@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.40

package/dist/internal/extractor/graph-types.d.ts

@@ -0,0 +1,89 @@
+export type Lane = "trusted" | "inferred";
+export type Source = "inspect.trusted" | "inspect.inferred";
+export type GraphLanguage = "typescript" | "javascript" | "python" | "go";
+export type AnalysisMode = "local" | "cloud";
+export type EvidenceKind = "import" | "http_route" | "config" | "manifest" | "decorator" | "annotation";
+export type NodeType = "service" | "endpoint" | "external_dependency";
+export type EdgeType = "exposes" | "depends_on";
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "WS" | "SSE" | "RPC";
+export type DependencyRegistry = "npm" | "pypi" | "go";
+export interface EvidenceSpan {
+    file: string;
+    start_line?: number;
+    end_line?: number;
+    kind: EvidenceKind;
+    detail?: Record<string, unknown>;
+}
+export interface ServiceAttributes {
+    framework?: string;
+    source_files?: string[];
+}
+export interface EndpointAttributes {
+    method: HttpMethod;
+    path: string;
+}
+export interface ExternalDependencyAttributes {
+    package: string;
+    version?: string;
+    registry: DependencyRegistry;
+    kind?: string;
+}
+export type NodeAttributes = ServiceAttributes | EndpointAttributes | ExternalDependencyAttributes;
+interface BaseNode {
+    id: string;
+    name: string;
+    lane: Lane;
+    source: Source;
+    confidence?: number;
+    language?: GraphLanguage;
+    evidence: EvidenceSpan[];
+}
+export interface ServiceNode extends BaseNode {
+    type: "service";
+    attributes?: ServiceAttributes;
+}
+export interface EndpointNode extends BaseNode {
+    type: "endpoint";
+    attributes: EndpointAttributes;
+}
+export interface ExternalDependencyNode extends BaseNode {
+    type: "external_dependency";
+    attributes: ExternalDependencyAttributes;
+}
+export type GraphNode = ServiceNode | EndpointNode | ExternalDependencyNode;
+export interface GraphEdge {
+    id: string;
+    type: EdgeType;
+    source_id: string;
+    target_id: string;
+    lane: Lane;
+    source: Source;
+    confidence?: number;
+    evidence?: EvidenceSpan[];
+    attributes?: Record<string, unknown>;
+}
+export interface GraphProvenance {
+    root_dir: string;
+    repo_id?: string;
+    commit_sha?: string;
+    branch?: string;
+    application_id?: string;
+    analysis_mode: AnalysisMode;
+}
+export interface GraphScope {
+    files_scanned: number;
+    files_skipped: number;
+    duration_ms: number;
+    languages?: GraphLanguage[];
+}
+export interface RepoGraphArtifactV1 {
+    version: "1.0.0";
+    kind: "repo_graph_artifact";
+    extracted_at: string;
+    extractor: string;
+    provenance: GraphProvenance;
+    scope: GraphScope;
+    nodes: GraphNode[];
+    edges: GraphEdge[];
+}
+export {};

package/dist/internal/extractor/graph-types.js

@@ -0,0 +1 @@
+export {};

package/dist/internal/extractor/index.d.ts

@@ -1,22 +1,8 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import type { ExtractionResult } from "./types.js";
 export interface RunOptions {
     rootDir: string;
-    /** Subset of language adapters to run; defaults to all registered. */
     languages?: Array<"typescript" | "go" | "python">;
-    /** Extra ignore patterns from --ignore flags. */
     extraIgnores?: string[];
-    /** Version string for the extractor — usually @zivis/cli's package version. */
     extractorVersion: string;
 }
 export declare function runExtractor(opts: RunOptions): Promise<ExtractionResult>;

package/dist/internal/extractor/index.js

@@ -1,14 +1,3 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import * as path from "node:path";
 import { walk } from "./walker.js";
 import { typescriptAdapter } from "./adapters/typescript/index.js";
@@ -25,7 +14,6 @@ export async function runExtractor(opts) {
     const adapters = opts.languages
         ? ADAPTERS.filter((a) => opts.languages.includes(a.language))
         : ADAPTERS;
-    // Aggregate the file filters from each adapter so we walk the tree once.
     const extensions = new Set();
     const manifests = new Set();
     for (const a of adapters) {
@@ -104,4 +92,3 @@ function dedupeExternalServices(items) {
     }
     return [...out.values()];
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/types.d.ts

@@ -1,29 +1,3 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export type Language = "typescript" | "javascript" | "go" | "python";
 export interface EvidenceLocation {
     file: string;
@@ -44,21 +18,16 @@ export interface ConfigEvidence extends EvidenceLocation {
 export type Evidence = HttpRouteEvidence | ImportEvidence | ConfigEvidence;
 export type ComponentKind = "process" | "data_store" | "external_service" | "frontend";
 export interface ExtractedComponent {
-    /** Stable name derived from path / module — never a value from inside a function. */
     name: string;
     kind: ComponentKind;
     language: Language;
-    /** Detected web framework, if any (express | fastify | nextjs | trpc | hono | gin | echo | …). */
     framework?: string;
     sourceFiles: string[];
     evidence: Evidence[];
 }
 export interface ExtractedExternalService {
-    /** Vendor / SDK name — "Anthropic", "OpenAI", "WorkOS". */
     name: string;
-    /** What kind of integration: ai_sdk, payments, auth, observability, etc. */
     kind: string;
-    /** npm/PyPI/Go module identifier ("@anthropic-ai/sdk"). */
     package: string;
     version?: string;
     callSites: EvidenceLocation[];
@@ -84,30 +53,16 @@ export interface ExtractionResult {
     components: ExtractedComponent[];
     externalServices: ExtractedExternalService[];
     dataStores: ExtractedDataStore[];
-    /**
-     * Per-language manifests detected in the scope. Surfaces dependency-only
-     * findings (e.g., "this repo uses @anthropic-ai/sdk@^0.30") even when
-     * we can't yet match call sites.
-     */
     manifests: ManifestSummary[];
 }
 export interface ManifestSummary {
     language: Language;
     file: string;
-    /** Direct dependency names → version (verbatim from manifest). */
     dependencies: Record<string, string>;
 }
-/**
- * Adapter contract — one per language. Each adapter is fed the list of
- * source files matched for it (already filtered by .gitignore + .zivisignore)
- * plus any manifest files (package.json, go.mod, pyproject.toml). Returns
- * structured findings the framework merges into the final ExtractionResult.
- */
 export interface LanguageAdapter {
     language: Language;
-    /** File extensions this adapter handles. */
     extensions: string[];
-    /** Manifest filenames this adapter cares about. */
     manifests: string[];
     extract(input: AdapterInput): Promise<AdapterOutput>;
 }

package/dist/internal/extractor/types.js

@@ -1,28 +1 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/internal/extractor/walker.d.ts

@@ -1,24 +1,7 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 export interface WalkOptions {
     rootDir: string;
-    /** Extensions to include (with the leading dot, e.g. [".ts", ".tsx"]). */
     extensions: string[];
-    /** Manifest basenames to capture regardless of extension (e.g. ["package.json"]). */
     manifests: string[];
-    /** Extra ignore patterns from --ignore CLI flags. */
     extraIgnores?: string[];
 }
 export interface WalkResult {
@@ -28,5 +11,4 @@ export interface WalkResult {
     filesSkipped: number;
 }
 export declare function walk(opts: WalkOptions): Promise<WalkResult>;
-/** Convert an absolute path to a posix-style repo-relative path. */
 export declare function repoRelative(rootDir: string, absPath: string): string;

package/dist/internal/extractor/walker.js

@@ -1,17 +1,3 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import ignore from "ignore";
@@ -64,7 +50,6 @@ export async function walk(opts) {
                     filesSkipped++;
                     continue;
                 }
-                // ignore() expects gitignore-style paths with trailing /
                 if (ig.ignores(childRel + "/")) {
                     filesSkipped++;
                     continue;
@@ -99,12 +84,9 @@ async function loadIgnoreFile(ig, filePath) {
         ig.add(content);
     }
     catch {
-        // No ignore file — fine.
     }
 }
-/** Convert an absolute path to a posix-style repo-relative path. */
 export function repoRelative(rootDir, absPath) {
     const rel = path.relative(rootDir, absPath);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=walker.js.map

package/dist/internal/github-linkage-prompt.d.ts

@@ -0,0 +1,7 @@
+import type { ZivisConfig } from "@zivis/mcp/types";
+export interface BuildLinkagePromptOpts {
+    config: ZivisConfig;
+    applicationId?: string;
+    style?: "short" | "full";
+}
+export declare function buildLinkagePrompt(opts: BuildLinkagePromptOpts): Promise<string | null>;

package/dist/internal/github-linkage-prompt.js

@@ -0,0 +1,95 @@
+import { resolveAuth } from "@zivis/mcp/auth";
+export async function buildLinkagePrompt(opts) {
+    const creds = await resolveAuth(opts.config);
+    if (creds.method === "none")
+        return null;
+    const appStatus = await fetchGitHubAppStatus(opts.config, creds);
+    if (!appStatus)
+        return null;
+    if (!appStatus.installed) {
+        if (!appStatus.installUrl)
+            return null;
+        return formatInstallPrompt(appStatus.installUrl, opts.style ?? "full");
+    }
+    if (opts.applicationId) {
+        const repoStatus = await fetchAppRepoStatus(opts.config, creds, opts.applicationId);
+        if (repoStatus && !repoStatus.linked) {
+            return formatLinkRepoPrompt(opts.config, opts.applicationId, opts.style ?? "full");
+        }
+    }
+    return null;
+}
+async function fetchGitHubAppStatus(config, creds) {
+    try {
+        const res = await fetch(`${config.apiBaseUrl}/api/github-app/status`, {
+            headers: authHeaders(creds),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchAppRepoStatus(config, creds, applicationId) {
+    try {
+        const res = await fetch(`${config.apiBaseUrl}/api/applications/${encodeURIComponent(applicationId)}/repos/status`, { headers: authHeaders(creds) });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+function authHeaders(creds) {
+    const base = {
+        "Content-Type": "application/json",
+        "User-Agent": "@zivis/cli",
+    };
+    if (creds.method === "oauth" && creds.accessToken) {
+        base.Authorization = `Bearer ${creds.accessToken}`;
+    }
+    else if (creds.method === "apikey" && creds.apiKey) {
+        base["X-API-Key"] = creds.apiKey;
+    }
+    return base;
+}
+function formatInstallPrompt(installUrl, style) {
+    if (style === "short") {
+        return `Next: install the ZIVIS GitHub App — ${installUrl}`;
+    }
+    return [
+        "",
+        "Next: install the ZIVIS GitHub App",
+        `  ${installUrl}`,
+        "  Enables continuous monitoring + automatic threat-model updates on push.",
+    ].join("\n");
+}
+function formatLinkRepoPrompt(config, applicationId, style) {
+    const appBase = process.env.ZIVIS_APP_URL || guessAppUrlFromApi(config.apiBaseUrl);
+    const url = `${appBase}/applications/${applicationId}`;
+    if (style === "short") {
+        return `Next: link a GitHub repo to this application — ${url}`;
+    }
+    return [
+        "",
+        "Next: link a GitHub repo to this application",
+        `  ${url}`,
+        "  The GitHub App is installed but this app has no linked repo yet.",
+    ].join("\n");
+}
+function guessAppUrlFromApi(apiBaseUrl) {
+    try {
+        const u = new URL(apiBaseUrl);
+        if (u.host.startsWith("api.")) {
+            u.host = "app." + u.host.slice(4);
+            return `${u.protocol}//${u.host}`;
+        }
+        return apiBaseUrl;
+    }
+    catch {
+        return "https://app.zivis.ai";
+    }
+}

package/dist/internal/ide-setup.d.ts

@@ -1,7 +1,16 @@
-export declare function setupCursor(session?: string): Promise<void>;
-export declare function setupVsCodeCopilot(session?: string): Promise<void>;
-export declare function setupVsCodeClaude(session?: string): Promise<void>;
-export declare function setupClaudeCodeCli(session?: string): Promise<void>;
-export declare function setupCline(session?: string): Promise<void>;
-export declare function setupWindsurf(session?: string): Promise<void>;
-export declare function printClaudeCodeManual(session?: string): void;
+export type Package = "appsec" | "builder";
+export type GuidanceClient = "cursor" | "claude-code-cli" | "vscode-copilot" | "vscode-claude" | "cline" | "windsurf";
+export interface GuidanceOptions {
+    cwd: string;
+    client: GuidanceClient;
+}
+export declare function writeGuidance(opts: GuidanceOptions): string[];
+export declare function detectIdesInRepo(cwd: string): GuidanceClient[];
+export declare function setupCursor(pkg?: Package): Promise<void>;
+export declare function setupCursorWorkspace(pkg?: Package): Promise<void>;
+export declare function setupVsCodeCopilot(pkg?: Package): Promise<void>;
+export declare function setupVsCodeClaude(pkg?: Package): Promise<void>;
+export declare function setupClaudeCodeCli(pkg?: Package): Promise<void>;
+export declare function setupCline(pkg?: Package): Promise<void>;
+export declare function setupWindsurf(pkg?: Package): Promise<void>;
+export declare function printClaudeCodeManual(pkg?: Package): void;