@dataparade/cli 0.0.1

package/dist/src/data-flow/ensure-manifest-declared-flows.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isManifestOnlyThirdPartyComponent = isManifestOnlyThirdPartyComponent;
+exports.ensureManifestDeclaredThirdPartyFlows = ensureManifestDeclaredThirdPartyFlows;
+const application_hub_1 = require("./application-hub");
+const MANIFEST_FILE_NAMES = new Set([
+    "package.json",
+    "pyproject.toml",
+    "pipfile",
+    "requirements.txt",
+]);
+function isManifestMetadataPath(filePath) {
+    if (!filePath?.trim())
+        return false;
+    const base = filePath.replace(/\\/g, "/").split("/").pop()?.toLowerCase() ?? "";
+    return MANIFEST_FILE_NAMES.has(base);
+}
+/**
+ * Third parties inferred only from dependency manifests (e.g. `package.json`
+ * imports), not from runtime call sites.
+ */
+function isManifestOnlyThirdPartyComponent(component) {
+    if (component.type !== "third_party")
+        return false;
+    if (component.properties?.sourceContext === "dependency_manifest") {
+        return true;
+    }
+    const refs = component.detectedFrom ?? [];
+    if (refs.length === 0)
+        return false;
+    return refs.every((ref) => {
+        if (ref.pattern !== "external_api_call")
+            return false;
+        const fp = ref.sourceLocation?.filePath;
+        return isManifestMetadataPath(fp);
+    });
+}
+/**
+ * Connects each workspace package hub to third parties declared in its manifest.
+ * Runtime call sites still produce their own flows; this only fills gaps for
+ * manifest-only vendors (e.g. Anthropic listed in `package.json` but called via
+ * OpenRouter at runtime).
+ */
+function ensureManifestDeclaredThirdPartyFlows(components, flows) {
+    const manifestThirdParties = components.filter(isManifestOnlyThirdPartyComponent);
+    if (manifestThirdParties.length === 0)
+        return flows;
+    const existingKeys = new Set(flows.map((f) => `${f.sourceComponentId}\t${f.targetComponentId}\t${f.type}`));
+    let maxFlowNum = flows.reduce((max, f) => {
+        const m = /^flow_(\d+)$/.exec(f.id);
+        return m ? Math.max(max, Number.parseInt(m[1], 10)) : max;
+    }, 0);
+    const synthetic = [];
+    const sortedThirdParties = [...manifestThirdParties].sort((a, b) => a.id.localeCompare(b.id));
+    for (const thirdParty of sortedThirdParties) {
+        const sectionId = String(thirdParty.properties?.section_id ?? "").trim();
+        const hub = (0, application_hub_1.findApplicationHubForFlows)(components, sectionId || undefined);
+        if (!hub || hub.id === thirdParty.id)
+            continue;
+        const key = `${hub.id}\t${thirdParty.id}\tapi_call`;
+        if (existingKeys.has(key))
+            continue;
+        existingKeys.add(key);
+        maxFlowNum += 1;
+        synthetic.push({
+            id: `flow_${maxFlowNum}`,
+            sourceComponentId: hub.id,
+            targetComponentId: thirdParty.id,
+            type: "api_call",
+            confidence: 0.65,
+            description: "Declared dependency (package.json)",
+            enrichmentNotes: "declared_dependency",
+        });
+    }
+    return synthetic.length > 0 ? [...flows, ...synthetic] : flows;
+}

package/dist/src/data-flow/ensure-section-api-flows.d.ts

@@ -0,0 +1,6 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Links the section main app to API assets that have no flows yet
+ */
+export declare function ensureMainToUnlinkedSectionApiFlows(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];

package/dist/src/data-flow/ensure-section-api-flows.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureMainToUnlinkedSectionApiFlows = ensureMainToUnlinkedSectionApiFlows;
+function getSectionId(component) {
+    const sid = component.properties?.section_id;
+    return typeof sid === "string" && sid.trim() ? sid.trim() : "";
+}
+function isMainApp(component) {
+    return (component.type === "asset" &&
+        (component.properties?.isMainApplication === true ||
+            component.properties?.isMainApplication === "true"));
+}
+function isSyntheticSectionApiNode(component) {
+    return (component.properties?.isSectionApiNode === true ||
+        component.properties?.isSectionApiNode === "true");
+}
+function componentHasFlow(componentId, flows) {
+    return flows.some((f) => f.sourceComponentId === componentId || f.targetComponentId === componentId);
+}
+/**
+ * Links the section main app to API assets that have no flows yet
+ */
+function ensureMainToUnlinkedSectionApiFlows(components, flows) {
+    const flowKeys = new Set(flows.map((f) => `${f.sourceComponentId}\t${f.targetComponentId}\t${f.type}`));
+    let maxFlowNum = flows.reduce((max, f) => {
+        const m = /^flow_(\d+)$/.exec(f.id);
+        return m ? Math.max(max, Number.parseInt(m[1], 10)) : max;
+    }, 0);
+    const synthetic = [];
+    const apiAssets = components
+        .filter((c) => c.type === "asset" &&
+        c.subType === "api" &&
+        !isSyntheticSectionApiNode(c))
+        .sort((a, b) => a.id.localeCompare(b.id));
+    for (const api of apiAssets) {
+        if (componentHasFlow(api.id, flows))
+            continue;
+        const sectionId = getSectionId(api);
+        const main = components.find((c) => isMainApp(c) && getSectionId(c) === sectionId);
+        if (!main || main.id === api.id)
+            continue;
+        const key = `${main.id}\t${api.id}\tapi_call`;
+        if (flowKeys.has(key))
+            continue;
+        flowKeys.add(key);
+        maxFlowNum += 1;
+        synthetic.push({
+            id: `flow_${maxFlowNum}`,
+            sourceComponentId: main.id,
+            targetComponentId: api.id,
+            type: "api_call",
+            confidence: 0.75,
+            description: "Section main to API surface",
+        });
+    }
+    return synthetic.length > 0 ? [...flows, ...synthetic] : flows;
+}

package/dist/src/data-flow/flow-builder.d.ts

@@ -0,0 +1,5 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DataFlowType, DetectedDataFlow } from "../core/types/data-flow";
+import type { RawFinding } from "../core/types/detection";
+export declare function flowTypeForExternalApi(finding: RawFinding): DataFlowType;
+export declare function buildFlow(sourceId: string, targetId: string, type: DataFlowType, finding: RawFinding, index: number, sourceComponent: DetectedComponent, targetComponent: DetectedComponent): DetectedDataFlow;

package/dist/src/data-flow/flow-builder.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flowTypeForExternalApi = flowTypeForExternalApi;
+exports.buildFlow = buildFlow;
+function getSectionIdFromMaybeUnknown(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const v = raw.trim();
+    return v ? v : undefined;
+}
+function getSectionIdFromComponent(component) {
+    return getSectionIdFromMaybeUnknown(component.properties?.section_id);
+}
+function inferTargetScope(sourceComponent, targetComponent) {
+    if (targetComponent.type === "third_party") {
+        return {
+            targetScope: "external",
+            targetScopeConfidence: "high",
+            targetScopeReason: "third-party-target",
+        };
+    }
+    const sourceSectionId = getSectionIdFromComponent(sourceComponent);
+    const targetSectionId = getSectionIdFromComponent(targetComponent);
+    if (!sourceSectionId || !targetSectionId) {
+        return {
+            targetScope: "unknown",
+            targetScopeConfidence: "low",
+            targetScopeReason: "missing-section-id",
+        };
+    }
+    if (sourceSectionId === targetSectionId) {
+        return {
+            targetScope: "local",
+            targetScopeConfidence: "high",
+            targetScopeReason: "same-section-id",
+        };
+    }
+    return {
+        targetScope: "cross_section_internal",
+        targetScopeConfidence: "high",
+        targetScopeReason: "different-section-id",
+    };
+}
+function flowTypeForExternalApi(finding) {
+    const method = typeof finding.properties?.httpMethod === "string"
+        ? finding.properties.httpMethod.toUpperCase()
+        : "";
+    const url = typeof finding.properties?.url === "string"
+        ? finding.properties.url.toLowerCase()
+        : "";
+    if (url && (url.includes("webhook") || url.includes("callback"))) {
+        return "webhook";
+    }
+    if (method === "POST" && url && (url.includes("hook") || url.includes("event"))) {
+        return "webhook";
+    }
+    return "api_call";
+}
+function buildFlow(sourceId, targetId, type, finding, index, sourceComponent, targetComponent) {
+    const method = typeof finding.properties?.httpMethod === "string"
+        ? finding.properties.httpMethod
+        : undefined;
+    const endpoint = typeof finding.properties?.url === "string"
+        ? finding.properties.url
+        : undefined;
+    const scope = inferTargetScope(sourceComponent, targetComponent);
+    return {
+        id: `flow_${index}`,
+        sourceComponentId: sourceId,
+        targetComponentId: targetId,
+        type,
+        confidence: typeof finding.confidence === "number" ? finding.confidence : 0.8,
+        sourceLocation: finding.location,
+        method: method ?? undefined,
+        endpoint: endpoint ?? undefined,
+        targetScope: scope.targetScope,
+        targetScopeConfidence: scope.targetScopeConfidence,
+        targetScopeReason: scope.targetScopeReason,
+    };
+}

package/dist/src/data-flow/import-graph.d.ts

@@ -0,0 +1,10 @@
+import type { FileInfo } from "../core/types/file";
+/** Normalize repo-relative paths for stable comparisons (POSIX, no leading ./). */
+export declare function normalizeProjectPath(p: string): string;
+/**
+ * Parse static relative imports (default, namespace, named, side-effect) and require() for bindings.
+ */
+export declare function parseStaticImportBindings(fromFile: string, content: string, knownPaths: Set<string>): Map<string, string>;
+export declare function buildKnownPathsSet(files: FileInfo[]): Set<string>;
+export declare function buildImportAdjacency(files: FileInfo[], knownPaths: Set<string>): Map<string, Set<string>>;
+export declare function shortestImportDistance(graph: Map<string, Set<string>>, from: string, to: string): number | undefined;

package/dist/src/data-flow/import-graph.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeProjectPath = normalizeProjectPath;
+exports.parseStaticImportBindings = parseStaticImportBindings;
+exports.buildKnownPathsSet = buildKnownPathsSet;
+exports.buildImportAdjacency = buildImportAdjacency;
+exports.shortestImportDistance = shortestImportDistance;
+const node_path_1 = __importDefault(require("node:path"));
+function toPosixPath(p) {
+    return p.replace(/\\/g, "/");
+}
+/** Normalize repo-relative paths for stable comparisons (POSIX, no leading ./). */
+function normalizeProjectPath(p) {
+    return node_path_1.default.posix.normalize(toPosixPath(p));
+}
+function resolveRelativeModule(fromFile, specifier, knownPaths) {
+    if (!specifier.startsWith("."))
+        return undefined;
+    const dir = node_path_1.default.posix.dirname(normalizeProjectPath(fromFile));
+    const raw = node_path_1.default.posix.normalize(node_path_1.default.posix.join(dir, specifier));
+    const candidates = [
+        raw,
+        `${raw}.ts`,
+        `${raw}.tsx`,
+        `${raw}.js`,
+        `${raw}.mjs`,
+        `${raw}.cjs`,
+        node_path_1.default.posix.join(raw, "index.ts"),
+        node_path_1.default.posix.join(raw, "index.tsx"),
+        node_path_1.default.posix.join(raw, "index.js"),
+        node_path_1.default.posix.join(raw, "index.mjs"),
+    ];
+    for (const c of candidates) {
+        const n = normalizeProjectPath(c);
+        if (knownPaths.has(n))
+            return n;
+    }
+    return undefined;
+}
+/**
+ * Parse static relative imports (default, namespace, named, side-effect) and require() for bindings.
+ */
+function parseStaticImportBindings(fromFile, content, knownPaths) {
+    const bindings = new Map();
+    const lines = content.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        let m = trimmed.match(/^import\s+(\w+)\s+from\s+['"](\.[^'"]+)['"]/);
+        if (m) {
+            const resolved = resolveRelativeModule(fromFile, m[2], knownPaths);
+            if (resolved)
+                bindings.set(m[1], resolved);
+            continue;
+        }
+        m = trimmed.match(/^import\s+\*\s+as\s+(\w+)\s+from\s+['"](\.[^'"]+)['"]/);
+        if (m) {
+            const resolved = resolveRelativeModule(fromFile, m[2], knownPaths);
+            if (resolved)
+                bindings.set(m[1], resolved);
+            continue;
+        }
+        m = trimmed.match(/^import\s+\{([^}]+)\}\s+from\s+['"](\.[^'"]+)['"]/);
+        if (m) {
+            const resolved = resolveRelativeModule(fromFile, m[2], knownPaths);
+            if (resolved) {
+                for (const part of m[1].split(",")) {
+                    const seg = part.trim();
+                    const asMatch = seg.match(/^(\w+)\s+as\s+(\w+)$/);
+                    if (asMatch)
+                        bindings.set(asMatch[2], resolved);
+                    else if (/^\w+$/.test(seg))
+                        bindings.set(seg, resolved);
+                }
+            }
+            continue;
+        }
+        m = trimmed.match(/^import\s+['"](\.[^'"]+)['"]/);
+        if (m) {
+            void resolveRelativeModule(fromFile, m[1], knownPaths);
+            continue;
+        }
+        m = trimmed.match(/(?:const|let|var)\s+(\w+)\s*=\s*require\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
+        if (m) {
+            const resolved = resolveRelativeModule(fromFile, m[2], knownPaths);
+            if (resolved)
+                bindings.set(m[1], resolved);
+        }
+    }
+    return bindings;
+}
+function collectDirectImportedModules(fromFile, content, knownPaths) {
+    const edges = new Set();
+    const bindings = parseStaticImportBindings(fromFile, content, knownPaths);
+    for (const resolved of bindings.values()) {
+        edges.add(resolved);
+    }
+    for (const match of content.matchAll(/import\s+['"](\.[^'"]+)['"]/g)) {
+        const resolved = resolveRelativeModule(fromFile, match[1], knownPaths);
+        if (resolved)
+            edges.add(resolved);
+    }
+    return edges;
+}
+function buildKnownPathsSet(files) {
+    const set = new Set();
+    for (const f of files) {
+        set.add(normalizeProjectPath(f.path));
+    }
+    return set;
+}
+function buildImportAdjacency(files, knownPaths) {
+    const graph = new Map();
+    for (const file of files) {
+        if (!file.content)
+            continue;
+        const fp = normalizeProjectPath(file.path);
+        graph.set(fp, collectDirectImportedModules(fp, file.content, knownPaths));
+    }
+    return graph;
+}
+function shortestImportDistance(graph, from, to) {
+    const start = normalizeProjectPath(from);
+    const end = normalizeProjectPath(to);
+    if (start === end)
+        return 0;
+    const seen = new Set();
+    const queue = [{ node: start, d: 0 }];
+    while (queue.length > 0) {
+        const { node, d } = queue.shift();
+        if (seen.has(node))
+            continue;
+        seen.add(node);
+        const neighbors = graph.get(node);
+        if (!neighbors)
+            continue;
+        for (const n of neighbors) {
+            if (n === end)
+                return d + 1;
+            if (!seen.has(n))
+                queue.push({ node: n, d: d + 1 });
+        }
+    }
+    return undefined;
+}

package/dist/src/data-flow/index.d.ts

@@ -0,0 +1,8 @@
+export { detectDataFlows } from "./detector";
+export { dedupeDataFlows } from "./dedupe";
+export { rewireFlowsThroughApplication } from "./rewire";
+export { ensureActorToAppFlow } from "./ensure-actor-flow";
+export { ensureManifestDeclaredThirdPartyFlows, isManifestOnlyThirdPartyComponent, } from "./ensure-manifest-declared-flows";
+export { ensureMainToUnlinkedSectionApiFlows } from "./ensure-section-api-flows";
+export { detectDataFlows as detectRawDataFlows } from "./detect";
+export { postprocessDataFlows } from "./postprocess";

package/dist/src/data-flow/index.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postprocessDataFlows = exports.detectRawDataFlows = exports.ensureMainToUnlinkedSectionApiFlows = exports.isManifestOnlyThirdPartyComponent = exports.ensureManifestDeclaredThirdPartyFlows = exports.ensureActorToAppFlow = exports.rewireFlowsThroughApplication = exports.dedupeDataFlows = exports.detectDataFlows = void 0;
+var detector_1 = require("./detector");
+Object.defineProperty(exports, "detectDataFlows", { enumerable: true, get: function () { return detector_1.detectDataFlows; } });
+var dedupe_1 = require("./dedupe");
+Object.defineProperty(exports, "dedupeDataFlows", { enumerable: true, get: function () { return dedupe_1.dedupeDataFlows; } });
+var rewire_1 = require("./rewire");
+Object.defineProperty(exports, "rewireFlowsThroughApplication", { enumerable: true, get: function () { return rewire_1.rewireFlowsThroughApplication; } });
+var ensure_actor_flow_1 = require("./ensure-actor-flow");
+Object.defineProperty(exports, "ensureActorToAppFlow", { enumerable: true, get: function () { return ensure_actor_flow_1.ensureActorToAppFlow; } });
+var ensure_manifest_declared_flows_1 = require("./ensure-manifest-declared-flows");
+Object.defineProperty(exports, "ensureManifestDeclaredThirdPartyFlows", { enumerable: true, get: function () { return ensure_manifest_declared_flows_1.ensureManifestDeclaredThirdPartyFlows; } });
+Object.defineProperty(exports, "isManifestOnlyThirdPartyComponent", { enumerable: true, get: function () { return ensure_manifest_declared_flows_1.isManifestOnlyThirdPartyComponent; } });
+var ensure_section_api_flows_1 = require("./ensure-section-api-flows");
+Object.defineProperty(exports, "ensureMainToUnlinkedSectionApiFlows", { enumerable: true, get: function () { return ensure_section_api_flows_1.ensureMainToUnlinkedSectionApiFlows; } });
+var detect_1 = require("./detect");
+Object.defineProperty(exports, "detectRawDataFlows", { enumerable: true, get: function () { return detect_1.detectDataFlows; } });
+var postprocess_1 = require("./postprocess");
+Object.defineProperty(exports, "postprocessDataFlows", { enumerable: true, get: function () { return postprocess_1.postprocessDataFlows; } });

package/dist/src/data-flow/internal-fetch.d.ts

@@ -0,0 +1,8 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+import type { FileInfo } from "../core/types/file";
+import type { ServiceSection } from "../core/sectioning/discover-service-sections";
+export declare function detectInternalFetchCalls(files: FileInfo[], components: DetectedComponent[], sourceComponent: DetectedComponent, startIndex: number, sections?: ServiceSection[]): {
+    flows: DetectedDataFlow[];
+    nextIndex: number;
+};

package/dist/src/data-flow/internal-fetch.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectInternalFetchCalls = detectInternalFetchCalls;
+const flow_builder_1 = require("./flow-builder");
+const source_resolution_1 = require("./source-resolution");
+function normalizeKey(s) {
+    return s.trim().toLowerCase().replace(/\s+/g, " ");
+}
+function componentDeclaredPathsMatch(component, normalizedPath) {
+    const raw = component.properties?.path;
+    const pathStrings = [];
+    if (typeof raw === "string") {
+        pathStrings.push(raw);
+    }
+    else if (Array.isArray(raw)) {
+        for (const p of raw) {
+            if (typeof p === "string")
+                pathStrings.push(p);
+        }
+    }
+    for (const pathStr of pathStrings) {
+        const compPath = normalizeKey(pathStr);
+        if (compPath &&
+            (compPath === normalizedPath || normalizedPath.startsWith(compPath))) {
+            return true;
+        }
+    }
+    return false;
+}
+function findTargetApiComponentByPath(pathStr, components, opts) {
+    const normalizedPath = normalizeKey(pathStr);
+    if (!normalizedPath)
+        return undefined;
+    for (const c of components) {
+        if (c.type !== "asset" || c.subType !== "api")
+            continue;
+        if (opts?.preferredSectionId &&
+            (0, source_resolution_1.getSectionIdFromComponent)(c) !== opts.preferredSectionId) {
+            continue;
+        }
+        if (opts?.excludeComponentId && c.id === opts.excludeComponentId) {
+            continue;
+        }
+        if (opts?.excludeMainApplicationTargets &&
+            (c.properties?.isMainApplication === true ||
+                c.properties?.isMainApplication === "true")) {
+            continue;
+        }
+        const compName = normalizeKey(c.name);
+        if (componentDeclaredPathsMatch(c, normalizedPath)) {
+            return c;
+        }
+        if (compName && (compName === normalizedPath || compName.includes(normalizedPath))) {
+            return c;
+        }
+    }
+    // Fallback: we couldn't match by path/name. Pick the main API asset within
+    // the preferred section (if any), so internal calls do not create
+    // cross-section edges.
+    const apiCandidates = components.filter((c) => c.type === "asset" && c.subType === "api");
+    const filtered = opts?.preferredSectionId
+        ? apiCandidates.filter((c) => (0, source_resolution_1.getSectionIdFromComponent)(c) === opts.preferredSectionId)
+        : apiCandidates;
+    const filteredNoExclude = opts?.excludeComponentId && filtered.length > 0
+        ? filtered.filter((c) => c.id !== opts.excludeComponentId)
+        : filtered;
+    const filteredNoMain = opts?.excludeMainApplicationTargets && filteredNoExclude.length > 0
+        ? filteredNoExclude.filter((c) => c.properties?.isMainApplication !== true &&
+            c.properties?.isMainApplication !== "true")
+        : filteredNoExclude;
+    const main = filteredNoMain.find((c) => c.properties?.isMainApplication === true ||
+        c.properties?.isMainApplication === "true");
+    return main ?? filteredNoMain[0];
+}
+function detectInternalFetchCalls(files, components, sourceComponent, startIndex, sections) {
+    const flows = [];
+    let index = startIndex;
+    const stringFetchRegex = /fetch\(\s*(['"`])(\/[^'"`]+)\1/g;
+    const templateFetchRegex = /fetch\(\s*`(\/[^`]+)`/g;
+    // Matches template-string fetch calls where the backend path is appended to
+    // a base URL variable, e.g. fetch(`${API_BASE_URL}/auth/login`, ...)
+    const templateFetchWithBaseRegex = /fetch\(\s*`([^`]+)`/g;
+    const findNearestSectionIdForFilePath = (filePathRelPosix) => {
+        if (!sections || sections.length === 0)
+            return "root";
+        let bestId;
+        let bestLen = -1;
+        for (const s of sections) {
+            if (!s.sectionDir)
+                continue; // root handled as fallback
+            if (filePathRelPosix === s.sectionDir ||
+                filePathRelPosix.startsWith(`${s.sectionDir}/`)) {
+                if (s.sectionDir.length > bestLen) {
+                    bestId = s.id;
+                    bestLen = s.sectionDir.length;
+                }
+            }
+        }
+        return (bestId ??
+            sections.find((s) => s.id === "root")?.id ??
+            sections[0]?.id ??
+            "root");
+    };
+    const findSectionApiNodeForSection = (sectionId) => components.find((c) => c.type === "asset" &&
+        c.subType === "api" &&
+        (0, source_resolution_1.getSectionIdFromComponent)(c) === sectionId &&
+        (c.properties?.isSectionApiNode === true ||
+            c.properties?.isSectionApiNode === "true"));
+    for (const file of files) {
+        if (!file.content)
+            continue;
+        const fileSectionId = findNearestSectionIdForFilePath(file.path);
+        const sourceForFile = (0, source_resolution_1.findSourceComponent)(components, fileSectionId) ?? sourceComponent;
+        const sourceForFileApi = findSectionApiNodeForSection(fileSectionId) ?? sourceForFile;
+        const lines = file.content.split(/\r?\n/);
+        const scan = (regex) => {
+            regex.lastIndex = 0;
+            let match;
+            while ((match = regex.exec(file.content)) !== null) {
+                const fullPath = match[2] ?? match[1];
+                if (!fullPath || typeof fullPath !== "string")
+                    continue;
+                const target = findTargetApiComponentByPath(fullPath, components, {
+                    preferredSectionId: fileSectionId,
+                    excludeComponentId: sourceForFileApi.id,
+                    excludeMainApplicationTargets: sourceForFileApi.properties?.isSectionApiNode === true ||
+                        sourceForFileApi.properties?.isSectionApiNode === "true",
+                });
+                if (!target)
+                    continue;
+                const offset = match.index;
+                const prefix = file.content.slice(0, offset);
+                const line = prefix.split(/\r?\n/).length;
+                const location = {
+                    filePath: file.path,
+                    startLine: line,
+                    endLine: line,
+                    code: lines[line - 1],
+                };
+                const syntheticFinding = {
+                    pattern: "express_route",
+                    name: `INTERNAL_FETCH ${fullPath}`,
+                    confidence: 0.8,
+                    location,
+                    properties: {
+                        httpMethod: "GET",
+                        url: fullPath,
+                    },
+                };
+                const flow = (0, flow_builder_1.buildFlow)(sourceForFileApi.id, target.id, "api_call", syntheticFinding, ++index, sourceForFileApi, target);
+                flows.push(flow);
+            }
+        };
+        scan(stringFetchRegex);
+        scan(templateFetchRegex);
+        // Extra pass for template strings that include a base URL expression.
+        templateFetchWithBaseRegex.lastIndex = 0;
+        let match;
+        while ((match = templateFetchWithBaseRegex.exec(file.content)) !== null) {
+            const templateContent = match[1];
+            if (typeof templateContent !== "string")
+                continue;
+            // Attempt to extract the trailing literal path after the last `${...}`.
+            // Example: "${API_BASE_URL}/auth/login" => "/auth/login"
+            const lastBrace = templateContent.lastIndexOf("}");
+            let fullPath;
+            if (lastBrace !== -1) {
+                const after = templateContent.slice(lastBrace + 1);
+                if (after.startsWith("/"))
+                    fullPath = after;
+            }
+            // If it doesn't include a base URL expression, fall back to literal path.
+            if (!fullPath && templateContent.startsWith("/"))
+                fullPath = templateContent;
+            if (!fullPath)
+                continue;
+            const target = findTargetApiComponentByPath(fullPath, components, {
+                preferredSectionId: fileSectionId,
+                excludeComponentId: sourceForFileApi.id,
+                excludeMainApplicationTargets: sourceForFileApi.properties?.isSectionApiNode === true ||
+                    sourceForFileApi.properties?.isSectionApiNode === "true",
+            });
+            if (!target)
+                continue;
+            const offset = match.index;
+            const prefix = file.content.slice(0, offset);
+            const line = prefix.split(/\r?\n/).length;
+            const location = {
+                filePath: file.path,
+                startLine: line,
+                endLine: line,
+                code: lines[line - 1],
+            };
+            const syntheticFinding = {
+                pattern: "express_route",
+                name: `INTERNAL_FETCH ${fullPath}`,
+                confidence: 0.8,
+                location,
+                properties: {
+                    httpMethod: "GET",
+                    url: fullPath,
+                },
+            };
+            const flow = (0, flow_builder_1.buildFlow)(sourceForFileApi.id, target.id, "api_call", syntheticFinding, ++index, sourceForFileApi, target);
+            flows.push(flow);
+        }
+    }
+    return { flows, nextIndex: index };
+}

package/dist/src/data-flow/postprocess.d.ts

@@ -0,0 +1,9 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Applies structural post-processing to raw detected data flows:
+ * - structural deduplication
+ * - rewiring actor → infra flows through the main application
+ * - ensuring at least one actor → app flow per section
+ */
+export declare function postprocessDataFlows(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];