@zivis/cli 0.1.0-alpha.5 → 0.1.0-alpha.52

package/dist/internal/extractor/adapters/go/parser.d.ts

@@ -1,6 +1,2 @@
-/**
- * tree-sitter-go loader. Lazy-init, reuses the same WASM directory as
- * the TypeScript adapter (both come from @vscode/tree-sitter-wasm).
- */
 import { Parser } from "web-tree-sitter";
 export declare function getGoParser(): Promise<Parser>;

package/dist/internal/extractor/adapters/go/parser.js

@@ -1,7 +1,3 @@
-/**
- * tree-sitter-go loader. Lazy-init, reuses the same WASM directory as
- * the TypeScript adapter (both come from @vscode/tree-sitter-wasm).
- */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -20,4 +16,3 @@ export function getGoParser() {
     }
     return parserPromise;
 }
-//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/go/scanner.d.ts

@@ -1,23 +1,3 @@
-/**
- * AST scanner for Go source files.
- *
- * Walks tree-sitter-go for two things:
- *
- *   1. import declarations naming any tracked module (AI SDKs, web
- *      frameworks, DB clients) → ImportEvidence
- *   2. HTTP route calls. Three flavors:
- *        net/http  : http.HandleFunc("/path", h)
- *        chi       : r.Get("/path", h), r.Post(…)        (TitleCase)
- *        echo/gin  : e.GET("/path", h), r.POST(…)        (UPPER)
- *        fiber     : app.Get("/path", h), app.Post(…)    (TitleCase)
- *
- * Method-name normalization happens after we identify the call-shape;
- * output is always UPPERCASE in the JSON.
- *
- * Privacy invariant: same as the TS adapter — only identifier names,
- * file paths, line numbers, package paths, and route method/path strings.
- * Function bodies are never read.
- */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;

package/dist/internal/extractor/adapters/go/scanner.js

@@ -1,23 +1,3 @@
-/**
- * AST scanner for Go source files.
- *
- * Walks tree-sitter-go for two things:
- *
- *   1. import declarations naming any tracked module (AI SDKs, web
- *      frameworks, DB clients) → ImportEvidence
- *   2. HTTP route calls. Three flavors:
- *        net/http  : http.HandleFunc("/path", h)
- *        chi       : r.Get("/path", h), r.Post(…)        (TitleCase)
- *        echo/gin  : e.GET("/path", h), r.POST(…)        (UPPER)
- *        fiber     : app.Get("/path", h), app.Post(…)    (TitleCase)
- *
- * Method-name normalization happens after we identify the call-shape;
- * output is always UPPERCASE in the JSON.
- *
- * Privacy invariant: same as the TS adapter — only identifier names,
- * file paths, line numbers, package paths, and route method/path strings.
- * Function bodies are never read.
- */
 import * as fs from "node:fs/promises";
 import { getGoParser } from "./parser.js";
 import { AI_SDK_MODULES, DATA_STORE_MODULES, WEB_FRAMEWORK_MODULES, STDLIB_FRAMEWORKS, } from "./manifest.js";
@@ -74,64 +54,45 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
-/** Pull the quoted module path out of an import_spec node. */
 function extractImportPath(node) {
-    // import_spec → optional package_identifier + interpreted_string_literal
     const stringNode = node.namedChildren.find((c) => c?.type === "interpreted_string_literal");
     if (!stringNode)
         return null;
-    // text is the quoted form; strip the surrounding quotes.
     const text = stringNode.text;
     return text.length >= 2 ? text.slice(1, -1) : null;
 }
 function trackedModuleMatch(pkg) {
     if (TRACKED_MODULES.has(pkg))
         return pkg;
-    // Sub-package import — e.g., "github.com/jackc/pgx/v5/pgxpool"
     for (const tracked of TRACKED_MODULES) {
         if (pkg.startsWith(tracked + "/"))
             return tracked;
     }
     return null;
 }
-/**
- * Match an HTTP-route call by inspecting the call-expression shape.
- * Two AST patterns to handle:
- *   - selector_expression(operand=identifier, field=field_identifier) called with args
- *     ⇒ http.HandleFunc, app.Get, e.GET, r.Post …
- *   - identifier called with args (rare for routes; ignored)
- */
 function extractRouteCall(node) {
-    // call_expression has: function (selector_expression | identifier) + argument_list
     const fn = node.namedChildren.find((c) => c?.type === "selector_expression");
     const args = node.namedChildren.find((c) => c?.type === "argument_list");
     if (!fn || !args)
         return null;
-    // selector_expression: operand (any) . field (field_identifier)
     const operand = fn.namedChildren[0];
     const field = fn.namedChildren.find((c) => c?.type === "field_identifier");
     if (!operand || !field)
         return null;
     const operandText = operand.text;
     const fieldName = field.text;
-    // Determine the HTTP method from the field name + operand shape.
     let method = null;
     if (HTTP_METHODS_UPPER.has(fieldName)) {
-        // echo/gin: e.GET, r.POST … — operand is a router-like local var
         method = fieldName === "ANY" ? "ALL" : fieldName;
     }
     else if (HTTP_METHODS_TITLE.has(fieldName)) {
-        // chi/fiber: r.Get, app.Post …
         method = fieldName.toUpperCase();
     }
     else if (STDLIB_HANDLER_FNS.has(fieldName) && operandText === "http") {
-        // net/http: http.HandleFunc("/x", h) / http.Handle("/x", h)
-        // We don't know the HTTP verb statically — emit "ALL".
         method = "ALL";
     }
     if (!method)
         return null;
-    // First arg = string literal route path.
     const firstArg = args.namedChildren[0];
     if (!firstArg)
         return null;
@@ -150,7 +111,6 @@ export function aggregate(scans) {
         if (s.routes.length === 0 && s.imports.length === 0)
             continue;
         for (const imp of s.imports) {
-            // Match against the FULL tracked module (allowing sub-paths).
             const matched = matchTracked(imp.package);
             if (!matched)
                 continue;
@@ -191,8 +151,6 @@ function matchTracked(pkg) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
-    // Go convention: cmd/foo/main.go → "foo"; internal/auth/handler.go → "auth"
-    // Use the deepest directory that isn't a stdlib-ish folder name.
     const skipPrefixes = new Set(["cmd", "internal", "pkg", "src", "app"]);
     const start = skipPrefixes.has(segs[0]) ? 1 : 0;
     if (segs.length - start >= 2)
@@ -213,4 +171,3 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
-//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/python/index.d.ts

@@ -1,5 +1,2 @@
-/**
- * Python language adapter. Same shape as TS/Go.
- */
 import type { LanguageAdapter } from "../../types.js";
 export declare const pythonAdapter: LanguageAdapter;

package/dist/internal/extractor/adapters/python/index.js

@@ -1,6 +1,3 @@
-/**
- * Python language adapter. Same shape as TS/Go.
- */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -65,4 +62,3 @@ function frameworkFromOwningManifest(sourceFile, manifests) {
         .sort((a, b) => b.dir.length - a.dir.length);
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/python/manifest.d.ts

@@ -1,10 +1,3 @@
-/**
- * Python manifest analysis.
- *
- * Reads pyproject.toml (PEP 621 + Poetry sections) and requirements.txt.
- * Other formats (Pipfile, setup.py) deferred — they're either rare in
- * modern projects (setup.py) or layer on top of these two.
- */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export declare const WEB_FRAMEWORK_PACKAGES: Record<string, string>;
 export declare const DATA_STORE_PACKAGES: Record<string, {
@@ -15,7 +8,6 @@ export declare const AI_SDK_PACKAGES: Record<string, string>;
 export interface ParsedPyManifest {
     filePath: string;
     format: "pyproject.toml" | "requirements.txt";
-    /** package name → version specifier (verbatim, e.g. "^0.30.0", ">=2.0,<3"). */
     deps: Record<string, string>;
 }
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedPyManifest[]>;

package/dist/internal/extractor/adapters/python/manifest.js

@@ -1,10 +1,3 @@
-/**
- * Python manifest analysis.
- *
- * Reads pyproject.toml (PEP 621 + Poetry sections) and requirements.txt.
- * Other formats (Pipfile, setup.py) deferred — they're either rare in
- * modern projects (setup.py) or layer on top of these two.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import TOML from "@iarna/toml";
@@ -20,7 +13,7 @@ export const WEB_FRAMEWORK_PACKAGES = {
     quart: "quart",
 };
 export const DATA_STORE_PACKAGES = {
-    sqlalchemy: { kind: "postgres", client: "sqlalchemy" }, // dialect varies; default to pg
+    sqlalchemy: { kind: "postgres", client: "sqlalchemy" },
     asyncpg: { kind: "postgres", client: "asyncpg" },
     psycopg: { kind: "postgres", client: "psycopg" },
     psycopg2: { kind: "postgres", client: "psycopg2" },
@@ -45,7 +38,7 @@ export const AI_SDK_PACKAGES = {
     vertexai: "Vertex AI",
     "google-generativeai": "Google Generative AI",
     cohere: "Cohere",
-    "boto3": "AWS (boto3)", // bedrock typically uses boto3
+    "boto3": "AWS (boto3)",
 };
 export async function readManifests(rootDir, manifestFiles) {
     const out = [];
@@ -61,7 +54,6 @@ export async function readManifests(rootDir, manifestFiles) {
             }
         }
         catch {
-            // skip unreadable / unparsable
         }
     }
     return out;
@@ -79,7 +71,6 @@ function parsePyproject(filePath, rootDir, raw) {
     catch {
         return result;
     }
-    // PEP 621: project.dependencies = ["fastapi >=0.100", ...]
     const projectDeps = parsed?.project?.dependencies;
     if (Array.isArray(projectDeps)) {
         for (const spec of projectDeps) {
@@ -90,7 +81,6 @@ function parsePyproject(filePath, rootDir, raw) {
                 result.deps[name] = version;
         }
     }
-    // PEP 621: optional-dependencies = { test = [...], dev = [...] }
     const opt = parsed?.project?.["optional-dependencies"];
     if (opt && typeof opt === "object") {
         for (const groupSpec of Object.values(opt)) {
@@ -105,7 +95,6 @@ function parsePyproject(filePath, rootDir, raw) {
             }
         }
     }
-    // Poetry: tool.poetry.dependencies = { fastapi = "^0.100" } (also dev-dependencies)
     const poetryDeps = parsed?.tool?.poetry?.dependencies;
     if (poetryDeps && typeof poetryDeps === "object") {
         for (const [name, value] of Object.entries(poetryDeps)) {
@@ -137,8 +126,7 @@ function parseRequirementsTxt(filePath, rootDir, raw) {
         if (!line || line.startsWith("#"))
             continue;
         if (line.startsWith("-"))
-            continue; // -e, -r, -c, --hash, etc.
-        // strip inline comments
+            continue;
         const hashAt = line.indexOf(" #");
         if (hashAt > 0)
             line = line.slice(0, hashAt).trim();
@@ -148,9 +136,7 @@ function parseRequirementsTxt(filePath, rootDir, raw) {
     }
     return result;
 }
-/** "fastapi>=0.100,<0.110" → ["fastapi", ">=0.100,<0.110"] */
 function splitPep508(spec) {
-    // strip extras like fastapi[all]
     const cleaned = spec.replace(/\[[^\]]*\]/g, "").trim();
     const m = cleaned.match(/^([A-Za-z0-9_.\-]+)\s*(.*)$/);
     if (!m)
@@ -185,6 +171,24 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
+        for (const [pkg, vendor] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
+            const ver = m.deps[pkg];
+            if (!ver)
+                continue;
+            const key = `web_framework::${pkg}`;
+            const existing = seen.get(key);
+            if (existing) {
+                existing.callSites.push({ file: m.filePath, line: 1 });
+                continue;
+            }
+            seen.set(key, {
+                name: vendor,
+                kind: "web_framework",
+                package: pkg,
+                version: ver,
+                callSites: [{ file: m.filePath, line: 1 }],
+            });
+        }
     }
     return [...seen.values()];
 }
@@ -233,4 +237,3 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=manifest.js.map

package/dist/internal/extractor/adapters/python/parser.d.ts

@@ -1,5 +1,2 @@
-/**
- * tree-sitter-python loader.
- */
 import { Parser } from "web-tree-sitter";
 export declare function getPythonParser(): Promise<Parser>;

package/dist/internal/extractor/adapters/python/parser.js

@@ -1,6 +1,3 @@
-/**
- * tree-sitter-python loader.
- */
 import { createRequire } from "node:module";
 import * as path from "node:path";
 import { Parser, Language } from "web-tree-sitter";
@@ -19,4 +16,3 @@ export function getPythonParser() {
     }
     return parserPromise;
 }
-//# sourceMappingURL=parser.js.map

package/dist/internal/extractor/adapters/python/scanner.d.ts

@@ -1,21 +1,3 @@
-/**
- * AST scanner for Python source files.
- *
- * Patterns covered:
- *   1. import_statement / import_from_statement → tracked-package imports
- *      (AI SDKs, web frameworks, DB clients).
- *   2. Decorator-based routes (FastAPI, Flask):
- *        @app.get("/path")            → method=GET
- *        @app.post("/path")           → method=POST
- *        @app.route("/path", …)       → method=ALL (Flask default; verbs in `methods=` kw not parsed yet)
- *        @router.get("/x", …)         → method=GET (FastAPI APIRouter convention)
- *   3. Django urls.py-style call: path("/route", view, …) / re_path(…)  → method=ALL
- *   4. aiohttp: app.router.add_get("/path", h) / add_post(…) / etc.
- *
- * Privacy invariant: identifier names + dotted attribute names + string
- * literals on routes only. Function bodies and decorator args beyond the
- * route path are never inspected.
- */
 import type { EvidenceLocation, Evidence, HttpRouteEvidence, ImportEvidence } from "../../types.js";
 export interface FileScanResult {
     file: string;

package/dist/internal/extractor/adapters/python/scanner.js

@@ -1,21 +1,3 @@
-/**
- * AST scanner for Python source files.
- *
- * Patterns covered:
- *   1. import_statement / import_from_statement → tracked-package imports
- *      (AI SDKs, web frameworks, DB clients).
- *   2. Decorator-based routes (FastAPI, Flask):
- *        @app.get("/path")            → method=GET
- *        @app.post("/path")           → method=POST
- *        @app.route("/path", …)       → method=ALL (Flask default; verbs in `methods=` kw not parsed yet)
- *        @router.get("/x", …)         → method=GET (FastAPI APIRouter convention)
- *   3. Django urls.py-style call: path("/route", view, …) / re_path(…)  → method=ALL
- *   4. aiohttp: app.router.add_get("/path", h) / add_post(…) / etc.
- *
- * Privacy invariant: identifier names + dotted attribute names + string
- * literals on routes only. Function bodies and decorator args beyond the
- * route path are never inspected.
- */
 import * as fs from "node:fs/promises";
 import { getPythonParser } from "./parser.js";
 import { AI_SDK_PACKAGES, DATA_STORE_PACKAGES, WEB_FRAMEWORK_PACKAGES, } from "./manifest.js";
@@ -87,22 +69,9 @@ function walk(node, visit) {
             walk(child, visit);
     }
 }
-/**
- * Pull the top-level package(s) out of an import statement.
- *
- * - `import anthropic` → ["anthropic"]
- * - `import langchain.chat_models` → ["langchain"] (we track the root)
- * - `from fastapi import FastAPI` → ["fastapi"]
- * - `from langchain.schema import HumanMessage` → ["langchain"]
- *
- * Sub-modules collapse to the root because the manifest table is keyed
- * by distribution name, which is also the import root for the packages
- * we care about.
- */
 function extractImportPackages(node) {
     const out = [];
     if (node.type === "import_from_statement") {
-        // import_from_statement → module_name as the "module" field
         const moduleField = node.childForFieldName("module_name");
         if (moduleField) {
             const root = topLevelImportName(moduleField);
@@ -111,7 +80,6 @@ function extractImportPackages(node) {
         }
         return out;
     }
-    // import_statement: one or more dotted_name (or aliased_import wrapping it)
     for (const child of node.namedChildren) {
         if (!child)
             continue;
@@ -141,13 +109,7 @@ function topLevelImportName(node) {
 function trackedPackageMatch(pkg) {
     return TRACKED_PACKAGES.has(pkg) ? pkg : null;
 }
-/**
- * Match @app.get("/path"), @router.post(…), @app.route("/x", …).
- * Returns the route + method, or null if it isn't a known shape.
- */
 function extractDecoratorRoute(node) {
-    // decorator → `@` + (call | attribute | identifier)
-    // We only care about call shapes: @app.get("/path", …)
     const callNode = node.namedChildren.find((c) => c?.type === "call");
     if (!callNode)
         return null;
@@ -163,37 +125,28 @@ function extractDecoratorRoute(node) {
         return null;
     const objectName = objectNode.text.toLowerCase();
     const attrName = attrNode.text.toLowerCase();
-    // Object must be a router-y identifier — keep the false-positive surface
-    // tight even though we'd lose decorators on uncommon names like `myapi`.
     if (!ROUTER_IDENTIFIERS.has(objectName))
         return null;
     let method = null;
     if (HTTP_METHODS.has(attrName))
         method = attrName.toUpperCase();
     else if (attrName === "route")
-        method = "ALL"; // Flask default; verbs in methods= kwarg not yet parsed
+        method = "ALL";
     if (!method)
         return null;
     return readRoutePath(args, method);
 }
-/**
- * Match Django path("/route", view, …) / re_path(…) and aiohttp
- * app.router.add_get("/path", h) / add_post(…) etc.
- */
 function extractCallRoute(node) {
     const fn = node.childForFieldName("function");
     const args = node.childForFieldName("arguments");
     if (!fn || !args)
         return null;
-    // Django: bare identifier function, e.g. `path("/route", view)`.
     if (fn.type === "identifier") {
         const name = fn.text;
         if (!DJANGO_PATH_FNS.has(name))
             return null;
         return readRoutePath(args, "ALL");
     }
-    // aiohttp: app.router.add_get("/path", h) — attribute call where the
-    // method name is encoded into the attribute (add_get, add_post, …).
     if (fn.type === "attribute") {
         const attrNode = fn.childForFieldName("attribute");
         if (!attrNode)
@@ -205,20 +158,16 @@ function extractCallRoute(node) {
     }
     return null;
 }
-/** Pull the first positional string-literal argument as the route path. */
 function readRoutePath(argsNode, method) {
     for (const arg of argsNode.namedChildren) {
         if (!arg)
             continue;
-        // Skip kwargs (we only want the first positional).
         if (arg.type === "keyword_argument")
             continue;
         if (arg.type !== "string")
             return null;
-        // string → string_start, string_content, string_end
         const content = arg.namedChildren.find((c) => c?.type === "string_content");
         if (!content) {
-            // fall back: strip leading/trailing quote chars from raw text
             const text = arg.text;
             if (text.length >= 2 && (text.startsWith('"') || text.startsWith("'"))) {
                 return { method, path: text.slice(1, -1) };
@@ -265,7 +214,6 @@ export function aggregate(scans) {
 }
 function deriveComponentName(filePath) {
     const segs = filePath.split("/");
-    // Skip common project-layout prefixes.
     const skipPrefixes = new Set(["src", "app", "apps", "backend", "api"]);
     const start = skipPrefixes.has(segs[0]) ? 1 : 0;
     if (segs.length - start >= 2)
@@ -281,4 +229,3 @@ function detectFrameworkFromImports(imports) {
     }
     return undefined;
 }
-//# sourceMappingURL=scanner.js.map

package/dist/internal/extractor/adapters/typescript/index.d.ts

@@ -1,9 +1,2 @@
-/**
- * TypeScript / JavaScript language adapter.
- *
- * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
- * (cheap, runs against package.json) with AST scanning (per source file)
- * to produce components, external services, and data stores.
- */
 import type { LanguageAdapter } from "../../types.js";
 export declare const typescriptAdapter: LanguageAdapter;

package/dist/internal/extractor/adapters/typescript/index.js

@@ -1,10 +1,3 @@
-/**
- * TypeScript / JavaScript language adapter.
- *
- * Handles .ts/.tsx/.js/.jsx + package.json. Combines manifest analysis
- * (cheap, runs against package.json) with AST scanning (per source file)
- * to produce components, external services, and data stores.
- */
 import * as path from "node:path";
 import { readManifests, summarizeManifests, findExternalServices, findDataStores, detectFrameworkFromManifest, } from "./manifest.js";
 import { scanFile, aggregate } from "./scanner.js";
@@ -15,13 +8,10 @@ export const typescriptAdapter = {
     manifests: ["package.json"],
     async extract(input) {
         const { rootDir, sourceFiles, manifestFiles } = input;
-        // Manifest pass — fast, runs entirely on package.json contents.
         const parsedManifests = await readManifests(rootDir, manifestFiles);
         const manifestSummaries = summarizeManifests(parsedManifests);
         const manifestExternalServices = findExternalServices(parsedManifests);
         const manifestDataStores = findDataStores(parsedManifests);
-        // AST pass — only on source files. Cap at MAX_SOURCE_FILES per run
-        // for the Phase J <60s budget on a 100k-LOC monorepo.
         const MAX_SOURCE_FILES = 5_000;
         const filesToScan = sourceFiles.slice(0, MAX_SOURCE_FILES);
         const scans = await Promise.all(filesToScan.map(async (abs) => {
@@ -33,10 +23,7 @@ export const typescriptAdapter = {
             }
         }));
         const agg = aggregate(scans);
-        // Map scanner output → ExtractedComponent shape.
         const components = agg.components.map((c) => {
-            // Best-effort framework inference: scanner picks up imports; manifest
-            // picks up the dep. Either signal counts.
             const framework = c.framework ?? frameworkFromOwningManifest(c.sourceFile, parsedManifests);
             return {
                 name: c.name,
@@ -47,13 +34,11 @@ export const typescriptAdapter = {
                 evidence: [...c.routes, ...c.imports],
             };
         });
-        // Augment manifest-derived ExternalServices with AST call sites.
         for (const svc of manifestExternalServices) {
             const sites = agg.aiSdkCallSites.get(svc.package);
             if (sites)
                 svc.callSites.push(...sites);
         }
-        // Augment manifest-derived DataStores with import-evidence from source.
         for (const store of manifestDataStores) {
             if (!store.client)
                 continue;
@@ -69,16 +54,11 @@ export const typescriptAdapter = {
         };
     },
 };
-/**
- * Walk up from a source file's path to find the closest package.json
- * we parsed; return the framework hint from that manifest.
- */
 function frameworkFromOwningManifest(sourceFile, manifests) {
     const sourceDir = path.posix.dirname(sourceFile);
     const candidates = manifests
         .map((m) => ({ m, dir: path.posix.dirname(m.filePath) }))
         .filter(({ dir }) => sourceDir === dir || sourceDir.startsWith(dir + "/"))
-        .sort((a, b) => b.dir.length - a.dir.length); // closest wins
+        .sort((a, b) => b.dir.length - a.dir.length);
     return candidates[0] ? detectFrameworkFromManifest(candidates[0].m) : undefined;
 }
-//# sourceMappingURL=index.js.map

package/dist/internal/extractor/adapters/typescript/manifest.d.ts

@@ -1,11 +1,3 @@
-/**
- * TypeScript / JavaScript manifest analysis.
- *
- * Reads package.json files (root + workspaces) to classify dependencies
- * into the categories the threat-model graph cares about. Used both for
- * the manifests block of the output and as a hint for which AST queries
- * are worth running on which files.
- */
 import type { ExtractedExternalService, ExtractedDataStore, ManifestSummary } from "../../types.js";
 export interface PackageJson {
     name?: string;
@@ -28,14 +20,8 @@ export interface ParsedManifest {
     packageName?: string;
     deps: Record<string, string>;
 }
-/**
- * Read every package.json, return per-file dependency maps. Combines
- * dependencies + devDependencies (we want both — devDeps include things
- * like @types that signal use, plus dev-only auth packages).
- */
 export declare function readManifests(rootDir: string, manifestFiles: string[]): Promise<ParsedManifest[]>;
 export declare function summarizeManifests(parsed: ParsedManifest[]): ManifestSummary[];
 export declare function findExternalServices(parsed: ParsedManifest[]): ExtractedExternalService[];
 export declare function findDataStores(parsed: ParsedManifest[]): ExtractedDataStore[];
-/** Pick the most likely web framework for a manifest's owning package. */
 export declare function detectFrameworkFromManifest(m: ParsedManifest): string | undefined;

package/dist/internal/extractor/adapters/typescript/manifest.js

@@ -1,11 +1,3 @@
-/**
- * TypeScript / JavaScript manifest analysis.
- *
- * Reads package.json files (root + workspaces) to classify dependencies
- * into the categories the threat-model graph cares about. Used both for
- * the manifests block of the output and as a hint for which AST queries
- * are worth running on which files.
- */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 export const WEB_FRAMEWORK_PACKAGES = {
@@ -15,9 +7,14 @@ export const WEB_FRAMEWORK_PACKAGES = {
     "@trpc/server": "trpc",
     hono: "hono",
     koa: "koa",
+    "@nestjs/core": "nestjs",
+    "@nestjs/common": "nestjs",
+    "@hapi/hapi": "hapi",
+    "express-graphql": "express",
+    "apollo-server-express": "express",
 };
 export const DATA_STORE_PACKAGES = {
-    "@prisma/client": { kind: "postgres", client: "@prisma/client" }, // assumes postgres; could be MySQL/SQLite via schema
+    "@prisma/client": { kind: "postgres", client: "@prisma/client" },
     pg: { kind: "postgres", client: "pg" },
     postgres: { kind: "postgres", client: "postgres" },
     mongoose: { kind: "mongo", client: "mongoose" },
@@ -38,11 +35,6 @@ export const AI_SDK_PACKAGES = {
     "@langchain/core": "LangChain",
     llamaindex: "LlamaIndex",
 };
-/**
- * Read every package.json, return per-file dependency maps. Combines
- * dependencies + devDependencies (we want both — devDeps include things
- * like @types that signal use, plus dev-only auth packages).
- */
 export async function readManifests(rootDir, manifestFiles) {
     const out = [];
     for (const file of manifestFiles) {
@@ -63,7 +55,6 @@ export async function readManifests(rootDir, manifestFiles) {
             });
         }
         catch {
-            // Skip broken JSON; not our job to validate the customer's manifests.
         }
     }
     return out;
@@ -98,6 +89,26 @@ export function findExternalServices(parsed) {
                 callSites: [{ file: m.filePath, line: 1 }],
             });
         }
+        for (const [pkg, vendor] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
+            const ver = m.deps[pkg];
+            if (!ver)
+                continue;
+            const key = `web_framework::${pkg}`;
+            const existing = seen.get(key);
+            if (existing) {
+                existing.callSites.push({ file: m.filePath, line: 1 });
+                if (!existing.version)
+                    existing.version = ver;
+                continue;
+            }
+            seen.set(key, {
+                name: vendor,
+                kind: "web_framework",
+                package: pkg,
+                version: ver,
+                callSites: [{ file: m.filePath, line: 1 }],
+            });
+        }
     }
     return [...seen.values()];
 }
@@ -125,7 +136,6 @@ export function findDataStores(parsed) {
     }
     return [...seen.values()];
 }
-/** Pick the most likely web framework for a manifest's owning package. */
 export function detectFrameworkFromManifest(m) {
     for (const [pkg, framework] of Object.entries(WEB_FRAMEWORK_PACKAGES)) {
         if (m.deps[pkg])
@@ -153,4 +163,3 @@ function relPosix(rootDir, abs) {
     const rel = path.relative(rootDir, abs);
     return rel.split(path.sep).join("/");
 }
-//# sourceMappingURL=manifest.js.map