v1.1.0

[github-actions[bot]]

codeanalyzer-typescript v1.1.0

The call graph is now built entirely in-house, and every analysis carries a new repository-artifact
layer: the files, dependencies and configuration keys a project ships, alongside its code.

Breaking changes

1. Jelly is gone — --backend no longer exists.

Call-graph construction was two paths (a tsc resolver and the Jelly backend); it is now one, the
defuse linker: the tsc resolver followed by per-callable tiers that chase aliases, decorators,
library callbacks and constructor-field chains.

Migration: delete --backend from your invocations. There is nothing to select any more. The
@cs-au-dk/jelly dependency and its patch are also gone, so installs are smaller and no longer
need the patched package.

2. The schema model's TypeScript type names changed (V2* → TS*).

Migration: only affects code that imports this analyzer's TypeScript types. If you consume
analysis.json or the Neo4j graph, nothing changes — the emitted output is unaffected.

What's new

A repository-artifact layer. Three new level-free sections on application, present at every
-a:

• artifacts — every non-source file, with role, hash, size and captured text
• dependencies — flat, evidence-tagged records; lockfile-only transitives are kept and marked
  direct: false, because "what does this app declare?" and "what actually ships?" are different
  questions, and a vulnerable package four levels down is in your bundle either way
• unresolved_imports — imports no declared dependency satisfies

Each artifact also carries config_keys, extracted from .env, JSON/JSONC, YAML, TOML, INI and
Dockerfiles, plus Compose and Kubernetes environment blocks. config_uses joins a process.env.X
read in code to the key that declares it.

Artifact ids are deliberately language-neutral (can://artifact/<app>/<path>, packages as
purl), so sibling analyzers over the same repository mint the same id for the same file and their
graphs join.

Three new flags: --no-artifact-text (inventory without captured text), --artifact-text-max-bytes
(per-file cap), --resolve-installed (opt-in node_modules probe; off by default, so a default run
reads only repository files).

Anonymous callables are first-class. An unnamed arrow or function expression that is not a
variable initializer — the returned Express route handler is the canonical case — was never indexed
as a callable, so everything inside it was invisible to every level above L1. Such nodes are now
callables in their own right, and edges into and out of them are addressable.

Two fixes found by running the analyzer against the vscode repository:

• A node the TypeScript checker could not resolve aborted the entire run. It now degrades to an
  unresolved callee and the count is reported.
• allowJs is forced on for discovered .js files, which previously had no valid checker state.
  This removes a class of false call edges that came from name-matching an untypeable receiver.

Measured on the vscode repository

18,391 files, 9,351 modules, 174,767 callables:

-a 1 (symbol table)	6m41s, 18.1 GB peak
-a 2 (call graph)	7m09s, 24.3 GB peak, 1,149,968 edges
Artifact layer	4,953 artifacts, 4,107 dependencies, 2,931 config keys

Known limitation: levels 3 and 4 on multi-program repositories

The dataflow stage still builds its program from a single root tsconfig.json for the whole
repository (src/core.ts, issue #56), while the level-2 call graph is fully per-program. On a
repository with many nested TypeScript projects the effect is much larger than "under-resolve":
measured on vscode, which has 92 programs and no root tsconfig.json at all, -a 4 completes in
12m22s and populates control- and data-flow for 1,204 of 174,767 callables (0.7%), across 44 of
9,351 modules.

Levels 1 and 2 are unaffected, and single-root repositories are unaffected. If you rely on -a 3
or -a 4, point the analyzer at a directory governed by one tsconfig until #56 is threaded through
the dataflow workers.

Upgrade

Shell script (prebuilt binary; macOS and Linux):

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codellm-devkit/codeanalyzer-typescript/releases/latest/download/cants-installer.sh | sh

Homebrew:

brew install codellm-devkit/homebrew-tap/codeanalyzer-typescript

Python wheel:

pip install -U codeanalyzer-typescript==1.1.0

Also published with this release

schema.json, the Neo4j schema contract — unchanged at 2.1.0; it re-baselines once every
CLDK analyzer's schema is stable, not once per release. New this time: analyzing-cants-graphs,
a query skill that teaches an agent the Cypher recipes for the graph this analyzer produces,
shipped both as a tarball and as a bare SKILL.md.

Note for SDK users

python-sdk rejects unknown fields, so it needs support for artifacts, dependencies and
unresolved_imports before its analyzer pin moves to 1.1.0.

---

Full release, notes and downloads