cg-code-graph 0.10.1__py3-none-any.whl

codegraph/presets/__init__.py

@@ -0,0 +1,146 @@
+"""Built-in presets: versioned data files with the per-language and per-framework knowledge cg applies.
+
+    common.yaml          every project: name-based auth / secret token patterns, directories no walk descends into
+    <language>.yaml      php, typescript, python, dart, rust, c_cpp: skip directories / paths of that ecosystem
+    <framework>.yaml     laravel, django, djangorestframework, django-ninja, nest, next, express, nuxt: guard names
+                         (auth / not_auth / secret), plan defaults, framework-specific skip directories
+
+Detection picks them: `select()` returns the applied names in merge order (common -> languages -> frameworks); the
+project's `.cg.yaml` and command-line flags come after them. The index records the applied names in its stats
+(`stats.presets`), and `cg coverage`, `cg config show` and MCP `coverage` show them."""
+from __future__ import annotations
+
+import functools
+import re
+from pathlib import Path
+
+PRESET_DIR = Path(__file__).parent
+LANGUAGE_ORDER = ("php", "typescript", "python", "dart", "rust", "c_cpp", "kotlin", "swift")
+# framework spellings accepted in .cg.yaml `frameworks.add/remove` -> framework plugin / preset name
+FRAMEWORK_ALIASES = {"nestjs": "nest", "next": "nextjs", "next.js": "nextjs", "koa": "express", "fastify": "express",
+                     "hono": "express", "starlette": "fastapi", "drf": "djangorestframework", "ninja": "django-ninja"}
+
+
+class PresetError(ValueError):
+    pass
+
+
+@functools.lru_cache(maxsize=None)
+def load(name: str) -> dict:
+    p = PRESET_DIR / f"{name}.yaml"
+    if not p.is_file():
+        raise PresetError(f"no built-in preset '{name}' (available: {', '.join(available())})")
+    import yaml
+    d = yaml.safe_load(p.read_text(encoding="utf-8")) or {}
+    if d.get("name") != name:
+        raise PresetError(f"preset file {p.name}: name must be '{name}'")
+    return d
+
+
+def available() -> list[str]:
+    return sorted(p.stem for p in PRESET_DIR.glob("*.yaml"))
+
+
+def has(name: str) -> bool:
+    return (PRESET_DIR / f"{name}.yaml").is_file()
+
+
+def skip_dirs(preset: str = "common", *keys: str) -> frozenset[str]:
+    """Directory names a walk skips: common.skip_dirs plus `keys` of `preset` (default its own skip_dirs)."""
+    out = set(load("common").get("skip_dirs") or [])
+    for k in keys or ("skip_dirs",):
+        out |= set(load(preset).get(k) or [])
+    return frozenset(out)
+
+
+def values(preset: str, *path: str, default=None):
+    """A nested value of one preset file, e.g. values("laravel", "plans", "short_prefixes")."""
+    d = load(preset)
+    for k in path:
+        if not isinstance(d, dict) or k not in d:
+            return default
+        d = d[k]
+    return d
+
+
+def select(languages, frameworks) -> list[str]:
+    """Applied preset names in merge order for the active language plugins and frameworks."""
+    out = ["common"]
+    out += [lang for lang in LANGUAGE_ORDER if lang in set(languages) and has(lang)]
+    for f in frameworks:
+        f = FRAMEWORK_ALIASES.get(f, f)
+        if f not in out and has(f) and load(f).get("kind") == "framework":
+            out.append(f)
+    return out
+
+
+def frameworks() -> list[str]:
+    return [n for n in available() if load(n).get("kind") == "framework"]
+
+
+def name_tokens(name: str) -> str:
+    """'ApiKeyGuard' -> 'api_key_guard', 'auth:api' -> 'auth_api', 'password.confirm' -> 'password_confirm'."""
+    return "_".join(t.lower() for t in re.findall(r"[A-Z]?[a-z0-9]+|[A-Z]+(?![a-z])", name or ""))
+
+
+class NameSet:
+    """Guard names from presets. lookup() matches the guard's own name, so `auth` matches `auth:api`, `can` matches
+    `can:update,post`, `AuthGuard` matches `AuthGuard('jwt')` and `IsAuthenticated` matches
+    `rest_framework.permissions.IsAuthenticated`, while a project's own `MaintenanceAuthGuard` is left to the name
+    pattern. contains() matches the preset name anywhere in the guard's word tokens (for names that never count as
+    auth, such as `ThrottlerGuard` in `CustomThrottlerGuard`). Both name the preset the entry came from."""
+
+    def __init__(self, entries: list[tuple[str, str, str]]):   # (name, preset, source)
+        self.by_tok: dict[str, tuple[str, str, str]] = {}
+        for name, preset, source in entries:
+            self.by_tok.setdefault(name_tokens(name), (name, preset, source))
+        toks = sorted((t for t in self.by_tok if t), key=len, reverse=True)
+        self.rx = re.compile(r"(?:^|_)(" + "|".join(map(re.escape, toks)) + r")(?=_|$)") if toks else None
+
+    def lookup(self, name: str) -> tuple[str, str, str] | None:
+        for c in own_names(name):
+            hit = self.by_tok.get(name_tokens(c))
+            if hit:
+                return hit
+        return None
+
+    def contains(self, name: str) -> tuple[str, str, str] | None:
+        if not self.rx:
+            return None
+        m = self.rx.search(name_tokens(name))
+        return self.by_tok[m.group(1)] if m else None
+
+    def __len__(self):
+        return len(self.by_tok)
+
+
+def own_names(name: str) -> list[str]:
+    """The names a guard is known by, without its namespace, parameters or call arguments:
+    'auth:sanctum' -> auth, 'Illuminate\\Auth\\Middleware\\Authenticate' -> Authenticate, "AuthGuard('jwt')" -> AuthGuard,
+    'App\\Http\\Middleware\\Authorize::handle' -> Authorize, 'rest_framework.permissions.IsAuthenticated' -> both the
+    dotted name and IsAuthenticated, 'passport.authenticate' stays whole."""
+    n = (name or "").strip().lstrip("@")
+    n = re.sub(r"::\w+$", "", n).split("(", 1)[0]
+    if "::" not in n:
+        n = n.split(":", 1)[0]
+    n = re.split(r"[\\/]", n)[-1].strip()
+    out = [n] if n else []
+    if "." in n:
+        last = n.rsplit(".", 1)[1]
+        if last[:1].isupper():
+            out.append(last)
+    return out
+
+
+def guard_names(applied: list[str], section: str, key: str = "guards") -> NameSet:
+    """auth.guards / auth.not_auth / secret.guards of the applied presets, in merge order."""
+    entries = []
+    for p in applied:
+        if not has(p):
+            continue
+        for g in values(p, section, key, default=[]) or []:
+            if isinstance(g, dict) and g.get("name"):
+                entries.append((str(g["name"]), p, str(g.get("source") or "")))
+            elif isinstance(g, str):
+                entries.append((g, p, ""))
+    return NameSet(entries)

codegraph/presets/c_cpp.yaml

@@ -0,0 +1,9 @@
+name: c_cpp
+kind: language
+docs: docs/native.md
+# version-control state, vendored third-party trees and test frameworks, CMake / Bazel build output, caches
+# (CODEGRAPH_EXCLUDE_DIRS / CODEGRAPH_INCLUDE_DIRS adjust this list for C / C++; .cg.yaml skip_dirs for every language)
+skip_dirs: [.hg, .svn, target, third_party, thirdparty, third-party, 3rdparty, googletest, gtest, gmock, catch2,
+            doctest, vendor, external, extern, deps, _deps, .cache, CMakeFiles, bazel-out, .venv]
+# build trees by name prefix (build-release/, cmake-build-debug/); a directory holding CMakeCache.txt is skipped too
+skip_dir_prefixes: [build, cmake-build]

codegraph/presets/common.yaml

@@ -0,0 +1,66 @@
+# Built-in knowledge every project gets, before the language and framework presets and the project's .cg.yaml.
+# Format (every preset file): name, kind (common | language | framework), docs, then any of the sections below.
+#   auth / secret     guard names that count as user auth / as a shared-secret or signature check (`cg routes`)
+#   skip_dirs         directory names that never hold project source: dependencies, build output, caches, tool state
+# Lists are merged in order common -> language -> framework -> .cg.yaml -> command-line flags.
+name: common
+kind: common
+docs: docs/configuration.md#presets
+auth:
+  # Name-based fallback for every stack: matched against the guard name split into lower-case word tokens joined by
+  # "_" (ApiKeyGuard -> api_key_guard, auth:api -> auth_api, IsAuthenticated -> is_authenticated), so
+  # AuditLogInterceptor does not count as "login".
+  token_pattern: '(^|_)(auth|authn|authz|authed|authenticate[ds]?|authentication|authori[sz](e[ds]?|ation|er)|login|logged|jwt|token|session|sanctum|passport|bearer|api_key|permissions?|permission_[a-z]+|admin|staff|superuser|can|roles?|acl|verified|protected|protect|require_user|current_user|oauth[a-z0-9]*|oidc|saml|clerk|firebase_auth)(_|$)'
+secret:
+  # shared-secret / signature verification (webhooks, signed URLs): the caller proves it knows a secret, not who it is
+  token_pattern: '(^|_)(signed|signature|signatures|hmac|secret|webhook_secret)(_|$)|(^|_)verify(_[a-z0-9]+)*_webhooks?(_|$)|(^|_)webhooks?(_[a-z0-9]+)*_(verify|verified|verification|signature|secret|hmac)(_|$)'
+# skipped by every directory walk (language plugins, extractors, the coverage scan)
+skip_dirs: [.git, node_modules, __pycache__]
+# the coverage scan (`cg coverage`: which source files exist) also skips these dependency / build / IDE directories
+scan_skip_dirs: [vendor, target, build, dist, .dart_tool, .venv, venv, .tox, .mypy_cache, .pytest_cache, .next, .output,
+                 out, .gradle, .idea, Pods, .build, .swiftpm, DerivedData, Carthage]
+# generated files (codegraph/core/generated.py): kept out of the graph by default and listed by `cg coverage`
+generated:
+  # framework build output directories (names at any depth) -> reason
+  build_dirs:
+    .nuxt: Nuxt build output (.nuxt/)
+    .output: Nitro / Nuxt build output (.output/)
+    .next: Next.js build output (.next/)
+    .svelte-kit: SvelteKit build output (.svelte-kit/)
+    .docusaurus: Docusaurus build output (.docusaurus/)
+    dist: build output (dist/)
+    build: build output (build/)
+  # paths written by tools (gitignore-style globs) -> reason
+  paths:
+    "**/Flutter/ephemeral/**": Flutter tool output (ephemeral/)
+    "**/flutter/ephemeral/**": Flutter tool output (ephemeral/)
+  # file names written by code generators (globs on the file name) -> generator
+  files:
+    "*.g.dart": build_runner output (*.g.dart)
+    "*.freezed.dart": freezed output (*.freezed.dart)
+    "*.gr.dart": auto_route output (*.gr.dart)
+    "*.mocks.dart": mockito output (*.mocks.dart)
+    "*.config.dart": injectable output (*.config.dart)
+    "generated_plugin_registrant.*": Flutter plugin registrant
+    "GeneratedPluginRegistrant.*": Flutter plugin registrant
+    "*.pb.dart": protoc output (Dart)
+    "*.pbenum.dart": protoc output (Dart)
+    "*.pbjson.dart": protoc output (Dart)
+    "*.pbgrpc.dart": protoc output (Dart)
+    "*.pbserver.dart": protoc output (Dart)
+    "*_pb2.py": protoc output (Python)
+    "*_pb2_grpc.py": protoc output (Python)
+    "*.pb.go": protoc output (Go)
+    "*_grpc.pb.go": protoc output (Go)
+    "*_pb.ts": protoc output (TypeScript)
+    "*_pb.js": protoc output (JavaScript)
+    "*_grpc_pb.ts": protoc output (TypeScript)
+    "*_grpc_pb.js": protoc output (JavaScript)
+    "*.pb.swift": protoc output (Swift)
+    "*.grpc.swift": protoc output (Swift)
+    "R.generated.swift": R.swift output
+    "*.pb.cc": protoc output (C++)
+    "*.pb.h": protoc output (C++)
+    "*.grpc.pb.cc": protoc output (C++)
+    "*.grpc.pb.h": protoc output (C++)
+    "*.pb.rs": protoc output (Rust)

codegraph/presets/dart.yaml

@@ -0,0 +1,9 @@
+name: dart
+kind: language
+docs: https://dart.dev/tools/pub/package-layout
+# pub / build output, CocoaPods, FVM and IDE state
+skip_dirs: [.dart_tool, build, .pub-cache, Pods, .symlinks, .fvm, .idea]
+# platform runner directories of a Flutter app: never hold a Dart package of their own
+package_skip_dirs: [build, Pods, ios, android, windows, linux, macos, web]
+# generated Dart sources (freezed, mockito, injectable, auto_route); `dart_keep_generated` keeps them
+generated_suffixes: [.freezed.dart, .mocks.dart, .config.dart, .gr.dart]

codegraph/presets/django-ninja.yaml

@@ -0,0 +1,15 @@
+name: django-ninja
+kind: framework
+docs: https://django-ninja.dev/guides/authentication/
+auth:
+  # values of `auth=` on an operation, router or NinjaAPI
+  guards:
+    - {name: django_auth, source: "ninja.security.django_auth (session auth)"}
+    - {name: django_auth_superuser, source: "ninja.security.django_auth_superuser"}
+    - {name: django_auth_is_staff, source: "ninja.security.django_auth_is_staff"}
+    - {name: HttpBearer, source: "ninja.security.HttpBearer"}
+    - {name: HttpBasicAuth, source: "ninja.security.HttpBasicAuth"}
+    - {name: APIKeyHeader, source: "ninja.security.APIKeyHeader"}
+    - {name: APIKeyQuery, source: "ninja.security.APIKeyQuery"}
+    - {name: APIKeyCookie, source: "ninja.security.APIKeyCookie"}
+    - {name: SessionAuth, source: "ninja.security.SessionAuth"}

codegraph/presets/django.yaml

@@ -0,0 +1,25 @@
+name: django
+kind: framework
+docs: https://docs.djangoproject.com/en/stable/topics/auth/default/#limiting-access-to-logged-in-users
+auth:
+  guards:
+    - {name: login_required, source: "django.contrib.auth.decorators.login_required"}
+    - {name: permission_required, source: "django.contrib.auth.decorators.permission_required"}
+    - {name: user_passes_test, source: "django.contrib.auth.decorators.user_passes_test"}
+    - {name: staff_member_required, source: "django.contrib.admin.views.decorators.staff_member_required"}
+    - {name: LoginRequiredMixin, source: "django.contrib.auth.mixins.LoginRequiredMixin"}
+    - {name: PermissionRequiredMixin, source: "django.contrib.auth.mixins.PermissionRequiredMixin"}
+    - {name: UserPassesTestMixin, source: "django.contrib.auth.mixins.UserPassesTestMixin"}
+    - {name: LoginRequiredMiddleware, source: "django.contrib.auth.middleware.LoginRequiredMiddleware (Django 5.1)"}
+  # names that read like auth but mark a view public or check something else
+  not_auth:
+    - {name: login_not_required, source: "django.contrib.auth.decorators.login_not_required (Django 5.1): opts a view out of LoginRequiredMiddleware"}
+    - {name: csrf_protect, source: "django.views.decorators.csrf.csrf_protect: CSRF token check, not user auth"}
+# what the Django plugin records as a view's access checks (route attrs.access, read by `cg routes`): these decorators
+# and mixins by name, any decorator whose name matches name_pattern (unless opt_out_pattern), any decorator matching
+# the project's .cg.yaml auth / secret extra_patterns, and signature-check decorators (common secret token pattern)
+access:
+  decorators: [login_required, permission_required, user_passes_test, staff_member_required, superuser_required]
+  mixins: [LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, AccessMixin]
+  name_pattern: '(auth|login|permission|staff|superuser|token|jwt)'
+  opt_out_pattern: 'not_required|exempt|optional|allow_any'

codegraph/presets/djangorestframework.yaml

@@ -0,0 +1,17 @@
+name: djangorestframework
+kind: framework
+docs: https://www.django-rest-framework.org/api-guide/permissions/
+auth:
+  guards:
+    - {name: IsAuthenticated, source: "rest_framework.permissions.IsAuthenticated"}
+    - {name: IsAdminUser, source: "rest_framework.permissions.IsAdminUser"}
+    - {name: IsAuthenticatedOrReadOnly, source: "rest_framework.permissions.IsAuthenticatedOrReadOnly (writes need auth)"}
+    - {name: DjangoModelPermissions, source: "rest_framework.permissions.DjangoModelPermissions"}
+    - {name: DjangoModelPermissionsOrAnonReadOnly, source: "rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly"}
+    - {name: DjangoObjectPermissions, source: "rest_framework.permissions.DjangoObjectPermissions"}
+    - {name: TokenAuthentication, source: "rest_framework.authentication.TokenAuthentication, https://www.django-rest-framework.org/api-guide/authentication/"}
+    - {name: SessionAuthentication, source: "rest_framework.authentication.SessionAuthentication"}
+    - {name: BasicAuthentication, source: "rest_framework.authentication.BasicAuthentication"}
+    - {name: JWTAuthentication, source: "rest_framework_simplejwt.authentication.JWTAuthentication"}
+  not_auth:
+    - {name: AllowAny, source: "rest_framework.permissions.AllowAny: explicitly public"}

codegraph/presets/express.yaml

@@ -0,0 +1,17 @@
+name: express
+kind: framework
+docs: https://expressjs.com/en/guide/using-middleware.html
+# Express, Koa, Fastify, Hono and the other servers of the express plugin (SERVER_DEPS in codegraph/plugins/tsweb/common.py)
+auth:
+  guards:
+    - {name: passport.authenticate, source: "passport, https://www.passportjs.org/concepts/authentication/middleware/"}
+    - {name: ensureLoggedIn, source: "connect-ensure-login"}
+    - {name: expressjwt, source: "express-jwt v7+ (`expressjwt`), https://github.com/auth0/express-jwt"}
+    - {name: expressJwt, source: "express-jwt before v7"}
+    - {name: requiresAuth, source: "express-openid-connect requiresAuth"}
+    - {name: koaJwt, source: "koa-jwt"}
+    - {name: authenticate, source: "fastify.authenticate decorator convention, https://github.com/fastify/fastify-jwt"}
+    - {name: jwtVerify, source: "@fastify/jwt request.jwtVerify"}
+    - {name: basicAuth, source: "hono/basic-auth, express-basic-auth"}
+    - {name: bearerAuth, source: "hono/bearer-auth"}
+    - {name: jwt, source: "hono/jwt, koa-jwt"}

codegraph/presets/kotlin.yaml

@@ -0,0 +1,11 @@
+name: kotlin
+kind: language
+docs: docs/kotlin.md
+# Gradle build output (KSP / kapt sources under build/generated), Gradle and IDE state, Kotlin/Native and JS caches
+skip_dirs: [build, .gradle, .idea, .kotlin, .cxx, .externalNativeBuild, node_modules]
+auth:
+  guards:
+    - {name: authenticate, source: "Ktor authenticate(\"name\") { } blocks, https://ktor.io/docs/server-auth.html"}
+    - {name: PreAuthorize, source: "Spring Security method security, https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html"}
+    - {name: Secured, source: "Spring Security @Secured"}
+    - {name: RolesAllowed, source: "Jakarta @RolesAllowed (Spring Security jsr250)"}

codegraph/presets/laravel.yaml

@@ -0,0 +1,40 @@
+name: laravel
+kind: framework
+docs: https://laravel.com/docs/middleware
+auth:
+  # route / group middleware aliases and classes (Illuminate\Foundation\Configuration\Middleware::defaultAliases)
+  guards:
+    - {name: auth, source: "Illuminate\\Auth\\Middleware\\Authenticate, https://laravel.com/docs/authentication#protecting-routes"}
+    - {name: auth.basic, source: "AuthenticateWithBasicAuth, https://laravel.com/docs/authentication#http-basic-authentication"}
+    - {name: auth.session, source: "Illuminate\\Session\\Middleware\\AuthenticateSession"}
+    - {name: can, source: "Illuminate\\Auth\\Middleware\\Authorize, https://laravel.com/docs/authorization#via-middleware"}
+    - {name: password.confirm, source: "RequirePassword, https://laravel.com/docs/authentication#password-confirmation"}
+    - {name: verified, source: "EnsureEmailIsVerified, https://laravel.com/docs/verification"}
+    - {name: abilities, source: "Laravel\\Sanctum\\Http\\Middleware\\CheckAbilities, https://laravel.com/docs/sanctum#token-ability-middleware"}
+    - {name: ability, source: "Laravel\\Sanctum\\Http\\Middleware\\CheckForAnyAbility"}
+    - {name: role, source: "spatie/laravel-permission RoleMiddleware, https://spatie.be/docs/laravel-permission/basic-usage/middleware"}
+    - {name: permission, source: "spatie/laravel-permission PermissionMiddleware"}
+    - {name: role_or_permission, source: "spatie/laravel-permission RoleOrPermissionMiddleware"}
+    - {name: Authenticate, source: "Illuminate\\Auth\\Middleware\\Authenticate / Filament\\Http\\Middleware\\Authenticate (class form)"}
+    # the same middleware referenced by class (Route::middleware(EnsureEmailIsVerified::class), $middlewareAliases)
+    - {name: AuthenticateWithBasicAuth, source: "Illuminate\\Auth\\Middleware\\AuthenticateWithBasicAuth"}
+    - {name: AuthenticateSession, source: "Illuminate\\Session\\Middleware\\AuthenticateSession"}
+    - {name: Authorize, source: "Illuminate\\Auth\\Middleware\\Authorize"}
+    - {name: RequirePassword, source: "Illuminate\\Auth\\Middleware\\RequirePassword"}
+    - {name: EnsureEmailIsVerified, source: "Illuminate\\Auth\\Middleware\\EnsureEmailIsVerified"}
+    - {name: CheckAbilities, source: "Laravel\\Sanctum\\Http\\Middleware\\CheckAbilities"}
+    - {name: CheckForAnyAbility, source: "Laravel\\Sanctum\\Http\\Middleware\\CheckForAnyAbility"}
+    - {name: RoleMiddleware, source: "Spatie\\Permission\\Middleware\\RoleMiddleware"}
+    - {name: PermissionMiddleware, source: "Spatie\\Permission\\Middleware\\PermissionMiddleware"}
+    - {name: RoleOrPermissionMiddleware, source: "Spatie\\Permission\\Middleware\\RoleOrPermissionMiddleware"}
+secret:
+  guards:
+    - {name: signed, source: "Illuminate\\Routing\\Middleware\\ValidateSignature, https://laravel.com/docs/urls#signed-urls"}
+    - {name: ValidateSignature, source: "Illuminate\\Routing\\Middleware\\ValidateSignature (class form)"}
+    - {name: VerifyWebhookSignature, source: "Laravel\\Cashier\\Http\\Middleware\\VerifyWebhookSignature, https://laravel.com/docs/billing#verifying-webhook-signatures"}
+plans:
+  # class-name prefixes shortened in plan reports (PSR-4 `App\` namespace, https://laravel.com/docs/structure)
+  short_prefixes: ["App\\Models\\", "App\\Services\\", "App\\Http\\Controllers\\", "App\\Http\\Requests\\", "App\\Support\\",
+                   "App\\Jobs\\", "App\\Console\\Commands\\"]
+  # where plan completeness looks for text mentions of columns / relations (application code and Blade views)
+  text_mention_dirs: [app, resources/views]

codegraph/presets/nest.yaml

@@ -0,0 +1,11 @@
+name: nest
+kind: framework
+docs: https://docs.nestjs.com/guards
+auth:
+  guards:
+    - {name: AuthGuard, source: "@nestjs/passport AuthGuard('jwt' | 'local' | ...), https://docs.nestjs.com/recipes/passport"}
+    - {name: JwtAuthGuard, source: "conventional name of the AuthGuard('jwt') subclass, https://docs.nestjs.com/security/authentication"}
+    - {name: RolesGuard, source: "https://docs.nestjs.com/security/authorization#basic-rbac-implementation"}
+    - {name: PoliciesGuard, source: "https://docs.nestjs.com/security/authorization#implementing-a-policiesguard"}
+  not_auth:
+    - {name: ThrottlerGuard, source: "@nestjs/throttler rate limiting, https://docs.nestjs.com/security/rate-limiting"}

codegraph/presets/nextjs.yaml

@@ -0,0 +1,15 @@
+name: nextjs
+kind: framework
+docs: https://nextjs.org/docs/app/building-your-application/authentication
+auth:
+  # middleware.ts exports and handler wrappers of the common auth libraries
+  guards:
+    - {name: withAuth, source: "next-auth/middleware withAuth, https://next-auth.js.org/configuration/nextjs#middleware"}
+    - {name: getServerSession, source: "next-auth getServerSession"}
+    - {name: auth, source: "Auth.js v5 auth() / export { auth as middleware }, https://authjs.dev/getting-started/session-management/protecting"}
+    - {name: clerkMiddleware, source: "@clerk/nextjs clerkMiddleware, https://clerk.com/docs/references/nextjs/clerk-middleware"}
+    - {name: authMiddleware, source: "@clerk/nextjs authMiddleware (Clerk v4)"}
+    - {name: withPageAuthRequired, source: "@auth0/nextjs-auth0 withPageAuthRequired"}
+    - {name: withApiAuthRequired, source: "@auth0/nextjs-auth0 withApiAuthRequired"}
+    - {name: withMiddlewareAuthRequired, source: "@auth0/nextjs-auth0 withMiddlewareAuthRequired"}
+    - {name: withIronSessionApiRoute, source: "iron-session withIronSessionApiRoute"}

codegraph/presets/nuxt.yaml

@@ -0,0 +1,9 @@
+name: nuxt
+kind: framework
+docs: https://nuxt.com/docs/guide/directory-structure/nuxt
+# kept out of the generated tsconfig: build output, native shells (Capacitor), static assets, test reports
+skip_dirs: [.output, .nuxt, dist, android, ios, public, coverage, playwright-report]
+auth:
+  guards:
+    - {name: requireUserSession, source: "nuxt-auth-utils requireUserSession, https://github.com/atinux/nuxt-auth-utils"}
+    - {name: getServerSession, source: "@sidebase/nuxt-auth getServerSession"}

codegraph/presets/php.yaml

@@ -0,0 +1,5 @@
+name: php
+kind: language
+docs: https://getcomposer.org/doc/articles/vendor-binaries.md
+# root-relative paths the PHP file discovery skips: Composer dependencies, Laravel's runtime storage and cache
+skip_paths: [vendor, node_modules, storage, bootstrap/cache, .git]

codegraph/presets/python.yaml

@@ -0,0 +1,10 @@
+name: python
+kind: language
+docs: https://docs.python.org/3/library/venv.html
+# virtualenvs, packaging / tool caches, build output, and Django's collected static / uploaded media
+skip_dirs: [venv, .venv, env, .env, site-packages, .tox, .nox, build, dist, .mypy_cache, .eggs, .pytest_cache,
+            .ruff_cache, htmlcov, static, media]
+# also skipped when deciding whether a repository holds Python at all (vendored / other-stack build output)
+detect_skip_dirs: [vendor, target, out, Pods, .next, .output]
+# test directories: skipped when scanning imports to detect a web framework (test fixtures quote `from flask import ...`)
+test_dirs: [tests, test, testing]

codegraph/presets/rust.yaml

@@ -0,0 +1,5 @@
+name: rust
+kind: language
+docs: https://doc.rust-lang.org/cargo/guide/build-cache.html
+# Cargo build output, `cargo vendor`, vendored C code, Cargo home
+skip_dirs: [target, vendor, third_party, .cargo]

codegraph/presets/swift.yaml

@@ -0,0 +1,10 @@
+name: swift
+kind: language
+docs: docs/swift.md
+# SwiftPM build output and checkouts, Xcode DerivedData, CocoaPods / Carthage dependencies, IDE state
+skip_dirs: [.build, .swiftpm, DerivedData, Pods, Carthage, xcuserdata, node_modules]
+auth:
+  guards:
+    - {name: guardMiddleware, source: "Vapor Authenticatable.guardMiddleware(), https://docs.vapor.codes/security/authentication/"}
+    - {name: authenticator, source: "Vapor ModelAuthenticatable / BearerAuthenticator authenticators"}
+    - {name: redirectMiddleware, source: "Vapor session auth redirectMiddleware(path:)"}

codegraph/presets/typescript.yaml

@@ -0,0 +1,13 @@
+name: typescript
+kind: language
+docs: https://www.typescriptlang.org/tsconfig#exclude
+# not hashed into the extractor facts cache key (build output, tool caches, test reports)
+skip_dirs: [.output, dist, .cache, coverage, playwright-report, test-results]
+# the test-file walk (tests/, e2e/, ... and spec files in the source dirs) also skips build output, fixtures and snapshots
+test_walk_skip_dirs: [build, fixtures, __fixtures__, __snapshots__]
+# files the tsconfig pulls in from these directories are resolution input (dependency types, Nuxt's generated
+# auto-import types), never project source
+source_skip_dirs: [node_modules, .nuxt]
+# build output of the JS frameworks cg models (Next.js .next, Nuxt .nuxt / .output, SvelteKit, Turborepo, Vercel,
+# Storybook); never application source for the Nest / Next.js / Express plugins
+build_dirs: [.next, .nuxt, .output, .svelte-kit, .turbo, .vercel, dist, build, out, coverage, storybook-static]