cra-audit 2.1.1 → 2.3.0

package/CHANGELOG.md

@@ -8,6 +8,30 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.3.0] — Python, Go and Java without an SBOM tool
+
+### Highlights
+
+- **Native manifests**: `npx cra-audit` in a Python, Go or Java project reads `poetry.lock`, `uv.lock`, `Pipfile.lock` or `requirements*.txt`, `go.mod`, `gradle.lockfile` and `pom.xml` directly — no Syft/cdxgen step and no package.json needed. Same checks as npm: OSV vulnerabilities, malicious packages, CISA KEV with the Art. 14 clock, VEX and SARIF.
+- Findings and SARIF alerts point at the exact line of the manifest.
+- Only exact versions are audited: unpinned requirements, parent/BOM-managed Maven versions and version ranges are skipped and reported, never guessed. `pom.xml` covers declared dependencies (transitive ones need a Maven-generated SBOM).
+- Folders with an npm lockfile *and* one of these manifests are audited as a whole.
+- For these ecosystems the audit warns (instead of failing) about the missing TR-03183 SBOM and undeclared licenses; `sbom generate` explains how to produce one.
+
+## [2.2.0] — Any language through its SBOM
+
+### Highlights
+
+- **Input SBOM** (`-i/--input` for `audit`, `vuln`, `licenses` and `vex`; `sbom-input` in the GitHub Action): audit a CycloneDX JSON, SPDX 2.x JSON or SPDX 3.0 JSON-LD SBOM from Syft, cdxgen, Trivy or the CycloneDX build plugins instead of the npm lockfile. Components are looked up in OSV.dev by Package URL, so **Python, Java, Go, Rust, .NET, PHP, Ruby…** projects get known vulnerabilities, malicious packages, CISA KEV with the Art. 14 clock, licenses, VEX and SARIF. No package.json needed.
+- SARIF alerts point at the purl's line in the SBOM; VEX statements use the components' real purls and the product's purl (or `pkg:generic`).
+- The input SBOM's TR-03183-2 gaps are reported as a warning in the audit (`sbom check -i` still fails on them).
+- `readiness` works in any repository (stops at the nearest package.json or .git) and accepts a committed SBOM file for non-npm projects.
+
+### Fixes
+
+- The SPDX validator no longer counts the described product as a component and accepts `CONTAINS` / `DEPENDENCY_OF` edges (as written by Syft).
+- Fixed versions resolve with each ecosystem's naming (Maven `group:artifact`, PyPI normalisation) and Go `v`-prefixed versions.
+
 ## [2.1.1] — GitHub Marketplace
 
 - The GitHub Action is published in the Marketplace as **CRA Compliance Audit** (the name "CRA Audit" is taken by a GitHub organization). Usage is unchanged: `uses: migohe14/cra-audit@v2`.

package/README.md

@@ -2,10 +2,10 @@
 
 [![npm](https://img.shields.io/npm/v/cra-audit)](https://www.npmjs.com/package/cra-audit) [![CI](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/migohe14/cra-audit/actions/workflows/ci.yml) [![license](https://img.shields.io/npm/l/cra-audit)](LICENSE)
 
-> Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline, for npm projects.
+> Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline — native for npm, Yarn and pnpm, and for **any language** through its SBOM.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
-It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned.
+It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned. **Python, Go and Java** projects are read directly from `requirements.txt` / `poetry.lock` / `uv.lock` / `Pipfile.lock`, `go.mod`, `pom.xml` and `gradle.lockfile`, and **any other language** through the SBOM your tooling produces (`-i`) — [details](#8-other-languages-manifests-and-input-sbom).
 ```bash
 # Run ALL the law's checks (Vulnerabilities + Licenses + SBOM)
 npx cra-audit
@@ -151,6 +151,55 @@ npx cra-audit readiness --init   # creates SECURITY.md and .well-known/security.
 
 `--init` prefills the templates from `package.json` (GitHub private vulnerability reporting link, supported major version, a coordinated disclosure process and the Art. 14 24 h / 72 h / 14 days reporting commitments); fill in the `TODO` placeholders and run it again.
 
+### 8. Other languages: manifests and input SBOM
+
+**Read directly — just run `npx cra-audit` in the project folder (no package.json needed):**
+
+| Ecosystem | Files | Notes |
+| --- | --- | --- |
+| Python | `poetry.lock`, `uv.lock`, `Pipfile.lock` (exact); otherwise `requirements*.txt` | Only `==` pins are audited; ranges are skipped and reported, never guessed. `-r` includes, extras, markers and `--hash` lines are handled. |
+| Go | `go.mod` | Every required module (direct and `// indirect`), with `replace` directives applied. |
+| Java | `gradle.lockfile` (exact), `pom.xml` | `pom.xml`: declared dependencies with `${property}` and `<dependencyManagement>` resolution; transitive ones need a Maven-generated SBOM. |
+
+Findings point at the exact line of the manifest (in the console and in SARIF). A folder with both an npm lockfile and one of these manifests (e.g. a front end next to a Go API) is audited as a whole. Manifests do not carry licenses or hashes, so for these ecosystems the audit **warns** instead of generating a TR-03183 SBOM: commit the one your build produces and audit it with `-i`.
+
+```text
+  Sources: OSV.dev … · 4 components from requirements.txt, go.mod, pom.xml (golang, maven, pypi)
+  pom.xml: declared dependencies only; commit a Maven-generated SBOM (cyclonedx-maven-plugin) to audit transitive ones
+  CRITICAL [KEV] org.apache.logging.log4j:log4j-core@2.14.1  (fix: org.apache.logging.log4j:log4j-core@2.25.4)
+```
+
+**Input SBOM (`-i`), any language:**
+
+`audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
+
+```bash
+# Generate the SBOM with the tool of your ecosystem…
+syft dir:. -o cyclonedx-json=sbom.cdx.json          # any language / container images
+cdxgen -o sbom.cdx.json .                            # multi-language
+mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom   # Maven → target/bom.json
+cyclonedx-py environment -o sbom.cdx.json            # Python
+
+# …and audit it (no package.json needed)
+npx cra-audit -i sbom.cdx.json
+npx cra-audit vex -i sbom.cdx.json -o vex.cdx.json
+npx cra-audit -i sbom.cdx.json --sarif cra-audit.sarif
+```
+
+```text
+  Sources: OSV.dev … · CISA KEV (1721 entries) · 5 components from sbom.spdx.json (cargo, golang, maven, nuget) · 1 without purl skipped
+  CRITICAL [KEV] org.apache.logging.log4j:log4j-core@2.14.1  (fix: org.apache.logging.log4j:log4j-core@2.25.4)
+    GHSA-jfh8-c2jp-5v3q / CVE-2021-44228 Remote code injection in Log4j [KEV since 2021-12-10]
+  CRITICAL smallvec@1.6.0  (fix: smallvec@1.6.1)
+  HIGH     Newtonsoft.Json@12.0.1  (fix: Newtonsoft.Json@13.0.1, breaking)
+```
+
+Notes:
+- Components without a purl are skipped and counted in the output. Operating-system packages (deb/rpm/apk) are not looked up.
+- `--production` skips components with CycloneDX scope `optional`/`excluded` (or SPDX `DEV_DEPENDENCY_OF`).
+- The input SBOM is also checked against TR-03183-2; since third-party generators rarely include the manufacturer fields, gaps are reported as a **warning** in the audit (`cra-audit sbom check -i` shows the details and fails on them). For npm projects, `cra-audit sbom generate` produces a conforming SBOM.
+- SARIF alerts point at the line of the component's purl in the SBOM file.
+
 ---
 
 ## Usage
@@ -222,7 +271,7 @@ cra-audit --help
 | `--sarif <path>` | Also write the audit as SARIF 2.1.0 for GitHub code scanning. |
 | `--init` | With `readiness`: create SECURITY.md and security.txt templates. |
 | `--output`, `-o <path>` | Write the result / SBOM / HTML to a file. |
-| `--input`, `-i <path>` | Existing SBOM to validate (for `sbom check`). |
+| `--input`, `-i <path>` | Existing CycloneDX/SPDX JSON SBOM: validated by `sbom check`, or audited instead of the npm lockfile by `audit`, `vuln`, `licenses` and `vex` (any language). |
 | `--config`, `-c <path>` | Path to the security policy. |
 | `--cwd <path>` | Project directory to audit. |
 | `--no-color` | Disable colors. |
@@ -315,6 +364,17 @@ Suitable for CI/CD: a non-`0` code blocks the pipeline.
 
 Available in the GitHub Marketplace as [CRA Compliance Audit](https://github.com/marketplace/actions/cra-compliance-audit).
 
+Python, Go and Java projects work as they are (the action reads `requirements.txt`, `go.mod`, `pom.xml`…). For other languages, or to include Maven's transitive dependencies, generate the SBOM first and pass it with `sbom-input`:
+
+```yaml
+      - uses: anchore/sbom-action@v0          # Syft
+        with: { format: cyclonedx-json, output-file: sbom.cdx.json, upload-artifact: false }
+      - uses: migohe14/cra-audit@v2
+        with:
+          sbom-input: sbom.cdx.json
+          vex: vex.cdx.json
+```
+
 ```yaml
 name: CRA audit
 on: [push, pull_request]
@@ -357,6 +417,7 @@ Every finding shows up in **Security → Code scanning**, pointing at the exact
 | `sarif` | `cra-audit.sarif` | SARIF path (empty to skip). |
 | `upload-sarif` | `true` | Upload to code scanning (needs `security-events: write`; private repos need GitHub Advanced Security). |
 | `sbom` / `vex` | — | Also write the SBOM / VEX to these paths. |
+| `sbom-input` | — | Audit this CycloneDX/SPDX SBOM instead of the npm lockfile (any language). |
 | `args` | — | Extra `cra-audit audit` arguments. |
 
 Outputs: `exit-code`, `sarif`, `sbom`, `vex`. Without the action, `npx cra-audit --sarif cra-audit.sarif` does the same in any CI.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.1.1",
+  "version": "2.3.0",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {

package/src/cli.js

@@ -211,7 +211,8 @@ ${c.bold('OPTIONS')}
   ${c.cyan('--json')}                Machine-readable JSON output.
   ${c.cyan('--sarif <path>')}        Also write the audit as SARIF 2.1.0 (GitHub code scanning).
   ${c.cyan('--output, -o <path>')}   Write the result/SBOM/HTML to a file.
-  ${c.cyan('--input, -i <path>')}    Existing SBOM to validate (for "sbom check").
+  ${c.cyan('--input, -i <path>')}    Existing CycloneDX/SPDX JSON SBOM: validate it (sbom check) or audit it
+                        instead of the npm lockfile — any ecosystem (audit, vuln, licenses, vex).
   ${c.cyan('--config, -c <path>')}   Path to the security policy (.cra-audit.json).
   ${c.cyan('--cwd <path>')}          Project directory to audit.
   ${c.cyan('--no-color')}            Disable colors.
@@ -233,6 +234,9 @@ ${c.bold('EXAMPLES')}
   ${c.gray('# Generate a CycloneDX SBOM on disk')}
   npx cra-audit sbom generate -o sbom.cdx.json
 
+  ${c.gray('# Any language: audit an SBOM from Syft, cdxgen, Trivy, CycloneDX plugins…')}
+  npx cra-audit -i sbom.cdx.json
+
   ${c.gray('# VEX with the exploitability assessments recorded in .cra-audit.json')}
   npx cra-audit vex -o vex.cdx.json
 

package/src/commands/audit.js

@@ -1,69 +1,85 @@
-'use strict';
-
-const { findProjectRoot } = require('../utils/fs');
-const { logger } = require('../utils/logger');
-const { loadPolicy } = require('../core/policy');
-const { runAudit } = require('../core/auditor');
-const { reportConsole } = require('../reporters/console');
-const { reportJson } = require('../reporters/json');
-const { reportSarif } = require('../reporters/sarif');
-
-/**
- * `cra-audit [audit]` — runs the full compliance audit (vulnerabilities + SBOM
- * + licenses) or a single section via `only`.
- *
- * @param {object} flags Parsed CLI flags.
- * @param {'vulnerabilities'|'sbom'|'licenses'} [only]
- * @returns {Promise<number>} Process exit code.
- */
-async function auditCommand(flags, only) {
-  const projectRoot = resolveRoot(flags);
-  if (!projectRoot) return 1;
-
-  let policyResult;
-  try {
-    policyResult = loadPolicy(projectRoot, flags.config);
-  } catch (err) {
-    logger.error(err.message);
-    return 1;
-  }
-
-  const policy = applyFlagOverrides(policyResult.policy, flags);
-  const report = await runAudit(projectRoot, policy, policyResult.source, { only });
-
-  if (flags.json) {
-    reportJson(report, { outputPath: flags.output });
-  } else {
-    reportConsole(report);
-  }
-  if (typeof flags.sarif === 'string') {
-    reportSarif(report, projectRoot, flags.sarif, { quiet: flags.json && !flags.output, policy });
-  }
-
-  return report.gate.passed ? 0 : 1;
-}
-
-function resolveRoot(flags) {
-  const start = flags.cwd || process.cwd();
-  const root = findProjectRoot(start);
-  if (!root) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return null;
-  }
-  return root;
-}
-
-/** CLI flags take precedence over the file-based policy. */
-function applyFlagOverrides(policy, flags) {
-  const merged = { ...policy };
-  if (flags.failOn) merged.failOn = flags.failOn;
-  if (flags.production) merged.productionOnly = true;
-  if (flags.format) merged.sbomFormat = flags.format;
-  if (flags.noSbom) merged.requireSbom = false;
-  if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
-  if (flags.failOnKev) merged.failOnKev = true;
-  if (flags.noFailOnKev) merged.failOnKev = false;
-  return merged;
-}
-
-module.exports = { auditCommand };
+'use strict';
+
+const path = require('node:path');
+const { findAnyProjectRoot } = require('../core/project-source');
+const { logger } = require('../utils/logger');
+const { loadPolicy } = require('../core/policy');
+const { runAudit } = require('../core/auditor');
+const { reportConsole } = require('../reporters/console');
+const { reportJson } = require('../reporters/json');
+const { reportSarif } = require('../reporters/sarif');
+
+/**
+ * `cra-audit [audit]` — runs the full compliance audit (vulnerabilities + SBOM
+ * + licenses) or a single section via `only`.
+ *
+ * @param {object} flags Parsed CLI flags.
+ * @param {'vulnerabilities'|'sbom'|'licenses'} [only]
+ * @returns {Promise<number>} Process exit code.
+ */
+async function auditCommand(flags, only) {
+  const projectRoot = resolveRoot(flags);
+  if (!projectRoot) return 1;
+
+  let policyResult;
+  try {
+    policyResult = loadPolicy(projectRoot, flags.config);
+  } catch (err) {
+    logger.error(err.message);
+    return 1;
+  }
+
+  const policy = applyFlagOverrides(policyResult.policy, flags);
+  const report = await runAudit(projectRoot, policy, policyResult.source, { only, input: inputPath(flags) });
+
+  if (flags.json) {
+    reportJson(report, { outputPath: flags.output });
+  } else {
+    reportConsole(report);
+  }
+  if (typeof flags.sarif === 'string') {
+    reportSarif(report, projectRoot, flags.sarif, { quiet: flags.json && !flags.output, policy });
+  }
+
+  return report.gate.passed ? 0 : 1;
+}
+
+/**
+ * Project root: with `-i <sbom>` the working directory; otherwise the nearest
+ * folder with a package.json or a supported manifest (requirements.txt,
+ * poetry.lock, uv.lock, Pipfile.lock, go.mod, pom.xml, gradle.lockfile).
+ */
+function resolveRoot(flags) {
+  const start = flags.cwd || process.cwd();
+  if (inputPath(flags)) return path.resolve(start);
+  const root = findAnyProjectRoot(start);
+  if (!root) {
+    logger.error(NO_PROJECT);
+    return null;
+  }
+  return root;
+}
+
+const NO_PROJECT = 'No project found: expected a package.json (npm/Yarn/pnpm), requirements.txt, ' +
+  'poetry.lock, uv.lock, Pipfile.lock, go.mod, pom.xml or gradle.lockfile — or pass an SBOM with -i.';
+
+/** `-i/--input <sbom>` resolved against the working directory. */
+function inputPath(flags) {
+  if (typeof flags.input !== 'string') return null;
+  return path.resolve(flags.cwd || process.cwd(), flags.input);
+}
+
+/** CLI flags take precedence over the file-based policy. */
+function applyFlagOverrides(policy, flags) {
+  const merged = { ...policy };
+  if (flags.failOn) merged.failOn = flags.failOn;
+  if (flags.production) merged.productionOnly = true;
+  if (flags.format) merged.sbomFormat = flags.format;
+  if (flags.noSbom) merged.requireSbom = false;
+  if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
+  if (flags.failOnKev) merged.failOnKev = true;
+  if (flags.noFailOnKev) merged.failOnKev = false;
+  return merged;
+}
+
+module.exports = { auditCommand, inputPath, resolveRoot };

package/src/commands/readiness.js

@@ -1,6 +1,7 @@
 'use strict';
 
-const { findProjectRoot } = require('../utils/fs');
+const fs = require('node:fs');
+const path = require('node:path');
 const { logger, color } = require('../utils/logger');
 const { checkReadiness, writeTemplates } = require('../core/readiness');
 
@@ -13,11 +14,7 @@ const { checkReadiness, writeTemplates } = require('../core/readiness');
  * @returns {number} exit code: 1 when a required check fails.
  */
 function readinessCommand(flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
+  const projectRoot = findRepositoryRoot(flags.cwd || process.cwd());
 
   if (flags.init) {
     for (const { file, created } of writeTemplates(projectRoot)) {
@@ -56,4 +53,18 @@ function readinessCommand(flags) {
   return result.passed ? 0 : 1;
 }
 
+/**
+ * The nearest folder with a package.json or a .git entry: readiness applies to
+ * any repository, not only npm projects. Falls back to the start folder.
+ */
+function findRepositoryRoot(start) {
+  let dir = path.resolve(start);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'package.json')) || fs.existsSync(path.join(dir, '.git'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return path.resolve(start);
+    dir = parent;
+  }
+}
+
 module.exports = { readinessCommand };

package/src/commands/sbom.js

@@ -1,111 +1,122 @@
-'use strict';
-
-const path = require('node:path');
-const { findProjectRoot, readJson, writeJson, exists } = require('../utils/fs');
-const { logger, color } = require('../utils/logger');
-const { generateSbom } = require('../core/sbom-generator');
-const { validateSbom } = require('../core/sbom-validator');
-const { loadPolicy } = require('../core/policy');
-
-/**
- * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
- *
- * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
- * - check:    generates (or reads) an SBOM and validates the data fields
- *             required by BSI TR-03183-2 v2.1.0 §5.2.
- */
-function sbomCommand(subcommand, flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
-
-  const action = subcommand || 'generate';
-  const format = flags.format || 'cyclonedx';
-
-  if (action === 'check') {
-    return sbomCheck(projectRoot, format, flags);
-  }
-  if (action === 'generate') {
-    return sbomGenerate(projectRoot, format, flags);
-  }
-
-  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
-  return 1;
-}
-
-function sbomGenerate(projectRoot, format, flags) {
-  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
-  if (!result.ok) {
-    logger.error(result.error);
-    return 1;
-  }
-
-  if (flags.output) {
-    const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
-    writeJson(outPath, result.document);
-    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
-  } else {
-    process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
-  }
-  return 0;
-}
-
-function sbomCheck(projectRoot, format, flags) {
-  let document;
-
-  // If an SBOM file is provided, validate it directly; otherwise generate one.
-  if (flags.input) {
-    const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
-    if (!exists(inPath)) {
-      logger.error(`The specified SBOM was not found: ${flags.input}`);
-      return 1;
-    }
-    document = readJson(inPath);
-  } else {
-    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
-    if (!result.ok) {
-      logger.error(result.error);
-      return 1;
-    }
-    document = result.document;
-  }
-
-  const validation = validateSbom(document);
-  if (!validation.ok) {
-    logger.error(validation.error);
-    return 1;
-  }
-
-  if (flags.json) {
-    process.stdout.write(JSON.stringify(validation, null, 2) + '\n');
-    return validation.valid ? 0 : 1;
-  }
-
-  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
-  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
-  for (const check of validation.checks) {
-    const mark = check.passed ? color.green('✔') : color.red('✖');
-    logger.log(`  ${mark} ${check.label}`);
-  }
-  logger.log('');
-  if (validation.valid) {
-    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
-    return 0;
-  }
-  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
-  return 1;
-}
-
-/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
-function sbomCreator(projectRoot, flags) {
-  if (typeof flags.creator === 'string') return flags.creator;
-  try {
-    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
-  } catch {
-    return undefined; // A broken policy file must not block SBOM generation.
-  }
-}
-
-module.exports = { sbomCommand };
+'use strict';
+
+const path = require('node:path');
+const { readJson, writeJson, exists } = require('../utils/fs');
+const { logger, color } = require('../utils/logger');
+const { generateSbom } = require('../core/sbom-generator');
+const { validateSbom } = require('../core/sbom-validator');
+const { loadPolicy } = require('../core/policy');
+const { hasManifests } = require('../core/manifest-reader');
+const { findAnyProjectRoot } = require('../core/project-source');
+
+/**
+ * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
+ *
+ * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
+ * - check:    generates (or reads) an SBOM and validates the data fields
+ *             required by BSI TR-03183-2 v2.1.0 §5.2.
+ */
+function sbomCommand(subcommand, flags) {
+  const start = flags.cwd || process.cwd();
+  // The nearest project decides: a Python/Go/Java folder inside an npm repo is not npm.
+  const nearest = findAnyProjectRoot(start);
+  const npmProject = nearest && exists(path.join(nearest, 'package.json'));
+  const projectRoot = npmProject ? nearest : (flags.input ? path.resolve(start) : null);
+  if (!projectRoot) {
+    const other = nearest && hasManifests(nearest);
+    logger.error(other
+      ? 'cra-audit generates TR-03183 SBOMs for npm/Yarn/pnpm projects. For this ecosystem, generate the SBOM with ' +
+        'your build tooling (Syft, cdxgen, cyclonedx-maven-plugin, cyclonedx-py…) and check it with `cra-audit sbom check -i <file>`; ' +
+        '`cra-audit` audits this project directly.'
+      : 'No package.json found. Run the command inside an npm project, or pass an SBOM with `sbom check -i <file>`.');
+    return 1;
+  }
+
+  const action = subcommand || 'generate';
+  const format = flags.format || 'cyclonedx';
+
+  if (action === 'check') {
+    return sbomCheck(projectRoot, format, flags);
+  }
+  if (action === 'generate') {
+    return sbomGenerate(projectRoot, format, flags);
+  }
+
+  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
+  return 1;
+}
+
+function sbomGenerate(projectRoot, format, flags) {
+  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
+  if (!result.ok) {
+    logger.error(result.error);
+    return 1;
+  }
+
+  if (flags.output) {
+    const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
+    writeJson(outPath, result.document);
+    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
+  } else {
+    process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
+  }
+  return 0;
+}
+
+function sbomCheck(projectRoot, format, flags) {
+  let document;
+
+  // If an SBOM file is provided, validate it directly; otherwise generate one.
+  if (flags.input) {
+    const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
+    if (!exists(inPath)) {
+      logger.error(`The specified SBOM was not found: ${flags.input}`);
+      return 1;
+    }
+    document = readJson(inPath);
+  } else {
+    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
+    if (!result.ok) {
+      logger.error(result.error);
+      return 1;
+    }
+    document = result.document;
+  }
+
+  const validation = validateSbom(document);
+  if (!validation.ok) {
+    logger.error(validation.error);
+    return 1;
+  }
+
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(validation, null, 2) + '\n');
+    return validation.valid ? 0 : 1;
+  }
+
+  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
+  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
+  for (const check of validation.checks) {
+    const mark = check.passed ? color.green('✔') : color.red('✖');
+    logger.log(`  ${mark} ${check.label}`);
+  }
+  logger.log('');
+  if (validation.valid) {
+    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
+    return 0;
+  }
+  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
+  return 1;
+}
+
+/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
+function sbomCreator(projectRoot, flags) {
+  if (typeof flags.creator === 'string') return flags.creator;
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
+  } catch {
+    return undefined; // A broken policy file must not block SBOM generation.
+  }
+}
+
+module.exports = { sbomCommand };