# Generate SBOM
praisonai recipe sbom ./my-recipe -o sbom.json

# Audit dependencies
praisonai recipe audit ./my-recipe

# Sign a bundle
praisonai recipe sign my-recipe.praison --key private.pem

# Verify signature
praisonai recipe verify my-recipe.praison --key public.pem

praisonai recipe sbom <recipe> [options]

# Generate CycloneDX SBOM
praisonai recipe sbom ./my-recipe --format cyclonedx -o sbom.json

# Generate SPDX SBOM
praisonai recipe sbom ./my-recipe --format spdx -o sbom.spdx.json

# Output to stdout
praisonai recipe sbom ./my-recipe --json

praisonai recipe audit <recipe> [options]

# Basic audit
praisonai recipe audit ./my-recipe

# Strict mode (fail on issues)
praisonai recipe audit ./my-recipe --strict

# JSON output
praisonai recipe audit ./my-recipe --json

Audit Report: my-recipe
  Lockfile: lock/requirements.lock
  Dependencies: 15
  Vulnerabilities: 0
  Warnings: 1
    - Outdated: requests (2.28.0 -> 2.31.0)
✓ Audit passed

praisonai recipe sign <bundle> --key <private.pem> [options]

# Sign a bundle
praisonai recipe sign my-recipe.praison --key private.pem

# Custom signature output
praisonai recipe sign my-recipe.praison --key private.pem -o my-recipe.sig

praisonai recipe verify <bundle> --key <public.pem> [options]

# Verify signature
praisonai recipe verify my-recipe.praison --key public.pem

# Custom signature path
praisonai recipe verify my-recipe.praison --key public.pem --signature my-recipe.sig

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "metadata": {
    "component": {
      "name": "my-recipe",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "openai",
      "version": "1.0.0",
      "purl": "pkg:pypi/openai@1.0.0"
    }
  ]
}

# Validate with lockfile requirement
praisonai recipe validate ./my-recipe --require-lockfile

data_policy:
  pii:
    mode: redact  # allow, deny, redact
    fields:
      - email
      - phone
      - ssn
      - credit_card

from praisonai.recipe.security import (
    generate_sbom,
    audit_dependencies,
    sign_bundle,
    verify_bundle,
    validate_lockfile,
    redact_pii,
    detect_pii,
)

# Generate SBOM
sbom = generate_sbom("./my-recipe", format="cyclonedx")

# Audit dependencies
report = audit_dependencies("./my-recipe")
if not report["passed"]:
    print(f"Vulnerabilities: {report['vulnerabilities']}")

# Validate lockfile
result = validate_lockfile("./my-recipe", strict=True)

# Sign bundle
sig_path = sign_bundle("my-recipe.praison", "private.pem")

# Verify bundle
valid, message = verify_bundle("my-recipe.praison", "public.pem")

# Redact PII
data = {"email": "test@example.com"}
policy = {"pii": {"mode": "redact", "fields": ["email"]}}
redacted = redact_pii(data, policy)

# Detect PII
detections = detect_pii(data)

# Generate private key
openssl genrsa -out private.pem 2048

# Extract public key
openssl rsa -in private.pem -pubout -out public.pem