@zivis/cli 0.1.0-alpha.34 → 0.1.0-alpha.36

package/dist/commands/inspect/index.d.ts

@@ -1,17 +1,2 @@
-/**
- * `zivis inspect` — local repo graph extraction.
- *
- * Walks the repo with the existing extractor, converts the result into a
- * RepoGraphArtifactV1 (the canonical contract), and writes it to the
- * user-level cache. This is the user-facing entrypoint for Phase 1 of the
- * local repo graph + pattern library work.
- *
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
- * Schema: schemas/repo-graph-artifact.schema.json
- *
- * The command is local-only and never makes network calls. Persistence to
- * the platform happens in a separate step (Phase 4 — `/inspect` upload),
- * gated on Application mapping resolution per plan §Repo->Application Mapping.
- */
 import type { Command } from "commander";
 export declare function registerInspectCommands(program: Command): void;

package/dist/commands/inspect/index.js

@@ -1,18 +1,3 @@
-/**
- * `zivis inspect` — local repo graph extraction.
- *
- * Walks the repo with the existing extractor, converts the result into a
- * RepoGraphArtifactV1 (the canonical contract), and writes it to the
- * user-level cache. This is the user-facing entrypoint for Phase 1 of the
- * local repo graph + pattern library work.
- *
- * Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
- * Schema: schemas/repo-graph-artifact.schema.json
- *
- * The command is local-only and never makes network calls. Persistence to
- * the platform happens in a separate step (Phase 4 — `/inspect` upload),
- * gated on Application mapping resolution per plan §Repo->Application Mapping.
- */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
@@ -115,12 +100,6 @@ function deriveRepoId(remoteUrl, rootDir) {
 function sha256Short(value) {
     return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
 }
-/**
- * XDG-compliant user cache root. Layout follows the plan §2A:
- *   macOS:   ~/Library/Caches/zivis
- *   Linux:   $XDG_CACHE_HOME/zivis  (or ~/.cache/zivis)
- *   Windows: %LOCALAPPDATA%\zivis\Cache
- */
 function userCacheRoot() {
     const home = os.homedir();
     if (process.platform === "darwin") {
@@ -138,7 +117,6 @@ function defaultCacheOutPath(repoId, commitSha, extractedAt) {
     return path.join(userCacheRoot(), "repos", repoId, "inspect", "runs", `${runId}.json`);
 }
 function formatRunId(commitSha, extractedAt) {
-    // <short-commit>-<compact-iso>  e.g. abc1234-20260505T201600Z
     const compactTs = extractedAt.replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
     if (!commitSha)
         return `nogit-${compactTs}`;
@@ -156,4 +134,3 @@ function printSummary(artifact, suffix) {
         `  ${artifact.edges.length} edges  (${exposes} exposes, ${dependsOn} depends_on)\n` +
         (suffix ? `  ${suffix}\n` : ""));
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/mcp/index.js

@@ -12,10 +12,6 @@ const KNOWN_CLIENTS = [
     "vscode-copilot",
     "vscode-claude",
 ];
-/**
- * Map the CLI --client value to the GuidanceClient type used by writeGuidance().
- * "claude-code" (manual) has no guidance files — skip it.
- */
 function toGuidanceClient(client) {
     switch (client) {
         case "cursor": return "cursor";
@@ -97,23 +93,19 @@ export function registerMcpCommands(program) {
             console.error("Install failed:", err instanceof Error ? err.message : err);
             process.exit(1);
         }
-        // "claude-code" is manual — no guidance files to write
         if (client === "claude-code")
             return;
         const guidanceClient = toGuidanceClient(client);
         if (!guidanceClient)
             return;
-        // Determine whether to write guidance files
         let shouldWrite;
         if (opts.withGuidance) {
             shouldWrite = true;
         }
         else if (opts.guidance === false) {
-            // Commander sets opts.guidance = false when --no-guidance is passed
             shouldWrite = false;
         }
         else {
-            // Interactive default
             console.log("");
             shouldWrite = await promptYesNo("Write ZIVIS guidance files so your IDE knows when to suggest security checks?\n" +
                 "(Adds a rule/instruction file to the project. You can edit or remove it anytime.) [Y/n] ");
@@ -133,4 +125,3 @@ export function registerMcpCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/open/index.d.ts

@@ -1,10 +1,2 @@
-/**
- * `zivis open` — Build and (by default) launch a vscode:// or cursor:// deep link
- * that opens a ZIVIS artifact in the ZIVIS Code IDE extension. Use `--ide cursor`
- * for Cursor. With --print, emit the URI to stdout for piping/sharing.
- *
- * Mirrors the URI shape emitted by the `zivis_open_in_ide` MCP tool and the
- * web app's buildIdeLink() helper. See docs/platform/integrations/IDE-DEEP-LINKS.md.
- */
 import type { Command } from "commander";
 export declare function registerOpenCommands(program: Command): void;

package/dist/commands/open/index.js

@@ -1,11 +1,3 @@
-/**
- * `zivis open` — Build and (by default) launch a vscode:// or cursor:// deep link
- * that opens a ZIVIS artifact in the ZIVIS Code IDE extension. Use `--ide cursor`
- * for Cursor. With --print, emit the URI to stdout for piping/sharing.
- *
- * Mirrors the URI shape emitted by the `zivis_open_in_ide` MCP tool and the
- * web app's buildIdeLink() helper. See docs/platform/integrations/IDE-DEEP-LINKS.md.
- */
 const KINDS = ["diagram", "document", "threat-model"];
 export function registerOpenCommands(program) {
     program
@@ -47,11 +39,8 @@ export function registerOpenCommands(program) {
             console.log(uri);
             return;
         }
-        // Lazy-import `open` so --print stays dependency-free in environments
-        // (e.g. headless CI) where launching a URL handler would fail or hang.
         const { default: open } = await import("open");
         await open(uri);
         console.log(uri);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/scan/index.js

@@ -118,11 +118,6 @@ export function registerScanCommands(program) {
         }
     });
 }
-/**
- * Map customer-facing ApplicationType to the RT scan's targetType enum.
- * The two enums differ historically: ApplicationType is product-shape,
- * targetType is what the RT runner needs to know about the wire format.
- */
 function appTypeToTargetType(appType) {
     switch (appType) {
         case "agent":
@@ -137,4 +132,3 @@ function appTypeToTargetType(appType) {
             return undefined;
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/target/index.js

@@ -4,8 +4,6 @@ import { getStorageName } from "../../internal/target-auth/keychain.js";
 import { decodeJwtPayload } from "../../internal/target-auth/workos.js";
 const DEFAULT_PERSONA = "default";
 function warnDeprecated() {
-    // stderr so it doesn't pollute stdout (CLI scripts pipe `zivis target token`
-    // straight into curl). One line, no color codes — keeps grep-friendly.
     console.error("[zivis] WARNING: 'zivis target' is deprecated; use 'zivis app' instead.");
 }
 export function registerTargetCommands(program) {
@@ -143,4 +141,3 @@ export function registerTargetCommands(program) {
         console.log(`✓ Cleared tokens for target ${targetId} (persona: ${opts.persona})`);
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/commands/tm/index.js

@@ -14,7 +14,6 @@ function collect(value, previous) {
     return previous.concat([value]);
 }
 function defaultOutPath(extractedAt) {
-    // .zivis/extracted/<iso-no-colons>.json — matches the doc's example.
     const ts = extractedAt.replace(/[:.]/g, "-");
     return `.zivis/extracted/${ts}.json`;
 }
@@ -80,9 +79,6 @@ export function registerTmCommands(program) {
             process.exit(1);
         });
         const parsed = JSON.parse(raw);
-        // Only fields the PATCH endpoint accepts. tm pull dumps the full
-        // record; tm push only sends the editable subset, so a round-trip
-        // edit cycle Just Works.
         const payload = {};
         for (const k of ["name", "description", "status", "campaignId"]) {
             if (parsed[k] !== undefined)
@@ -123,8 +119,6 @@ export function registerTmCommands(program) {
             extractorVersion: cliPkg.version,
         });
         if (opts.privacyAudit) {
-            // Prints the entire object that WOULD be sent to ZIVIS via --apply.
-            // Never makes a network call; the extractor itself is local-only.
             process.stdout.write(JSON.stringify(result, null, 2) + "\n");
             process.stderr.write(`\n[zivis] Privacy audit: ${result.scope.filesScanned} files scanned, ` +
                 `${result.components.length} component(s), ${result.externalServices.length} external service(s), ` +
@@ -263,4 +257,3 @@ export function registerTmCommands(program) {
         }
     });
 }
-//# sourceMappingURL=index.js.map

package/dist/index.js

@@ -4,6 +4,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { registerAuthCommands } from "./commands/auth/index.js";
+import { initCommand as authInitCommand } from "./commands/auth/init.js";
 import { registerAppCommands } from "./commands/app/index.js";
 import { registerTargetCommands } from "./commands/target/index.js";
 import { registerTmCommands } from "./commands/tm/index.js";
@@ -28,6 +29,14 @@ program
     .name("zivis")
     .description("ZIVIS CLI — threat modeling, scans, and MCP server")
     .version(getVersion(), "-v, --version", "show version");
+program
+    .command("init")
+    .description("interactive setup: authenticate, pick org, and bind this repo (alias for `zivis auth init`)")
+    .option("-s, --session <name>", "named session for multi-tenant")
+    .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")
+    .action(async (opts) => {
+    await authInitCommand(opts);
+});
 registerAuthCommands(program);
 registerCheckCommands(program);
 registerAppCommands(program);
@@ -42,4 +51,3 @@ program.parseAsync(process.argv).catch((err) => {
     console.error(err instanceof Error ? err.message : err);
     process.exit(1);
 });
-//# sourceMappingURL=index.js.map

package/dist/internal/binding-token-mint.d.ts

@@ -1,7 +1,3 @@
-/**
- * Mint a Local Project Binding Token via POST /api/auth/bind and store it as
- * apikey.<session>. Shared by `zivis auth bind` and post-login auto-mint.
- */
 import { type ZivisConfig } from "@zivis/mcp/types";
 export type MintBindingTokenResult = {
     ok: true;
@@ -13,10 +9,6 @@ export type MintBindingTokenResult = {
     ok: false;
     error: string;
 };
-/**
- * Calls the bind API with a fresh access JWT and persists the minted WorkOS API key.
- * Does not start OAuth nor update IDE configs.
- */
 export declare function mintLocalProjectBindingToken(params: {
     config: ZivisConfig;
     session: string;
@@ -27,35 +19,14 @@ export interface TryAutoMintOptions {
     cwd: string;
     sessionName: string;
     accessToken: string;
-    /** Caller flag (e.g. `zivis auth login --no-mint-key`). */
     skip?: boolean;
-    /**
-     * When false (login after ensureProjectBinding): mint failures log a warning and return.
-     * When true (`zivis auth bind`): caller should exit 1 if result not ok — not handled here.
-     */
     warnOnFailure: boolean;
 }
-/**
- * After OAuth login finishes, mint an MCP-friendly API key if the repo is bound
- * and JWT org matches `.zivis/project.json`.
- * Skips if `apikey.<session>` already exists (avoid spawning keys on every login).
- */
 export declare function tryAutoMintBindingTokenAfterLogin(opts: TryAutoMintOptions): Promise<{
     ran: boolean;
     ok: boolean;
     message?: string;
 }>;
-/**
- * Drop the OAuth tokens stored under `oauth.<session>` (or `oauth` when no
- * session). OAuth exists only to mint the MCP API key — once login finishes,
- * MCP and tenant API calls go through `apikey.<session>`. Keeping the OAuth
- * tokens around adds attack surface and risks org-drift if the refresh token
- * outlives the binding.
- *
- * Verifies the delete actually emptied the keychain before returning — macOS
- * keychain access prompts can be denied without surfacing an error code, and
- * stale duplicates from older builds can mask a successful single delete.
- */
 export declare function discardOauthAfterLogin(params: {
     session: string | undefined;
     config: ZivisConfig;

package/dist/internal/binding-token-mint.js

@@ -1,7 +1,3 @@
-/**
- * Mint a Local Project Binding Token via POST /api/auth/bind and store it as
- * apikey.<session>. Shared by `zivis auth bind` and post-login auto-mint.
- */
 import * as os from "node:os";
 import * as crypto from "node:crypto";
 import * as child_process from "node:child_process";
@@ -9,7 +5,6 @@ import { getSessionAccount, keychainClearSession, keychainRead, keychainStore, }
 import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
 import { DEFAULT_CONFIG, credentialStorageFromConfig } from "@zivis/mcp/types";
 import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
-/** Same fingerprint strategy as bind command — stable-ish per-repo key name suffix. */
 function getRepoFingerprint(cwd) {
     try {
         const remote = child_process
@@ -20,14 +15,9 @@ function getRepoFingerprint(cwd) {
         }
     }
     catch {
-        /* no git or no remote */
     }
     return crypto.createHash("sha256").update(cwd).digest("hex").slice(0, 12);
 }
-/**
- * Calls the bind API with a fresh access JWT and persists the minted WorkOS API key.
- * Does not start OAuth nor update IDE configs.
- */
 export async function mintLocalProjectBindingToken(params) {
     const { config, session, accessToken, cwd } = params;
     const credentialStorage = credentialStorageFromConfig(config);
@@ -77,11 +67,6 @@ export async function mintLocalProjectBindingToken(params) {
         workosOrgId: bindResult.workosOrgId,
     };
 }
-/**
- * After OAuth login finishes, mint an MCP-friendly API key if the repo is bound
- * and JWT org matches `.zivis/project.json`.
- * Skips if `apikey.<session>` already exists (avoid spawning keys on every login).
- */
 export async function tryAutoMintBindingTokenAfterLogin(opts) {
     if (opts.skip) {
         return { ran: false, ok: true };
@@ -147,24 +132,12 @@ export async function tryAutoMintBindingTokenAfterLogin(opts) {
     console.log(`✓ MCP API key stored (${result.keyName}; org: ${result.orgName})`);
     return { ran: true, ok: true };
 }
-/**
- * Drop the OAuth tokens stored under `oauth.<session>` (or `oauth` when no
- * session). OAuth exists only to mint the MCP API key — once login finishes,
- * MCP and tenant API calls go through `apikey.<session>`. Keeping the OAuth
- * tokens around adds attack surface and risks org-drift if the refresh token
- * outlives the binding.
- *
- * Verifies the delete actually emptied the keychain before returning — macOS
- * keychain access prompts can be denied without surfacing an error code, and
- * stale duplicates from older builds can mask a successful single delete.
- */
 export async function discardOauthAfterLogin(params) {
     const storage = credentialStorageFromConfig(params.config);
     try {
         await keychainClearSession(params.session, storage);
     }
     catch {
-        /* No-op — see verify step below. */
     }
     const leftover = await keychainRead(getSessionAccount(params.session), storage).catch(() => null);
     if (leftover) {
@@ -199,4 +172,3 @@ function printMintFailureBanner(message) {
     console.error(bar);
     console.error("");
 }
-//# sourceMappingURL=binding-token-mint.js.map

package/dist/internal/extractor/adapters/go/index.d.ts

@@ -1,7 +1,3 @@
-/**
- * Go language adapter. Same shape as the TypeScript adapter — manifest
- * pass + AST pass — different parser + framework table.
- */
 import type { LanguageAdapter } from "../../types.js";
 export declare const goAdapter: LanguageAdapter;
 export declare const _stdlibFrameworkSet: Set<string>;

package/dist/internal/extractor/adapters/go/index.js

@@ -1,7 +1,3 @@
-/**
- * Go language adapter. Same shape as the TypeScript adapter — manifest
- * pass + AST pass — different parser + framework table.
- */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, STDLIB_FRAMEWORKS, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -66,6 +62,4 @@ function frameworkFromOwningManifest(sourceFile, manifests) {
         .sort((a, b) => b.dir.length - a.dir.length);
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
-// Used by orchestrator-side typing to widen the language union if needed.
 export const _stdlibFrameworkSet = STDLIB_FRAMEWORKS;
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/go/manifest.d.ts

@@ -1,14 +1,5 @@
-/**
- * Go manifest analysis.
- *
- * Parses go.mod (line-based, no real grammar needed) to build the
- * dependency map. Doesn't read go.sum — that's a hash list, not version
- * authority. Direct vs indirect deps are both in the require block;
- * we keep the // indirect annotation as a hint but don't filter on it.
- */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export declare const WEB_FRAMEWORK_MODULES: Record<string, string>;
-/** stdlib router lives at "net/http"; not in go.mod, only detected via imports. */
 export declare const STDLIB_FRAMEWORKS: Set<string>;
 export declare const DATA_STORE_MODULES: Record<string, {
     kind: ExtractedDataStore["kind"];
@@ -19,17 +10,9 @@ export interface ParsedGoMod {
     filePath: string;
     module?: string;
     goVersion?: string;
-    /** module path → version. */
     deps: Record<string, string>;
 }
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedGoMod[]>;
-/**
- * Minimal go.mod parser. Supports the two block forms:
- *   require modulePath v1.2.3
- *   require ( modulePath v1.2.3 \n other v0.0.1 )
- * Strips trailing "// indirect" markers. Does NOT handle replace/exclude
- * directives (out of scope for inventory).
- */
 export declare function parseGoMod(filePath: string, rootDir: string, raw: string): ParsedGoMod;
 export declare function summarizeManifests(parsed: ParsedGoMod[]): ManifestSummary[];
 export declare function findExternalServices(parsed: ParsedGoMod[]): ExtractedExternalService[];

package/dist/internal/extractor/adapters/go/manifest.js

@@ -1,11 +1,3 @@
-/**
- * Go manifest analysis.
- *
- * Parses go.mod (line-based, no real grammar needed) to build the
- * dependency map. Doesn't read go.sum — that's a hash list, not version
- * authority. Direct vs indirect deps are both in the require block;
- * we keep the // indirect annotation as a hint but don't filter on it.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 export const WEB_FRAMEWORK_MODULES = {
@@ -18,14 +10,13 @@ export const WEB_FRAMEWORK_MODULES = {
     "github.com/gofiber/fiber/v2": "fiber",
     "github.com/gorilla/mux": "gorilla-mux",
 };
-/** stdlib router lives at "net/http"; not in go.mod, only detected via imports. */
 export const STDLIB_FRAMEWORKS = new Set(["net/http"]);
 export const DATA_STORE_MODULES = {
     "github.com/jackc/pgx": { kind: "postgres", client: "pgx" },
     "github.com/jackc/pgx/v5": { kind: "postgres", client: "pgx" },
     "github.com/jackc/pgx/v4": { kind: "postgres", client: "pgx" },
     "github.com/lib/pq": { kind: "postgres", client: "pq" },
-    "gorm.io/gorm": { kind: "postgres", client: "gorm" }, // dialect varies; gorm itself is most often pg
+    "gorm.io/gorm": { kind: "postgres", client: "gorm" },
     "go.mongodb.org/mongo-driver": { kind: "mongo", client: "mongo-driver" },
     "github.com/redis/go-redis": { kind: "redis", client: "go-redis" },
     "github.com/redis/go-redis/v9": { kind: "redis", client: "go-redis" },
@@ -48,18 +39,10 @@ export async function readManifests(rootDir, manifestFiles) {
             out.push(parseGoMod(file, rootDir, raw));
         }
         catch {
-            // skip unreadable
         }
     }
     return out;
 }
-/**
- * Minimal go.mod parser. Supports the two block forms:
- *   require modulePath v1.2.3
- *   require ( modulePath v1.2.3 \n other v0.0.1 )
- * Strips trailing "// indirect" markers. Does NOT handle replace/exclude
- * directives (out of scope for inventory).
- */
 export function parseGoMod(filePath, rootDir, raw) {
     const lines = raw.split("\n");
     const result = {
@@ -92,7 +75,6 @@ export function parseGoMod(filePath, rootDir, raw) {
             body = body.slice("require ".length).trim();
         else if (!inBlock)
             continue;
-        // Strip "// indirect" / other line comments
         const commentAt = body.indexOf("//");
         if (commentAt >= 0)
             body = body.slice(0, commentAt).trim();
@@ -184,14 +166,9 @@ export function detectFrameworkFromManifest(m) {
     }
     return undefined;
 }
-/**
- * Match a module path including its versioned variants (mod, mod/v2, etc.).
- * Returns the version of the first match.
- */
 function matchModuleVersion(deps, modulePath) {
     if (deps[modulePath])
         return deps[modulePath];
-    // Try versioned variants
     for (const [k, v] of Object.entries(deps)) {
         if (k === modulePath)
             return v;
@@ -214,4 +191,3 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/go/parser.d.ts

@@ -1,6 +1,2 @@
-/**
- * tree-sitter-go loader. Lazy-init, reuses the same WASM directory as
- * the TypeScript adapter (both come from @vscode/tree-sitter-wasm).
- */
 import { Parser } from "web-tree-sitter";
 export declare function getGoParser(): Promise<Parser>;

package/dist/internal/extractor/adapters/go/parser.js

@@ -1,7 +1,3 @@
-/**
- * tree-sitter-go loader. Lazy-init, reuses the same WASM directory as
- * the TypeScript adapter (both come from @vscode/tree-sitter-wasm).
- */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -20,4 +16,3 @@ export function getGoParser() {
     }
     return parserPromise;
 }
-//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/go/scanner.d.ts

@@ -1,23 +1,3 @@
-/**
- * AST scanner for Go source files.
- *
- * Walks tree-sitter-go for two things:
- *
- *   1. import declarations naming any tracked module (AI SDKs, web
- *      frameworks, DB clients) → ImportEvidence
- *   2. HTTP route calls. Three flavors:
- *        net/http  : http.HandleFunc("/path", h)
- *        chi       : r.Get("/path", h), r.Post(…)        (TitleCase)
- *        echo/gin  : e.GET("/path", h), r.POST(…)        (UPPER)
- *        fiber     : app.Get("/path", h), app.Post(…)    (TitleCase)
- *
- * Method-name normalization happens after we identify the call-shape;
- * output is always UPPERCASE in the JSON.
- *
- * Privacy invariant: same as the TS adapter — only identifier names,
- * file paths, line numbers, package paths, and route method/path strings.
- * Function bodies are never read.
- */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;

package/dist/internal/extractor/adapters/go/scanner.js

@@ -1,23 +1,3 @@
-/**
- * AST scanner for Go source files.
- *
- * Walks tree-sitter-go for two things:
- *
- *   1. import declarations naming any tracked module (AI SDKs, web
- *      frameworks, DB clients) → ImportEvidence
- *   2. HTTP route calls. Three flavors:
- *        net/http  : http.HandleFunc("/path", h)
- *        chi       : r.Get("/path", h), r.Post(…)        (TitleCase)
- *        echo/gin  : e.GET("/path", h), r.POST(…)        (UPPER)
- *        fiber     : app.Get("/path", h), app.Post(…)    (TitleCase)
- *
- * Method-name normalization happens after we identify the call-shape;
- * output is always UPPERCASE in the JSON.
- *
- * Privacy invariant: same as the TS adapter — only identifier names,
- * file paths, line numbers, package paths, and route method/path strings.
- * Function bodies are never read.
- */
 import * as fs from "node:fs/promises";
 import { getGoParser } from "./parser.js";
 import { AI_SDK_MODULES, DATA_STORE_MODULES, WEB_FRAMEWORK_MODULES, STDLIB_FRAMEWORKS, } from "./manifest.js";
@@ -74,64 +54,45 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
-/** Pull the quoted module path out of an import_spec node. */
 function extractImportPath(node) {
-    // import_spec → optional package_identifier + interpreted_string_literal
     const stringNode = node.namedChildren.find((c) => c?.type === "interpreted_string_literal");
     if (!stringNode)
         return null;
-    // text is the quoted form; strip the surrounding quotes.
     const text = stringNode.text;
     return text.length >= 2 ? text.slice(1, -1) : null;
 }
 function trackedModuleMatch(pkg) {
     if (TRACKED_MODULES.has(pkg))
         return pkg;
-    // Sub-package import — e.g., "github.com/jackc/pgx/v5/pgxpool"
     for (const tracked of TRACKED_MODULES) {
         if (pkg.startsWith(tracked + "/"))
             return tracked;
     }
     return null;
 }
-/**
- * Match an HTTP-route call by inspecting the call-expression shape.
- * Two AST patterns to handle:
- *   - selector_expression(operand=identifier, field=field_identifier) called with args
- *     ⇒ http.HandleFunc, app.Get, e.GET, r.Post …
- *   - identifier called with args (rare for routes; ignored)
- */
 function extractRouteCall(node) {
-    // call_expression has: function (selector_expression | identifier) + argument_list
     const fn = node.namedChildren.find((c) => c?.type === "selector_expression");
     const args = node.namedChildren.find((c) => c?.type === "argument_list");
     if (!fn || !args)
         return null;
-    // selector_expression: operand (any) . field (field_identifier)
     const operand = fn.namedChildren[0];
     const field = fn.namedChildren.find((c) => c?.type === "field_identifier");
     if (!operand || !field)
         return null;
     const operandText = operand.text;
     const fieldName = field.text;
-    // Determine the HTTP method from the field name + operand shape.
     let method = null;
     if (HTTP_METHODS_UPPER.has(fieldName)) {
-        // echo/gin: e.GET, r.POST … — operand is a router-like local var
         method = fieldName === "ANY" ? "ALL" : fieldName;
     }
     else if (HTTP_METHODS_TITLE.has(fieldName)) {
-        // chi/fiber: r.Get, app.Post …
         method = fieldName.toUpperCase();
     }
     else if (STDLIB_HANDLER_FNS.has(fieldName) && operandText === "http") {
-        // net/http: http.HandleFunc("/x", h) / http.Handle("/x", h)
-        // We don't know the HTTP verb statically — emit "ALL".
         method = "ALL";
     }
     if (!method)
         return null;
-    // First arg = string literal route path.
     const firstArg = args.namedChildren[0];
     if (!firstArg)
         return null;
@@ -150,7 +111,6 @@ export function aggregate(scans) {
         if (s.routes.length === 0 && s.imports.length === 0)
             continue;
         for (const imp of s.imports) {
-            // Match against the FULL tracked module (allowing sub-paths).
             const matched = matchTracked(imp.package);
             if (!matched)
                 continue;
@@ -191,8 +151,6 @@ function matchTracked(pkg) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
-    // Go convention: cmd/foo/main.go → "foo"; internal/auth/handler.go → "auth"
-    // Use the deepest directory that isn't a stdlib-ish folder name.
     const skipPrefixes = new Set(["cmd", "internal", "pkg", "src", "app"]);
     const start = skipPrefixes.has(segs[0]) ? 1 : 0;
     if (segs.length - start >= 2)
@@ -213,4 +171,3 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
-//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/python/index.d.ts

@@ -1,5 +1,2 @@
-/**
- * Python language adapter. Same shape as TS/Go.
- */
 import type { LanguageAdapter } from "../../types.js";
 export declare const pythonAdapter: LanguageAdapter;

package/dist/internal/extractor/adapters/python/index.js

@@ -1,6 +1,3 @@
-/**
- * Python language adapter. Same shape as TS/Go.
- */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -65,4 +62,3 @@ function frameworkFromOwningManifest(sourceFile, manifests) {
         .sort((a, b) => b.dir.length - a.dir.length);
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
-//# sourceMappingURL=index.js.map