audit-tools 0.28.0

package/dist/audit/extractors/analyzers/css.js

@@ -0,0 +1,102 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { graphEdge, normalizeGraphPath } from "../graphPathUtils.js";
+import { getTreeSitterParser } from "./treeSitter.js";
+import { resolveResourceUrl } from "./resourceUrl.js";
+const CSS_IMPORT_EDGE_CONFIDENCE = 0.9;
+const CSS_URL_EDGE_CONFIDENCE = 0.82;
+const MAX_CSS_SOURCE_BYTES = 512 * 1024;
+function supports(file) {
+    return normalizeGraphPath(file).toLowerCase().endsWith(".css");
+}
+function unquote(value) {
+    const trimmed = value.trim();
+    if (trimmed.length >= 2 &&
+        ((trimmed.startsWith('"') && trimmed.endsWith('"')) ||
+            (trimmed.startsWith("'") && trimmed.endsWith("'")))) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+/** First quoted or unquoted literal value beneath a node (string / url arg). */
+function literalValue(node) {
+    // tree-sitter-css string_value includes the surrounding quotes; plain_value
+    // (unquoted url() args) does not.
+    const value = node.descendantsOfType(["string_value", "plain_value"])[0];
+    return value ? unquote(value.text) : undefined;
+}
+function collectFileEdges(fromPath, root, pathLookup, edges) {
+    const importTargets = new Set();
+    // @import "x.css";  and  @import url("x.css");
+    for (const statement of root.descendantsOfType("import_statement")) {
+        const url = literalValue(statement);
+        if (!url)
+            continue;
+        const target = resolveResourceUrl(fromPath, url, pathLookup);
+        if (!target || target === fromPath || importTargets.has(target))
+            continue;
+        importTargets.add(target);
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "css-import",
+            confidence: CSS_IMPORT_EDGE_CONFIDENCE,
+            reason: `CSS @import references '${target}'.`,
+        }));
+    }
+    // url(...) references in declarations (background images, fonts, …).
+    const seenUrls = new Set(importTargets);
+    for (const call of root.descendantsOfType("call_expression")) {
+        if (!/^\s*url\s*\(/i.test(call.text))
+            continue;
+        const url = literalValue(call);
+        if (!url)
+            continue;
+        const target = resolveResourceUrl(fromPath, url, pathLookup);
+        if (!target || target === fromPath || seenUrls.has(target))
+            continue;
+        seenUrls.add(target);
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "css-url",
+            confidence: CSS_URL_EDGE_CONFIDENCE,
+            reason: `CSS url() references '${target}'.`,
+        }));
+    }
+}
+async function analyze(files, context) {
+    if (files.length === 0)
+        return { edges: [] };
+    const parser = await getTreeSitterParser("css", context.dependencyPath);
+    if (!parser)
+        return { edges: [] };
+    const root = resolve(context.root);
+    const edges = [];
+    for (const file of files) {
+        let content;
+        try {
+            content = await readFile(resolve(root, file), "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (content.length > MAX_CSS_SOURCE_BYTES)
+            continue;
+        try {
+            const tree = parser.parse(content);
+            collectFileEdges(normalizeGraphPath(file), tree.rootNode, context.pathLookup, edges);
+        }
+        catch (e) {
+            process.stderr.write(`[audit-code] css-analyzer: parse failed for '${file}': ${e.message ?? String(e)}\n`);
+        }
+    }
+    return { edges };
+}
+export const cssAnalyzer = {
+    id: "css",
+    dependency: "web-tree-sitter",
+    supports,
+    analyze,
+};
+//# sourceMappingURL=css.js.map

package/dist/audit/extractors/analyzers/css.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"css.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/css.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAe,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AAExC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IACE,OAAO,CAAC,MAAM,IAAI,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EACrD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,IAAY;IAChC,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,IAAY,EACZ,UAA+B,EAC/B,KAAkB;IAElB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,+CAA+C;IAC/C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1E,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,0BAA0B;YACtC,MAAM,EAAE,2BAA2B,MAAM,IAAI;SAC9C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACrE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,uBAAuB;YACnC,MAAM,EAAE,yBAAyB,MAAM,IAAI;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAe,EACf,OAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB;YAAE,SAAS;QACpD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,gBAAgB,CACd,kBAAkB,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,UAAU,EAClB,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,IAAI,MAAO,CAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAqB;IAC3C,EAAE,EAAE,KAAK;IACT,UAAU,EAAE,iBAAiB;IAC7B,QAAQ;IACR,OAAO;CACR,CAAC"}

package/dist/audit/extractors/analyzers/html.d.ts

@@ -0,0 +1,3 @@
+import type { LanguageAnalyzer } from "./types.js";
+export declare const htmlAnalyzer: LanguageAnalyzer;
+//# sourceMappingURL=html.d.ts.map

package/dist/audit/extractors/analyzers/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/html.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAmC,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAgGpF,eAAO,MAAM,YAAY,EAAE,gBAK1B,CAAC"}

package/dist/audit/extractors/analyzers/html.js

@@ -0,0 +1,93 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { graphEdge, normalizeGraphPath } from "../graphPathUtils.js";
+import { getTreeSitterParser } from "./treeSitter.js";
+import { resolveResourceUrl } from "./resourceUrl.js";
+// Above the regex floor's html-resource-link so the merge prefers the parsed
+// edge for the same (from, to).
+const HTML_RESOURCE_EDGE_CONFIDENCE = 0.96;
+const MAX_HTML_SOURCE_BYTES = 512 * 1024;
+const HTML_EXTENSIONS = [".html", ".htm"];
+// tag → the attribute carrying its resource reference.
+const RESOURCE_ATTRIBUTE = {
+    script: "src",
+    link: "href",
+    img: "src",
+};
+function supports(file) {
+    const lower = normalizeGraphPath(file).toLowerCase();
+    return HTML_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
+function attributeValue(tag, name) {
+    for (const attribute of tag.descendantsOfType("attribute")) {
+        const attributeName = attribute
+            .descendantsOfType("attribute_name")[0]
+            ?.text?.toLowerCase();
+        if (attributeName !== name)
+            continue;
+        const value = attribute.descendantsOfType("attribute_value")[0]?.text;
+        if (value && value.trim().length > 0)
+            return value;
+    }
+    return undefined;
+}
+function collectFileEdges(fromPath, root, pathLookup, edges) {
+    const seen = new Set();
+    for (const tag of root.descendantsOfType("start_tag")) {
+        const tagName = tag.descendantsOfType("tag_name")[0]?.text?.toLowerCase();
+        if (!tagName)
+            continue;
+        const attribute = RESOURCE_ATTRIBUTE[tagName];
+        if (!attribute)
+            continue;
+        const url = attributeValue(tag, attribute);
+        if (!url)
+            continue;
+        const target = resolveResourceUrl(fromPath, url, pathLookup);
+        if (!target || target === fromPath || seen.has(target))
+            continue;
+        seen.add(target);
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "html-resource",
+            confidence: HTML_RESOURCE_EDGE_CONFIDENCE,
+            reason: `HTML <${tagName} ${attribute}> references '${target}'.`,
+        }));
+    }
+}
+async function analyze(files, context) {
+    if (files.length === 0)
+        return { edges: [] };
+    const parser = await getTreeSitterParser("html", context.dependencyPath);
+    if (!parser)
+        return { edges: [] };
+    const root = resolve(context.root);
+    const edges = [];
+    for (const file of files) {
+        let content;
+        try {
+            content = await readFile(resolve(root, file), "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (content.length > MAX_HTML_SOURCE_BYTES)
+            continue;
+        try {
+            const tree = parser.parse(content);
+            collectFileEdges(normalizeGraphPath(file), tree.rootNode, context.pathLookup, edges);
+        }
+        catch (e) {
+            process.stderr.write(`[audit-code] html-analyzer: parse failed for '${file}': ${e.message ?? String(e)}\n`);
+        }
+    }
+    return { edges };
+}
+export const htmlAnalyzer = {
+    id: "html",
+    dependency: "web-tree-sitter",
+    supports,
+    analyze,
+};
+//# sourceMappingURL=html.js.map

package/dist/audit/extractors/analyzers/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAe,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,6EAA6E;AAC7E,gCAAgC;AAChC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC;AACzC,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAEnD,uDAAuD;AACvD,MAAM,kBAAkB,GAA2B;IACjD,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,IAAY;IAC/C,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,aAAa,GAAG,SAAS;aAC5B,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACvC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxB,IAAI,aAAa,KAAK,IAAI;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACtE,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,IAAY,EACZ,UAA+B,EAC/B,KAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACjE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,6BAA6B;YACzC,MAAM,EAAE,SAAS,OAAO,IAAI,SAAS,iBAAiB,MAAM,IAAI;SACjE,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAe,EACf,OAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB;YAAE,SAAS;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,gBAAgB,CACd,kBAAkB,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,UAAU,EAClB,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,MAAO,CAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAqB;IAC5C,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,iBAAiB;IAC7B,QAAQ;IACR,OAAO;CACR,CAAC"}

package/dist/audit/extractors/analyzers/merge.d.ts

@@ -0,0 +1,15 @@
+import type { GraphEdge } from "audit-tools/shared";
+export declare const TS_IMPORT_EDGE_CONFIDENCE = 0.99;
+export declare const TS_REEXPORT_EDGE_CONFIDENCE = 0.99;
+export declare const TS_EXTENDS_EDGE_CONFIDENCE = 0.97;
+export declare const TS_IMPLEMENTS_EDGE_CONFIDENCE = 0.97;
+export declare const TS_CALL_EDGE_CONFIDENCE = 0.9;
+/**
+ * Merge analyzer edges into an existing floor bucket (e.g. `graphs.imports`).
+ * Within a known relationship group, edges sharing (from, to) collapse to the
+ * highest-confidence one (ties favour the later/analyzer edge); ungrouped kinds
+ * keep their per-kind identity. Self-edges are dropped. Result is deduped and
+ * sorted, matching the floor's ordering contract.
+ */
+export declare function mergeAnalyzerEdges(floor: GraphEdge[], analyzer: GraphEdge[]): GraphEdge[];
+//# sourceMappingURL=merge.d.ts.map

package/dist/audit/extractors/analyzers/merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAKpD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAClD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AA6D3C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,EAAE,EAClB,QAAQ,EAAE,SAAS,EAAE,GACpB,SAAS,EAAE,CAmBb"}

package/dist/audit/extractors/analyzers/merge.js

@@ -0,0 +1,86 @@
+// Analyzer edge confidences are set above their regex-floor counterparts so the
+// group-aware merge below prefers the compiler-derived edge for the same
+// (from, to) relationship. Floor import kinds sit at 0.95 (see graph.ts).
+export const TS_IMPORT_EDGE_CONFIDENCE = 0.99;
+export const TS_REEXPORT_EDGE_CONFIDENCE = 0.99;
+export const TS_EXTENDS_EDGE_CONFIDENCE = 0.97;
+export const TS_IMPLEMENTS_EDGE_CONFIDENCE = 0.97;
+export const TS_CALL_EDGE_CONFIDENCE = 0.9;
+/**
+ * Kinds that represent the same underlying relationship collapse together during
+ * a merge (highest confidence wins). Kinds with no group keep their distinct
+ * (from, to, kind) identity — so floor-only relationships such as
+ * `heuristic-container-edge` or `heuristic-auth-session-link` are never dropped
+ * by an analyzer that happens to connect the same two nodes a different way.
+ */
+const EDGE_GROUP = {
+    // import relationship
+    esm: "import",
+    "re-export": "import",
+    "dynamic-import": "import",
+    commonjs: "import",
+    "ts-import": "import",
+    "ts-reexport": "import",
+    // Python imports: the tree-sitter analyzer (py-*) supersedes the regex floor
+    // (python-*) for the same (from, to).
+    "python-import": "import",
+    "python-from-import": "import",
+    "py-import": "import",
+    "py-from-import": "import",
+    // HTML resource references: the tree-sitter analyzer (html-resource)
+    // supersedes the regex floor (html-resource-link).
+    "html-resource-link": "html-resource",
+    "html-resource": "html-resource",
+    // inheritance relationship
+    "ts-extends": "inheritance",
+    "ts-implements": "inheritance",
+    // call relationship
+    "ts-call": "call",
+};
+function edgeGroupOf(edge) {
+    return edge.kind ? EDGE_GROUP[edge.kind] : undefined;
+}
+function confidenceOf(edge) {
+    return typeof edge.confidence === "number" && Number.isFinite(edge.confidence)
+        ? edge.confidence
+        : 0;
+}
+function groupedKey(edge, group) {
+    return `${edge.from}\0${edge.to}\0${group}`;
+}
+function ungroupedKey(edge) {
+    return `${edge.from}\0${edge.to}\0${edge.kind ?? ""}`;
+}
+function sortEdges(edges) {
+    return edges.sort((a, b) => a.from.localeCompare(b.from) ||
+        a.to.localeCompare(b.to) ||
+        (a.kind ?? "").localeCompare(b.kind ?? ""));
+}
+/**
+ * Merge analyzer edges into an existing floor bucket (e.g. `graphs.imports`).
+ * Within a known relationship group, edges sharing (from, to) collapse to the
+ * highest-confidence one (ties favour the later/analyzer edge); ungrouped kinds
+ * keep their per-kind identity. Self-edges are dropped. Result is deduped and
+ * sorted, matching the floor's ordering contract.
+ */
+export function mergeAnalyzerEdges(floor, analyzer) {
+    const grouped = new Map();
+    const ungrouped = new Map();
+    for (const edge of [...floor, ...analyzer]) {
+        if (edge.from === edge.to)
+            continue;
+        const group = edgeGroupOf(edge);
+        if (group) {
+            const key = groupedKey(edge, group);
+            const existing = grouped.get(key);
+            if (!existing || confidenceOf(edge) >= confidenceOf(existing)) {
+                grouped.set(key, edge);
+            }
+        }
+        else {
+            ungrouped.set(ungroupedKey(edge), edge);
+        }
+    }
+    return sortEdges([...grouped.values(), ...ungrouped.values()]);
+}
+//# sourceMappingURL=merge.js.map

package/dist/audit/extractors/analyzers/merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/merge.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,GAA2B;IACzC,sBAAsB;IACtB,GAAG,EAAE,QAAQ;IACb,WAAW,EAAE,QAAQ;IACrB,gBAAgB,EAAE,QAAQ;IAC1B,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,QAAQ;IACrB,aAAa,EAAE,QAAQ;IACvB,6EAA6E;IAC7E,sCAAsC;IACtC,eAAe,EAAE,QAAQ;IACzB,oBAAoB,EAAE,QAAQ;IAC9B,WAAW,EAAE,QAAQ;IACrB,gBAAgB,EAAE,QAAQ;IAC1B,qEAAqE;IACrE,mDAAmD;IACnD,oBAAoB,EAAE,eAAe;IACrC,eAAe,EAAE,eAAe;IAChC,2BAA2B;IAC3B,YAAY,EAAE,aAAa;IAC3B,eAAe,EAAE,aAAa;IAC9B,oBAAoB;IACpB,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF,SAAS,WAAW,CAAC,IAAe;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,IAAe;IACnC,OAAO,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5E,CAAC,CAAC,IAAI,CAAC,UAAU;QACjB,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,UAAU,CAAC,IAAe,EAAE,KAAa;IAChD,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,IAAe;IACnC,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB;IACnC,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAkB,EAClB,QAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/audit/extractors/analyzers/python.d.ts

@@ -0,0 +1,3 @@
+import type { LanguageAnalyzer } from "./types.js";
+export declare const pythonAnalyzer: LanguageAnalyzer;
+//# sourceMappingURL=python.d.ts.map

package/dist/audit/extractors/analyzers/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/python.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAmC,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA0HpF,eAAO,MAAM,cAAc,EAAE,gBAK5B,CAAC"}

package/dist/audit/extractors/analyzers/python.js

@@ -0,0 +1,105 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { graphEdge, normalizeGraphPath } from "../graphPathUtils.js";
+import { isPythonSourcePath, resolvePythonFromImportTargets, resolvePythonImportTarget, } from "../graphPythonImports.js";
+import { getTreeSitterParser } from "./treeSitter.js";
+// Set above the regex floor's 0.95 so the merge prefers the AST-resolved edge
+// for the same (from, to). Resolution itself is shared with the floor, so the
+// only difference is parse-grade extraction.
+const PY_IMPORT_EDGE_CONFIDENCE = 0.97;
+const MAX_PYTHON_SOURCE_BYTES = 512 * 1024;
+function supports(file) {
+    return isPythonSourcePath(file);
+}
+/** The bare module text for one `import` name (unwrapping `x.y as z`). */
+function importModuleText(nameNode) {
+    const moduleNode = nameNode.type === "aliased_import"
+        ? nameNode.childForFieldName("name")
+        : nameNode;
+    const text = moduleNode?.text?.trim();
+    return text && text.length > 0 ? text : undefined;
+}
+function collectFileEdges(fromPath, root, pathLookup, edges) {
+    const seen = new Set();
+    const push = (target, kind, specifier) => {
+        if (target === fromPath)
+            return;
+        const key = `${kind}\0${target}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind,
+            confidence: PY_IMPORT_EDGE_CONFIDENCE,
+            reason: `tree-sitter resolved Python import '${specifier}' to '${target}'.`,
+        }));
+    };
+    for (const node of root.descendantsOfType("import_statement")) {
+        for (const nameNode of childrenForField(node, "name")) {
+            const specifier = importModuleText(nameNode);
+            if (!specifier)
+                continue;
+            const target = resolvePythonImportTarget(fromPath, specifier, pathLookup);
+            if (target)
+                push(target, "py-import", specifier);
+        }
+    }
+    for (const node of root.descendantsOfType("import_from_statement")) {
+        const moduleNode = node.childForFieldName("module_name");
+        const moduleSpecifier = moduleNode?.text?.trim();
+        if (!moduleSpecifier)
+            continue;
+        const importedNames = childrenForField(node, "name")
+            .map((nameNode) => importModuleText(nameNode))
+            .filter((name) => Boolean(name));
+        for (const { specifier, target } of resolvePythonFromImportTargets(fromPath, moduleSpecifier, importedNames, pathLookup)) {
+            push(target, "py-from-import", specifier);
+        }
+    }
+}
+/** web-tree-sitter Node#childrenForFieldName, guarded for older runtimes. */
+function childrenForField(node, field) {
+    const fn = node.childrenForFieldName;
+    if (typeof fn === "function") {
+        return fn.call(node, field) ?? [];
+    }
+    const single = node.childForFieldName(field);
+    return single ? [single] : [];
+}
+async function analyze(files, context) {
+    if (files.length === 0)
+        return { edges: [] };
+    const parser = await getTreeSitterParser("python", context.dependencyPath);
+    if (!parser)
+        return { edges: [] };
+    const root = resolve(context.root);
+    const edges = [];
+    for (const file of files) {
+        let content;
+        try {
+            content = await readFile(resolve(root, file), "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (content.length > MAX_PYTHON_SOURCE_BYTES)
+            continue;
+        try {
+            const tree = parser.parse(content);
+            collectFileEdges(normalizeGraphPath(file), tree.rootNode, context.pathLookup, edges);
+        }
+        catch (e) {
+            process.stderr.write(`[audit-code] python-analyzer: parse failed for '${file}': ${e.message ?? String(e)}\n`);
+        }
+    }
+    return { edges };
+}
+export const pythonAnalyzer = {
+    id: "python",
+    dependency: "web-tree-sitter",
+    supports,
+    analyze,
+};
+//# sourceMappingURL=python.js.map

package/dist/audit/extractors/analyzers/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/python.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAe,MAAM,iBAAiB,CAAC;AAEnE,8EAA8E;AAC9E,8EAA8E;AAC9E,6CAA6C;AAC7C,MAAM,yBAAyB,GAAG,IAAI,CAAC;AACvC,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE3C,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,KAAK,gBAAgB;QAChC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,QAAQ,CAAC;IACf,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,IAAY,EACZ,UAA+B,EAC/B,KAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CACX,MAAc,EACd,IAAoC,EACpC,SAAiB,EACX,EAAE;QACR,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO;QAChC,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI;YACJ,UAAU,EAAE,yBAAyB;YACrC,MAAM,EAAE,uCAAuC,SAAS,SAAS,MAAM,IAAI;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YAC1E,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe;YAAE,SAAS;QAC/B,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC;aACjD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;aAC7C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,KAAK,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,8BAA8B,CAChE,QAAQ,EACR,eAAe,EACf,aAAa,EACb,UAAU,CACX,EAAE,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,MAAM,EAAE,GAAI,IAEV,CAAC,oBAAoB,CAAC;IACxB,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAe,EACf,OAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB;YAAE,SAAS;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,gBAAgB,CACd,kBAAkB,CAAC,IAAI,CAAC,EACxB,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,UAAU,EAClB,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,IAAI,MAAO,CAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAqB;IAC9C,EAAE,EAAE,QAAQ;IACZ,UAAU,EAAE,iBAAiB;IAC7B,QAAQ;IACR,OAAO;CACR,CAAC"}

package/dist/audit/extractors/analyzers/registry.d.ts

@@ -0,0 +1,34 @@
+import { type AnalyzerSetting } from "audit-tools/shared";
+import type { AnalyzerPlanEntry, LanguageAnalyzer } from "./types.js";
+/**
+ * Registered language analyzers, in within-phase order (seam → TS/JS →
+ * Python → HTML → CSS). SQL is a registry stub (recognises `.sql`, emits no
+ * edges yet). The tree-sitter analyzers (Python/HTML/CSS) load their grammar
+ * from the optional `web-tree-sitter` dependency and degrade to the regex
+ * floor when it cannot be resolved.
+ */
+export declare const ANALYZER_REGISTRY: LanguageAnalyzer[];
+export declare function getAnalyzerById(id: string): LanguageAnalyzer | undefined;
+/**
+ * Deterministically resolve, without installing anything, how each registered
+ * analyzer would run for this repo. The conversation-first CLI uses this to
+ * decide whether to propose an install before the enrichment executor runs.
+ *
+ * Resolution rules:
+ *  - 0 supported in-scope files            → `not_applicable`
+ *  - setting `skip`                         → `skip`
+ *  - dependency resolves (repo|cache)       → `repo` | `cache`
+ *  - dependency absent                      → `absent` (executor installs only
+ *    for `ephemeral`/`permanent`; `auto` may prompt; `repo` falls to the floor)
+ */
+export declare function resolveAnalyzerPlan(root: string, analyzers: Record<string, AnalyzerSetting> | undefined, includedFiles: string[], options?: {
+    cacheRoot?: string;
+}): AnalyzerPlanEntry[];
+/**
+ * A plan entry whose dependency is absent and whose setting is `auto` (or unset)
+ * with in-scope files — the only case that warrants proposing an install in the
+ * conversation-first flow. (ephemeral/permanent install silently; repo/skip fall
+ * to the floor silently.)
+ */
+export declare function needsInstallDecision(entry: AnalyzerPlanEntry): boolean;
+//# sourceMappingURL=registry.d.ts.map

package/dist/audit/extractors/analyzers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAOtE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,gBAAgB,EAM/C,CAAC;AAEF,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAExE;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,EACtD,aAAa,EAAE,MAAM,EAAE,EACvB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,iBAAiB,EAAE,CAyBrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAEtE"}

package/dist/audit/extractors/analyzers/registry.js

@@ -0,0 +1,82 @@
+import { resolveAnalyzerDep, } from "audit-tools/shared";
+import { typescriptAnalyzer } from "./typescript.js";
+import { pythonAnalyzer } from "./python.js";
+import { htmlAnalyzer } from "./html.js";
+import { cssAnalyzer } from "./css.js";
+import { sqlAnalyzer } from "./sql.js";
+/**
+ * Registered language analyzers, in within-phase order (seam → TS/JS →
+ * Python → HTML → CSS). SQL is a registry stub (recognises `.sql`, emits no
+ * edges yet). The tree-sitter analyzers (Python/HTML/CSS) load their grammar
+ * from the optional `web-tree-sitter` dependency and degrade to the regex
+ * floor when it cannot be resolved.
+ */
+export const ANALYZER_REGISTRY = [
+    typescriptAnalyzer,
+    pythonAnalyzer,
+    htmlAnalyzer,
+    cssAnalyzer,
+    sqlAnalyzer,
+];
+export function getAnalyzerById(id) {
+    return ANALYZER_REGISTRY.find((analyzer) => analyzer.id === id);
+}
+function settingFor(analyzers, id) {
+    return analyzers?.[id] ?? "auto";
+}
+function makeEntry(analyzer, setting, supportedCount, resolution, path) {
+    const entry = {
+        id: analyzer.id,
+        dependency: analyzer.dependency,
+        setting,
+        resolution,
+        supportedCount,
+    };
+    if (path !== undefined)
+        entry.path = path;
+    return entry;
+}
+/**
+ * Deterministically resolve, without installing anything, how each registered
+ * analyzer would run for this repo. The conversation-first CLI uses this to
+ * decide whether to propose an install before the enrichment executor runs.
+ *
+ * Resolution rules:
+ *  - 0 supported in-scope files            → `not_applicable`
+ *  - setting `skip`                         → `skip`
+ *  - dependency resolves (repo|cache)       → `repo` | `cache`
+ *  - dependency absent                      → `absent` (executor installs only
+ *    for `ephemeral`/`permanent`; `auto` may prompt; `repo` falls to the floor)
+ */
+export function resolveAnalyzerPlan(root, analyzers, includedFiles, options = {}) {
+    const depOptions = options.cacheRoot ? { cacheRoot: options.cacheRoot } : {};
+    return ANALYZER_REGISTRY.map((analyzer) => {
+        const setting = settingFor(analyzers, analyzer.id);
+        const supportedCount = includedFiles.filter((file) => analyzer.supports(file)).length;
+        if (supportedCount === 0) {
+            return makeEntry(analyzer, setting, supportedCount, "not_applicable");
+        }
+        if (setting === "skip") {
+            return makeEntry(analyzer, setting, supportedCount, "skip");
+        }
+        if (!analyzer.dependency) {
+            // No dependency required: always available.
+            return makeEntry(analyzer, setting, supportedCount, "repo");
+        }
+        const resolved = resolveAnalyzerDep(analyzer.dependency, root, depOptions);
+        if (resolved.via === "repo" || resolved.via === "cache") {
+            return makeEntry(analyzer, setting, supportedCount, resolved.via, resolved.path);
+        }
+        return makeEntry(analyzer, setting, supportedCount, "absent");
+    });
+}
+/**
+ * A plan entry whose dependency is absent and whose setting is `auto` (or unset)
+ * with in-scope files — the only case that warrants proposing an install in the
+ * conversation-first flow. (ephemeral/permanent install silently; repo/skip fall
+ * to the floor silently.)
+ */
+export function needsInstallDecision(entry) {
+    return entry.resolution === "absent" && entry.setting === "auto";
+}
+//# sourceMappingURL=registry.js.map

package/dist/audit/extractors/analyzers/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuB;IACnD,kBAAkB;IAClB,cAAc;IACd,YAAY;IACZ,WAAW;IACX,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CACjB,SAAsD,EACtD,EAAU;IAEV,OAAO,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAChB,QAA0B,EAC1B,OAAwB,EACxB,cAAsB,EACtB,UAA2C,EAC3C,IAAa;IAEb,MAAM,KAAK,GAAsB;QAC/B,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;QACP,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,SAAsD,EACtD,aAAuB,EACvB,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CACxB,CAAC,MAAM,CAAC;QAET,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzB,4CAA4C;YAC5C,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,GAAG,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACxD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC;AACnE,CAAC"}

package/dist/audit/extractors/analyzers/resourceUrl.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve an HTML/CSS resource reference (script src, link href, @import, url())
+ * to a repo-relative file path, or undefined. Root-relative URLs ("/assets/x")
+ * resolve from the repo root; everything else is relative to the referencing
+ * file. Query strings and fragments are stripped before resolution.
+ */
+export declare function resolveResourceUrl(fromPath: string, url: string, pathLookup: Map<string, string>): string | undefined;
+//# sourceMappingURL=resourceUrl.d.ts.map

package/dist/audit/extractors/analyzers/resourceUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceUrl.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/resourceUrl.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAapB"}

package/dist/audit/extractors/analyzers/resourceUrl.js

@@ -0,0 +1,26 @@
+import { posix } from "node:path";
+import { normalizeGraphPath, resolveCandidate } from "../graphPathUtils.js";
+// Protocol (http:, data:, mailto:, …), protocol-relative (//), and fragment (#)
+// URLs point outside the repository and are never resolved to a local file.
+const EXTERNAL_URL_PATTERN = /^(?:[a-z][a-z0-9+.-]*:|\/\/|#)/i;
+/**
+ * Resolve an HTML/CSS resource reference (script src, link href, @import, url())
+ * to a repo-relative file path, or undefined. Root-relative URLs ("/assets/x")
+ * resolve from the repo root; everything else is relative to the referencing
+ * file. Query strings and fragments are stripped before resolution.
+ */
+export function resolveResourceUrl(fromPath, url, pathLookup) {
+    const trimmed = url.trim();
+    if (trimmed.length === 0 || EXTERNAL_URL_PATTERN.test(trimmed)) {
+        return undefined;
+    }
+    const withoutQuery = trimmed.split(/[?#]/, 1)[0] ?? "";
+    if (withoutQuery.length === 0) {
+        return undefined;
+    }
+    const candidate = withoutQuery.startsWith("/")
+        ? withoutQuery.slice(1)
+        : posix.join(posix.dirname(normalizeGraphPath(fromPath)), withoutQuery);
+    return resolveCandidate(candidate, pathLookup);
+}
+//# sourceMappingURL=resourceUrl.js.map

package/dist/audit/extractors/analyzers/resourceUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceUrl.js","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/resourceUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE5E,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,GAAW,EACX,UAA+B;IAE/B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5C,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,OAAO,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC"}

package/dist/audit/extractors/analyzers/sql.d.ts

@@ -0,0 +1,3 @@
+import type { LanguageAnalyzer } from "./types.js";
+export declare const sqlAnalyzer: LanguageAnalyzer;
+//# sourceMappingURL=sql.d.ts.map

package/dist/audit/extractors/analyzers/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/analyzers/sql.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAoBpB,eAAO,MAAM,WAAW,EAAE,gBAIzB,CAAC"}