cra-audit 2.2.0 → 2.4.0

package/CHANGELOG.md

@@ -8,6 +8,29 @@ Releases are automated: pushing a `vX.Y.Z` tag publishes the package to npm
 (with provenance) and creates the GitHub Release from the matching section
 below, so add the section before running `npm version`.
 
+## [2.4.0] — Report to your country's CSIRT (INCIBE-CERT for Spain)
+
+### Highlights
+
+- **`--country`** (policy `country`, action input `country`): the country of your main establishment decides where CRA Art. 14 notifications go. For **Spain**, the Art. 14 notice now shows INCIBE-CERT's procedure, verified against [INCIBE-CERT's CRA guidance](https://www.incibe.es/incibe-cert/blog/reglamento-de-ciberresiliencia-cra-que-es-quien-afecta-y-como-prepararse): SRP access requested from INCIBE (cve-coordination@incibe.es) with prior validation, incidents outside the CRA to incidencias@incibe-cert.es, and INCIBE's usual channels when in doubt.
+- The JSON report carries a **`reporting`** block (CSIRT, SRP, deadlines, steps) for automation.
+- **`readiness --init --lang es`** writes Spanish `SECURITY.md` and `security.txt` templates; with `--country ES` they include the INCIBE-CERT section, and `readiness` checks that the coordinating CSIRT is named. The checks understand Spanish wording.
+- 🇪🇸 New guide in Spanish: [docs/es/notificar-incibe.md](docs/es/notificar-incibe.md).
+
+### Fixes
+
+- `require('cra-audit/package.json')` works again: the manifest is exported alongside the API, so tools that read dependency versions this way no longer fail with `ERR_PACKAGE_PATH_NOT_EXPORTED`.
+
+## [2.3.0] — Python, Go and Java without an SBOM tool
+
+### Highlights
+
+- **Native manifests**: `npx cra-audit` in a Python, Go or Java project reads `poetry.lock`, `uv.lock`, `Pipfile.lock` or `requirements*.txt`, `go.mod`, `gradle.lockfile` and `pom.xml` directly — no Syft/cdxgen step and no package.json needed. Same checks as npm: OSV vulnerabilities, malicious packages, CISA KEV with the Art. 14 clock, VEX and SARIF.
+- Findings and SARIF alerts point at the exact line of the manifest.
+- Only exact versions are audited: unpinned requirements, parent/BOM-managed Maven versions and version ranges are skipped and reported, never guessed. `pom.xml` covers declared dependencies (transitive ones need a Maven-generated SBOM).
+- Folders with an npm lockfile *and* one of these manifests are audited as a whole.
+- For these ecosystems the audit warns (instead of failing) about the missing TR-03183 SBOM and undeclared licenses; `sbom generate` explains how to produce one.
+
 ## [2.2.0] — Any language through its SBOM
 
 ### Highlights

package/README.md

@@ -5,7 +5,7 @@
 > Compliance audit for the **Cyber Resilience Act** (Regulation EU 2024/2847) and the **BSI TR-03183** technical guideline — native for npm, Yarn and pnpm, and for **any language** through its SBOM.
 
 `cra-audit` audits the installed dependencies of an npm project and checks the key requirements that the CRA imposes on "products with digital elements". It runs directly with `npx`, **without installation**, and has **no production dependencies** to minimize its own supply-chain surface.
-It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned. For **Python, Java, Go, Rust, .NET, PHP, Ruby…** pass the SBOM produced by your usual tooling with `-i` ([details](#8-any-language-input-sbom--i)).
+It reads the project lockfile natively, so it works with **npm** (`package-lock.json` / `npm-shrinkwrap.json`), **Yarn** (classic v1 and Berry v2+ `yarn.lock`) and **pnpm** (`pnpm-lock.yaml`) — auditing the exact versions each package manager pinned. **Python, Go and Java** projects are read directly from `requirements.txt` / `poetry.lock` / `uv.lock` / `Pipfile.lock`, `go.mod`, `pom.xml` and `gradle.lockfile`, and **any other language** through the SBOM your tooling produces (`-i`) — [details](#8-other-languages-manifests-and-input-sbom).
 ```bash
 # Run ALL the law's checks (Vulnerabilities + Licenses + SBOM)
 npx cra-audit
@@ -151,7 +151,25 @@ npx cra-audit readiness --init   # creates SECURITY.md and .well-known/security.
 
 `--init` prefills the templates from `package.json` (GitHub private vulnerability reporting link, supported major version, a coordinated disclosure process and the Art. 14 24 h / 72 h / 14 days reporting commitments); fill in the `TODO` placeholders and run it again.
 
-### 8. Any language: input SBOM (`-i`)
+### 8. Other languages: manifests and input SBOM
+
+**Read directly — just run `npx cra-audit` in the project folder (no package.json needed):**
+
+| Ecosystem | Files | Notes |
+| --- | --- | --- |
+| Python | `poetry.lock`, `uv.lock`, `Pipfile.lock` (exact); otherwise `requirements*.txt` | Only `==` pins are audited; ranges are skipped and reported, never guessed. `-r` includes, extras, markers and `--hash` lines are handled. |
+| Go | `go.mod` | Every required module (direct and `// indirect`), with `replace` directives applied. |
+| Java | `gradle.lockfile` (exact), `pom.xml` | `pom.xml`: declared dependencies with `${property}` and `<dependencyManagement>` resolution; transitive ones need a Maven-generated SBOM. |
+
+Findings point at the exact line of the manifest (in the console and in SARIF). A folder with both an npm lockfile and one of these manifests (e.g. a front end next to a Go API) is audited as a whole. Manifests do not carry licenses or hashes, so for these ecosystems the audit **warns** instead of generating a TR-03183 SBOM: commit the one your build produces and audit it with `-i`.
+
+```text
+  Sources: OSV.dev … · 4 components from requirements.txt, go.mod, pom.xml (golang, maven, pypi)
+  pom.xml: declared dependencies only; commit a Maven-generated SBOM (cyclonedx-maven-plugin) to audit transitive ones
+  CRITICAL [KEV] org.apache.logging.log4j:log4j-core@2.14.1  (fix: org.apache.logging.log4j:log4j-core@2.25.4)
+```
+
+**Input SBOM (`-i`), any language:**
 
 `audit`, `vuln`, `licenses` and `vex` accept an existing **CycloneDX JSON**, **SPDX 2.x JSON** or **SPDX 3.0 JSON-LD** SBOM instead of the npm lockfile. Every component is looked up in OSV.dev by its **Package URL**, so you get the same checks — known vulnerabilities, **malicious packages**, **CISA KEV** with the Art. 14 clock, licenses, VEX and SARIF — for any ecosystem OSV covers (Maven, PyPI, Go, crates.io, NuGet, Packagist, RubyGems, Hex, Pub, npm…).
 
@@ -182,6 +200,21 @@ Notes:
 - The input SBOM is also checked against TR-03183-2; since third-party generators rarely include the manufacturer fields, gaps are reported as a **warning** in the audit (`cra-audit sbom check -i` shows the details and fails on them). For npm projects, `cra-audit sbom generate` produces a conforming SBOM.
 - SARIF alerts point at the line of the component's purl in the SBOM file.
 
+### 9. Where to report: your country's CSIRT (`--country`)
+
+CRA Art. 14 notifications go through ENISA's Single Reporting Platform to the CSIRT of your main establishment's Member State. Set it once (`"country": "ES"` in `.cra-audit.json`, `--country ES`, or the action's `country` input) and the Art. 14 notice, the JSON report (`reporting`) and `readiness` include that CSIRT's procedure.
+
+**Spain — INCIBE-CERT** (verified against [INCIBE-CERT's CRA guidance](https://www.incibe.es/incibe-cert/blog/reglamento-de-ciberresiliencia-cra-que-es-quien-afecta-y-como-prepararse), 2026-09-09):
+
+- SRP access is requested from INCIBE at **cve-coordination@incibe.es**, which validates the manufacturer before registration — request it before you need it.
+- Incidents outside the CRA: **incidencias@incibe-cert.es**. Undisclosed vulnerabilities needing a CVE: INCIBE's CNA (**cve-coordination@incibe.es**).
+- In doubt, report through INCIBE-CERT's usual channels; INCIBE tells you whether to file it in the SRP.
+- `npx cra-audit readiness --init --lang es --country ES` writes a Spanish `SECURITY.md` with this procedure.
+
+🇪🇸 Guía en español: [Notificar al INCIBE-CERT según el CRA](docs/es/notificar-incibe.md).
+
+Other countries get the generic EU procedure for now; contributions with verified CSIRT procedures are welcome.
+
 ---
 
 ## Usage
@@ -247,6 +280,8 @@ cra-audit --help
 | `--fail-on <sev>` | Minimum severity that fails the audit: `info`, `low`, `moderate`, `high`, `critical`. |
 | `--vuln-source <src>` | `osv` (default: OSV.dev + CISA KEV) or `npm` (`npm audit`). |
 | `--no-fail-on-kev` | Report actively exploited (CISA KEV) vulnerabilities as a warning instead of failing. |
+| `--country <cc>` | Country of your main establishment (e.g. `ES`): the Art. 14 notice and `readiness` include its CSIRT's procedure. |
+| `--lang <en|es>` | Language of the `readiness --init` templates. |
 | `--production`, `--prod` | Audit production dependencies only. |
 | `--no-sbom` | Do not require an SBOM in the full audit. |
 | `--json` | Machine-readable JSON output. |
@@ -302,6 +337,7 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 {
   "failOn": "high",
   "failOnKev": true,
+  "country": "ES",
   "vulnerabilitySource": "osv",
   "requireSbom": true,
   "sbomFormat": "cyclonedx",
@@ -319,6 +355,7 @@ Create a `.cra-audit.json` file at the project root to customize the rules (ther
 ```
 
 - `failOn`: minimum severity that blocks the audit.
+- `country`: ISO code of your main establishment (e.g. `ES`); decides the CSIRT in the Art. 14 guidance.
 - `failOnKev`: fail when a dependency has an actively exploited vulnerability (CISA KEV). Default `true`.
 - `vulnerabilitySource`: `osv` (OSV.dev + CISA KEV) or `npm` (`npm audit`).
 - `requireSbom`: require the SBOM to meet the TR-03183-2 required data fields.
@@ -346,7 +383,7 @@ Suitable for CI/CD: a non-`0` code blocks the pipeline.
 
 Available in the GitHub Marketplace as [CRA Compliance Audit](https://github.com/marketplace/actions/cra-compliance-audit).
 
-For a Python, Java, Go… project, generate the SBOM first and pass it with `sbom-input`:
+Python, Go and Java projects work as they are (the action reads `requirements.txt`, `go.mod`, `pom.xml`…). For other languages, or to include Maven's transitive dependencies, generate the SBOM first and pass it with `sbom-input`:
 
 ```yaml
       - uses: anchore/sbom-action@v0          # Syft
@@ -396,6 +433,7 @@ Every finding shows up in **Security → Code scanning**, pointing at the exact
 | `fail-on` | `high` | Minimum severity that fails the job. |
 | `fail-on-kev` | `true` | Fail on actively exploited (CISA KEV) vulnerabilities. |
 | `production` | `false` | Production dependencies only. |
+| `country` | — | Country of your main establishment (e.g. `ES`) for the Art. 14 CSIRT steps. |
 | `sarif` | `cra-audit.sarif` | SARIF path (empty to skip). |
 | `upload-sarif` | `true` | Upload to code scanning (needs `security-events: write`; private repos need GitHub Advanced Security). |
 | `sbom` / `vex` | — | Also write the SBOM / VEX to these paths. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cra-audit",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Audits npm, yarn, and pnpm projects for compliance with the European Cyber Resilience Act (CRA, EU Regulation 2024/2847) and BSI TR-03183: SBOM (CycloneDX/SPDX), known vulnerabilities, third-party components, and licenses.",
   "homepage": "https://github.com/migohe14/cra-audit#readme",
   "repository": {
@@ -37,7 +37,8 @@
   },
   "main": "src/index.js",
   "exports": {
-    ".": "./src/index.js"
+    ".": "./src/index.js",
+    "./package.json": "./package.json"
   },
   "files": [
     "bin",

package/src/cli.js

@@ -167,6 +167,8 @@ function setFlag(flags, name, value) {
     case '--no-fail-on-kev': flags.noFailOnKev = value; break;
     case '--sarif': flags.sarif = value; break;
     case '--init': flags.init = value; break;
+    case '--country': flags.country = value; break;
+    case '--lang': flags.lang = String(value).toLowerCase(); break;
     case '--verbose': flags.verbose = value; break;
     default:
       // Unknown flag stored under its raw name for forward compatibility.
@@ -206,6 +208,8 @@ ${c.bold('OPTIONS')}
   ${c.cyan('--fail-on <sev>')}       Minimum severity that fails the audit: info|low|moderate|high|critical.
   ${c.cyan('--vuln-source <src>')}   Vulnerability source: osv (default: OSV.dev + CISA KEV) | npm (npm audit).
   ${c.cyan('--no-fail-on-kev')}      Report actively exploited (CISA KEV) vulnerabilities without failing.
+  ${c.cyan('--country <cc>')}        Country of your main establishment (e.g. ES): shows its CSIRT's Art. 14 steps.
+  ${c.cyan('--lang <en|es>')}        Language of the readiness --init templates (default: en).
   ${c.cyan('--production, --prod')}  Audit production dependencies only (skips devDependencies).
   ${c.cyan('--no-sbom')}             Do not require an SBOM in the full audit.
   ${c.cyan('--json')}                Machine-readable JSON output.

package/src/commands/audit.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const path = require('node:path');
-const { findProjectRoot } = require('../utils/fs');
+const { findAnyProjectRoot } = require('../core/project-source');
 const { logger } = require('../utils/logger');
 const { loadPolicy } = require('../core/policy');
 const { runAudit } = require('../core/auditor');
@@ -45,20 +45,24 @@ async function auditCommand(flags, only) {
 }
 
 /**
- * Project root: the nearest package.json, or with `-i <sbom>` the working
- * directory (any ecosystem, no package.json needed).
+ * Project root: with `-i <sbom>` the working directory; otherwise the nearest
+ * folder with a package.json or a supported manifest (requirements.txt,
+ * poetry.lock, uv.lock, Pipfile.lock, go.mod, pom.xml, gradle.lockfile).
  */
 function resolveRoot(flags) {
   const start = flags.cwd || process.cwd();
   if (inputPath(flags)) return path.resolve(start);
-  const root = findProjectRoot(start);
+  const root = findAnyProjectRoot(start);
   if (!root) {
-    logger.error('No package.json found. Run the command inside an npm project.');
+    logger.error(NO_PROJECT);
     return null;
   }
   return root;
 }
 
+const NO_PROJECT = 'No project found: expected a package.json (npm/Yarn/pnpm), requirements.txt, ' +
+  'poetry.lock, uv.lock, Pipfile.lock, go.mod, pom.xml or gradle.lockfile — or pass an SBOM with -i.';
+
 /** `-i/--input <sbom>` resolved against the working directory. */
 function inputPath(flags) {
   if (typeof flags.input !== 'string') return null;
@@ -75,7 +79,8 @@ function applyFlagOverrides(policy, flags) {
   if (flags.vulnSource) merged.vulnerabilitySource = flags.vulnSource;
   if (flags.failOnKev) merged.failOnKev = true;
   if (flags.noFailOnKev) merged.failOnKev = false;
+  if (typeof flags.country === 'string') merged.country = flags.country.toUpperCase();
   return merged;
 }
 
-module.exports = { auditCommand, inputPath };
+module.exports = { auditCommand, inputPath, resolveRoot };

package/src/commands/readiness.js

@@ -4,6 +4,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { logger, color } = require('../utils/logger');
 const { checkReadiness, writeTemplates } = require('../core/readiness');
+const { loadPolicy } = require('../core/policy');
 
 /**
  * `cra-audit readiness [--init]` — checks the organisational CRA duties that
@@ -15,15 +16,17 @@ const { checkReadiness, writeTemplates } = require('../core/readiness');
  */
 function readinessCommand(flags) {
   const projectRoot = findRepositoryRoot(flags.cwd || process.cwd());
+  const country = typeof flags.country === 'string' ? flags.country.toUpperCase() : policyCountry(projectRoot, flags);
+  const lang = flags.lang === 'es' ? 'es' : 'en';
 
   if (flags.init) {
-    for (const { file, created } of writeTemplates(projectRoot)) {
+    for (const { file, created } of writeTemplates(projectRoot, { lang, country })) {
       if (created) logger.success(`Created ${file} — fill in the TODO placeholders.`);
       else logger.info(`${file} already exists; left untouched.`);
     }
   }
 
-  const result = checkReadiness(projectRoot);
+  const result = checkReadiness(projectRoot, { country });
 
   if (flags.json) {
     process.stdout.write(JSON.stringify(result, null, 2) + '\n');
@@ -67,4 +70,13 @@ function findRepositoryRoot(start) {
   }
 }
 
+/** `country` from .cra-audit.json, if any (a broken policy never blocks readiness). */
+function policyCountry(projectRoot, flags) {
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.country || null;
+  } catch {
+    return null;
+  }
+}
+
 module.exports = { readinessCommand };

package/src/commands/sbom.js

@@ -1,111 +1,122 @@
-'use strict';
-
-const path = require('node:path');
-const { findProjectRoot, readJson, writeJson, exists } = require('../utils/fs');
-const { logger, color } = require('../utils/logger');
-const { generateSbom } = require('../core/sbom-generator');
-const { validateSbom } = require('../core/sbom-validator');
-const { loadPolicy } = require('../core/policy');
-
-/**
- * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
- *
- * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
- * - check:    generates (or reads) an SBOM and validates the data fields
- *             required by BSI TR-03183-2 v2.1.0 §5.2.
- */
-function sbomCommand(subcommand, flags) {
-  const projectRoot = findProjectRoot(flags.cwd || process.cwd());
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
-
-  const action = subcommand || 'generate';
-  const format = flags.format || 'cyclonedx';
-
-  if (action === 'check') {
-    return sbomCheck(projectRoot, format, flags);
-  }
-  if (action === 'generate') {
-    return sbomGenerate(projectRoot, format, flags);
-  }
-
-  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
-  return 1;
-}
-
-function sbomGenerate(projectRoot, format, flags) {
-  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
-  if (!result.ok) {
-    logger.error(result.error);
-    return 1;
-  }
-
-  if (flags.output) {
-    const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
-    writeJson(outPath, result.document);
-    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
-  } else {
-    process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
-  }
-  return 0;
-}
-
-function sbomCheck(projectRoot, format, flags) {
-  let document;
-
-  // If an SBOM file is provided, validate it directly; otherwise generate one.
-  if (flags.input) {
-    const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
-    if (!exists(inPath)) {
-      logger.error(`The specified SBOM was not found: ${flags.input}`);
-      return 1;
-    }
-    document = readJson(inPath);
-  } else {
-    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
-    if (!result.ok) {
-      logger.error(result.error);
-      return 1;
-    }
-    document = result.document;
-  }
-
-  const validation = validateSbom(document);
-  if (!validation.ok) {
-    logger.error(validation.error);
-    return 1;
-  }
-
-  if (flags.json) {
-    process.stdout.write(JSON.stringify(validation, null, 2) + '\n');
-    return validation.valid ? 0 : 1;
-  }
-
-  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
-  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
-  for (const check of validation.checks) {
-    const mark = check.passed ? color.green('✔') : color.red('✖');
-    logger.log(`  ${mark} ${check.label}`);
-  }
-  logger.log('');
-  if (validation.valid) {
-    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
-    return 0;
-  }
-  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
-  return 1;
-}
-
-/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
-function sbomCreator(projectRoot, flags) {
-  if (typeof flags.creator === 'string') return flags.creator;
-  try {
-    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
-  } catch {
-    return undefined; // A broken policy file must not block SBOM generation.
-  }
-}
-
-module.exports = { sbomCommand };
+'use strict';
+
+const path = require('node:path');
+const { readJson, writeJson, exists } = require('../utils/fs');
+const { logger, color } = require('../utils/logger');
+const { generateSbom } = require('../core/sbom-generator');
+const { validateSbom } = require('../core/sbom-validator');
+const { loadPolicy } = require('../core/policy');
+const { hasManifests } = require('../core/manifest-reader');
+const { findAnyProjectRoot } = require('../core/project-source');
+
+/**
+ * `cra-audit sbom <generate|check>` and the `--sbom` shortcut.
+ *
+ * - generate: builds a CycloneDX/SPDX SBOM and prints it or writes it to disk.
+ * - check:    generates (or reads) an SBOM and validates the data fields
+ *             required by BSI TR-03183-2 v2.1.0 §5.2.
+ */
+function sbomCommand(subcommand, flags) {
+  const start = flags.cwd || process.cwd();
+  // The nearest project decides: a Python/Go/Java folder inside an npm repo is not npm.
+  const nearest = findAnyProjectRoot(start);
+  const npmProject = nearest && exists(path.join(nearest, 'package.json'));
+  const projectRoot = npmProject ? nearest : (flags.input ? path.resolve(start) : null);
+  if (!projectRoot) {
+    const other = nearest && hasManifests(nearest);
+    logger.error(other
+      ? 'cra-audit generates TR-03183 SBOMs for npm/Yarn/pnpm projects. For this ecosystem, generate the SBOM with ' +
+        'your build tooling (Syft, cdxgen, cyclonedx-maven-plugin, cyclonedx-py…) and check it with `cra-audit sbom check -i <file>`; ' +
+        '`cra-audit` audits this project directly.'
+      : 'No package.json found. Run the command inside an npm project, or pass an SBOM with `sbom check -i <file>`.');
+    return 1;
+  }
+
+  const action = subcommand || 'generate';
+  const format = flags.format || 'cyclonedx';
+
+  if (action === 'check') {
+    return sbomCheck(projectRoot, format, flags);
+  }
+  if (action === 'generate') {
+    return sbomGenerate(projectRoot, format, flags);
+  }
+
+  logger.error(`Unknown SBOM subcommand: "${action}". Use "generate" or "check".`);
+  return 1;
+}
+
+function sbomGenerate(projectRoot, format, flags) {
+  const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
+  if (!result.ok) {
+    logger.error(result.error);
+    return 1;
+  }
+
+  if (flags.output) {
+    const outPath = path.isAbsolute(flags.output) ? flags.output : path.join(projectRoot, flags.output);
+    writeJson(outPath, result.document);
+    logger.success(`SBOM (${result.format}) with ${result.componentCount} components written to: ${outPath}`);
+  } else {
+    process.stdout.write(JSON.stringify(result.document, null, 2) + '\n');
+  }
+  return 0;
+}
+
+function sbomCheck(projectRoot, format, flags) {
+  let document;
+
+  // If an SBOM file is provided, validate it directly; otherwise generate one.
+  if (flags.input) {
+    const inPath = path.isAbsolute(flags.input) ? flags.input : path.join(projectRoot, flags.input);
+    if (!exists(inPath)) {
+      logger.error(`The specified SBOM was not found: ${flags.input}`);
+      return 1;
+    }
+    document = readJson(inPath);
+  } else {
+    const result = generateSbom(projectRoot, { format, creator: sbomCreator(projectRoot, flags) });
+    if (!result.ok) {
+      logger.error(result.error);
+      return 1;
+    }
+    document = result.document;
+  }
+
+  const validation = validateSbom(document);
+  if (!validation.ok) {
+    logger.error(validation.error);
+    return 1;
+  }
+
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(validation, null, 2) + '\n');
+    return validation.valid ? 0 : 1;
+  }
+
+  logger.heading('SBOM validation · BSI TR-03183-2 v2.1.0 (required data fields)');
+  logger.detail(`Detected format: ${validation.format} · Components: ${validation.stats.total}`);
+  for (const check of validation.checks) {
+    const mark = check.passed ? color.green('✔') : color.red('✖');
+    logger.log(`  ${mark} ${check.label}`);
+  }
+  logger.log('');
+  if (validation.valid) {
+    logger.success(color.bold('SBOM VALID — meets the TR-03183-2 data fields required by the CRA.'));
+    return 0;
+  }
+  logger.error(color.bold(`SBOM INVALID — ${validation.failedChecks.length} requirement(s) not met.`));
+  return 1;
+}
+
+/** SBOM creator from --creator, else from the project policy (`sbomCreator`). */
+function sbomCreator(projectRoot, flags) {
+  if (typeof flags.creator === 'string') return flags.creator;
+  try {
+    return loadPolicy(projectRoot, flags.config).policy.sbomCreator;
+  } catch {
+    return undefined; // A broken policy file must not block SBOM generation.
+  }
+}
+
+module.exports = { sbomCommand };

package/src/commands/vex.js

@@ -1,14 +1,14 @@
 'use strict';
 
 const path = require('node:path');
-const { findProjectRoot, readJson, writeJson } = require('../utils/fs');
+const { readJson, writeJson } = require('../utils/fs');
 const { logger } = require('../utils/logger');
 const { loadPolicy } = require('../core/policy');
 const { scanVulnerabilities } = require('../core/vuln-scanner');
 const { buildVex } = require('../core/vex');
 const { creatorFromManifest } = require('../core/installed-metadata');
-const { readSbom } = require('../core/sbom-reader');
-const { inputPath } = require('./audit');
+const { loadProject } = require('../core/project-source');
+const { inputPath, resolveRoot } = require('./audit');
 
 /**
  * `cra-audit vex` — writes a VEX document (CycloneDX 1.6 or OpenVEX 0.2.0)
@@ -19,12 +19,8 @@ const { inputPath } = require('./audit');
  */
 async function vexCommand(flags) {
   const input = inputPath(flags);
-  const start = flags.cwd || process.cwd();
-  const projectRoot = input ? path.resolve(start) : findProjectRoot(start);
-  if (!projectRoot) {
-    logger.error('No package.json found. Run the command inside an npm project.');
-    return 1;
-  }
+  const projectRoot = resolveRoot(flags);
+  if (!projectRoot) return 1;
 
   let policy;
   try {
@@ -40,7 +36,7 @@ async function vexCommand(flags) {
     return 1;
   }
 
-  const parsed = input ? readSbom(input) : null;
+  const { mode, parsed } = loadProject(projectRoot, { input });
   if (parsed && !parsed.ok) {
     logger.error(parsed.error);
     return 1;
@@ -63,7 +59,7 @@ async function vexCommand(flags) {
   const pkg = readJson(path.join(projectRoot, 'package.json')) || {};
   const creator = creatorFromManifest(pkg);
   const author = policy.sbomCreator || (creator && (creator.email || creator.url)) || null;
-  const product = parsed
+  const product = parsed && mode !== 'npm+manifest'
     ? { name: parsed.root.name, version: parsed.root.version, purl: parsed.root.purl }
     : { name: pkg.name || path.basename(projectRoot), version: pkg.version || '0.0.0' };
   const document = buildVex(product, vulns, policy, { format, author });

package/src/core/auditor.js

@@ -5,7 +5,8 @@ const { generateSbom } = require('./sbom-generator');
 const { validateSbom } = require('./sbom-validator');
 const { checkLicenses } = require('./license-checker');
 const { acceptance } = require('./vex');
-const { readSbom } = require('./sbom-reader');
+const { loadProject } = require('./project-source');
+const { reportingGuide } = require('./reporting');
 
 /**
  * @typedef {object} AuditResult
@@ -19,12 +20,13 @@ const { readSbom } = require('./sbom-reader');
  * Runs the full CRA audit: vulnerabilities + SBOM + licenses, then evaluates
  * the result against the configured security policy.
  *
+ * The components come from the npm lockfile, an input SBOM (`input`, any
+ * ecosystem) or, without an npm lockfile, the manifests of other ecosystems
+ * (requirements.txt, poetry.lock, go.mod, pom.xml…). See ./project-source.js.
+ *
  * @param {string} projectRoot
  * @param {object} policy
  * @param {string|null} policySource
- * With `input` (path to a CycloneDX/SPDX JSON SBOM) the audit runs on that
- * SBOM instead of the npm lockfile, so it covers any ecosystem.
- *
  * @param {{ only?: 'vulnerabilities'|'sbom'|'licenses', input?: string }} [options]
  * @returns {Promise<AuditResult>}
  */
@@ -32,7 +34,9 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   const { only, input } = options;
   const sections = {};
   const reasons = [];
-  const parsed = input ? readSbom(input) : null;
+  const project = loadProject(projectRoot, { input });
+  const parsed = project.parsed;
+  const fromManifests = project.mode === 'manifest';
 
   // --- 1. Vulnerabilities -------------------------------------------------
   if (!only || only === 'vulnerabilities') {
@@ -62,7 +66,21 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   // --- 2. SBOM ------------------------------------------------------------
-  if ((!only || only === 'sbom') && parsed) {
+  if ((!only || only === 'sbom') && fromManifests) {
+    // TR-03183 SBOMs (hashes, creators, graph) are built from npm lockfiles;
+    // other ecosystems should commit the one their build tooling produces.
+    sections.sbom = {
+      ok: true, manifest: true, format: 'manifest', componentCount: parsed.components.length,
+      files: parsed.files, ecosystems: parsed.ecosystems,
+    };
+    if (policy.requireSbom) {
+      reasons.push({
+        label: `No SBOM generated for ${parsed.ecosystems.join(', ')}: commit one from your build tooling (Syft, cdxgen, CycloneDX plugins) and audit it with \`-i\``,
+        passed: true,
+        warning: true,
+      });
+    }
+  } else if ((!only || only === 'sbom') && project.mode === 'sbom') {
     // An input SBOM comes from third-party tooling that rarely carries the
     // manufacturer fields TR-03183 requires: report gaps without blocking.
     const sbom = parsed.ok
@@ -103,11 +121,18 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
 
   // --- 3. Licenses --------------------------------------------------------
   if (!only || only === 'licenses') {
-    const licenses = checkLicenses(projectRoot, policy.licenses, { parsed });
+    const licenses = checkLicenses(projectRoot, policy.licenses, { parsed: project.mode === 'npm+manifest' ? null : parsed });
     sections.licenses = licenses;
 
     if (!licenses.ok) {
       reasons.push({ label: `Licenses could not be analyzed: ${licenses.error}`, passed: false });
+    } else if (fromManifests) {
+      // Manifests do not declare licenses: report the gap instead of failing.
+      reasons.push({
+        label: `Licenses are not declared in ${parsed.files.join(', ')}: ${licenses.summary.missing.length} component(s) to review in your SBOM`,
+        passed: true,
+        warning: licenses.summary.missing.length > 0,
+      });
     } else {
       const s = licenses.summary;
       const missingFails = policy.licenses.failOnMissing && s.missing.length > 0;
@@ -122,11 +147,13 @@ async function runAudit(projectRoot, policy, policySource, options = {}) {
   }
 
   return {
-    project: parsed && parsed.ok
-      ? { name: parsed.root.name, version: parsed.root.version, sbom: parsed.sourceFile }
+    project: parsed && parsed.ok && project.mode !== 'npm+manifest'
+      ? { name: parsed.root.name, version: parsed.root.version, ...(project.mode === 'sbom' ? { sbom: parsed.sourceFile } : { manifests: parsed.files }) }
       : getProject(projectRoot, sections),
     policySource,
     generatedAt: new Date().toISOString(),
+    // Where CRA Art. 14 notifications go for the manufacturer's country.
+    reporting: reportingGuide(policy.country),
     sections,
     gate: { passed: reasons.every((r) => r.passed), reasons },
   };