@zivis/cli 0.1.0-alpha.32 → 0.1.0-alpha.34

package/dist/internal/extractor/graph-builder.js

@@ -0,0 +1,283 @@
+/**
+ * Build a RepoGraphArtifactV1 from an ExtractionResult.
+ *
+ * The existing extractor emits an entity-list shape (components,
+ * externalServices, dataStores, manifests). This builder is the canonical
+ * translator from that internal intermediate into the graph artifact that
+ * downstream pattern matching, threat modeling, and evidence storage all
+ * consume.
+ *
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 1)
+ * Schema: schemas/repo-graph-artifact.schema.json
+ *
+ * v1 scope (locked): three node types (service, endpoint, external_dependency)
+ * and two edge types (exposes, depends_on). Datastores and the corresponding
+ * reads/writes edges are deferred to Phase 1.5.
+ *
+ * Lane assignment for v1: every node and edge produced by deterministic
+ * adapter output is `trusted`. Inferred-lane nodes are introduced later by
+ * the matching engine (Phase 3), not by extraction.
+ */
+const TRUSTED_LANE = "trusted";
+const TRUSTED_SOURCE = "inspect.trusted";
+export function buildRepoGraphArtifact(result, opts = {}) {
+    const nodes = [];
+    const edges = [];
+    // Service nodes — every component that isn't an external service or pure datastore.
+    // The existing extractor models datastores via `dataStores` and external SDKs via
+    // `externalServices`; `components` covers code-defined services and frontends.
+    // Skip components that arrive with empty evidence — schema requires minItems: 1.
+    const serviceById = new Map();
+    for (const component of result.components) {
+        if (component.kind === "external_service" || component.kind === "data_store") {
+            continue;
+        }
+        if (component.evidence.length === 0)
+            continue;
+        const node = buildServiceNode(component);
+        serviceById.set(node.id, node);
+        nodes.push(node);
+    }
+    // Endpoint nodes + exposes edges — derived from each service's http_route evidence.
+    // Non-canonical methods (e.g. Express `app.use()` mounts emitted by the TS adapter)
+    // are dropped here — they're middleware mounts, not endpoints. Fixing them belongs
+    // upstream in the adapter; the graph-builder enforces the contract.
+    for (const component of result.components) {
+        const owningServiceId = serviceIdFor(component);
+        if (!serviceById.has(owningServiceId))
+            continue;
+        const seenEndpoints = new Set();
+        for (const ev of component.evidence) {
+            if (ev.kind !== "http_route")
+                continue;
+            const method = canonicalMethod(ev.method);
+            if (!method)
+                continue;
+            const endpointNode = buildEndpointNode(owningServiceId, component.language, ev, method);
+            if (seenEndpoints.has(endpointNode.id))
+                continue;
+            seenEndpoints.add(endpointNode.id);
+            nodes.push(endpointNode);
+            edges.push(buildExposesEdge(owningServiceId, endpointNode.id, ev));
+        }
+    }
+    // External dependency nodes — one per (registry, package) tuple.
+    // Manifest-only deps (no callSites) fall back to manifest evidence so they still
+    // satisfy the schema's evidence: minItems: 1 invariant.
+    const manifestEvidenceByPackage = indexManifestsByPackage(result);
+    const depById = new Map();
+    for (const ext of result.externalServices) {
+        const node = buildExternalDependencyNode(ext, manifestEvidenceByPackage.get(ext.package) ?? []);
+        if (depById.has(node.id))
+            continue;
+        if (node.evidence.length === 0)
+            continue; // truly orphaned — skip
+        depById.set(node.id, node);
+        nodes.push(node);
+    }
+    // File-to-service index for resolving callSites into depends_on edges.
+    const fileToServiceId = buildFileToServiceIndex(result.components, serviceById);
+    for (const ext of result.externalServices) {
+        const depId = externalDepId(ext);
+        const seenServiceIds = new Set();
+        const evidenceByService = new Map();
+        for (const callSite of ext.callSites) {
+            const serviceId = fileToServiceId.get(callSite.file);
+            if (!serviceId)
+                continue;
+            seenServiceIds.add(serviceId);
+            const list = evidenceByService.get(serviceId) ?? [];
+            list.push(toImportEvidence(callSite, ext.package));
+            evidenceByService.set(serviceId, list);
+        }
+        for (const serviceId of seenServiceIds) {
+            edges.push(buildDependsOnEdge(serviceId, depId, evidenceByService.get(serviceId) ?? []));
+        }
+    }
+    const provenance = {
+        root_dir: result.scope.rootDir,
+        analysis_mode: opts.analysisMode ?? "local",
+        ...(opts.repoId ? { repo_id: opts.repoId } : {}),
+        ...(opts.commitSha ? { commit_sha: opts.commitSha } : {}),
+        ...(opts.branch ? { branch: opts.branch } : {}),
+        ...(opts.applicationId ? { application_id: opts.applicationId } : {}),
+    };
+    const languagesFromManifests = new Set(result.manifests.map((m) => normalizeLanguage(m.language)).filter(Boolean));
+    return {
+        version: "1.0.0",
+        kind: "repo_graph_artifact",
+        extracted_at: result.extractedAt,
+        extractor: result.extractor,
+        provenance,
+        scope: {
+            files_scanned: result.scope.filesScanned,
+            files_skipped: result.scope.filesSkipped,
+            duration_ms: result.scope.durationMs,
+            languages: [...languagesFromManifests],
+        },
+        nodes,
+        edges,
+    };
+}
+// ── Node builders ──
+function buildServiceNode(component) {
+    const id = serviceIdFor(component);
+    return {
+        id,
+        type: "service",
+        name: component.name,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        language: normalizeLanguage(component.language),
+        evidence: component.evidence.map(toEvidenceSpan),
+        attributes: {
+            ...(component.framework ? { framework: component.framework } : {}),
+            source_files: component.sourceFiles,
+        },
+    };
+}
+function buildEndpointNode(serviceId, language, ev, method) {
+    const id = `endpoint::${stripPrefix(serviceId, "service::")}::${method}::${ev.path}`;
+    return {
+        id,
+        type: "endpoint",
+        name: `${method} ${ev.path}`,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        language: normalizeLanguage(language),
+        evidence: [toEvidenceSpan(ev)],
+        attributes: { method, path: ev.path },
+    };
+}
+function buildExternalDependencyNode(ext, manifestFallback) {
+    const registry = registryFor(ext);
+    const evidence = ext.callSites.length > 0
+        ? ext.callSites.map((cs) => toImportEvidence(cs, ext.package))
+        : manifestFallback;
+    return {
+        id: externalDepId(ext),
+        type: "external_dependency",
+        name: ext.name,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence,
+        attributes: {
+            package: ext.package,
+            registry,
+            ...(ext.version ? { version: ext.version } : {}),
+            ...(ext.kind ? { kind: ext.kind } : {}),
+        },
+    };
+}
+function indexManifestsByPackage(result) {
+    const idx = new Map();
+    for (const m of result.manifests) {
+        for (const pkg of Object.keys(m.dependencies)) {
+            const span = { file: m.file, kind: "manifest", detail: { package: pkg } };
+            const list = idx.get(pkg) ?? [];
+            list.push(span);
+            idx.set(pkg, list);
+        }
+    }
+    return idx;
+}
+function buildExposesEdge(serviceId, endpointId, ev) {
+    return {
+        id: `exposes::${serviceId}::${endpointId}`,
+        type: "exposes",
+        source_id: serviceId,
+        target_id: endpointId,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence: [toEvidenceSpan(ev)],
+    };
+}
+function buildDependsOnEdge(serviceId, depId, evidence) {
+    return {
+        id: `depends_on::${serviceId}::${depId}`,
+        type: "depends_on",
+        source_id: serviceId,
+        target_id: depId,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence,
+    };
+}
+// ── Helpers ──
+function serviceIdFor(component) {
+    return `service::${component.language}::${component.name}`;
+}
+function externalDepId(ext) {
+    const registry = registryFor(ext);
+    return `external_dependency::${registry}::${ext.package}`;
+}
+function registryFor(ext) {
+    // Heuristic — the existing extractor doesn't tag registry, so derive from package shape.
+    if (ext.package.startsWith("github.com/"))
+        return "go";
+    if (ext.package.startsWith("@") || /^[a-z0-9-]+$/.test(ext.package)) {
+        // npm + pypi share many shapes; lean npm by default since most ai_sdks live there.
+        // PyPI-only packages can be retagged once adapters expose registry directly.
+        return "npm";
+    }
+    return "npm";
+}
+const CANONICAL_METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+    "OPTIONS",
+    "WS",
+    "SSE",
+    "RPC",
+]);
+function canonicalMethod(method) {
+    const upper = method.toUpperCase();
+    return CANONICAL_METHODS.has(upper) ? upper : undefined;
+}
+function normalizeLanguage(lang) {
+    return lang;
+}
+function buildFileToServiceIndex(components, servicesById) {
+    const idx = new Map();
+    for (const component of components) {
+        const id = serviceIdFor(component);
+        if (!servicesById.has(id))
+            continue;
+        for (const file of component.sourceFiles) {
+            if (!idx.has(file))
+                idx.set(file, id);
+        }
+    }
+    return idx;
+}
+function toEvidenceSpan(ev) {
+    const base = { file: ev.file, start_line: ev.line, kind: ev.kind };
+    if (ev.kind === "http_route") {
+        return { ...base, detail: { method: ev.method, path: ev.path } };
+    }
+    if (ev.kind === "import") {
+        return { ...base, detail: { package: ev.package } };
+    }
+    return base;
+}
+function toImportEvidence(loc, pkg) {
+    return {
+        file: loc.file,
+        start_line: loc.line,
+        kind: "import",
+        detail: { package: pkg },
+    };
+}
+function stripPrefix(value, prefix) {
+    return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+}
+//# sourceMappingURL=graph-builder.js.map

package/dist/internal/extractor/graph-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-builder.js","sourceRoot":"","sources":["../../../src/internal/extractor/graph-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAyBH,MAAM,YAAY,GAAG,SAAkB,CAAC;AACxC,MAAM,cAAc,GAAG,iBAA0B,CAAC;AAelD,MAAM,UAAU,sBAAsB,CACpC,MAAwB,EACxB,OAAqB,EAAE;IAEvB,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,oFAAoF;IACpF,kFAAkF;IAClF,+EAA+E;IAC/E,iFAAiF;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,kBAAkB,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC9C,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACzC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,mFAAmF;IACnF,oEAAoE;IACpE,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,SAAS;QAEhD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,eAAe,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACxF,IAAI,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAAE,SAAS;YACjD,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,iFAAiF;IACjF,wDAAwD;IACxD,MAAM,yBAAyB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS,CAAC,wBAAwB;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,uEAAuE;IACvE,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEhF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA0B,CAAC;QAE5D,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACnD,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CACR,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAoB;QAClC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO;QAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;IAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAoB,CAC9F,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,qBAAqB;QAC3B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU;QACV,KAAK,EAAE;YACL,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;YACxC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;YACxC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU;YACpC,SAAS,EAAE,CAAC,GAAG,sBAAsB,CAAC;SACvC;QACD,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,sBAAsB;AAEtB,SAAS,gBAAgB,CAAC,SAA6B;IACrD,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,EAAE;QACF,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;QAChD,UAAU,EAAE;YACV,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,YAAY,EAAE,SAAS,CAAC,WAAW;SACpC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAiB,EACjB,QAAkB,EAClB,EAAsD,EACtD,MAAkB;IAElB,MAAM,EAAE,GAAG,aAAa,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,KAAK,MAAM,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACrF,OAAO;QACL,EAAE;QACF,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;QAC5B,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACrC,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC9B,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,GAA6B,EAC7B,gBAAgC;IAEhC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAmB,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC,CAAC,gBAAgB,CAAC;IACrB,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,GAAG,CAAC;QACtB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,CAAC;QACb,QAAQ;QACR,UAAU,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ;YACR,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAwB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;YACxF,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAiB,EACjB,UAAkB,EAClB,EAAsD;IAEtD,OAAO;QACL,EAAE,EAAE,YAAY,SAAS,KAAK,UAAU,EAAE;QAC1C,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAiB,EACjB,KAAa,EACb,QAAwB;IAExB,OAAO;QACL,EAAE,EAAE,eAAe,SAAS,KAAK,KAAK,EAAE;QACxC,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,CAAC;QACb,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,gBAAgB;AAEhB,SAAS,YAAY,CAAC,SAA6B;IACjD,OAAO,YAAY,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,GAA6B;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,wBAAwB,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,GAA6B;IAChD,yFAAyF;IACzF,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,mFAAmF;QACnF,6EAA6E;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,iBAAiB,GAA4B,IAAI,GAAG,CAAa;IACrE,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,IAAI;IACJ,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,iBAAiB,CAAC,GAAG,CAAC,KAAmB,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAgC,EAChC,YAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,EAAqB;IAC3C,MAAM,IAAI,GAAiB,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAqB,EAAE,GAAW;IAC1D,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,IAAI;QACpB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc;IAChD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACvE,CAAC"}

package/dist/internal/extractor/graph-types.d.ts

@@ -0,0 +1,99 @@
+/**
+ * TypeScript interfaces for RepoGraphArtifactV1.
+ *
+ * Canonical source: schemas/repo-graph-artifact.schema.json
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 1)
+ *
+ * The JSON schema is authoritative — these types must stay in sync. A
+ * repo-level test (planned) validates extractor output against the schema
+ * to catch drift.
+ */
+export type Lane = "trusted" | "inferred";
+export type Source = "inspect.trusted" | "inspect.inferred";
+export type GraphLanguage = "typescript" | "javascript" | "python" | "go";
+export type AnalysisMode = "local" | "cloud";
+export type EvidenceKind = "import" | "http_route" | "config" | "manifest" | "decorator" | "annotation";
+export type NodeType = "service" | "endpoint" | "external_dependency";
+export type EdgeType = "exposes" | "depends_on";
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "WS" | "SSE" | "RPC";
+export type DependencyRegistry = "npm" | "pypi" | "go";
+export interface EvidenceSpan {
+    file: string;
+    start_line?: number;
+    end_line?: number;
+    kind: EvidenceKind;
+    detail?: Record<string, unknown>;
+}
+export interface ServiceAttributes {
+    framework?: string;
+    source_files?: string[];
+}
+export interface EndpointAttributes {
+    method: HttpMethod;
+    path: string;
+}
+export interface ExternalDependencyAttributes {
+    package: string;
+    version?: string;
+    registry: DependencyRegistry;
+    kind?: string;
+}
+export type NodeAttributes = ServiceAttributes | EndpointAttributes | ExternalDependencyAttributes;
+interface BaseNode {
+    id: string;
+    name: string;
+    lane: Lane;
+    source: Source;
+    confidence?: number;
+    language?: GraphLanguage;
+    evidence: EvidenceSpan[];
+}
+export interface ServiceNode extends BaseNode {
+    type: "service";
+    attributes?: ServiceAttributes;
+}
+export interface EndpointNode extends BaseNode {
+    type: "endpoint";
+    attributes: EndpointAttributes;
+}
+export interface ExternalDependencyNode extends BaseNode {
+    type: "external_dependency";
+    attributes: ExternalDependencyAttributes;
+}
+export type GraphNode = ServiceNode | EndpointNode | ExternalDependencyNode;
+export interface GraphEdge {
+    id: string;
+    type: EdgeType;
+    source_id: string;
+    target_id: string;
+    lane: Lane;
+    source: Source;
+    confidence?: number;
+    evidence?: EvidenceSpan[];
+    attributes?: Record<string, unknown>;
+}
+export interface GraphProvenance {
+    root_dir: string;
+    repo_id?: string;
+    commit_sha?: string;
+    branch?: string;
+    application_id?: string;
+    analysis_mode: AnalysisMode;
+}
+export interface GraphScope {
+    files_scanned: number;
+    files_skipped: number;
+    duration_ms: number;
+    languages?: GraphLanguage[];
+}
+export interface RepoGraphArtifactV1 {
+    version: "1.0.0";
+    kind: "repo_graph_artifact";
+    extracted_at: string;
+    extractor: string;
+    provenance: GraphProvenance;
+    scope: GraphScope;
+    nodes: GraphNode[];
+    edges: GraphEdge[];
+}
+export {};

package/dist/internal/extractor/graph-types.js

@@ -0,0 +1,12 @@
+/**
+ * TypeScript interfaces for RepoGraphArtifactV1.
+ *
+ * Canonical source: schemas/repo-graph-artifact.schema.json
+ * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md (Phase 1)
+ *
+ * The JSON schema is authoritative — these types must stay in sync. A
+ * repo-level test (planned) validates extractor output against the schema
+ * to catch drift.
+ */
+export {};
+//# sourceMappingURL=graph-types.js.map

package/dist/internal/extractor/graph-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-types.js","sourceRoot":"","sources":["../../../src/internal/extractor/graph-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/internal/github-linkage-prompt.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Lane-2 conversion prompts — nudges the user to install the ZIVIS
+ * GitHub App and / or link a repo to a specific Application.
+ *
+ * Surfaced from `zivis auth login`, `zivis auth init`, and `zivis check`
+ * so the next step is obvious right after a developer signs in.
+ *
+ * Best-effort by design: any fetch failure returns `null` so we don't
+ * fail an otherwise-successful auth or check run on a transient API
+ * blip.
+ */
+import type { ZivisConfig } from "@zivis/mcp/types";
+export interface BuildLinkagePromptOpts {
+    config: ZivisConfig;
+    /** Optional. When provided we also check whether THIS app has linked repos. */
+    applicationId?: string;
+    /** Format hint: "short" omits the explanatory why-line. Default "full". */
+    style?: "short" | "full";
+}
+/**
+ * Fetch GitHub App status + (if applicationId given) per-app repo
+ * linkage status, then return a multi-line printable prompt suggesting
+ * the next step. Returns null when nothing actionable is missing
+ * (fully linked) or when we couldn't determine the state.
+ */
+export declare function buildLinkagePrompt(opts: BuildLinkagePromptOpts): Promise<string | null>;

package/dist/internal/github-linkage-prompt.js

@@ -0,0 +1,121 @@
+/**
+ * Lane-2 conversion prompts — nudges the user to install the ZIVIS
+ * GitHub App and / or link a repo to a specific Application.
+ *
+ * Surfaced from `zivis auth login`, `zivis auth init`, and `zivis check`
+ * so the next step is obvious right after a developer signs in.
+ *
+ * Best-effort by design: any fetch failure returns `null` so we don't
+ * fail an otherwise-successful auth or check run on a transient API
+ * blip.
+ */
+import { resolveAuth } from "@zivis/mcp/auth";
+/**
+ * Fetch GitHub App status + (if applicationId given) per-app repo
+ * linkage status, then return a multi-line printable prompt suggesting
+ * the next step. Returns null when nothing actionable is missing
+ * (fully linked) or when we couldn't determine the state.
+ */
+export async function buildLinkagePrompt(opts) {
+    const creds = await resolveAuth(opts.config);
+    if (creds.method === "none")
+        return null;
+    const appStatus = await fetchGitHubAppStatus(opts.config, creds);
+    if (!appStatus)
+        return null;
+    // Case 1: GitHub App not installed at all → install URL.
+    if (!appStatus.installed) {
+        if (!appStatus.installUrl)
+            return null; // env not configured; don't show a broken link
+        return formatInstallPrompt(appStatus.installUrl, opts.style ?? "full");
+    }
+    // Case 2: App installed but caller has a specific applicationId and
+    // that app has no linked repo → web link-repo prompt.
+    if (opts.applicationId) {
+        const repoStatus = await fetchAppRepoStatus(opts.config, creds, opts.applicationId);
+        if (repoStatus && !repoStatus.linked) {
+            return formatLinkRepoPrompt(opts.config, opts.applicationId, opts.style ?? "full");
+        }
+    }
+    // Case 3: All good (or no applicationId to check at app-level).
+    return null;
+}
+// ── HTTP helpers ──
+async function fetchGitHubAppStatus(config, creds) {
+    try {
+        const res = await fetch(`${config.apiBaseUrl}/api/github-app/status`, {
+            headers: authHeaders(creds),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchAppRepoStatus(config, creds, applicationId) {
+    try {
+        const res = await fetch(`${config.apiBaseUrl}/api/applications/${encodeURIComponent(applicationId)}/repos/status`, { headers: authHeaders(creds) });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+function authHeaders(creds) {
+    const base = {
+        "Content-Type": "application/json",
+        "User-Agent": "@zivis/cli",
+    };
+    if (creds.method === "oauth" && creds.accessToken) {
+        base.Authorization = `Bearer ${creds.accessToken}`;
+    }
+    else if (creds.method === "apikey" && creds.apiKey) {
+        base["X-API-Key"] = creds.apiKey;
+    }
+    return base;
+}
+// ── Formatters ──
+function formatInstallPrompt(installUrl, style) {
+    if (style === "short") {
+        return `Next: install the ZIVIS GitHub App — ${installUrl}`;
+    }
+    return [
+        "",
+        "Next: install the ZIVIS GitHub App",
+        `  ${installUrl}`,
+        "  Enables continuous monitoring + automatic threat-model updates on push.",
+    ].join("\n");
+}
+function formatLinkRepoPrompt(config, applicationId, style) {
+    const appBase = process.env.ZIVIS_APP_URL || guessAppUrlFromApi(config.apiBaseUrl);
+    const url = `${appBase}/applications/${applicationId}`;
+    if (style === "short") {
+        return `Next: link a GitHub repo to this application — ${url}`;
+    }
+    return [
+        "",
+        "Next: link a GitHub repo to this application",
+        `  ${url}`,
+        "  The GitHub App is installed but this app has no linked repo yet.",
+    ].join("\n");
+}
+function guessAppUrlFromApi(apiBaseUrl) {
+    // Standard mapping: api.* ⇄ app.* on the same root domain.
+    try {
+        const u = new URL(apiBaseUrl);
+        if (u.host.startsWith("api.")) {
+            u.host = "app." + u.host.slice(4);
+            return `${u.protocol}//${u.host}`;
+        }
+        // localhost / non-standard hosts → fall back to the api URL itself.
+        return apiBaseUrl;
+    }
+    catch {
+        return "https://app.zivis.ai";
+    }
+}
+//# sourceMappingURL=github-linkage-prompt.js.map

package/dist/internal/github-linkage-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-linkage-prompt.js","sourceRoot":"","sources":["../../src/internal/github-linkage-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAwB9C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B;IAE5B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,yDAAyD;IACzD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;QACvF,OAAO,mBAAmB,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,oEAAoE;IACpE,sDAAsD;IACtD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qBAAqB;AAErB,KAAK,UAAU,oBAAoB,CACjC,MAAmB,EACnB,KAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,wBAAwB,EAAE;YACpE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAmB,EACnB,KAAsB,EACtB,aAAqB;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,MAAM,CAAC,UAAU,qBAAqB,kBAAkB,CAAC,aAAa,CAAC,eAAe,EACzF,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,IAAI,GAA2B;QACnC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,YAAY;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;IACrD,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mBAAmB;AAEnB,SAAS,mBAAmB,CAAC,UAAkB,EAAE,KAAuB;IACtE,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,wCAAwC,UAAU,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,EAAE;QACF,oCAAoC;QACpC,KAAK,UAAU,EAAE;QACjB,2EAA2E;KAC5E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAmB,EACnB,aAAqB,EACrB,KAAuB;IAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,GAAG,OAAO,iBAAiB,aAAa,EAAE,CAAC;IACvD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,kDAAkD,GAAG,EAAE,CAAC;IACjE,CAAC;IACD,OAAO;QACL,EAAE;QACF,8CAA8C;QAC9C,KAAK,GAAG,EAAE;QACV,oEAAoE;KACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,CAAC,CAAC,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QACD,oEAAoE;QACpE,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sBAAsB,CAAC;IAChC,CAAC;AACH,CAAC"}