@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.40

package/dist/internal/extractor/adapters/typescript/index.js

@@ -1,10 +1,3 @@
-/**
- * TypeScript / JavaScript language adapter.
- *
- * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
- * (cheap, runs against package.json) with AST scanning (per source file)
- * to produce components, external services, and data stores.
- */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -15,13 +8,10 @@ export const typescriptAdapter = {
     manifests: ["package.json"],
     async extract(input) {
         const { rootDir, sourceFiles, manifestFiles } = input;
-        // Manifest pass — fast, runs entirely on package.json contents.
         const parsedManifests = await readManifests(rootDir, manifestFiles);
         const manifestSummaries = summarizeManifests(parsedManifests);
         const manifestExternalServices = findExternalServices(parsedManifests);
         const manifestDataStores = findDataStores(parsedManifests);
-        // AST pass — only on source files. Cap at MAX_SOURCE_FILES per run
-        // for the Phase J <60s budget on a 100k-LOC monorepo.
         const MAX_SOURCE_FILES = 5_000;
         const filesToScan = sourceFiles.slice(0, MAX_SOURCE_FILES);
         const scans = await Promise.all(filesToScan.map(async (abs) => {
@@ -33,10 +23,7 @@ export const typescriptAdapter = {
             }
         }));
         const agg = aggregate(scans);
-        // Map scanner output → ExtractedComponent shape.
         const components = agg.components.map((c) => {
-            // Best-effort framework inference: scanner picks up imports; manifest
-            // picks up the dep. Either signal counts.
             const framework = c.framework ?? frameworkFromOwningManifest(c.sourceFile, parsedManifests);
             return {
                 name: c.name,
@@ -47,13 +34,11 @@ export const typescriptAdapter = {
                 evidence: [...c.routes, ...c.imports],
             };
         });
-        // Augment manifest-derived ExternalServices with AST call sites.
         for (const svc of manifestExternalServices) {
             const sites = agg.aiSdkCallSites.get(svc.package);
             if (sites)
                 svc.callSites.push(...sites);
         }
-        // Augment manifest-derived DataStores with import-evidence from source.
         for (const store of manifestDataStores) {
             if (!store.client)
                 continue;
@@ -69,16 +54,11 @@ export const typescriptAdapter = {
         };
     },
 };
-/**
- * Walk up from a source file's path to find the closest package.json
- * we parsed; return the framework hint from that manifest.
- */
 function frameworkFromOwningManifest(sourceFile, manifests) {
     const sourceDir = path.posix.dirname(sourceFile);
     const candidates = manifests
         .map((m) => ({ m, dir: path.posix.dirname(m.filePath) }))
         .filter(({ dir }) => sourceDir === dir || sourceDir.startsWith(dir + "/"))
-        .sort((a, b) => b.dir.length - a.dir.length); // closest wins
+        .sort((a, b) => b.dir.length - a.dir.length);
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/typescript/manifest.d.ts

@@ -1,11 +1,3 @@
-/**
- * TypeScript / JavaScript manifest analysis.
- *
- * Reads package.json files (root + workspaces) to classify dependencies
- * into the categories the threat-model graph cares about. Used both for
- * the manifests block of the output and as a hint for which AST queries
- * are worth running on which files.
- */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export interface PackageJson {
     name?: string;
@@ -28,14 +20,8 @@ export interface ParsedManifest {
     packageName?: string;
     deps: Record<string, string>;
 }
-/**
- * Read every package.json, return per-file dependency maps. Combines
- * dependencies + devDependencies (we want both — devDeps include things
- * like @types that signal use, plus dev-only auth packages).
- */
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedManifest[]>;
 export declare function summarizeManifests(parsed: ParsedManifest[]): ManifestSummary[];
 export declare function findExternalServices(parsed: ParsedManifest[]): ExtractedExternalService[];
 export declare function findDataStores(parsed: ParsedManifest[]): ExtractedDataStore[];
-/** Pick the most likely web framework for a manifest's owning package. */
 export declare function detectFrameworkFromManifest(m: ParsedManifest): string | undefined;

package/dist/internal/extractor/adapters/typescript/manifest.js

@@ -1,11 +1,3 @@
-/**
- * TypeScript / JavaScript manifest analysis.
- *
- * Reads package.json files (root + workspaces) to classify dependencies
- * into the categories the threat-model graph cares about. Used both for
- * the manifests block of the output and as a hint for which AST queries
- * are worth running on which files.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 export const WEB_FRAMEWORK_PACKAGES = {
@@ -15,9 +7,14 @@ export const WEB_FRAMEWORK_PACKAGES = {
     "@trpc/server": "trpc",
     hono: "hono",
     koa: "koa",
+    "@nestjs/core": "nestjs",
+    "@nestjs/common": "nestjs",
+    "@hapi/hapi": "hapi",
+    "express-graphql": "express",
+    "apollo-server-express": "express",
 };
 export const DATA_STORE_PACKAGES = {
-    "@prisma/client": { kind: "postgres", client: "@prisma/client" }, // assumes postgres; could be MySQL/SQLite via schema
+    "@prisma/client": { kind: "postgres", client: "@prisma/client" },
     pg: { kind: "postgres", client: "pg" },
     postgres: { kind: "postgres", client: "postgres" },
     mongoose: { kind: "mongo", client: "mongoose" },
@@ -38,11 +35,6 @@ export const AI_SDK_PACKAGES = {
     "@langchain/core": "LangChain",
     llamaindex: "LlamaIndex",
 };
-/**
- * Read every package.json, return per-file dependency maps. Combines
- * dependencies + devDependencies (we want both — devDeps include things
- * like @types that signal use, plus dev-only auth packages).
- */
 export async function readManifests(rootDir, manifestFiles) {
     const out = [];
     for (const file of manifestFiles) {
@@ -63,7 +55,6 @@ export async function readManifests(rootDir, manifestFiles) {
             });
         }
         catch {
-            // Skip broken JSON; not our job to validate the customer's manifests.
         }
     }
     return out;
@@ -98,6 +89,26 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
+        for (const [pkg, vendor] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
+            const ver = m.deps[pkg];
+            if (!ver)
+                continue;
+            const key = `web_framework::${pkg}`;
+            const existing = seen.get(key);
+            if (existing) {
+                existing.callSites.push({ file: m.filePath, line: 1 });
+                if (!existing.version)
+                    existing.version = ver;
+                continue;
+            }
+            seen.set(key, {
+                name: vendor,
+                kind: "web_framework",
+                package: pkg,
+                version: ver,
+                callSites: [{ file: m.filePath, line: 1 }],
+            });
+        }
     }
     return [...seen.values()];
 }
@@ -125,7 +136,6 @@ export function findDataStores(parsed) {
     }
     return [...seen.values()];
 }
-/** Pick the most likely web framework for a manifest's owning package. */
 export function detectFrameworkFromManifest(m) {
     for (const [pkg, framework] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
         if (m.deps[pkg])
@@ -153,4 +163,3 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/typescript/parser.d.ts

@@ -1,11 +1,3 @@
-/**
- * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
- * caches the parser+language for the rest of the run.
- *
- * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
- * need a build step on the user's machine. Loading a .wasm grammar is
- * O(50ms); parsing a TS file is O(low ms) per file.
- */
 import { Parser } from "web-tree-sitter";
 export declare function getParsers(): Promise<{
     parser: Parser;

package/dist/internal/extractor/adapters/typescript/parser.js

@@ -1,11 +1,3 @@
-/**
- * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
- * caches the parser+language for the rest of the run.
- *
- * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
- * need a build step on the user's machine. Loading a .wasm grammar is
- * O(50ms); parsing a TS file is O(low ms) per file.
- */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -30,4 +22,3 @@ export function getParsers() {
 export function pickParserForFile(file, parser, tsx) {
     return file.endsWith(".tsx") || file.endsWith(".jsx") ? tsx : parser;
 }
-//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/typescript/scanner.d.ts

@@ -1,24 +1,3 @@
-/**
- * AST scanner for TypeScript / JavaScript source files.
- *
- * For each file: parses with tree-sitter-typescript, walks the tree
- * looking for:
- *
- *   1. `import` / `require` statements naming any tracked package
- *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
- *      ExternalService call sites
- *   2. Express-style route declarations:
- *        app.METHOD("/path", ...)
- *        router.METHOD("/path", ...)
- *        server.METHOD("/path", ...)
- *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
- *      → HTTP-route-evidence on a component derived from the file
- *
- * Privacy invariant: we only ever emit identifier names, file paths,
- * line numbers, dependency identifiers, and HTTP method/path strings.
- * Function bodies and inline values are never read past the first arg
- * of a route call.
- */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;
@@ -27,7 +6,6 @@ export interface FileScanResult {
 }
 export declare function scanFile(absPath: string, repoRel: string): Promise<FileScanResult>;
 export interface ScannedAggregates {
-    /** Per-component findings (one per source file with relevant evidence). */
     components: Array<{
         name: string;
         sourceFile: string;
@@ -35,9 +13,7 @@ export interface ScannedAggregates {
         routes: HttpRouteEvidence[];
         imports: ImportEvidence[];
     }>;
-    /** Extra ExternalService call-site evidence beyond what the manifests gave. */
     aiSdkCallSites: Map<string, EvidenceLocation[]>;
-    /** Extra data-store evidence (when AST shows usage of e.g. `new Pool()` etc.; v1 just imports). */
     dataStoreEvidence: Map<string, Evidence[]>;
 }
 export declare function aggregate(scans: FileScanResult[]): ScannedAggregates;

package/dist/internal/extractor/adapters/typescript/scanner.js

@@ -1,24 +1,3 @@
-/**
- * AST scanner for TypeScript / JavaScript source files.
- *
- * For each file: parses with tree-sitter-typescript, walks the tree
- * looking for:
- *
- *   1. `import` / `require` statements naming any tracked package
- *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
- *      ExternalService call sites
- *   2. Express-style route declarations:
- *        app.METHOD("/path", ...)
- *        router.METHOD("/path", ...)
- *        server.METHOD("/path", ...)
- *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
- *      → HTTP-route-evidence on a component derived from the file
- *
- * Privacy invariant: we only ever emit identifier names, file paths,
- * line numbers, dependency identifiers, and HTTP method/path strings.
- * Function bodies and inline values are never read past the first arg
- * of a route call.
- */
 import * as fs from "node:fs/promises";
 import { getParsers, pickParserForFile } from "./parser.js";
 import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
@@ -75,35 +54,22 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
-/** Pull the string literal from `import … from "<here>"`. */
 function extractImportSource(node) {
-    // import_statement → ... → (string (string_fragment))
     const stringNode = node.children.find((c) => c?.type === "string");
     if (!stringNode)
         return null;
     const frag = stringNode.namedChildren.find((c) => c?.type === "string_fragment");
     return frag?.text ?? null;
 }
-/** Map a package import to a tracked-package identifier, allowing for sub-paths. */
 function trackedPackageMatch(pkg) {
     if (TRACKED_PACKAGES.has(pkg))
         return pkg;
-    // sub-paths: "@anthropic-ai/sdk/foo" → "@anthropic-ai/sdk"
     for (const tracked of TRACKED_PACKAGES) {
         if (pkg.startsWith(tracked + "/"))
             return tracked;
     }
     return null;
 }
-/**
- * Identify Express-style route calls. Only inspects the AST shape; never
- * reads the handler-function body.
- *
- * Matches:
- *   <ROUTER_IDENT>.<METHOD>("/path", ...)
- *
- * Where the second-and-onward args are deliberately ignored.
- */
 function extractRouteCall(node) {
     const fn = node.namedChildren.find((c) => c?.type === "member_expression");
     const args = node.namedChildren.find((c) => c?.type === "arguments");
@@ -119,7 +85,6 @@ function extractRouteCall(node) {
         return null;
     if (!HTTP_METHODS.has(methodName))
         return null;
-    // First arg should be a string literal — the route path.
     const firstArg = args.namedChildren[0];
     if (!firstArg || firstArg.type !== "string")
         return null;
@@ -135,8 +100,6 @@ export function aggregate(scans) {
     for (const s of scans) {
         if (s.routes.length === 0 && s.imports.length === 0)
             continue;
-        // Tag SDK call sites. Each tracked import of an AI SDK package
-        // counts as a call site for that vendor, on top of the manifest hit.
         for (const imp of s.imports) {
             if (AI_SDK_PACKAGES[imp.package]) {
                 const arr = aiSdkCallSites.get(imp.package) ?? [];
@@ -152,8 +115,6 @@ export function aggregate(scans) {
         }
         if (s.routes.length === 0)
             continue;
-        // Derive a friendly component name from the file path (the deepest
-        // meaningful directory). e.g. src/auth/login.ts → "auth".
         const name = deriveComponentName(s.file);
         const framework = detectFrameworkFromImports(s.imports);
         components.push({
@@ -168,10 +129,7 @@ export function aggregate(scans) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
-    // Drop "src" / "lib" / "app" prefixes so the name is meaningful.
     const start = ["src", "lib", "app"].includes(segs[0]) ? 1 : 0;
-    // Use the parent directory as the component (e.g. "auth"), or the
-    // filename root if the file lives at the top level.
     if (segs.length - start >= 2)
         return segs[start];
     const last = segs[segs.length - 1];
@@ -185,4 +143,3 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
-//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/graph-builder.d.ts

@@ -0,0 +1,10 @@
+import type { ExtractionResult } from "./types.js";
+import type { RepoGraphArtifactV1, AnalysisMode } from "./graph-types.js";
+export interface BuildOptions {
+    applicationId?: string;
+    repoId?: string;
+    commitSha?: string;
+    branch?: string;
+    analysisMode?: AnalysisMode;
+}
+export declare function buildRepoGraphArtifact(result: ExtractionResult, opts?: BuildOptions): RepoGraphArtifactV1;

package/dist/internal/extractor/graph-builder.js

@@ -0,0 +1,245 @@
+const TRUSTED_LANE = "trusted";
+const TRUSTED_SOURCE = "inspect.trusted";
+export function buildRepoGraphArtifact(result, opts = {}) {
+    const nodes = [];
+    const edges = [];
+    const serviceById = new Map();
+    for (const component of result.components) {
+        if (component.kind === "external_service" || component.kind === "data_store") {
+            continue;
+        }
+        if (component.evidence.length === 0)
+            continue;
+        const node = buildServiceNode(component);
+        serviceById.set(node.id, node);
+        nodes.push(node);
+    }
+    for (const component of result.components) {
+        const owningServiceId = serviceIdFor(component);
+        if (!serviceById.has(owningServiceId))
+            continue;
+        const seenEndpoints = new Set();
+        for (const ev of component.evidence) {
+            if (ev.kind !== "http_route")
+                continue;
+            const method = canonicalMethod(ev.method);
+            if (!method)
+                continue;
+            const endpointNode = buildEndpointNode(owningServiceId, component.language, ev, method);
+            if (seenEndpoints.has(endpointNode.id))
+                continue;
+            seenEndpoints.add(endpointNode.id);
+            nodes.push(endpointNode);
+            edges.push(buildExposesEdge(owningServiceId, endpointNode.id, ev));
+        }
+    }
+    const manifestEvidenceByPackage = indexManifestsByPackage(result);
+    const depById = new Map();
+    for (const ext of result.externalServices) {
+        const node = buildExternalDependencyNode(ext, manifestEvidenceByPackage.get(ext.package) ?? []);
+        if (depById.has(node.id))
+            continue;
+        if (node.evidence.length === 0)
+            continue;
+        depById.set(node.id, node);
+        nodes.push(node);
+    }
+    const fileToServiceId = buildFileToServiceIndex(result.components, serviceById);
+    for (const ext of result.externalServices) {
+        const depId = externalDepId(ext);
+        const seenServiceIds = new Set();
+        const evidenceByService = new Map();
+        for (const callSite of ext.callSites) {
+            const serviceId = fileToServiceId.get(callSite.file);
+            if (!serviceId)
+                continue;
+            seenServiceIds.add(serviceId);
+            const list = evidenceByService.get(serviceId) ?? [];
+            list.push(toImportEvidence(callSite, ext.package));
+            evidenceByService.set(serviceId, list);
+        }
+        for (const serviceId of seenServiceIds) {
+            edges.push(buildDependsOnEdge(serviceId, depId, evidenceByService.get(serviceId) ?? []));
+        }
+    }
+    const provenance = {
+        root_dir: result.scope.rootDir,
+        analysis_mode: opts.analysisMode ?? "local",
+        ...(opts.repoId ? { repo_id: opts.repoId } : {}),
+        ...(opts.commitSha ? { commit_sha: opts.commitSha } : {}),
+        ...(opts.branch ? { branch: opts.branch } : {}),
+        ...(opts.applicationId ? { application_id: opts.applicationId } : {}),
+    };
+    const languagesFromManifests = new Set(result.manifests.map((m) => normalizeLanguage(m.language)).filter(Boolean));
+    return {
+        version: "1.0.0",
+        kind: "repo_graph_artifact",
+        extracted_at: result.extractedAt,
+        extractor: result.extractor,
+        provenance,
+        scope: {
+            files_scanned: result.scope.filesScanned,
+            files_skipped: result.scope.filesSkipped,
+            duration_ms: result.scope.durationMs,
+            languages: [...languagesFromManifests],
+        },
+        nodes,
+        edges,
+    };
+}
+function buildServiceNode(component) {
+    const id = serviceIdFor(component);
+    return {
+        id,
+        type: "service",
+        name: component.name,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        language: normalizeLanguage(component.language),
+        evidence: component.evidence.map(toEvidenceSpan),
+        attributes: {
+            ...(component.framework ? { framework: component.framework } : {}),
+            source_files: component.sourceFiles,
+        },
+    };
+}
+function buildEndpointNode(serviceId, language, ev, method) {
+    const id = `endpoint::${stripPrefix(serviceId, "service::")}::${method}::${ev.path}`;
+    return {
+        id,
+        type: "endpoint",
+        name: `${method} ${ev.path}`,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        language: normalizeLanguage(language),
+        evidence: [toEvidenceSpan(ev)],
+        attributes: { method, path: ev.path },
+    };
+}
+function buildExternalDependencyNode(ext, manifestFallback) {
+    const registry = registryFor(ext);
+    const evidence = ext.callSites.length > 0
+        ? ext.callSites.map((cs) => toImportEvidence(cs, ext.package))
+        : manifestFallback;
+    return {
+        id: externalDepId(ext),
+        type: "external_dependency",
+        name: ext.name,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence,
+        attributes: {
+            package: ext.package,
+            registry,
+            ...(ext.version ? { version: ext.version } : {}),
+            ...(ext.kind ? { kind: ext.kind } : {}),
+        },
+    };
+}
+function indexManifestsByPackage(result) {
+    const idx = new Map();
+    for (const m of result.manifests) {
+        for (const pkg of Object.keys(m.dependencies)) {
+            const span = { file: m.file, kind: "manifest", detail: { package: pkg } };
+            const list = idx.get(pkg) ?? [];
+            list.push(span);
+            idx.set(pkg, list);
+        }
+    }
+    return idx;
+}
+function buildExposesEdge(serviceId, endpointId, ev) {
+    return {
+        id: `exposes::${serviceId}::${endpointId}`,
+        type: "exposes",
+        source_id: serviceId,
+        target_id: endpointId,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence: [toEvidenceSpan(ev)],
+    };
+}
+function buildDependsOnEdge(serviceId, depId, evidence) {
+    return {
+        id: `depends_on::${serviceId}::${depId}`,
+        type: "depends_on",
+        source_id: serviceId,
+        target_id: depId,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence,
+    };
+}
+function serviceIdFor(component) {
+    return `service::${component.language}::${component.name}`;
+}
+function externalDepId(ext) {
+    const registry = registryFor(ext);
+    return `external_dependency::${registry}::${ext.package}`;
+}
+function registryFor(ext) {
+    if (ext.package.startsWith("github.com/"))
+        return "go";
+    if (ext.package.startsWith("@") || /^[a-z0-9-]+$/.test(ext.package)) {
+        return "npm";
+    }
+    return "npm";
+}
+const CANONICAL_METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+    "OPTIONS",
+    "WS",
+    "SSE",
+    "RPC",
+]);
+function canonicalMethod(method) {
+    const upper = method.toUpperCase();
+    return CANONICAL_METHODS.has(upper) ? upper : undefined;
+}
+function normalizeLanguage(lang) {
+    return lang;
+}
+function buildFileToServiceIndex(components, servicesById) {
+    const idx = new Map();
+    for (const component of components) {
+        const id = serviceIdFor(component);
+        if (!servicesById.has(id))
+            continue;
+        for (const file of component.sourceFiles) {
+            if (!idx.has(file))
+                idx.set(file, id);
+        }
+    }
+    return idx;
+}
+function toEvidenceSpan(ev) {
+    const base = { file: ev.file, start_line: ev.line, kind: ev.kind };
+    if (ev.kind === "http_route") {
+        return { ...base, detail: { method: ev.method, path: ev.path } };
+    }
+    if (ev.kind === "import") {
+        return { ...base, detail: { package: ev.package } };
+    }
+    return base;
+}
+function toImportEvidence(loc, pkg) {
+    return {
+        file: loc.file,
+        start_line: loc.line,
+        kind: "import",
+        detail: { package: pkg },
+    };
+}
+function stripPrefix(value, prefix) {
+    return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+}