@dataparade/cli 0.0.1

package/dist/src/data-flow/postprocess.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postprocessDataFlows = postprocessDataFlows;
+const dedupe_1 = require("./dedupe");
+const rewire_1 = require("./rewire");
+const drop_cross_section_flows_1 = require("./drop-cross-section-flows");
+const ensure_actor_flow_1 = require("./ensure-actor-flow");
+const ensure_manifest_declared_flows_1 = require("./ensure-manifest-declared-flows");
+const ensure_section_api_flows_1 = require("./ensure-section-api-flows");
+function getSectionId(component) {
+    const sid = component?.properties?.section_id;
+    return typeof sid === "string" ? sid : "";
+}
+function isMainApp(component) {
+    return (component?.type === "asset" &&
+        (component.properties?.isMainApplication === true ||
+            component.properties?.isMainApplication === "true"));
+}
+function isSectionApiNode(component) {
+    return (component?.type === "asset" &&
+        component?.subType === "api" &&
+        (component.properties?.isSectionApiNode === true ||
+            component.properties?.isSectionApiNode === "true"));
+}
+function collapseSectionApiDuplicateOutboundFlows(components, flows) {
+    const componentById = new Map(components.map((c) => [c.id, c]));
+    const hasMainOutbound = new Set();
+    for (const flow of flows) {
+        const source = componentById.get(flow.sourceComponentId);
+        if (!isMainApp(source))
+            continue;
+        const sid = getSectionId(source);
+        if (!sid)
+            continue;
+        hasMainOutbound.add(`${sid}::${flow.targetComponentId}::${flow.type}`);
+    }
+    return flows.filter((flow) => {
+        const source = componentById.get(flow.sourceComponentId);
+        if (!isSectionApiNode(source))
+            return true;
+        const sid = getSectionId(source);
+        if (!sid)
+            return true;
+        const key = `${sid}::${flow.targetComponentId}::${flow.type}`;
+        return !hasMainOutbound.has(key);
+    });
+}
+/**
+ * Applies structural post-processing to raw detected data flows:
+ * - structural deduplication
+ * - rewiring actor → infra flows through the main application
+ * - ensuring at least one actor → app flow per section
+ */
+function postprocessDataFlows(components, flows) {
+    const deduped = (0, dedupe_1.dedupeDataFlows)(flows);
+    const rewired = (0, rewire_1.rewireFlowsThroughApplication)(components, deduped);
+    const withoutApiDuplicates = collapseSectionApiDuplicateOutboundFlows(components, rewired);
+    const withActor = (0, ensure_actor_flow_1.ensureActorToAppFlow)(components, withoutApiDuplicates);
+    const withTerraform = (0, ensure_actor_flow_1.ensureInjectedProjectMainToTerraformProviderHub)(components, withActor);
+    const withManifest = (0, ensure_manifest_declared_flows_1.ensureManifestDeclaredThirdPartyFlows)(components, withTerraform);
+    const withSectionApis = (0, ensure_section_api_flows_1.ensureMainToUnlinkedSectionApiFlows)(components, withManifest);
+    return (0, drop_cross_section_flows_1.dropCrossSectionServiceFlows)(components, withSectionApis);
+}

package/dist/src/data-flow/rewire.d.ts

@@ -0,0 +1,10 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { DetectedDataFlow } from "../core/types/data-flow";
+/**
+ * Rewires data flows so that actor → (asset | third_party) edges go through the
+ * main Application node: actor → Application and Application → target.
+ * Flows that already involve the Application or are not actor→infra are unchanged.
+ * Call this after flow detection and dedupe so the emitted dataflow.json reflects
+ * the desired topology (actors → Application → databases / third parties).
+ */
+export declare function rewireFlowsThroughApplication(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];

package/dist/src/data-flow/rewire.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewireFlowsThroughApplication = rewireFlowsThroughApplication;
+const terraform_flows_1 = require("./terraform-flows");
+const application_hub_1 = require("./application-hub");
+const application_injection_1 = require("../classifier/application-injection");
+function resolveSyntheticMainTerraformEdgeTarget(componentById, components, appId, originalTargetId) {
+    const app = componentById.get(appId);
+    const target = componentById.get(originalTargetId);
+    if (!app || app.properties?.sourceContext !== application_injection_1.INJECTED_PROJECT_PLACEHOLDER_SOURCE_CONTEXT) {
+        return originalTargetId;
+    }
+    if (!target ||
+        target.type !== "asset" ||
+        typeof target.properties?.terraform_address !== "string" ||
+        !target.properties.terraform_address.trim()) {
+        return originalTargetId;
+    }
+    const prov = (0, terraform_flows_1.findTerraformProviderForResourceAsset)(components, target);
+    if (!prov || prov.id === originalTargetId)
+        return originalTargetId;
+    return prov.id;
+}
+/**
+ * Rewires data flows so that actor → (asset | third_party) edges go through the
+ * main Application node: actor → Application and Application → target.
+ * Flows that already involve the Application or are not actor→infra are unchanged.
+ * Call this after flow detection and dedupe so the emitted dataflow.json reflects
+ * the desired topology (actors → Application → databases / third parties).
+ */
+function rewireFlowsThroughApplication(components, flows) {
+    const defaultApp = (0, application_hub_1.findApplicationHubForFlows)(components);
+    if (!defaultApp)
+        return flows;
+    const componentById = new Map(components.map((c) => [c.id, c]));
+    const result = [];
+    const infraTargetsNeedingAppEdgeByAppId = new Map();
+    let syntheticIndex = 0;
+    for (const flow of flows) {
+        const sourceComp = componentById.get(flow.sourceComponentId);
+        const targetComp = componentById.get(flow.targetComponentId);
+        if (!sourceComp || !targetComp) {
+            result.push(flow);
+            continue;
+        }
+        const isActorSource = sourceComp.type === "actor";
+        const isInfraTarget = targetComp.type === "asset" || targetComp.type === "third_party";
+        if (isActorSource && isInfraTarget) {
+            // This branch becomes reachable only when actor→infra edges exist.
+            // Choose the right app for the actor's section.
+            const actorSectionId = String(sourceComp.properties?.section_id ?? "");
+            const app = (0, application_hub_1.findApplicationHubForFlows)(components, actorSectionId) ?? defaultApp;
+            if (flow.targetComponentId !== app.id) {
+                result.push({
+                    ...flow,
+                    targetComponentId: app.id,
+                });
+                const set = infraTargetsNeedingAppEdgeByAppId.get(app.id) ?? new Set();
+                set.add(flow.targetComponentId);
+                infraTargetsNeedingAppEdgeByAppId.set(app.id, set);
+            }
+            else {
+                result.push(flow);
+            }
+        }
+        else {
+            result.push(flow);
+        }
+    }
+    const existingApiCallOutKeys = new Set(result
+        .filter((f) => f.type === "api_call")
+        .map((f) => `${f.sourceComponentId}\t${f.targetComponentId}\t${f.type}`));
+    const stableInfraTargetsEntries = Array.from(infraTargetsNeedingAppEdgeByAppId.entries()).sort(([a], [b]) => a.localeCompare(b));
+    for (const [appId, targetIds] of stableInfraTargetsEntries) {
+        const stableTargetIds = Array.from(targetIds).sort((a, b) => a.localeCompare(b));
+        for (const targetId of stableTargetIds) {
+            const resolvedTargetId = resolveSyntheticMainTerraformEdgeTarget(componentById, components, appId, targetId);
+            const key = `${appId}\t${resolvedTargetId}\tapi_call`;
+            if (existingApiCallOutKeys.has(key))
+                continue;
+            existingApiCallOutKeys.add(key);
+            syntheticIndex += 1;
+            result.push({
+                id: `flow_app_${syntheticIndex}`,
+                sourceComponentId: appId,
+                targetComponentId: resolvedTargetId,
+                type: "api_call",
+                confidence: 0.8,
+            });
+        }
+    }
+    return result;
+}

package/dist/src/data-flow/source-attribution.d.ts

@@ -0,0 +1,8 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { RawFinding } from "../core/types/detection";
+import type { FileInfo } from "../core/types/file";
+/**
+ * Prefer the API route asset that owns an external call
+ * (same file, import chain, or handler binding).
+ */
+export declare function findSourceComponentForExternalApiCall(finding: RawFinding, components: DetectedComponent[], defaultSource: DetectedComponent, files: FileInfo[], importGraph: Map<string, Set<string>>, knownPaths: Set<string>): DetectedComponent;

package/dist/src/data-flow/source-attribution.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findSourceComponentForExternalApiCall = findSourceComponentForExternalApiCall;
+const main_application_selection_1 = require("../classifier/main-application-selection");
+const import_graph_1 = require("./import-graph");
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function getFileContent(files, filePath) {
+    const n = (0, import_graph_1.normalizeProjectPath)(filePath);
+    const hit = files.find((f) => (0, import_graph_1.normalizeProjectPath)(f.path) === n);
+    return hit?.content;
+}
+function getRouteRegistrationAnchor(route) {
+    if (route.sourceLocations.length === 0)
+        return undefined;
+    const byFile = new Map();
+    for (const sl of route.sourceLocations) {
+        const f = (0, import_graph_1.normalizeProjectPath)(sl.filePath);
+        const arr = byFile.get(f) ?? [];
+        arr.push(sl.startLine);
+        byFile.set(f, arr);
+    }
+    const sortedFiles = [...byFile.keys()].sort((a, b) => a.localeCompare(b));
+    const file = sortedFiles[0];
+    const lines = byFile.get(file);
+    if (!lines?.length)
+        return undefined;
+    return { file, line: Math.min(...lines) };
+}
+function routeRegistrationReferencesCallFile(route, callFile, files, knownPaths) {
+    const anchor = getRouteRegistrationAnchor(route);
+    if (!anchor)
+        return false;
+    const content = getFileContent(files, anchor.file);
+    if (!content)
+        return false;
+    const bindings = (0, import_graph_1.parseStaticImportBindings)(anchor.file, content, knownPaths);
+    const normCall = (0, import_graph_1.normalizeProjectPath)(callFile);
+    const lines = content.split(/\r?\n/);
+    const startIdx = Math.max(0, anchor.line - 1);
+    const block = lines.slice(startIdx, startIdx + 30).join("\n");
+    for (const [local, resolved] of bindings) {
+        if ((0, import_graph_1.normalizeProjectPath)(resolved) !== normCall)
+            continue;
+        const re = new RegExp(`\\b${escapeRegExp(local)}\\s*\\(`);
+        if (re.test(block))
+            return true;
+    }
+    return false;
+}
+function findRouteContainingCallLine(callFile, callLine, apiRouteAssets) {
+    const nCall = (0, import_graph_1.normalizeProjectPath)(callFile);
+    const candidates = [];
+    for (const route of apiRouteAssets) {
+        const inFileLocs = route.sourceLocations.filter((l) => (0, import_graph_1.normalizeProjectPath)(l.filePath) === nCall);
+        if (inFileLocs.length === 0)
+            continue;
+        const regLine = Math.min(...inFileLocs.map((l) => l.startLine));
+        candidates.push({ route, regLine });
+    }
+    candidates.sort((a, b) => b.regLine - a.regLine);
+    for (const c of candidates) {
+        if (c.regLine <= callLine)
+            return c.route;
+    }
+    return undefined;
+}
+function listApiRouteAssets(components, defaultSource) {
+    return components.filter((c) => {
+        if (c.type !== "asset" || c.subType !== "api")
+            return false;
+        if (c.id === defaultSource.id)
+            return false;
+        if (c.properties?.isMainApplication === true ||
+            c.properties?.isMainApplication === "true") {
+            return false;
+        }
+        // Outbound fetch/SDK calls to vendor URLs are not in-app route surfaces; if we
+        // treat them like Express routes, other calls in the same file get mis-attributed.
+        if ((0, main_application_selection_1.isOutboundExternalHttpApiAsset)(c)) {
+            return false;
+        }
+        return true;
+    });
+}
+/**
+ * Prefer the API route asset that owns an external call
+ * (same file, import chain, or handler binding).
+ */
+function findSourceComponentForExternalApiCall(finding, components, defaultSource, files, importGraph, knownPaths) {
+    const loc = finding.location;
+    if (!loc?.filePath || files.length === 0)
+        return defaultSource;
+    const callFile = (0, import_graph_1.normalizeProjectPath)(loc.filePath);
+    const callLine = typeof loc.startLine === "number" ? loc.startLine : 1;
+    const apiRouteAssets = listApiRouteAssets(components, defaultSource);
+    if (apiRouteAssets.length === 0)
+        return defaultSource;
+    const containing = findRouteContainingCallLine(callFile, callLine, apiRouteAssets);
+    if (containing)
+        return containing;
+    const scored = [];
+    for (const route of apiRouteAssets) {
+        const regFiles = [
+            ...new Set(route.sourceLocations.map((sl) => (0, import_graph_1.normalizeProjectPath)(sl.filePath))),
+        ];
+        if (regFiles.length === 0)
+            continue;
+        let best;
+        for (const reg of regFiles) {
+            const d = (0, import_graph_1.shortestImportDistance)(importGraph, reg, callFile);
+            if (d === undefined)
+                continue;
+            best = best === undefined ? d : Math.min(best, d);
+        }
+        if (best !== undefined) {
+            scored.push({ route, distance: best });
+        }
+    }
+    if (scored.length === 0)
+        return defaultSource;
+    const minD = Math.min(...scored.map((s) => s.distance));
+    const atMin = scored.filter((s) => s.distance === minD);
+    if (atMin.length === 1)
+        return atMin[0].route;
+    const referenced = atMin.filter((s) => routeRegistrationReferencesCallFile(s.route, callFile, files, knownPaths));
+    if (referenced.length === 1)
+        return referenced[0].route;
+    return defaultSource;
+}

package/dist/src/data-flow/source-resolution.d.ts

@@ -0,0 +1,13 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { RawFinding } from "../core/types/detection";
+export declare function getSectionIdFromFinding(finding: RawFinding): string | undefined;
+export declare function getSectionIdFromComponent(component: DetectedComponent): string | undefined;
+export declare function isConcreteServiceSectionId(sectionId: string | undefined): boolean;
+/**
+ * Resolves the default "caller" component (Application) for app→DB and app→TP flows.
+ * Uses asset with isMainApplication, or first asset with subType api/service.
+ * When multiple main applications exist (per section_id), selects the one
+ * matching the finding's section_id.
+ */
+export declare function findSourceComponent(components: DetectedComponent[], sectionId?: string): DetectedComponent | undefined;
+export declare function findSectionApiNode(components: DetectedComponent[], sectionId?: string): DetectedComponent | undefined;

package/dist/src/data-flow/source-resolution.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSectionIdFromFinding = getSectionIdFromFinding;
+exports.getSectionIdFromComponent = getSectionIdFromComponent;
+exports.isConcreteServiceSectionId = isConcreteServiceSectionId;
+exports.findSourceComponent = findSourceComponent;
+exports.findSectionApiNode = findSectionApiNode;
+function getSectionIdFromMaybeUnknown(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const v = raw.trim();
+    return v ? v : undefined;
+}
+function getSectionIdFromFinding(finding) {
+    return getSectionIdFromMaybeUnknown(finding.properties?.section_id);
+}
+function getSectionIdFromComponent(component) {
+    return getSectionIdFromMaybeUnknown(component.properties?.section_id);
+}
+function isConcreteServiceSectionId(sectionId) {
+    if (!sectionId)
+        return false;
+    return (sectionId !== "root" &&
+        sectionId !== "<unsectioned>" &&
+        sectionId !== "global");
+}
+/**
+ * Resolves the default "caller" component (Application) for app→DB and app→TP flows.
+ * Uses asset with isMainApplication, or first asset with subType api/service.
+ * When multiple main applications exist (per section_id), selects the one
+ * matching the finding's section_id.
+ */
+function findSourceComponent(components, sectionId) {
+    const scoped = sectionId && sectionId.trim().length > 0
+        ? components.filter((c) => getSectionIdFromComponent(c) === sectionId)
+        : components;
+    const main = scoped.find((c) => c.type === "asset" &&
+        (c.properties?.isMainApplication === true ||
+            c.properties?.isMainApplication === "true"));
+    if (main)
+        return main;
+    const apiOrService = scoped.find((c) => c.type === "asset" && (c.subType === "api" || c.subType === "service"));
+    if (apiOrService)
+        return apiOrService;
+    // Fallback to global selection when the section has no candidate.
+    const globalMain = components.find((c) => c.type === "asset" &&
+        (c.properties?.isMainApplication === true ||
+            c.properties?.isMainApplication === "true"));
+    if (globalMain)
+        return globalMain;
+    return (components.find((c) => c.type === "asset" && (c.subType === "api" || c.subType === "service")) ?? components.find((c) => c.type === "asset"));
+}
+function findSectionApiNode(components, sectionId) {
+    if (!sectionId || !sectionId.trim())
+        return undefined;
+    return components.find((c) => c.type === "asset" &&
+        c.subType === "api" &&
+        getSectionIdFromComponent(c) === sectionId &&
+        (c.properties?.isSectionApiNode === true ||
+            c.properties?.isSectionApiNode === "true"));
+}

package/dist/src/data-flow/target-matching.d.ts

@@ -0,0 +1,21 @@
+import type { DetectedComponent } from "../core/types/component";
+import type { RawFinding } from "../core/types/detection";
+/**
+ * Matches a database_connection finding to an asset component by databaseType or name.
+ */
+export declare function findTargetDatabaseComponent(finding: RawFinding, components: DetectedComponent[]): DetectedComponent | undefined;
+/**
+ * Matches an external_api_call finding to a third_party component by serviceName,
+ * URL hostname / registrable domain, client, or display name.
+ */
+export declare function findTargetThirdPartyComponent(finding: RawFinding, components: DetectedComponent[]): DetectedComponent | undefined;
+/**
+ * Matches an express_route finding to an asset component by route name (service-to-service).
+ * Excludes the main application so we don't create app→app flows.
+ */
+export declare function findTargetAssetForRoute(finding: RawFinding, components: DetectedComponent[], sourceComponent: DetectedComponent): DetectedComponent | undefined;
+export declare function findMergedHttpApiSurfaceComponent(components: DetectedComponent[], sourceComponent: DetectedComponent): DetectedComponent | undefined;
+/**
+ * Matches web_actor / service_actor finding to an actor component by name.
+ */
+export declare function findTargetActorComponent(finding: RawFinding, components: DetectedComponent[]): DetectedComponent | undefined;

package/dist/src/data-flow/target-matching.js

@@ -0,0 +1,253 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findTargetDatabaseComponent = findTargetDatabaseComponent;
+exports.findTargetThirdPartyComponent = findTargetThirdPartyComponent;
+exports.findTargetAssetForRoute = findTargetAssetForRoute;
+exports.findMergedHttpApiSurfaceComponent = findMergedHttpApiSurfaceComponent;
+exports.findTargetActorComponent = findTargetActorComponent;
+const external_url_third_party_1 = require("../classifier/external-url-third-party");
+const source_resolution_1 = require("./source-resolution");
+function normalizeKey(s) {
+    return s.trim().toLowerCase().replace(/\s+/g, " ");
+}
+/**
+ * Matches a database_connection finding to an asset component by databaseType or name.
+ */
+function findTargetDatabaseComponent(finding, components) {
+    const dbType = typeof finding.properties?.databaseType === "string"
+        ? normalizeKey(finding.properties.databaseType)
+        : "";
+    const findingName = normalizeKey(finding.name);
+    const client = typeof finding.properties?.client === "string"
+        ? normalizeKey(finding.properties.client)
+        : "";
+    const findingSectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+    // Prefer same-section matches when multiple logical DB nodes exist.
+    if (findingSectionId) {
+        for (const c of components) {
+            if (c.type !== "asset")
+                continue;
+            if ((0, source_resolution_1.getSectionIdFromComponent)(c) !== findingSectionId)
+                continue;
+            const compDbType = typeof c.properties?.databaseType === "string"
+                ? normalizeKey(c.properties.databaseType)
+                : "";
+            const compName = normalizeKey(c.name);
+            if (dbType && compDbType && dbType === compDbType)
+                return c;
+            if (findingName &&
+                compName &&
+                (findingName === compName ||
+                    compName.includes(findingName) ||
+                    findingName.includes(compName))) {
+                return c;
+            }
+            if (client &&
+                compName &&
+                (client === compName || compName.includes(client) || client.includes(compName))) {
+                return c;
+            }
+        }
+    }
+    // For concrete service sections, do not fall back across sections.
+    if ((0, source_resolution_1.isConcreteServiceSectionId)(findingSectionId)) {
+        return undefined;
+    }
+    for (const c of components) {
+        if (c.type !== "asset")
+            continue;
+        const compDbType = typeof c.properties?.databaseType === "string"
+            ? normalizeKey(c.properties.databaseType)
+            : "";
+        const compName = normalizeKey(c.name);
+        if (dbType && compDbType && dbType === compDbType)
+            return c;
+        if (findingName &&
+            compName &&
+            (findingName === compName ||
+                compName.includes(findingName) ||
+                findingName.includes(compName))) {
+            return c;
+        }
+        if (client &&
+            compName &&
+            (client === compName || compName.includes(client) || client.includes(compName))) {
+            return c;
+        }
+    }
+    return undefined;
+}
+function externalFindingUrlMatchKeys(finding) {
+    const keys = new Set();
+    const urlProp = finding.properties?.url;
+    if (typeof urlProp === "string") {
+        for (const k of (0, external_url_third_party_1.urlHostMatchKeys)(urlProp)) {
+            keys.add(normalizeKey(k));
+        }
+    }
+    if (typeof finding.name === "string" &&
+        /^https?:\/\//i.test(finding.name.trim())) {
+        for (const k of (0, external_url_third_party_1.urlHostMatchKeys)(finding.name.trim())) {
+            keys.add(normalizeKey(k));
+        }
+    }
+    return keys;
+}
+function thirdPartyComponentUrlMatchKeys(c) {
+    const keys = new Set();
+    const p = c.properties ?? {};
+    for (const field of ["url", "service_url_api_endpoint"]) {
+        const v = p[field];
+        if (typeof v !== "string")
+            continue;
+        for (const k of (0, external_url_third_party_1.urlHostMatchKeys)(v)) {
+            keys.add(normalizeKey(k));
+        }
+    }
+    return keys;
+}
+/**
+ * Matches an external_api_call finding to a third_party component by serviceName,
+ * URL hostname / registrable domain, client, or display name.
+ */
+function findTargetThirdPartyComponent(finding, components) {
+    const serviceName = typeof finding.properties?.serviceName === "string"
+        ? normalizeKey(finding.properties.serviceName)
+        : "";
+    const client = typeof finding.properties?.client === "string"
+        ? normalizeKey(finding.properties.client)
+        : "";
+    const findingName = normalizeKey(finding.name);
+    const findingUrlKeys = externalFindingUrlMatchKeys(finding);
+    const findingSectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+    if (findingSectionId) {
+        for (const c of components) {
+            if (c.type !== "third_party")
+                continue;
+            if ((0, source_resolution_1.getSectionIdFromComponent)(c) !== findingSectionId)
+                continue;
+            const compServiceName = typeof c.properties?.serviceName === "string"
+                ? normalizeKey(c.properties.serviceName)
+                : "";
+            const compName = normalizeKey(c.name);
+            if (serviceName && (compServiceName === serviceName || compName === serviceName)) {
+                return c;
+            }
+            if (client && (compServiceName === client || compName === client))
+                return c;
+            if (findingName && (compName === findingName || compServiceName === findingName)) {
+                return c;
+            }
+            if (findingUrlKeys.size > 0) {
+                const compUrlKeys = thirdPartyComponentUrlMatchKeys(c);
+                for (const fk of findingUrlKeys) {
+                    if (compUrlKeys.has(fk))
+                        return c;
+                }
+                if (compServiceName.length >= 4) {
+                    for (const fk of findingUrlKeys) {
+                        if (fk.includes(compServiceName) || compServiceName.includes(fk)) {
+                            return c;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    if ((0, source_resolution_1.isConcreteServiceSectionId)(findingSectionId)) {
+        return undefined;
+    }
+    for (const c of components) {
+        if (c.type !== "third_party")
+            continue;
+        const compServiceName = typeof c.properties?.serviceName === "string"
+            ? normalizeKey(c.properties.serviceName)
+            : "";
+        const compName = normalizeKey(c.name);
+        if (serviceName && (compServiceName === serviceName || compName === serviceName)) {
+            return c;
+        }
+        if (client && (compServiceName === client || compName === client))
+            return c;
+        if (findingName && (compName === findingName || compServiceName === findingName)) {
+            return c;
+        }
+        if (findingUrlKeys.size > 0) {
+            const compUrlKeys = thirdPartyComponentUrlMatchKeys(c);
+            for (const fk of findingUrlKeys) {
+                if (compUrlKeys.has(fk))
+                    return c;
+            }
+            if (compServiceName.length >= 4) {
+                for (const fk of findingUrlKeys) {
+                    if (fk.includes(compServiceName) || compServiceName.includes(fk)) {
+                        return c;
+                    }
+                }
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Matches an express_route finding to an asset component by route name (service-to-service).
+ * Excludes the main application so we don't create app→app flows.
+ */
+function findTargetAssetForRoute(finding, components, sourceComponent) {
+    const routeName = normalizeKey(finding.name);
+    if (!routeName || routeName === "route" || routeName === "api")
+        return undefined;
+    const findingSectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+    for (const c of components) {
+        if (c.type !== "asset" || c.id === sourceComponent.id)
+            continue;
+        if (c.properties?.isMainApplication === true ||
+            c.properties?.isMainApplication === "true") {
+            continue;
+        }
+        if (findingSectionId && (0, source_resolution_1.getSectionIdFromComponent)(c) !== findingSectionId)
+            continue;
+        const compName = normalizeKey(c.name);
+        if (compName &&
+            (compName === routeName ||
+                compName.includes(routeName) ||
+                routeName.includes(compName))) {
+            return c;
+        }
+    }
+    return undefined;
+}
+/** Classifier merges express_route findings into one asset named "HTTP API". */
+const MERGED_HTTP_API_SURFACE_NAME = "http api";
+function findMergedHttpApiSurfaceComponent(components, sourceComponent) {
+    for (const c of components) {
+        if (c.type !== "asset" || c.id === sourceComponent.id)
+            continue;
+        if (c.subType !== "api")
+            continue;
+        if (normalizeKey(c.name) === MERGED_HTTP_API_SURFACE_NAME)
+            return c;
+    }
+    return undefined;
+}
+/**
+ * Matches web_actor / service_actor finding to an actor component by name.
+ */
+function findTargetActorComponent(finding, components) {
+    const findingName = normalizeKey(finding.name);
+    const findingSectionId = (0, source_resolution_1.getSectionIdFromFinding)(finding);
+    for (const c of components) {
+        if (c.type !== "actor")
+            continue;
+        if (findingSectionId && (0, source_resolution_1.getSectionIdFromComponent)(c) !== findingSectionId)
+            continue;
+        const compName = normalizeKey(c.name);
+        if (compName &&
+            (compName === findingName ||
+                compName.includes(findingName) ||
+                findingName.includes(compName))) {
+            return c;
+        }
+    }
+    return undefined;
+}