@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/internal/binding-token-mint.js

@@ -0,0 +1,174 @@
+import * as os from "node:os";
+import * as crypto from "node:crypto";
+import * as child_process from "node:child_process";
+import { getSessionAccount, keychainClearSession, keychainRead, keychainStore, } from "@zivis/mcp/auth";
+import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
+import { DEFAULT_CONFIG, credentialStorageFromConfig } from "@zivis/mcp/types";
+import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+function getRepoFingerprint(cwd) {
+    try {
+        const remote = child_process
+            .execSync("git remote get-url origin 2>/dev/null", { cwd, encoding: "utf8" })
+            .trim();
+        if (remote) {
+            return crypto.createHash("sha256").update(remote).digest("hex").slice(0, 12);
+        }
+    }
+    catch {
+    }
+    return crypto.createHash("sha256").update(cwd).digest("hex").slice(0, 12);
+}
+export async function mintLocalProjectBindingToken(params) {
+    const { config, session, accessToken, cwd } = params;
+    const credentialStorage = credentialStorageFromConfig(config);
+    const repoFingerprint = getRepoFingerprint(cwd);
+    const hostname = os.hostname();
+    let bindResult;
+    try {
+        const response = await fetch(`${config.apiBaseUrl}/api/auth/bind`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "Content-Type": "application/json",
+                "User-Agent": "@zivis/cli",
+            },
+            body: JSON.stringify({ repoFingerprint, hostname }),
+        });
+        if (!response.ok) {
+            const body = (await response.json().catch(() => ({})));
+            return {
+                ok: false,
+                error: body.message ?? body.error ?? `HTTP ${response.status}`,
+            };
+        }
+        bindResult = (await response.json());
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    const apiKeyAccount = `apikey.${session}`;
+    try {
+        await keychainStore(apiKeyAccount, bindResult.key, credentialStorage);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? err.message : "Failed to store key in OS keychain",
+        };
+    }
+    return {
+        ok: true,
+        keyName: bindResult.keyName,
+        key: bindResult.key,
+        orgName: bindResult.orgName,
+        workosOrgId: bindResult.workosOrgId,
+    };
+}
+export async function tryAutoMintBindingTokenAfterLogin(opts) {
+    if (opts.skip) {
+        return { ran: false, ok: true };
+    }
+    const fullConfig = { ...DEFAULT_CONFIG, ...resolveConfigFromBinding(opts.cwd) };
+    const claims = decodeJwtPayload(opts.accessToken);
+    const jwtOrgId = claims?.org_id;
+    if (!jwtOrgId) {
+        return {
+            ran: false,
+            ok: true,
+            message: "JWT has no org_id — skipped MCP binding-key mint.",
+        };
+    }
+    const detected = detectProjectBinding(opts.cwd);
+    const bindingOrg = detected?.binding.workosOrgId;
+    const bindingSession = detected?.binding.session;
+    if (!bindingOrg || !bindingSession) {
+        return {
+            ran: false,
+            ok: true,
+            message: "No project binding with workosOrgId — skipped MCP binding-key mint.",
+        };
+    }
+    if (bindingOrg !== jwtOrgId) {
+        const msg = `JWT org does not match project binding — skipped MCP binding-key mint.`;
+        if (opts.warnOnFailure) {
+            console.log("");
+            console.log(`  WARNING: ${msg}`);
+        }
+        return { ran: false, ok: false, message: msg };
+    }
+    if (bindingSession !== opts.sessionName) {
+        const msg = `Session "${opts.sessionName}" does not match binding session "${bindingSession}" — skipped MCP binding-key mint.`;
+        if (opts.warnOnFailure) {
+            console.log("");
+            console.log(`  WARNING: ${msg}`);
+        }
+        return { ran: false, ok: false, message: msg };
+    }
+    const st = credentialStorageFromConfig(fullConfig);
+    const existing = await keychainRead(`apikey.${bindingSession}`, st).catch(() => null);
+    if (existing) {
+        console.log("");
+        console.log(`✓ MCP API key already present for session "${bindingSession}" — skipped mint.`);
+        return { ran: false, ok: true };
+    }
+    console.log("");
+    console.log("Minting Local Project Binding Token for MCP (one-time per machine/session)…");
+    const result = await mintLocalProjectBindingToken({
+        config: fullConfig,
+        session: bindingSession,
+        accessToken: opts.accessToken,
+        cwd: opts.cwd,
+    });
+    if (!result.ok) {
+        const msg = result.error;
+        if (opts.warnOnFailure) {
+            printMintFailureBanner(msg);
+        }
+        return { ran: true, ok: false, message: msg };
+    }
+    console.log(`✓ MCP API key stored (${result.keyName}; org: ${result.orgName})`);
+    return { ran: true, ok: true };
+}
+export async function discardOauthAfterLogin(params) {
+    const storage = credentialStorageFromConfig(params.config);
+    try {
+        await keychainClearSession(params.session, storage);
+    }
+    catch {
+    }
+    const leftover = await keychainRead(getSessionAccount(params.session), storage).catch(() => null);
+    if (leftover) {
+        const account = getSessionAccount(params.session);
+        const service = `${storage.keychainPrefix}.${account}`;
+        console.error("");
+        console.error(`  WARNING: OAuth tokens are still present in the keychain (${service}).`);
+        console.error("  Possible cause: keychain access was denied, or older builds left");
+        console.error("  duplicate entries that the OS doesn't surface in a single delete.");
+        console.error("  Force-clean with:");
+        console.error(`    while security delete-generic-password -a zivis-mcp -s '${service}' 2>/dev/null; do :; done`);
+        console.error("");
+    }
+}
+function printMintFailureBanner(message) {
+    const bar = "═".repeat(70);
+    console.error("");
+    console.error(bar);
+    console.error("  ACTION REQUIRED — MCP API KEY WAS NOT MINTED");
+    console.error(bar);
+    console.error("");
+    console.error(`  Reason: ${message}`);
+    console.error("");
+    console.error("  Why this matters:");
+    console.error("    The MCP server in your IDE authenticates with an org-scoped");
+    console.error("    API key. Without it, every zivis_* tool call will fail with");
+    console.error("    \"Not authenticated\" until you mint one.");
+    console.error("");
+    console.error("  To fix, run from this repo:");
+    console.error("    zivis auth bind");
+    console.error("");
+    console.error(bar);
+    console.error("");
+}

package/dist/internal/change-recommendation.d.ts

@@ -0,0 +1,6 @@
+import type { PackScopeEntry } from "./packs/types.js";
+export interface ChangeRecommendation {
+    scopeIds: string[];
+    testIds: string[];
+}
+export declare function buildChangeRecommendation(changedFiles: string[], resolvedScopes: Pick<PackScopeEntry, "id" | "label" | "tests">[]): ChangeRecommendation | null;

package/dist/internal/change-recommendation.js

@@ -0,0 +1,113 @@
+function globToRegex(glob) {
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    let pattern = escaped;
+    const leadingDoubleStarSlash = pattern.startsWith("**/");
+    if (leadingDoubleStarSlash)
+        pattern = pattern.slice(3);
+    const DOUBLE_STAR_TOKEN = "@@DOUBLESTAR@@";
+    pattern = pattern
+        .replace(/\*\*/g, DOUBLE_STAR_TOKEN)
+        .replace(/\*/g, "[^/]*")
+        .replace(new RegExp(DOUBLE_STAR_TOKEN, "g"), ".*");
+    if (leadingDoubleStarSlash)
+        pattern = `(?:.*/)?${pattern}`;
+    return new RegExp(`^${pattern}$`, "i");
+}
+const REGEX_CACHE = new Map();
+function compiledGlob(glob) {
+    let rx = REGEX_CACHE.get(glob);
+    if (!rx) {
+        rx = globToRegex(glob);
+        REGEX_CACHE.set(glob, rx);
+    }
+    return rx;
+}
+function matchesAnyGlob(filePath, globs) {
+    const normalized = filePath.replace(/\\/g, "/");
+    return globs.some((glob) => compiledGlob(glob).test(normalized));
+}
+const CHANGE_SCOPE_HEURISTICS = [
+    { scopeId: "auth", globs: ["**/*password*", "**/*passwd*", "**/*bcrypt*", "**/*argon2*", "**/*scrypt*", "**/*hash*"], testIds: ["AUTH-001"] },
+    { scopeId: "auth", globs: ["**/*login*", "**/*signin*", "**/*sign-in*", "**/*credential*"], testIds: ["AUTH-003"] },
+    { scopeId: "auth", globs: ["**/*mfa*", "**/*otp*", "**/*two-factor*", "**/*2fa*", "**/*step-up*"], testIds: ["AUTH-004"] },
+    { scopeId: "auth", globs: ["**/*reset-password*", "**/*forgot-password*", "**/*password-reset*", "**/*account-recovery*"], testIds: ["AUTH-005"] },
+    { scopeId: "auth", globs: ["**/*rate-limit*", "**/*throttle*", "**/*lockout*"], testIds: ["AUTH-006"] },
+    { scopeId: "auth", globs: ["**/auth/**", "**/authentication/**", "**/*oauth*", "**/*sso*", "**/*saml*"] },
+    { scopeId: "authorization", globs: ["**/*rbac*", "**/*permission*", "**/*acl*"], testIds: ["AUTHZ-001", "AUTHZ-002"] },
+    { scopeId: "authorization", globs: ["**/*tenant*", "**/*multi-tenant*", "**/*org-scope*"], testIds: ["AUTHZ-003"] },
+    { scopeId: "authorization", globs: ["**/authz/**", "**/authorization/**", "**/*entitlement*", "**/*role*"] },
+    { scopeId: "session", globs: ["**/*jwt*"], testIds: ["SESSION-006"] },
+    { scopeId: "session", globs: ["**/*csrf*"], testIds: ["SESSION-005"] },
+    { scopeId: "session", globs: ["**/*cookie*"], testIds: ["SESSION-004"] },
+    { scopeId: "session", globs: ["**/session/**", "**/*sessions*", "**/*token*"] },
+    { scopeId: "api", globs: ["**/routes/**", "**/route/**", "**/controllers/**", "**/api/**", "**/*.graphql", "**/openapi*.*", "**/swagger*.*"] },
+    { scopeId: "input", globs: ["**/*sql*", "**/*query-builder*", "**/*raw-query*"], testIds: ["INPUT-001"] },
+    { scopeId: "input", globs: ["**/*template*"], testIds: ["INPUT-003"] },
+    { scopeId: "input", globs: ["**/*path-traversal*", "**/*path-join*"], testIds: ["INPUT-004"] },
+    { scopeId: "input", globs: ["**/*deserializ*", "**/*unmarshal*", "**/*pickle*"], testIds: ["INPUT-005"] },
+    { scopeId: "input", globs: ["**/*sanitiz*", "**/*validat*", "**/*escape*"] },
+    { scopeId: "data", globs: ["**/*encrypt*", "**/*crypto*", "**/*cipher*"], testIds: ["DATA-003", "DATA-005"] },
+    { scopeId: "data", globs: ["**/models/**", "**/entities/**", "**/schema.prisma", "**/*.sql"] },
+    { scopeId: "secrets", globs: ["**/*.env*", "**/*secret*", "**/*credentials*"], testIds: ["SECRETS-001"] },
+    { scopeId: "secrets", globs: ["**/.github/workflows/**"], testIds: ["SECRETS-006"] },
+    {
+        scopeId: "dependencies",
+        globs: [
+            "**/package.json",
+            "**/package-lock.json",
+            "**/pnpm-lock.yaml",
+            "**/yarn.lock",
+            "**/go.mod",
+            "**/go.sum",
+            "**/requirements*.txt",
+            "**/Pipfile*",
+            "**/Gemfile*",
+            "**/*.csproj",
+        ],
+    },
+    { scopeId: "ssrf", globs: ["**/*webhook*"], testIds: ["SSRF-001"] },
+    { scopeId: "ssrf", globs: ["**/*fetch*", "**/*http-client*", "**/*outbound*", "**/*proxy*"] },
+    { scopeId: "uploads", globs: ["**/*content-type*", "**/*mime-type*", "**/*filetype*"], testIds: ["UPLOAD-001"] },
+    { scopeId: "uploads", globs: ["**/*blob-storage*", "**/*s3*", "**/*azurite*", "**/*storage-service*"], testIds: ["UPLOAD-002"] },
+    { scopeId: "uploads", globs: ["**/*filename*"], testIds: ["UPLOAD-003"] },
+    { scopeId: "uploads", globs: ["**/*svg*"], testIds: ["UPLOAD-006"] },
+    { scopeId: "uploads", globs: ["**/*upload*", "**/*multipart*", "**/*attachment*"] },
+    { scopeId: "frontend", globs: ["**/*.tsx", "**/*.jsx", "**/components/**", "**/*.vue", "**/*.svelte"] },
+    { scopeId: "infra", globs: ["**/*.tf", "**/Dockerfile*", "**/docker-compose*.yml", "**/docker-compose*.yaml", "**/k8s/**", "**/helm/**", "**/.github/workflows/**"] },
+    { scopeId: "ai", globs: ["**/*llm*", "**/*prompt*", "**/*agent*", "**/*anthropic*", "**/*openai*", "**/*rag*", "**/*embedding*"] },
+];
+export function buildChangeRecommendation(changedFiles, resolvedScopes) {
+    const scopesById = new Map(resolvedScopes.map((s) => [s.id, s]));
+    const matchedScopeIds = new Set();
+    const matchedTestIdsByScope = new Map();
+    for (const rule of CHANGE_SCOPE_HEURISTICS) {
+        if (!scopesById.has(rule.scopeId))
+            continue;
+        if (!changedFiles.some((file) => matchesAnyGlob(file, rule.globs)))
+            continue;
+        matchedScopeIds.add(rule.scopeId);
+        if (rule.testIds?.length) {
+            const set = matchedTestIdsByScope.get(rule.scopeId) ?? new Set();
+            for (const id of rule.testIds)
+                set.add(id);
+            matchedTestIdsByScope.set(rule.scopeId, set);
+        }
+    }
+    if (matchedScopeIds.size === 0)
+        return null;
+    const scopeIds = resolvedScopes.filter((s) => matchedScopeIds.has(s.id)).map((s) => s.id);
+    const testIds = [];
+    for (const scopeId of scopeIds) {
+        const candidateIds = matchedTestIdsByScope.get(scopeId);
+        if (!candidateIds)
+            continue;
+        const tests = scopesById.get(scopeId)?.tests ?? [];
+        for (const test of tests) {
+            if (test.deprecated)
+                continue;
+            if (candidateIds.has(test.id))
+                testIds.push(test.id);
+        }
+    }
+    return { scopeIds, testIds };
+}

package/dist/internal/cli-output.d.ts

@@ -0,0 +1,16 @@
+export declare const SCHEMA_VERSION = "1";
+export declare const EXIT: {
+    readonly OK: 0;
+    readonly POLICY_FAIL: 1;
+    readonly INVALID_OR_INDETERMINATE: 2;
+    readonly AUTH_FAILURE: 3;
+    readonly CLOUD_UNAVAILABLE: 4;
+};
+export declare function jsonEnvelope<T extends Record<string, unknown>>(command: string, data: T): {
+    schema_version: string;
+    command: string;
+} & T;
+export declare function printJson(value: unknown): void;
+export declare function exitCodeForError(err: unknown): number;
+export declare function errorMessage(err: unknown): string;
+export declare function failCommand(command: string, err: unknown, json: boolean): never;

package/dist/internal/cli-output.js

@@ -0,0 +1,39 @@
+import { ApiError } from "@zivis/mcp/api-client";
+export const SCHEMA_VERSION = "1";
+export const EXIT = {
+    OK: 0,
+    POLICY_FAIL: 1,
+    INVALID_OR_INDETERMINATE: 2,
+    AUTH_FAILURE: 3,
+    CLOUD_UNAVAILABLE: 4,
+};
+export function jsonEnvelope(command, data) {
+    return { schema_version: SCHEMA_VERSION, command, ...data };
+}
+export function printJson(value) {
+    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+export function exitCodeForError(err) {
+    if (err instanceof ApiError) {
+        if (err.code === "NETWORK_ERROR")
+            return EXIT.CLOUD_UNAVAILABLE;
+        if (err.code === "AUTH_REQUIRED" || err.status === 401 || err.status === 403)
+            return EXIT.AUTH_FAILURE;
+        return EXIT.INVALID_OR_INDETERMINATE;
+    }
+    return EXIT.INVALID_OR_INDETERMINATE;
+}
+export function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+export function failCommand(command, err, json) {
+    const code = exitCodeForError(err);
+    const message = errorMessage(err);
+    if (json) {
+        printJson(jsonEnvelope(command, { result: "error", error: message }));
+    }
+    else {
+        console.error(`zivis ${command}: ${message}`);
+    }
+    process.exit(code);
+}

package/dist/internal/devx-run.d.ts

@@ -0,0 +1,129 @@
+export declare const DEVX_RUN_CONTRACT_VERSION = "1";
+export interface DevXRunApi {
+    post<T>(path: string, body: unknown): Promise<T>;
+}
+export interface DevXRunPackProvenance {
+    packId: string;
+    packType: string;
+    version: string;
+}
+export interface StartDevXRunParams {
+    applicationId: string;
+    runType: string;
+    requestedIntent?: unknown;
+    pack?: DevXRunPackProvenance;
+    cwd?: string;
+}
+export interface StartedDevXRun {
+    runId: string;
+    contractVersion: string;
+    applicationId: string;
+    startedAt: string;
+}
+export declare function startDevXRun(client: DevXRunApi, params: StartDevXRunParams): Promise<StartedDevXRun>;
+export interface DevXRunWire {
+    id: string;
+    applicationId: string;
+    status: "pending" | "completed" | "cancelled";
+    contractVersion: string;
+    startedAt: string;
+    completedAt: string | null;
+    cancelledAt: string | null;
+    cancelReason: string | null;
+}
+export interface DevXRunReconciliationSummary {
+    findings: Array<{
+        id: string;
+        action: "created" | "updated" | "unchanged";
+        fingerprint: string;
+    }>;
+    retests: Array<{
+        findingId: string;
+        outcome: "resolved" | "still_present";
+        action: "disposition_updated" | "no_change";
+    }>;
+    evidence: Array<{
+        id: string;
+        action: "created" | "existing";
+    }>;
+    coverage: Array<{
+        scopeId: string;
+        applicability: string;
+    }>;
+}
+export type TrustRoomLinkSource = string;
+export interface DevXRunOutcome {
+    outcome: "completed" | "cancelled" | "idempotent-replay";
+    run: DevXRunWire;
+    reconciliation?: DevXRunReconciliationSummary;
+    trustRoomUrl?: string | null;
+    trustRoomSource?: TrustRoomLinkSource | null;
+}
+export declare function isRetryableDevXRunError(err: unknown): boolean;
+export declare function completeDevXRunRemote(client: DevXRunApi, params: {
+    runId: string;
+    contractVersion: string;
+    result: unknown;
+}): Promise<DevXRunOutcome>;
+export declare function cancelDevXRunRemote(client: DevXRunApi, params: {
+    runId: string;
+    reason?: string | null;
+}): Promise<DevXRunOutcome>;
+export interface DevXRunItemsPayload {
+    findings?: unknown[];
+    evidence?: unknown[];
+    observations?: unknown[];
+}
+export interface DevXRunItemFindingWire {
+    index: number;
+    action: "created" | "updated" | "matched_existing";
+    findingId: string;
+    match: {
+        basis: "fingerprint";
+        fingerprint: string;
+    };
+    retestRecommendation: {
+        recommended: true;
+        reason: string;
+        instruction: string;
+    } | null;
+    dispositionHistory: Array<Record<string, unknown>>;
+}
+export interface DevXRunItemEvidenceWire {
+    index: number;
+    action: "created" | "matched_existing";
+    evidenceId: string;
+    match: {
+        basis: "content_hash";
+        contentHash: string;
+    };
+}
+export interface DevXRunItemObservationWire {
+    testId: string;
+    action: "created" | "matched_existing";
+    observationId: string;
+    scopeId: string;
+    result: string;
+}
+export interface DevXRunItemsOutcome {
+    runId: string;
+    outcome: "applied";
+    items: {
+        findings: DevXRunItemFindingWire[];
+        evidence: DevXRunItemEvidenceWire[];
+        observations: DevXRunItemObservationWire[];
+    };
+    rejectedObservations?: Array<{
+        test_id: string;
+        reason: string;
+    }>;
+    runTotals: {
+        findings: number;
+        evidence: number;
+        observations: number;
+    };
+}
+export declare function reportDevXRunItems(client: DevXRunApi, params: {
+    runId: string;
+    items: DevXRunItemsPayload;
+}): Promise<DevXRunItemsOutcome>;

package/dist/internal/devx-run.js

@@ -0,0 +1,39 @@
+import { ApiError } from "@zivis/mcp/api-client";
+import { readGitMetadata } from "./git.js";
+export const DEVX_RUN_CONTRACT_VERSION = "1";
+export async function startDevXRun(client, params) {
+    const git = await readGitMetadata(params.cwd ?? process.cwd());
+    const response = await client.post(`/api/rt/applications/${params.applicationId}/runs`, {
+        runType: params.runType,
+        contractVersion: DEVX_RUN_CONTRACT_VERSION,
+        gitSha: git.commitSha ?? null,
+        gitDirty: git.dirty ?? null,
+        packId: params.pack?.packId ?? null,
+        packType: params.pack?.packType ?? null,
+        packVersion: params.pack?.version ?? null,
+        requestedIntent: params.requestedIntent,
+    });
+    return {
+        runId: response.id,
+        contractVersion: response.contractVersion,
+        applicationId: response.applicationId,
+        startedAt: response.startedAt,
+    };
+}
+export function isRetryableDevXRunError(err) {
+    return err instanceof ApiError && (err.code === "NETWORK_ERROR" || err.status >= 500);
+}
+export async function completeDevXRunRemote(client, params) {
+    return client.post(`/api/devx-runs/${params.runId}/complete`, {
+        contractVersion: params.contractVersion,
+        result: params.result,
+    });
+}
+export async function cancelDevXRunRemote(client, params) {
+    return client.post(`/api/devx-runs/${params.runId}/cancel`, {
+        reason: params.reason ?? null,
+    });
+}
+export async function reportDevXRunItems(client, params) {
+    return client.post(`/api/devx-runs/${params.runId}/items`, params.items);
+}

package/dist/internal/extractor/adapters/go/index.d.ts

@@ -1,7 +1,3 @@
-/**
- * Go language adapter. Same shape as the TypeScript adapter — manifest
- * pass + AST pass — different parser + framework table.
- */
 import type { LanguageAdapter } from "../../types.js";
 export declare const goAdapter: LanguageAdapter;
 export declare const _stdlibFrameworkSet: Set<string>;

package/dist/internal/extractor/adapters/go/index.js

@@ -1,7 +1,3 @@
-/**
- * Go language adapter. Same shape as the TypeScript adapter — manifest
- * pass + AST pass — different parser + framework table.
- */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, STDLIB_FRAMEWORKS, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -66,6 +62,4 @@ function frameworkFromOwningManifest(sourceFile, manifests) {
         .sort((a, b) => b.dir.length - a.dir.length);
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
-// Used by orchestrator-side typing to widen the language union if needed.
 export const _stdlibFrameworkSet = STDLIB_FRAMEWORKS;
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/go/manifest.d.ts

@@ -1,14 +1,5 @@
-/**
- * Go manifest analysis.
- *
- * Parses go.mod (line-based, no real grammar needed) to build the
- * dependency map. Doesn't read go.sum — that's a hash list, not version
- * authority. Direct vs indirect deps are both in the require block;
- * we keep the // indirect annotation as a hint but don't filter on it.
- */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export declare const WEB_FRAMEWORK_MODULES: Record<string, string>;
-/** stdlib router lives at "net/http"; not in go.mod, only detected via imports. */
 export declare const STDLIB_FRAMEWORKS: Set<string>;
 export declare const DATA_STORE_MODULES: Record<string, {
     kind: ExtractedDataStore["kind"];
@@ -19,17 +10,9 @@ export interface ParsedGoMod {
     filePath: string;
     module?: string;
     goVersion?: string;
-    /** module path → version. */
     deps: Record<string, string>;
 }
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedGoMod[]>;
-/**
- * Minimal go.mod parser. Supports the two block forms:
- *   require modulePath v1.2.3
- *   require ( modulePath v1.2.3 \n other v0.0.1 )
- * Strips trailing "// indirect" markers. Does NOT handle replace/exclude
- * directives (out of scope for inventory).
- */
 export declare function parseGoMod(filePath: string, rootDir: string, raw: string): ParsedGoMod;
 export declare function summarizeManifests(parsed: ParsedGoMod[]): ManifestSummary[];
 export declare function findExternalServices(parsed: ParsedGoMod[]): ExtractedExternalService[];

package/dist/internal/extractor/adapters/go/manifest.js

@@ -1,11 +1,3 @@
-/**
- * Go manifest analysis.
- *
- * Parses go.mod (line-based, no real grammar needed) to build the
- * dependency map. Doesn't read go.sum — that's a hash list, not version
- * authority. Direct vs indirect deps are both in the require block;
- * we keep the // indirect annotation as a hint but don't filter on it.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 export const WEB_FRAMEWORK_MODULES = {
@@ -18,14 +10,13 @@ export const WEB_FRAMEWORK_MODULES = {
     "github.com/gofiber/fiber/v2": "fiber",
     "github.com/gorilla/mux": "gorilla-mux",
 };
-/** stdlib router lives at "net/http"; not in go.mod, only detected via imports. */
 export const STDLIB_FRAMEWORKS = new Set(["net/http"]);
 export const DATA_STORE_MODULES = {
     "github.com/jackc/pgx": { kind: "postgres", client: "pgx" },
     "github.com/jackc/pgx/v5": { kind: "postgres", client: "pgx" },
     "github.com/jackc/pgx/v4": { kind: "postgres", client: "pgx" },
     "github.com/lib/pq": { kind: "postgres", client: "pq" },
-    "gorm.io/gorm": { kind: "postgres", client: "gorm" }, // dialect varies; gorm itself is most often pg
+    "gorm.io/gorm": { kind: "postgres", client: "gorm" },
     "go.mongodb.org/mongo-driver": { kind: "mongo", client: "mongo-driver" },
     "github.com/redis/go-redis": { kind: "redis", client: "go-redis" },
     "github.com/redis/go-redis/v9": { kind: "redis", client: "go-redis" },
@@ -48,18 +39,10 @@ export async function readManifests(rootDir, manifestFiles) {
             out.push(parseGoMod(file, rootDir, raw));
         }
         catch {
-            // skip unreadable
         }
     }
     return out;
 }
-/**
- * Minimal go.mod parser. Supports the two block forms:
- *   require modulePath v1.2.3
- *   require ( modulePath v1.2.3 \n other v0.0.1 )
- * Strips trailing "// indirect" markers. Does NOT handle replace/exclude
- * directives (out of scope for inventory).
- */
 export function parseGoMod(filePath, rootDir, raw) {
     const lines = raw.split("\n");
     const result = {
@@ -92,7 +75,6 @@ export function parseGoMod(filePath, rootDir, raw) {
             body = body.slice("require ".length).trim();
         else if (!inBlock)
             continue;
-        // Strip "// indirect" / other line comments
         const commentAt = body.indexOf("//");
         if (commentAt >= 0)
             body = body.slice(0, commentAt).trim();
@@ -132,6 +114,24 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
+        for (const [mod, vendor] of Object.entries(WEB_FRAMEWORK_MODULES)) {
+            const ver = matchModuleVersion(m.deps, mod);
+            if (!ver)
+                continue;
+            const key = `web_framework::${mod}`;
+            const existing = seen.get(key);
+            if (existing) {
+                existing.callSites.push({ file: m.filePath, line: 1 });
+                continue;
+            }
+            seen.set(key, {
+                name: vendor,
+                kind: "web_framework",
+                package: mod,
+                version: ver,
+                callSites: [{ file: m.filePath, line: 1 }],
+            });
+        }
     }
     return [...seen.values()];
 }
@@ -166,14 +166,9 @@ export function detectFrameworkFromManifest(m) {
     }
     return undefined;
 }
-/**
- * Match a module path including its versioned variants (mod, mod/v2, etc.).
- * Returns the version of the first match.
- */
 function matchModuleVersion(deps, modulePath) {
     if (deps[modulePath])
         return deps[modulePath];
-    // Try versioned variants
     for (const [k, v] of Object.entries(deps)) {
         if (k === modulePath)
             return v;
@@ -196,4 +191,3 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=manifest.js.map