attackmap 0.4.21__tar.gz → 0.4.25__tar.gz

{attackmap-0.4.21/src/attackmap.egg-info → attackmap-0.4.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.21
+Version: 0.4.25
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -128,6 +128,31 @@ model ID verbatim.
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
+**Multi-repo (fleet) scan.** Pass two or more repositories to scan a whole fleet
+in one run:
+
+```bash
+attackmap analyze ./service-a ./service-b ./gateway --output reports
+```
+
+Each repo is scanned independently into its own `reports/<repo>/` directory, and
+a `reports/fleet-summary.md` (+ `.json`) indexes the run with per-repo severity
+counts and top findings. AttackMap then **links the seams**: it matches one
+repo's outbound HTTP calls to another repo's routes (by normalized path template
++ method — `base + "/api/orders/" + id` in a caller aligns with `/api/orders/{id}`
+served elsewhere), lists each client→server link (citing both sides) in the fleet
+summary, and renders the repo-to-repo graph to `reports/fleet-graph.md`.
+
+Over those links it then flags **cross-boundary trust** (confused-deputy) risks:
+a value one repo forwards across a link that the callee trusts into a dangerous
+sink or an unguarded object access — each repo looks locally fine; the bug is in
+the seam. These are marked **speculative** (leads to adjudicate, citing both the
+caller and callee sites) and listed in the fleet summary. It also flags
+**trust-assumption gaps** (a state-changing call crossing a link to a route the
+callee serves with no auth — if each side assumes the other enforces, nobody
+does) and **cross-repo anomalies** (the one service that omits an auth control
+its siblings enforce on the same route). Single-repo behavior is unchanged.
+
 ---
 
 ## Install

{attackmap-0.4.21 → attackmap-0.4.25}/README.md

@@ -67,6 +67,31 @@ model ID verbatim.
 Read `reports/defensive-review.md` (heuristic) and `reports/defensive-review-llm.md`
 (LLM-narrated) side by side.
 
+**Multi-repo (fleet) scan.** Pass two or more repositories to scan a whole fleet
+in one run:
+
+```bash
+attackmap analyze ./service-a ./service-b ./gateway --output reports
+```
+
+Each repo is scanned independently into its own `reports/<repo>/` directory, and
+a `reports/fleet-summary.md` (+ `.json`) indexes the run with per-repo severity
+counts and top findings. AttackMap then **links the seams**: it matches one
+repo's outbound HTTP calls to another repo's routes (by normalized path template
++ method — `base + "/api/orders/" + id` in a caller aligns with `/api/orders/{id}`
+served elsewhere), lists each client→server link (citing both sides) in the fleet
+summary, and renders the repo-to-repo graph to `reports/fleet-graph.md`.
+
+Over those links it then flags **cross-boundary trust** (confused-deputy) risks:
+a value one repo forwards across a link that the callee trusts into a dangerous
+sink or an unguarded object access — each repo looks locally fine; the bug is in
+the seam. These are marked **speculative** (leads to adjudicate, citing both the
+caller and callee sites) and listed in the fleet summary. It also flags
+**trust-assumption gaps** (a state-changing call crossing a link to a route the
+callee serves with no auth — if each side assumes the other enforces, nobody
+does) and **cross-repo anomalies** (the one service that omits an auth control
+its siblings enforce on the same route). Single-repo behavior is unchanged.
+
 ---
 
 ## Install

{attackmap-0.4.21 → attackmap-0.4.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.21"
+version = "0.4.25"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.21 → attackmap-0.4.25}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.21"
+__version__ = "0.4.25"

{attackmap-0.4.21 → attackmap-0.4.25}/src/attackmap/analyzers.py

@@ -47,6 +47,7 @@ from .scanner import (
     DB_KEYWORDS,
     DB_PATTERNS,
     EXTERNAL_CALL_PATTERNS,
+    _external_call_fields,
     SECRET_PATTERNS,
     extract_routes,
     scan_repo,
@@ -104,7 +105,10 @@ class ExternalCallAnalyzer:
         calls: list[ExternalCall] = []
         for pattern in EXTERNAL_CALL_PATTERNS:
             for match in pattern.finditer(context.content):
-                calls.append(ExternalCall(target=match.groups()[-1], file=context.relative_path))
+                target, method = _external_call_fields(match)
+                calls.append(
+                    ExternalCall(target=target, method=method, file=context.relative_path)
+                )
         return AnalyzerSignals(external_calls=calls)
 
 

{attackmap-0.4.21 → attackmap-0.4.25}/src/attackmap/anomalies.py

@@ -195,6 +195,32 @@ def find_anomalies(
     return out
 
 
+def route_auth_signals(
+    scan: ScanResult, root: str | Path | None = None
+) -> dict[tuple[str, str, str], bool]:
+    """Per-route authentication/authorization presence for one repo.
+
+    Maps ``(file, method, path)`` → whether an auth/authorization marker appears
+    within that route handler's own span (the same span-bounded detection the
+    within-repo `auth_outlier` pass uses). Exposed for cross-repo trust analysis
+    (#146d): the fleet layer runs it per repo — each with its own root — to spot
+    an unauthenticated route reached across a service boundary, and the sibling
+    service that omits an auth control its peers enforce."""
+    root_path = Path(root or scan.root).resolve()
+    routes = [r for r in scan.routes if not is_test_file(r.file)]
+    line_cache: dict[str, list[str]] = {}
+    file_route_lines: dict[str, list[int]] = {}
+    for route in routes:
+        if route.line is not None:
+            file_route_lines.setdefault(route.file, []).append(route.line)
+    for lines in file_route_lines.values():
+        lines.sort()
+    ctx = _SignalCtx(root_path, line_cache, file_route_lines)
+    return {
+        (r.file, r.method, r.path): _route_has_signal(r, ctx, _AUTH_MARKERS) for r in routes
+    }
+
+
 # --- Heuristics ------------------------------------------------------------
 
 
@@ -608,4 +634,4 @@ def _file_lines(rel_file: str, ctx: _SignalCtx) -> list[str]:
     return lines
 
 
-__all__ = ["find_anomalies"]
+__all__ = ["find_anomalies", "route_auth_signals"]

{attackmap-0.4.21 → attackmap-0.4.25}/src/attackmap/cli.py

@@ -17,6 +17,21 @@ from .analyzers import (
     select_requested_analyzers,
 )
 from .cve import query_vulnerabilities
+from .anomalies import route_auth_signals
+from .contracts import link_contracts
+from .crossrepo import (
+    find_cross_boundary_flows,
+    find_cross_repo_anomalies,
+    find_trust_gaps,
+)
+from .fleet import (
+    FleetRepoResult,
+    FleetScan,
+    fleet_repo_ids,
+    fleet_summary_json,
+    render_fleet_graph_mermaid,
+    render_fleet_summary,
+)
 from .diff import (
     FindingSnapshot,
     diff_findings,
@@ -66,9 +81,151 @@ TRIAGE_BANNER = (
 )
 
 
+def _run_fleet(
+    repo_paths: list[Path],
+    *,
+    output: str,
+    module: list[str] | None,
+    recall: bool,
+    cve: bool,
+    no_suppress: bool,
+    suppress_file: str | None,
+    progress_format: str,
+    no_progress: bool,
+    fleet_incompatible: dict[str, bool],
+) -> None:
+    """Multi-repo fleet scan (#146a). Scans each repo independently — reusing the
+    same building blocks a single-repo run uses — writes per-repo reports into
+    ``output/<repo_id>/``, and assembles a fleet summary. No cross-repo detection
+    yet (that is #146b–#146d); this is the foundation."""
+    active_flags = [flag for flag, on in fleet_incompatible.items() if on]
+    if active_flags:
+        raise typer.BadParameter(
+            f"{', '.join(sorted(active_flags))} not yet supported in multi-repo mode — "
+            "run one repository at a time for these (fleet-aware wiring lands in #146b+)."
+        )
+
+    selected_analyzers = None
+    if module:
+        try:
+            selected_analyzers = select_requested_analyzers(module, auto_install=True)
+        except ValueError as exc:
+            raise typer.BadParameter(str(exc)) from exc
+
+    output_root = Path(output)
+    repo_ids = fleet_repo_ids(repo_paths)
+    fleet = FleetScan()
+
+    for repo_id, repo_path in zip(repo_ids, repo_paths):
+        typer.echo("")
+        typer.echo(f"── {repo_id}  ({repo_path}) ──")
+        active_analyzers = resolve_run_analyzers(repo_path, analyzers=selected_analyzers)
+        scan_progress = create_progress(progress_format, no_progress=no_progress)
+        scan = analyze_repository(
+            repo_path, analyzers=active_analyzers, progress=scan_progress, recall=recall
+        )
+        if cve and scan.dependencies:
+            try:
+                vulns, _cve_summary = query_vulnerabilities(scan.dependencies)
+            finally:
+                scan_progress.done()
+            scan.vulnerabilities = vulns
+
+        graph = build_graph(scan)
+        analysis = translate_recon(scan)
+        attack_surfaces = analysis.attack_surfaces
+        findings = analysis.findings
+        attack_paths = analysis.attack_paths
+        architecture_md = summarize_architecture(scan, graph)
+        attack_surface_md = summarize_attack_surface(scan, attack_surfaces)
+
+        suppressed_findings: list = []
+        if not no_suppress:
+            explicit = Path(suppress_file) if suppress_file else None
+            if explicit is not None and not explicit.exists():
+                raise typer.BadParameter(f"Suppress file not found: {explicit}")
+            suppset, sup_warnings = collect_suppressions(repo_path, findings, explicit_file=explicit)
+            for warning in sup_warnings:
+                typer.echo(f"Suppression warning: {warning}", err=True)
+            outcome = apply_suppressions(findings, suppset)
+            findings = outcome.active
+            suppressed_findings = outcome.suppressed
+
+        defensive_review_md = render_defensive_review(scan, attack_surfaces, findings, attack_paths)
+        repo_out = output_root / repo_id
+        write_reports(
+            repo_out,
+            scan,
+            architecture_md,
+            attack_surface_md,
+            defensive_review_md,
+            attack_surfaces,
+            findings,
+            attack_paths,
+            analyzer_metadata=[
+                {
+                    "name": metadata.name,
+                    "description": metadata.description,
+                    "scope": metadata.scope,
+                    "ecosystems": list(metadata.ecosystems),
+                }
+                for metadata in (get_analyzer_metadata(a) for a in active_analyzers)
+            ],
+            suppressed=suppressed_findings,
+        )
+        typer.echo(render_console_summary(scan, findings, attack_paths))
+        fleet.results.append(
+            FleetRepoResult(
+                repo_id=repo_id,
+                root=str(repo_path),
+                report_dir=str(repo_out.resolve()),
+                scan=scan,
+                findings=findings,
+                attack_paths=attack_paths,
+                suppressed_count=len(suppressed_findings),
+            )
+        )
+
+    # Cross-repo contract linking (#146b): match one repo's outbound calls to
+    # another repo's routes, over the assembled fleet.
+    repo_scans = [(r.repo_id, r.scan) for r in fleet.results]
+    fleet.links = link_contracts(repo_scans)
+    # Cross-boundary trust flows (#146c): confused-deputy leads over the links.
+    fleet.cross_boundary = find_cross_boundary_flows(fleet.links, repo_scans)
+    # Trust-assumption gaps + cross-repo anomalies (#146d / #149b). Per-route auth
+    # signals are resolved per repo (each with its own root).
+    auth_by_repo = {r.repo_id: route_auth_signals(r.scan, r.root) for r in fleet.results}
+    fleet.trust_gaps = find_trust_gaps(fleet.links, repo_scans, auth_by_repo)
+    fleet.cross_repo_anomalies = find_cross_repo_anomalies(repo_scans, auth_by_repo)
+
+    output_root.mkdir(parents=True, exist_ok=True)
+    (output_root / "fleet-summary.md").write_text(
+        render_fleet_summary(fleet) + "\n", encoding="utf-8"
+    )
+    (output_root / "fleet-summary.json").write_text(
+        json.dumps(fleet_summary_json(fleet), indent=2) + "\n", encoding="utf-8"
+    )
+    (output_root / "fleet-graph.md").write_text(
+        render_fleet_graph_mermaid(fleet) + "\n", encoding="utf-8"
+    )
+    typer.echo("")
+    typer.echo(
+        f"Fleet: {fleet.repo_count} repositories, {fleet.total_findings()} finding(s), "
+        f"{len(fleet.links)} cross-repo link(s), "
+        f"{len(fleet.cross_boundary)} cross-boundary + {len(fleet.trust_gaps)} trust-gap + "
+        f"{len(fleet.cross_repo_anomalies)} anomaly (all speculative). "
+        f"Summary written to: {(output_root / 'fleet-summary.md').resolve()}"
+    )
+
+
 @app.command()
 def analyze(
-    path: str = typer.Argument(".", help="Path to the repository to analyze."),
+    paths: list[str] | None = typer.Argument(
+        None,
+        help="Path(s) to the repository(ies) to analyze. Pass two or more for a "
+        "cross-repo fleet scan (#146a): each is scanned into its own report "
+        "subdirectory and a fleet summary is written alongside. Defaults to '.'.",
+    ),
     output: str = typer.Option("reports", "--output", "-o", help="Directory for generated reports."),
     format: str = typer.Option("all", "--format", help="Output format: all, markdown, or json."),
     module: list[str] | None = typer.Option(
@@ -198,9 +355,45 @@ def analyze(
         help="Path to a suppression baseline, overriding auto-discovery of .attackmap-suppress.yaml at the repo root (#144).",
     ),
 ) -> None:
-    repo_path = Path(path).resolve()
-    if not repo_path.exists():
-        raise typer.BadParameter(f"Path does not exist: {repo_path}")
+    repo_paths = [Path(p).resolve() for p in (paths or ["."])]
+    for rp in repo_paths:
+        if not rp.exists():
+            raise typer.BadParameter(f"Path does not exist: {rp}")
+
+    # Validate progress format before either branch, so the fleet path enforces
+    # the same option semantics as a single-repo run (#146a).
+    if progress_format not in {"auto", "tty", "json", "none"}:
+        raise typer.BadParameter("--progress-format must be one of: auto, json, none.")
+
+    # Multi-repo fleet mode (#146a): scan each repo independently and assemble a
+    # fleet view. Dispatched here so the single-repo path below is untouched.
+    if len(repo_paths) > 1:
+        _run_fleet(
+            repo_paths,
+            output=output,
+            module=module,
+            recall=recall,
+            cve=cve,
+            no_suppress=no_suppress,
+            suppress_file=suppress_file,
+            progress_format=progress_format,
+            no_progress=no_progress,
+            # Single-repo-only features aren't fleet-aware yet — reject rather
+            # than silently ignore, so the user isn't surprised (#146b+ wire them).
+            fleet_incompatible={
+                "--baseline": baseline is not None,
+                "--diff-output": diff_output is not None,
+                "--fail-on-new-high": fail_on_new_high,
+                "--pr-comment": pr_comment is not None,
+                "--llm": llm,
+                "--hunt": hunt,
+                "--remediate": remediate,
+                "--triage": triage,
+            },
+        )
+        return
+
+    repo_path = repo_paths[0]
     # Validate diff-mode flag combinations before doing any real work.
     if fail_on_new_high and baseline is None:
         raise typer.BadParameter("--fail-on-new-high requires --baseline to be set.")
@@ -216,8 +409,7 @@ def analyze(
         except ValueError as exc:
             raise typer.BadParameter(str(exc)) from exc
 
-    if progress_format not in {"auto", "tty", "json", "none"}:
-        raise typer.BadParameter("--progress-format must be one of: auto, json, none.")
+    # (--progress-format is validated up-front, before the fleet dispatch.)
     if llm_speed not in {"standard", "fast"}:
         raise typer.BadParameter("--llm-speed must be one of: standard, fast.")
     if llm_provider not in {"claude", "openai"}:

attackmap-0.4.25/src/attackmap/contracts.py

@@ -0,0 +1,201 @@
+"""Cross-repo contract linking — cross-repo phase 2 (#146b).
+
+Given a fleet of independently-scanned repos (#146a), link one repo's **outbound
+HTTP calls** to another repo's **routes** — the client↔server seam. This is the
+one linking dimension that reuses signals both sides already produce
+(`ExternalCall.target`/`.method` and `Route.path`/`.method`); the richer
+dimensions (RPC callers, shared schemas, queues, DB tables, token iss/aud) are
+new extraction deferred to later work.
+
+Matching is by **normalized path template + method**, cross-repo only:
+
+- The call's URL path and the route's path are each normalized to a segment
+  tuple with concrete ids and path params collapsed to ``*`` (so
+  ``/users/123`` ↔ ``/users/{id}`` ↔ ``/users/:id`` align).
+- A link requires the normalized paths to be **equal** and the methods
+  compatible (equal, or either side unknown/``ANY``).
+- Precision guards: the path must carry at least one **static** segment (a bare
+  ``/{id}`` won't link), infra/static routes are excluded, and client and
+  server must be **different** repos.
+
+Pure and deterministic — takes ``(repo_id, ScanResult)`` primitives so it stays
+unit-testable without a real scan and imports nothing from the CLI/fleet layer.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from urllib.parse import urlsplit
+
+from .models import ExternalCall, Route, ScanResult
+from .srcpaths import is_infra_route, is_test_file, is_vendored_file
+
+# A path segment that is a concrete instance id rather than a static resource
+# name: an explicit path param (`{id}`, `:id`, `<id>`), an all-digits segment,
+# a uuid, or a long hex blob. Collapsed to `*` so caller and server templates
+# align regardless of how each side writes the variable part.
+_PARAM_SEG = re.compile(r"^([{:<].*|.*[}>]|\d+|[0-9a-fA-F-]{16,}|[0-9a-fA-F]{8,})$")
+_PLACEHOLDER = "*"
+
+
+@dataclass(frozen=True)
+class ContractLink:
+    """A matched client→server seam across two repos."""
+
+    client_repo: str
+    server_repo: str
+    method: str  # the route's method (the served contract)
+    path_template: str  # normalized template, e.g. "users/*"
+    client_target: str  # the raw outbound URL as written in the caller
+    client_file: str
+    client_line: int | None
+    server_route_path: str  # the route path as declared on the server
+    server_file: str
+    server_line: int | None
+    # The caller's concrete verb — retained so a state-changing call to a
+    # method-unspecified (`ANY`) server route (e.g. XRPC surfaces) isn't lost by
+    # downstream trust-gap analysis (#146d). `None` when unknown (config URL).
+    client_method: str | None = None
+
+
+def _normalize_path(path: str, *, client: bool = False) -> tuple[str, ...] | None:
+    """Normalize a URL/route path to a segment tuple with instance ids collapsed
+    to ``*``. Returns ``None`` when there is nothing linkable (no path, or only a
+    root / all-variable path with no static segment to anchor on).
+
+    ``client=True`` handles the concatenation idiom: an outbound URL built as
+    ``base + "/api/orders/" + oid`` is captured only up to the trailing slash, so
+    a client path ending in ``/`` is treated as having a dynamic final segment
+    (``api/orders/`` → ``("api","orders","*")``) — which then aligns with the
+    server template ``/api/orders/{id}`` while still separating from the bare
+    collection route ``/api/orders``."""
+    if not path:
+        return None
+    # A full URL (client side) — take just the path component.
+    if "://" in path:
+        path = urlsplit(path).path
+    else:
+        path = path.split("?", 1)[0].split("#", 1)[0]
+    trailing_slash = path.endswith("/") and path.strip() not in {"", "/"}
+    segments = [s for s in path.split("/") if s]
+    if not segments:
+        return None
+    norm = [_PLACEHOLDER if _PARAM_SEG.match(s) else s.lower() for s in segments]
+    if client and trailing_slash:
+        norm.append(_PLACEHOLDER)  # the concatenated dynamic segment
+    # Require at least one static segment — a bare `/{id}` or `/*/*` is too
+    # generic to link on without producing spurious cross-repo edges.
+    if all(s == _PLACEHOLDER for s in norm):
+        return None
+    return tuple(norm)
+
+
+def _method_compatible(call_method: str | None, route_method: str) -> bool:
+    """Methods match when they're equal, or either side is unknown/ANY."""
+    rm = (route_method or "ANY").upper()
+    if call_method is None or rm in {"", "ANY"}:
+        return True
+    return call_method.upper() == rm
+
+
+def _excluded_source(rel_file: str) -> bool:
+    """Test/spec/fixture and vendored/generated files are not production
+    architecture — a cross-repo link anchored on one is noise. Honors the same
+    `ATTACKMAP_INCLUDE_TESTS`/`_VENDORED` opt-ins as the rest of the scanner."""
+    return is_test_file(rel_file) or is_vendored_file(rel_file)
+
+
+def _linkable_calls(scan: ScanResult) -> list[tuple[ExternalCall, tuple[str, ...]]]:
+    out: list[tuple[ExternalCall, tuple[str, ...]]] = []
+    for call in scan.external_calls:
+        if _excluded_source(call.file):
+            continue
+        norm = _normalize_path(call.target, client=True)
+        if norm is None:
+            continue
+        if is_infra_route("/" + "/".join(norm)):
+            continue
+        out.append((call, norm))
+    return out
+
+
+def _linkable_routes(scan: ScanResult) -> list[tuple[Route, tuple[str, ...]]]:
+    out: list[tuple[Route, tuple[str, ...]]] = []
+    for route in scan.routes:
+        if _excluded_source(route.file):
+            continue
+        if is_infra_route(route.path):
+            continue
+        norm = _normalize_path(route.path)
+        if norm is None:
+            continue
+        out.append((route, norm))
+    return out
+
+
+def link_contracts(repo_scans: list[tuple[str, ScanResult]]) -> list[ContractLink]:
+    """Return the client→server contract links across a fleet of repos.
+
+    For every ordered pair of *distinct* repos (A as client, B as server), match
+    A's linkable outbound calls to B's linkable routes by normalized path +
+    method. Deterministic; deduped on the full link identity.
+    """
+    calls_by_repo = {rid: _linkable_calls(scan) for rid, scan in repo_scans}
+    routes_by_repo = {rid: _linkable_routes(scan) for rid, scan in repo_scans}
+
+    links: list[ContractLink] = []
+    seen: set[tuple] = set()
+    for client_id, _client_scan in repo_scans:
+        for call, call_norm in calls_by_repo[client_id]:
+            for server_id, _server_scan in repo_scans:
+                if server_id == client_id:
+                    continue
+                for route, route_norm in routes_by_repo[server_id]:
+                    if call_norm != route_norm:
+                        continue
+                    if not _method_compatible(call.method, route.method):
+                        continue
+                    key = (
+                        client_id,
+                        server_id,
+                        call.file,
+                        call.line,
+                        route.file,
+                        route.method,
+                        route.path,
+                    )
+                    if key in seen:
+                        continue
+                    seen.add(key)
+                    links.append(
+                        ContractLink(
+                            client_repo=client_id,
+                            server_repo=server_id,
+                            method=(route.method or "ANY").upper(),
+                            path_template="/".join(call_norm),
+                            client_target=call.target,
+                            client_file=call.file,
+                            client_line=call.line,
+                            server_route_path=route.path,
+                            server_file=route.file,
+                            server_line=route.line,
+                            client_method=(call.method.upper() if call.method else None),
+                        )
+                    )
+    links.sort(
+        key=lambda link: (link.client_repo, link.server_repo, link.path_template, link.method)
+    )
+    return links
+
+
+def route_template(path: str) -> str | None:
+    """Public helper: the normalized template for a route path (instance ids
+    collapsed to ``*``), or ``None`` if too generic to key on. Used by the
+    cross-repo anomaly cohorting (#146d) to group the *same* resource route
+    across repos."""
+    norm = _normalize_path(path)
+    return "/".join(norm) if norm is not None else None
+
+
+__all__ = ["ContractLink", "link_contracts", "route_template"]