or URL of the entity that creates the SBOM (usually the manufacturer).
 - `productionOnly`: audit production dependencies only.
 - `vulnerabilities.allowlist`: advisory/CVE identifiers accepted with documented justification.
 - `licenses.allow` / `licenses.deny`: allowed / denied lists (SPDX id).
@@ -237,7 +259,7 @@ const signals = await enrichComponents(components, { network: true, github: true
 
 - Node.js >= 18 (uses native `fetch` and `node --test`).
 - `npm` available on the `PATH` (for `npm audit`).
-- A `package-lock.json` or `npm-shrinkwrap.json` present (run `npm install` if missing).
+- A lockfile present: `package-lock.json` / `npm-shrinkwrap.json` (npm), `yarn.lock` (Yarn classic or Berry) or `pnpm-lock.yaml` (pnpm). Run `npm install` / `yarn` / `pnpm install` if missing.
 
 ## Legal notice
 

package/package.json

@@ -1,8 +1,16 @@
 {
   "name": "cra-audit",
-  "version": "0.1.0",
-  "description": "Audits npm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and the BSI TR-03183 technical guideline: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
-  "author": "Miguel Gonzalez Herrera",
+  "version": "1.1.0",
+  "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
+  "homepage": "https://github.com/migohe14/cra-audit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/migohe14/cra-audit.git"
+  },
+  "bugs": {
+    "url": "https://github.com/migohe14/cra-audit/issues"
+  },
+  "author": "Miguel Gonzalez (https://github.com/migohe14)",
   "keywords": [
     "cra",
     "cyber-resilience-act",
@@ -16,7 +24,11 @@
     "compliance",
     "vulnerabilities",
     "licenses",
-    "supply-chain"
+    "supply-chain",
+    "yarn",
+    "pnpm",
+    "eu",
+    "sbom-validation"
   ],
   "license": "MIT",
   "type": "commonjs",

package/src/cli.js

@@ -79,8 +79,8 @@ async function main(argv) {
       return 0;
 
     default:
-      logger.error(`Comando desconocido: "${command}".`);
-      logger.log(`Ejecuta ${color.cyan('cra-audit --help')} para ver los comandos disponibles.`);
+      logger.error(`Unknown command: "${command}".`);
+      logger.log(`Run ${color.cyan('cra-audit --help')} to see the available commands.`);
       return 1;
   }
 }
@@ -151,6 +151,7 @@ function setFlag(flags, name, value) {
     case '--format': flags.format = String(value).toLowerCase(); break;
     case '--fail-on': flags.failOn = String(value).toLowerCase(); break;
     case '--cwd': flags.cwd = value; break;
+    case '--creator': flags.creator = value; break;
     default:
       // Unknown flag stored under its raw name for forward compatibility.
       flags[name.replace(/^--/, '')] = value;
@@ -160,56 +161,57 @@ function setFlag(flags, name, value) {
 function printHelp() {
   const c = color;
   logger.log(`
-${c.bold('cra-audit')} — Auditoría de cumplimiento del Cyber Resilience Act (UE 2024/2847)
-            y la directriz técnica BSI TR-03183 para proyectos npm.
-
-${c.bold('USO')}
-  npx cra-audit [comando] [opciones]
-
-${c.bold('COMANDOS')}
-  ${c.cyan('audit')}                 Ejecuta TODAS las comprobaciones (vulnerabilidades + SBOM + licencias). Por defecto.
-  ${c.cyan('visualize')}             Genera un informe HTML interactivo (SBOM, licencias, versiones y mantenimiento).
-  ${c.cyan('sbom generate')}         Genera un SBOM (CycloneDX o SPDX) y lo imprime o guarda.
-  ${c.cyan('sbom check')}            Valida que el SBOM cumple los elementos mínimos de TR-03183.
-  ${c.cyan('vulnerabilities')}       Analiza solo vulnerabilidades conocidas (alias: vuln).
-  ${c.cyan('licenses')}              Analiza solo las licencias de las dependencias.
-  ${c.cyan('help')}                  Muestra esta ayuda.
-
-${c.bold('OPCIONES')}
-  ${c.cyan('--visualize, -V')}       Atajo para generar y abrir el informe HTML interactivo.
-  ${c.cyan('--github')}              Enriquece el informe visual con datos de GitHub (último commit, contribuidores, stars).
-  ${c.cyan('--offline')}             No consulta la red al visualizar (omite metadatos de mantenimiento).
-  ${c.cyan('--no-open')}             No abre el informe HTML en el navegador automáticamente.
-  ${c.cyan('--sbom')}                Atajo equivalente a "sbom check".
-  ${c.cyan('--format <fmt>')}        Formato del SBOM: cyclonedx (def.) | spdx.
-  ${c.cyan('--fail-on <sev>')}       Severidad mínima que hace fallar la auditoría: info|low|moderate|high|critical.
-  ${c.cyan('--production, --prod')}  Audita solo dependencias de producción (omite devDependencies).
-  ${c.cyan('--no-sbom')}             No exige SBOM en la auditoría completa.
-  ${c.cyan('--json')}                Salida en JSON legible por máquina.
-  ${c.cyan('--output, -o <ruta>')}   Escribe el resultado/SBOM/HTML en un archivo.
-  ${c.cyan('--input, -i <ruta>')}    SBOM existente a validar (para "sbom check").
-  ${c.cyan('--config, -c <ruta>')}   Ruta a la política de seguridad (.cra-audit.json).
-  ${c.cyan('--cwd <ruta>')}          Directorio del proyecto a auditar.
-  ${c.cyan('--no-color')}            Desactiva los colores.
-  ${c.cyan('--version, -v')}         Muestra la versión.
-  ${c.cyan('--help, -h')}            Muestra esta ayuda.
-
-${c.bold('EJEMPLOS')}
-  ${c.gray('# Auditoría completa de cumplimiento CRA')}
+${c.bold('cra-audit')} — Cyber Resilience Act (EU 2024/2847) compliance audit
+            and the BSI TR-03183 technical guideline, for npm projects.
+
+${c.bold('USAGE')}
+  npx cra-audit [command] [options]
+
+${c.bold('COMMANDS')}
+  ${c.cyan('audit')}                 Run ALL the checks (vulnerabilities + SBOM + licenses). Default.
+  ${c.cyan('visualize')}             Generate an interactive HTML report (SBOM, licenses, versions and maintenance).
+  ${c.cyan('sbom generate')}         Generate an SBOM (CycloneDX or SPDX) and print or save it.
+  ${c.cyan('sbom check')}            Validate the SBOM against the TR-03183-2 v2.1 data fields.
+  ${c.cyan('vulnerabilities')}       Analyze known vulnerabilities only (alias: vuln).
+  ${c.cyan('licenses')}              Analyze dependency licenses only.
+  ${c.cyan('help')}                  Show this help.
+
+${c.bold('OPTIONS')}
+  ${c.cyan('--visualize, -V')}       Shortcut to generate and open the interactive HTML report.
+  ${c.cyan('--github')}              Enrich the visual report with GitHub data (last commit, contributors, stars).
+  ${c.cyan('--offline')}             Do not query the network when visualizing (skips maintenance metadata).
+  ${c.cyan('--no-open')}             Do not open the HTML report in the browser automatically.
+  ${c.cyan('--sbom')}                Shortcut equivalent to "sbom check".
+  ${c.cyan('--format <fmt>')}        SBOM format: cyclonedx (default) | spdx.
+  ${c.cyan('--creator <contact>')}   Email or URL of the SBOM creator (default: package.json author/homepage).
+  ${c.cyan('--fail-on <sev>')}       Minimum severity that fails the audit: info|low|moderate|high|critical.
+  ${c.cyan('--production, --prod')}  Audit production dependencies only (skips devDependencies).
+  ${c.cyan('--no-sbom')}             Do not require an SBOM in the full audit.
+  ${c.cyan('--json')}                Machine-readable JSON output.
+  ${c.cyan('--output, -o <path>')}   Write the result/SBOM/HTML to a file.
+  ${c.cyan('--input, -i <path>')}    Existing SBOM to validate (for "sbom check").
+  ${c.cyan('--config, -c <path>')}   Path to the security policy (.cra-audit.json).
+  ${c.cyan('--cwd <path>')}          Project directory to audit.
+  ${c.cyan('--no-color')}            Disable colors.
+  ${c.cyan('--version, -v')}         Show the version.
+  ${c.cyan('--help, -h')}            Show this help.
+
+${c.bold('EXAMPLES')}
+  ${c.gray('# Full CRA compliance audit')}
   npx cra-audit
 
-  ${c.gray('# Informe visual interactivo (HTML) con datos de mantenimiento')}
+  ${c.gray('# Interactive visual report (HTML) with maintenance data')}
   npx cra-audit --visualize
   npx cra-audit visualize --github
 
-  ${c.gray('# Solo la parte del SBOM')}
+  ${c.gray('# Just the SBOM part')}
   npx cra-audit --sbom
   npx cra-audit sbom check
 
-  ${c.gray('# Generar un SBOM CycloneDX en disco')}
+  ${c.gray('# Generate a CycloneDX SBOM on disk')}
   npx cra-audit sbom generate -o sbom.cdx.json
 
-  ${c.gray('# Fallar solo ante vulnerabilidades críticas, en CI')}
+  ${c.gray('# Fail only on critical vulnerabilities, in CI')}
   npx cra-audit --fail-on critical --production --json -o cra-report.json
 `);
 }

package/src/commands/audit.js

@@ -43,7 +43,7 @@ function resolveRoot(flags) {
   const start = flags.cwd || process.cwd();
   const root = findProjectRoot(start);
   if (!root) {
-    logger.error('No se encontró ningún package.json. Ejecuta el comando dentro de un proyecto npm.');
+    logger.error('No package.json found. Run the command inside an npm project.');
     return null;
   }
   return root;

package/src/commands/sbom.js

@@ -5,18 +5,19 @@ const { findProjectRoot, readJson, writeJson, exists } = require('../utils/fs');
 const { logger, color } = require('../utils/logger');
 const { generateSbom } = require('../core/sbom-generator');
 const { validateSbom } = require('../core/sbom-validator');
+const { loadPolicy } = require('../core/policy');
 
 /**
  * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
  *
  * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
- * - check:    generates (or reads) an SBOM and validates the minimum elements
- *             required by BSI TR-03183 §6.
+ * - check:    generates (or reads) an SBOM and validates the data fields
+ *             required by BSI TR-03183-2 v2.1.0 §5.2.
  */
 function sbomCommand(subcommand, flags) {
   const projectRoot = findProjectRoot(flags.cwd || process.cwd());
   if (!projectRoot) {
-    logger.error('No se encontró ningún package.json. Ejecuta el comando dentro de un proyecto npm.');
+    logger.error('No package.json found. Run the command inside an npm project.');
     return 1;
   }
 
@@ -30,12 +31,12 @@ function sbomCommand(subcommand, flags) {
     return sbomGenerate(projectRoot, format, flags);
   }
 
-  logger.error(`Subcomando de SBOM desconocido: "${action}". Usa "generate" o "check".`);
+  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
   return 1;
 }
 
 function sbomGenerate(projectRoot, format, flags) {
-  const result = generateSbom(projectRoot, { format });
+  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
   if (!result.ok) {
     logger.error(result.error);
     return 1;
@@ -44,7 +45,7 @@ function sbomGenerate(projectRoot, format, flags) {
   if (flags.output) {
     const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
     writeJson(outPath, result.document);
-    logger.success(`SBOM (${result.format}) con ${result.componentCount} componentes escrito en: ${outPath}`);
+    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
   } else {
     process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
   }
@@ -58,12 +59,12 @@ function sbomCheck(projectRoot, format, flags) {
   if (flags.input) {
     const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
     if (!exists(inPath)) {
-      logger.error(`No se encontró el SBOM indicado: ${flags.input}`);
+      logger.error(`The specified SBOM was not found: ${flags.input}`);
       return 1;
     }
     document = readJson(inPath);
   } else {
-    const result = generateSbom(projectRoot, { format });
+    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
     if (!result.ok) {
       logger.error(result.error);
       return 1;
@@ -82,19 +83,29 @@ function sbomCheck(projectRoot, format, flags) {
     return validation.valid ? 0 : 1;
   }
 
-  logger.heading('Validación de SBOM · BSI TR-03183 §6 (elementos mínimos)');
-  logger.detail(`Formato detectado: ${validation.format} · Componentes: ${validation.stats.total}`);
+  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
+  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
   for (const check of validation.checks) {
     const mark = check.passed ? color.green('✔') : color.red('✖');
     logger.log(`  ${mark} ${check.label}`);
   }
   logger.log('');
   if (validation.valid) {
-    logger.success(color.bold('SBOM VÁLIDO — cumple los elementos mínimos exigidos por el CRA.'));
+    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
     return 0;
   }
-  logger.error(color.bold(`SBOM INVÁLIDO — ${validation.failedChecks.length} requisito(s) sin cumplir.`));
+  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
   return 1;
 }
 
+/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
+function sbomCreator(projectRoot, flags) {
+  if (typeof flags.creator === 'string') return flags.creator;
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
+  } catch {
+    return undefined; // A broken policy file must not block SBOM generation.
+  }
+}
+
 module.exports = { sbomCommand };

package/src/commands/visualize.js

@@ -25,7 +25,7 @@ const { buildHtml } = require('../reporters/html');
 async function visualizeCommand(flags) {
   const projectRoot = findProjectRoot(flags.cwd || process.cwd());
   if (!projectRoot) {
-    logger.error('No se encontró ningún package.json. Ejecuta el comando dentro de un proyecto npm.');
+    logger.error('No package.json found. Run the command inside an npm project.');
     return 1;
   }
 
@@ -42,7 +42,7 @@ async function visualizeCommand(flags) {
     policy = {};
   }
 
-  logger.info(`Analizando ${parsed.components.length} componentes de ${parsed.root.name}@${parsed.root.version}…`);
+  logger.info(`Analyzing ${parsed.components.length} components from ${parsed.root.name}@${parsed.root.version}…`);
 
   // Vulnerabilities + licenses run locally (no network).
   const vulns = scanVulnerabilities(projectRoot, { production: policy.productionOnly });
@@ -53,23 +53,18 @@ async function visualizeCommand(flags) {
   const github = Boolean(flags.github);
   if (network) {
     logger.info(
-      `Consultando metadatos de mantenimiento (npm${github ? ' + GitHub' : ''})…` +
-      (github && !process.env.GITHUB_TOKEN ? color.gray(' (sin GITHUB_TOKEN: límite de 60 req/h)') : '')
+      `Fetching maintenance metadata (npm${github ? ' + GitHub' : ''})…` +
+      (github && !process.env.GITHUB_TOKEN ? color.gray(' (no GITHUB_TOKEN: limited to 60 req/h)') : '')
     );
   } else {
-    logger.info('Modo offline: se omiten metadatos de mantenimiento.');
+    logger.info('Offline mode: maintenance metadata skipped.');
   }
 
-  let lastPct = -1;
   const enrichment = await enrichComponents(parsed.components, {
     network,
     github,
     onProgress: (done, total) => {
-      const pct = Math.floor((done / total) * 100);
-      if (pct !== lastPct && pct % 20 === 0) {
-        logger.detail(`metadatos npm: ${pct}%`);
-        lastPct = pct;
-      }
+      logger.progress('npm metadata', done, total);
     },
   });
 
@@ -78,13 +73,13 @@ async function visualizeCommand(flags) {
 
   const outPath = resolveOutputPath(projectRoot, flags.output);
   fs.writeFileSync(outPath, html, 'utf8');
-  logger.success(`Informe visual escrito en: ${outPath}`);
+  logger.success(`Visual report written to: ${outPath}`);
 
   if (!flags.noOpen) {
     openInBrowser(outPath);
-    logger.detail('Abriendo en el navegador…');
+    logger.detail('Opening in the browser…');
   } else {
-    logger.detail(`Ábrelo en tu navegador: file://${outPath.replace(/\\/g, '/')}`);
+    logger.detail(`Open it in your browser: file://${outPath.replace(/\\/g, '/')}`);
   }
 
   return 0;
@@ -107,11 +102,16 @@ function buildModel(parsed, vulns, licenses, enrichment) {
     const lic = licByKey.get(key) || null;
     const enr = enrichment.get(key) || {};
 
+    const license = (lic && lic.license) || c.license || enr.license || null;
+    const licenseStatus = (lic && lic.license)
+      ? lic.status
+      : (license ? 'ok' : 'missing');
+
     return {
       name: c.name,
       version: c.version,
-      license: (lic && lic.license) || c.license || null,
-      licenseStatus: lic ? lic.status : (c.license ? 'ok' : 'missing'),
+      license,
+      licenseStatus,
       severity: vuln ? vuln.severity : 'none',
       fixAvailable: vuln ? Boolean(vuln.fixAvailable) : false,
       latest: enr.latest || null,

package/src/core/auditor.js

@@ -34,13 +34,13 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
     sections.vulnerabilities = vulns;
 
     if (!vulns.ok) {
-      reasons.push({ label: `No se pudieron analizar vulnerabilidades: ${vulns.error}`, passed: false });
+      reasons.push({ label: `Vulnerabilities could not be analyzed: ${vulns.error}`, passed: false });
     } else {
       const blocking = countBlocking(vulns, policy);
       reasons.push({
         label: blocking === 0
-          ? `Sin vulnerabilidades de severidad >= ${policy.failOn}`
-          : `${blocking} vulnerabilidad(es) de severidad >= ${policy.failOn}`,
+          ? `No vulnerabilities of severity >= ${policy.failOn}`
+          : `${blocking} vulnerability(ies) of severity >= ${policy.failOn}`,
         passed: blocking === 0,
       });
     }
@@ -48,7 +48,7 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
 
   // --- 2. SBOM ------------------------------------------------------------
   if (!only || only === 'sbom') {
-    const sbom = generateSbom(projectRoot, { format: policy.sbomFormat });
+    const sbom = generateSbom(projectRoot, { format: policy.sbomFormat, creator: policy.sbomCreator });
     if (sbom.ok) {
       sbom.validation = validateSbom(sbom.document);
     }
@@ -56,12 +56,12 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
 
     if (policy.requireSbom) {
       if (!sbom.ok) {
-        reasons.push({ label: `No se pudo generar el SBOM: ${sbom.error}`, passed: false });
+        reasons.push({ label: `The SBOM could not be generated: ${sbom.error}`, passed: false });
       } else {
         reasons.push({
           label: sbom.validation.valid
-            ? 'SBOM válido según los elementos mínimos de TR-03183'
-            : 'SBOM incompleto respecto a TR-03183',
+            ? 'SBOM valid against the TR-03183-2 required data fields'
+            : 'SBOM incomplete with respect to TR-03183',
           passed: sbom.validation.valid,
         });
       }
@@ -74,15 +74,15 @@ function runAudit(projectRoot, policy, policySource, options = {}) {
     sections.licenses = licenses;
 
     if (!licenses.ok) {
-      reasons.push({ label: `No se pudieron analizar licencias: ${licenses.error}`, passed: false });
+      reasons.push({ label: `Licenses could not be analyzed: ${licenses.error}`, passed: false });
     } else {
       const s = licenses.summary;
       const missingFails = policy.licenses.failOnMissing && s.missing.length > 0;
       const licensesPassed = s.denied.length === 0 && s.notAllowed.length === 0 && !missingFails;
       reasons.push({
         label: licensesPassed
-          ? 'Licencias documentadas y conformes con la política'
-          : 'Problemas de licencias detectados (prohibidas, no permitidas o sin documentar)',
+          ? 'Licenses documented and compliant with the policy'
+          : 'License issues detected (denied, not allowed or undocumented)',
         passed: licensesPassed,
       });
     }

package/src/core/enrich.js

@@ -103,9 +103,35 @@ async function fetchNpmMeta(name, timeout) {
     repo,
     deprecated,
     homepage: doc.homepage || null,
+    licenseByVersion: licensesByVersion(doc),
   };
 }
 
+/**
+ * Builds a compact `{ version: licenseId }` map from a registry document so the
+ * report can document a license even when it is absent from the lockfile or
+ * not installed on disk (common with pnpm/Yarn).
+ */
+function licensesByVersion(doc) {
+  const map = {};
+  const versions = doc.versions && typeof doc.versions === 'object' ? doc.versions : {};
+  for (const [version, vDoc] of Object.entries(versions)) {
+    const license = normalizeRegistryLicense(vDoc);
+    if (license) map[version] = license;
+  }
+  return map;
+}
+
+function normalizeRegistryLicense(vDoc) {
+  if (!vDoc) return null;
+  if (typeof vDoc.license === 'string') return vDoc.license;
+  if (vDoc.license && typeof vDoc.license.type === 'string') return vDoc.license.type;
+  if (Array.isArray(vDoc.licenses) && vDoc.licenses.length) {
+    return vDoc.licenses.map((l) => (typeof l === 'string' ? l : l && l.type)).filter(Boolean).join(' OR ') || null;
+  }
+  return null;
+}
+
 async function fetchGithubRepo(owner, name, timeout, token) {
   const headers = { 'User-Agent': 'cra-audit', Accept: 'application/vnd.github+json' };
   if (token) headers.Authorization = `Bearer ${token}`;
@@ -163,7 +189,7 @@ function buildSignals(comp, npm, gh) {
   const signals = {
     name: comp.name,
     version: comp.version,
-    license: comp.license || null,
+    license: comp.license || (npm && npm.licenseByVersion && npm.licenseByVersion[comp.version]) || null,
     latest: npm ? npm.latest : null,
     outdated: Boolean(npm && npm.latest && comp.version && npm.latest !== comp.version),
     lastPublish: npm ? npm.lastPublish : null,