@zivis/cli 0.1.0-alpha.40 → 0.1.0-alpha.6

package/dist/internal/extractor/adapters/python/manifest.js

@@ -1,3 +1,10 @@
+/**
+ * Python manifest analysis.
+ *
+ * Reads pyproject.toml (PEP 621 + Poetry sections) and requirements.txt.
+ * Other formats (Pipfile, setup.py) deferred — they're either rare in
+ * modern projects (setup.py) or layer on top of these two.
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import TOML from "@iarna/toml";
@@ -13,7 +20,7 @@ export const WEB_FRAMEWORK_PACKAGES = {
     quart: "quart",
 };
 export const DATA_STORE_PACKAGES = {
-    sqlalchemy: { kind: "postgres", client: "sqlalchemy" },
+    sqlalchemy: { kind: "postgres", client: "sqlalchemy" }, // dialect varies; default to pg
     asyncpg: { kind: "postgres", client: "asyncpg" },
     psycopg: { kind: "postgres", client: "psycopg" },
     psycopg2: { kind: "postgres", client: "psycopg2" },
@@ -38,7 +45,7 @@ export const AI_SDK_PACKAGES = {
     vertexai: "Vertex AI",
     "google-generativeai": "Google Generative AI",
     cohere: "Cohere",
-    "boto3": "AWS (boto3)",
+    "boto3": "AWS (boto3)", // bedrock typically uses boto3
 };
 export async function readManifests(rootDir, manifestFiles) {
     const out = [];
@@ -54,6 +61,7 @@ export async function readManifests(rootDir, manifestFiles) {
             }
         }
         catch {
+            // skip unreadable / unparsable
         }
     }
     return out;
@@ -71,6 +79,7 @@ function parsePyproject(filePath, rootDir, raw) {
     catch {
         return result;
     }
+    // PEP 621: project.dependencies = ["fastapi >=0.100", ...]
     const projectDeps = parsed?.project?.dependencies;
     if (Array.isArray(projectDeps)) {
         for (const spec of projectDeps) {
@@ -81,6 +90,7 @@ function parsePyproject(filePath, rootDir, raw) {
                 result.deps[name] = version;
         }
     }
+    // PEP 621: optional-dependencies = { test = [...], dev = [...] }
     const opt = parsed?.project?.["optional-dependencies"];
     if (opt && typeof opt === "object") {
         for (const groupSpec of Object.values(opt)) {
@@ -95,6 +105,7 @@ function parsePyproject(filePath, rootDir, raw) {
             }
         }
     }
+    // Poetry: tool.poetry.dependencies = { fastapi = "^0.100" } (also dev-dependencies)
     const poetryDeps = parsed?.tool?.poetry?.dependencies;
     if (poetryDeps && typeof poetryDeps === "object") {
         for (const [name, value] of Object.entries(poetryDeps)) {
@@ -126,7 +137,8 @@ function parseRequirementsTxt(filePath, rootDir, raw) {
         if (!line || line.startsWith("#"))
             continue;
         if (line.startsWith("-"))
-            continue;
+            continue; // -e, -r, -c, --hash, etc.
+        // strip inline comments
         const hashAt = line.indexOf(" #");
         if (hashAt > 0)
             line = line.slice(0, hashAt).trim();
@@ -136,7 +148,9 @@ function parseRequirementsTxt(filePath, rootDir, raw) {
     }
     return result;
 }
+/** "fastapi>=0.100,<0.110" → ["fastapi", ">=0.100,<0.110"] */
 function splitPep508(spec) {
+    // strip extras like fastapi[all]
     const cleaned = spec.replace(/\[[^\]]*\]/g, "").trim();
     const m = cleaned.match(/^([A-Za-z0-9_.\-]+)\s*(.*)$/);
     if (!m)
@@ -171,24 +185,6 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
-        for (const [pkg, vendor] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
-            const ver = m.deps[pkg];
-            if (!ver)
-                continue;
-            const key = `web_framework::${pkg}`;
-            const existing = seen.get(key);
-            if (existing) {
-                existing.callSites.push({ file: m.filePath, line: 1 });
-                continue;
-            }
-            seen.set(key, {
-                name: vendor,
-                kind: "web_framework",
-                package: pkg,
-                version: ver,
-                callSites: [{ file: m.filePath, line: 1 }],
-            });
-        }
     }
     return [...seen.values()];
 }
@@ -237,3 +233,4 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
+//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/python/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/python/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,IAAI,MAAM,aAAa,CAAC;AAG/B,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAyE;IACvG,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,gCAAgC;IACxF,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;IAChD,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE;IAChD,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IAClD,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IAC3D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACzC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;IAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;IACjD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;IAClD,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,gBAAgB,EAAE,WAAW;IAC7B,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,oBAAoB;IACxC,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,YAAY;IAC3B,QAAQ,EAAE,WAAW;IACrB,qBAAqB,EAAE,sBAAsB;IAC7C,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,aAAa,EAAE,+BAA+B;CACxD,CAAC;AASF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,aAAuB;IAC1E,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW;IACpE,MAAM,MAAM,GAAqB;QAC/B,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;QACrC,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,EAAE;KACT,CAAC;IAEF,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GAAY,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACxC,CAAC;IACH,CAAC;IACD,iEAAiE;IACjE,MAAM,GAAG,GAAY,MAAM,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAChE,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAA8B,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,SAAS;YACxC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBACvC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,MAAM,UAAU,GAAY,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC;IAC/D,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAqC,CAAC,EAAE,CAAC;YAClF,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAa,EAAE,OAAO,IAAI,GAAG,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GACjB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,IAAI,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC;IAC/F,IAAI,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAwC,CAAC,EAAE,CAAC;YACrF,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAa,EAAE,OAAO,IAAI,GAAG,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW;IAC1E,MAAM,MAAM,GAAqB;QAC/B,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;QACrC,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,EAAE;KACT,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,2BAA2B;QAC/D,wBAAwB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,GAAG,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,IAAY;IAC/B,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,CAAC,CAAC,QAAQ;QAChB,YAAY,EAAE,CAAC,CAAC,IAAI;KACrB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,WAAW,GAAG,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG;gBACZ,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA0B;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAmB;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAgC;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;QACnC,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/internal/extractor/adapters/python/parser.d.ts

@@ -1,2 +1,5 @@
+/**
+ * tree-sitter-python loader.
+ */
 import { Parser } from "web-tree-sitter";
 export declare function getPythonParser(): Promise<Parser>;

package/dist/internal/extractor/adapters/python/parser.js

@@ -1,3 +1,6 @@
+/**
+ * tree-sitter-python loader.
+ */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -16,3 +19,4 @@ export function getPythonParser() {
     }
     return parserPromise;
 }
+//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/python/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/python/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,IAAI,aAAa,GAA2B,IAAI,CAAC;AAEjD,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACxF,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/internal/extractor/adapters/python/scanner.d.ts

@@ -1,3 +1,21 @@
+/**
+ * AST scanner for Python source files.
+ *
+ * Patterns covered:
+ *   1. import_statement / import_from_statement → tracked-package imports
+ *      (AI SDKs, web frameworks, DB clients).
+ *   2. Decorator-based routes (FastAPI, Flask):
+ *        @app.get("/path")            → method=GET
+ *        @app.post("/path")           → method=POST
+ *        @app.route("/path", …)       → method=ALL (Flask default; verbs in `methods=` kw not parsed yet)
+ *        @router.get("/x", …)         → method=GET (FastAPI APIRouter convention)
+ *   3. Django urls.py-style call: path("/route", view, …) / re_path(…)  → method=ALL
+ *   4. aiohttp: app.router.add_get("/path", h) / add_post(…) / etc.
+ *
+ * Privacy invariant: identifier names + dotted attribute names + string
+ * literals on routes only. Function bodies and decorator args beyond the
+ * route path are never inspected.
+ */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;

package/dist/internal/extractor/adapters/python/scanner.js

@@ -1,3 +1,21 @@
+/**
+ * AST scanner for Python source files.
+ *
+ * Patterns covered:
+ *   1. import_statement / import_from_statement → tracked-package imports
+ *      (AI SDKs, web frameworks, DB clients).
+ *   2. Decorator-based routes (FastAPI, Flask):
+ *        @app.get("/path")            → method=GET
+ *        @app.post("/path")           → method=POST
+ *        @app.route("/path", …)       → method=ALL (Flask default; verbs in `methods=` kw not parsed yet)
+ *        @router.get("/x", …)         → method=GET (FastAPI APIRouter convention)
+ *   3. Django urls.py-style call: path("/route", view, …) / re_path(…)  → method=ALL
+ *   4. aiohttp: app.router.add_get("/path", h) / add_post(…) / etc.
+ *
+ * Privacy invariant: identifier names + dotted attribute names + string
+ * literals on routes only. Function bodies and decorator args beyond the
+ * route path are never inspected.
+ */
 import * as fs from "node:fs/promises";
 import { getPythonParser } from "./parser.js";
 import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
@@ -69,9 +87,22 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
+/**
+ * Pull the top-level package(s) out of an import statement.
+ *
+ * - `import anthropic` → ["anthropic"]
+ * - `import langchain.chat_models` → ["langchain"] (we track the root)
+ * - `from fastapi import FastAPI` → ["fastapi"]
+ * - `from langchain.schema import HumanMessage` → ["langchain"]
+ *
+ * Sub-modules collapse to the root because the manifest table is keyed
+ * by distribution name, which is also the import root for the packages
+ * we care about.
+ */
 function extractImportPackages(node) {
     const out = [];
     if (node.type === "import_from_statement") {
+        // import_from_statement → module_name as the "module" field
         const moduleField = node.childForFieldName("module_name");
         if (moduleField) {
             const root = topLevelImportName(moduleField);
@@ -80,6 +111,7 @@ function extractImportPackages(node) {
         }
         return out;
     }
+    // import_statement: one or more dotted_name (or aliased_import wrapping it)
     for (const child of node.namedChildren) {
         if (!child)
             continue;
@@ -109,7 +141,13 @@ function topLevelImportName(node) {
 function trackedPackageMatch(pkg) {
     return TRACKED_PACKAGES.has(pkg) ? pkg : null;
 }
+/**
+ * Match @app.get("/path"), @router.post(…), @app.route("/x", …).
+ * Returns the route + method, or null if it isn't a known shape.
+ */
 function extractDecoratorRoute(node) {
+    // decorator → `@` + (call | attribute | identifier)
+    // We only care about call shapes: @app.get("/path", …)
     const callNode = node.namedChildren.find((c) => c?.type === "call");
     if (!callNode)
         return null;
@@ -125,28 +163,37 @@ function extractDecoratorRoute(node) {
         return null;
     const objectName = objectNode.text.toLowerCase();
     const attrName = attrNode.text.toLowerCase();
+    // Object must be a router-y identifier — keep the false-positive surface
+    // tight even though we'd lose decorators on uncommon names like `myapi`.
     if (!ROUTER_IDENTIFIERS.has(objectName))
         return null;
     let method = null;
     if (HTTP_METHODS.has(attrName))
         method = attrName.toUpperCase();
     else if (attrName === "route")
-        method = "ALL";
+        method = "ALL"; // Flask default; verbs in methods= kwarg not yet parsed
     if (!method)
         return null;
     return readRoutePath(args, method);
 }
+/**
+ * Match Django path("/route", view, …) / re_path(…) and aiohttp
+ * app.router.add_get("/path", h) / add_post(…) etc.
+ */
 function extractCallRoute(node) {
     const fn = node.childForFieldName("function");
     const args = node.childForFieldName("arguments");
     if (!fn || !args)
         return null;
+    // Django: bare identifier function, e.g. `path("/route", view)`.
     if (fn.type === "identifier") {
         const name = fn.text;
         if (!DJANGO_PATH_FNS.has(name))
             return null;
         return readRoutePath(args, "ALL");
     }
+    // aiohttp: app.router.add_get("/path", h) — attribute call where the
+    // method name is encoded into the attribute (add_get, add_post, …).
     if (fn.type === "attribute") {
         const attrNode = fn.childForFieldName("attribute");
         if (!attrNode)
@@ -158,16 +205,20 @@ function extractCallRoute(node) {
     }
     return null;
 }
+/** Pull the first positional string-literal argument as the route path. */
 function readRoutePath(argsNode, method) {
     for (const arg of argsNode.namedChildren) {
         if (!arg)
             continue;
+        // Skip kwargs (we only want the first positional).
         if (arg.type === "keyword_argument")
             continue;
         if (arg.type !== "string")
             return null;
+        // string → string_start, string_content, string_end
         const content = arg.namedChildren.find((c) => c?.type === "string_content");
         if (!content) {
+            // fall back: strip leading/trailing quote chars from raw text
             const text = arg.text;
             if (text.length >= 2 && (text.startsWith('"') || text.startsWith("'"))) {
                 return { method, path: text.slice(1, -1) };
@@ -214,6 +265,7 @@ export function aggregate(scans) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
+    // Skip common project-layout prefixes.
     const skipPrefixes = new Set(["src", "app", "apps", "backend", "api"]);
     const start = skipPrefixes.has(segs[0]) ? 1 : 0;
     if (segs.length - start >= 2)
@@ -229,3 +281,4 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
+//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/python/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/python/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAQvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC3F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAChF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,gDAAgD,CAAC;AAEzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACnC,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAQH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC9E,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAA0B;IACpD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC1C,4DAA4D;QAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvC,IAAI,IAAI;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,oDAAoD;IACpD,uDAAuD;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAE7C,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;SAC3D,IAAI,QAAQ,KAAK,OAAO;QAAE,MAAM,GAAG,KAAK,CAAC,CAAC,wDAAwD;IACvG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,iEAAiE;IACjE,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,mDAAmD;QACnD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;YAAE,SAAS;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,oDAAoD;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8DAA8D;YAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD,MAAM,UAAU,SAAS,CAAC,KAAuB;IAC/C,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE9D,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,uCAAuC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAyB;IAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/internal/extractor/adapters/typescript/index.d.ts

@@ -1,2 +1,9 @@
+/**
+ * TypeScript / JavaScript language adapter.
+ *
+ * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
+ * (cheap, runs against package.json) with AST scanning (per source file)
+ * to produce components, external services, and data stores.
+ */
 import type { LanguageAdapter } from "../../types.js";
 export declare const typescriptAdapter: LanguageAdapter;

package/dist/internal/extractor/adapters/typescript/index.js

@@ -1,3 +1,10 @@
+/**
+ * TypeScript / JavaScript language adapter.
+ *
+ * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
+ * (cheap, runs against package.json) with AST scanning (per source file)
+ * to produce components, external services, and data stores.
+ */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -8,10 +15,13 @@ export const typescriptAdapter = {
     manifests: ["package.json"],
     async extract(input) {
         const { rootDir, sourceFiles, manifestFiles } = input;
+        // Manifest pass — fast, runs entirely on package.json contents.
         const parsedManifests = await readManifests(rootDir, manifestFiles);
         const manifestSummaries = summarizeManifests(parsedManifests);
         const manifestExternalServices = findExternalServices(parsedManifests);
         const manifestDataStores = findDataStores(parsedManifests);
+        // AST pass — only on source files. Cap at MAX_SOURCE_FILES per run
+        // for the Phase J <60s budget on a 100k-LOC monorepo.
         const MAX_SOURCE_FILES = 5_000;
         const filesToScan = sourceFiles.slice(0, MAX_SOURCE_FILES);
         const scans = await Promise.all(filesToScan.map(async (abs) => {
@@ -23,7 +33,10 @@ export const typescriptAdapter = {
             }
         }));
         const agg = aggregate(scans);
+        // Map scanner output → ExtractedComponent shape.
         const components = agg.components.map((c) => {
+            // Best-effort framework inference: scanner picks up imports; manifest
+            // picks up the dep. Either signal counts.
             const framework = c.framework ?? frameworkFromOwningManifest(c.sourceFile, parsedManifests);
             return {
                 name: c.name,
@@ -34,11 +47,13 @@ export const typescriptAdapter = {
                 evidence: [...c.routes, ...c.imports],
             };
         });
+        // Augment manifest-derived ExternalServices with AST call sites.
         for (const svc of manifestExternalServices) {
             const sites = agg.aiSdkCallSites.get(svc.package);
             if (sites)
                 svc.callSites.push(...sites);
         }
+        // Augment manifest-derived DataStores with import-evidence from source.
         for (const store of manifestDataStores) {
             if (!store.client)
                 continue;
@@ -54,11 +69,16 @@ export const typescriptAdapter = {
         };
     },
 };
+/**
+ * Walk up from a source file's path to find the closest package.json
+ * we parsed; return the framework hint from that manifest.
+ */
 function frameworkFromOwningManifest(sourceFile, manifests) {
     const sourceDir = path.posix.dirname(sourceFile);
     const candidates = manifests
         .map((m) => ({ m, dir: path.posix.dirname(m.filePath) }))
         .filter(({ dir }) => sourceDir === dir || sourceDir.startsWith(dir + "/"))
-        .sort((a, b) => b.dir.length - a.dir.length);
+        .sort((a, b) => b.dir.length - a.dir.length); // closest wins
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
+//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/typescript/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,2BAA2B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQ/C,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,SAAS,EAAE,CAAC,cAAc,CAAC;IAC3B,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAEtD,gEAAgE;QAChE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;QAE3D,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,KAAK,CAAC;QAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAE7B,iDAAiD;QACjD,MAAM,UAAU,GAAyB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChE,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,2BAA2B,CAAC,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAC5F,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,YAAY;gBACtB,SAAS;gBACT,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC3B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;aACtC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,KAAK;gBAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,EAAE;gBAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO;YACL,UAAU;YACV,gBAAgB,EAAE,wBAAwB;YAC1C,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,iBAAiB;SAC7B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,2BAA2B,CAClC,UAAkB,EAClB,SAAoD;IAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,SAAS;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;SACzE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;IAC/D,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC"}

package/dist/internal/extractor/adapters/typescript/manifest.d.ts

@@ -1,3 +1,11 @@
+/**
+ * TypeScript / JavaScript manifest analysis.
+ *
+ * Reads package.json files (root + workspaces) to classify dependencies
+ * into the categories the threat-model graph cares about. Used both for
+ * the manifests block of the output and as a hint for which AST queries
+ * are worth running on which files.
+ */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export interface PackageJson {
     name?: string;
@@ -20,8 +28,14 @@ export interface ParsedManifest {
     packageName?: string;
     deps: Record<string, string>;
 }
+/**
+ * Read every package.json, return per-file dependency maps. Combines
+ * dependencies + devDependencies (we want both — devDeps include things
+ * like @types that signal use, plus dev-only auth packages).
+ */
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedManifest[]>;
 export declare function summarizeManifests(parsed: ParsedManifest[]): ManifestSummary[];
 export declare function findExternalServices(parsed: ParsedManifest[]): ExtractedExternalService[];
 export declare function findDataStores(parsed: ParsedManifest[]): ExtractedDataStore[];
+/** Pick the most likely web framework for a manifest's owning package. */
 export declare function detectFrameworkFromManifest(m: ParsedManifest): string | undefined;

package/dist/internal/extractor/adapters/typescript/manifest.js

@@ -1,3 +1,11 @@
+/**
+ * TypeScript / JavaScript manifest analysis.
+ *
+ * Reads package.json files (root + workspaces) to classify dependencies
+ * into the categories the threat-model graph cares about. Used both for
+ * the manifests block of the output and as a hint for which AST queries
+ * are worth running on which files.
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 export const WEB_FRAMEWORK_PACKAGES = {
@@ -7,14 +15,9 @@ export const WEB_FRAMEWORK_PACKAGES = {
     "@trpc/server": "trpc",
     hono: "hono",
     koa: "koa",
-    "@nestjs/core": "nestjs",
-    "@nestjs/common": "nestjs",
-    "@hapi/hapi": "hapi",
-    "express-graphql": "express",
-    "apollo-server-express": "express",
 };
 export const DATA_STORE_PACKAGES = {
-    "@prisma/client": { kind: "postgres", client: "@prisma/client" },
+    "@prisma/client": { kind: "postgres", client: "@prisma/client" }, // assumes postgres; could be MySQL/SQLite via schema
     pg: { kind: "postgres", client: "pg" },
     postgres: { kind: "postgres", client: "postgres" },
     mongoose: { kind: "mongo", client: "mongoose" },
@@ -35,6 +38,11 @@ export const AI_SDK_PACKAGES = {
     "@langchain/core": "LangChain",
     llamaindex: "LlamaIndex",
 };
+/**
+ * Read every package.json, return per-file dependency maps. Combines
+ * dependencies + devDependencies (we want both — devDeps include things
+ * like @types that signal use, plus dev-only auth packages).
+ */
 export async function readManifests(rootDir, manifestFiles) {
     const out = [];
     for (const file of manifestFiles) {
@@ -55,6 +63,7 @@ export async function readManifests(rootDir, manifestFiles) {
             });
         }
         catch {
+            // Skip broken JSON; not our job to validate the customer's manifests.
         }
     }
     return out;
@@ -89,26 +98,6 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
-        for (const [pkg, vendor] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
-            const ver = m.deps[pkg];
-            if (!ver)
-                continue;
-            const key = `web_framework::${pkg}`;
-            const existing = seen.get(key);
-            if (existing) {
-                existing.callSites.push({ file: m.filePath, line: 1 });
-                if (!existing.version)
-                    existing.version = ver;
-                continue;
-            }
-            seen.set(key, {
-                name: vendor,
-                kind: "web_framework",
-                package: pkg,
-                version: ver,
-                callSites: [{ file: m.filePath, line: 1 }],
-            });
-        }
     }
     return [...seen.values()];
 }
@@ -136,6 +125,7 @@ export function findDataStores(parsed) {
     }
     return [...seen.values()];
 }
+/** Pick the most likely web framework for a manifest's owning package. */
 export function detectFrameworkFromManifest(m) {
     for (const [pkg, framework] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
         if (m.deps[pkg])
@@ -163,3 +153,4 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
+//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/typescript/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAYlC,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,QAAQ;IACd,cAAc,EAAE,MAAM;IACtB,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAyE;IACvG,gBAAgB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,qDAAqD;IACvH,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;IACtC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IAClD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;IAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;IAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACzC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3C,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,mBAAmB,EAAE,WAAW;IAChC,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,eAAe;IACnB,+BAA+B,EAAE,4BAA4B;IAC7D,uBAAuB,EAAE,sBAAsB;IAC/C,iCAAiC,EAAE,aAAa;IAChD,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,WAAW;IAC9B,UAAU,EAAE,YAAY;CACzB,CAAC;AAQF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,aAAuB;IAC1E,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;YAC5C,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACnF,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;gBACjC,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,CAAC,CAAC,QAAQ;QAChB,YAAY,EAAE,CAAC,CAAC,IAAI;KACrB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAwB;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,WAAW,GAAG,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvD,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG;gBACZ,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,GAAG;gBACZ,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,CAAiB;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAgC;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/internal/extractor/adapters/typescript/parser.d.ts

@@ -1,3 +1,11 @@
+/**
+ * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
+ * caches the parser+language for the rest of the run.
+ *
+ * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
+ * need a build step on the user's machine. Loading a .wasm grammar is
+ * O(50ms); parsing a TS file is O(low ms) per file.
+ */
 import { Parser } from "web-tree-sitter";
 export declare function getParsers(): Promise<{
     parser: Parser;

package/dist/internal/extractor/adapters/typescript/parser.js

@@ -1,3 +1,11 @@
+/**
+ * tree-sitter-typescript loader. Initializes the WASM grammar lazily and
+ * caches the parser+language for the rest of the run.
+ *
+ * @vscode/tree-sitter-wasm bundles the prebuilt .wasm files so we don't
+ * need a build step on the user's machine. Loading a .wasm grammar is
+ * O(50ms); parsing a TS file is O(low ms) per file.
+ */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -22,3 +30,4 @@ export function getParsers() {
 export function pickParserForFile(file, parser, tsx) {
     return file.endsWith(".tsx") || file.endsWith(".jsx") ? tsx : parser;
 }
+//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/typescript/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,IAAI,aAAa,GAAoD,IAAI,CAAC;AAE1E,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IACzE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC"}

package/dist/internal/extractor/adapters/typescript/scanner.d.ts

@@ -1,3 +1,24 @@
+/**
+ * AST scanner for TypeScript / JavaScript source files.
+ *
+ * For each file: parses with tree-sitter-typescript, walks the tree
+ * looking for:
+ *
+ *   1. `import` / `require` statements naming any tracked package
+ *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
+ *      ExternalService call sites
+ *   2. Express-style route declarations:
+ *        app.METHOD("/path", ...)
+ *        router.METHOD("/path", ...)
+ *        server.METHOD("/path", ...)
+ *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
+ *      → HTTP-route-evidence on a component derived from the file
+ *
+ * Privacy invariant: we only ever emit identifier names, file paths,
+ * line numbers, dependency identifiers, and HTTP method/path strings.
+ * Function bodies and inline values are never read past the first arg
+ * of a route call.
+ */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;
@@ -6,6 +27,7 @@ export interface FileScanResult {
 }
 export declare function scanFile(absPath: string, repoRel: string): Promise<FileScanResult>;
 export interface ScannedAggregates {
+    /** Per-component findings (one per source file with relevant evidence). */
     components: Array<{
         name: string;
         sourceFile: string;
@@ -13,7 +35,9 @@ export interface ScannedAggregates {
         routes: HttpRouteEvidence[];
         imports: ImportEvidence[];
     }>;
+    /** Extra ExternalService call-site evidence beyond what the manifests gave. */
     aiSdkCallSites: Map<string, EvidenceLocation[]>;
+    /** Extra data-store evidence (when AST shows usage of e.g. `new Pool()` etc.; v1 just imports). */
     dataStoreEvidence: Map<string, Evidence[]>;
 }
 export declare function aggregate(scans: FileScanResult[]): ScannedAggregates;