@zivis/cli 0.1.0-alpha.1

package/dist/commands/tm/index.js

@@ -0,0 +1,266 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { ApiClient } from "@zivis-ai/mcp-security/api-client";
+import { DEFAULT_CONFIG } from "@zivis-ai/mcp-security/types";
+import { getEphemeralCreds } from "../../internal/target-auth/index.js";
+import { runExtractor } from "../../internal/extractor/index.js";
+function buildClient(opts) {
+    const config = opts.session
+        ? { ...DEFAULT_CONFIG, session: opts.session }
+        : DEFAULT_CONFIG;
+    return new ApiClient(config);
+}
+function collect(value, previous) {
+    return previous.concat([value]);
+}
+function defaultOutPath(extractedAt) {
+    // .zivis/extracted/<iso-no-colons>.json — matches the doc's example.
+    const ts = extractedAt.replace(/[:.]/g, "-");
+    return `.zivis/extracted/${ts}.json`;
+}
+export function registerTmCommands(program) {
+    const tm = program.command("tm").description("threat model operations");
+    tm.command("list")
+        .description("list threat models in the active org")
+        .option("-s, --session <name>", "named session")
+        .option("--app <applicationId>", "filter by application id")
+        .option("--json", "emit raw JSON")
+        .action(async (opts) => {
+        const client = buildClient(opts);
+        const query = opts.app ? `?applicationId=${encodeURIComponent(opts.app)}` : "";
+        const list = await client.request("GET", `/api/threat-models${query}`);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(list, null, 2) + "\n");
+            return;
+        }
+        if (list.length === 0) {
+            console.log("No threat models found.");
+            return;
+        }
+        for (const tm of list) {
+            const v = tm.latestVersion;
+            const stats = v
+                ? `v${v.versionNumber} ${v.analysisStatus} · ${v.totalThreats} threats (${v.criticalCount}C/${v.highCount}H)`
+                : "no analysis";
+            const app = tm.applicationName ? ` [${tm.applicationName}]` : "";
+            console.log(`${tm.id}  ${tm.name}${app}`);
+            console.log(`  ${tm.status} · ${stats}`);
+        }
+    });
+    tm.command("get <threatModelId>")
+        .description("dump a threat model as JSON")
+        .option("-s, --session <name>", "named session")
+        .action(async (id, opts) => {
+        const client = buildClient(opts);
+        const tm = await client.request("GET", `/api/threat-models/${encodeURIComponent(id)}`);
+        process.stdout.write(JSON.stringify(tm, null, 2) + "\n");
+    });
+    tm.command("pull <threatModelId>")
+        .description("write a threat model to a local JSON file (default: ./<id>.json)")
+        .option("-s, --session <name>", "named session")
+        .option("-o, --out <file>", "output file path")
+        .action(async (id, opts) => {
+        const client = buildClient(opts);
+        const tm = await client.request("GET", `/api/threat-models/${encodeURIComponent(id)}`);
+        const outPath = path.resolve(opts.out ?? `${id}.json`);
+        await fs.writeFile(outPath, JSON.stringify(tm, null, 2) + "\n", "utf8");
+        console.log(`✓ Wrote ${outPath}`);
+        if (tm.name)
+            console.log(`  ${tm.name}`);
+    });
+    tm.command("push <threatModelId>")
+        .description("update a threat model from a local JSON file (only name/description/status fields)")
+        .option("-s, --session <name>", "named session")
+        .option("-f, --file <file>", "JSON file to read (default: ./<id>.json)")
+        .option("--dry-run", "print the PATCH payload without sending")
+        .action(async (id, opts) => {
+        const inPath = path.resolve(opts.file ?? `${id}.json`);
+        const raw = await fs.readFile(inPath, "utf8").catch((err) => {
+            console.error(`Could not read ${inPath}: ${err.message}`);
+            process.exit(1);
+        });
+        const parsed = JSON.parse(raw);
+        // Only fields the PATCH endpoint accepts. tm pull dumps the full
+        // record; tm push only sends the editable subset, so a round-trip
+        // edit cycle Just Works.
+        const payload = {};
+        for (const k of ["name", "description", "status", "campaignId"]) {
+            if (parsed[k] !== undefined)
+                payload[k] = parsed[k];
+        }
+        if (Object.keys(payload).length === 0) {
+            console.error("No updatable fields found in file (name/description/status/campaignId).");
+            process.exit(1);
+        }
+        if (opts.dryRun) {
+            console.log("Would PATCH:");
+            console.log(JSON.stringify(payload, null, 2));
+            return;
+        }
+        const client = buildClient(opts);
+        const updated = await client.request("PATCH", `/api/threat-models/${encodeURIComponent(id)}`, payload);
+        console.log(`✓ Updated ${updated.id}`);
+        if (updated.name)
+            console.log(`  ${updated.name}`);
+    });
+    tm.command("extract")
+        .description("walk the local repo with tree-sitter and emit structural metadata as JSON (Phase J.2)")
+        .option("--root <dir>", "directory to scan (default: cwd)")
+        .option("--out <file>", "write JSON to a file (default: .zivis/extracted/<ts>.json; '-' for stdout)")
+        .option("--ignore <pattern>", "extra ignore pattern (repeatable)", collect, [])
+        .option("--privacy-audit", "print exactly what would be sent without sending — never makes network calls")
+        .option("--lang <list>", "comma-separated subset of adapters to run: typescript,go,python")
+        .action(async (opts) => {
+        const rootDir = path.resolve(opts.root ?? process.cwd());
+        const cliPkg = JSON.parse(await fs.readFile(path.join(path.dirname(new URL(import.meta.url).pathname), "../../../package.json"), "utf8"));
+        const langs = opts.lang
+            ? String(opts.lang).split(",").map((s) => s.trim()).filter(Boolean)
+            : undefined;
+        const result = await runExtractor({
+            rootDir,
+            languages: langs,
+            extraIgnores: opts.ignore,
+            extractorVersion: cliPkg.version,
+        });
+        if (opts.privacyAudit) {
+            // Prints the entire object that WOULD be sent to ZIVIS via --apply.
+            // Never makes a network call; the extractor itself is local-only.
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+            process.stderr.write(`\n[zivis] Privacy audit: ${result.scope.filesScanned} files scanned, ` +
+                `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
+                `${result.dataStores.length} data store(s), ${result.manifests.length} manifest(s).\n` +
+                `[zivis] Nothing was sent. Run without --privacy-audit + --apply <tm-id> to upload.\n`);
+            return;
+        }
+        const target = opts.out ?? defaultOutPath(result.extractedAt);
+        if (target === "-") {
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+            return;
+        }
+        const absOut = path.isAbsolute(target) ? target : path.join(rootDir, target);
+        await fs.mkdir(path.dirname(absOut), { recursive: true });
+        await fs.writeFile(absOut, JSON.stringify(result, null, 2) + "\n", "utf8");
+        console.log(`✓ Wrote ${absOut}`);
+        console.log(`  ${result.scope.filesScanned} files scanned in ${result.scope.durationMs}ms — ` +
+            `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
+            `${result.dataStores.length} data store(s).`);
+    });
+    tm.command("threats")
+        .description("show threats touching a file (Phase J.3 — IDE/CLI surface)")
+        .requiredOption("--tm <threatModelId>", "threat model to query")
+        .requiredOption("--file <path>", "file path (repo-relative, matches ThreatModelComponent.sourceFiles)")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit raw JSON")
+        .action(async (opts) => {
+        const client = buildClient(opts);
+        const path = `/api/threat-models/${encodeURIComponent(opts.tm)}/files/threats?path=${encodeURIComponent(opts.file)}`;
+        const result = await client.request("GET", path);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+            return;
+        }
+        if (result.components.length === 0) {
+            console.log(`No components reference ${result.path} in this threat model.`);
+            return;
+        }
+        console.log(`${result.path}`);
+        for (const c of result.components) {
+            const idLabel = c.displayId ? `[${c.displayId}]` : `[${c.id.slice(0, 8)}]`;
+            console.log(`  ${idLabel} ${c.name} (${c.componentType}) — ${c.threatCount} threat(s)`);
+            for (const t of c.threats) {
+                const sev = t.severity ? `[${t.severity}]` : "";
+                console.log(`    • ${sev} ${t.title ?? t.id}`);
+            }
+        }
+    });
+    const scenario = tm
+        .command("scenario")
+        .description("threat model scenario operations");
+    scenario
+        .command("list")
+        .description("list scenarios in a threat model")
+        .requiredOption("--tm <threatModelId>", "threat model id")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit raw JSON")
+        .action(async (opts) => {
+        const client = buildClient(opts);
+        const result = await client.request("GET", `/api/threat-models/${encodeURIComponent(opts.tm)}/scenarios`);
+        const scenarios = Array.isArray(result) ? result : result.data ?? [];
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(scenarios, null, 2) + "\n");
+            return;
+        }
+        if (scenarios.length === 0) {
+            console.log("No scenarios in this threat model.");
+            return;
+        }
+        for (const s of scenarios) {
+            const sev = s.severity ? ` [${s.severity}]` : "";
+            console.log(`${s.id}  ${s.status.padEnd(10)} ${s.title ?? "(untitled)"}${sev}`);
+        }
+    });
+    scenario
+        .command("show <scenarioId>")
+        .description("dump a scenario as JSON (uses /api/scenarios/:id, no --tm needed)")
+        .option("-s, --session <name>", "named session")
+        .action(async (scenarioId, opts) => {
+        const client = buildClient(opts);
+        const result = await client.request("GET", `/api/scenarios/${encodeURIComponent(scenarioId)}`);
+        process.stdout.write(JSON.stringify(result.data ?? result, null, 2) + "\n");
+    });
+    scenario
+        .command("run <scenarioId>")
+        .description("trigger a manual scenario run (scenario must be in 'testing' status)")
+        .option("-s, --session <name>", "named session")
+        .option("--app <applicationId>", "the customer-facing Application to test against (Phase J.4 — preferred over --target)")
+        .option("--target <targetId>", "[deprecated alias for --app] interpreted as applicationId; also used as keychain key for ephemeral creds")
+        .option("-p, --persona <name>", "target-system persona to use (default: default)", "default")
+        .option("--no-creds", "skip the ephemeral-creds path even if --app is set")
+        .option("--json", "emit raw JSON")
+        .action(async (scenarioId, opts) => {
+        const client = buildClient(opts);
+        const path = `/api/scenarios/${encodeURIComponent(scenarioId)}/run`;
+        const appId = opts.app ?? opts.target;
+        if (opts.target && !opts.app) {
+            console.warn("[zivis] --target is deprecated; use --app <applicationId>");
+        }
+        const body = {};
+        if (appId) {
+            body.applicationId = appId;
+            if (opts.creds !== false) {
+                const creds = await getEphemeralCreds(appId, opts.persona);
+                if (!creds) {
+                    console.error(`No valid token for application ${appId} (persona: ${opts.persona}).`);
+                    console.error(`Run: zivis app auth ${appId} -p ${opts.persona}`);
+                    process.exit(2);
+                }
+                body.targetCreds = creds;
+            }
+        }
+        try {
+            const result = await client.request("POST", path, Object.keys(body).length ? body : undefined);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+                return;
+            }
+            console.log(`✓ Triggered scenario run ${result.data.runId}`);
+            if (result.threatModelId) {
+                console.log(`  Threat model: ${result.threatModelId}`);
+            }
+            if (result.credsAccepted) {
+                console.log(`  Ephemeral creds accepted (persona: ${opts.persona}, ttl: ${result.credsTtlSec ?? "?"}s)`);
+            }
+            if (result.scanId) {
+                console.log(`  Dispatched RT scan: ${result.scanId}`);
+            }
+            else if (result.dispatchSkippedReason) {
+                console.log(`  Dispatch: ${result.dispatchSkippedReason}`);
+            }
+        }
+        catch (err) {
+            console.error("Run failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/tm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/tm/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAkBjE,SAAS,WAAW,CAAC,IAA0B;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO;QACzB,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;QAC9C,CAAC,CAAC,cAAc,CAAC;IACnB,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IAChD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB;IACzC,qEAAqE;IACrE,MAAM,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,oBAAoB,EAAE,OAAO,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAExE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAe,KAAK,EAAE,qBAAqB,KAAK,EAAE,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC;gBACb,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC,YAAY,aAAa,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,SAAS,IAAI;gBAC7G,CAAC,CAAC,aAAa,CAAC;YAClB,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,KAAK,EAAE,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;SAC/B,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAC7B,KAAK,EACL,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAC/C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;SAC/B,WAAW,CAAC,oFAAoF,CAAC;SACjG,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;SACvE,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1D,OAAO,CAAC,KAAK,CAAC,kBAAkB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,iEAAiE;QACjE,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YACzE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,OAAO,EACP,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAC9C,OAAO,CACR,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uFAAuF,CAAC;SACpG,MAAM,CAAC,cAAc,EAAE,kCAAkC,CAAC;SAC1D,MAAM,CAAC,cAAc,EAAE,4EAA4E,CAAC;SACpG,MAAM,CAAC,oBAAoB,EAAE,mCAAmC,EAAE,OAAO,EAAE,EAAE,CAAC;SAC9E,MAAM,CAAC,iBAAiB,EAAE,8EAA8E,CAAC;SACzG,MAAM,CAAC,eAAe,EAAE,iEAAiE,CAAC;SAC1F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,CACxF,CAAC;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI;YACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACnE,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,OAAO;YACP,SAAS,EAAE,KAA0D;YACrE,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,gBAAgB,EAAE,MAAM,CAAC,OAAO;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,oEAAoE;YACpE,kEAAkE;YAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,MAAM,CAAC,KAAK,CAAC,YAAY,kBAAkB;gBACrE,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,kBAAkB,MAAM,CAAC,gBAAgB,CAAC,MAAM,wBAAwB;gBACnG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,mBAAmB,MAAM,CAAC,SAAS,CAAC,MAAM,iBAAiB;gBACtF,sFAAsF,CACzF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,qBAAqB,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO;YAC/E,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,kBAAkB,MAAM,CAAC,gBAAgB,CAAC,MAAM,wBAAwB;YACnG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,iBAAiB,CAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,4DAA4D,CAAC;SACzE,cAAc,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;SAC/D,cAAc,CAAC,eAAe,EAAE,qEAAqE,CAAC;SACtG,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAYhC,KAAK,EAAE,IAAI,CAAC,CAAC;QAEhB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,CAAC,IAAI,wBAAwB,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,OAAO,CAAC,CAAC,WAAW,YAAY,CAAC,CAAC;YACxF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM,QAAQ,GAAG,EAAE;SAChB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAEnD,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,kCAAkC,CAAC;SAC/C,cAAc,CAAC,sBAAsB,EAAE,iBAAiB,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAGjC,KAAK,EACL,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAC9D,CAAC;QACF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CACjC,KAAK,EACL,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACnD,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,sEAAsE,CAAC;SACnF,MAAM,CAAC,sBAAsB,EAAE,eAAe,CAAC;SAC/C,MAAM,CACL,uBAAuB,EACvB,uFAAuF,CACxF;SACA,MAAM,CACL,qBAAqB,EACrB,0GAA0G,CAC3G;SACA,MAAM,CAAC,sBAAsB,EAAE,iDAAiD,EAAE,SAAS,CAAC;SAC5F,MAAM,CAAC,YAAY,EAAE,oDAAoD,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;SACjC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC;QAEpE,MAAM,KAAK,GAAI,IAAI,CAAC,GAA0B,IAAK,IAAI,CAAC,MAA6B,CAAC;QACtF,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAsD,EAAE,CAAC;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;YAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,cAAc,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;oBACrF,OAAO,CAAC,KAAK,CAAC,uBAAuB,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;oBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAOhC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAE9D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC7D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CACT,wCAAwC,IAAI,CAAC,OAAO,UAAU,MAAM,CAAC,WAAW,IAAI,GAAG,IAAI,CAC5F,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { registerAuthCommands } from "./commands/auth/index.js";
+import { registerAppCommands } from "./commands/app/index.js";
+import { registerTargetCommands } from "./commands/target/index.js";
+import { registerTmCommands } from "./commands/tm/index.js";
+import { registerScanCommands } from "./commands/scan/index.js";
+import { registerMcpCommands } from "./commands/mcp/index.js";
+import { registerCreditsCommands } from "./commands/credits/index.js";
+import { registerOpenCommands } from "./commands/open/index.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function getVersion() {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../package.json"), "utf-8"));
+        return pkg.version;
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const program = new Command();
+program
+    .name("zivis")
+    .description("ZIVIS CLI — threat modeling, scans, and MCP server")
+    .version(getVersion(), "-v, --version", "show version");
+registerAuthCommands(program);
+registerAppCommands(program);
+registerTargetCommands(program);
+registerTmCommands(program);
+registerScanCommands(program);
+registerMcpCommands(program);
+registerCreditsCommands(program);
+registerOpenCommands(program);
+program.parseAsync(process.argv).catch((err) => {
+    console.error(err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAClE,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,oDAAoD,CAAC;KACjE,OAAO,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;AAE1D,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/internal/extractor/adapters/go/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Go language adapter. Same shape as the TypeScript adapter — manifest
+ * pass + AST pass — different parser + framework table.
+ */
+import type { LanguageAdapter } from "../../types.js";
+export declare const goAdapter: LanguageAdapter;
+export declare const _stdlibFrameworkSet: Set<string>;

package/dist/internal/extractor/adapters/go/index.js

@@ -0,0 +1,71 @@
+/**
+ * Go language adapter. Same shape as the TypeScript adapter — manifest
+ * pass + AST pass — different parser + framework table.
+ */
+import * as path from "node:path";
+import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, STDLIB_FRAMEWORKS, } from "./manifest.js";
+import { scanFile, aggregate } from "./scanner.js";
+import { repoRelative } from "../../walker.js";
+export const goAdapter = {
+    language: "go",
+    extensions: [".go"],
+    manifests: ["go.mod"],
+    async extract(input) {
+        const { rootDir, sourceFiles, manifestFiles } = input;
+        const parsedManifests = await readManifests(rootDir, manifestFiles);
+        const manifestSummaries = summarizeManifests(parsedManifests);
+        const manifestExternalServices = findExternalServices(parsedManifests);
+        const manifestDataStores = findDataStores(parsedManifests);
+        const MAX_SOURCE_FILES = 5_000;
+        const filesToScan = sourceFiles.slice(0, MAX_SOURCE_FILES);
+        const scans = await Promise.all(filesToScan.map(async (abs) => {
+            try {
+                return await scanFile(abs, repoRelative(rootDir, abs));
+            }
+            catch {
+                return { file: repoRelative(rootDir, abs), imports: [], routes: [] };
+            }
+        }));
+        const agg = aggregate(scans);
+        const components = agg.components.map((c) => {
+            const framework = c.framework ?? frameworkFromOwningManifest(c.sourceFile, parsedManifests);
+            return {
+                name: c.name,
+                kind: "process",
+                language: "go",
+                framework,
+                sourceFiles: [c.sourceFile],
+                evidence: [...c.routes, ...c.imports],
+            };
+        });
+        for (const svc of manifestExternalServices) {
+            const sites = agg.aiSdkCallSites.get(svc.package);
+            if (sites)
+                svc.callSites.push(...sites);
+        }
+        for (const store of manifestDataStores) {
+            if (!store.client)
+                continue;
+            const ev = agg.dataStoreEvidence.get(store.client);
+            if (ev)
+                store.evidence.push(...ev);
+        }
+        return {
+            components,
+            externalServices: manifestExternalServices,
+            dataStores: manifestDataStores,
+            manifests: manifestSummaries,
+        };
+    },
+};
+function frameworkFromOwningManifest(sourceFile, manifests) {
+    const sourceDir = path.posix.dirname(sourceFile);
+    const candidates = manifests
+        .map((m) => ({ m, dir: path.posix.dirname(m.filePath) }))
+        .filter(({ dir }) => sourceDir === dir || sourceDir.startsWith(dir + "/"))
+        .sort((a, b) => b.dir.length - a.dir.length);
+    return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
+}
+// Used by orchestrator-side typing to widen the language union if needed.
+export const _stdlibFrameworkSet = STDLIB_FRAMEWORKS;
+//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/go/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/go/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQ/C,MAAM,CAAC,MAAM,SAAS,GAAoB;IACxC,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,CAAC,KAAK,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAEtD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;QAE3D,MAAM,gBAAgB,GAAG,KAAK,CAAC;QAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAE7B,MAAM,UAAU,GAAyB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChE,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAC5F,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,IAAI;gBACd,SAAS;gBACT,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC3B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;aACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,KAAK;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,EAAE;gBAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO;YACL,UAAU;YACV,gBAAgB,EAAE,wBAAwB;YAC1C,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,2BAA2B,CAClC,UAAkB,EAClB,SAAoD;IAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,SAAS;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;SACzE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC"}

package/dist/internal/extractor/adapters/go/manifest.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Go manifest analysis.
+ *
+ * Parses go.mod (line-based, no real grammar needed) to build the
+ * dependency map. Doesn't read go.sum — that's a hash list, not version
+ * authority. Direct vs indirect deps are both in the require block;
+ * we keep the // indirect annotation as a hint but don't filter on it.
+ */
+import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
+export declare const WEB_FRAMEWORK_MODULES: Record<string, string>;
+/** stdlib router lives at "net/http"; not in go.mod, only detected via imports. */
+export declare const STDLIB_FRAMEWORKS: Set<string>;
+export declare const DATA_STORE_MODULES: Record<string, {
+    kind: ExtractedDataStore["kind"];
+    client: string;
+}>;
+export declare const AI_SDK_MODULES: Record<string, string>;
+export interface ParsedGoMod {
+    filePath: string;
+    module?: string;
+    goVersion?: string;
+    /** module path → version. */
+    deps: Record<string, string>;
+}
+export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedGoMod[]>;
+/**
+ * Minimal go.mod parser. Supports the two block forms:
+ *   require modulePath v1.2.3
+ *   require ( modulePath v1.2.3 \n other v0.0.1 )
+ * Strips trailing "// indirect" markers. Does NOT handle replace/exclude
+ * directives (out of scope for inventory).
+ */
+export declare function parseGoMod(filePath: string, rootDir: string, raw: string): ParsedGoMod;
+export declare function summarizeManifests(parsed: ParsedGoMod[]): ManifestSummary[];
+export declare function findExternalServices(parsed: ParsedGoMod[]): ExtractedExternalService[];
+export declare function findDataStores(parsed: ParsedGoMod[]): ExtractedDataStore[];
+export declare function detectFrameworkFromManifest(m: ParsedGoMod): string | undefined;