@zivis/cli 0.1.0-alpha.40 → 0.1.0-alpha.6

package/dist/internal/extractor/adapters/typescript/scanner.js

@@ -1,3 +1,24 @@
+/**
+ * AST scanner for TypeScript / JavaScript source files.
+ *
+ * For each file: parses with tree-sitter-typescript, walks the tree
+ * looking for:
+ *
+ *   1. `import` / `require` statements naming any tracked package
+ *      (AI SDKs, web frameworks, DB clients) → import-evidence + extra
+ *      ExternalService call sites
+ *   2. Express-style route declarations:
+ *        app.METHOD("/path", ...)
+ *        router.METHOD("/path", ...)
+ *        server.METHOD("/path", ...)
+ *      where METHOD is one of GET/POST/PUT/DELETE/PATCH/ALL/USE
+ *      → HTTP-route-evidence on a component derived from the file
+ *
+ * Privacy invariant: we only ever emit identifier names, file paths,
+ * line numbers, dependency identifiers, and HTTP method/path strings.
+ * Function bodies and inline values are never read past the first arg
+ * of a route call.
+ */
 import * as fs from "node:fs/promises";
 import { getParsers, pickParserForFile } from "./parser.js";
 import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
@@ -54,22 +75,35 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
+/** Pull the string literal from `import … from "<here>"`. */
 function extractImportSource(node) {
+    // import_statement → ... → (string (string_fragment))
     const stringNode = node.children.find((c) => c?.type === "string");
     if (!stringNode)
         return null;
     const frag = stringNode.namedChildren.find((c) => c?.type === "string_fragment");
     return frag?.text ?? null;
 }
+/** Map a package import to a tracked-package identifier, allowing for sub-paths. */
 function trackedPackageMatch(pkg) {
     if (TRACKED_PACKAGES.has(pkg))
         return pkg;
+    // sub-paths: "@anthropic-ai/sdk/foo" → "@anthropic-ai/sdk"
     for (const tracked of TRACKED_PACKAGES) {
         if (pkg.startsWith(tracked + "/"))
             return tracked;
     }
     return null;
 }
+/**
+ * Identify Express-style route calls. Only inspects the AST shape; never
+ * reads the handler-function body.
+ *
+ * Matches:
+ *   <ROUTER_IDENT>.<METHOD>("/path", ...)
+ *
+ * Where the second-and-onward args are deliberately ignored.
+ */
 function extractRouteCall(node) {
     const fn = node.namedChildren.find((c) => c?.type === "member_expression");
     const args = node.namedChildren.find((c) => c?.type === "arguments");
@@ -85,6 +119,7 @@ function extractRouteCall(node) {
         return null;
     if (!HTTP_METHODS.has(methodName))
         return null;
+    // First arg should be a string literal — the route path.
     const firstArg = args.namedChildren[0];
     if (!firstArg || firstArg.type !== "string")
         return null;
@@ -100,6 +135,8 @@ export function aggregate(scans) {
     for (const s of scans) {
         if (s.routes.length === 0 && s.imports.length === 0)
             continue;
+        // Tag SDK call sites. Each tracked import of an AI SDK package
+        // counts as a call site for that vendor, on top of the manifest hit.
         for (const imp of s.imports) {
             if (AI_SDK_PACKAGES[imp.package]) {
                 const arr = aiSdkCallSites.get(imp.package) ?? [];
@@ -115,6 +152,8 @@ export function aggregate(scans) {
         }
         if (s.routes.length === 0)
             continue;
+        // Derive a friendly component name from the file path (the deepest
+        // meaningful directory). e.g. src/auth/login.ts → "auth".
         const name = deriveComponentName(s.file);
         const framework = detectFrameworkFromImports(s.imports);
         components.push({
@@ -129,7 +168,10 @@ export function aggregate(scans) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
+    // Drop "src" / "lib" / "app" prefixes so the name is meaningful.
     const start = ["src", "lib", "app"].includes(segs[0]) ? 1 : 0;
+    // Use the parent directory as the component (e.g. "auth"), or the
+    // filename root if the file lives at the top level.
     if (segs.length - start >= 2)
         return segs[start];
     const last = segs[segs.length - 1];
@@ -143,3 +185,4 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
+//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/typescript/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../../../src/internal/extractor/adapters/typescript/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAQvB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACzG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACnC,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAQH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAe;IAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,OAAO,EAAE,GAAG;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAA0B;IACpD,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,mBAAmB,CAAC,IAAY;IACvC,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC;IACpG,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,2DAA2D;IAC3D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC;IACxF,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACtG,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmB,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAiBD,MAAM,UAAU,SAAS,CAAC,KAAuB;IAC/C,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE9D,+DAA+D;QAC/D,qEAAqE;QACrE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,iEAAiE;IACjE,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,kEAAkE;IAClE,oDAAoD;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAyB;IAC3D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/internal/extractor/index.d.ts

@@ -1,8 +1,22 @@
+/**
+ * Extractor orchestrator.
+ *
+ * Walks the customer's repo, dispatches matched files to per-language
+ * adapters, merges their findings into a single ExtractionResult.
+ *
+ * Adapters register their own file extensions + manifest filenames; the
+ * walker only reads files those filters claim. So adding a Go or Python
+ * adapter doesn't change anything here — register the adapter and the
+ * orchestrator picks up its files.
+ */
 import type { ExtractionResult } from "./types.js";
 export interface RunOptions {
     rootDir: string;
+    /** Subset of language adapters to run; defaults to all registered. */
     languages?: Array<"typescript" | "go" | "python">;
+    /** Extra ignore patterns from --ignore flags. */
     extraIgnores?: string[];
+    /** Version string for the extractor — usually @zivis/cli's package version. */
     extractorVersion: string;
 }
 export declare function runExtractor(opts: RunOptions): Promise<ExtractionResult>;

package/dist/internal/extractor/index.js

@@ -1,3 +1,14 @@
+/**
+ * Extractor orchestrator.
+ *
+ * Walks the customer's repo, dispatches matched files to per-language
+ * adapters, merges their findings into a single ExtractionResult.
+ *
+ * Adapters register their own file extensions + manifest filenames; the
+ * walker only reads files those filters claim. So adding a Go or Python
+ * adapter doesn't change anything here — register the adapter and the
+ * orchestrator picks up its files.
+ */
 import * as path from "node:path";
 import { walk } from "./walker.js";
 import { typescriptAdapter } from "./adapters/typescript/index.js";
@@ -14,6 +25,7 @@ export async function runExtractor(opts) {
     const adapters = opts.languages
         ? ADAPTERS.filter((a) => opts.languages.includes(a.language))
         : ADAPTERS;
+    // Aggregate the file filters from each adapter so we walk the tree once.
     const extensions = new Set();
     const manifests = new Set();
     for (const a of adapters) {
@@ -92,3 +104,4 @@ function dedupeExternalServices(items) {
     }
     return [...out.values()];
 }
+//# sourceMappingURL=index.js.map

package/dist/internal/extractor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/extractor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAoB3D,MAAM,QAAQ,GAAsB;IAClC,iBAAiB;IACjB,SAAS;IACT,aAAa;CACd,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS;QAC7B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAe,CAAC,CAAC;QACrE,CAAC,CAAC,QAAQ,CAAC;IAEb,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;QAC3B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,MAAM,gBAAgB,GAA+B,EAAE,CAAC;IACxD,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,MAAM,iBAAiB,GAAsB,EAAE,CAAC;IAEhD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5F,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAErE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,iBAAiB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,cAAc,IAAI,CAAC,gBAAgB,EAAE;QAChD,KAAK,EAAE;YACL,OAAO;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC;QACD,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;QACxC,gBAAgB,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;QAC1D,UAAU;QACV,SAAS,EAAE,iBAAiB;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA2B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;YAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAiC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;YAAE,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACjE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/internal/extractor/types.d.ts

@@ -1,3 +1,29 @@
+/**
+ * Extractor output schema.
+ *
+ * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
+ * for privacy-audit metadata. The shape is the contract between the CLI
+ * and the eventual `--apply` endpoint that maps into ThreatModelComponent
+ * / OrgComponent records (RECON.3-gated).
+ *
+ * Privacy invariant — what's IN the JSON:
+ *   component names ("auth-service")
+ *   file paths ("src/auth/login.ts")
+ *   line numbers (42)
+ *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
+ *   detected protocols / methods (POST /login)
+ *   dependency versions (from package.json / go.mod / pyproject.toml)
+ *
+ * What's NOT:
+ *   function bodies, file contents, code snippets
+ *   variable names from inside functions
+ *   comments
+ *   raw AST nodes
+ *
+ * `zivis tm extract --privacy-audit` prints this whole object to stdout
+ * before any network call, so the customer can see exactly what would
+ * be sent.
+ */
 export type Language = "typescript" | "javascript" | "go" | "python";
 export interface EvidenceLocation {
     file: string;
@@ -18,16 +44,21 @@ export interface ConfigEvidence extends EvidenceLocation {
 export type Evidence = HttpRouteEvidence | ImportEvidence | ConfigEvidence;
 export type ComponentKind = "process" | "data_store" | "external_service" | "frontend";
 export interface ExtractedComponent {
+    /** Stable name derived from path / module — never a value from inside a function. */
     name: string;
     kind: ComponentKind;
     language: Language;
+    /** Detected web framework, if any (express | fastify | nextjs | trpc | hono | gin | echo | …). */
     framework?: string;
     sourceFiles: string[];
     evidence: Evidence[];
 }
 export interface ExtractedExternalService {
+    /** Vendor / SDK name — "Anthropic", "OpenAI", "WorkOS". */
     name: string;
+    /** What kind of integration: ai_sdk, payments, auth, observability, etc. */
     kind: string;
+    /** npm/PyPI/Go module identifier ("@anthropic-ai/sdk"). */
     package: string;
     version?: string;
     callSites: EvidenceLocation[];
@@ -53,16 +84,30 @@ export interface ExtractionResult {
     components: ExtractedComponent[];
     externalServices: ExtractedExternalService[];
     dataStores: ExtractedDataStore[];
+    /**
+     * Per-language manifests detected in the scope. Surfaces dependency-only
+     * findings (e.g., "this repo uses @anthropic-ai/sdk@^0.30") even when
+     * we can't yet match call sites.
+     */
     manifests: ManifestSummary[];
 }
 export interface ManifestSummary {
     language: Language;
     file: string;
+    /** Direct dependency names → version (verbatim from manifest). */
     dependencies: Record<string, string>;
 }
+/**
+ * Adapter contract — one per language. Each adapter is fed the list of
+ * source files matched for it (already filtered by .gitignore + .zivisignore)
+ * plus any manifest files (package.json, go.mod, pyproject.toml). Returns
+ * structured findings the framework merges into the final ExtractionResult.
+ */
 export interface LanguageAdapter {
     language: Language;
+    /** File extensions this adapter handles. */
     extensions: string[];
+    /** Manifest filenames this adapter cares about. */
     manifests: string[];
     extract(input: AdapterInput): Promise<AdapterOutput>;
 }

package/dist/internal/extractor/types.js

@@ -1 +1,28 @@
+/**
+ * Extractor output schema.
+ *
+ * Matches `THREAT-MODEL-PHASE-J.md`'s J.2 output shape, with additions
+ * for privacy-audit metadata. The shape is the contract between the CLI
+ * and the eventual `--apply` endpoint that maps into ThreatModelComponent
+ * / OrgComponent records (RECON.3-gated).
+ *
+ * Privacy invariant — what's IN the JSON:
+ *   component names ("auth-service")
+ *   file paths ("src/auth/login.ts")
+ *   line numbers (42)
+ *   framework + SDK identifiers ("express", "@anthropic-ai/sdk")
+ *   detected protocols / methods (POST /login)
+ *   dependency versions (from package.json / go.mod / pyproject.toml)
+ *
+ * What's NOT:
+ *   function bodies, file contents, code snippets
+ *   variable names from inside functions
+ *   comments
+ *   raw AST nodes
+ *
+ * `zivis tm extract --privacy-audit` prints this whole object to stdout
+ * before any network call, so the customer can see exactly what would
+ * be sent.
+ */
 export {};
+//# sourceMappingURL=types.js.map

package/dist/internal/extractor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/internal/extractor/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/internal/extractor/walker.d.ts

@@ -1,7 +1,24 @@
+/**
+ * Filesystem walker — yields source files relative to the scan root,
+ * filtered by .gitignore + .zivisignore + per-extractor extension filters.
+ *
+ * Uses the `ignore` npm package (the same engine git ships with) so the
+ * matching semantics mirror what developers expect from .gitignore.
+ *
+ * Hard limits:
+ *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
+ *    if not in .gitignore. These exist by convention and contain
+ *    third-party code that pollutes the inventory.
+ *  - Caps total files at 50_000 to refuse to scan a generated monorepo
+ *    by accident (extractor would take forever; user should narrow scope).
+ */
 export interface WalkOptions {
     rootDir: string;
+    /** Extensions to include (with the leading dot, e.g. [".ts", ".tsx"]). */
     extensions: string[];
+    /** Manifest basenames to capture regardless of extension (e.g. ["package.json"]). */
     manifests: string[];
+    /** Extra ignore patterns from --ignore CLI flags. */
     extraIgnores?: string[];
 }
 export interface WalkResult {
@@ -11,4 +28,5 @@ export interface WalkResult {
     filesSkipped: number;
 }
 export declare function walk(opts: WalkOptions): Promise<WalkResult>;
+/** Convert an absolute path to a posix-style repo-relative path. */
 export declare function repoRelative(rootDir: string, absPath: string): string;

package/dist/internal/extractor/walker.js

@@ -1,3 +1,17 @@
+/**
+ * Filesystem walker — yields source files relative to the scan root,
+ * filtered by .gitignore + .zivisignore + per-extractor extension filters.
+ *
+ * Uses the `ignore` npm package (the same engine git ships with) so the
+ * matching semantics mirror what developers expect from .gitignore.
+ *
+ * Hard limits:
+ *  - Skips node_modules, dist, build, .next, .git, .yarn, vendor — even
+ *    if not in .gitignore. These exist by convention and contain
+ *    third-party code that pollutes the inventory.
+ *  - Caps total files at 50_000 to refuse to scan a generated monorepo
+ *    by accident (extractor would take forever; user should narrow scope).
+ */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import ignore from "ignore";
@@ -50,6 +64,7 @@ export async function walk(opts) {
                     filesSkipped++;
                     continue;
                 }
+                // ignore() expects gitignore-style paths with trailing /
                 if (ig.ignores(childRel + "/")) {
                     filesSkipped++;
                     continue;
@@ -84,9 +99,12 @@ async function loadIgnoreFile(ig, filePath) {
         ig.add(content);
     }
     catch {
+        // No ignore file — fine.
     }
 }
+/** Convert an absolute path to a posix-style repo-relative path. */
 export function repoRelative(rootDir, absPath) {
     const rel = path.relative(rootDir, absPath);
     return rel.split(path.sep).join("/");
 }
+//# sourceMappingURL=walker.js.map

package/dist/internal/extractor/walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walker.js","sourceRoot":"","sources":["../../../src/internal/extractor/walker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,MAAkB,MAAM,QAAQ,CAAC;AAExC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC;AAmBzB,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEzD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,UAAU,KAAK,CAAC,MAAc,EAAE,MAAc;QACjD,IAAI,WAAW,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO;QAEnE,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE/D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,yDAAyD;gBACzD,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC/B,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACzD,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEpC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE9B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,QAAgB;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,OAAe;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/internal/ide-setup.d.ts

@@ -1,16 +1,7 @@
-export type Package = "appsec" | "builder";
-export type GuidanceClient = "cursor" | "claude-code-cli" | "vscode-copilot" | "vscode-claude" | "cline" | "windsurf";
-export interface GuidanceOptions {
-    cwd: string;
-    client: GuidanceClient;
-}
-export declare function writeGuidance(opts: GuidanceOptions): string[];
-export declare function detectIdesInRepo(cwd: string): GuidanceClient[];
-export declare function setupCursor(pkg?: Package): Promise<void>;
-export declare function setupCursorWorkspace(pkg?: Package): Promise<void>;
-export declare function setupVsCodeCopilot(pkg?: Package): Promise<void>;
-export declare function setupVsCodeClaude(pkg?: Package): Promise<void>;
-export declare function setupClaudeCodeCli(pkg?: Package): Promise<void>;
-export declare function setupCline(pkg?: Package): Promise<void>;
-export declare function setupWindsurf(pkg?: Package): Promise<void>;
-export declare function printClaudeCodeManual(pkg?: Package): void;
+export declare function setupCursor(session?: string): Promise<void>;
+export declare function setupVsCodeCopilot(session?: string): Promise<void>;
+export declare function setupVsCodeClaude(session?: string): Promise<void>;
+export declare function setupClaudeCodeCli(session?: string): Promise<void>;
+export declare function setupCline(session?: string): Promise<void>;
+export declare function setupWindsurf(session?: string): Promise<void>;
+export declare function printClaudeCodeManual(session?: string): void;