auditor-lambda 0.3.40 → 0.5.0

package/dist/extractors/graph.js

@@ -1,10 +1,11 @@
 import { readFile } from "node:fs/promises";
 import { isAbsolute, relative, resolve } from "node:path";
 import { posix } from "node:path";
-import { isAuditExcludedStatus } from "./disposition.js";
+import { buildDispositionMap, isAuditExcludedStatus } from "./disposition.js";
 import { extractChromeExtensionManifestEdges, extractHtmlResourceEdges, } from "./browserExtension.js";
 import { extractCargoWorkspaceMemberEdges, extractGoWorkspaceModuleEdges, extractMavenModuleEdges, extractPackageEntrypointEdges, extractPackageScriptEdges, extractPyprojectTestpathLinks, extractTypescriptProjectReferenceEdges, extractWorkspacePackageEdges, extractYamlPathReferenceEdges, isCargoManifestPath, isGoWorkspaceManifestPath, isMavenPomPath, isPyprojectPath, } from "./graphManifestEdges.js";
 import { graphEdge, graphLookupKey, normalizeGraphPath, resolveCandidate, } from "./graphPathUtils.js";
+import { extractPythonImportEdges, isPythonSourcePath, } from "./graphPythonImports.js";
 import { isTestPath, normalizeExtractorPath } from "./pathPatterns.js";
 const MAX_GRAPH_SOURCE_BYTES = 512 * 1024;
 const SOURCE_LANGUAGES = new Set([
@@ -40,8 +41,6 @@ const SOURCE_EXTENSIONS = [
     ".java",
     ".cs",
 ];
-const PYTHON_SOURCE_EXTENSIONS = [".py", ".pyi"];
-const PYTHON_PACKAGE_INDEX_FILES = ["__init__.py", "__init__.pyi"];
 const TYPESCRIPT_TYPE_CONTRACT_EXTENSIONS = [
     ".ts",
     ".tsx",
@@ -135,7 +134,7 @@ function shouldReadForGraph(file) {
             isMavenPomPath(normalized) ||
             isPyprojectPath(normalized)));
 }
-function buildPathLookup(repoManifest, dispositionMap) {
+export function buildPathLookup(repoManifest, dispositionMap) {
     return new Map(repoManifest.files
         .filter((file) => {
         const status = dispositionMap.get(file.path);
@@ -339,327 +338,6 @@ function extractImportBindings(fromPath, content, pathLookup) {
     }
     return bindings;
 }
-function isPythonSourcePath(path) {
-    const normalized = normalizeGraphPath(path).toLowerCase();
-    return PYTHON_SOURCE_EXTENSIONS.some((extension) => normalized.endsWith(extension));
-}
-function stripPythonLineComment(line) {
-    let quote;
-    let escaped = false;
-    for (let index = 0; index < line.length; index++) {
-        const char = line[index];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            if (char === "\\") {
-                escaped = true;
-                continue;
-            }
-            if (char === quote) {
-                quote = undefined;
-            }
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        if (char === "#") {
-            return line.slice(0, index);
-        }
-    }
-    return line;
-}
-function pythonParenDelta(line) {
-    let quote;
-    let escaped = false;
-    let delta = 0;
-    for (const char of line) {
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            if (char === "\\") {
-                escaped = true;
-                continue;
-            }
-            if (char === quote) {
-                quote = undefined;
-            }
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            quote = char;
-            continue;
-        }
-        if (char === "(") {
-            delta += 1;
-        }
-        else if (char === ")") {
-            delta -= 1;
-        }
-    }
-    return delta;
-}
-function pythonLogicalLines(content) {
-    const logicalLines = [];
-    let pending = "";
-    let parenDepth = 0;
-    for (const rawLine of content.split(/\r?\n/)) {
-        const stripped = stripPythonLineComment(rawLine).trim();
-        if (stripped.length === 0) {
-            continue;
-        }
-        if (pending.length === 0 && !/^(?:import|from)\s+/i.test(stripped)) {
-            continue;
-        }
-        const continued = stripped.endsWith("\\");
-        const line = continued ? stripped.slice(0, -1).trimEnd() : stripped;
-        pending = pending.length > 0 ? `${pending} ${line}` : line;
-        parenDepth += pythonParenDelta(line);
-        if (!continued && parenDepth <= 0) {
-            logicalLines.push(pending.replace(/\s+/g, " ").trim());
-            pending = "";
-            parenDepth = 0;
-        }
-    }
-    if (pending.length > 0) {
-        logicalLines.push(pending.replace(/\s+/g, " ").trim());
-    }
-    return logicalLines;
-}
-function unwrapPythonImportList(value) {
-    let trimmed = value.trim();
-    if (trimmed.startsWith("(") && trimmed.endsWith(")")) {
-        trimmed = trimmed.slice(1, -1).trim();
-    }
-    return trimmed;
-}
-function splitPythonImportList(value) {
-    const items = [];
-    let current = "";
-    let quote;
-    let escaped = false;
-    let parenDepth = 0;
-    for (const char of unwrapPythonImportList(value)) {
-        if (escaped) {
-            current += char;
-            escaped = false;
-            continue;
-        }
-        if (quote) {
-            current += char;
-            if (char === "\\") {
-                escaped = true;
-            }
-            else if (char === quote) {
-                quote = undefined;
-            }
-            continue;
-        }
-        if (char === "'" || char === '"') {
-            current += char;
-            quote = char;
-            continue;
-        }
-        if (char === "(") {
-            parenDepth += 1;
-            current += char;
-            continue;
-        }
-        if (char === ")") {
-            parenDepth -= 1;
-            current += char;
-            continue;
-        }
-        if (char === "," && parenDepth === 0) {
-            const item = current.trim();
-            if (item.length > 0) {
-                items.push(item);
-            }
-            current = "";
-            continue;
-        }
-        current += char;
-    }
-    const item = current.trim();
-    if (item.length > 0) {
-        items.push(item);
-    }
-    return items;
-}
-function stripPythonAlias(value) {
-    return value.replace(/\s+as\s+[A-Za-z_]\w*$/i, "").trim();
-}
-function isPythonIdentifier(value) {
-    return /^[A-Za-z_]\w*$/.test(value);
-}
-function isPythonAbsoluteModuleSpecifier(value) {
-    return /^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*$/.test(value);
-}
-function isPythonRelativeModuleSpecifier(value) {
-    return /^\.+(?:[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)?$/.test(value);
-}
-function isPythonModuleSpecifier(value) {
-    return (isPythonAbsoluteModuleSpecifier(value) ||
-        isPythonRelativeModuleSpecifier(value));
-}
-function pythonModulePath(specifier) {
-    return specifier.split(".").filter(Boolean).join("/");
-}
-function resolvePythonPathCandidate(candidate, pathLookup) {
-    const normalized = normalizeGraphPath(candidate).replace(/\/+$/, "");
-    if (normalized.length === 0 || normalized === "." || normalized === "..") {
-        return undefined;
-    }
-    return resolveCandidate(normalized, pathLookup);
-}
-function pythonPathMatchesModule(path, modulePath) {
-    const normalizedPath = normalizeGraphPath(path).toLowerCase();
-    const normalizedModulePath = normalizeGraphPath(modulePath).toLowerCase();
-    return (PYTHON_SOURCE_EXTENSIONS.some((extension) => {
-        const moduleFile = `${normalizedModulePath}${extension}`;
-        return (normalizedPath === moduleFile ||
-            normalizedPath.endsWith(`/${moduleFile}`));
-    }) ||
-        PYTHON_PACKAGE_INDEX_FILES.some((indexFile) => {
-            const packageFile = posix.join(normalizedModulePath, indexFile);
-            return (normalizedPath === packageFile ||
-                normalizedPath.endsWith(`/${packageFile}`));
-        }));
-}
-function commonDirectoryPrefixLength(left, right) {
-    const leftParts = normalizeGraphPath(left).split("/").filter(Boolean);
-    const rightParts = normalizeGraphPath(right).split("/").filter(Boolean);
-    let count = 0;
-    while (count < leftParts.length &&
-        count < rightParts.length &&
-        leftParts[count].toLowerCase() === rightParts[count].toLowerCase()) {
-        count += 1;
-    }
-    return count;
-}
-function resolvePythonAbsoluteModuleSpecifier(fromPath, specifier, pathLookup) {
-    const modulePath = pythonModulePath(specifier);
-    const direct = resolvePythonPathCandidate(modulePath, pathLookup);
-    if (direct) {
-        return direct;
-    }
-    const matches = [...new Set(pathLookup.values())].filter((path) => isPythonSourcePath(path) && pythonPathMatchesModule(path, modulePath));
-    if (matches.length === 1) {
-        return matches[0];
-    }
-    if (matches.length === 0) {
-        return undefined;
-    }
-    const fromDir = posix.dirname(normalizeGraphPath(fromPath));
-    const scored = matches
-        .map((target) => ({
-        target,
-        score: commonDirectoryPrefixLength(fromDir, posix.dirname(normalizeGraphPath(target))),
-    }))
-        .sort((a, b) => b.score - a.score || a.target.localeCompare(b.target));
-    const bestScore = scored[0]?.score ?? 0;
-    const bestMatches = scored.filter((item) => item.score === bestScore);
-    if (bestScore > 0 && bestMatches.length === 1) {
-        return bestMatches[0].target;
-    }
-    const srcMatches = matches.filter((target) => normalizeGraphPath(target).toLowerCase().startsWith("src/"));
-    return srcMatches.length === 1 ? srcMatches[0] : undefined;
-}
-function resolvePythonRelativeModuleSpecifier(fromPath, specifier, pathLookup) {
-    const match = /^(\.+)(.*)$/.exec(specifier);
-    if (!match) {
-        return undefined;
-    }
-    const level = match[1].length;
-    const remainder = match[2] ?? "";
-    let baseDir = posix.dirname(normalizeGraphPath(fromPath));
-    for (let index = 1; index < level; index++) {
-        const next = posix.dirname(baseDir);
-        if (next === baseDir) {
-            return undefined;
-        }
-        baseDir = next;
-    }
-    const modulePath = pythonModulePath(remainder);
-    const candidate = modulePath.length > 0 ? posix.join(baseDir, modulePath) : baseDir;
-    return resolvePythonPathCandidate(candidate, pathLookup);
-}
-function resolvePythonModuleSpecifier(fromPath, specifier, pathLookup) {
-    if (isPythonRelativeModuleSpecifier(specifier)) {
-        return resolvePythonRelativeModuleSpecifier(fromPath, specifier, pathLookup);
-    }
-    if (isPythonAbsoluteModuleSpecifier(specifier)) {
-        return resolvePythonAbsoluteModuleSpecifier(fromPath, specifier, pathLookup);
-    }
-    return undefined;
-}
-function appendPythonImportedSpecifier(moduleSpecifier, importedName) {
-    return moduleSpecifier.endsWith(".")
-        ? `${moduleSpecifier}${importedName}`
-        : `${moduleSpecifier}.${importedName}`;
-}
-function addPythonImportEdge(edges, fromPath, target, kind, specifier) {
-    if (!target || target === fromPath) {
-        return;
-    }
-    edges.push(graphEdge({
-        from: fromPath,
-        to: target,
-        kind,
-        confidence: IMPORT_EDGE_CONFIDENCE,
-        reason: `Resolved Python import specifier '${specifier}'.`,
-    }));
-}
-function extractPythonImportEdges(fromPath, content, pathLookup) {
-    if (!isPythonSourcePath(fromPath)) {
-        return [];
-    }
-    const edges = [];
-    for (const line of pythonLogicalLines(content)) {
-        const importMatch = /^import\s+(.+)$/i.exec(line);
-        if (importMatch) {
-            for (const rawSpecifier of splitPythonImportList(importMatch[1] ?? "")) {
-                const specifier = stripPythonAlias(rawSpecifier);
-                if (!isPythonAbsoluteModuleSpecifier(specifier)) {
-                    continue;
-                }
-                addPythonImportEdge(edges, fromPath, resolvePythonModuleSpecifier(fromPath, specifier, pathLookup), "python-import", specifier);
-            }
-            continue;
-        }
-        const fromImportMatch = /^from\s+([.\w]+)\s+import\s+(.+)$/i.exec(line);
-        if (!fromImportMatch) {
-            continue;
-        }
-        const moduleSpecifier = fromImportMatch[1] ?? "";
-        if (!isPythonModuleSpecifier(moduleSpecifier)) {
-            continue;
-        }
-        const importedNames = splitPythonImportList(fromImportMatch[2] ?? "")
-            .map(stripPythonAlias)
-            .filter((name) => name !== "*" && isPythonIdentifier(name));
-        const submoduleTargets = importedNames
-            .map((name) => appendPythonImportedSpecifier(moduleSpecifier, name))
-            .map((specifier) => ({
-            specifier,
-            target: resolvePythonModuleSpecifier(fromPath, specifier, pathLookup),
-        }))
-            .filter((item) => item.target);
-        if (submoduleTargets.length > 0) {
-            for (const { specifier, target } of submoduleTargets) {
-                addPythonImportEdge(edges, fromPath, target, "python-from-import", specifier);
-            }
-            continue;
-        }
-        addPythonImportEdge(edges, fromPath, resolvePythonModuleSpecifier(fromPath, moduleSpecifier, pathLookup), "python-from-import", moduleSpecifier);
-    }
-    return edges;
-}
 function extractImportEdges(fromPath, content, pathLookup) {
     const edges = [];
     for (const { pattern, kind } of IMPORT_PATTERNS) {
@@ -1105,6 +783,169 @@ function extractConventionalRouteEvidence(fromPath, content) {
     }
     return routes.length > 0 ? routes : [{ path: routePath, handler: fromPath }];
 }
+// ---- Phase 4A: decorator / framework route detection ----
+// Deterministic route patterns for NestJS, FastAPI, Flask, and Angular. These
+// emit only the existing RouteEdge / route-handler-link shapes — no new
+// planning-topology edge kinds. Each branch is gated on a framework marker so
+// the patterns do not fire on unrelated decorators or object literals. An
+// AST-based version can later move behind the analyzer seam; this is the
+// regex floor for these frameworks.
+const NEST_CONTROLLER_PATTERN = /@Controller\s*\(([\s\S]{0,200}?)\)/g;
+const NEST_METHOD_DECORATOR_PATTERN = /@(Get|Post|Put|Patch|Delete|Options|Head|All)\s*\(\s*(?:["'`]([^"'`]*)["'`])?/g;
+const PY_DECORATOR_METHOD_PATTERN = /@\s*[A-Za-z_]\w*\s*\.\s*(get|post|put|patch|delete|options|head|trace|websocket)\s*\(\s*["']([^"']+)["']/g;
+const PY_ROUTE_DECORATOR_PATTERN = /@\s*[A-Za-z_]\w*\s*\.\s*(api_route|route)\s*\(\s*["']([^"']+)["']([\s\S]{0,200}?)\)/g;
+const PY_METHODS_LIST_PATTERN = /methods\s*=\s*\[([^\]]*)\]/;
+const PY_METHOD_LITERAL_PATTERN = /["']([A-Za-z]+)["']/g;
+const ANGULAR_FILE_MARKER_PATTERN = /\b(?:RouterModule|provideRouter|loadChildren|loadComponent)\b|:\s*Routes\b/;
+const ANGULAR_ROUTE_OBJECT_PATTERN = /\{[^{}]*?\bpath\s*:\s*["'`]([^"'`]*)["'`][^{}]*?\}/g;
+const ANGULAR_ROUTE_KEY_PATTERN = /\b(?:component|loadChildren|loadComponent|redirectTo)\s*:/;
+const ANGULAR_COMPONENT_PATTERN = /\b(?:component|loadComponent)\s*:\s*([A-Za-z_$][\w$]*)/;
+const ANGULAR_LAZY_IMPORT_PATTERN = /\b(?:loadChildren|loadComponent)\s*:[\s\S]*?import\s*\(\s*["']([^"']+)["']\s*\)/;
+const TS_LIKE_EXTENSION_PATTERN = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
+/** Join route segments (controller prefix + method path) into one clean path. */
+function joinRouteSegments(...segments) {
+    return segments
+        .map((segment) => segment.trim().replace(/^\/+|\/+$/g, ""))
+        .filter((segment) => segment.length > 0)
+        .join("/");
+}
+/** Controller prefixes in document order, so each method can take the nearest. */
+function nestControllerPrefixes(content) {
+    const prefixes = [];
+    NEST_CONTROLLER_PATTERN.lastIndex = 0;
+    for (const match of content.matchAll(NEST_CONTROLLER_PATTERN)) {
+        const arg = match[1] ?? "";
+        const pathProp = arg.match(/\bpath\s*:\s*["'`]([^"'`]*)["'`]/);
+        const firstString = arg.match(/["'`]([^"'`]*)["'`]/);
+        const prefix = pathProp?.[1] ?? firstString?.[1] ?? "";
+        prefixes.push({ index: match.index ?? 0, prefix });
+    }
+    return prefixes;
+}
+function collectNestRoutes(fromPath, content, routes) {
+    if (!content.includes("@Controller")) {
+        return;
+    }
+    const controllers = nestControllerPrefixes(content);
+    if (controllers.length === 0) {
+        return;
+    }
+    NEST_METHOD_DECORATOR_PATTERN.lastIndex = 0;
+    for (const match of content.matchAll(NEST_METHOD_DECORATOR_PATTERN)) {
+        const method = match[1];
+        if (!method)
+            continue;
+        const subPath = match[2] ?? "";
+        const at = match.index ?? 0;
+        let prefix = "";
+        for (const controller of controllers) {
+            if (controller.index <= at)
+                prefix = controller.prefix;
+            else
+                break;
+        }
+        routes.push({
+            path: normalizeRoutePath(joinRouteSegments(prefix, subPath)),
+            handler: fromPath,
+            method: method.toUpperCase(),
+        });
+    }
+}
+function pythonRouteMethods(args) {
+    const listMatch = args.match(PY_METHODS_LIST_PATTERN);
+    if (!listMatch?.[1])
+        return [];
+    PY_METHOD_LITERAL_PATTERN.lastIndex = 0;
+    return [...listMatch[1].matchAll(PY_METHOD_LITERAL_PATTERN)].map((method) => method[1].toUpperCase());
+}
+function collectPythonFrameworkRoutes(fromPath, content, routes) {
+    // FastAPI / Starlette: @app.get("/x"), @router.post("/y"), @router.websocket("/ws")
+    PY_DECORATOR_METHOD_PATTERN.lastIndex = 0;
+    for (const match of content.matchAll(PY_DECORATOR_METHOD_PATTERN)) {
+        const verb = match[1];
+        const routePath = match[2];
+        if (!verb || !routePath)
+            continue;
+        const method = verb.toUpperCase();
+        routes.push({
+            path: normalizeRoutePath(routePath),
+            handler: fromPath,
+            method: method === "WEBSOCKET" ? "WS" : method,
+        });
+    }
+    // FastAPI api_route + Flask route: @app.route("/x", methods=["GET","POST"])
+    PY_ROUTE_DECORATOR_PATTERN.lastIndex = 0;
+    for (const match of content.matchAll(PY_ROUTE_DECORATOR_PATTERN)) {
+        const routePath = match[2];
+        if (!routePath)
+            continue;
+        const methods = pythonRouteMethods(match[3] ?? "");
+        const path = normalizeRoutePath(routePath);
+        if (methods.length === 0) {
+            routes.push({ path, handler: fromPath, method: "GET" });
+            continue;
+        }
+        for (const method of methods) {
+            routes.push({ path, handler: fromPath, method });
+        }
+    }
+}
+function collectAngularRoutes(fromPath, content, pathLookup, calls, routes) {
+    if (!ANGULAR_FILE_MARKER_PATTERN.test(content)) {
+        return;
+    }
+    const bindings = extractImportBindings(fromPath, content, pathLookup);
+    ANGULAR_ROUTE_OBJECT_PATTERN.lastIndex = 0;
+    for (const match of content.matchAll(ANGULAR_ROUTE_OBJECT_PATTERN)) {
+        const body = match[0];
+        if (!ANGULAR_ROUTE_KEY_PATTERN.test(body)) {
+            continue;
+        }
+        const routePath = normalizeRoutePath(match[1] ?? "");
+        let handlerPath = fromPath;
+        let handlerExpression;
+        const lazyImport = body.match(ANGULAR_LAZY_IMPORT_PATTERN);
+        const component = body.match(ANGULAR_COMPONENT_PATTERN);
+        if (lazyImport?.[1]) {
+            const target = resolveSpecifier(fromPath, lazyImport[1], pathLookup) ??
+                resolveReferenceLiteral(fromPath, lazyImport[1], pathLookup);
+            if (target) {
+                handlerPath = target;
+                handlerExpression = lazyImport[1];
+            }
+        }
+        else if (component?.[1]) {
+            const binding = bindings.get(component[1]);
+            if (binding) {
+                handlerPath = binding.target;
+                handlerExpression = component[1];
+            }
+        }
+        routes.push({ path: routePath, handler: handlerPath });
+        if (handlerPath !== fromPath) {
+            calls.push(graphEdge({
+                from: fromPath,
+                to: handlerPath,
+                kind: "route-handler-link",
+                confidence: ROUTE_HANDLER_EDGE_CONFIDENCE,
+                reason: `Angular route '${routePath}' maps to '${handlerExpression ?? handlerPath}'.`,
+            }));
+        }
+    }
+}
+function extractFrameworkRouteEvidence(fromPath, content, pathLookup) {
+    const normalized = normalizeGraphPath(fromPath).toLowerCase();
+    const calls = [];
+    const routes = [];
+    if (normalized.endsWith(".py")) {
+        collectPythonFrameworkRoutes(fromPath, content, routes);
+    }
+    else if (TS_LIKE_EXTENSION_PATTERN.test(normalized)) {
+        collectNestRoutes(fromPath, content, routes);
+        collectAngularRoutes(fromPath, content, pathLookup, calls, routes);
+    }
+    return { calls, routes };
+}
 function fallbackRouteEdge(filePath) {
     const normalized = filePath.toLowerCase();
     if (normalized.includes("api/") || normalized.includes("route")) {
@@ -1239,7 +1080,7 @@ function extractPytestConftestLinks(pathLookup) {
 }
 export async function buildGraphBundleFromFs(repoManifest, root, disposition, options = {}) {
     const rootPath = resolve(root);
-    const dispositionMap = new Map(disposition?.files.map((item) => [item.path, item.status]) ?? []);
+    const dispositionMap = buildDispositionMap(disposition);
     const fileContents = {};
     await Promise.all(repoManifest.files.map(async (file) => {
         const status = dispositionMap.get(file.path);
@@ -1267,7 +1108,7 @@ export function buildGraphBundle(repoManifest, disposition, options = {}) {
     const calls = [];
     const references = [];
     const routes = [];
-    const dispositionMap = new Map(disposition?.files.map((item) => [item.path, item.status]) ?? []);
+    const dispositionMap = buildDispositionMap(disposition);
     const pathLookup = buildPathLookup(repoManifest, dispositionMap);
     for (const file of repoManifest.files) {
         const status = dispositionMap.get(file.path);
@@ -1327,6 +1168,9 @@ export function buildGraphBundle(repoManifest, disposition, options = {}) {
             const registeredRoutes = extractRegisteredRouteEvidence(file.path, content, pathLookup);
             calls.push(...registeredRoutes.calls);
             fileRoutes.push(...registeredRoutes.routes);
+            const frameworkRoutes = extractFrameworkRouteEvidence(file.path, content, pathLookup);
+            calls.push(...frameworkRoutes.calls);
+            fileRoutes.push(...frameworkRoutes.routes);
         }
         fileRoutes.push(...extractConventionalRouteEvidence(file.path, content));
         if (fileRoutes.length === 0) {

package/dist/extractors/graphManifestEdges.d.ts

@@ -1,4 +1,4 @@
-import type { GraphEdge } from "../types/graph.js";
+import type { GraphEdge } from "@audit-tools/shared";
 export declare function extractPackageEntrypointEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
 export declare function extractPackageScriptEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
 export declare function isGoWorkspaceManifestPath(path: string): boolean;

package/dist/extractors/graphPathUtils.d.ts

@@ -1,4 +1,4 @@
-import type { GraphEdge } from "../types/graph.js";
+import type { GraphEdge } from "@audit-tools/shared";
 export declare function normalizeGraphPath(path: string): string;
 export declare function graphLookupKey(path: string): string;
 export declare function resolveCandidate(candidate: string, pathLookup: Map<string, string>): string | undefined;

package/dist/extractors/graphPythonImports.d.ts

@@ -0,0 +1,18 @@
+import type { GraphEdge } from "@audit-tools/shared";
+export declare function isPythonSourcePath(path: string): boolean;
+/**
+ * Resolve a single `import <spec>` module specifier to a repo file, or
+ * undefined. Shared with the tree-sitter Python analyzer so AST-extracted
+ * imports resolve to exactly the same targets as the regex floor.
+ */
+export declare function resolvePythonImportTarget(fromPath: string, specifier: string, pathLookup: Map<string, string>): string | undefined;
+/**
+ * Resolve a `from <module> import <names>` statement to repo files. Mirrors the
+ * floor: prefer submodule files (`module.name`), else the module itself. Shared
+ * with the tree-sitter Python analyzer.
+ */
+export declare function resolvePythonFromImportTargets(fromPath: string, moduleSpecifier: string, importedNames: string[], pathLookup: Map<string, string>): Array<{
+    specifier: string;
+    target: string;
+}>;
+export declare function extractPythonImportEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];