@zivis/cli 0.1.0-alpha.4 → 0.1.0-alpha.41

package/dist/internal/extractor/adapters/typescript/scanner.js

@@ -1,24 +1,3 @@
-/**
- * AST scanner for TypeScript / JavaScript source files.
- *
- * For each file: parses with tree-sitter-typescript, walks the tree
- * looking for:
- *
- *   1. `import` / `require` statements naming any tracked package
- *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
- *      ExternalService call sites
- *   2. Express-style route declarations:
- *        app.METHOD("/path", ...)
- *        router.METHOD("/path", ...)
- *        server.METHOD("/path", ...)
- *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
- *      → HTTP-route-evidence on a component derived from the file
- *
- * Privacy invariant: we only ever emit identifier names, file paths,
- * line numbers, dependency identifiers, and HTTP method/path strings.
- * Function bodies and inline values are never read past the first arg
- * of a route call.
- */
 import * as fs from "node:fs/promises";
 import { getParsers, pickParserForFile } from "./parser.js";
 import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
@@ -75,35 +54,22 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
-/** Pull the string literal from `import … from "<here>"`. */
 function extractImportSource(node) {
-    // import_statement → ... → (string (string_fragment))
     const stringNode = node.children.find((c) => c?.type === "string");
     if (!stringNode)
         return null;
     const frag = stringNode.namedChildren.find((c) => c?.type === "string_fragment");
     return frag?.text ?? null;
 }
-/** Map a package import to a tracked-package identifier, allowing for sub-paths. */
 function trackedPackageMatch(pkg) {
     if (TRACKED_PACKAGES.has(pkg))
         return pkg;
-    // sub-paths: "@anthropic-ai/sdk/foo" → "@anthropic-ai/sdk"
     for (const tracked of TRACKED_PACKAGES) {
         if (pkg.startsWith(tracked + "/"))
             return tracked;
     }
     return null;
 }
-/**
- * Identify Express-style route calls. Only inspects the AST shape; never
- * reads the handler-function body.
- *
- * Matches:
- *   <ROUTER_IDENT>.<METHOD>("/path", ...)
- *
- * Where the second-and-onward args are deliberately ignored.
- */
 function extractRouteCall(node) {
     const fn = node.namedChildren.find((c) => c?.type === "member_expression");
     const args = node.namedChildren.find((c) => c?.type === "arguments");
@@ -119,7 +85,6 @@ function extractRouteCall(node) {
         return null;
     if (!HTTP_METHODS.has(methodName))
         return null;
-    // First arg should be a string literal — the route path.
     const firstArg = args.namedChildren[0];
     if (!firstArg || firstArg.type !== "string")
         return null;
@@ -135,8 +100,6 @@ export function aggregate(scans) {
     for (const s of scans) {
         if (s.routes.length === 0 && s.imports.length === 0)
             continue;
-        // Tag SDK call sites. Each tracked import of an AI SDK package
-        // counts as a call site for that vendor, on top of the manifest hit.
         for (const imp of s.imports) {
             if (AI_SDK_PACKAGES[imp.package]) {
                 const arr = aiSdkCallSites.get(imp.package) ?? [];
@@ -152,8 +115,6 @@ export function aggregate(scans) {
         }
         if (s.routes.length === 0)
             continue;
-        // Derive a friendly component name from the file path (the deepest
-        // meaningful directory). e.g. src/auth/login.ts → "auth".
         const name = deriveComponentName(s.file);
         const framework = detectFrameworkFromImports(s.imports);
         components.push({
@@ -168,10 +129,7 @@ export function aggregate(scans) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
-    // Drop "src" / "lib" / "app" prefixes so the name is meaningful.
     const start = ["src", "lib", "app"].includes(segs[0]) ? 1 : 0;
-    // Use the parent directory as the component (e.g. "auth"), or the
-    // filename root if the file lives at the top level.
     if (segs.length - start >= 2)
         return segs[start];
     const last = segs[segs.length - 1];
@@ -185,4 +143,3 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
-//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/graph-builder.d.ts

@@ -0,0 +1,10 @@
+import type { ExtractionResult } from "./types.js";
+import type { RepoGraphArtifactV1, AnalysisMode } from "./graph-types.js";
+export interface BuildOptions {
+    applicationId?: string;
+    repoId?: string;
+    commitSha?: string;
+    branch?: string;
+    analysisMode?: AnalysisMode;
+}
+export declare function buildRepoGraphArtifact(result: ExtractionResult, opts?: BuildOptions): RepoGraphArtifactV1;

package/dist/internal/extractor/graph-builder.js

@@ -0,0 +1,245 @@
+const TRUSTED_LANE = "trusted";
+const TRUSTED_SOURCE = "inspect.trusted";
+export function buildRepoGraphArtifact(result, opts = {}) {
+    const nodes = [];
+    const edges = [];
+    const serviceById = new Map();
+    for (const component of result.components) {
+        if (component.kind === "external_service" || component.kind === "data_store") {
+            continue;
+        }
+        if (component.evidence.length === 0)
+            continue;
+        const node = buildServiceNode(component);
+        serviceById.set(node.id, node);
+        nodes.push(node);
+    }
+    for (const component of result.components) {
+        const owningServiceId = serviceIdFor(component);
+        if (!serviceById.has(owningServiceId))
+            continue;
+        const seenEndpoints = new Set();
+        for (const ev of component.evidence) {
+            if (ev.kind !== "http_route")
+                continue;
+            const method = canonicalMethod(ev.method);
+            if (!method)
+                continue;
+            const endpointNode = buildEndpointNode(owningServiceId, component.language, ev, method);
+            if (seenEndpoints.has(endpointNode.id))
+                continue;
+            seenEndpoints.add(endpointNode.id);
+            nodes.push(endpointNode);
+            edges.push(buildExposesEdge(owningServiceId, endpointNode.id, ev));
+        }
+    }
+    const manifestEvidenceByPackage = indexManifestsByPackage(result);
+    const depById = new Map();
+    for (const ext of result.externalServices) {
+        const node = buildExternalDependencyNode(ext, manifestEvidenceByPackage.get(ext.package) ?? []);
+        if (depById.has(node.id))
+            continue;
+        if (node.evidence.length === 0)
+            continue;
+        depById.set(node.id, node);
+        nodes.push(node);
+    }
+    const fileToServiceId = buildFileToServiceIndex(result.components, serviceById);
+    for (const ext of result.externalServices) {
+        const depId = externalDepId(ext);
+        const seenServiceIds = new Set();
+        const evidenceByService = new Map();
+        for (const callSite of ext.callSites) {
+            const serviceId = fileToServiceId.get(callSite.file);
+            if (!serviceId)
+                continue;
+            seenServiceIds.add(serviceId);
+            const list = evidenceByService.get(serviceId) ?? [];
+            list.push(toImportEvidence(callSite, ext.package));
+            evidenceByService.set(serviceId, list);
+        }
+        for (const serviceId of seenServiceIds) {
+            edges.push(buildDependsOnEdge(serviceId, depId, evidenceByService.get(serviceId) ?? []));
+        }
+    }
+    const provenance = {
+        root_dir: result.scope.rootDir,
+        analysis_mode: opts.analysisMode ?? "local",
+        ...(opts.repoId ? { repo_id: opts.repoId } : {}),
+        ...(opts.commitSha ? { commit_sha: opts.commitSha } : {}),
+        ...(opts.branch ? { branch: opts.branch } : {}),
+        ...(opts.applicationId ? { application_id: opts.applicationId } : {}),
+    };
+    const languagesFromManifests = new Set(result.manifests.map((m) => normalizeLanguage(m.language)).filter(Boolean));
+    return {
+        version: "1.0.0",
+        kind: "repo_graph_artifact",
+        extracted_at: result.extractedAt,
+        extractor: result.extractor,
+        provenance,
+        scope: {
+            files_scanned: result.scope.filesScanned,
+            files_skipped: result.scope.filesSkipped,
+            duration_ms: result.scope.durationMs,
+            languages: [...languagesFromManifests],
+        },
+        nodes,
+        edges,
+    };
+}
+function buildServiceNode(component) {
+    const id = serviceIdFor(component);
+    return {
+        id,
+        type: "service",
+        name: component.name,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        language: normalizeLanguage(component.language),
+        evidence: component.evidence.map(toEvidenceSpan),
+        attributes: {
+            ...(component.framework ? { framework: component.framework } : {}),
+            source_files: component.sourceFiles,
+        },
+    };
+}
+function buildEndpointNode(serviceId, language, ev, method) {
+    const id = `endpoint::${stripPrefix(serviceId, "service::")}::${method}::${ev.path}`;
+    return {
+        id,
+        type: "endpoint",
+        name: `${method} ${ev.path}`,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        language: normalizeLanguage(language),
+        evidence: [toEvidenceSpan(ev)],
+        attributes: { method, path: ev.path },
+    };
+}
+function buildExternalDependencyNode(ext, manifestFallback) {
+    const registry = registryFor(ext);
+    const evidence = ext.callSites.length > 0
+        ? ext.callSites.map((cs) => toImportEvidence(cs, ext.package))
+        : manifestFallback;
+    return {
+        id: externalDepId(ext),
+        type: "external_dependency",
+        name: ext.name,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence,
+        attributes: {
+            package: ext.package,
+            registry,
+            ...(ext.version ? { version: ext.version } : {}),
+            ...(ext.kind ? { kind: ext.kind } : {}),
+        },
+    };
+}
+function indexManifestsByPackage(result) {
+    const idx = new Map();
+    for (const m of result.manifests) {
+        for (const pkg of Object.keys(m.dependencies)) {
+            const span = { file: m.file, kind: "manifest", detail: { package: pkg } };
+            const list = idx.get(pkg) ?? [];
+            list.push(span);
+            idx.set(pkg, list);
+        }
+    }
+    return idx;
+}
+function buildExposesEdge(serviceId, endpointId, ev) {
+    return {
+        id: `exposes::${serviceId}::${endpointId}`,
+        type: "exposes",
+        source_id: serviceId,
+        target_id: endpointId,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence: [toEvidenceSpan(ev)],
+    };
+}
+function buildDependsOnEdge(serviceId, depId, evidence) {
+    return {
+        id: `depends_on::${serviceId}::${depId}`,
+        type: "depends_on",
+        source_id: serviceId,
+        target_id: depId,
+        lane: TRUSTED_LANE,
+        source: TRUSTED_SOURCE,
+        confidence: 1,
+        evidence,
+    };
+}
+function serviceIdFor(component) {
+    return `service::${component.language}::${component.name}`;
+}
+function externalDepId(ext) {
+    const registry = registryFor(ext);
+    return `external_dependency::${registry}::${ext.package}`;
+}
+function registryFor(ext) {
+    if (ext.package.startsWith("github.com/"))
+        return "go";
+    if (ext.package.startsWith("@") || /^[a-z0-9-]+$/.test(ext.package)) {
+        return "npm";
+    }
+    return "npm";
+}
+const CANONICAL_METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+    "OPTIONS",
+    "WS",
+    "SSE",
+    "RPC",
+]);
+function canonicalMethod(method) {
+    const upper = method.toUpperCase();
+    return CANONICAL_METHODS.has(upper) ? upper : undefined;
+}
+function normalizeLanguage(lang) {
+    return lang;
+}
+function buildFileToServiceIndex(components, servicesById) {
+    const idx = new Map();
+    for (const component of components) {
+        const id = serviceIdFor(component);
+        if (!servicesById.has(id))
+            continue;
+        for (const file of component.sourceFiles) {
+            if (!idx.has(file))
+                idx.set(file, id);
+        }
+    }
+    return idx;
+}
+function toEvidenceSpan(ev) {
+    const base = { file: ev.file, start_line: ev.line, kind: ev.kind };
+    if (ev.kind === "http_route") {
+        return { ...base, detail: { method: ev.method, path: ev.path } };
+    }
+    if (ev.kind === "import") {
+        return { ...base, detail: { package: ev.package } };
+    }
+    return base;
+}
+function toImportEvidence(loc, pkg) {
+    return {
+        file: loc.file,
+        start_line: loc.line,
+        kind: "import",
+        detail: { package: pkg },
+    };
+}
+function stripPrefix(value, prefix) {
+    return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+}

package/dist/internal/extractor/graph-types.d.ts

@@ -0,0 +1,89 @@
+export type Lane = "trusted" | "inferred";
+export type Source = "inspect.trusted" | "inspect.inferred";
+export type GraphLanguage = "typescript" | "javascript" | "python" | "go";
+export type AnalysisMode = "local" | "cloud";
+export type EvidenceKind = "import" | "http_route" | "config" | "manifest" | "decorator" | "annotation";
+export type NodeType = "service" | "endpoint" | "external_dependency";
+export type EdgeType = "exposes" | "depends_on";
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "WS" | "SSE" | "RPC";
+export type DependencyRegistry = "npm" | "pypi" | "go";
+export interface EvidenceSpan {
+    file: string;
+    start_line?: number;
+    end_line?: number;
+    kind: EvidenceKind;
+    detail?: Record<string, unknown>;
+}
+export interface ServiceAttributes {
+    framework?: string;
+    source_files?: string[];
+}
+export interface EndpointAttributes {
+    method: HttpMethod;
+    path: string;
+}
+export interface ExternalDependencyAttributes {
+    package: string;
+    version?: string;
+    registry: DependencyRegistry;
+    kind?: string;
+}
+export type NodeAttributes = ServiceAttributes | EndpointAttributes | ExternalDependencyAttributes;
+interface BaseNode {
+    id: string;
+    name: string;
+    lane: Lane;
+    source: Source;
+    confidence?: number;
+    language?: GraphLanguage;
+    evidence: EvidenceSpan[];
+}
+export interface ServiceNode extends BaseNode {
+    type: "service";
+    attributes?: ServiceAttributes;
+}
+export interface EndpointNode extends BaseNode {
+    type: "endpoint";
+    attributes: EndpointAttributes;
+}
+export interface ExternalDependencyNode extends BaseNode {
+    type: "external_dependency";
+    attributes: ExternalDependencyAttributes;
+}
+export type GraphNode = ServiceNode | EndpointNode | ExternalDependencyNode;
+export interface GraphEdge {
+    id: string;
+    type: EdgeType;
+    source_id: string;
+    target_id: string;
+    lane: Lane;
+    source: Source;
+    confidence?: number;
+    evidence?: EvidenceSpan[];
+    attributes?: Record<string, unknown>;
+}
+export interface GraphProvenance {
+    root_dir: string;
+    repo_id?: string;
+    commit_sha?: string;
+    branch?: string;
+    application_id?: string;
+    analysis_mode: AnalysisMode;
+}
+export interface GraphScope {
+    files_scanned: number;
+    files_skipped: number;
+    duration_ms: number;
+    languages?: GraphLanguage[];
+}
+export interface RepoGraphArtifactV1 {
+    version: "1.0.0";
+    kind: "repo_graph_artifact";
+    extracted_at: string;
+    extractor: string;
+    provenance: GraphProvenance;
+    scope: GraphScope;
+    nodes: GraphNode[];
+    edges: GraphEdge[];
+}
+export {};

package/dist/internal/extractor/graph-types.js

@@ -0,0 +1 @@
+export {};

package/dist/internal/extractor/index.d.ts

@@ -1,22 +1,8 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import type { ExtractionResult } from "./types.js";
 export interface RunOptions {
     rootDir: string;
-    /** Subset of language adapters to run; defaults to all registered. */
     languages?: Array<"typescript" | "go" | "python">;
-    /** Extra ignore patterns from --ignore flags. */
     extraIgnores?: string[];
-    /** Version string for the extractor — usually @zivis/cli's package version. */
     extractorVersion: string;
 }
 export declare function runExtractor(opts: RunOptions): Promise<ExtractionResult>;

package/dist/internal/extractor/index.js

@@ -1,14 +1,3 @@
-/**
- * Extractor orchestrator.
- *
- * Walks the customer's repo, dispatches matched files to per-language
- * adapters, merges their findings into a single ExtractionResult.
- *
- * Adapters register their own file extensions + manifest filenames; the
- * walker only reads files those filters claim. So adding a Go or Python
- * adapter doesn't change anything here — register the adapter and the
- * orchestrator picks up its files.
- */
 import * as path from "node:path";
 import { walk } from "./walker.js";
 import { typescriptAdapter } from "./adapters/typescript/index.js";
@@ -25,7 +14,6 @@ export async function runExtractor(opts) {
     const adapters = opts.languages
         ? ADAPTERS.filter((a) => opts.languages.includes(a.language))
         : ADAPTERS;
-    // Aggregate the file filters from each adapter so we walk the tree once.
     const extensions = new Set();
     const manifests = new Set();
     for (const a of adapters) {
@@ -104,4 +92,3 @@ function dedupeExternalServices(items) {
     }
     return [...out.values()];
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/types.d.ts

@@ -1,29 +1,3 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export type Language = "typescript" | "javascript" | "go" | "python";
 export interface EvidenceLocation {
     file: string;
@@ -44,21 +18,16 @@ export interface ConfigEvidence extends EvidenceLocation {
 export type Evidence = HttpRouteEvidence | ImportEvidence | ConfigEvidence;
 export type ComponentKind = "process" | "data_store" | "external_service" | "frontend";
 export interface ExtractedComponent {
-    /** Stable name derived from path / module — never a value from inside a function. */
     name: string;
     kind: ComponentKind;
     language: Language;
-    /** Detected web framework, if any (express | fastify | nextjs | trpc | hono | gin | echo | …). */
     framework?: string;
     sourceFiles: string[];
     evidence: Evidence[];
 }
 export interface ExtractedExternalService {
-    /** Vendor / SDK name — "Anthropic", "OpenAI", "WorkOS". */
     name: string;
-    /** What kind of integration: ai_sdk, payments, auth, observability, etc. */
     kind: string;
-    /** npm/PyPI/Go module identifier ("@anthropic-ai/sdk"). */
     package: string;
     version?: string;
     callSites: EvidenceLocation[];
@@ -84,30 +53,16 @@ export interface ExtractionResult {
     components: ExtractedComponent[];
     externalServices: ExtractedExternalService[];
     dataStores: ExtractedDataStore[];
-    /**
-     * Per-language manifests detected in the scope. Surfaces dependency-only
-     * findings (e.g., "this repo uses @anthropic-ai/sdk@^0.30") even when
-     * we can't yet match call sites.
-     */
     manifests: ManifestSummary[];
 }
 export interface ManifestSummary {
     language: Language;
     file: string;
-    /** Direct dependency names → version (verbatim from manifest). */
     dependencies: Record<string, string>;
 }
-/**
- * Adapter contract — one per language. Each adapter is fed the list of
- * source files matched for it (already filtered by .gitignore + .zivisignore)
- * plus any manifest files (package.json, go.mod, pyproject.toml). Returns
- * structured findings the framework merges into the final ExtractionResult.
- */
 export interface LanguageAdapter {
     language: Language;
-    /** File extensions this adapter handles. */
     extensions: string[];
-    /** Manifest filenames this adapter cares about. */
     manifests: string[];
     extract(input: AdapterInput): Promise<AdapterOutput>;
 }

package/dist/internal/extractor/types.js

@@ -1,28 +1 @@
-/**
- * Extractor output schema.
- *
- * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
- * for privacy-audit metadata. The shape is the contract between the CLI
- * and the eventual `--apply` endpoint that maps into ThreatModelComponent
- * / OrgComponent records (RECON.3-gated).
- *
- * Privacy invariant — what's IN the JSON:
- *   component names ("auth-service")
- *   file paths ("src/auth/login.ts")
- *   line numbers (42)
- *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
- *   detected protocols / methods (POST /login)
- *   dependency versions (from package.json / go.mod / pyproject.toml)
- *
- * What's NOT:
- *   function bodies, file contents, code snippets
- *   variable names from inside functions
- *   comments
- *   raw AST nodes
- *
- * `zivis tm extract --privacy-audit` prints this whole object to stdout
- * before any network call, so the customer can see exactly what would
- * be sent.
- */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/internal/extractor/walker.d.ts

@@ -1,24 +1,7 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 export interface WalkOptions {
     rootDir: string;
-    /** Extensions to include (with the leading dot, e.g. [".ts", ".tsx"]). */
     extensions: string[];
-    /** Manifest basenames to capture regardless of extension (e.g. ["package.json"]). */
     manifests: string[];
-    /** Extra ignore patterns from --ignore CLI flags. */
     extraIgnores?: string[];
 }
 export interface WalkResult {
@@ -28,5 +11,4 @@ export interface WalkResult {
     filesSkipped: number;
 }
 export declare function walk(opts: WalkOptions): Promise<WalkResult>;
-/** Convert an absolute path to a posix-style repo-relative path. */
 export declare function repoRelative(rootDir: string, absPath: string): string;

package/dist/internal/extractor/walker.js

@@ -1,17 +1,3 @@
-/**
- * Filesystem walker — yields source files relative to the scan root,
- * filtered by .gitignore + .zivisignore + per-extractor extension filters.
- *
- * Uses the `ignore` npm package (the same engine git ships with) so the
- * matching semantics mirror what developers expect from .gitignore.
- *
- * Hard limits:
- *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
- *    if not in .gitignore. These exist by convention and contain
- *    third-party code that pollutes the inventory.
- *  - Caps total files at 50_000 to refuse to scan a generated monorepo
- *    by accident (extractor would take forever; user should narrow scope).
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import ignore from "ignore";
@@ -64,7 +50,6 @@ export async function walk(opts) {
                     filesSkipped++;
                     continue;
                 }
-                // ignore() expects gitignore-style paths with trailing /
                 if (ig.ignores(childRel + "/")) {
                     filesSkipped++;
                     continue;
@@ -99,12 +84,9 @@ async function loadIgnoreFile(ig, filePath) {
         ig.add(content);
     }
     catch {
-        // No ignore file — fine.
     }
 }
-/** Convert an absolute path to a posix-style repo-relative path. */
 export function repoRelative(rootDir, absPath) {
     const rel = path.relative(rootDir, absPath);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=walker.js.map