@codyswann/lisa 2.310.3 → 2.310.5

package/dist/cli/doctor-readiness-supply-chain-go-assess.d.ts

@@ -0,0 +1,8 @@
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
+/**
+ * Assess Go module dependencies when no JavaScript manifest exists.
+ * @param root - Repository root to assess
+ * @returns The B5 record, or null when no Go manifest exists
+ */
+export declare function assessGoDependenciesSupplyChainDimension(root: string): Promise<ReadinessDimensionRecord | null>;
+//# sourceMappingURL=doctor-readiness-supply-chain-go-assess.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-go-assess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-go-assess.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-go-assess.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AA+F5E;;;;GAIG;AACH,wBAAsB,wCAAwC,CAC5D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CA6C1C"}

package/dist/cli/doctor-readiness-supply-chain-go-assess.js

@@ -0,0 +1,132 @@
+/**
+ * Go module B5 readiness record construction.
+ * @module cli/doctor-readiness-supply-chain-go-assess
+ */
+import { informationalFindings } from "./doctor-readiness-shared.js";
+import { DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID, MAX_EVIDENCE_LINES, SUPPLY_CHAIN_BLOCKER_ID, } from "./doctor-readiness-supply-chain-constants.js";
+import { findGoAuditGate, findGoLockfile, isFloatingGoSpec, readGoManifest, } from "./doctor-readiness-supply-chain-go.js";
+const GO_MOD = "go.mod";
+const GO_SUM = "go.sum";
+/**
+ * Build the rubric-shaped B5 finding from evidence lines.
+ * @param violations - Evidence lines
+ * @returns The B5 finding
+ */
+function supplyChainFinding(violations) {
+    const shown = violations.slice(0, MAX_EVIDENCE_LINES);
+    const overflow = violations.length - shown.length;
+    return {
+        blocker: SUPPLY_CHAIN_BLOCKER_ID,
+        invariant_violated: "belief that the owned surface still works rests on a repeatable install " +
+            "and a standing audit, not on hope",
+        evidence: shown.join(" | ") +
+            (overflow > 0
+                ? ` | (+${overflow} further finding(s) of the same kind)`
+                : ""),
+        why_proof_missed: "the test suite proves things about the code in the tree it happened to " +
+            "install, so a tree that drifts — or one carrying a known advisory nobody " +
+            "checks for — still reports green",
+        root_correction: "commit a module checksum file, name a version for every module " +
+            "requirement, and run a Go dependency audit on every push",
+        machinery_to_remove: [
+            "manual dependency review with no standing module checksum and audit gate",
+        ],
+    };
+}
+/**
+ * Build a stated-reason SKIP record.
+ * @param reason - Why the dimension was not assessed
+ * @returns The SKIP dimension record
+ */
+function skipRecord(reason) {
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "SKIP",
+        findings: [{ reason, skip: true }],
+    };
+}
+/**
+ * Build B5 evidence lines for a Go module project.
+ * @param specs - Go module requirements under assessment
+ * @param lockfile - Committed checksum file path, or null when absent
+ * @param auditGate - Audit gate path, or null when absent
+ * @returns Evidence lines for B5 violations
+ */
+function goSupplyChainViolations(specs, lockfile, auditGate) {
+    if (specs.length === 0) {
+        return [];
+    }
+    return [
+        ...(lockfile === null
+            ? [
+                `\`${GO_MOD}\` declares ${specs.length} Go module requirement(s) ` +
+                    `but no \`${GO_SUM}\` is committed — two module downloads can ` +
+                    "resolve to different transitive checksums, so what was " +
+                    "validated is not provably what gets installed",
+            ]
+            : []),
+        ...specs
+            .filter(spec => isFloatingGoSpec(spec.spec))
+            .map(spec => `\`${GO_MOD}\` module \`${spec.name}\` names no pinned version, so ` +
+            "Go may resolve a branch or latest module state rather than a " +
+            "version any run intentionally chose"),
+        ...(auditGate === null
+            ? [
+                "no Go dependency-audit gate was found anywhere — no " +
+                    "`govulncheck`/`osv-scanner` step in `.github/workflows/*.yml`, " +
+                    "none in a git hook, and no `dependabot.yml` gomod entry or Go " +
+                    "Renovate manager — so a newly disclosed advisory in this module " +
+                    "tree would never be noticed by anything",
+            ]
+            : []),
+    ];
+}
+/**
+ * Assess Go module dependencies when no JavaScript manifest exists.
+ * @param root - Repository root to assess
+ * @returns The B5 record, or null when no Go manifest exists
+ */
+export async function assessGoDependenciesSupplyChainDimension(root) {
+    const go = await readGoManifest(root);
+    if (go.kind === "absent") {
+        return null;
+    }
+    if (go.specs.length === 0) {
+        return skipRecord("`go.mod` was found but declares no module requirements, so this " +
+            "repository owns no Go third-party surface a confidence model could " +
+            "cover; supply-chain confidence is not established either way");
+    }
+    const lockfile = await findGoLockfile(root);
+    const auditGate = await findGoAuditGate(root);
+    const violations = goSupplyChainViolations(go.specs, lockfile, auditGate);
+    const observations = [
+        ...(lockfile === null ? [] : [`Go checksum file in use: \`${lockfile}\`.`]),
+        ...(auditGate === null
+            ? []
+            : [`Go dependency-audit gate declared in \`${auditGate}\`.`]),
+    ];
+    if (violations.length > 0) {
+        return {
+            id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+            status: "FAIL",
+            findings: [
+                supplyChainFinding(violations),
+                ...informationalFindings(observations),
+            ],
+        };
+    }
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "PASS",
+        findings: [
+            {
+                evidence: `Inspected ${go.specs.length} Go module requirement(s) in ` +
+                    "`go.mod`: each module names a pinned version, `go.sum` is " +
+                    "committed, and a Go dependency-audit gate is declared.",
+                checked: [SUPPLY_CHAIN_BLOCKER_ID],
+            },
+            ...informationalFindings(observations),
+        ],
+    };
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-go-assess.js.map

package/dist/cli/doctor-readiness-supply-chain-go-assess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-go-assess.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-go-assess.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,sCAAsC,EACtC,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,GAEf,MAAM,uCAAuC,CAAC;AAG/C,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,iEAAiE;YACjE,0DAA0D;QAC5D,mBAAmB,EAAE;YACnB,0EAA0E;SAC3E;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAC9B,KAAkC,EAClC,QAAuB,EACvB,SAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,IAAI;YACnB,CAAC,CAAC;gBACE,KAAK,MAAM,eAAe,KAAK,CAAC,MAAM,4BAA4B;oBAChE,YAAY,MAAM,6CAA6C;oBAC/D,yDAAyD;oBACzD,+CAA+C;aAClD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,KAAK;aACL,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC3C,GAAG,CACF,IAAI,CAAC,EAAE,CACL,KAAK,MAAM,eAAe,IAAI,CAAC,IAAI,iCAAiC;YACpE,+DAA+D;YAC/D,qCAAqC,CACxC;QACH,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC;gBACE,sDAAsD;oBACpD,iEAAiE;oBACjE,gEAAgE;oBAChE,kEAAkE;oBAClE,yCAAyC;aAC5C;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC5D,IAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CACf,kEAAkE;YAChE,qEAAqE;YACrE,8DAA8D,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG;QACnB,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,QAAQ,KAAK,CAAC,CAAC;QAC3E,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,0CAA0C,SAAS,KAAK,CAAC,CAAC;KAChE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,EAAE,CAAC,KAAK,CAAC,MAAM,+BAA+B;oBAC3D,4DAA4D;oBAC5D,wDAAwD;gBAC1D,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-supply-chain-go.d.ts

@@ -0,0 +1,39 @@
+/** One Go module requirement flattened from `go.mod`. */
+export interface GoDependencySpec {
+    readonly manifestPath: "go.mod";
+    readonly name: string;
+    readonly spec: string | null;
+}
+/** What reading a Go module manifest established. */
+export type GoManifestOutcome = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "ok";
+    readonly manifestPath: "go.mod";
+    readonly specs: readonly GoDependencySpec[];
+};
+/**
+ * Read the Go module dependency manifest when no JavaScript manifest exists.
+ * @param root - Repository root
+ * @returns Parsed Go module specs, or absent when this is not a Go module
+ */
+export declare function readGoManifest(root: string): Promise<GoManifestOutcome>;
+/**
+ * Find the committed Go module checksum file.
+ * @param root - Repository root
+ * @returns The checksum file path, or null when none is committed
+ */
+export declare function findGoLockfile(root: string): Promise<string | null>;
+/**
+ * Find where the repository audits its Go module dependency tree.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first Go audit gate found, or null
+ */
+export declare function findGoAuditGate(root: string): Promise<string | null>;
+/**
+ * Check whether a Go module requirement spec floats.
+ * @param spec - Version/pseudo-version from go.mod
+ * @returns True when the spec is absent or branch-like rather than pinned
+ */
+export declare function isFloatingGoSpec(spec: string | null): boolean;
+//# sourceMappingURL=doctor-readiness-supply-chain-go.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-go.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-go.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-go.ts"],"names":[],"mappings":"AAkDA,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC7C,CAAC;AA+IN;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAM7E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEzE;AA8CD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoB1E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE7D"}

package/dist/cli/doctor-readiness-supply-chain-go.js

@@ -0,0 +1,249 @@
+/**
+ * Go module scanning for the dependencies/supply-chain readiness producer
+ * (B5, PRD #1739, #1896).
+ * @module cli/doctor-readiness-supply-chain-go
+ */
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { readFileOrNull } from "./doctor-readiness-shared.js";
+/** Dependabot ecosystem spelling for Go module dependency updates. */
+const GO_ECOSYSTEM_PATTERN = /package-ecosystem:\s*["']?gomod\b/i;
+/** Commands and scanners that audit Go module dependencies. */
+const GO_AUDIT_GATE_PATTERN = /\b(govulncheck|osv-scanner|snyk|trivy|grype)\b/i;
+/** Renovate manager spelling for Go module dependencies. */
+const RENOVATE_GO_PATTERN = /\b(gomod|golang|go_modules?)\b/i;
+/** Files that may declare an audit gate in their text. */
+const GATE_DIRECTORIES = [
+    path.join(".github", "workflows"),
+    ".husky",
+];
+/** Single-file gate declarations checked by text match. */
+const GATE_FILES = [
+    "lefthook.yml",
+    "lefthook.yaml",
+    ".lefthook.yml",
+];
+/** Update bots whose mere presence is a standing confidence model. */
+const UPDATE_BOT_FILES = [
+    path.join(".github", "dependabot.yml"),
+    path.join(".github", "dependabot.yaml"),
+    path.join(".github", "renovate.json"),
+    "renovate.json",
+    ".renovaterc",
+    ".renovaterc.json",
+];
+/** Go module specs that do not pin a version or pseudo-version. */
+const FLOATING_SPECS = new Set([
+    "",
+    "latest",
+    "main",
+    "master",
+    "HEAD",
+]);
+/**
+ * Whether a repository-relative path exists.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path
+ * @returns True when the file could be read
+ */
+async function fileExists(root, relativePath) {
+    return (await readFileOrNull(root, relativePath)) !== null;
+}
+/**
+ * List files directly inside a repository-relative directory.
+ * @param root - Repository root
+ * @param relativeDir - Repo-relative directory
+ * @returns Repo-relative file paths
+ */
+async function listDirectory(root, relativeDir) {
+    try {
+        const entries = await readdir(path.join(root, relativeDir), {
+            withFileTypes: true,
+        });
+        return entries
+            .filter(entry => entry.isFile())
+            .map(entry => path.join(relativeDir, entry.name))
+            .sort((a, b) => a.localeCompare(b));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Remove a trailing line comment from go.mod syntax.
+ * @param line - Raw go.mod line
+ * @returns The uncommented prefix
+ */
+function stripGoComment(line) {
+    const commentStart = line.indexOf("//");
+    return (commentStart === -1 ? line : line.slice(0, commentStart)).trim();
+}
+/**
+ * Parse one module/version pair from a `require` line.
+ * @param line - Raw line without the leading `require` keyword
+ * @returns A dependency spec, or null for unparsable lines
+ */
+function parseRequireSpec(line) {
+    const parts = stripGoComment(line).split(/\s+/u).filter(Boolean);
+    const [name, spec] = parts;
+    if (name === undefined) {
+        return null;
+    }
+    return {
+        manifestPath: "go.mod",
+        name,
+        spec: spec ?? null,
+    };
+}
+/**
+ * Whether a trimmed go.mod line starts a require block.
+ * @param line - Trimmed go.mod line
+ * @returns True when the line is `require (`
+ */
+function startsRequireBlock(line) {
+    return line === "require (" || line === "require(";
+}
+/**
+ * Append a parsed requirement if the line contains one.
+ * @param specs - Existing specs
+ * @param line - Raw requirement text
+ * @returns Specs with the parsed requirement appended when present
+ */
+function appendRequireSpec(specs, line) {
+    const spec = parseRequireSpec(line);
+    return spec === null ? specs : [...specs, spec];
+}
+/**
+ * Parse one go.mod line while tracking whether we are inside a require block.
+ * @param state - Current parser state
+ * @param rawLine - Raw go.mod line
+ * @returns Updated parser state
+ */
+function collectGoSpecLine(state, rawLine) {
+    const line = stripGoComment(rawLine);
+    if (line === "") {
+        return state;
+    }
+    if (state.inRequireBlock) {
+        return line === ")"
+            ? { inRequireBlock: false, specs: state.specs }
+            : {
+                inRequireBlock: true,
+                specs: appendRequireSpec(state.specs, line),
+            };
+    }
+    if (startsRequireBlock(line)) {
+        return { inRequireBlock: true, specs: state.specs };
+    }
+    if (line.startsWith("require ")) {
+        return {
+            inRequireBlock: false,
+            specs: appendRequireSpec(state.specs, line.slice("require ".length)),
+        };
+    }
+    return state;
+}
+/**
+ * Flatten Go module requirements from go.mod.
+ * @param source - go.mod source
+ * @returns Parsed module requirements
+ */
+function collectGoSpecs(source) {
+    return source
+        .split(/\r?\n/u)
+        .reduce((state, line) => collectGoSpecLine(state, line), { inRequireBlock: false, specs: [] }).specs;
+}
+/**
+ * Read the Go module dependency manifest when no JavaScript manifest exists.
+ * @param root - Repository root
+ * @returns Parsed Go module specs, or absent when this is not a Go module
+ */
+export async function readGoManifest(root) {
+    const source = await readFileOrNull(root, "go.mod");
+    if (source === null) {
+        return { kind: "absent" };
+    }
+    return { kind: "ok", manifestPath: "go.mod", specs: collectGoSpecs(source) };
+}
+/**
+ * Find the committed Go module checksum file.
+ * @param root - Repository root
+ * @returns The checksum file path, or null when none is committed
+ */
+export async function findGoLockfile(root) {
+    return (await fileExists(root, "go.sum")) ? "go.sum" : null;
+}
+/**
+ * Whether an update-bot config watches Go module dependencies.
+ * @param botFile - Repo-relative bot config path
+ * @param source - The config's text
+ * @returns True when the bot covers Go modules
+ */
+function coversGoTree(botFile, source) {
+    return botFile.includes("dependabot")
+        ? GO_ECOSYSTEM_PATTERN.test(source)
+        : RENOVATE_GO_PATTERN.test(source);
+}
+/**
+ * Extract a command-shaped line from CI/hook text.
+ * @param line - One source line
+ * @returns The executable command candidate, or null
+ */
+function executableCommandCandidate(line) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) {
+        return null;
+    }
+    const commandish = trimmed.startsWith("- ")
+        ? trimmed.slice(2).trimStart()
+        : trimmed;
+    if (commandish.toLowerCase().startsWith("run:")) {
+        const command = commandish.slice("run:".length).trim();
+        return command === "|" || command === ">" ? null : command;
+    }
+    return commandish;
+}
+/**
+ * Whether CI/hook text contains a real Go dependency audit command.
+ * @param source - File text
+ * @returns True when an executable command audits Go module dependencies
+ */
+function hasGoAuditCommand(source) {
+    return source.split(/\r?\n/u).some(line => {
+        const command = executableCommandCandidate(line);
+        return command !== null && GO_AUDIT_GATE_PATTERN.test(command);
+    });
+}
+/**
+ * Find where the repository audits its Go module dependency tree.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first Go audit gate found, or null
+ */
+export async function findGoAuditGate(root) {
+    for (const botFile of UPDATE_BOT_FILES) {
+        const source = await readFileOrNull(root, botFile);
+        if (source !== null && coversGoTree(botFile, source)) {
+            return botFile.split(path.sep).join("/");
+        }
+    }
+    const scanned = [
+        ...(await Promise.all(GATE_DIRECTORIES.map(dir => listDirectory(root, dir)))).flat(),
+        ...GATE_FILES,
+    ];
+    for (const file of scanned) {
+        const source = await readFileOrNull(root, file);
+        if (source !== null && hasGoAuditCommand(source)) {
+            return file.split(path.sep).join("/");
+        }
+    }
+    return null;
+}
+/**
+ * Check whether a Go module requirement spec floats.
+ * @param spec - Version/pseudo-version from go.mod
+ * @returns True when the spec is absent or branch-like rather than pinned
+ */
+export function isFloatingGoSpec(spec) {
+    return spec === null || FLOATING_SPECS.has(spec.trim());
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-go.js.map

package/dist/cli/doctor-readiness-supply-chain-go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-go.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAElE,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,iDAAiD,CAAC;AAEhF,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAE9D,0DAA0D;AAC1D,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;IACjC,QAAQ;CACT,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,GAAsB;IACpC,cAAc;IACd,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,sEAAsE;AACtE,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;IACrC,eAAe;IACf,aAAa;IACb,kBAAkB;CACnB,CAAC;AAEF,mEAAmE;AACnE,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,EAAE;IACF,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAkBH;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,YAAoB;IAEpB,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YAC1D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,OAAO;aACX,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC/B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,IAAI;QACJ,IAAI,EAAE,IAAI,IAAI,IAAI;KACnB,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,KAAkC,EAClC,IAAY;IAEZ,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,KAA0B,EAC1B,OAAe;IAEf,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,GAAG;YACjB,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC/C,CAAC,CAAC;gBACE,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;aAC5C,CAAC;IACR,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,cAAc,EAAE,KAAK;YACrB,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM;SACV,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CACL,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,EAC/C,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CACrC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,OAAO,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;QAC9B,CAAC,CAAC,OAAO,CAAC;IACZ,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,CACD,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CACzE,CAAC,IAAI,EAAE;QACR,GAAG,UAAU;KACd,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/cli/doctor-readiness-supply-chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAwJtG;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CAqEnC"}
+{"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AA2KtG;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CAiEnC"}

package/dist/cli/doctor-readiness-supply-chain.js

@@ -32,6 +32,7 @@ import { auditExceptionViolations } from "./doctor-readiness-audit-allowlist.js"
 import { collectSpecs, findAuditGate, findLockfile, findLockfileInstallGate, readManifest, } from "./doctor-readiness-supply-chain-scan.js";
 import { assessRubyDependenciesSupplyChainDimension } from "./doctor-readiness-supply-chain-ruby-assess.js";
 import { assessPythonDependenciesSupplyChainDimension } from "./doctor-readiness-supply-chain-python-assess.js";
+import { assessGoDependenciesSupplyChainDimension } from "./doctor-readiness-supply-chain-go-assess.js";
 import { DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID, MAX_EVIDENCE_LINES, SUPPLY_CHAIN_BLOCKER_ID, } from "./doctor-readiness-supply-chain-constants.js";
 import { dependencyConfidenceObservations, dependencyConfidenceViolations, installTimeExecutionViolations, } from "./doctor-readiness-supply-chain-evidence.js";
 import { resolveWorkspaceMembers, } from "./doctor-readiness-workspaces.js";
@@ -162,6 +163,22 @@ function skipRecord(reason) {
         findings: [{ reason, skip: true }],
     };
 }
+/**
+ * Try non-JavaScript dependency models after package.json is absent or unreadable.
+ * @param root - Project root to assess
+ * @returns A non-JS B5 record, or null when no supported manifest exists
+ */
+async function assessNonJavaScriptDependenciesSupplyChainDimension(root) {
+    const rubyRecord = await assessRubyDependenciesSupplyChainDimension(root);
+    if (rubyRecord !== null) {
+        return rubyRecord;
+    }
+    const pythonRecord = await assessPythonDependenciesSupplyChainDimension(root);
+    if (pythonRecord !== null) {
+        return pythonRecord;
+    }
+    return await assessGoDependenciesSupplyChainDimension(root);
+}
 /**
  * Assess the dependencies/supply-chain dimension: B5, "an owned compatibility or
  * security surface has no confidence model". Offline by construction — it reads
@@ -174,13 +191,9 @@ function skipRecord(reason) {
 export async function assessDependenciesSupplyChainDimension(root) {
     const outcome = await readManifest(root);
     if (outcome.kind === "unassessable") {
-        const rubyRecord = await assessRubyDependenciesSupplyChainDimension(root);
-        if (rubyRecord !== null) {
-            return rubyRecord;
-        }
-        const pythonRecord = await assessPythonDependenciesSupplyChainDimension(root);
-        if (pythonRecord !== null) {
-            return pythonRecord;
+        const nonJavaScriptRecord = await assessNonJavaScriptDependenciesSupplyChainDimension(root);
+        if (nonJavaScriptRecord !== null) {
+            return nonJavaScriptRecord;
         }
         return skipRecord(outcome.reason);
     }

package/dist/cli/doctor-readiness-supply-chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-supply-chain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,YAAY,EAEZ,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,YAAY,GACb,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0CAA0C,EAAE,MAAM,gDAAgD,CAAC;AAC5G,OAAO,EAAE,4CAA4C,EAAE,MAAM,kDAAkD,CAAC;AAChH,OAAO,EACL,sCAAsC,EACtC,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAE/B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAEtG;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAgC,EAChC,SAA6C,EAC7C,UAA4B;IAK5B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GACvB,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,SAAS;QACT,QAAQ;QACR,mBAAmB;QACnB,KAAK;QACL,UAAU;KACX,CAAC;IACF,OAAO;QACL,UAAU,EAAE;YACV,GAAG,8BAA8B,CAAC,MAAM,CAAC;YACzC,GAAG,8BAA8B,CAAC,SAAS,CAAC;YAC5C,GAAG,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC1C;QACD,YAAY,EAAE;YACZ,GAAG,gCAAgC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,UAA4B;IACxD,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAC9B,CAAC,CAAC,+BAA+B,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB;YACpE,6DAA6D;QACjE,CAAC,CAAC,uEAAuE;YACrE,gEAAgE;YAChE,yEAAyE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;QAChD,mBAAmB,EAAE;YACnB,0EAA0E;gBACxE,yCAAyC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,OAAO,IAAI,GAAG,CACZ,KAAK;SACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC9B,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,YAAY,KAAK,cAAc,CAAC,CAC3D,CAAC,IAAI,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,cAAc,KAAK,CAAC;QACzB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,iCAAiC,cAAc,mBAAmB;YAChE,aAAa,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,UAA4B;IAC3D,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACvD,CAAC,CAAC,oEAAoE;YAClE,kEAAkE;QACtE,CAAC,CAAC,uDAAuD,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,0CAA0C,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,YAAY,GAChB,MAAM,4CAA4C,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG;QAChB,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5D,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACrC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CACnD;KACF,CAAC;IACF,MAAM,qBAAqB,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,UAAU,CACf,yEAAyE;YACvE,8DAA8D;YAC9D,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CACxD,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,CACX,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,KAAK,CAAC,MAAM,yBAAyB;oBAClD,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI;oBACnC,GAAG,uBAAuB,CAAC,UAAU,CAAC,MAAM;oBAC5C,8DAA8D;oBAC9D,gEAAgE;oBAChE,6BAA6B;gBAC/B,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-readiness-supply-chain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,YAAY,EAEZ,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,YAAY,GACb,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,0CAA0C,EAAE,MAAM,gDAAgD,CAAC;AAC5G,OAAO,EAAE,4CAA4C,EAAE,MAAM,kDAAkD,CAAC;AAChH,OAAO,EAAE,wCAAwC,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,EACL,sCAAsC,EACtC,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAE/B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAEtG;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAgC,EAChC,SAA6C,EAC7C,UAA4B;IAK5B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GACvB,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,SAAS;QACT,QAAQ;QACR,mBAAmB;QACnB,KAAK;QACL,UAAU;KACX,CAAC;IACF,OAAO;QACL,UAAU,EAAE;YACV,GAAG,8BAA8B,CAAC,MAAM,CAAC;YACzC,GAAG,8BAA8B,CAAC,SAAS,CAAC;YAC5C,GAAG,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC1C;QACD,YAAY,EAAE;YACZ,GAAG,gCAAgC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,UAA4B;IACxD,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAC9B,CAAC,CAAC,+BAA+B,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB;YACpE,6DAA6D;QACjE,CAAC,CAAC,uEAAuE;YACrE,gEAAgE;YAChE,yEAAyE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;QAChD,mBAAmB,EAAE;YACnB,0EAA0E;gBACxE,yCAAyC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,OAAO,IAAI,GAAG,CACZ,KAAK;SACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC9B,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,YAAY,KAAK,cAAc,CAAC,CAC3D,CAAC,IAAI,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,cAAc,KAAK,CAAC;QACzB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,iCAAiC,cAAc,mBAAmB;YAChE,aAAa,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,UAA4B;IAC3D,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACvD,CAAC,CAAC,oEAAoE;YAClE,kEAAkE;QACtE,CAAC,CAAC,uDAAuD,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mDAAmD,CAChE,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,0CAA0C,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,4CAA4C,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,wCAAwC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,mBAAmB,GACvB,MAAM,mDAAmD,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG;QAChB,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5D,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACrC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CACnD;KACF,CAAC;IACF,MAAM,qBAAqB,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,UAAU,CACf,yEAAyE;YACvE,8DAA8D;YAC9D,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CACxD,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,CACX,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,KAAK,CAAC,MAAM,yBAAyB;oBAClD,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI;oBACnC,GAAG,uBAAuB,CAAC,UAAU,CAAC,MAAM;oBAC5C,8DAA8D;oBAC9D,gEAAgE;oBAChE,6BAA6B;gBAC/B,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkjEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAq3MjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkjEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAy3MjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -6402,6 +6402,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/doctor-readiness-shared.ts": true,
     "src/cli/doctor-readiness-supply-chain-constants.ts": true,
     "src/cli/doctor-readiness-supply-chain-evidence.ts": true,
+    "src/cli/doctor-readiness-supply-chain-go-assess.ts": true,
+    "src/cli/doctor-readiness-supply-chain-go.ts": true,
     "src/cli/doctor-readiness-supply-chain-python-assess.ts": true,
     "src/cli/doctor-readiness-supply-chain-python.ts": true,
     "src/cli/doctor-readiness-supply-chain-ruby-assess.ts": true,
@@ -6796,6 +6798,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/doctor-readiness-guardrails.test.ts": true,
     "tests/unit/cli/doctor-readiness-journey.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-exceptions.test.ts": true,
+    "tests/unit/cli/doctor-readiness-supply-chain-go.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-install-gate.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-install-scripts.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-precision.test.ts": true,
@@ -7233,6 +7236,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/utils/fibonacci.test.ts": true,
     "tests/unit/utils/file-operations.test.ts": true,
     "tests/unit/utils/ignore-patterns.test.ts": true,
+    "tests/unit/utils/json-merge.property.test.ts": true,
     "tests/unit/utils/json-utils.test.ts": true,
     "tests/unit/utils/linked-worktree.test.ts": true,
     "tests/unit/utils/postinstall-trampoline.test.ts": true,