@zivis/cli 0.1.0-alpha.1

package/dist/internal/extractor/adapters/typescript/index.js

@@ -0,0 +1,84 @@
+/**
+ * TypeScript / JavaScript language adapter.
+ *
+ * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
+ * (cheap, runs against package.json) with AST scanning (per source file)
+ * to produce components, external services, and data stores.
+ */
+import * as path from "node:path";
+import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
+import { scanFile, aggregate } from "./scanner.js";
+import { repoRelative } from "../../walker.js";
+export const typescriptAdapter = {
+    language: "typescript",
+    extensions: [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"],
+    manifests: ["package.json"],
+    async extract(input) {
+        const { rootDir, sourceFiles, manifestFiles } = input;
+        // Manifest pass — fast, runs entirely on package.json contents.
+        const parsedManifests = await readManifests(rootDir, manifestFiles);
+        const manifestSummaries = summarizeManifests(parsedManifests);
+        const manifestExternalServices = findExternalServices(parsedManifests);
+        const manifestDataStores = findDataStores(parsedManifests);
+        // AST pass — only on source files. Cap at MAX_SOURCE_FILES per run
+        // for the Phase J <60s budget on a 100k-LOC monorepo.
+        const MAX_SOURCE_FILES = 5_000;
+        const filesToScan = sourceFiles.slice(0, MAX_SOURCE_FILES);
+        const scans = await Promise.all(filesToScan.map(async (abs) => {
+            try {
+                return await scanFile(abs, repoRelative(rootDir, abs));
+            }
+            catch {
+                return { file: repoRelative(rootDir, abs), imports: [], routes: [] };
+            }
+        }));
+        const agg = aggregate(scans);
+        // Map scanner output → ExtractedComponent shape.
+        const components = agg.components.map((c) => {
+            // Best-effort framework inference: scanner picks up imports; manifest
+            // picks up the dep. Either signal counts.
+            const framework = c.framework ?? frameworkFromOwningManifest(c.sourceFile, parsedManifests);
+            return {
+                name: c.name,
+                kind: "process",
+                language: "typescript",
+                framework,
+                sourceFiles: [c.sourceFile],
+                evidence: [...c.routes, ...c.imports],
+            };
+        });
+        // Augment manifest-derived ExternalServices with AST call sites.
+        for (const svc of manifestExternalServices) {
+            const sites = agg.aiSdkCallSites.get(svc.package);
+            if (sites)
+                svc.callSites.push(...sites);
+        }
+        // Augment manifest-derived DataStores with import-evidence from source.
+        for (const store of manifestDataStores) {
+            if (!store.client)
+                continue;
+            const ev = agg.dataStoreEvidence.get(store.client);
+            if (ev)
+                store.evidence.push(...ev);
+        }
+        return {
+            components,
+            externalServices: manifestExternalServices,
+            dataStores: manifestDataStores,
+            manifests: manifestSummaries,
+        };
+    },
+};
+/**
+ * Walk up from a source file's path to find the closest package.json
+ * we parsed; return the framework hint from that manifest.
+ */
+function frameworkFromOwningManifest(sourceFile, manifests) {
+    const sourceDir = path.posix.dirname(sourceFile);
+    const candidates = manifests
+        .map((m) => ({ m, dir: path.posix.dirname(m.filePath) }))
+        .filter(({ dir }) => sourceDir === dir || sourceDir.startsWith(dir + "/"))
+        .sort((a, b) => b.dir.length - a.dir.length); // closest wins
+    return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
+}
+//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,2BAA2B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQ/C,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,cAAc,CAAC;IAC3B,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAEtD,gEAAgE;QAChE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;QAE3D,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,KAAK,CAAC;QAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAE7B,iDAAiD;QACjD,MAAM,UAAU,GAAyB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChE,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAC5F,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,YAAY;gBACtB,SAAS;gBACT,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC3B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;aACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,KAAK;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,EAAE;gBAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO;YACL,UAAU;YACV,gBAAgB,EAAE,wBAAwB;YAC1C,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,2BAA2B,CAClC,UAAkB,EAClB,SAAoD;IAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,SAAS;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;SACzE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;IAC/D,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC"}

package/dist/internal/extractor/adapters/typescript/manifest.d.ts

@@ -0,0 +1,41 @@
+/**
+ * TypeScript / JavaScript manifest analysis.
+ *
+ * Reads package.json files (root + workspaces) to classify dependencies
+ * into the categories the threat-model graph cares about. Used both for
+ * the manifests block of the output and as a hint for which AST queries
+ * are worth running on which files.
+ */
+import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
+export interface PackageJson {
+    name?: string;
+    version?: string;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    workspaces?: string[] | {
+        packages?: string[];
+    };
+}
+export declare const WEB_FRAMEWORK_PACKAGES: Record<string, string>;
+export declare const DATA_STORE_PACKAGES: Record<string, {
+    kind: ExtractedDataStore["kind"];
+    client: string;
+}>;
+export declare const AI_SDK_PACKAGES: Record<string, string>;
+export interface ParsedManifest {
+    filePath: string;
+    packageName?: string;
+    deps: Record<string, string>;
+}
+/**
+ * Read every package.json, return per-file dependency maps. Combines
+ * dependencies + devDependencies (we want both — devDeps include things
+ * like @types that signal use, plus dev-only auth packages).
+ */
+export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedManifest[]>;
+export declare function summarizeManifests(parsed: ParsedManifest[]): ManifestSummary[];
+export declare function findExternalServices(parsed: ParsedManifest[]): ExtractedExternalService[];
+export declare function findDataStores(parsed: ParsedManifest[]): ExtractedDataStore[];
+/** Pick the most likely web framework for a manifest's owning package. */
+export declare function detectFrameworkFromManifest(m: ParsedManifest): string | undefined;

package/dist/internal/extractor/adapters/typescript/manifest.js

@@ -0,0 +1,156 @@
+/**
+ * TypeScript / JavaScript manifest analysis.
+ *
+ * Reads package.json files (root + workspaces) to classify dependencies
+ * into the categories the threat-model graph cares about. Used both for
+ * the manifests block of the output and as a hint for which AST queries
+ * are worth running on which files.
+ */
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+export const WEB_FRAMEWORK_PACKAGES = {
+    express: "express",
+    fastify: "fastify",
+    next: "nextjs",
+    "@trpc/server": "trpc",
+    hono: "hono",
+    koa: "koa",
+};
+export const DATA_STORE_PACKAGES = {
+    "@prisma/client": { kind: "postgres", client: "@prisma/client" }, // assumes postgres; could be MySQL/SQLite via schema
+    pg: { kind: "postgres", client: "pg" },
+    postgres: { kind: "postgres", client: "postgres" },
+    mongoose: { kind: "mongo", client: "mongoose" },
+    mongodb: { kind: "mongo", client: "mongodb" },
+    ioredis: { kind: "redis", client: "ioredis" },
+    redis: { kind: "redis", client: "redis" },
+    mysql2: { kind: "mysql", client: "mysql2" },
+    "better-sqlite3": { kind: "sqlite", client: "better-sqlite3" },
+};
+export const AI_SDK_PACKAGES = {
+    "@anthropic-ai/sdk": "Anthropic",
+    openai: "OpenAI",
+    ai: "Vercel AI SDK",
+    "@google-ai/generativelanguage": "Google Generative Language",
+    "@google/generative-ai": "Google Generative AI",
+    "@aws-sdk/client-bedrock-runtime": "AWS Bedrock",
+    langchain: "LangChain",
+    "@langchain/core": "LangChain",
+    llamaindex: "LlamaIndex",
+};
+/**
+ * Read every package.json, return per-file dependency maps. Combines
+ * dependencies + devDependencies (we want both — devDeps include things
+ * like @types that signal use, plus dev-only auth packages).
+ */
+export async function readManifests(rootDir, manifestFiles) {
+    const out = [];
+    for (const file of manifestFiles) {
+        try {
+            const raw = await fs.readFile(file, "utf8");
+            const json = JSON.parse(raw);
+            const deps = {};
+            for (const src of [json.dependencies, json.devDependencies, json.peerDependencies]) {
+                if (!src)
+                    continue;
+                for (const [k, v] of Object.entries(src))
+                    deps[k] = v;
+            }
+            out.push({
+                filePath: relPosix(rootDir, file),
+                packageName: json.name,
+                deps,
+            });
+        }
+        catch {
+            // Skip broken JSON; not our job to validate the customer's manifests.
+        }
+    }
+    return out;
+}
+export function summarizeManifests(parsed) {
+    return parsed.map((m) => ({
+        language: "typescript",
+        file: m.filePath,
+        dependencies: m.deps,
+    }));
+}
+export function findExternalServices(parsed) {
+    const seen = new Map();
+    for (const m of parsed) {
+        for (const [pkg, vendor] of Object.entries(AI_SDK_PACKAGES)) {
+            const ver = m.deps[pkg];
+            if (!ver)
+                continue;
+            const key = `ai_sdk::${pkg}`;
+            const existing = seen.get(key);
+            if (existing) {
+                existing.callSites.push({ file: m.filePath, line: 1 });
+                if (!existing.version)
+                    existing.version = ver;
+                continue;
+            }
+            seen.set(key, {
+                name: vendor,
+                kind: "ai_sdk",
+                package: pkg,
+                version: ver,
+                callSites: [{ file: m.filePath, line: 1 }],
+            });
+        }
+    }
+    return [...seen.values()];
+}
+export function findDataStores(parsed) {
+    const seen = new Map();
+    for (const m of parsed) {
+        for (const [pkg, info] of Object.entries(DATA_STORE_PACKAGES)) {
+            const ver = m.deps[pkg];
+            if (!ver)
+                continue;
+            const key = `${info.kind}::${info.client}`;
+            const existing = seen.get(key);
+            if (existing) {
+                existing.evidence.push({ file: m.filePath, line: 1, kind: "config" });
+                continue;
+            }
+            seen.set(key, {
+                name: defaultDataStoreName(info.kind),
+                kind: info.kind,
+                client: info.client,
+                version: ver,
+                evidence: [{ file: m.filePath, line: 1, kind: "config" }],
+            });
+        }
+    }
+    return [...seen.values()];
+}
+/** Pick the most likely web framework for a manifest's owning package. */
+export function detectFrameworkFromManifest(m) {
+    for (const [pkg, framework] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
+        if (m.deps[pkg])
+            return framework;
+    }
+    return undefined;
+}
+function defaultDataStoreName(kind) {
+    switch (kind) {
+        case "postgres":
+            return "postgres";
+        case "mysql":
+            return "mysql";
+        case "mongo":
+            return "mongo";
+        case "redis":
+            return "redis";
+        case "sqlite":
+            return "sqlite";
+        default:
+            return "data-store";
+    }
+}
+function relPosix(rootDir, abs) {
+    const rel = path.relative(rootDir, abs);
+    return rel.split(path.sep).join("/");
+}
+//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/typescript/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAYlC,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,QAAQ;IACd,cAAc,EAAE,MAAM;IACtB,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAyE;IACvG,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,qDAAqD;IACvH,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;IACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IAClD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;IAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACzC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3C,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,mBAAmB,EAAE,WAAW;IAChC,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,eAAe;IACnB,+BAA+B,EAAE,4BAA4B;IAC7D,uBAAuB,EAAE,sBAAsB;IAC/C,iCAAiC,EAAE,aAAa;IAChD,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY;CACzB,CAAC;AAQF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,aAAuB;IAC1E,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;YAC5C,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;gBACjC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,CAAC,CAAC,QAAQ;QAChB,YAAY,EAAE,CAAC,CAAC,IAAI;KACrB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,WAAW,GAAG,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvD,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG;gBACZ,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,CAAiB;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAgC;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/internal/extractor/adapters/typescript/parser.d.ts

@@ -0,0 +1,14 @@
+/**
+ * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
+ * caches the parser+language for the rest of the run.
+ *
+ * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
+ * need a build step on the user's machine. Loading a .wasm grammar is
+ * O(50ms); parsing a TS file is O(low ms) per file.
+ */
+import { Parser } from "web-tree-sitter";
+export declare function getParsers(): Promise<{
+    parser: Parser;
+    tsx: Parser;
+}>;
+export declare function pickParserForFile(file: string, parser: Parser, tsx: Parser): Parser;

package/dist/internal/extractor/adapters/typescript/parser.js

@@ -0,0 +1,33 @@
+/**
+ * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
+ * caches the parser+language for the rest of the run.
+ *
+ * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
+ * need a build step on the user's machine. Loading a .wasm grammar is
+ * O(50ms); parsing a TS file is O(low ms) per file.
+ */
+import { createRequire } from "node:module";
+import * as path from "node:path";
+import { Parser, Language } from "web-tree-sitter";
+const require = createRequire(import.meta.url);
+let parserPromise = null;
+export function getParsers() {
+    if (!parserPromise) {
+        parserPromise = (async () => {
+            await Parser.init();
+            const wasmDir = path.dirname(require.resolve("@vscode/tree-sitter-wasm/package.json"));
+            const tsLang = await Language.load(path.join(wasmDir, "wasm", "tree-sitter-typescript.wasm"));
+            const tsxLang = await Language.load(path.join(wasmDir, "wasm", "tree-sitter-tsx.wasm"));
+            const parser = new Parser();
+            parser.setLanguage(tsLang);
+            const tsx = new Parser();
+            tsx.setLanguage(tsxLang);
+            return { parser, tsx };
+        })();
+    }
+    return parserPromise;
+}
+export function pickParserForFile(file, parser, tsx) {
+    return file.endsWith(".tsx") || file.endsWith(".jsx") ? tsx : parser;
+}
+//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/typescript/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,IAAI,aAAa,GAAoD,IAAI,CAAC;AAE1E,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC"}

package/dist/internal/extractor/adapters/typescript/scanner.d.ts

@@ -0,0 +1,43 @@
+/**
+ * AST scanner for TypeScript / JavaScript source files.
+ *
+ * For each file: parses with tree-sitter-typescript, walks the tree
+ * looking for:
+ *
+ *   1. `import` / `require` statements naming any tracked package
+ *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
+ *      ExternalService call sites
+ *   2. Express-style route declarations:
+ *        app.METHOD("/path", ...)
+ *        router.METHOD("/path", ...)
+ *        server.METHOD("/path", ...)
+ *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
+ *      → HTTP-route-evidence on a component derived from the file
+ *
+ * Privacy invariant: we only ever emit identifier names, file paths,
+ * line numbers, dependency identifiers, and HTTP method/path strings.
+ * Function bodies and inline values are never read past the first arg
+ * of a route call.
+ */
+import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
+export interface FileScanResult {
+    file: string;
+    imports: ImportEvidence[];
+    routes: HttpRouteEvidence[];
+}
+export declare function scanFile(absPath: string, repoRel: string): Promise<FileScanResult>;
+export interface ScannedAggregates {
+    /** Per-component findings (one per source file with relevant evidence). */
+    components: Array<{
+        name: string;
+        sourceFile: string;
+        framework?: string;
+        routes: HttpRouteEvidence[];
+        imports: ImportEvidence[];
+    }>;
+    /** Extra ExternalService call-site evidence beyond what the manifests gave. */
+    aiSdkCallSites: Map<string, EvidenceLocation[]>;
+    /** Extra data-store evidence (when AST shows usage of e.g. `new Pool()` etc.; v1 just imports). */
+    dataStoreEvidence: Map<string, Evidence[]>;
+}
+export declare function aggregate(scans: FileScanResult[]): ScannedAggregates;

package/dist/internal/extractor/adapters/typescript/scanner.js

@@ -0,0 +1,188 @@
+/**
+ * AST scanner for TypeScript / JavaScript source files.
+ *
+ * For each file: parses with tree-sitter-typescript, walks the tree
+ * looking for:
+ *
+ *   1. `import` / `require` statements naming any tracked package
+ *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
+ *      ExternalService call sites
+ *   2. Express-style route declarations:
+ *        app.METHOD("/path", ...)
+ *        router.METHOD("/path", ...)
+ *        server.METHOD("/path", ...)
+ *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
+ *      → HTTP-route-evidence on a component derived from the file
+ *
+ * Privacy invariant: we only ever emit identifier names, file paths,
+ * line numbers, dependency identifiers, and HTTP method/path strings.
+ * Function bodies and inline values are never read past the first arg
+ * of a route call.
+ */
+import * as fs from "node:fs/promises";
+import { getParsers, pickParserForFile } from "./parser.js";
+import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
+const HTTP_METHODS = new Set(["get", "post", "put", "delete", "patch", "all", "use", "head", "options"]);
+const ROUTER_IDENTIFIERS = new Set(["app", "router", "server", "fastify", "hono"]);
+const TRACKED_PACKAGES = new Set([
+    ...Object.keys(AI_SDK_PACKAGES),
+    ...Object.keys(DATA_STORE_PACKAGES),
+    ...Object.keys(WEB_FRAMEWORK_PACKAGES),
+]);
+export async function scanFile(absPath, repoRel) {
+    const { parser, tsx } = await getParsers();
+    const source = await fs.readFile(absPath, "utf8");
+    const p = pickParserForFile(absPath, parser, tsx);
+    const tree = p.parse(source);
+    if (!tree) {
+        return { file: repoRel, imports: [], routes: [] };
+    }
+    const imports = [];
+    const routes = [];
+    walk(tree.rootNode, (node) => {
+        if (node.type === "import_statement") {
+            const pkg = extractImportSource(node);
+            if (pkg && trackedPackageMatch(pkg)) {
+                imports.push({
+                    kind: "import",
+                    file: repoRel,
+                    line: node.startPosition.row + 1,
+                    package: pkg,
+                });
+            }
+            return;
+        }
+        if (node.type === "call_expression") {
+            const route = extractRouteCall(node);
+            if (route) {
+                routes.push({
+                    kind: "http_route",
+                    file: repoRel,
+                    line: node.startPosition.row + 1,
+                    method: route.method,
+                    path: route.path,
+                });
+            }
+        }
+    });
+    return { file: repoRel, imports, routes };
+}
+function walk(node, visit) {
+    visit(node);
+    for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child)
+            walk(child, visit);
+    }
+}
+/** Pull the string literal from `import … from "<here>"`. */
+function extractImportSource(node) {
+    // import_statement → ... → (string (string_fragment))
+    const stringNode = node.children.find((c) => c?.type === "string");
+    if (!stringNode)
+        return null;
+    const frag = stringNode.namedChildren.find((c) => c?.type === "string_fragment");
+    return frag?.text ?? null;
+}
+/** Map a package import to a tracked-package identifier, allowing for sub-paths. */
+function trackedPackageMatch(pkg) {
+    if (TRACKED_PACKAGES.has(pkg))
+        return pkg;
+    // sub-paths: "@anthropic-ai/sdk/foo" → "@anthropic-ai/sdk"
+    for (const tracked of TRACKED_PACKAGES) {
+        if (pkg.startsWith(tracked + "/"))
+            return tracked;
+    }
+    return null;
+}
+/**
+ * Identify Express-style route calls. Only inspects the AST shape; never
+ * reads the handler-function body.
+ *
+ * Matches:
+ *   <ROUTER_IDENT>.<METHOD>("/path", ...)
+ *
+ * Where the second-and-onward args are deliberately ignored.
+ */
+function extractRouteCall(node) {
+    const fn = node.namedChildren.find((c) => c?.type === "member_expression");
+    const args = node.namedChildren.find((c) => c?.type === "arguments");
+    if (!fn || !args)
+        return null;
+    const objectNode = fn.namedChildren.find((c) => c?.type === "identifier");
+    const methodNode = fn.namedChildren.find((c) => c?.type === "property_identifier");
+    if (!objectNode || !methodNode)
+        return null;
+    const objectName = objectNode.text.toLowerCase();
+    const methodName = methodNode.text.toLowerCase();
+    if (!ROUTER_IDENTIFIERS.has(objectName))
+        return null;
+    if (!HTTP_METHODS.has(methodName))
+        return null;
+    // First arg should be a string literal — the route path.
+    const firstArg = args.namedChildren[0];
+    if (!firstArg || firstArg.type !== "string")
+        return null;
+    const frag = firstArg.namedChildren.find((c) => c?.type === "string_fragment");
+    if (!frag)
+        return null;
+    return { method: methodName.toUpperCase(), path: frag.text };
+}
+export function aggregate(scans) {
+    const components = [];
+    const aiSdkCallSites = new Map();
+    const dataStoreEvidence = new Map();
+    for (const s of scans) {
+        if (s.routes.length === 0 && s.imports.length === 0)
+            continue;
+        // Tag SDK call sites. Each tracked import of an AI SDK package
+        // counts as a call site for that vendor, on top of the manifest hit.
+        for (const imp of s.imports) {
+            if (AI_SDK_PACKAGES[imp.package]) {
+                const arr = aiSdkCallSites.get(imp.package) ?? [];
+                arr.push({ file: imp.file, line: imp.line });
+                aiSdkCallSites.set(imp.package, arr);
+            }
+            if (DATA_STORE_PACKAGES[imp.package]) {
+                const key = DATA_STORE_PACKAGES[imp.package].client;
+                const arr = dataStoreEvidence.get(key) ?? [];
+                arr.push({ kind: "import", file: imp.file, line: imp.line, package: imp.package });
+                dataStoreEvidence.set(key, arr);
+            }
+        }
+        if (s.routes.length === 0)
+            continue;
+        // Derive a friendly component name from the file path (the deepest
+        // meaningful directory). e.g. src/auth/login.ts → "auth".
+        const name = deriveComponentName(s.file);
+        const framework = detectFrameworkFromImports(s.imports);
+        components.push({
+            name,
+            sourceFile: s.file,
+            framework,
+            routes: s.routes,
+            imports: s.imports,
+        });
+    }
+    return { components, aiSdkCallSites, dataStoreEvidence };
+}
+function deriveComponentName(filePath) {
+    const segs = filePath.split("/");
+    // Drop "src" / "lib" / "app" prefixes so the name is meaningful.
+    const start = ["src", "lib", "app"].includes(segs[0]) ? 1 : 0;
+    // Use the parent directory as the component (e.g. "auth"), or the
+    // filename root if the file lives at the top level.
+    if (segs.length - start >= 2)
+        return segs[start];
+    const last = segs[segs.length - 1];
+    return last.replace(/\.(t|j)sx?$/, "");
+}
+function detectFrameworkFromImports(imports) {
+    for (const imp of imports) {
+        const fw = WEB_FRAMEWORK_PACKAGES[imp.package];
+        if (fw)
+            return fw;
+    }
+    return undefined;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/typescript/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAQvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACnC,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAQH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAe;IAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,OAAO,EAAE,GAAG;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAA0B;IACpD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,mBAAmB,CAAC,IAAY;IACvC,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACpG,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,2DAA2D;IAC3D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC;IACxF,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACtG,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAiBD,MAAM,UAAU,SAAS,CAAC,KAAuB;IAC/C,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE9D,+DAA+D;QAC/D,qEAAqE;QACrE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,iEAAiE;IACjE,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,kEAAkE;IAClE,oDAAoD;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAyB;IAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/internal/extractor/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Extractor orchestrator.
+ *
+ * Walks the customer's repo, dispatches matched files to per-language
+ * adapters, merges their findings into a single ExtractionResult.
+ *
+ * Adapters register their own file extensions + manifest filenames; the
+ * walker only reads files those filters claim. So adding a Go or Python
+ * adapter doesn't change anything here — register the adapter and the
+ * orchestrator picks up its files.
+ */
+import type { ExtractionResult } from "./types.js";
+export interface RunOptions {
+    rootDir: string;
+    /** Subset of language adapters to run; defaults to all registered. */
+    languages?: Array<"typescript" | "go" | "python">;
+    /** Extra ignore patterns from --ignore flags. */
+    extraIgnores?: string[];
+    /** Version string for the extractor — usually @zivis-ai/cli's package version. */
+    extractorVersion: string;
+}
+export declare function runExtractor(opts: RunOptions): Promise<ExtractionResult>;