@dataparade/cli 0.0.1

package/dist/src/data-flow/application-hub.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findApplicationHubForFlows = findApplicationHubForFlows;
+const application_injection_1 = require("../classifier/application-injection");
+const terraform_provider_hub_1 = require("../classifier/terraform-provider-hub");
+const section_runtime_1 = require("../core/sectioning/section-runtime");
+/**
+ * PaaS "application" resources (e.g. `heroku_app`) are Terraform hosting shells,
+ * not the user-facing codebase. Prefer a real app/API main when one exists so
+ * actor rewiring does not land on infra nodes.
+ */
+function isTerraformPaaSApplicationResource(component) {
+    if (component.type !== "asset")
+        return false;
+    const rt = component.properties?.resource_type;
+    if (typeof rt !== "string" || !rt.trim())
+        return false;
+    return rt === "heroku_app";
+}
+function isPreferredMainApplicationAsset(component) {
+    if (component.type !== "asset")
+        return false;
+    const main = component.properties?.isMainApplication === true ||
+        component.properties?.isMainApplication === "true";
+    if (!main)
+        return false;
+    return !isTerraformPaaSApplicationResource(component);
+}
+function isAnyMainApplicationAsset(component) {
+    if (component.type !== "asset")
+        return false;
+    return (component.properties?.isMainApplication === true ||
+        component.properties?.isMainApplication === "true");
+}
+/**
+ * Resolves the "application hub" used for actor→hub flows and actor→infra
+ * rewiring. Prefers explicit main apps, then api/service assets, then a
+ * Terraform cloud provider node when the scan is infrastructure-only.
+ */
+function findApplicationHubForFlows(components, sectionId) {
+    const concreteSection = (0, section_runtime_1.isConcreteServiceSectionId)(sectionId);
+    const scoped = sectionId && sectionId.trim().length > 0
+        ? components.filter((c) => String(c.properties?.section_id ?? "") === sectionId)
+        : components;
+    const injectedMainInScoped = scoped.find((c) => c.type === "asset" &&
+        (c.properties?.isMainApplication === true ||
+            c.properties?.isMainApplication === "true") &&
+        c.properties?.sourceContext === application_injection_1.INJECTED_PROJECT_PLACEHOLDER_SOURCE_CONTEXT);
+    if (injectedMainInScoped)
+        return injectedMainInScoped;
+    const mainPreferredScoped = scoped.find(isPreferredMainApplicationAsset);
+    if (mainPreferredScoped)
+        return mainPreferredScoped;
+    const apiOrServiceInScoped = scoped.find((c) => c.type === "asset" &&
+        (c.subType === "api" || c.subType === "service"));
+    if (apiOrServiceInScoped)
+        return apiOrServiceInScoped;
+    if (!concreteSection) {
+        const globalMainPreferred = components.find(isPreferredMainApplicationAsset);
+        if (globalMainPreferred)
+            return globalMainPreferred;
+    }
+    const mainScopedAny = scoped.find(isAnyMainApplicationAsset);
+    if (mainScopedAny)
+        return mainScopedAny;
+    const tfScoped = (0, terraform_provider_hub_1.findTerraformPrimaryProviderHub)(components, sectionId);
+    if (tfScoped)
+        return tfScoped;
+    if (!concreteSection) {
+        const globalInjectedMain = components.find((c) => c.type === "asset" &&
+            (c.properties?.isMainApplication === true ||
+                c.properties?.isMainApplication === "true") &&
+            c.properties?.sourceContext === application_injection_1.INJECTED_PROJECT_PLACEHOLDER_SOURCE_CONTEXT);
+        if (globalInjectedMain)
+            return globalInjectedMain;
+        const globalMainAny = components.find(isAnyMainApplicationAsset);
+        if (globalMainAny)
+            return globalMainAny;
+        const globalApiOrService = components.find((c) => c.type === "asset" && (c.subType === "api" || c.subType === "service"));
+        if (globalApiOrService)
+            return globalApiOrService;
+        const tfGlobal = (0, terraform_provider_hub_1.findTerraformPrimaryProviderHub)(components);
+        if (tfGlobal)
+            return tfGlobal;
+        return components.find((c) => c.type === "asset") ?? undefined;
+    }
+    return undefined;
+}

package/dist/src/data-flow/dedupe.d.ts

@@ -0,0 +1,7 @@
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Deduplicate DetectedDataFlow[] by (sourceComponentId, targetComponentId, type).
+ * Preserves the base flow's id and metadata, uses the highest confidence,
+ * and unions all contributing source locations.
+ */
+export declare function dedupeDataFlows(flows: DetectedDataFlow[]): DetectedDataFlow[];

package/dist/src/data-flow/dedupe.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dedupeDataFlows = dedupeDataFlows;
+function makeKey(flow) {
+    return `${flow.sourceComponentId}\t${flow.targetComponentId}\t${flow.type}`;
+}
+function locationsEqual(a, b) {
+    return (a.filePath === b.filePath &&
+        a.startLine === b.startLine &&
+        a.endLine === b.endLine);
+}
+function compareSourceLocations(a, b) {
+    const fileCmp = a.filePath.localeCompare(b.filePath);
+    if (fileCmp !== 0)
+        return fileCmp;
+    if (a.startLine !== b.startLine)
+        return a.startLine - b.startLine;
+    if (a.endLine !== b.endLine)
+        return a.endLine - b.endLine;
+    return 0;
+}
+function collectUniqueSourceLocations(flows) {
+    const all = [];
+    const seen = new Set();
+    const locKey = (loc) => `${loc.filePath}:${loc.startLine}:${loc.endLine}`;
+    for (const flow of flows) {
+        if (flow.sourceLocation) {
+            const key = locKey(flow.sourceLocation);
+            if (!seen.has(key)) {
+                seen.add(key);
+                all.push(flow.sourceLocation);
+            }
+        }
+        if (flow.sourceLocations) {
+            for (const loc of flow.sourceLocations) {
+                const key = locKey(loc);
+                if (!seen.has(key)) {
+                    seen.add(key);
+                    all.push(loc);
+                }
+            }
+        }
+    }
+    return all;
+}
+/**
+ * Deduplicate DetectedDataFlow[] by (sourceComponentId, targetComponentId, type).
+ * Preserves the base flow's id and metadata, uses the highest confidence,
+ * and unions all contributing source locations.
+ */
+function dedupeDataFlows(flows) {
+    const groups = new Map();
+    for (const flow of flows) {
+        const key = makeKey(flow);
+        const existing = groups.get(key);
+        if (existing) {
+            existing.push(flow);
+        }
+        else {
+            groups.set(key, [flow]);
+        }
+    }
+    const result = [];
+    const groupEntries = Array.from(groups.entries()).sort(([aKey], [bKey]) => aKey.localeCompare(bKey));
+    for (const [, group] of groupEntries) {
+        const maxConfidence = group.reduce((max, flow) => (flow.confidence > max ? flow.confidence : max), group[0]?.confidence ?? 0);
+        const base = [...group].sort((a, b) => {
+            // Deterministic base selection:
+            // - highest confidence
+            // - tie-break by stable id
+            if (a.confidence !== b.confidence)
+                return b.confidence - a.confidence;
+            return a.id.localeCompare(b.id);
+        })[0];
+        const allLocations = collectUniqueSourceLocations(group).sort(compareSourceLocations);
+        const primary = allLocations[0];
+        result.push({
+            ...base,
+            confidence: maxConfidence,
+            sourceLocation: primary ?? base.sourceLocation,
+            sourceLocations: allLocations.length > 0 ? allLocations : base.sourceLocations,
+        });
+    }
+    return result.sort((a, b) => {
+        const keyA = makeKey(a);
+        const keyB = makeKey(b);
+        const cmp = keyA.localeCompare(keyB);
+        if (cmp !== 0)
+            return cmp;
+        return a.id.localeCompare(b.id);
+    });
+}

package/dist/src/data-flow/detect.d.ts

@@ -0,0 +1,16 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+import type { RawFinding } from "../core/types/detection";
+import type { FileInfo } from "../core/types/file";
+import type { ServiceSection } from "../core/sectioning/discover-service-sections";
+/**
+ * Build raw data flows from findings/components/files.
+ *
+ * This module is intentionally orchestration-focused: heavy matching/parsing logic
+ * lives in focused helpers (`source-*`, `target-matching`, `import-graph`,
+ * `internal-fetch`, `flow-builder`).
+ *
+ * Note: structural post-processing (dedupe/rewire/ensure actor flow) is handled
+ * outside this function.
+ */
+export declare function detectDataFlows(files: FileInfo[], components: DetectedComponent[], findings: RawFinding[], sections?: ServiceSection[]): DetectedDataFlow[];

package/dist/src/data-flow/detect.js

@@ -0,0 +1,203 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDataFlows = detectDataFlows;
+const node_path_1 = __importDefault(require("node:path"));
+const flow_source_patterns_1 = require("../patterns/flow-source-patterns");
+const flow_builder_1 = require("./flow-builder");
+const source_resolution_1 = require("./source-resolution");
+const import_graph_1 = require("./import-graph");
+const source_attribution_1 = require("./source-attribution");
+const target_matching_1 = require("./target-matching");
+const internal_fetch_1 = require("./internal-fetch");
+const terraform_flows_1 = require("./terraform-flows");
+function isManifestOrNonRuntimeMetadataFile(normalizedPath) {
+    const fileName = node_path_1.default.posix.basename(normalizedPath).toLowerCase();
+    if (flow_source_patterns_1.NON_RUNTIME_METADATA_FILE_NAMES.has(fileName))
+        return true;
+    return flow_source_patterns_1.NON_RUNTIME_METADATA_EXTENSIONS.some((ext) => fileName.endsWith(ext));
+}
+function isClearlyFrontendRuntimeFile(normalizedPath) {
+    const p = normalizedPath.toLowerCase();
+    if (p.includes("/app/api/"))
+        return false;
+    if (flow_source_patterns_1.FRONTEND_RUNTIME_PATH_MARKERS.some((marker) => p.includes(marker)))
+        return true;
+    return flow_source_patterns_1.FRONTEND_RUNTIME_FILE_EXTENSIONS.some((ext) => p.endsWith(ext));
+}
+function isLikelyRouteHandlerFile(normalizedPath) {
+    const p = normalizedPath.toLowerCase();
+    if (flow_source_patterns_1.ROUTE_HANDLER_PATH_MARKERS.some((marker) => p.includes(marker)))
+        return true;
+    return flow_source_patterns_1.ROUTE_HANDLER_FILE_SUFFIXES.some((suffix) => p.endsWith(suffix));
+}
+function isAuthProviderThirdParty(component) {
+    if (component.type !== "third_party")
+        return false;
+    const serviceName = component.properties?.serviceName;
+    const normalizedService = typeof serviceName === "string" ? serviceName.trim().toLowerCase() : "";
+    const normalizedName = (component.name || "").trim().toLowerCase();
+    return normalizedService.includes("auth0") || normalizedName.includes("auth0");
+}
+function findAuthMiddlewareTarget(finding, components) {
+    const sectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+    const authServiceInSection = components.find((c) => c.type === "asset" &&
+        c.subType === "auth_service" &&
+        (!sectionId || (0, source_resolution_1.getSectionIdFromComponent)(c) === sectionId));
+    if (authServiceInSection)
+        return authServiceInSection;
+    const authThirdPartyInSection = components.find((c) => isAuthProviderThirdParty(c) &&
+        (!sectionId || (0, source_resolution_1.getSectionIdFromComponent)(c) === sectionId));
+    if (authThirdPartyInSection)
+        return authThirdPartyInSection;
+    // For concrete section-scoped findings, avoid cross-section fallback.
+    if ((0, source_resolution_1.isConcreteServiceSectionId)(sectionId)) {
+        return undefined;
+    }
+    return (components.find((c) => c.type === "asset" && c.subType === "auth_service") ??
+        components.find((c) => isAuthProviderThirdParty(c)));
+}
+/**
+ * Build raw data flows from findings/components/files.
+ *
+ * This module is intentionally orchestration-focused: heavy matching/parsing logic
+ * lives in focused helpers (`source-*`, `target-matching`, `import-graph`,
+ * `internal-fetch`, `flow-builder`).
+ *
+ * Note: structural post-processing (dedupe/rewire/ensure actor flow) is handled
+ * outside this function.
+ */
+function detectDataFlows(files, components, findings, sections) {
+    const defaultSource = (0, source_resolution_1.findSourceComponent)(components);
+    if (!defaultSource)
+        return [];
+    const sourceBySectionId = new Map();
+    const getSourceForFinding = (finding) => {
+        const findingSectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+        const key = findingSectionId ?? "__global__";
+        if (sourceBySectionId.has(key)) {
+            return sourceBySectionId.get(key) ?? defaultSource;
+        }
+        const resolved = (0, source_resolution_1.findSourceComponent)(components, findingSectionId);
+        sourceBySectionId.set(key, resolved);
+        return resolved ?? defaultSource;
+    };
+    const hasFiles = files.length > 0;
+    const knownPaths = hasFiles ? (0, import_graph_1.buildKnownPathsSet)(files) : new Set();
+    const importGraph = hasFiles
+        ? (0, import_graph_1.buildImportAdjacency)(files, knownPaths)
+        : new Map();
+    const flows = [];
+    let flowIndex = 0;
+    for (const finding of findings) {
+        const sourceComponent = getSourceForFinding(finding);
+        const findingSectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+        const sectionApiSource = (0, source_resolution_1.findSectionApiNode)(components, findingSectionId) ?? sourceComponent;
+        if (finding.pattern === "database_connection") {
+            const target = (0, target_matching_1.findTargetDatabaseComponent)(finding, components);
+            if (target) {
+                const flow = (0, flow_builder_1.buildFlow)(sourceComponent.id, target.id, "database_query", finding, ++flowIndex, sourceComponent, target);
+                flows.push(flow);
+            }
+            continue;
+        }
+        if (finding.pattern === "external_api_call") {
+            const target = (0, target_matching_1.findTargetThirdPartyComponent)(finding, components);
+            if (target) {
+                const normalizedFindingPath = (0, import_graph_1.normalizeProjectPath)(finding.location?.filePath ?? "");
+                if (normalizedFindingPath &&
+                    isManifestOrNonRuntimeMetadataFile(normalizedFindingPath)) {
+                    continue;
+                }
+                let flowSource = (0, source_attribution_1.findSourceComponentForExternalApiCall)(finding, components, sourceComponent, files, importGraph, knownPaths);
+                if (sectionApiSource && sectionApiSource.id !== sourceComponent.id) {
+                    if (isClearlyFrontendRuntimeFile(normalizedFindingPath)) {
+                        flowSource = sourceComponent;
+                    }
+                    else if (isLikelyRouteHandlerFile(normalizedFindingPath) ||
+                        flowSource.id === sourceComponent.id) {
+                        // Prefer API source for backend/route evidence or ambiguous
+                        // non-frontend sources.
+                        flowSource = sectionApiSource;
+                    }
+                }
+                const flowType = (0, flow_builder_1.flowTypeForExternalApi)(finding);
+                const flow = (0, flow_builder_1.buildFlow)(flowSource.id, target.id, flowType, finding, ++flowIndex, flowSource, target);
+                flows.push(flow);
+            }
+            continue;
+        }
+        if (finding.pattern === "auth_middleware") {
+            const target = findAuthMiddlewareTarget(finding, components);
+            if (target &&
+                sourceComponent &&
+                target.id !== sourceComponent.id) {
+                flows.push((0, flow_builder_1.buildFlow)(sourceComponent.id, target.id, "api_call", finding, ++flowIndex, sourceComponent, target));
+            }
+            continue;
+        }
+        if (finding.pattern === "express_route") {
+            let target = (0, target_matching_1.findTargetAssetForRoute)(finding, components, sectionApiSource);
+            if (!target) {
+                target = (0, target_matching_1.findMergedHttpApiSurfaceComponent)(components, sectionApiSource);
+            }
+            if (target) {
+                const flow = (0, flow_builder_1.buildFlow)(sectionApiSource.id, target.id, "api_call", finding, ++flowIndex, sectionApiSource, target);
+                flows.push(flow);
+            }
+            continue;
+        }
+        if (finding.pattern === "web_actor" || finding.pattern === "service_actor") {
+            const target = (0, target_matching_1.findTargetActorComponent)(finding, components);
+            if (target) {
+                const flow = (0, flow_builder_1.buildFlow)(target.id, sourceComponent.id, "api_call", finding, ++flowIndex, target, sourceComponent);
+                flows.push(flow);
+            }
+        }
+    }
+    const internal = (0, internal_fetch_1.detectInternalFetchCalls)(files, components, defaultSource, flowIndex, sections);
+    flows.push(...internal.flows);
+    flowIndex = internal.nextIndex;
+    const terraformAppend = (0, terraform_flows_1.appendTerraformDataFlows)(components, flowIndex);
+    flows.push(...terraformAppend.flows);
+    flowIndex = terraformAppend.nextIndex;
+    // Provider → Terraform resource edges (and managed-service topology) are
+    // applied in applyDeterministicInferenceFallbacks (same pass as TS SDK).
+    // Ensure section API nodes are visibly connected from the section main app.
+    const existingFlowKeys = new Set(flows.map((f) => `${f.sourceComponentId}::${f.targetComponentId}::${f.type}`));
+    for (const component of components) {
+        if (component.type !== "asset" ||
+            component.subType !== "api" ||
+            (component.properties?.isSectionApiNode !== true &&
+                component.properties?.isSectionApiNode !== "true")) {
+            continue;
+        }
+        const sectionId = (0, source_resolution_1.getSectionIdFromComponent)(component);
+        const mainApp = components.find((c) => c.type === "asset" &&
+            (0, source_resolution_1.getSectionIdFromComponent)(c) === sectionId &&
+            (c.properties?.isMainApplication === true ||
+                c.properties?.isMainApplication === "true"));
+        if (!mainApp)
+            continue;
+        if (mainApp.id === component.id)
+            continue;
+        const key = `${mainApp.id}::${component.id}::api_call`;
+        if (existingFlowKeys.has(key))
+            continue;
+        existingFlowKeys.add(key);
+        flowIndex += 1;
+        flows.push({
+            id: `flow_${flowIndex}`,
+            sourceComponentId: mainApp.id,
+            targetComponentId: component.id,
+            type: "api_call",
+            confidence: 1,
+            targetScope: "local",
+            targetScopeConfidence: "high",
+            targetScopeReason: "main-to-section-api",
+        });
+    }
+    return flows;
+}

package/dist/src/data-flow/detector.d.ts

@@ -0,0 +1,15 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+import type { RawFinding } from "../core/types/detection";
+import type { FileInfo } from "../core/types/file";
+import type { ServiceSection } from "../core/sectioning/discover-service-sections";
+/**
+ * Thin coordinator that runs raw data-flow detection followed by structural
+ * post-processing (dedupe, rewiring through the application, actor→app safety
+ * flows, etc.).
+ *
+ * Callers that need fine-grained control over raw flows vs. post-processing
+ * should import from `data-flow/detect` and `data-flow/postprocess`
+ * directly instead.
+ */
+export declare function detectDataFlows(files: FileInfo[], components: DetectedComponent[], findings: RawFinding[], sections?: ServiceSection[]): DetectedDataFlow[];

package/dist/src/data-flow/detector.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectDataFlows = detectDataFlows;
+const detect_1 = require("./detect");
+const postprocess_1 = require("./postprocess");
+/**
+ * Thin coordinator that runs raw data-flow detection followed by structural
+ * post-processing (dedupe, rewiring through the application, actor→app safety
+ * flows, etc.).
+ *
+ * Callers that need fine-grained control over raw flows vs. post-processing
+ * should import from `data-flow/detect` and `data-flow/postprocess`
+ * directly instead.
+ */
+function detectDataFlows(files, components, findings, sections) {
+    const raw = (0, detect_1.detectDataFlows)(files, components, findings, sections);
+    return (0, postprocess_1.postprocessDataFlows)(components, raw);
+}

package/dist/src/data-flow/drop-cross-section-flows.d.ts

@@ -0,0 +1,8 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Drops edges between two different concrete service sections. Monorepo scans
+ * should show per-package subgraphs; synthetic bridges (e.g. app → remote TF hub)
+ * are not valid cross-section runtime flows.
+ */
+export declare function dropCrossSectionServiceFlows(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];

package/dist/src/data-flow/drop-cross-section-flows.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dropCrossSectionServiceFlows = dropCrossSectionServiceFlows;
+const section_runtime_1 = require("../core/sectioning/section-runtime");
+function sectionIdOf(component) {
+    const sid = component?.properties?.section_id;
+    return typeof sid === "string" ? sid.trim() : "";
+}
+/**
+ * Drops edges between two different concrete service sections. Monorepo scans
+ * should show per-package subgraphs; synthetic bridges (e.g. app → remote TF hub)
+ * are not valid cross-section runtime flows.
+ */
+function dropCrossSectionServiceFlows(components, flows) {
+    const byId = new Map(components.map((c) => [c.id, c]));
+    return flows.filter((flow) => {
+        const source = byId.get(flow.sourceComponentId);
+        const target = byId.get(flow.targetComponentId);
+        if (!source || !target)
+            return true;
+        const sourceSection = sectionIdOf(source);
+        const targetSection = sectionIdOf(target);
+        if (!sourceSection || !targetSection || sourceSection === targetSection) {
+            return true;
+        }
+        if (!(0, section_runtime_1.isConcreteServiceSectionId)(sourceSection) ||
+            !(0, section_runtime_1.isConcreteServiceSectionId)(targetSection)) {
+            return true;
+        }
+        return false;
+    });
+}

package/dist/src/data-flow/ensure-actor-flow.d.ts

@@ -0,0 +1,16 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Ensures at least one flow connects an actor to the main application hub.
+ * When we have both a hub and actor(s) but no actor↔hub flow (e.g. because
+ * the actor was injected and no pattern matched), adds actor→hub from the
+ * first actor.
+ */
+export declare function ensureActorToAppFlow(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];
+/**
+ * After {@link ensureActorToAppFlow}, the graph can have User → injected project
+ * main with no main → cloud provider edge (rewire only adds main→provider when
+ * it rewires an earlier actor→infra flow). Adds main → `provider.*` for each
+ * injected placeholder main that has a matching Terraform provider in scope.
+ */
+export declare function ensureInjectedProjectMainToTerraformProviderHub(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];

package/dist/src/data-flow/ensure-actor-flow.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureActorToAppFlow = ensureActorToAppFlow;
+exports.ensureInjectedProjectMainToTerraformProviderHub = ensureInjectedProjectMainToTerraformProviderHub;
+const application_injection_1 = require("../classifier/application-injection");
+const terraform_provider_hub_1 = require("../classifier/terraform-provider-hub");
+const section_runtime_1 = require("../core/sectioning/section-runtime");
+const application_hub_1 = require("./application-hub");
+/**
+ * Ensures at least one flow connects an actor to the main application hub.
+ * When we have both a hub and actor(s) but no actor↔hub flow (e.g. because
+ * the actor was injected and no pattern matched), adds actor→hub from the
+ * first actor.
+ */
+function ensureActorToAppFlow(components, flows) {
+    const actors = components.filter((c) => c.type === "actor");
+    if (actors.length === 0)
+        return flows;
+    const maxFlowNum = flows.reduce((max, f) => {
+        const m = /^flow_(\d+)$/.exec(f.id);
+        return m ? Math.max(max, Number.parseInt(m[1], 10)) : max;
+    }, 0);
+    const actorsBySection = new Map();
+    for (const actor of actors) {
+        const sectionId = String(actor.properties?.section_id ?? "");
+        const list = actorsBySection.get(sectionId);
+        if (list)
+            list.push(actor);
+        else
+            actorsBySection.set(sectionId, [actor]);
+    }
+    const synthetic = [];
+    let nextFlowNum = maxFlowNum;
+    const stableActorSectionEntries = Array.from(actorsBySection.entries()).sort(([a], [b]) => a.localeCompare(b));
+    for (const [sectionId, sectionActors] of stableActorSectionEntries) {
+        const app = (0, application_hub_1.findApplicationHubForFlows)(components, sectionId);
+        if (!app)
+            continue;
+        if (!(0, section_runtime_1.shouldInjectUserActorForMainApp)(app, components))
+            continue;
+        const appId = app.id;
+        const stableActors = [...sectionActors].sort((a, b) => a.id.localeCompare(b.id));
+        const actorIds = new Set(stableActors.map((a) => a.id));
+        const hasActorAppFlow = flows.some((f) => (actorIds.has(f.sourceComponentId) && f.targetComponentId === appId) ||
+            (actorIds.has(f.targetComponentId) && f.sourceComponentId === appId));
+        if (hasActorAppFlow)
+            continue;
+        nextFlowNum += 1;
+        synthetic.push({
+            id: `flow_${nextFlowNum}`,
+            sourceComponentId: stableActors[0].id,
+            targetComponentId: appId,
+            type: "api_call",
+            confidence: 0.5,
+        });
+    }
+    return synthetic.length > 0 ? [...flows, ...synthetic] : flows;
+}
+/**
+ * After {@link ensureActorToAppFlow}, the graph can have User → injected project
+ * main with no main → cloud provider edge (rewire only adds main→provider when
+ * it rewires an earlier actor→infra flow). Adds main → `provider.*` for each
+ * injected placeholder main that has a matching Terraform provider in scope.
+ */
+function ensureInjectedProjectMainToTerraformProviderHub(components, flows) {
+    const mains = components.filter((c) => c.type === "asset" &&
+        (c.properties?.isMainApplication === true ||
+            c.properties?.isMainApplication === "true") &&
+        c.properties?.sourceContext === application_injection_1.INJECTED_PROJECT_PLACEHOLDER_SOURCE_CONTEXT);
+    if (mains.length === 0)
+        return flows;
+    const maxFlowNum = flows.reduce((max, f) => {
+        const m = /^flow_(\d+)$/.exec(f.id);
+        return m ? Math.max(max, Number.parseInt(m[1], 10)) : max;
+    }, 0);
+    let nextFlowNum = maxFlowNum;
+    const pairKeys = new Set(flows
+        .filter((f) => f.type === "api_call")
+        .map((f) => `${f.sourceComponentId}\t${f.targetComponentId}`));
+    const synthetic = [];
+    const stableMains = [...mains].sort((a, b) => a.id.localeCompare(b.id));
+    for (const main of stableMains) {
+        const sid = String(main.properties?.section_id ?? "");
+        const hub = (0, terraform_provider_hub_1.findTerraformPrimaryProviderHub)(components, sid);
+        if (!hub)
+            continue;
+        const key = `${main.id}\t${hub.id}`;
+        if (pairKeys.has(key))
+            continue;
+        pairKeys.add(key);
+        nextFlowNum += 1;
+        synthetic.push({
+            id: `flow_${nextFlowNum}`,
+            sourceComponentId: main.id,
+            targetComponentId: hub.id,
+            type: "api_call",
+            confidence: 0.72,
+        });
+    }
+    return synthetic.length > 0 ? [...flows, ...synthetic] : flows;
+}

package/dist/src/data-flow/ensure-manifest-declared-flows.d.ts

@@ -0,0 +1,14 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Third parties inferred only from dependency manifests (e.g. `package.json`
+ * imports), not from runtime call sites.
+ */
+export declare function isManifestOnlyThirdPartyComponent(component: DetectedComponent): boolean;
+/**
+ * Connects each workspace package hub to third parties declared in its manifest.
+ * Runtime call sites still produce their own flows; this only fills gaps for
+ * manifest-only vendors (e.g. Anthropic listed in `package.json` but called via
+ * OpenRouter at runtime).
+ */
+export declare function ensureManifestDeclaredThirdPartyFlows(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];