codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/callsites/go.js

@@ -0,0 +1,163 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var go_exports = {};
+__export(go_exports, {
+  goCallsites: () => goCallsites
+});
+module.exports = __toCommonJS(go_exports);
+var import_shared = require("./shared");
+const GROUP_RE = /(\w+)\s*:?=\s*(\w+)\s*\.\s*Group\s*\(\s*"([^"]*)"/;
+const SUBROUTER_RE = /(\w+)\s*:?=\s*(\w+)\s*\.\s*PathPrefix\s*\(\s*"([^"]*)"\s*\)\s*\.\s*Subrouter\s*\(\s*\)/;
+const CHI_ROUTE_RE = /(\w+)\s*\.\s*Route\s*\(\s*"([^"]*)"\s*,\s*func/;
+const VERB_METHOD_RE = /(\w+)\s*\.\s*(Get|Post|Put|Patch|Delete|Head|Options|GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(\s*"([^"]*)"/g;
+const HANDLE_RE = /(\w+)\s*\.\s*(HandleFunc|Handle)\s*\(\s*"([^"]*)"/g;
+const METHODS_SUFFIX_RE = /\.\s*Methods\s*\(([^)]*)\)/;
+const HTTP_VERB_CALL_RE = /\bhttp\s*\.\s*(Get|Post|Put|Patch|Delete|Head)\s*\(\s*"([^"]*)"/g;
+const NEW_REQUEST_RE = /\bhttp\s*\.\s*NewRequest(?:WithContext)?\s*\(\s*(?:[^,]+,\s*)?"([A-Za-z]+)"\s*,\s*("([^"]*)"|fmt\s*\.\s*Sprintf\s*\(\s*"([^"]*)")/g;
+const goCallsites = {
+  language: "go",
+  extract(content, _filePath) {
+    const out = [];
+    out.push(...extractRoutes(content));
+    out.push(...extractOutbound(content));
+    return out;
+  }
+};
+function extractRoutes(content) {
+  const lines = content.split("\n");
+  const out = [];
+  const groupPrefix = /* @__PURE__ */ new Map();
+  for (let sweep = 0; sweep < 2; sweep++) {
+    for (const line of lines) {
+      const m = GROUP_RE.exec(line) ?? SUBROUTER_RE.exec(line);
+      if (!m) continue;
+      const [, name, parent, literal] = m;
+      groupPrefix.set(name, (0, import_shared.joinPath)(groupPrefix.get(parent) ?? "", literal));
+    }
+  }
+  const blockStack = [];
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const line = (0, import_shared.stripLineComment)(lines[i], "//");
+    const lineNo = i + 1;
+    while (blockStack.length > 0 && depth < blockStack[blockStack.length - 1].depth) {
+      blockStack.pop();
+    }
+    const blockPrefix = blockStack.length > 0 ? blockStack[blockStack.length - 1].prefix : "";
+    const depthBefore = depth;
+    depth += (0, import_shared.countBraces)(line);
+    const chi = CHI_ROUTE_RE.exec(line);
+    if (chi) {
+      const [, recv, literal] = chi;
+      const base = groupPrefix.get(recv) ?? blockPrefix;
+      blockStack.push({ depth: depthBefore + 1, prefix: (0, import_shared.joinPath)(base, literal) });
+    }
+    for (const cs of routesOnLine(line, lineNo, groupPrefix, blockPrefix)) out.push(cs);
+  }
+  return out;
+}
+function isRouteLiteral(literal, prefixed) {
+  if (literal.startsWith("/")) return true;
+  if (!prefixed || literal === "") return false;
+  return !/\s/.test(literal);
+}
+function* routesOnLine(line, lineNo, groupPrefix, blockPrefix) {
+  VERB_METHOD_RE.lastIndex = 0;
+  let m;
+  while (m = VERB_METHOD_RE.exec(line)) {
+    const [, recv, verb, literal] = m;
+    const prefix = groupPrefix.get(recv) ?? blockPrefix;
+    if (!isRouteLiteral(literal, groupPrefix.has(recv) || blockPrefix !== "")) continue;
+    yield {
+      kind: "http_route",
+      protocol: "http",
+      line: lineNo,
+      method: verb.toUpperCase(),
+      urlPattern: (0, import_shared.normalizeRoute)((0, import_shared.joinPath)(prefix, literal)),
+      context: `${recv}.${verb}`
+    };
+  }
+  HANDLE_RE.lastIndex = 0;
+  while (m = HANDLE_RE.exec(line)) {
+    const [, recv, fn, rawPattern] = m;
+    const prefix = groupPrefix.get(recv) ?? blockPrefix;
+    let method;
+    let literal = rawPattern;
+    const spaceIdx = rawPattern.indexOf(" ");
+    if (spaceIdx > 0) {
+      const candidate = rawPattern.slice(0, spaceIdx).toUpperCase();
+      if (import_shared.VERB_SET.has(candidate)) {
+        method = candidate;
+        literal = rawPattern.slice(spaceIdx + 1);
+      }
+    }
+    const methodsSuffix = METHODS_SUFFIX_RE.exec(line.slice(m.index));
+    const suffixVerbs = methodsSuffix ? methodsSuffix[1].split(",").map((s) => s.replace(/["'\s]/g, "").toUpperCase()).filter((s) => import_shared.VERB_SET.has(s)) : [];
+    if (!isRouteLiteral(literal, groupPrefix.has(recv) || blockPrefix !== "")) continue;
+    const methods = suffixVerbs.length > 0 ? suffixVerbs : [method ?? "ANY"];
+    for (const verb of methods) {
+      yield {
+        kind: "http_route",
+        protocol: "http",
+        line: lineNo,
+        method: verb,
+        urlPattern: (0, import_shared.normalizeRoute)((0, import_shared.joinPath)(prefix, literal)),
+        context: `${recv}.${fn}`
+      };
+    }
+  }
+}
+function extractOutbound(content) {
+  const out = [];
+  HTTP_VERB_CALL_RE.lastIndex = 0;
+  let m;
+  while (m = HTTP_VERB_CALL_RE.exec(content)) {
+    const [, verb, url] = m;
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    out.push({
+      kind: "http_call",
+      protocol: "http",
+      line: (0, import_shared.lineOf)(content, m.index),
+      method: verb.toUpperCase(),
+      urlPattern: (0, import_shared.normalizeUrl)(url),
+      ...(0, import_shared.hostField)(url),
+      context: `http.${verb}`
+    });
+  }
+  NEW_REQUEST_RE.lastIndex = 0;
+  while (m = NEW_REQUEST_RE.exec(content)) {
+    const verb = m[1].toUpperCase();
+    if (!import_shared.VERB_SET.has(verb)) continue;
+    const url = m[3] ?? m[4] ?? "";
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    out.push({
+      kind: "http_call",
+      protocol: "http",
+      line: (0, import_shared.lineOf)(content, m.index),
+      method: verb,
+      urlPattern: (0, import_shared.normalizeUrl)(url),
+      ...(0, import_shared.hostField)(url),
+      context: "http.NewRequest"
+    });
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  goCallsites
+});

package/src/backend/services/callsites/index.js

@@ -0,0 +1,53 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var callsites_exports = {};
+__export(callsites_exports, {
+  CALLSITE_EXTRACTORS: () => CALLSITE_EXTRACTORS,
+  getCallsiteExtractor: () => getCallsiteExtractor
+});
+module.exports = __toCommonJS(callsites_exports);
+var import_typescript = require("./typescript");
+var import_python = require("./python");
+var import_go = require("./go");
+var import_csharp = require("./csharp");
+var import_kotlin = require("./kotlin");
+var import_swift = require("./swift");
+var import_ruby = require("./ruby");
+const CALLSITE_EXTRACTORS = [
+  import_typescript.typescriptCallsites,
+  import_typescript.javascriptCallsites,
+  import_python.pythonCallsites,
+  import_go.goCallsites,
+  import_csharp.csharpCallsites,
+  import_kotlin.kotlinCallsites,
+  import_swift.swiftCallsites,
+  import_ruby.rubyCallsites
+];
+const BY_LANGUAGE = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const e of CALLSITE_EXTRACTORS) map.set(e.language, e);
+  return map;
+})();
+function getCallsiteExtractor(language) {
+  return BY_LANGUAGE.get(language) ?? null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CALLSITE_EXTRACTORS,
+  getCallsiteExtractor
+});

package/src/backend/services/callsites/kotlin.js

@@ -0,0 +1,123 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var kotlin_exports = {};
+__export(kotlin_exports, {
+  kotlinCallsites: () => kotlinCallsites
+});
+module.exports = __toCommonJS(kotlin_exports);
+var import_shared = require("./shared");
+const REQUEST_MAPPING_RE = /@RequestMapping\s*\(\s*(?:value\s*=\s*)?\[?\s*"([^"]*)"/;
+const REQUEST_METHOD_RE = /RequestMethod\s*\.\s*(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)/g;
+const VERB_MAPPING_RE = /@(Get|Post|Put|Patch|Delete)Mapping\s*(?:\(\s*(?:value\s*=\s*)?\[?\s*"([^"]*)")?/g;
+const CLASS_RE = /\b(?:class|object|interface)\s+(\w+)/;
+const KTOR_ROUTE_BLOCK_RE = /(?:^|[^.\w])route\s*\(\s*"([^"]*)"\s*\)\s*\{/;
+const KTOR_VERB_RE = /(?:^|[^.\w])(get|post|put|patch|delete|head|options)\s*\(\s*"([^"]*)"\s*\)\s*\{/g;
+const CLIENT_VERB_RE = /(\w+)\s*\.\s*(get|post|put|patch|delete|head|options)\s*(?:<[^>]*>)?\s*\(\s*"([^"]*)"/g;
+const OKHTTP_URL_RE = /\.\s*url\s*\(\s*"([^"]*)"/g;
+const RETROFIT_RE = /@(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(\s*"([^"]*)"\s*\)/g;
+const kotlinCallsites = {
+  language: "kotlin",
+  extract(content, _filePath) {
+    return [...extractRoutes(content), ...extractOutbound(content)];
+  }
+};
+function extractRoutes(content) {
+  const lines = content.split("\n").map((l) => (0, import_shared.stripLineComment)(l, "//"));
+  const out = [];
+  const blockStack = [];
+  let depth = 0;
+  let classPrefix = "";
+  let pendingMapping = null;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    const depthBefore = depth;
+    depth += (0, import_shared.countBraces)(line);
+    const blockPrefix = (0, import_shared.unwindBlocks)(blockStack, depthBefore);
+    const mapping = REQUEST_MAPPING_RE.exec(line);
+    if (mapping) {
+      REQUEST_METHOD_RE.lastIndex = 0;
+      const verbs = [];
+      let vm;
+      while (vm = REQUEST_METHOD_RE.exec(line)) verbs.push(vm[1]);
+      pendingMapping = { path: mapping[1], verbs };
+    }
+    const classDecl = CLASS_RE.exec(line);
+    if (classDecl) {
+      classPrefix = pendingMapping ? pendingMapping.path : "";
+      pendingMapping = null;
+      continue;
+    }
+    VERB_MAPPING_RE.lastIndex = 0;
+    let m;
+    let sawVerbMapping = false;
+    while (m = VERB_MAPPING_RE.exec(line)) {
+      sawVerbMapping = true;
+      out.push((0, import_shared.route)(lineNo, m[1], (0, import_shared.joinPath)(classPrefix, m[2] ?? ""), `@${m[1]}Mapping`));
+    }
+    if (sawVerbMapping) {
+      pendingMapping = null;
+      continue;
+    }
+    if (pendingMapping && pendingMapping.verbs.length > 0) {
+      for (const verb of pendingMapping.verbs) {
+        out.push((0, import_shared.route)(lineNo, verb, (0, import_shared.joinPath)(classPrefix, pendingMapping.path), "@RequestMapping"));
+      }
+      pendingMapping = null;
+      continue;
+    }
+    const routeBlock = KTOR_ROUTE_BLOCK_RE.exec(line);
+    if (routeBlock) {
+      blockStack.push({ depth: depthBefore + 1, prefix: (0, import_shared.joinPath)(blockPrefix, routeBlock[1]) });
+    }
+    KTOR_VERB_RE.lastIndex = 0;
+    while (m = KTOR_VERB_RE.exec(line)) {
+      const [, verb, literal] = m;
+      out.push((0, import_shared.route)(lineNo, verb, (0, import_shared.joinPath)(blockPrefix, literal), `ktor ${verb}`));
+    }
+  }
+  return out;
+}
+function extractOutbound(content) {
+  const out = [];
+  let m;
+  CLIENT_VERB_RE.lastIndex = 0;
+  while (m = CLIENT_VERB_RE.exec(content)) {
+    const [, recv, verb, url] = m;
+    if ((0, import_shared.isNonClientReceiver)(recv)) continue;
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    out.push((0, import_shared.call)((0, import_shared.lineOf)(content, m.index), verb, url, `${recv}.${verb}`));
+  }
+  OKHTTP_URL_RE.lastIndex = 0;
+  while (m = OKHTTP_URL_RE.exec(content)) {
+    const url = m[1];
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    out.push((0, import_shared.call)((0, import_shared.lineOf)(content, m.index), "GET", url, "okhttp .url"));
+  }
+  RETROFIT_RE.lastIndex = 0;
+  while (m = RETROFIT_RE.exec(content)) {
+    const [, verb, url] = m;
+    if (!import_shared.VERB_SET.has(verb)) continue;
+    out.push((0, import_shared.call)((0, import_shared.lineOf)(content, m.index), verb, url.startsWith("/") ? url : "/" + url, `@${verb} (Retrofit)`));
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  kotlinCallsites
+});

package/src/backend/services/callsites/process-env.js

@@ -0,0 +1,125 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var process_env_exports = {};
+__export(process_env_exports, {
+  extractProcessAndEnv: () => extractProcessAndEnv,
+  programOf: () => programOf
+});
+module.exports = __toCommonJS(process_env_exports);
+var import_shared = require("./shared");
+const PROGRAM = /^[A-Za-z0-9][\w.+-]{0,63}$/;
+const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const RUN = {};
+const READ = {};
+const JS_RUN = [
+  // child_process and execa, with the command or program as the first argument.
+  /(?<![\w$])(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|execa|execaSync)\s*\(\s*(['"`])\s*([^\s'"`$]+)/g
+];
+const JS_READ = [
+  /\bprocess\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\bprocess\.env\[\s*(['"`])([A-Za-z_][A-Za-z0-9_]*)\1\s*\]/g,
+  /\bimport\.meta\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\bDeno\.env\.get\(\s*(['"`])([A-Za-z_][A-Za-z0-9_]*)\1/g
+];
+RUN.typescript = JS_RUN;
+RUN.javascript = JS_RUN;
+READ.typescript = JS_READ;
+READ.javascript = JS_READ;
+RUN.python = [
+  /\bsubprocess\.(?:run|call|check_call|check_output|Popen)\s*\(\s*\[\s*(['"])\s*([^\s'"]+)/g,
+  /\bsubprocess\.(?:run|call|check_call|check_output|Popen|getoutput|getstatusoutput)\s*\(\s*(['"])\s*([^\s'"]+)/g,
+  /\bos\.(?:system|popen)\s*\(\s*(['"])\s*([^\s'"]+)/g
+];
+READ.python = [
+  /\bos\.environ\[\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1\s*\]/g,
+  /\bos\.environ\.get\(\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1/g,
+  /\bos\.getenv\(\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1/g
+];
+RUN.go = [/\bexec\.Command(?:Context)?\s*\(\s*(?:[^,()"]+,\s*)?"([^\s"]+)/g];
+READ.go = [/\bos\.(?:Getenv|LookupEnv)\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g];
+RUN.ruby = [
+  /(?<![\w.])(?:system|spawn|exec)\s*\(?\s*(['"])\s*([^\s'"]+)/g,
+  /\bOpen3\.(?:capture2e?|capture3|popen2e?|popen3)\s*\(\s*(['"])\s*([^\s'"]+)/g,
+  /%x\(\s*([^\s)]+)/g
+];
+READ.ruby = [
+  /\bENV\[\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1\s*\]/g,
+  /\bENV\.fetch\(\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1/g
+];
+RUN.csharp = [
+  /\bProcess\.Start\s*\(\s*"([^\s"]+)/g,
+  /\bnew\s+ProcessStartInfo\s*\(\s*"([^\s"]+)/g
+];
+READ.csharp = [/\bEnvironment\.GetEnvironmentVariable\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g];
+const JVM_RUN = [
+  /\bProcessBuilder\s*\(\s*(?:(?:listOf|mutableListOf|arrayOf|List\.of|Arrays\.asList)\s*\(\s*)?"([^\s"]+)/g,
+  /\bRuntime\.getRuntime\(\)\.exec\s*\(\s*"([^\s"]+)/g
+];
+const JVM_READ = [/\bSystem\.getenv\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g];
+RUN.kotlin = JVM_RUN;
+RUN.java = JVM_RUN;
+READ.kotlin = JVM_READ;
+READ.java = JVM_READ;
+RUN.swift = [
+  /\bexecutableURL\s*=\s*URL\s*\(\s*fileURLWithPath:\s*"([^\s"]+)/g,
+  /\blaunchPath\s*=\s*"([^\s"]+)/g
+];
+READ.swift = [/\benvironment\[\s*"([A-Za-z_][A-Za-z0-9_]*)"\s*\]/g];
+RUN.rust = [/\bCommand::new\(\s*"([^\s"]+)/g];
+READ.rust = [/\benv::var(?:_os)?\(\s*"([A-Za-z_][A-Za-z0-9_]*)"/g];
+RUN.php = [/\b(?:exec|shell_exec|system|passthru|proc_open|popen)\s*\(\s*(['"])\s*([^\s'"]+)/g];
+READ.php = [
+  /\bgetenv\(\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1/g,
+  /\$_(?:ENV|SERVER)\[\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\1\s*\]/g
+];
+function programOf(command) {
+  const first = command.trim().split(/\s+/)[0] ?? "";
+  const name = first.slice(first.lastIndexOf("/") + 1).replace(/\.exe$/i, "");
+  return PROGRAM.test(name) ? name : null;
+}
+function extractProcessAndEnv(language, content) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (cs) => {
+    const k = `${cs.kind}\0${cs.urlPattern}\0${cs.line}`;
+    if (!seen.has(k)) {
+      seen.add(k);
+      out.push(cs);
+    }
+  };
+  for (const re of RUN[language] ?? []) {
+    re.lastIndex = 0;
+    for (let m = re.exec(content); m; m = re.exec(content)) {
+      const program = programOf(m[m.length - 1]);
+      if (program) add({ kind: "subprocess", protocol: "subprocess", line: (0, import_shared.lineOf)(content, m.index), urlPattern: program, context: m[0].slice(0, 120) });
+    }
+  }
+  for (const re of READ[language] ?? []) {
+    re.lastIndex = 0;
+    for (let m = re.exec(content); m; m = re.exec(content)) {
+      const name = m[m.length - 1];
+      if (VARIABLE.test(name)) add({ kind: "env_lookup", protocol: "env", line: (0, import_shared.lineOf)(content, m.index), urlPattern: name, context: m[0].slice(0, 120) });
+    }
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  extractProcessAndEnv,
+  programOf
+});

package/src/backend/services/callsites/python.js

@@ -0,0 +1,91 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var python_exports = {};
+__export(python_exports, {
+  pythonCallsites: () => pythonCallsites
+});
+module.exports = __toCommonJS(python_exports);
+var import_shared = require("./shared");
+const FASTAPI_DECORATOR_RE = /@(?:\w+\.)?(get|post|put|patch|delete|head|options)\s*\(\s*([`'"])([^`'"]+?)\2/gi;
+const FLASK_ROUTE_RE = /@(?:\w+\.)?route\s*\(\s*([`'"])([^`'"]+?)\1(?:[\s\S]*?methods\s*=\s*\[([^\]]+)\])?/gi;
+const REQUESTS_RE = /\brequests\s*\.\s*(get|post|put|patch|delete|head|options)\s*\(\s*([`'"])([^`'"]+?)\2/gi;
+const pythonCallsites = {
+  language: "python",
+  extract(content, _filePath) {
+    const out = [];
+    for (const cs of iterateFastApi(content)) out.push(cs);
+    for (const cs of iterateFlask(content)) out.push(cs);
+    for (const cs of iterateRequests(content)) out.push(cs);
+    return out;
+  }
+};
+function* iterateFastApi(content) {
+  FASTAPI_DECORATOR_RE.lastIndex = 0;
+  let m;
+  while (m = FASTAPI_DECORATOR_RE.exec(content)) {
+    yield {
+      kind: "http_route",
+      protocol: "http",
+      line: (0, import_shared.lineOf)(content, m.index),
+      method: m[1].toUpperCase(),
+      urlPattern: (0, import_shared.normalizeRoute)(m[3]),
+      context: `@${m[1]}`
+    };
+  }
+}
+function* iterateFlask(content) {
+  FLASK_ROUTE_RE.lastIndex = 0;
+  let m;
+  while (m = FLASK_ROUTE_RE.exec(content)) {
+    const url = m[2];
+    const methodsRaw = m[3] ?? "";
+    const methods = methodsRaw ? methodsRaw.split(",").map((s) => s.replace(/['"`\s]/g, "").toUpperCase()).filter(Boolean) : ["GET"];
+    for (const method of methods) {
+      yield {
+        kind: "http_route",
+        protocol: "http",
+        line: (0, import_shared.lineOf)(content, m.index),
+        method,
+        urlPattern: (0, import_shared.normalizeRoute)(url),
+        context: "@app.route"
+      };
+    }
+  }
+}
+function* iterateRequests(content) {
+  REQUESTS_RE.lastIndex = 0;
+  let m;
+  while (m = REQUESTS_RE.exec(content)) {
+    const url = m[3];
+    const verb = m[1].toUpperCase();
+    if (!(0, import_shared.isLikelyApiPath)(url)) continue;
+    yield {
+      kind: "http_call",
+      protocol: "http",
+      line: (0, import_shared.lineOf)(content, m.index),
+      method: verb,
+      urlPattern: (0, import_shared.normalizeUrl)(url),
+      ...(0, import_shared.hostField)(url),
+      context: `requests.${verb.toLowerCase()}`
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  pythonCallsites
+});