@craft-ts/dev-tools 0.7.0-beta.13

package/src/scripts/data-flow-graph.d.ts

@@ -0,0 +1,36 @@
+import { type SourceFile } from 'ts-morph';
+import type { DependencyGraphEdge, DependencyGraphNode } from './dependency-graph';
+export interface DataClassificationNodeDetails {
+    readonly classification: string;
+    readonly source: 'schema-annotation';
+    readonly schemaName: string;
+}
+export interface ExternalOutputNodeDetails {
+    readonly boundary: 'server-function-response';
+    readonly serverFunctionId?: string;
+    readonly schemaName?: string;
+    readonly classifications: readonly string[];
+}
+export interface DataFlowRelationDetails {
+    readonly classification: string;
+    readonly resolution: 'static' | 'unknown';
+}
+declare module './dependency-graph' {
+    interface DependencyGraphNodeRegistry {
+        'data-classification': DataClassificationNodeDetails;
+        'external-output': ExternalOutputNodeDetails;
+    }
+    interface DependencyGraphEdgeRegistry {
+        'exposes-data': DataFlowRelationDetails;
+        'flows-data': DataFlowRelationDetails;
+    }
+}
+/**
+ * Extracts schema annotations and server-function response boundaries. The
+ * propagation is intentionally conservative: only statically named schema
+ * variables are followed, and no transform is assumed to remove sensitivity.
+ */
+export declare function collectDataFlowGraph(sourceFiles: readonly SourceFile[]): {
+    nodes: DependencyGraphNode[];
+    edges: DependencyGraphEdge[];
+};

package/src/scripts/data-flow-graph.js

@@ -0,0 +1,186 @@
+import { Node, SyntaxKind, } from 'ts-morph';
+const classificationId = (filePath, name, value) => `data-classification:${filePath}#${name}:${value}`;
+const outputId = (filePath, line) => `external-output:${filePath}:${line}`;
+/**
+ * Extracts schema annotations and server-function response boundaries. The
+ * propagation is intentionally conservative: only statically named schema
+ * variables are followed, and no transform is assumed to remove sensitivity.
+ */
+export function collectDataFlowGraph(sourceFiles) {
+    const nodes = new Map();
+    const edges = new Map();
+    const schemas = new Map();
+    const schemaByName = new Map();
+    const addNode = (node) => {
+        if (!nodes.has(node.id))
+            nodes.set(node.id, node);
+    };
+    const addEdge = (edge) => {
+        const key = `${edge.from}:${edge.kind}:${edge.to}`;
+        if (!edges.has(key))
+            edges.set(key, edge);
+    };
+    const proof = (node, pattern) => ({
+        filePath: node.getSourceFile().getFilePath(),
+        line: node.getStartLineNumber(),
+        pattern,
+    });
+    for (const sourceFile of sourceFiles) {
+        for (const declaration of sourceFile.getVariableDeclarations()) {
+            const initializer = declaration.getInitializer();
+            if (!initializer || !containsSchema(initializer))
+                continue;
+            const name = declaration.getName();
+            const info = {
+                declaration,
+                filePath: sourceFile.getFilePath(),
+                name,
+                classifications: new Set(findSchemaAnnotations(initializer)),
+            };
+            schemas.set(`${sourceFile.getFilePath()}#${name}`, info);
+            schemaByName.set(name, [...(schemaByName.get(name) ?? []), info]);
+        }
+    }
+    const classifications = new Map();
+    for (const info of schemas.values()) {
+        for (const value of info.classifications) {
+            const annotation = findSchemaAnnotation(info.declaration.getInitializer(), value);
+            if (!annotation)
+                continue;
+            classifications.set(`${info.filePath}#${info.name}:${value}`, {
+                schema: info,
+                value,
+                node: annotation,
+            });
+            addNode({
+                id: classificationId(info.filePath, info.name, value),
+                kind: 'data-classification',
+                label: `${info.name} [${value}]`,
+                filePath: info.filePath,
+                line: info.declaration.getStartLineNumber(),
+                details: {
+                    classification: value,
+                    source: 'schema-annotation',
+                    schemaName: info.name,
+                },
+            });
+        }
+    }
+    const classificationsFor = (info, seen = new Set()) => {
+        const key = `${info.filePath}#${info.name}`;
+        if (seen.has(key))
+            return new Set();
+        const nextSeen = new Set([...seen, key]);
+        const result = new Set(info.classifications);
+        const initializer = info.declaration.getInitializer();
+        if (!initializer)
+            return result;
+        for (const identifier of initializer.getDescendantsOfKind(SyntaxKind.Identifier)) {
+            for (const target of schemaByName.get(identifier.getText()) ?? []) {
+                for (const value of classificationsFor(target, nextSeen))
+                    result.add(value);
+            }
+        }
+        return result;
+    };
+    for (const sourceFile of sourceFiles) {
+        if (!sourceFile.getBaseName().endsWith('.fn-serveur.ts'))
+            continue;
+        const serverFunction = sourceFile
+            .getDescendantsOfKind(SyntaxKind.CallExpression)
+            .find((call) => call.getExpression().getText() === 'serverFunction');
+        if (!serverFunction)
+            continue;
+        const id = serverFunction
+            .getArguments()[0]
+            ?.asKind(SyntaxKind.StringLiteral)
+            ?.getLiteralValue();
+        const options = serverFunction
+            .getArguments()[2]
+            ?.asKind(SyntaxKind.ObjectLiteralExpression);
+        const output = options
+            ?.getProperty('output')
+            ?.asKind(SyntaxKind.PropertyAssignment)
+            ?.getInitializer();
+        if (!output)
+            continue;
+        const schemaName = output.asKind(SyntaxKind.Identifier)?.getText();
+        const schema = schemaName
+            ? [...(schemaByName.get(schemaName) ?? [])][0]
+            : undefined;
+        const values = schema ? [...classificationsFor(schema)] : [];
+        const outputNode = {
+            id: outputId(sourceFile.getFilePath(), serverFunction.getStartLineNumber()),
+            kind: 'external-output',
+            label: `${id ?? 'server-function'} response`,
+            filePath: sourceFile.getFilePath(),
+            line: serverFunction.getStartLineNumber(),
+            details: {
+                boundary: 'server-function-response',
+                ...(id === undefined ? {} : { serverFunctionId: id }),
+                ...(schemaName === undefined ? {} : { schemaName }),
+                classifications: values,
+            },
+        };
+        addNode(outputNode);
+        for (const value of values) {
+            const source = [...classifications.values()].find((candidate) => candidate.value === value &&
+                classificationsFor(candidate.schema).has(value));
+            if (!source)
+                continue;
+            addEdge({
+                from: classificationId(source.schema.filePath, source.schema.name, value),
+                to: outputNode.id,
+                kind: 'exposes-data',
+                evidence: 'ast',
+                details: { classification: value, resolution: 'static' },
+                proof: proof(output, `server function output: ${schemaName ?? 'unknown schema'}`),
+            });
+        }
+    }
+    return { nodes: [...nodes.values()], edges: [...edges.values()] };
+}
+function containsSchema(node) {
+    return [
+        ...(Node.isCallExpression(node) ? [node] : []),
+        ...node.getDescendantsOfKind(SyntaxKind.CallExpression),
+    ].some((call) => call.getExpression().getText().startsWith('Schema.'));
+}
+function findSchemaAnnotations(node) {
+    const values = new Set();
+    for (const call of [
+        ...(Node.isCallExpression(node) ? [node] : []),
+        ...node.getDescendantsOfKind(SyntaxKind.CallExpression),
+    ]) {
+        const value = readSensitivity(call);
+        if (value)
+            values.add(value);
+    }
+    return [...values];
+}
+function findSchemaAnnotation(node, value) {
+    if (!node)
+        return undefined;
+    return [
+        ...(Node.isCallExpression(node) ? [node] : []),
+        ...node.getDescendantsOfKind(SyntaxKind.CallExpression),
+    ].find((call) => readSensitivity(call) === value);
+}
+function readSensitivity(call) {
+    // Effect expose l'annotation en méthode (`Schema.String.annotate({ … })`) ;
+    // `annotations` reste accepté pour les variantes qui l'orthographient ainsi.
+    const callee = call.getExpression().getText();
+    if (!callee.endsWith('annotate') && !callee.endsWith('annotations')) {
+        return undefined;
+    }
+    const object = call
+        .getArguments()[0]
+        ?.asKind(SyntaxKind.ObjectLiteralExpression);
+    return object
+        ?.getProperty('sensitivity')
+        ?.asKind(SyntaxKind.PropertyAssignment)
+        ?.getInitializer()
+        ?.asKind(SyntaxKind.StringLiteral)
+        ?.getLiteralValue();
+}
+//# sourceMappingURL=data-flow-graph.js.map

package/src/scripts/data-flow-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-flow-graph.js","sourceRoot":"","sources":["../../../../../libs/dev-tools/src/scripts/data-flow-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,UAAU,GAIX,MAAM,UAAU,CAAC;AA4ClB,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE,CACzE,uBAAuB,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;AAErD,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClD,mBAAmB,QAAQ,IAAI,IAAI,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;IAErD,MAAM,OAAO,GAAG,CAAC,IAAyB,EAAE,EAAE;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,IAAyB,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAU,EAAE,OAAe,EAAwB,EAAE,CAAC,CAAC;QACpE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE;QAC5C,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;QAC/B,OAAO;KACR,CAAC,CAAC;IAEH,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,WAAW,IAAI,UAAU,CAAC,uBAAuB,EAAE,EAAE,CAAC;YAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC;YACjD,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAe;gBACvB,WAAW;gBACX,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;gBAClC,IAAI;gBACJ,eAAe,EAAE,IAAI,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;aAC7D,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACzD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC7F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;YAClF,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,eAAe,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE;gBAC5D,MAAM,EAAE,IAAI;gBACZ,KAAK;gBACL,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,OAAO,CAAC;gBACN,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;gBACrD,IAAI,EAAE,qBAAqB;gBAC3B,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,GAAG;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,EAAE;gBAC3C,OAAO,EAAE;oBACP,cAAc,EAAE,KAAK;oBACrB,MAAM,EAAE,mBAAmB;oBAC3B,UAAU,EAAE,IAAI,CAAC,IAAI;iBACtB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,CAAC,IAAgB,EAAE,OAAO,IAAI,GAAG,EAAU,EAAe,EAAE;QACrF,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC;QAChC,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,oBAAoB,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClE,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,SAAS;QACnE,MAAM,cAAc,GAAG,UAAU;aAC9B,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC;aAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,KAAK,gBAAgB,CAAC,CAAC;QACvE,IAAI,CAAC,cAAc;YAAE,SAAS;QAC9B,MAAM,EAAE,GAAG,cAAc;aACtB,YAAY,EAAE,CAAC,CAAC,CAAC;YAClB,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;YAClC,EAAE,eAAe,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,cAAc;aAC3B,YAAY,EAAE,CAAC,CAAC,CAAC;YAClB,EAAE,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO;YACpB,EAAE,WAAW,CAAC,QAAQ,CAAC;YACvB,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACvC,EAAE,cAAc,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,UAAU;YACvB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAwB;YACtC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,kBAAkB,EAAE,CAAC;YAC3E,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,GAAG,EAAE,IAAI,iBAAiB,WAAW;YAC5C,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;YAClC,IAAI,EAAE,cAAc,CAAC,kBAAkB,EAAE;YACzC,OAAO,EAAE;gBACP,QAAQ,EAAE,0BAA0B;gBACpC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACrD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,eAAe,EAAE,MAAM;aACxB;SACF,CAAC;QACF,OAAO,CAAC,UAAU,CAAC,CAAC;QAEpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,KAAK;gBACtC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAClD,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,OAAO,CAAC;gBACN,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;gBACzE,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;gBACxD,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,2BAA2B,UAAU,IAAI,gBAAgB,EAAE,CAAC;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC;KACxD,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAU;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC;KACxD,EAAE,CAAC;QACF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAsB,EAAE,KAAa;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC;KACxD,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,IAAoB;IAC3C,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI;SAChB,YAAY,EAAE,CAAC,CAAC,CAAC;QAClB,EAAE,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC/C,OAAO,MAAM;QACX,EAAE,WAAW,CAAC,aAAa,CAAC;QAC5B,EAAE,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACvC,EAAE,cAAc,EAAE;QAClB,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;QAClC,EAAE,eAAe,EAAE,CAAC;AACxB,CAAC"}

package/src/scripts/data-flow-graph.ts

@@ -0,0 +1,240 @@
+import {
+  Node,
+  SyntaxKind,
+  type CallExpression,
+  type SourceFile,
+  type VariableDeclaration,
+} from 'ts-morph';
+import type {
+  DependencyGraphEdge,
+  DependencyGraphNode,
+  DependencyGraphProof,
+} from './dependency-graph';
+
+export interface DataClassificationNodeDetails {
+  readonly classification: string;
+  readonly source: 'schema-annotation';
+  readonly schemaName: string;
+}
+
+export interface ExternalOutputNodeDetails {
+  readonly boundary: 'server-function-response';
+  readonly serverFunctionId?: string;
+  readonly schemaName?: string;
+  readonly classifications: readonly string[];
+}
+
+export interface DataFlowRelationDetails {
+  readonly classification: string;
+  readonly resolution: 'static' | 'unknown';
+}
+
+declare module './dependency-graph' {
+  interface DependencyGraphNodeRegistry {
+    'data-classification': DataClassificationNodeDetails;
+    'external-output': ExternalOutputNodeDetails;
+  }
+
+  interface DependencyGraphEdgeRegistry {
+    'exposes-data': DataFlowRelationDetails;
+    'flows-data': DataFlowRelationDetails;
+  }
+}
+
+type SchemaInfo = {
+  readonly declaration: VariableDeclaration;
+  readonly filePath: string;
+  readonly name: string;
+  readonly classifications: Set<string>;
+};
+
+const classificationId = (filePath: string, name: string, value: string) =>
+  `data-classification:${filePath}#${name}:${value}`;
+
+const outputId = (filePath: string, line: number) =>
+  `external-output:${filePath}:${line}`;
+
+/**
+ * Extracts schema annotations and server-function response boundaries. The
+ * propagation is intentionally conservative: only statically named schema
+ * variables are followed, and no transform is assumed to remove sensitivity.
+ */
+export function collectDataFlowGraph(
+  sourceFiles: readonly SourceFile[],
+): { nodes: DependencyGraphNode[]; edges: DependencyGraphEdge[] } {
+  const nodes = new Map<string, DependencyGraphNode>();
+  const edges = new Map<string, DependencyGraphEdge>();
+  const schemas = new Map<string, SchemaInfo>();
+  const schemaByName = new Map<string, SchemaInfo[]>();
+
+  const addNode = (node: DependencyGraphNode) => {
+    if (!nodes.has(node.id)) nodes.set(node.id, node);
+  };
+  const addEdge = (edge: DependencyGraphEdge) => {
+    const key = `${edge.from}:${edge.kind}:${edge.to}`;
+    if (!edges.has(key)) edges.set(key, edge);
+  };
+  const proof = (node: Node, pattern: string): DependencyGraphProof => ({
+    filePath: node.getSourceFile().getFilePath(),
+    line: node.getStartLineNumber(),
+    pattern,
+  });
+
+  for (const sourceFile of sourceFiles) {
+    for (const declaration of sourceFile.getVariableDeclarations()) {
+      const initializer = declaration.getInitializer();
+      if (!initializer || !containsSchema(initializer)) continue;
+      const name = declaration.getName();
+      const info: SchemaInfo = {
+        declaration,
+        filePath: sourceFile.getFilePath(),
+        name,
+        classifications: new Set(findSchemaAnnotations(initializer)),
+      };
+      schemas.set(`${sourceFile.getFilePath()}#${name}`, info);
+      schemaByName.set(name, [...(schemaByName.get(name) ?? []), info]);
+    }
+  }
+
+  const classifications = new Map<string, { schema: SchemaInfo; value: string; node: Node }>();
+  for (const info of schemas.values()) {
+    for (const value of info.classifications) {
+      const annotation = findSchemaAnnotation(info.declaration.getInitializer(), value);
+      if (!annotation) continue;
+      classifications.set(`${info.filePath}#${info.name}:${value}`, {
+        schema: info,
+        value,
+        node: annotation,
+      });
+      addNode({
+        id: classificationId(info.filePath, info.name, value),
+        kind: 'data-classification',
+        label: `${info.name} [${value}]`,
+        filePath: info.filePath,
+        line: info.declaration.getStartLineNumber(),
+        details: {
+          classification: value,
+          source: 'schema-annotation',
+          schemaName: info.name,
+        },
+      });
+    }
+  }
+
+  const classificationsFor = (info: SchemaInfo, seen = new Set<string>()): Set<string> => {
+    const key = `${info.filePath}#${info.name}`;
+    if (seen.has(key)) return new Set();
+    const nextSeen = new Set([...seen, key]);
+    const result = new Set(info.classifications);
+    const initializer = info.declaration.getInitializer();
+    if (!initializer) return result;
+    for (const identifier of initializer.getDescendantsOfKind(SyntaxKind.Identifier)) {
+      for (const target of schemaByName.get(identifier.getText()) ?? []) {
+        for (const value of classificationsFor(target, nextSeen)) result.add(value);
+      }
+    }
+    return result;
+  };
+
+  for (const sourceFile of sourceFiles) {
+    if (!sourceFile.getBaseName().endsWith('.fn-serveur.ts')) continue;
+    const serverFunction = sourceFile
+      .getDescendantsOfKind(SyntaxKind.CallExpression)
+      .find((call) => call.getExpression().getText() === 'serverFunction');
+    if (!serverFunction) continue;
+    const id = serverFunction
+      .getArguments()[0]
+      ?.asKind(SyntaxKind.StringLiteral)
+      ?.getLiteralValue();
+    const options = serverFunction
+      .getArguments()[2]
+      ?.asKind(SyntaxKind.ObjectLiteralExpression);
+    const output = options
+      ?.getProperty('output')
+      ?.asKind(SyntaxKind.PropertyAssignment)
+      ?.getInitializer();
+    if (!output) continue;
+    const schemaName = output.asKind(SyntaxKind.Identifier)?.getText();
+    const schema = schemaName
+      ? [...(schemaByName.get(schemaName) ?? [])][0]
+      : undefined;
+    const values = schema ? [...classificationsFor(schema)] : [];
+    const outputNode: DependencyGraphNode = {
+      id: outputId(sourceFile.getFilePath(), serverFunction.getStartLineNumber()),
+      kind: 'external-output',
+      label: `${id ?? 'server-function'} response`,
+      filePath: sourceFile.getFilePath(),
+      line: serverFunction.getStartLineNumber(),
+      details: {
+        boundary: 'server-function-response',
+        ...(id === undefined ? {} : { serverFunctionId: id }),
+        ...(schemaName === undefined ? {} : { schemaName }),
+        classifications: values,
+      },
+    };
+    addNode(outputNode);
+
+    for (const value of values) {
+      const source = [...classifications.values()].find(
+        (candidate) => candidate.value === value &&
+          classificationsFor(candidate.schema).has(value),
+      );
+      if (!source) continue;
+      addEdge({
+        from: classificationId(source.schema.filePath, source.schema.name, value),
+        to: outputNode.id,
+        kind: 'exposes-data',
+        evidence: 'ast',
+        details: { classification: value, resolution: 'static' },
+        proof: proof(output, `server function output: ${schemaName ?? 'unknown schema'}`),
+      });
+    }
+  }
+
+  return { nodes: [...nodes.values()], edges: [...edges.values()] };
+}
+
+function containsSchema(node: Node): boolean {
+  return [
+    ...(Node.isCallExpression(node) ? [node] : []),
+    ...node.getDescendantsOfKind(SyntaxKind.CallExpression),
+  ].some((call) => call.getExpression().getText().startsWith('Schema.'));
+}
+
+function findSchemaAnnotations(node: Node): string[] {
+  const values = new Set<string>();
+  for (const call of [
+    ...(Node.isCallExpression(node) ? [node] : []),
+    ...node.getDescendantsOfKind(SyntaxKind.CallExpression),
+  ]) {
+    const value = readSensitivity(call);
+    if (value) values.add(value);
+  }
+  return [...values];
+}
+
+function findSchemaAnnotation(node: Node | undefined, value: string): Node | undefined {
+  if (!node) return undefined;
+  return [
+    ...(Node.isCallExpression(node) ? [node] : []),
+    ...node.getDescendantsOfKind(SyntaxKind.CallExpression),
+  ].find((call) => readSensitivity(call) === value);
+}
+
+function readSensitivity(call: CallExpression): string | undefined {
+  // Effect expose l'annotation en méthode (`Schema.String.annotate({ … })`) ;
+  // `annotations` reste accepté pour les variantes qui l'orthographient ainsi.
+  const callee = call.getExpression().getText();
+  if (!callee.endsWith('annotate') && !callee.endsWith('annotations')) {
+    return undefined;
+  }
+  const object = call
+    .getArguments()[0]
+    ?.asKind(SyntaxKind.ObjectLiteralExpression);
+  return object
+    ?.getProperty('sensitivity')
+    ?.asKind(SyntaxKind.PropertyAssignment)
+    ?.getInitializer()
+    ?.asKind(SyntaxKind.StringLiteral)
+    ?.getLiteralValue();
+}

package/src/scripts/dependency-graph.d.ts

@@ -0,0 +1,152 @@
+import { Project, SourceFile } from 'ts-morph';
+import './effect-dependency-graph.js';
+import './data-flow-graph.js';
+/**
+ * The graph's built-in vocabulary.  Values are deliberately detail records
+ * rather than node classes: consumers can augment this interface with module
+ * augmentation without making the graph core import their runtime.
+ */
+export interface DependencyGraphNodeRegistry {
+    route: Record<string, unknown>;
+    'route-hook': Record<string, unknown>;
+    'route-check': Record<string, unknown>;
+    'app-config': Record<string, unknown>;
+    component: Record<string, unknown>;
+    service: Record<string, unknown>;
+    property: Record<string, unknown>;
+    primitive: Record<string, unknown>;
+    source: Record<string, unknown>;
+    'http-endpoint': Record<string, unknown>;
+    unique: Record<string, unknown>;
+    'template-element': Record<string, unknown>;
+    'server-function-family': Record<string, unknown>;
+    'server-function-contract': Record<string, unknown>;
+    'server-function-client': Record<string, unknown>;
+    'server-function-server': Record<string, unknown>;
+    'server-function-misnamed': Record<string, unknown>;
+    'server-function-middleware': Record<string, unknown>;
+    'server-function-middleware-misnamed': Record<string, unknown>;
+    'client-function-middleware': Record<string, unknown>;
+    'client-function-middleware-misnamed': Record<string, unknown>;
+    handshake: Record<string, unknown>;
+}
+export type DependencyGraphNodeKind = keyof DependencyGraphNodeRegistry;
+export type DependencyGraphNodeFor<K extends DependencyGraphNodeKind = DependencyGraphNodeKind> = {
+    id: string;
+    kind: K;
+    label: string;
+    filePath?: string;
+    line?: number;
+    details?: DependencyGraphNodeRegistry[K];
+};
+/**
+ * The built-in relation vocabulary.  Relation details are open for the same
+ * reason as node details: an adapter can add a typed relation without
+ * changing this module.
+ */
+export interface DependencyGraphEdgeRegistry {
+    loads: Record<string, unknown>;
+    renders: Record<string, unknown>;
+    contains: Record<string, unknown>;
+    checks: Record<string, unknown>;
+    'depends-on': Record<string, unknown>;
+    provides: Record<string, unknown>;
+    'uses-property': Record<string, unknown>;
+    calls: Record<string, unknown>;
+    reads: Record<string, unknown>;
+    writes: Record<string, unknown>;
+    subscribes: Record<string, unknown>;
+    triggers: Record<string, unknown>;
+}
+export type DependencyGraphEdgeKind = keyof DependencyGraphEdgeRegistry;
+export type DependencyGraphEdgeFor<K extends DependencyGraphEdgeKind = DependencyGraphEdgeKind> = {
+    from: string;
+    to: string;
+    kind: K;
+    evidence: 'ast' | 'type';
+    details?: DependencyGraphEdgeRegistry[K];
+    proof?: DependencyGraphProof;
+};
+export type DependencyGraphProof = {
+    filePath: string;
+    line?: number;
+    symbol?: string;
+    pattern?: string;
+};
+export type DependencyGraphDiagnostic = {
+    code: string;
+    message: string;
+    proof?: DependencyGraphProof;
+};
+export type RouteCheckMechanism = 'ValidateCascadeRoutesFile' | 'RouteCheckedDI' | 'RouteExceptionComponentCheckedDI' | 'CanRun' | 'assertExhaustiveRouteExceptions';
+export type DependencyGraphNode = {
+    id: string;
+    kind: DependencyGraphNodeKind;
+    label: string;
+    filePath?: string;
+    line?: number;
+    details?: Record<string, unknown>;
+};
+export type DependencyGraphHttpEndpoint = {
+    method: string;
+    url: string;
+    line: number;
+};
+export type DependencyGraphTemporalOperation = {
+    operation: string;
+    delay?: string;
+    line: number;
+};
+export type DependencyGraphEdge = {
+    from: string;
+    to: string;
+    kind: DependencyGraphEdgeKind;
+    evidence: 'ast' | 'type';
+    details?: Record<string, unknown>;
+    proof?: DependencyGraphProof;
+};
+export type DependencyGraph = {
+    version: 1;
+    rootDir: string;
+    tsConfigFilePath: string;
+    nodes: DependencyGraphNode[];
+    edges: DependencyGraphEdge[];
+    diagnostics?: DependencyGraphDiagnostic[];
+};
+export type AnalyzeDependencyGraphOptions = {
+    rootDir?: string;
+    tsConfigFilePath?: string;
+    include?: readonly string[];
+    /** Additional collectors are opt-in; importing their types has no effect. */
+    collectors?: readonly DependencyGraphCollector[];
+    /** Repository-declared middleware capabilities used by security rules. */
+    middlewareCapabilities?: Readonly<Record<string, readonly string[]>>;
+};
+export type DependencyGraphCollectorContext = {
+    readonly project: Project;
+    readonly rootDir: string;
+    readonly sourceFiles: readonly SourceFile[];
+    readonly graph: Readonly<DependencyGraph>;
+};
+export type DependencyGraphContribution = {
+    readonly nodes?: readonly DependencyGraphNode[];
+    readonly edges?: readonly DependencyGraphEdge[];
+    readonly diagnostics?: readonly DependencyGraphDiagnostic[];
+};
+export type DependencyGraphCollector = {
+    readonly name: string;
+    readonly collect: (context: DependencyGraphCollectorContext) => DependencyGraphContribution;
+};
+export type WriteDependencyGraphOptions = AnalyzeDependencyGraphOptions & {
+    outputPath: string;
+    format?: 'json' | 'mermaid' | 'html' | 'both' | 'all';
+};
+export declare function analyzeDependencyGraph(options?: AnalyzeDependencyGraphOptions): DependencyGraph;
+export declare function writeDependencyGraph(options: WriteDependencyGraphOptions): Promise<DependencyGraph>;
+export declare function dependencyGraphToMermaid(graph: DependencyGraph): string;
+/**
+ * Creates a self-contained, static explorer. The graph is embedded in the file
+ * so opening the HTML never needs the source tree, a server, or application
+ * runtime instrumentation.
+ */
+export declare function dependencyGraphToHtml(graph: DependencyGraph): string;