@zivis/cli 0.1.0-alpha.39 → 0.1.0-alpha.4

package/dist/internal/extractor/adapters/python/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/python/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAQvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAChF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,gDAAgD,CAAC;AAEzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACnC,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAQH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC9E,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAA0B;IACpD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC1C,4DAA4D;QAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,IAAI;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,oDAAoD;IACpD,uDAAuD;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAE7C,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;SAC3D,IAAI,QAAQ,KAAK,OAAO;QAAE,MAAM,GAAG,KAAK,CAAC,CAAC,wDAAwD;IACvG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,iEAAiE;IACjE,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,mDAAmD;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;YAAE,SAAS;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,oDAAoD;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8DAA8D;YAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD,MAAM,UAAU,SAAS,CAAC,KAAuB;IAC/C,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE9D,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,uCAAuC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAyB;IAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/internal/extractor/adapters/typescript/index.d.ts

@@ -1,2 +1,9 @@
+/**
+ * TypeScript / JavaScript language adapter.
+ *
+ * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
+ * (cheap, runs against package.json) with AST scanning (per source file)
+ * to produce components, external services, and data stores.
+ */
 import type { LanguageAdapter } from "../../types.js";
 export declare const typescriptAdapter: LanguageAdapter;

package/dist/internal/extractor/adapters/typescript/index.js

@@ -1,3 +1,10 @@
+/**
+ * TypeScript / JavaScript language adapter.
+ *
+ * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
+ * (cheap, runs against package.json) with AST scanning (per source file)
+ * to produce components, external services, and data stores.
+ */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -8,10 +15,13 @@ export const typescriptAdapter = {
     manifests: ["package.json"],
     async extract(input) {
         const { rootDir, sourceFiles, manifestFiles } = input;
+        // Manifest pass — fast, runs entirely on package.json contents.
         const parsedManifests = await readManifests(rootDir, manifestFiles);
         const manifestSummaries = summarizeManifests(parsedManifests);
         const manifestExternalServices = findExternalServices(parsedManifests);
         const manifestDataStores = findDataStores(parsedManifests);
+        // AST pass — only on source files. Cap at MAX_SOURCE_FILES per run
+        // for the Phase J <60s budget on a 100k-LOC monorepo.
         const MAX_SOURCE_FILES = 5_000;
         const filesToScan = sourceFiles.slice(0, MAX_SOURCE_FILES);
         const scans = await Promise.all(filesToScan.map(async (abs) => {
@@ -23,7 +33,10 @@ export const typescriptAdapter = {
             }
         }));
         const agg = aggregate(scans);
+        // Map scanner output → ExtractedComponent shape.
         const components = agg.components.map((c) => {
+            // Best-effort framework inference: scanner picks up imports; manifest
+            // picks up the dep. Either signal counts.
             const framework = c.framework ?? frameworkFromOwningManifest(c.sourceFile, parsedManifests);
             return {
                 name: c.name,
@@ -34,11 +47,13 @@ export const typescriptAdapter = {
                 evidence: [...c.routes, ...c.imports],
             };
         });
+        // Augment manifest-derived ExternalServices with AST call sites.
         for (const svc of manifestExternalServices) {
             const sites = agg.aiSdkCallSites.get(svc.package);
             if (sites)
                 svc.callSites.push(...sites);
         }
+        // Augment manifest-derived DataStores with import-evidence from source.
         for (const store of manifestDataStores) {
             if (!store.client)
                 continue;
@@ -54,11 +69,16 @@ export const typescriptAdapter = {
         };
     },
 };
+/**
+ * Walk up from a source file's path to find the closest package.json
+ * we parsed; return the framework hint from that manifest.
+ */
 function frameworkFromOwningManifest(sourceFile, manifests) {
     const sourceDir = path.posix.dirname(sourceFile);
     const candidates = manifests
         .map((m) => ({ m, dir: path.posix.dirname(m.filePath) }))
         .filter(({ dir }) => sourceDir === dir || sourceDir.startsWith(dir + "/"))
-        .sort((a, b) => b.dir.length - a.dir.length);
+        .sort((a, b) => b.dir.length - a.dir.length); // closest wins
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
+//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,2BAA2B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQ/C,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,cAAc,CAAC;IAC3B,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAEtD,gEAAgE;QAChE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;QAE3D,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,KAAK,CAAC;QAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAE7B,iDAAiD;QACjD,MAAM,UAAU,GAAyB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChE,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAC5F,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,YAAY;gBACtB,SAAS;gBACT,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC3B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;aACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,KAAK;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,EAAE;gBAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO;YACL,UAAU;YACV,gBAAgB,EAAE,wBAAwB;YAC1C,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,2BAA2B,CAClC,UAAkB,EAClB,SAAoD;IAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,SAAS;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;SACzE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;IAC/D,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC"}

package/dist/internal/extractor/adapters/typescript/manifest.d.ts

@@ -1,3 +1,11 @@
+/**
+ * TypeScript / JavaScript manifest analysis.
+ *
+ * Reads package.json files (root + workspaces) to classify dependencies
+ * into the categories the threat-model graph cares about. Used both for
+ * the manifests block of the output and as a hint for which AST queries
+ * are worth running on which files.
+ */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export interface PackageJson {
     name?: string;
@@ -20,8 +28,14 @@ export interface ParsedManifest {
     packageName?: string;
     deps: Record<string, string>;
 }
+/**
+ * Read every package.json, return per-file dependency maps. Combines
+ * dependencies + devDependencies (we want both — devDeps include things
+ * like @types that signal use, plus dev-only auth packages).
+ */
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedManifest[]>;
 export declare function summarizeManifests(parsed: ParsedManifest[]): ManifestSummary[];
 export declare function findExternalServices(parsed: ParsedManifest[]): ExtractedExternalService[];
 export declare function findDataStores(parsed: ParsedManifest[]): ExtractedDataStore[];
+/** Pick the most likely web framework for a manifest's owning package. */
 export declare function detectFrameworkFromManifest(m: ParsedManifest): string | undefined;

package/dist/internal/extractor/adapters/typescript/manifest.js

@@ -1,3 +1,11 @@
+/**
+ * TypeScript / JavaScript manifest analysis.
+ *
+ * Reads package.json files (root + workspaces) to classify dependencies
+ * into the categories the threat-model graph cares about. Used both for
+ * the manifests block of the output and as a hint for which AST queries
+ * are worth running on which files.
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 export const WEB_FRAMEWORK_PACKAGES = {
@@ -7,14 +15,9 @@ export const WEB_FRAMEWORK_PACKAGES = {
     "@trpc/server": "trpc",
     hono: "hono",
     koa: "koa",
-    "@nestjs/core": "nestjs",
-    "@nestjs/common": "nestjs",
-    "@hapi/hapi": "hapi",
-    "express-graphql": "express",
-    "apollo-server-express": "express",
 };
 export const DATA_STORE_PACKAGES = {
-    "@prisma/client": { kind: "postgres", client: "@prisma/client" },
+    "@prisma/client": { kind: "postgres", client: "@prisma/client" }, // assumes postgres; could be MySQL/SQLite via schema
     pg: { kind: "postgres", client: "pg" },
     postgres: { kind: "postgres", client: "postgres" },
     mongoose: { kind: "mongo", client: "mongoose" },
@@ -35,6 +38,11 @@ export const AI_SDK_PACKAGES = {
     "@langchain/core": "LangChain",
     llamaindex: "LlamaIndex",
 };
+/**
+ * Read every package.json, return per-file dependency maps. Combines
+ * dependencies + devDependencies (we want both — devDeps include things
+ * like @types that signal use, plus dev-only auth packages).
+ */
 export async function readManifests(rootDir, manifestFiles) {
     const out = [];
     for (const file of manifestFiles) {
@@ -55,6 +63,7 @@ export async function readManifests(rootDir, manifestFiles) {
             });
         }
         catch {
+            // Skip broken JSON; not our job to validate the customer's manifests.
         }
     }
     return out;
@@ -89,26 +98,6 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
-        for (const [pkg, vendor] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
-            const ver = m.deps[pkg];
-            if (!ver)
-                continue;
-            const key = `web_framework::${pkg}`;
-            const existing = seen.get(key);
-            if (existing) {
-                existing.callSites.push({ file: m.filePath, line: 1 });
-                if (!existing.version)
-                    existing.version = ver;
-                continue;
-            }
-            seen.set(key, {
-                name: vendor,
-                kind: "web_framework",
-                package: pkg,
-                version: ver,
-                callSites: [{ file: m.filePath, line: 1 }],
-            });
-        }
     }
     return [...seen.values()];
 }
@@ -136,6 +125,7 @@ export function findDataStores(parsed) {
     }
     return [...seen.values()];
 }
+/** Pick the most likely web framework for a manifest's owning package. */
 export function detectFrameworkFromManifest(m) {
     for (const [pkg, framework] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
         if (m.deps[pkg])
@@ -163,3 +153,4 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
+//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/typescript/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAYlC,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,QAAQ;IACd,cAAc,EAAE,MAAM;IACtB,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAyE;IACvG,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,qDAAqD;IACvH,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;IACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IAClD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;IAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACzC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3C,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,mBAAmB,EAAE,WAAW;IAChC,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,eAAe;IACnB,+BAA+B,EAAE,4BAA4B;IAC7D,uBAAuB,EAAE,sBAAsB;IAC/C,iCAAiC,EAAE,aAAa;IAChD,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY;CACzB,CAAC;AAQF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,aAAuB;IAC1E,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;YAC5C,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;gBACjC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,CAAC,CAAC,QAAQ;QAChB,YAAY,EAAE,CAAC,CAAC,IAAI;KACrB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,WAAW,GAAG,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvD,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG;gBACZ,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,CAAiB;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAgC;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/internal/extractor/adapters/typescript/parser.d.ts

@@ -1,3 +1,11 @@
+/**
+ * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
+ * caches the parser+language for the rest of the run.
+ *
+ * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
+ * need a build step on the user's machine. Loading a .wasm grammar is
+ * O(50ms); parsing a TS file is O(low ms) per file.
+ */
 import { Parser } from "web-tree-sitter";
 export declare function getParsers(): Promise<{
     parser: Parser;

package/dist/internal/extractor/adapters/typescript/parser.js

@@ -1,3 +1,11 @@
+/**
+ * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
+ * caches the parser+language for the rest of the run.
+ *
+ * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
+ * need a build step on the user's machine. Loading a .wasm grammar is
+ * O(50ms); parsing a TS file is O(low ms) per file.
+ */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -22,3 +30,4 @@ export function getParsers() {
 export function pickParserForFile(file, parser, tsx) {
     return file.endsWith(".tsx") || file.endsWith(".jsx") ? tsx : parser;
 }
+//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/typescript/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,IAAI,aAAa,GAAoD,IAAI,CAAC;AAE1E,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC"}

package/dist/internal/extractor/adapters/typescript/scanner.d.ts

@@ -1,3 +1,24 @@
+/**
+ * AST scanner for TypeScript / JavaScript source files.
+ *
+ * For each file: parses with tree-sitter-typescript, walks the tree
+ * looking for:
+ *
+ *   1. `import` / `require` statements naming any tracked package
+ *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
+ *      ExternalService call sites
+ *   2. Express-style route declarations:
+ *        app.METHOD("/path", ...)
+ *        router.METHOD("/path", ...)
+ *        server.METHOD("/path", ...)
+ *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
+ *      → HTTP-route-evidence on a component derived from the file
+ *
+ * Privacy invariant: we only ever emit identifier names, file paths,
+ * line numbers, dependency identifiers, and HTTP method/path strings.
+ * Function bodies and inline values are never read past the first arg
+ * of a route call.
+ */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;
@@ -6,6 +27,7 @@ export interface FileScanResult {
 }
 export declare function scanFile(absPath: string, repoRel: string): Promise<FileScanResult>;
 export interface ScannedAggregates {
+    /** Per-component findings (one per source file with relevant evidence). */
     components: Array<{
         name: string;
         sourceFile: string;
@@ -13,7 +35,9 @@ export interface ScannedAggregates {
         routes: HttpRouteEvidence[];
         imports: ImportEvidence[];
     }>;
+    /** Extra ExternalService call-site evidence beyond what the manifests gave. */
     aiSdkCallSites: Map<string, EvidenceLocation[]>;
+    /** Extra data-store evidence (when AST shows usage of e.g. `new Pool()` etc.; v1 just imports). */
     dataStoreEvidence: Map<string, Evidence[]>;
 }
 export declare function aggregate(scans: FileScanResult[]): ScannedAggregates;

package/dist/internal/extractor/adapters/typescript/scanner.js

@@ -1,3 +1,24 @@
+/**
+ * AST scanner for TypeScript / JavaScript source files.
+ *
+ * For each file: parses with tree-sitter-typescript, walks the tree
+ * looking for:
+ *
+ *   1. `import` / `require` statements naming any tracked package
+ *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
+ *      ExternalService call sites
+ *   2. Express-style route declarations:
+ *        app.METHOD("/path", ...)
+ *        router.METHOD("/path", ...)
+ *        server.METHOD("/path", ...)
+ *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
+ *      → HTTP-route-evidence on a component derived from the file
+ *
+ * Privacy invariant: we only ever emit identifier names, file paths,
+ * line numbers, dependency identifiers, and HTTP method/path strings.
+ * Function bodies and inline values are never read past the first arg
+ * of a route call.
+ */
 import * as fs from "node:fs/promises";
 import { getParsers, pickParserForFile } from "./parser.js";
 import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
@@ -54,22 +75,35 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
+/** Pull the string literal from `import … from "<here>"`. */
 function extractImportSource(node) {
+    // import_statement → ... → (string (string_fragment))
     const stringNode = node.children.find((c) => c?.type === "string");
     if (!stringNode)
         return null;
     const frag = stringNode.namedChildren.find((c) => c?.type === "string_fragment");
     return frag?.text ?? null;
 }
+/** Map a package import to a tracked-package identifier, allowing for sub-paths. */
 function trackedPackageMatch(pkg) {
     if (TRACKED_PACKAGES.has(pkg))
         return pkg;
+    // sub-paths: "@anthropic-ai/sdk/foo" → "@anthropic-ai/sdk"
     for (const tracked of TRACKED_PACKAGES) {
         if (pkg.startsWith(tracked + "/"))
             return tracked;
     }
     return null;
 }
+/**
+ * Identify Express-style route calls. Only inspects the AST shape; never
+ * reads the handler-function body.
+ *
+ * Matches:
+ *   <ROUTER_IDENT>.<METHOD>("/path", ...)
+ *
+ * Where the second-and-onward args are deliberately ignored.
+ */
 function extractRouteCall(node) {
     const fn = node.namedChildren.find((c) => c?.type === "member_expression");
     const args = node.namedChildren.find((c) => c?.type === "arguments");
@@ -85,6 +119,7 @@ function extractRouteCall(node) {
         return null;
     if (!HTTP_METHODS.has(methodName))
         return null;
+    // First arg should be a string literal — the route path.
     const firstArg = args.namedChildren[0];
     if (!firstArg || firstArg.type !== "string")
         return null;
@@ -100,6 +135,8 @@ export function aggregate(scans) {
     for (const s of scans) {
         if (s.routes.length === 0 && s.imports.length === 0)
             continue;
+        // Tag SDK call sites. Each tracked import of an AI SDK package
+        // counts as a call site for that vendor, on top of the manifest hit.
         for (const imp of s.imports) {
             if (AI_SDK_PACKAGES[imp.package]) {
                 const arr = aiSdkCallSites.get(imp.package) ?? [];
@@ -115,6 +152,8 @@ export function aggregate(scans) {
         }
         if (s.routes.length === 0)
             continue;
+        // Derive a friendly component name from the file path (the deepest
+        // meaningful directory). e.g. src/auth/login.ts → "auth".
         const name = deriveComponentName(s.file);
         const framework = detectFrameworkFromImports(s.imports);
         components.push({
@@ -129,7 +168,10 @@ export function aggregate(scans) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
+    // Drop "src" / "lib" / "app" prefixes so the name is meaningful.
     const start = ["src", "lib", "app"].includes(segs[0]) ? 1 : 0;
+    // Use the parent directory as the component (e.g. "auth"), or the
+    // filename root if the file lives at the top level.
     if (segs.length - start >= 2)
         return segs[start];
     const last = segs[segs.length - 1];
@@ -143,3 +185,4 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
+//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/typescript/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAQvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACnC,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAQH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAe;IAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,OAAO,EAAE,GAAG;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAA0B;IACpD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,mBAAmB,CAAC,IAAY;IACvC,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACpG,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,2DAA2D;IAC3D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC;IACxF,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACtG,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAiBD,MAAM,UAAU,SAAS,CAAC,KAAuB;IAC/C,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE9D,+DAA+D;QAC/D,qEAAqE;QACrE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,iEAAiE;IACjE,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,kEAAkE;IAClE,oDAAoD;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAyB;IAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/internal/extractor/index.d.ts

@@ -1,8 +1,22 @@
+/**
+ * Extractor orchestrator.
+ *
+ * Walks the customer's repo, dispatches matched files to per-language
+ * adapters, merges their findings into a single ExtractionResult.
+ *
+ * Adapters register their own file extensions + manifest filenames; the
+ * walker only reads files those filters claim. So adding a Go or Python
+ * adapter doesn't change anything here — register the adapter and the
+ * orchestrator picks up its files.
+ */
 import type { ExtractionResult } from "./types.js";
 export interface RunOptions {
     rootDir: string;
+    /** Subset of language adapters to run; defaults to all registered. */
     languages?: Array<"typescript" | "go" | "python">;
+    /** Extra ignore patterns from --ignore flags. */
     extraIgnores?: string[];
+    /** Version string for the extractor — usually @zivis/cli's package version. */
     extractorVersion: string;
 }
 export declare function runExtractor(opts: RunOptions): Promise<ExtractionResult>;

package/dist/internal/extractor/index.js

@@ -1,3 +1,14 @@
+/**
+ * Extractor orchestrator.
+ *
+ * Walks the customer's repo, dispatches matched files to per-language
+ * adapters, merges their findings into a single ExtractionResult.
+ *
+ * Adapters register their own file extensions + manifest filenames; the
+ * walker only reads files those filters claim. So adding a Go or Python
+ * adapter doesn't change anything here — register the adapter and the
+ * orchestrator picks up its files.
+ */
 import * as path from "node:path";
 import { walk } from "./walker.js";
 import { typescriptAdapter } from "./adapters/typescript/index.js";
@@ -14,6 +25,7 @@ export async function runExtractor(opts) {
     const adapters = opts.languages
         ? ADAPTERS.filter((a) => opts.languages.includes(a.language))
         : ADAPTERS;
+    // Aggregate the file filters from each adapter so we walk the tree once.
     const extensions = new Set();
     const manifests = new Set();
     for (const a of adapters) {
@@ -92,3 +104,4 @@ function dedupeExternalServices(items) {
     }
     return [...out.values()];
 }
+//# sourceMappingURL=index.js.map

package/dist/internal/extractor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/extractor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAoB3D,MAAM,QAAQ,GAAsB;IAClC,iBAAiB;IACjB,SAAS;IACT,aAAa;CACd,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS;QAC7B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAe,CAAC,CAAC;QACrE,CAAC,CAAC,QAAQ,CAAC;IAEb,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;QAC3B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,MAAM,gBAAgB,GAA+B,EAAE,CAAC;IACxD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAsB,EAAE,CAAC;IAEhD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAErE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,iBAAiB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,cAAc,IAAI,CAAC,gBAAgB,EAAE;QAChD,KAAK,EAAE;YACL,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC;QACD,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;QACxC,gBAAgB,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QAC1D,UAAU;QACV,SAAS,EAAE,iBAAiB;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA2B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;YAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAiC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;YAAE,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACjE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/internal/extractor/types.d.ts

@@ -1,3 +1,29 @@
+/**
+ * Extractor output schema.
+ *
+ * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
+ * for privacy-audit metadata. The shape is the contract between the CLI
+ * and the eventual `--apply` endpoint that maps into ThreatModelComponent
+ * / OrgComponent records (RECON.3-gated).
+ *
+ * Privacy invariant — what's IN the JSON:
+ *   component names ("auth-service")
+ *   file paths ("src/auth/login.ts")
+ *   line numbers (42)
+ *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
+ *   detected protocols / methods (POST /login)
+ *   dependency versions (from package.json / go.mod / pyproject.toml)
+ *
+ * What's NOT:
+ *   function bodies, file contents, code snippets
+ *   variable names from inside functions
+ *   comments
+ *   raw AST nodes
+ *
+ * `zivis tm extract --privacy-audit` prints this whole object to stdout
+ * before any network call, so the customer can see exactly what would
+ * be sent.
+ */
 export type Language = "typescript" | "javascript" | "go" | "python";
 export interface EvidenceLocation {
     file: string;
@@ -18,16 +44,21 @@ export interface ConfigEvidence extends EvidenceLocation {
 export type Evidence = HttpRouteEvidence | ImportEvidence | ConfigEvidence;
 export type ComponentKind = "process" | "data_store" | "external_service" | "frontend";
 export interface ExtractedComponent {
+    /** Stable name derived from path / module — never a value from inside a function. */
     name: string;
     kind: ComponentKind;
     language: Language;
+    /** Detected web framework, if any (express | fastify | nextjs | trpc | hono | gin | echo | …). */
     framework?: string;
     sourceFiles: string[];
     evidence: Evidence[];
 }
 export interface ExtractedExternalService {
+    /** Vendor / SDK name — "Anthropic", "OpenAI", "WorkOS". */
     name: string;
+    /** What kind of integration: ai_sdk, payments, auth, observability, etc. */
     kind: string;
+    /** npm/PyPI/Go module identifier ("@anthropic-ai/sdk"). */
     package: string;
     version?: string;
     callSites: EvidenceLocation[];
@@ -53,16 +84,30 @@ export interface ExtractionResult {
     components: ExtractedComponent[];
     externalServices: ExtractedExternalService[];
     dataStores: ExtractedDataStore[];
+    /**
+     * Per-language manifests detected in the scope. Surfaces dependency-only
+     * findings (e.g., "this repo uses @anthropic-ai/sdk@^0.30") even when
+     * we can't yet match call sites.
+     */
     manifests: ManifestSummary[];
 }
 export interface ManifestSummary {
     language: Language;
     file: string;
+    /** Direct dependency names → version (verbatim from manifest). */
     dependencies: Record<string, string>;
 }
+/**
+ * Adapter contract — one per language. Each adapter is fed the list of
+ * source files matched for it (already filtered by .gitignore + .zivisignore)
+ * plus any manifest files (package.json, go.mod, pyproject.toml). Returns
+ * structured findings the framework merges into the final ExtractionResult.
+ */
 export interface LanguageAdapter {
     language: Language;
+    /** File extensions this adapter handles. */
     extensions: string[];
+    /** Manifest filenames this adapter cares about. */
     manifests: string[];
     extract(input: AdapterInput): Promise<AdapterOutput>;
 }

package/dist/internal/extractor/types.js

@@ -1 +1,28 @@
+/**
+ * Extractor output schema.
+ *
+ * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
+ * for privacy-audit metadata. The shape is the contract between the CLI
+ * and the eventual `--apply` endpoint that maps into ThreatModelComponent
+ * / OrgComponent records (RECON.3-gated).
+ *
+ * Privacy invariant — what's IN the JSON:
+ *   component names ("auth-service")
+ *   file paths ("src/auth/login.ts")
+ *   line numbers (42)
+ *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
+ *   detected protocols / methods (POST /login)
+ *   dependency versions (from package.json / go.mod / pyproject.toml)
+ *
+ * What's NOT:
+ *   function bodies, file contents, code snippets
+ *   variable names from inside functions
+ *   comments
+ *   raw AST nodes
+ *
+ * `zivis tm extract --privacy-audit` prints this whole object to stdout
+ * before any network call, so the customer can see exactly what would
+ * be sent.
+ */
 export {};
+//# sourceMappingURL=types.js.map

package/dist/internal/extractor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/internal/extractor/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/internal/extractor/walker.d.ts

@@ -1,7 +1,24 @@
+/**
+ * Filesystem walker — yields source files relative to the scan root,
+ * filtered by .gitignore + .zivisignore + per-extractor extension filters.
+ *
+ * Uses the `ignore` npm package (the same engine git ships with) so the
+ * matching semantics mirror what developers expect from .gitignore.
+ *
+ * Hard limits:
+ *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
+ *    if not in .gitignore. These exist by convention and contain
+ *    third-party code that pollutes the inventory.
+ *  - Caps total files at 50_000 to refuse to scan a generated monorepo
+ *    by accident (extractor would take forever; user should narrow scope).
+ */
 export interface WalkOptions {
     rootDir: string;
+    /** Extensions to include (with the leading dot, e.g. [".ts", ".tsx"]). */
     extensions: string[];
+    /** Manifest basenames to capture regardless of extension (e.g. ["package.json"]). */
     manifests: string[];
+    /** Extra ignore patterns from --ignore CLI flags. */
     extraIgnores?: string[];
 }
 export interface WalkResult {
@@ -11,4 +28,5 @@ export interface WalkResult {
     filesSkipped: number;
 }
 export declare function walk(opts: WalkOptions): Promise<WalkResult>;
+/** Convert an absolute path to a posix-style repo-relative path. */
 export declare function repoRelative(rootDir: string, absPath: string): string;