audit-tools 0.28.0

package/dist/audit/extractors/graphManifestEdges/pnpm.d.ts

@@ -0,0 +1,10 @@
+import { WorkspacePattern } from "./workspace.js";
+/**
+ * pnpm workspace globs from `pnpm-workspace.yaml`'s top-level `packages:` list.
+ * Parsed with a vetted YAML parser (`yaml`) so both the block-sequence and
+ * inline-flow (`packages: [a, b]`) forms — and any quoting/anchoring — resolve
+ * to the same `packages` string array, instead of the prior line scanner that
+ * handled only the two it special-cased. Malformed YAML degrades to `[]`.
+ */
+export declare function pnpmWorkspacePatterns(content: string): WorkspacePattern[];
+//# sourceMappingURL=pnpm.d.ts.map

package/dist/audit/extractors/graphManifestEdges/pnpm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/pnpm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,gBAAgB,CAAC;AAGvE;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAOzE"}

package/dist/audit/extractors/graphManifestEdges/pnpm.js

@@ -0,0 +1,18 @@
+import { addWorkspacePattern } from "./workspace.js";
+import { yamlRootObject, yamlStringArray } from "./yaml.js";
+/**
+ * pnpm workspace globs from `pnpm-workspace.yaml`'s top-level `packages:` list.
+ * Parsed with a vetted YAML parser (`yaml`) so both the block-sequence and
+ * inline-flow (`packages: [a, b]`) forms — and any quoting/anchoring — resolve
+ * to the same `packages` string array, instead of the prior line scanner that
+ * handled only the two it special-cased. Malformed YAML degrades to `[]`.
+ */
+export function pnpmWorkspacePatterns(content) {
+    const root = yamlRootObject(content);
+    const patterns = [];
+    for (const pattern of yamlStringArray(root?.packages)) {
+        addWorkspacePattern(patterns, pattern);
+    }
+    return patterns;
+}
+//# sourceMappingURL=pnpm.js.map

package/dist/audit/extractors/graphManifestEdges/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/pnpm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtD,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/audit/extractors/graphManifestEdges/pyproject.d.ts

@@ -0,0 +1,4 @@
+import type { GraphEdge } from "audit-tools/shared";
+export declare const PYPROJECT_TESTPATHS_LINK_CONFIDENCE = 0.85;
+export declare function extractPyprojectTestpathLinks(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+//# sourceMappingURL=pyproject.d.ts.map

package/dist/audit/extractors/graphManifestEdges/pyproject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pyproject.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/pyproject.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIpD,eAAO,MAAM,mCAAmC,OAAO,CAAC;AAiBxD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CAgCb"}

package/dist/audit/extractors/graphManifestEdges/pyproject.js

@@ -0,0 +1,45 @@
+import { posix } from "node:path";
+import { graphEdge, normalizeGraphPath, isPyprojectPath } from "../graphPathUtils.js";
+import { parseTomlSafe, asTomlTable, tomlStringArray } from "./toml.js";
+export const PYPROJECT_TESTPATHS_LINK_CONFIDENCE = 0.85;
+/**
+ * pytest `testpaths` from `[tool.pytest.ini_options]`. Parsed with a vetted TOML
+ * parser (`smol-toml`), so the dotted-header, nested-table, and inline-table
+ * spellings all resolve to `tool.pytest.ini_options.testpaths`, and both the
+ * array (`testpaths = ["a", "b"]`) and the bare scalar (`testpaths = "tests"`)
+ * forms are handled — instead of the line scanner that matched only a literal
+ * `[tool.pytest.ini_options]` header. Malformed TOML degrades to `[]`.
+ */
+function pyprojectTestpaths(content) {
+    const tool = asTomlTable(parseTomlSafe(content).tool);
+    const pytest = asTomlTable(tool?.pytest);
+    const iniOptions = asTomlTable(pytest?.ini_options);
+    return tomlStringArray(iniOptions?.testpaths);
+}
+export function extractPyprojectTestpathLinks(fromPath, content, pathLookup) {
+    if (!isPyprojectPath(fromPath)) {
+        return [];
+    }
+    const testpaths = pyprojectTestpaths(content);
+    if (testpaths.length === 0) {
+        return [];
+    }
+    const pyprojectDir = posix.dirname(normalizeGraphPath(fromPath));
+    const edges = [];
+    for (const testpath of testpaths) {
+        const resolvedTestpath = pyprojectDir === "." ? testpath : posix.join(pyprojectDir, testpath);
+        const conftestKey = posix.join(resolvedTestpath, "conftest.py").toLowerCase();
+        const conftestTarget = pathLookup.get(conftestKey);
+        if (!conftestTarget || conftestTarget === fromPath)
+            continue;
+        edges.push(graphEdge({
+            from: fromPath,
+            to: conftestTarget,
+            kind: "pyproject-testpaths-link",
+            confidence: PYPROJECT_TESTPATHS_LINK_CONFIDENCE,
+            reason: `pyproject.toml testpaths entry '${testpath}' resolves to '${conftestTarget}'.`,
+        }));
+    }
+    return edges;
+}
+//# sourceMappingURL=pyproject.js.map

package/dist/audit/extractors/graphManifestEdges/pyproject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pyproject.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/pyproject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAExE,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAI,CAAC;AAExD;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpD,OAAO,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,gBAAgB,GACpB,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,QAAQ;YAAE,SAAS;QAE7D,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,0BAA0B;YAChC,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,mCAAmC,QAAQ,kBAAkB,cAAc,IAAI;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/extractors/graphManifestEdges/toml.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Vetted-parser TOML helpers for the manifest-edge extractors. Replaces the
+ * prior hand-rolled line scanner, which only understood `[section]` headers +
+ * single-key arrays and silently dropped dotted-key (`workspace.members = …`),
+ * inline-table (`workspace = { members = … }`), quoted-key, and multi-line
+ * string forms — dropping the dependency-graph edges those manifests declare
+ * (A5+A11). `smol-toml` is a pure-JS, TOML 1.0-compliant parser, so every
+ * spelling resolves to the same object shape.
+ *
+ * All helpers degrade to empty on malformed input: the graph builder treats a
+ * manifest it cannot parse as declaring no edges, and must never throw.
+ */
+/** Parse TOML, degrading to an empty object on malformed input (never throws). */
+export declare function parseTomlSafe(content: string): Record<string, unknown>;
+/** A nested object value (table) by key, or undefined when absent / not a table. */
+export declare function asTomlTable(value: unknown): Record<string, unknown> | undefined;
+/** The top-level TOML table for `key`, parsing `content` once. */
+export declare function tomlTable(content: string, key: string): Record<string, unknown> | undefined;
+/**
+ * Coerce a TOML value to a string[]: a string scalar → `[s]` (TOML allows a
+ * bare `testpaths = "tests"`), a string array → its string elements, anything
+ * else → `[]`. Trims and drops empties to match the prior extractor's behavior.
+ */
+export declare function tomlStringArray(value: unknown): string[];
+//# sourceMappingURL=toml.d.ts.map

package/dist/audit/extractors/graphManifestEdges/toml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/toml.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAStE;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAI/E;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAErC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAQxD"}

package/dist/audit/extractors/graphManifestEdges/toml.js

@@ -0,0 +1,49 @@
+import { parse as parseToml } from "smol-toml";
+/**
+ * Vetted-parser TOML helpers for the manifest-edge extractors. Replaces the
+ * prior hand-rolled line scanner, which only understood `[section]` headers +
+ * single-key arrays and silently dropped dotted-key (`workspace.members = …`),
+ * inline-table (`workspace = { members = … }`), quoted-key, and multi-line
+ * string forms — dropping the dependency-graph edges those manifests declare
+ * (A5+A11). `smol-toml` is a pure-JS, TOML 1.0-compliant parser, so every
+ * spelling resolves to the same object shape.
+ *
+ * All helpers degrade to empty on malformed input: the graph builder treats a
+ * manifest it cannot parse as declaring no edges, and must never throw.
+ */
+/** Parse TOML, degrading to an empty object on malformed input (never throws). */
+export function parseTomlSafe(content) {
+    try {
+        const parsed = parseToml(content);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** A nested object value (table) by key, or undefined when absent / not a table. */
+export function asTomlTable(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** The top-level TOML table for `key`, parsing `content` once. */
+export function tomlTable(content, key) {
+    return asTomlTable(parseTomlSafe(content)[key]);
+}
+/**
+ * Coerce a TOML value to a string[]: a string scalar → `[s]` (TOML allows a
+ * bare `testpaths = "tests"`), a string array → its string elements, anything
+ * else → `[]`. Trims and drops empties to match the prior extractor's behavior.
+ */
+export function tomlStringArray(value) {
+    const raw = typeof value === "string"
+        ? [value]
+        : Array.isArray(value)
+            ? value.filter((v) => typeof v === "string")
+            : [];
+    return raw.map((s) => s.trim()).filter((s) => s.length > 0);
+}
+//# sourceMappingURL=toml.js.map

package/dist/audit/extractors/graphManifestEdges/toml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/toml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/C;;;;;;;;;;;GAWG;AAEH,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CACvB,OAAe,EACf,GAAW;IAEX,OAAO,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACzD,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/audit/extractors/graphManifestEdges/typescript.d.ts

@@ -0,0 +1,4 @@
+import type { GraphEdge } from "audit-tools/shared";
+export declare const TYPESCRIPT_PROJECT_REFERENCE_EDGE_CONFIDENCE = 0.87;
+export declare function extractTypescriptProjectReferenceEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+//# sourceMappingURL=typescript.d.ts.map

package/dist/audit/extractors/graphManifestEdges/typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/typescript.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIpD,eAAO,MAAM,4CAA4C,OAAO,CAAC;AA8CjE,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CA0Bb"}

package/dist/audit/extractors/graphManifestEdges/typescript.js

@@ -0,0 +1,57 @@
+import { posix } from "node:path";
+import { graphEdge, normalizeGraphPath, resolveCandidate, isTypescriptProjectConfigPath } from "../graphPathUtils.js";
+import { parseJsoncObject } from "./jsonc.js";
+export const TYPESCRIPT_PROJECT_REFERENCE_EDGE_CONFIDENCE = 0.87;
+function typescriptProjectReferenceSpecifiers(content) {
+    const parsed = parseJsoncObject(content);
+    if (!parsed || !Array.isArray(parsed.references)) {
+        return [];
+    }
+    return parsed.references
+        .map((item) => {
+        if (item === null || typeof item !== "object" || Array.isArray(item)) {
+            return undefined;
+        }
+        const referencePath = item.path;
+        return typeof referencePath === "string" ? referencePath.trim() : undefined;
+    })
+        .filter((specifier) => Boolean(specifier));
+}
+function resolveTypescriptProjectReference(fromPath, specifier, pathLookup) {
+    const normalizedSpecifier = normalizeGraphPath(specifier);
+    if (normalizedSpecifier.length === 0 ||
+        normalizedSpecifier.startsWith("/") ||
+        /^[a-z][a-z0-9+.-]*:/i.test(normalizedSpecifier)) {
+        return undefined;
+    }
+    const configDir = posix.dirname(normalizeGraphPath(fromPath));
+    const target = configDir === "."
+        ? normalizedSpecifier
+        : posix.join(configDir, normalizedSpecifier);
+    const direct = resolveCandidate(target, pathLookup);
+    if (direct && isTypescriptProjectConfigPath(direct)) {
+        return direct;
+    }
+    return pathLookup.get(posix.join(target, "tsconfig.json").toLowerCase());
+}
+export function extractTypescriptProjectReferenceEdges(fromPath, content, pathLookup) {
+    if (!isTypescriptProjectConfigPath(fromPath)) {
+        return [];
+    }
+    const edges = [];
+    for (const specifier of typescriptProjectReferenceSpecifiers(content)) {
+        const target = resolveTypescriptProjectReference(fromPath, specifier, pathLookup);
+        if (!target) {
+            continue;
+        }
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "typescript-project-reference-link",
+            confidence: TYPESCRIPT_PROJECT_REFERENCE_EDGE_CONFIDENCE,
+            reason: `TypeScript project reference '${specifier}' resolves to '${target}'.`,
+        }));
+    }
+    return edges;
+}
+//# sourceMappingURL=typescript.js.map

package/dist/audit/extractors/graphManifestEdges/typescript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typescript.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/typescript.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACtH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;AAEjE,SAAS,oCAAoC,CAAC,OAAe;IAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,UAAU;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,aAAa,GAAI,IAAgC,CAAC,IAAI,CAAC;QAC7D,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iCAAiC,CACxC,QAAgB,EAChB,SAAiB,EACjB,UAA+B;IAE/B,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1D,IACE,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GACV,SAAS,KAAK,GAAG;QACf,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,MAAM,IAAI,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,oCAAoC,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,iCAAiC,CAC9C,QAAQ,EACR,SAAS,EACT,UAAU,CACX,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,mCAAmC;YACzC,UAAU,EAAE,4CAA4C;YACxD,MAAM,EAAE,iCAAiC,SAAS,kBAAkB,MAAM,IAAI;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/extractors/graphManifestEdges/workspace.d.ts

@@ -0,0 +1,11 @@
+export interface WorkspacePattern {
+    pattern: string;
+    negated: boolean;
+}
+export declare function addWorkspacePattern(patterns: WorkspacePattern[], rawPattern: string): void;
+export declare function collectWorkspacePatternValues(value: unknown, patterns: WorkspacePattern[]): void;
+export declare function normalizeWorkspacePattern(workspacePath: string, pattern: string): string | undefined;
+export declare function globPatternToRegExp(pattern: string): RegExp;
+export declare function workspacePatternMatchesPackage(workspacePattern: string, packagePath: string): boolean;
+export declare function workspacePatternMatchesManifest(workspacePattern: string, manifestPath: string, manifestName: string): boolean;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/audit/extractors/graphManifestEdges/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/workspace.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,UAAU,EAAE,MAAM,GACjB,IAAI,CAUN;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,gBAAgB,EAAE,GAC3B,IAAI,CAWN;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAiBpB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB3D;AAED,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,GAClB,OAAO,CAMT;AAED,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,MAAM,EACxB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT"}

package/dist/audit/extractors/graphManifestEdges/workspace.js

@@ -0,0 +1,73 @@
+import { posix } from "node:path";
+import { normalizeGraphPath } from "../graphPathUtils.js";
+export function addWorkspacePattern(patterns, rawPattern) {
+    const trimmedPattern = rawPattern.trim();
+    if (trimmedPattern.length === 0) {
+        return;
+    }
+    const negated = trimmedPattern.startsWith("!");
+    const pattern = negated ? trimmedPattern.slice(1).trim() : trimmedPattern;
+    if (pattern.length > 0) {
+        patterns.push({ pattern, negated });
+    }
+}
+export function collectWorkspacePatternValues(value, patterns) {
+    if (!Array.isArray(value)) {
+        return;
+    }
+    for (const item of value) {
+        if (typeof item !== "string") {
+            continue;
+        }
+        addWorkspacePattern(patterns, item);
+    }
+}
+export function normalizeWorkspacePattern(workspacePath, pattern) {
+    const normalizedPattern = pattern
+        .replace(/\\/g, "/")
+        .replace(/^\.\//, "")
+        .replace(/\/+$/, "");
+    if (normalizedPattern.length === 0 ||
+        normalizedPattern.startsWith("/") ||
+        /^[a-z][a-z0-9+.-]*:/i.test(normalizedPattern)) {
+        return undefined;
+    }
+    const workspaceDir = posix.dirname(normalizeGraphPath(workspacePath));
+    return workspaceDir === "."
+        ? normalizedPattern
+        : posix.join(workspaceDir, normalizedPattern);
+}
+export function globPatternToRegExp(pattern) {
+    let source = "^";
+    for (let index = 0; index < pattern.length; index++) {
+        const char = pattern[index];
+        const next = pattern[index + 1];
+        if (char === "*" && next === "*") {
+            source += ".*";
+            index++;
+        }
+        else if (char === "*") {
+            source += "[^/]*";
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+        }
+    }
+    return new RegExp(`${source}$`, "i");
+}
+export function workspacePatternMatchesPackage(workspacePattern, packagePath) {
+    return workspacePatternMatchesManifest(workspacePattern, packagePath, "package.json");
+}
+export function workspacePatternMatchesManifest(workspacePattern, manifestPath, manifestName) {
+    const normalizedManifestPath = normalizeGraphPath(manifestPath);
+    const manifestDir = posix.dirname(normalizedManifestPath);
+    const lowerManifestPattern = `/${manifestName.toLowerCase()}`;
+    const patternTarget = workspacePattern.toLowerCase().endsWith(lowerManifestPattern)
+        ? normalizedManifestPath
+        : manifestDir;
+    return globPatternToRegExp(workspacePattern).test(patternTarget);
+}
+//# sourceMappingURL=workspace.js.map

package/dist/audit/extractors/graphManifestEdges/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAO1D,MAAM,UAAU,mBAAmB,CACjC,QAA4B,EAC5B,UAAkB;IAElB,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAc,EACd,QAA4B;IAE5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,aAAqB,EACrB,OAAe;IAEf,MAAM,iBAAiB,GAAG,OAAO;SAC9B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,IACE,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAC9B,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC;QACjC,sBAAsB,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;IACtE,OAAO,YAAY,KAAK,GAAG;QACzB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC;YACf,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,OAAO,CAAC;QACpB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,MAAM,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,gBAAwB,EACxB,WAAmB;IAEnB,OAAO,+BAA+B,CACpC,gBAAgB,EAChB,WAAW,EACX,cAAc,CACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,gBAAwB,EACxB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,oBAAoB,GAAG,IAAI,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9D,MAAM,aAAa,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACjF,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,WAAW,CAAC;IAChB,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACnE,CAAC"}

package/dist/audit/extractors/graphManifestEdges/yaml.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Vetted-parser YAML helpers for the manifest-edge extractors. Replaces the
+ * prior line scanner, which understood only `key: value` / `- item` lines and a
+ * single-line flow list, silently missing block sequences nested under maps,
+ * flow collections, multi-line scalars, and anchors — dropping the path edges
+ * those YAML configs declare (A5+A11). `yaml` (eemeli) is a pure-JS,
+ * spec-compliant parser. All helpers degrade to empty on malformed input: the
+ * graph builder treats an unparseable manifest as declaring no edges, never
+ * throwing.
+ */
+/** Parse YAML, degrading to `undefined` on malformed input (never throws). */
+export declare function parseYamlSafe(content: string): unknown;
+/** The top-level object value of a parsed YAML document, or undefined. */
+export declare function yamlRootObject(content: string): Record<string, unknown> | undefined;
+/** Coerce a YAML value to a string[]: a scalar → `[s]`, a sequence → its strings. */
+export declare function yamlStringArray(value: unknown): string[];
+/**
+ * Every string SCALAR VALUE reachable in a parsed YAML value, walked depth-first
+ * through maps and sequences (map keys are not collected — only values, matching
+ * the prior extractor that read the value side of `key: value` and list items).
+ * Nested structures the line scanner could not reach are now included.
+ */
+export declare function collectYamlStringScalars(value: unknown, out?: string[]): string[];
+//# sourceMappingURL=yaml.d.ts.map

package/dist/audit/extractors/graphManifestEdges/yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/yaml.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAMtD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKnF;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAQxD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CASrF"}

package/dist/audit/extractors/graphManifestEdges/yaml.js

@@ -0,0 +1,57 @@
+import { parse as parseYaml } from "yaml";
+/**
+ * Vetted-parser YAML helpers for the manifest-edge extractors. Replaces the
+ * prior line scanner, which understood only `key: value` / `- item` lines and a
+ * single-line flow list, silently missing block sequences nested under maps,
+ * flow collections, multi-line scalars, and anchors — dropping the path edges
+ * those YAML configs declare (A5+A11). `yaml` (eemeli) is a pure-JS,
+ * spec-compliant parser. All helpers degrade to empty on malformed input: the
+ * graph builder treats an unparseable manifest as declaring no edges, never
+ * throwing.
+ */
+/** Parse YAML, degrading to `undefined` on malformed input (never throws). */
+export function parseYamlSafe(content) {
+    try {
+        return parseYaml(content);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The top-level object value of a parsed YAML document, or undefined. */
+export function yamlRootObject(content) {
+    const root = parseYamlSafe(content);
+    return root && typeof root === "object" && !Array.isArray(root)
+        ? root
+        : undefined;
+}
+/** Coerce a YAML value to a string[]: a scalar → `[s]`, a sequence → its strings. */
+export function yamlStringArray(value) {
+    const raw = typeof value === "string"
+        ? [value]
+        : Array.isArray(value)
+            ? value.filter((v) => typeof v === "string")
+            : [];
+    return raw.map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/**
+ * Every string SCALAR VALUE reachable in a parsed YAML value, walked depth-first
+ * through maps and sequences (map keys are not collected — only values, matching
+ * the prior extractor that read the value side of `key: value` and list items).
+ * Nested structures the line scanner could not reach are now included.
+ */
+export function collectYamlStringScalars(value, out = []) {
+    if (typeof value === "string") {
+        out.push(value);
+    }
+    else if (Array.isArray(value)) {
+        for (const item of value)
+            collectYamlStringScalars(item, out);
+    }
+    else if (value && typeof value === "object") {
+        for (const v of Object.values(value))
+            collectYamlStringScalars(v, out);
+    }
+    return out;
+}
+//# sourceMappingURL=yaml.js.map

package/dist/audit/extractors/graphManifestEdges/yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/yaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7D,CAAC,CAAE,IAAgC;QACnC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACzD,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,MAAgB,EAAE;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,wBAAwB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/audit/extractors/graphManifestEdges/yamlPaths.d.ts

@@ -0,0 +1,5 @@
+import type { GraphEdge } from "audit-tools/shared";
+export declare const YAML_PATH_REFERENCE_LINK_CONFIDENCE = 0.8;
+export declare const YAML_CONFIG_EXTENSIONS: readonly [".yaml", ".yml", ".json", ".toml"];
+export declare function extractYamlPathReferenceEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+//# sourceMappingURL=yamlPaths.d.ts.map

package/dist/audit/extractors/graphManifestEdges/yamlPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yamlPaths.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/yamlPaths.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAIpD,eAAO,MAAM,mCAAmC,MAAM,CAAC;AACvD,eAAO,MAAM,sBAAsB,8CAA+C,CAAC;AAoDnF,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CAwBb"}

package/dist/audit/extractors/graphManifestEdges/yamlPaths.js

@@ -0,0 +1,75 @@
+import { posix } from "node:path";
+import { graphEdge, normalizeGraphPath, resolveCandidate } from "../graphPathUtils.js";
+import { parseYamlSafe, collectYamlStringScalars } from "./yaml.js";
+export const YAML_PATH_REFERENCE_LINK_CONFIDENCE = 0.8;
+export const YAML_CONFIG_EXTENSIONS = [".yaml", ".yml", ".json", ".toml"];
+function isYamlSourcePath(path) {
+    const lower = normalizeGraphPath(path).toLowerCase();
+    return lower.endsWith(".yaml") || lower.endsWith(".yml");
+}
+function looksLikeConfigFilePath(value) {
+    if (!value.includes("/"))
+        return false;
+    if (/^[a-z][a-z0-9+.-]*:/i.test(value))
+        return false;
+    if (value.startsWith("/"))
+        return false;
+    const lower = value.toLowerCase();
+    return YAML_CONFIG_EXTENSIONS.some((ext) => lower.endsWith(ext));
+}
+/**
+ * Every config-path-looking string anywhere in the YAML document. Parsing with
+ * a vetted parser then walking ALL string scalars (vs the prior line regex that
+ * saw only top-level `key: value` and `- item` lines) recovers path references
+ * nested inside maps, block sequences, and flow collections the scanner missed.
+ */
+function extractYamlScalarValues(content) {
+    const root = parseYamlSafe(content);
+    if (root === undefined)
+        return [];
+    return collectYamlStringScalars(root)
+        .map((s) => s.trim())
+        .filter((value) => looksLikeConfigFilePath(value));
+}
+function resolveYamlPathReference(fromPath, specifier, pathLookup) {
+    const normalized = normalizeGraphPath(specifier.replace(/^\.\//, ""));
+    if (normalized.length === 0)
+        return undefined;
+    // Try as repo-root-relative first (many YAML configs use repo-root paths)
+    const repoRootTarget = resolveCandidate(normalized, pathLookup);
+    if (repoRootTarget)
+        return repoRootTarget;
+    // Fallback: relative to the YAML file's directory
+    const fromDir = posix.dirname(normalizeGraphPath(fromPath));
+    if (fromDir !== ".") {
+        const dirRelative = posix.join(fromDir, normalized);
+        const dirTarget = resolveCandidate(dirRelative, pathLookup);
+        if (dirTarget)
+            return dirTarget;
+    }
+    return undefined;
+}
+export function extractYamlPathReferenceEdges(fromPath, content, pathLookup) {
+    if (!isYamlSourcePath(fromPath))
+        return [];
+    const values = extractYamlScalarValues(content);
+    if (values.length === 0)
+        return [];
+    const edges = [];
+    const seen = new Set();
+    for (const value of values) {
+        const target = resolveYamlPathReference(fromPath, value, pathLookup);
+        if (!target || target === fromPath || seen.has(target))
+            continue;
+        seen.add(target);
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "yaml-path-reference-link",
+            confidence: YAML_PATH_REFERENCE_LINK_CONFIDENCE,
+            reason: `YAML file references path '${value}'.`,
+        }));
+    }
+    return edges;
+}
+//# sourceMappingURL=yamlPaths.js.map

package/dist/audit/extractors/graphManifestEdges/yamlPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yamlPaths.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/yamlPaths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAEpE,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAEnF,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,wBAAwB,CAAC,IAAI,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,SAAiB,EACjB,UAA+B;IAE/B,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9C,0EAA0E;IAC1E,MAAM,cAAc,GAAG,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAChE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAE1C,kDAAkD;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACjE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,0BAA0B;YAChC,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,8BAA8B,KAAK,IAAI;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/extractors/graphPathUtils.d.ts

@@ -0,0 +1,34 @@
+import type { GraphEdge } from "audit-tools/shared";
+export declare function normalizeGraphPath(path: string): string;
+export declare function graphLookupKey(path: string): string;
+export declare function resolveCandidate(candidate: string, pathLookup: Map<string, string>): string | undefined;
+export declare function graphEdge(params: GraphEdge): GraphEdge;
+/** Source file extensions the graph extractors read and reason about. */
+export declare const SOURCE_EXTENSIONS: readonly [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".json", ".html", ".htm", ".yml", ".yaml", ".py", ".pyi", ".go", ".rs", ".java", ".cs"];
+/** Matches any single/double/back-quoted string literal (bounded length). */
+export declare const STRING_LITERAL_PATTERN: RegExp;
+/** Resolve a relative import specifier to a repository path, if one exists. */
+export declare function resolveSpecifier(fromPath: string, specifier: string, pathLookup: Map<string, string>): string | undefined;
+/** Resolve a string literal (relative or repo-rooted) to a repository path. */
+export declare function resolveReferenceLiteral(fromPath: string, literal: string, pathLookup: Map<string, string>): string | undefined;
+/** True for `*.schema.json` files (JSON Schema documents). */
+export declare function isJsonSchemaPath(path: string): boolean;
+/** True for pytest `conftest.py` files. */
+export declare function isPytestConftestPath(path: string): boolean;
+/** True for `package.json` files. */
+export declare function isPackageManifestPath(path: string): boolean;
+/** True for `tsconfig.json` / `tsconfig.<name>.json` project config files. */
+export declare function isTypescriptProjectConfigPath(path: string): boolean;
+/** True for Go `go.mod` module manifests. */
+export declare function isGoModuleManifestPath(path: string): boolean;
+/** True for Go `go.work` workspace manifests. */
+export declare function isGoWorkspaceManifestPath(path: string): boolean;
+/** True for Rust `Cargo.toml` manifests. */
+export declare function isCargoManifestPath(path: string): boolean;
+/** True for Maven `pom.xml` manifests. */
+export declare function isMavenPomPath(path: string): boolean;
+/** True for Python `pyproject.toml` manifests. */
+export declare function isPyprojectPath(path: string): boolean;
+/** True for `pnpm-workspace.yaml` workspace manifests. */
+export declare function isPnpmWorkspaceManifestPath(path: string): boolean;
+//# sourceMappingURL=graphPathUtils.d.ts.map

package/dist/audit/extractors/graphPathUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphPathUtils.d.ts","sourceRoot":"","sources":["../../../src/audit/extractors/graphPathUtils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAqCpD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAmCpB;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAKtD;AAOD,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,iKAoBpB,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,QAAmC,CAAC;AAEvE,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAMpB;AAED,+EAA+E;AAC/E,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CASpB;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKtD;AAED,2CAA2C;AAC3C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAQD,qCAAqC;AACrC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMnE;AAED,6CAA6C;AAC7C,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,iDAAiD;AACjD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,4CAA4C;AAC5C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,0DAA0D;AAC1D,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKjE"}