kirograph 0.17.0 → 0.19.0

package/dist/security/manifest/plugins/composer.js

@@ -0,0 +1,152 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var composer_exports = {};
+__export(composer_exports, {
+  parseComposerManifest: () => parseComposerManifest
+});
+module.exports = __toCommonJS(composer_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseComposerManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:composer] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(content);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:composer] Failed to parse JSON in ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractComposerLicense(manifest);
+  const dependencies = [];
+  const sections = [
+    { key: "require", scope: "production" },
+    { key: "require-dev", scope: "development" }
+  ];
+  for (const { key, scope } of sections) {
+    const section = manifest[key];
+    if (!section || typeof section !== "object" || Array.isArray(section)) continue;
+    for (const [pkgName, versionConstraint] of Object.entries(section)) {
+      if (shouldSkipEntry(pkgName)) continue;
+      if (typeof versionConstraint !== "string") {
+        (0, import_errors.logWarn)(`[sec:composer] Non-string version for "${pkgName}" in ${relativeManifest} \u2014 skipping`);
+        continue;
+      }
+      if (!isValidPackageName(pkgName)) {
+        (0, import_errors.logWarn)(`[sec:composer] Invalid package name "${pkgName}" in ${relativeManifest} \u2014 skipping`);
+        continue;
+      }
+      const resolvedVersion = resolvedVersions.get(pkgName.toLowerCase());
+      dependencies.push({
+        name: pkgName,
+        declaredConstraint: versionConstraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "composer",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function shouldSkipEntry(name) {
+  if (name === "php") return true;
+  if (name.startsWith("ext-")) return true;
+  if (name === "platform") return true;
+  return false;
+}
+function isValidPackageName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 255) return false;
+  return /^[a-z0-9]([a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*)$/.test(name);
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "composer.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromComposerLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:composer] Failed to parse composer.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromComposerLock(content, map) {
+  let lockData;
+  try {
+    lockData = JSON.parse(content);
+  } catch {
+    (0, import_errors.logWarn)("[sec:composer] composer.lock is not valid JSON \u2014 resolved versions unavailable");
+    return;
+  }
+  const arrays = [lockData["packages"], lockData["packages-dev"]];
+  for (const arr of arrays) {
+    if (!Array.isArray(arr)) continue;
+    for (const entry of arr) {
+      if (!entry || typeof entry !== "object") continue;
+      const pkg = entry;
+      const name = typeof pkg["name"] === "string" ? pkg["name"].toLowerCase() : null;
+      const version = typeof pkg["version"] === "string" ? pkg["version"] : null;
+      if (name && version) {
+        const normalised = version.startsWith("v") ? version.slice(1) : version;
+        if (!map.has(name)) {
+          map.set(name, normalised);
+        }
+      }
+    }
+  }
+}
+function extractComposerLicense(manifest) {
+  const raw = manifest["license"];
+  if (typeof raw === "string" && raw.trim() !== "") {
+    return raw.trim();
+  }
+  if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === "string") {
+    return raw.join(" OR ");
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseComposerManifest
+});
+//# sourceMappingURL=composer.js.map

package/dist/security/manifest/plugins/composer.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/composer.ts"],
+  "sourcesContent": ["/**\n * Composer Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses composer.json manifests to extract PHP package declarations with\n * version constraints, scopes, and resolved versions from composer.lock.\n *\n * Handles:\n * - `require` section \u2192 'production' scope\n * - `require-dev` section \u2192 'development' scope\n * - Skips `php`, `ext-*`, and `platform` entries (not installable packages)\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from composer.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a composer.json manifest and extract package declarations with\n * version constraints, scopes, and resolved versions from composer.lock.\n *\n * @param manifestPath - Absolute path to the composer.json file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseComposerManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the composer.json content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:composer] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Parse JSON\n  let manifest: Record<string, unknown>;\n  try {\n    manifest = JSON.parse(content) as Record<string, unknown>;\n  } catch (err) {\n    logWarn(`[sec:composer] Failed to parse JSON in ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from composer.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the project-level license\n  const license = extractComposerLicense(manifest);\n\n  const dependencies: ParsedDependency[] = [];\n\n  // Process `require` (production) and `require-dev` (development) sections\n  const sections: Array<{ key: string; scope: ParsedDependency['scope'] }> = [\n    { key: 'require', scope: 'production' },\n    { key: 'require-dev', scope: 'development' },\n  ];\n\n  for (const { key, scope } of sections) {\n    const section = manifest[key];\n    if (!section || typeof section !== 'object' || Array.isArray(section)) continue;\n\n    for (const [pkgName, versionConstraint] of Object.entries(section as Record<string, unknown>)) {\n      // Skip PHP runtime and extensions\n      if (shouldSkipEntry(pkgName)) continue;\n\n      if (typeof versionConstraint !== 'string') {\n        logWarn(`[sec:composer] Non-string version for \"${pkgName}\" in ${relativeManifest} \u2014 skipping`);\n        continue;\n      }\n\n      if (!isValidPackageName(pkgName)) {\n        logWarn(`[sec:composer] Invalid package name \"${pkgName}\" in ${relativeManifest} \u2014 skipping`);\n        continue;\n      }\n\n      const resolvedVersion = resolvedVersions.get(pkgName.toLowerCase());\n      dependencies.push({\n        name: pkgName,\n        declaredConstraint: versionConstraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'composer',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * Determine whether a composer.json key should be skipped.\n * Skips `php`, `ext-*`, and `platform` entries.\n */\nfunction shouldSkipEntry(name: string): boolean {\n  if (name === 'php') return true;\n  if (name.startsWith('ext-')) return true;\n  if (name === 'platform') return true;\n  return false;\n}\n\n/**\n * Validate that a Composer package name follows the `vendor/package` convention.\n * Also accepts bare names for legacy packages, but rejects obviously invalid entries.\n */\nfunction isValidPackageName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 255) return false;\n  // Composer names must be vendor/package (lowercase, hyphens, digits allowed)\n  return /^[a-z0-9]([a-z0-9_.-]*\\/[a-z0-9][a-z0-9_.-]*)$/.test(name);\n}\n\n/**\n * Attempt to load resolved versions from composer.lock in the given directory.\n * Returns an empty map if composer.lock is not available.\n *\n * composer.lock format (JSON):\n * ```json\n * {\n *   \"packages\": [{ \"name\": \"vendor/package\", \"version\": \"1.2.3\" }],\n *   \"packages-dev\": [{ \"name\": \"vendor/dev-package\", \"version\": \"v2.0.0\" }]\n * }\n * ```\n * Version strings may be prefixed with `v` \u2014 these are stripped.\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'composer.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromComposerLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:composer] Failed to parse composer.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from composer.lock content.\n *\n * Reads both `packages` (production) and `packages-dev` arrays.\n * Normalises version strings by stripping a leading `v`.\n */\nfunction extractFromComposerLock(content: string, map: ResolvedVersionMap): void {\n  let lockData: Record<string, unknown>;\n  try {\n    lockData = JSON.parse(content) as Record<string, unknown>;\n  } catch {\n    logWarn('[sec:composer] composer.lock is not valid JSON \u2014 resolved versions unavailable');\n    return;\n  }\n\n  const arrays = [lockData['packages'], lockData['packages-dev']];\n  for (const arr of arrays) {\n    if (!Array.isArray(arr)) continue;\n    for (const entry of arr) {\n      if (!entry || typeof entry !== 'object') continue;\n      const pkg = entry as Record<string, unknown>;\n      const name = typeof pkg['name'] === 'string' ? pkg['name'].toLowerCase() : null;\n      const version = typeof pkg['version'] === 'string' ? pkg['version'] : null;\n      if (name && version) {\n        // Strip leading `v` from version strings (e.g. \"v1.2.3\" \u2192 \"1.2.3\")\n        const normalised = version.startsWith('v') ? version.slice(1) : version;\n        if (!map.has(name)) {\n          map.set(name, normalised);\n        }\n      }\n    }\n  }\n}\n\n/**\n * Extract the license field from a parsed composer.json manifest.\n * The \"license\" field can be a string or an array of strings (SPDX).\n */\nfunction extractComposerLicense(manifest: Record<string, unknown>): string | undefined {\n  const raw = manifest['license'];\n  if (typeof raw === 'string' && raw.trim() !== '') {\n    return raw.trim();\n  }\n  if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') {\n    return (raw as string[]).join(' OR ');\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAgBxB,eAAsB,sBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,iCAAiC,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAChH,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,OAAO;AAAA,EAC/B,SAAS,KAAK;AACZ,+BAAQ,0CAA0C,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACzH,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,uBAAuB,QAAQ;AAE/C,QAAM,eAAmC,CAAC;AAG1C,QAAM,WAAqE;AAAA,IACzE,EAAE,KAAK,WAAW,OAAO,aAAa;AAAA,IACtC,EAAE,KAAK,eAAe,OAAO,cAAc;AAAA,EAC7C;AAEA,aAAW,EAAE,KAAK,MAAM,KAAK,UAAU;AACrC,UAAM,UAAU,SAAS,GAAG;AAC5B,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG;AAEvE,eAAW,CAAC,SAAS,iBAAiB,KAAK,OAAO,QAAQ,OAAkC,GAAG;AAE7F,UAAI,gBAAgB,OAAO,EAAG;AAE9B,UAAI,OAAO,sBAAsB,UAAU;AACzC,mCAAQ,0CAA0C,OAAO,QAAQ,gBAAgB,kBAAa;AAC9F;AAAA,MACF;AAEA,UAAI,CAAC,mBAAmB,OAAO,GAAG;AAChC,mCAAQ,wCAAwC,OAAO,QAAQ,gBAAgB,kBAAa;AAC5F;AAAA,MACF;AAEA,YAAM,kBAAkB,iBAAiB,IAAI,QAAQ,YAAY,CAAC;AAClE,mBAAa,KAAK;AAAA,QAChB,MAAM;AAAA,QACN,oBAAoB;AAAA,QACpB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,gBAAgB,MAAuB;AAC9C,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,WAAW,MAAM,EAAG,QAAO;AACpC,MAAI,SAAS,WAAY,QAAO;AAChC,SAAO;AACT;AAMA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,IAAK,QAAO;AAE9B,SAAO,iDAAiD,KAAK,IAAI;AACnE;AAeA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,eAAe;AACvD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,4BAAwB,aAAa,GAAG;AAAA,EAC1C,SAAS,KAAK;AACZ,+BAAQ,iDAAiD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC7G;AAEA,SAAO;AACT;AAQA,SAAS,wBAAwB,SAAiB,KAA+B;AAC/E,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,OAAO;AAAA,EAC/B,QAAQ;AACN,+BAAQ,qFAAgF;AACxF;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,SAAS,UAAU,GAAG,SAAS,cAAc,CAAC;AAC9D,aAAW,OAAO,QAAQ;AACxB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,eAAW,SAAS,KAAK;AACvB,UAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,YAAM,MAAM;AACZ,YAAM,OAAO,OAAO,IAAI,MAAM,MAAM,WAAW,IAAI,MAAM,EAAE,YAAY,IAAI;AAC3E,YAAM,UAAU,OAAO,IAAI,SAAS,MAAM,WAAW,IAAI,SAAS,IAAI;AACtE,UAAI,QAAQ,SAAS;AAEnB,cAAM,aAAa,QAAQ,WAAW,GAAG,IAAI,QAAQ,MAAM,CAAC,IAAI;AAChE,YAAI,CAAC,IAAI,IAAI,IAAI,GAAG;AAClB,cAAI,IAAI,MAAM,UAAU;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,uBAAuB,UAAuD;AACrF,QAAM,MAAM,SAAS,SAAS;AAC9B,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,WAAO,IAAI,KAAK;AAAA,EAClB;AACA,MAAI,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,MAAM,UAAU;AACtE,WAAQ,IAAiB,KAAK,MAAM;AAAA,EACtC;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/go.js

@@ -0,0 +1,146 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var go_exports = {};
+__export(go_exports, {
+  parseGoManifest: () => parseGoManifest
+});
+module.exports = __toCommonJS(go_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseGoManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:go] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const goSumHashes = loadGoSumHashes(manifestDir);
+  const dependencies = [];
+  const requireBlockRegex = /require\s*\(([^)]*)\)/gs;
+  let blockMatch;
+  while ((blockMatch = requireBlockRegex.exec(content)) !== null) {
+    const blockContent = blockMatch[1];
+    parseRequireLines(blockContent, relativeManifest, goSumHashes, dependencies);
+  }
+  const lines = content.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const singleRequireMatch = trimmed.match(/^require\s+(\S+)\s+(\S+)/);
+    if (singleRequireMatch) {
+      const modulePath = singleRequireMatch[1];
+      const version = singleRequireMatch[2];
+      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);
+    }
+  }
+  return dependencies;
+}
+function parseRequireLines(blockContent, relativeManifest, goSumHashes, dependencies) {
+  const lines = blockContent.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const match = trimmed.match(/^(\S+)\s+(\S+)/);
+    if (match) {
+      const modulePath = match[1];
+      const version = match[2];
+      if (modulePath.startsWith("//")) continue;
+      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);
+    }
+  }
+}
+function addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies) {
+  if (!isValidGoModulePath(modulePath)) {
+    (0, import_errors.logWarn)(`[sec:go] Invalid module path "${modulePath}" in ${relativeManifest} \u2014 skipping`);
+    return;
+  }
+  if (!isValidGoVersion(version)) {
+    (0, import_errors.logWarn)(`[sec:go] Invalid version "${version}" for module "${modulePath}" in ${relativeManifest} \u2014 skipping`);
+    return;
+  }
+  const hasIntegrity = goSumHashes.has(`${modulePath}@${version}`);
+  dependencies.push({
+    name: modulePath,
+    declaredConstraint: version,
+    resolvedVersion: version,
+    scope: "production",
+    // Go doesn't have dev dependencies in go.mod
+    ecosystem: "go",
+    sourceManifest: relativeManifest
+  });
+}
+function loadGoSumHashes(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const goSumPath = path.join(manifestDir, "go.sum");
+  if (!fs.existsSync(goSumPath)) {
+    return map;
+  }
+  try {
+    const content = fs.readFileSync(goSumPath, "utf8");
+    const lines = content.split("\n");
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const parts = trimmed.split(/\s+/);
+      if (parts.length >= 3) {
+        const modulePath = parts[0];
+        let version = parts[1];
+        version = version.replace(/\/go\.mod$/, "");
+        map.set(`${modulePath}@${version}`, true);
+      }
+    }
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:go] Failed to read go.sum: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function isValidGoModulePath(modulePath) {
+  if (!modulePath || typeof modulePath !== "string") return false;
+  if (modulePath.includes(" ") || modulePath.includes("	")) return false;
+  const firstSlash = modulePath.indexOf("/");
+  const firstElement = firstSlash === -1 ? modulePath : modulePath.slice(0, firstSlash);
+  if (!firstElement.includes(".")) return false;
+  return true;
+}
+function isValidGoVersion(version) {
+  if (!version || typeof version !== "string") return false;
+  if (!version.startsWith("v")) return false;
+  const versionBody = version.slice(1);
+  if (!versionBody) return false;
+  const semverPattern = /^\d+\.\d+\.\d+/;
+  return semverPattern.test(versionBody);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseGoManifest
+});
+//# sourceMappingURL=go.js.map

package/dist/security/manifest/plugins/go.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/go.ts"],
+  "sourcesContent": ["/**\n * Go Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture go parser to extract version constraints\n * and resolved versions from go.mod and go.sum for security analysis.\n *\n * Reuses `goParser` from `src/architecture/manifest/go.ts` for discovery and\n * basic parsing, then layers on version extraction.\n *\n * In Go modules, the version in go.mod IS the resolved version (go.mod is\n * effectively a lock file). go.sum provides integrity hashes but the version\n * source of truth is go.mod itself. All Go dependencies are scope \"production\"\n * since Go doesn't have dev dependencies in go.mod.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Parse a go.mod manifest and extract dependency declarations with version\n * information. In Go modules, the version declared in go.mod is the resolved\n * version (pinned), so declaredConstraint and resolvedVersion are the same.\n *\n * @param manifestPath - Absolute path to the go.mod file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version information\n */\nexport async function parseGoManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read go.mod content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:go] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Load go.sum for integrity verification (optional)\n  const goSumHashes = loadGoSumHashes(manifestDir);\n\n  // Extract dependencies from require directives\n  const dependencies: ParsedDependency[] = [];\n\n  // Parse require block: require ( ... )\n  const requireBlockRegex = /require\\s*\\(([^)]*)\\)/gs;\n  let blockMatch: RegExpExecArray | null;\n  while ((blockMatch = requireBlockRegex.exec(content)) !== null) {\n    const blockContent = blockMatch[1];\n    parseRequireLines(blockContent, relativeManifest, goSumHashes, dependencies);\n  }\n\n  // Parse single-line require directives: require module/path v1.2.3\n  const lines = content.split('\\n');\n  for (const line of lines) {\n    const trimmed = line.trim();\n    // Skip lines inside require blocks (already handled above)\n    // Match: require <module> <version>\n    const singleRequireMatch = trimmed.match(/^require\\s+(\\S+)\\s+(\\S+)/);\n    if (singleRequireMatch) {\n      const modulePath = singleRequireMatch[1];\n      const version = singleRequireMatch[2];\n      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * Parse lines within a require block and extract module paths and versions.\n */\nfunction parseRequireLines(\n  blockContent: string,\n  relativeManifest: string,\n  goSumHashes: GoSumMap,\n  dependencies: ParsedDependency[],\n): void {\n  const lines = blockContent.split('\\n');\n  for (const line of lines) {\n    const trimmed = line.trim();\n\n    // Skip empty lines and comments\n    if (!trimmed || trimmed.startsWith('//')) continue;\n\n    // Match: module/path v1.2.3 [// indirect]\n    const match = trimmed.match(/^(\\S+)\\s+(\\S+)/);\n    if (match) {\n      const modulePath = match[1];\n      const version = match[2];\n\n      // Skip if the \"module path\" is actually a comment\n      if (modulePath.startsWith('//')) continue;\n\n      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);\n    }\n  }\n}\n\n/**\n * Add a single dependency entry after validation.\n */\nfunction addDependency(\n  modulePath: string,\n  version: string,\n  relativeManifest: string,\n  goSumHashes: GoSumMap,\n  dependencies: ParsedDependency[],\n): void {\n  // Validate module path\n  if (!isValidGoModulePath(modulePath)) {\n    logWarn(`[sec:go] Invalid module path \"${modulePath}\" in ${relativeManifest} \u2014 skipping`);\n    return;\n  }\n\n  // Validate version format (should start with 'v' for Go modules)\n  if (!isValidGoVersion(version)) {\n    logWarn(`[sec:go] Invalid version \"${version}\" for module \"${modulePath}\" in ${relativeManifest} \u2014 skipping`);\n    return;\n  }\n\n  // Check if this module+version has integrity info in go.sum\n  const hasIntegrity = goSumHashes.has(`${modulePath}@${version}`);\n\n  // In Go, the version in go.mod is the resolved version\n  // declaredConstraint and resolvedVersion are the same\n  dependencies.push({\n    name: modulePath,\n    declaredConstraint: version,\n    resolvedVersion: version,\n    scope: 'production', // Go doesn't have dev dependencies in go.mod\n    ecosystem: 'go',\n    sourceManifest: relativeManifest,\n  });\n}\n\n/**\n * Map of module@version \u2192 true, indicating presence in go.sum.\n * Used for integrity verification awareness.\n */\ntype GoSumMap = Map<string, boolean>;\n\n/**\n * Load go.sum hashes from the same directory as go.mod.\n * go.sum contains lines like:\n *   module/path v1.2.3 h1:hash...\n *   module/path v1.2.3/go.mod h1:hash...\n */\nfunction loadGoSumHashes(manifestDir: string): GoSumMap {\n  const map: GoSumMap = new Map();\n  const goSumPath = path.join(manifestDir, 'go.sum');\n\n  if (!fs.existsSync(goSumPath)) {\n    return map;\n  }\n\n  try {\n    const content = fs.readFileSync(goSumPath, 'utf8');\n    const lines = content.split('\\n');\n\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (!trimmed) continue;\n\n      // Format: module/path version hash\n      // e.g.: github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqFPSKw=\n      const parts = trimmed.split(/\\s+/);\n      if (parts.length >= 3) {\n        const modulePath = parts[0];\n        let version = parts[1];\n        // Strip /go.mod suffix from version if present\n        version = version.replace(/\\/go\\.mod$/, '');\n        map.set(`${modulePath}@${version}`, true);\n      }\n    }\n  } catch (err) {\n    logWarn(`[sec:go] Failed to read go.sum: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Validate a Go module path.\n * A valid module path must contain at least one dot in the first path element\n * (domain requirement) and consist of valid characters.\n */\nfunction isValidGoModulePath(modulePath: string): boolean {\n  if (!modulePath || typeof modulePath !== 'string') return false;\n\n  // Must not be empty or contain spaces\n  if (modulePath.includes(' ') || modulePath.includes('\\t')) return false;\n\n  // First path element must contain a dot (domain name requirement)\n  const firstSlash = modulePath.indexOf('/');\n  const firstElement = firstSlash === -1 ? modulePath : modulePath.slice(0, firstSlash);\n  if (!firstElement.includes('.')) return false;\n\n  return true;\n}\n\n/**\n * Validate a Go module version string.\n * Valid formats: v1.2.3, v0.0.0-timestamp-hash, v1.2.3-pre, v1.2.3+incompatible\n */\nfunction isValidGoVersion(version: string): boolean {\n  if (!version || typeof version !== 'string') return false;\n\n  // Must start with 'v'\n  if (!version.startsWith('v')) return false;\n\n  // Basic semver-like check after 'v': at minimum \"vX.Y.Z\" or pseudo-version\n  const versionBody = version.slice(1);\n  if (!versionBody) return false;\n\n  // Allow semver, pseudo-versions, and +incompatible suffix\n  // Pseudo-version format: v0.0.0-20230101120000-abcdef123456\n  const semverPattern = /^\\d+\\.\\d+\\.\\d+/;\n  return semverPattern.test(versionBody);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAWxB,eAAsB,gBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,2BAA2B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC1G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,cAAc,gBAAgB,WAAW;AAG/C,QAAM,eAAmC,CAAC;AAG1C,QAAM,oBAAoB;AAC1B,MAAI;AACJ,UAAQ,aAAa,kBAAkB,KAAK,OAAO,OAAO,MAAM;AAC9D,UAAM,eAAe,WAAW,CAAC;AACjC,sBAAkB,cAAc,kBAAkB,aAAa,YAAY;AAAA,EAC7E;AAGA,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,UAAM,qBAAqB,QAAQ,MAAM,0BAA0B;AACnE,QAAI,oBAAoB;AACtB,YAAM,aAAa,mBAAmB,CAAC;AACvC,YAAM,UAAU,mBAAmB,CAAC;AACpC,oBAAc,YAAY,SAAS,kBAAkB,aAAa,YAAY;AAAA,IAChF;AAAA,EACF;AAEA,SAAO;AACT;AAKA,SAAS,kBACP,cACA,kBACA,aACA,cACM;AACN,QAAM,QAAQ,aAAa,MAAM,IAAI;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,QAAI,CAAC,WAAW,QAAQ,WAAW,IAAI,EAAG;AAG1C,UAAM,QAAQ,QAAQ,MAAM,gBAAgB;AAC5C,QAAI,OAAO;AACT,YAAM,aAAa,MAAM,CAAC;AAC1B,YAAM,UAAU,MAAM,CAAC;AAGvB,UAAI,WAAW,WAAW,IAAI,EAAG;AAEjC,oBAAc,YAAY,SAAS,kBAAkB,aAAa,YAAY;AAAA,IAChF;AAAA,EACF;AACF;AAKA,SAAS,cACP,YACA,SACA,kBACA,aACA,cACM;AAEN,MAAI,CAAC,oBAAoB,UAAU,GAAG;AACpC,+BAAQ,iCAAiC,UAAU,QAAQ,gBAAgB,kBAAa;AACxF;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB,OAAO,GAAG;AAC9B,+BAAQ,6BAA6B,OAAO,iBAAiB,UAAU,QAAQ,gBAAgB,kBAAa;AAC5G;AAAA,EACF;AAGA,QAAM,eAAe,YAAY,IAAI,GAAG,UAAU,IAAI,OAAO,EAAE;AAI/D,eAAa,KAAK;AAAA,IAChB,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,OAAO;AAAA;AAAA,IACP,WAAW;AAAA,IACX,gBAAgB;AAAA,EAClB,CAAC;AACH;AAcA,SAAS,gBAAgB,aAA+B;AACtD,QAAM,MAAgB,oBAAI,IAAI;AAC9B,QAAM,YAAY,KAAK,KAAK,aAAa,QAAQ;AAEjD,MAAI,CAAC,GAAG,WAAW,SAAS,GAAG;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAU,GAAG,aAAa,WAAW,MAAM;AACjD,UAAM,QAAQ,QAAQ,MAAM,IAAI;AAEhC,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,CAAC,QAAS;AAId,YAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,UAAI,MAAM,UAAU,GAAG;AACrB,cAAM,aAAa,MAAM,CAAC;AAC1B,YAAI,UAAU,MAAM,CAAC;AAErB,kBAAU,QAAQ,QAAQ,cAAc,EAAE;AAC1C,YAAI,IAAI,GAAG,UAAU,IAAI,OAAO,IAAI,IAAI;AAAA,MAC1C;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,+BAAQ,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC/F;AAEA,SAAO;AACT;AAOA,SAAS,oBAAoB,YAA6B;AACxD,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAG1D,MAAI,WAAW,SAAS,GAAG,KAAK,WAAW,SAAS,GAAI,EAAG,QAAO;AAGlE,QAAM,aAAa,WAAW,QAAQ,GAAG;AACzC,QAAM,eAAe,eAAe,KAAK,aAAa,WAAW,MAAM,GAAG,UAAU;AACpF,MAAI,CAAC,aAAa,SAAS,GAAG,EAAG,QAAO;AAExC,SAAO;AACT;AAMA,SAAS,iBAAiB,SAA0B;AAClD,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AAGpD,MAAI,CAAC,QAAQ,WAAW,GAAG,EAAG,QAAO;AAGrC,QAAM,cAAc,QAAQ,MAAM,CAAC;AACnC,MAAI,CAAC,YAAa,QAAO;AAIzB,QAAM,gBAAgB;AACtB,SAAO,cAAc,KAAK,WAAW;AACvC;",
+  "names": []
+}