entrygraph 0.1.26__tar.gz → 0.1.28__tar.gz

{entrygraph-0.1.26 → entrygraph-0.1.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.26
+Version: 0.1.28
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.26'
-__version_tuple__ = version_tuple = (0, 1, 26)
+__version__ = version = '0.1.28'
+__version_tuple__ = version_tuple = (0, 1, 28)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/api.py

@@ -88,6 +88,17 @@ class _FilteredAdjacency:
         )
 
 
+class PathResults(list):
+    """CallPath list that also reports whether enumeration was budget-truncated.
+
+    It is a plain list for every existing use (iteration, len, indexing); the
+    `truncated` flag lets the CLI warn when 0 paths may mean "budget spent", not
+    "no reachable sink".
+    """
+
+    truncated: bool = False
+
+
 def _has_sanitizer(path: CallPath) -> bool:
     """True if a category sanitizer is called on the path (heuristic, no dataflow).
 
@@ -317,11 +328,15 @@ class CodeGraph:
             sources = self._source_ids(session, source, source_category)
             sinks = self._sink_ids(session, sink, sink_category)
             if not sources or not sinks:
-                return []
+                return PathResults()
             traverser = self._traverser(session, engine, kinds, floor, include_cha)
             raw_paths = traverser.paths(sources, sinks, max_depth=max_depth, max_paths=max_paths)
             if not raw_paths:
-                return []
+                # 0 paths may mean the visit budget was spent before any sink was
+                # reached — propagate the flag so this isn't mistaken for "safe".
+                empty = PathResults()
+                empty.truncated = bool(getattr(raw_paths, "truncated", False))
+                return empty
             all_ids = {node for path in raw_paths for node, _ in path}
             symbol_map = q.symbols_by_ids(session, all_ids)
             registry = self._registry(session)
@@ -347,7 +362,12 @@ class CodeGraph:
         results.sort(
             key=lambda p: (-(p.risk_score or 0.0), len(p.symbols), [s.id for s in p.symbols])
         )
-        return results
+        # Enumeration collected a candidate pool; return the top max_paths by risk.
+        # Truncating after the risk rank (not during DFS) is what makes the widen
+        # flags monotonic — a wider edge set can only add candidates to rank.
+        out = PathResults(results[:max_paths])
+        out.truncated = bool(getattr(raw_paths, "truncated", False))
+        return out
 
     def reachable(
         self,

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/cli/main.py

@@ -8,6 +8,7 @@ directly testable.
 from __future__ import annotations
 
 import argparse
+import sys
 from dataclasses import asdict
 from pathlib import Path
 
@@ -277,6 +278,15 @@ def cmd_paths(args) -> int:
             include_callbacks=args.include_callbacks,
             prune_sanitized=args.prune_sanitized,
         )
+    truncated = bool(getattr(paths, "truncated", False))
+    if truncated:
+        # A budget-truncated search may have missed paths — never let an empty or
+        # short result read as a clean "no reachable sinks" on a large graph.
+        print(
+            "warning: path search hit its work budget and may be incomplete; "
+            "narrow --source/--sink or lower --max-depth for a complete answer.",
+            file=sys.stderr,
+        )
     if args.json:
         print(
             to_json(

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/data/sinks/csharp.toml

@@ -104,3 +104,26 @@ id = "csharp.env"
 category = "env_input"
 callee = "cs:Environment.GetEnvironmentVariable"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "cs.sanitize.path-getfilename"
+category = "path_traversal"
+callee = "cs:*.{GetFileName,GetFullPath}"
+effect = "reduces"
+description = "Path.GetFileName / GetFullPath normalization"
+
+[[sanitizer]]
+id = "cs.sanitize.uri-escape"
+category = "ssrf"
+callee = "cs:*.{EscapeDataString,EscapeUriString}"
+effect = "reduces"
+description = "Uri.EscapeDataString URL encoding"
+
+[[sanitizer]]
+id = "cs.sanitize.sql-parameter"
+category = "sql"
+callee = "cs:*.{AddWithValue}"
+effect = "reduces"
+description = "Parameterized query value binding (SqlParameter)"

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/data/sinks/go.toml

@@ -85,3 +85,33 @@ id = "go.env"
 category = "env_input"
 callee = "go:os.Getenv"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "go.sanitize.filepath-clean"
+category = "path_traversal"
+callee = "go:{path/filepath.Clean,path.Clean,path/filepath.Base,path.Base}"
+effect = "reduces"
+description = "Path normalization / basename"
+
+[[sanitizer]]
+id = "go.sanitize.html-escape"
+category = "template_injection"
+callee = "go:{html.EscapeString,template.HTMLEscapeString}"
+effect = "reduces"
+description = "HTML escaping"
+
+[[sanitizer]]
+id = "go.sanitize.url-escape"
+category = "ssrf"
+callee = "go:{url.QueryEscape,url.PathEscape}"
+effect = "reduces"
+description = "URL component escaping"
+
+[[sanitizer]]
+id = "go.sanitize.strconv-sql"
+category = "sql"
+callee = "go:{strconv.Atoi,strconv.ParseInt,strconv.ParseUint,strconv.ParseFloat}"
+effect = "neutralizes"
+description = "Numeric parse — a parsed number cannot carry SQL injection"

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/data/sinks/java.toml

@@ -90,3 +90,26 @@ id = "java.env"
 category = "env_input"
 callee = "java:System.getenv"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "java.sanitize.html-encode"
+category = "template_injection"
+callee = "java:*.{forHtml,forHtmlContent,forJavaScript,escapeHtml4,escapeHtml,escapeXml11,htmlEscape}"
+effect = "reduces"
+description = "OWASP Encoder / commons-text / Spring HTML escaping"
+
+[[sanitizer]]
+id = "java.sanitize.path-normalize"
+category = "path_traversal"
+callee = "java:*.{getFileName,normalize,getName}"
+effect = "reduces"
+description = "Path normalization / filename extraction (Path.getFileName, FilenameUtils.getName)"
+
+[[sanitizer]]
+id = "java.sanitize.url-encode"
+category = "ssrf"
+callee = "java:*.{urlEncode,encode}"
+effect = "reduces"
+description = "URL encoding (URLEncoder.encode)"

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/data/sinks/php.toml

@@ -123,3 +123,47 @@ id = "php.laravel.request"
 category = "http_input"
 callee = "php:*.{input,query,post,cookie,header}"
 description = "Laravel request accessors"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "php.sanitize.escapeshell"
+category = "command_exec"
+callee = "php:{escapeshellarg,escapeshellcmd}"
+effect = "neutralizes"
+description = "Shell argument/command escaping"
+
+[[sanitizer]]
+id = "php.sanitize.htmlspecialchars"
+category = "template_injection"
+callee = "php:{htmlspecialchars,htmlentities,strip_tags}"
+effect = "reduces"
+description = "HTML escaping"
+
+[[sanitizer]]
+id = "php.sanitize.sql-escape"
+category = "sql"
+callee = "php:{mysqli_real_escape_string,pg_escape_string,pg_escape_literal}"
+effect = "reduces"
+description = "SQL string escaping"
+
+[[sanitizer]]
+id = "php.sanitize.sql-quote"
+category = "sql"
+callee = "php:*.{quote,real_escape_string}"
+effect = "reduces"
+description = "PDO::quote / mysqli::real_escape_string"
+
+[[sanitizer]]
+id = "php.sanitize.intval"
+category = "sql"
+callee = "php:{intval,floatval}"
+effect = "neutralizes"
+description = "Numeric cast — a parsed number cannot carry SQL injection"
+
+[[sanitizer]]
+id = "php.sanitize.basename"
+category = "path_traversal"
+callee = "php:{basename,realpath}"
+effect = "reduces"
+description = "Basename / realpath resolution"

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/data/sinks/ruby.toml

@@ -100,3 +100,33 @@ category = "env_input"
 callee = "rb:*.{fetch}"
 require_arg_hint = "ENV"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "rb.sanitize.shellwords"
+category = "command_exec"
+callee = "rb:*.{shellescape}"
+effect = "neutralizes"
+description = "Shell argument quoting (Shellwords.escape / String#shellescape)"
+
+[[sanitizer]]
+id = "rb.sanitize.html-escape"
+category = "template_injection"
+callee = "rb:{CGI.escapeHTML,ERB.Util.html_escape,ERB.Util.h,Rack.Utils.escape_html}"
+effect = "reduces"
+description = "HTML escaping"
+
+[[sanitizer]]
+id = "rb.sanitize.sql"
+category = "sql"
+callee = "rb:*.{sanitize_sql,sanitize_sql_array,sanitize_sql_for_conditions,quote}"
+effect = "reduces"
+description = "ActiveRecord SQL sanitization"
+
+[[sanitizer]]
+id = "rb.sanitize.basename"
+category = "path_traversal"
+callee = "rb:{File.basename}"
+effect = "reduces"
+description = "Basename extraction"

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/data/sinks/rust.toml

@@ -66,3 +66,19 @@ id = "rust.stdin"
 category = "stdin_input"
 callee = "rs:{std.io.stdin,io.stdin}"
 description = "Standard input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "rs.sanitize.shell-escape"
+category = "command_exec"
+callee = "rs:{shell_escape.escape,shell_escape.unix.escape,shlex.quote,shlex.try_quote}"
+effect = "neutralizes"
+description = "Shell argument quoting (shell-escape / shlex crates)"
+
+[[sanitizer]]
+id = "rs.sanitize.path-filename"
+category = "path_traversal"
+callee = "rs:*.{file_name,canonicalize}"
+effect = "reduces"
+description = "Path::file_name / canonicalize"

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/base.py

@@ -74,6 +74,17 @@ def first_string_arg(decorator_text: str) -> str | None:
     return match.group(1) if match else None
 
 
+def compose_route(prefix: str | None, path: str | None) -> str:
+    """Join a class/group-level route prefix with a method-level path.
+
+    Either side may be None/empty or carry stray leading/trailing slashes. The
+    result is a single slash-prefixed route ("/" when both are empty), matching
+    the NestJS rule so composed routes read consistently across frameworks.
+    """
+    parts = [seg.strip("/") for seg in (prefix, path) if seg and seg.strip("/")]
+    return "/" + "/".join(parts)
+
+
 def methods_kwarg(decorator_text: str) -> list[str]:
     match = _METHODS_KWARG.search(decorator_text)
     if not match:

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/csharp.py

@@ -14,6 +14,7 @@ import re
 
 from entrygraph.detect.entrypoints.base import (
     EntrypointRule,
+    compose_route,
     first_string_arg,
     register,
 )
@@ -48,14 +49,32 @@ def _is_controller(t: RawSymbol) -> bool:
     return any("Controller" in b for b in t.bases)
 
 
+def _controller_token(qname: str) -> str:
+    """The `[controller]` route-token value: the class name minus a Controller suffix."""
+    name = qname.rsplit(".", 1)[-1]
+    return name[: -len("Controller")] if name.endswith("Controller") else name
+
+
+def _class_route_prefix(t: RawSymbol) -> str:
+    """A controller's class-level [Route("...")] prefix, with [controller] expanded."""
+    route_dec = next((d for d in t.decorators if _ROUTE_ATTR.match(d)), None)
+    prefix = first_string_arg(route_dec) if route_dec else None
+    if not prefix:
+        return ""
+    return prefix.replace("[controller]", _controller_token(t.qualified_name))
+
+
 def _aspnet_controller_routes(x: FileExtraction) -> list[EntrypointHint]:
-    controllers = {t.qualified_name for t in _type_symbols(x) if _is_controller(t)}
+    controller_syms = [t for t in _type_symbols(x) if _is_controller(t)]
+    controllers = {t.qualified_name for t in controller_syms}
     if not controllers:
         return []
+    prefixes = {t.qualified_name: _class_route_prefix(t) for t in controller_syms}
     hints: list[EntrypointHint] = []
     for method in _methods(x):
         if method.parent_qualified_name not in controllers:
             continue
+        prefix = prefixes.get(method.parent_qualified_name or "", "")
         for decorator in method.decorators:
             m = _HTTP_ATTR.match(decorator)
             if m:
@@ -64,7 +83,7 @@ def _aspnet_controller_routes(x: FileExtraction) -> list[EntrypointHint]:
                         rule_id="csharp.aspnet.controller-route",
                         kind=EntrypointKind.HTTP_ROUTE,
                         handler_qualified_name=method.qualified_name,
-                        route=first_string_arg(decorator) or "",
+                        route=compose_route(prefix, first_string_arg(decorator)),
                         http_methods=[m.group(1).upper()],
                         framework="aspnetcore",
                     )
@@ -79,7 +98,7 @@ def _aspnet_controller_routes(x: FileExtraction) -> list[EntrypointHint]:
                         rule_id="csharp.aspnet.controller-route",
                         kind=EntrypointKind.HTTP_ROUTE,
                         handler_qualified_name=method.qualified_name,
-                        route=first_string_arg(route_dec) or "",
+                        route=compose_route(prefix, first_string_arg(route_dec)),
                         http_methods=["*"],
                         framework="aspnetcore",
                     )

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/golang.py

@@ -11,8 +11,11 @@ from entrygraph.detect.entrypoints.base import (
 from entrygraph.extract.ir import EntrypointHint, FileExtraction
 from entrygraph.kinds import EntrypointKind, SymbolKind
 
-_GIN_METHODS = frozenset(
-    {"GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS", "Any", "Handle"}
+# gin exports UPPERCASE verbs (r.GET); chi/fiber use TitleCase (r.Get). Accept
+# both so the shared _gin_style matcher recognizes chi/fiber, not just gin.
+_HTTP_VERBS = frozenset({"GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"})
+_GIN_METHODS = (
+    _HTTP_VERBS | frozenset(v.title() for v in _HTTP_VERBS) | frozenset({"Any", "Handle"})
 )
 _NETHTTP_REGISTER = frozenset({"HandleFunc", "Handle"})
 
@@ -73,12 +76,8 @@ def _gin_routes(x: FileExtraction) -> list[EntrypointHint]:
         ):
             route = first_string_arg("(" + ref.arg_preview.lstrip("("))
             if route is not None and route.startswith("/"):
-                method = (
-                    ref.callee_name.upper()
-                    if ref.callee_name
-                    in {"GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"}
-                    else "*"
-                )
+                verb = ref.callee_name.upper()
+                method = verb if verb in _HTTP_VERBS else "*"
                 hints.append(
                     EntrypointHint(
                         rule_id="go.gin.route",

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/java.py

@@ -13,6 +13,7 @@ import re
 
 from entrygraph.detect.entrypoints.base import (
     EntrypointRule,
+    compose_route,
     first_string_arg,
     register,
 )
@@ -38,6 +39,10 @@ def _annotation_names(decorators: list[str], pattern: re.Pattern) -> bool:
     return any(pattern.match(d) for d in decorators)
 
 
+def _class_prefix(qname: str | None, prefixes: dict[str, str]) -> str:
+    return prefixes.get(qname or "", "")
+
+
 def _type_symbols(x: FileExtraction) -> list[RawSymbol]:
     return [s for s in x.symbols if s.kind in (SymbolKind.CLASS, SymbolKind.INTERFACE)]
 
@@ -50,6 +55,17 @@ def _enclosing_type(method: RawSymbol, types: list[RawSymbol]) -> RawSymbol | No
     return next((t for t in types if t.qualified_name == method.parent_qualified_name), None)
 
 
+def _class_route_prefixes(types: list[RawSymbol], pattern: re.Pattern) -> dict[str, str]:
+    """Map controller/resource qname -> its class-level route prefix (via `pattern`)."""
+    prefixes: dict[str, str] = {}
+    for t in types:
+        for decorator in t.decorators:
+            if pattern.match(decorator):
+                prefixes[t.qualified_name] = first_string_arg(decorator) or ""
+                break
+    return prefixes
+
+
 def _spring_routes(x: FileExtraction) -> list[EntrypointHint]:
     types = _type_symbols(x)
     controllers = {
@@ -57,6 +73,10 @@ def _spring_routes(x: FileExtraction) -> list[EntrypointHint]:
     }
     if not controllers:
         return []
+    # A controller's own @RequestMapping("/api") is its route prefix.
+    prefixes = _class_route_prefixes(
+        [t for t in types if t.qualified_name in controllers], _SPRING_MAPPING
+    )
     hints = []
     for method in _methods(x):
         if method.parent_qualified_name not in controllers:
@@ -67,12 +87,15 @@ def _spring_routes(x: FileExtraction) -> list[EntrypointHint]:
                 continue
             verb = _MAPPING_VERB.get(match.group(1))
             methods = [verb] if verb else ["*"]
+            route = compose_route(
+                _class_prefix(method.parent_qualified_name, prefixes), first_string_arg(decorator)
+            )
             hints.append(
                 EntrypointHint(
                     rule_id="java.spring.route",
                     kind=EntrypointKind.HTTP_ROUTE,
                     handler_qualified_name=method.qualified_name,
-                    route=first_string_arg(decorator) or "",
+                    route=route,
                     http_methods=methods,
                     framework="spring-boot",
                 )
@@ -85,6 +108,10 @@ def _jaxrs_routes(x: FileExtraction) -> list[EntrypointHint]:
     resources = {t.qualified_name for t in types if _annotation_names(t.decorators, _JAXRS_PATH)}
     if not resources:
         return []
+    # A resource class's own @Path("/api") prefixes every sub-resource method.
+    prefixes = _class_route_prefixes(
+        [t for t in types if t.qualified_name in resources], _JAXRS_PATH
+    )
     hints = []
     for method in _methods(x):
         if method.parent_qualified_name not in resources:
@@ -95,13 +122,16 @@ def _jaxrs_routes(x: FileExtraction) -> list[EntrypointHint]:
         )
         if verb is None:
             continue
-        route = next((first_string_arg(d) for d in method.decorators if _JAXRS_PATH.match(d)), None)
+        method_path = next(
+            (first_string_arg(d) for d in method.decorators if _JAXRS_PATH.match(d)), None
+        )
+        route = compose_route(_class_prefix(method.parent_qualified_name, prefixes), method_path)
         hints.append(
             EntrypointHint(
                 rule_id="java.jaxrs",
                 kind=EntrypointKind.HTTP_ROUTE,
                 handler_qualified_name=method.qualified_name,
-                route=route or "",
+                route=route,
                 http_methods=[verb],
                 framework="jax-rs",
             )
@@ -121,6 +151,9 @@ def _micronaut_routes(x: FileExtraction) -> list[EntrypointHint]:
     }
     if not controllers:
         return []
+    prefixes = _class_route_prefixes(
+        [t for t in types if t.qualified_name in controllers], _MICRONAUT_CONTROLLER
+    )
     hints = []
     for method in _methods(x):
         if method.parent_qualified_name not in controllers:
@@ -128,12 +161,16 @@ def _micronaut_routes(x: FileExtraction) -> list[EntrypointHint]:
         for decorator in method.decorators:
             m = _MICRONAUT_MAPPING.match(decorator)
             if m:
+                route = compose_route(
+                    _class_prefix(method.parent_qualified_name, prefixes),
+                    first_string_arg(decorator),
+                )
                 hints.append(
                     EntrypointHint(
                         rule_id="java.micronaut.route",
                         kind=EntrypointKind.HTTP_ROUTE,
                         handler_qualified_name=method.qualified_name,
-                        route=first_string_arg(decorator) or "",
+                        route=route,
                         http_methods=[m.group(1).upper()],
                         framework="micronaut",
                     )

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/javascript.py

@@ -14,6 +14,31 @@ _NEST_DECORATOR = re.compile(r"^@(Get|Post|Put|Delete|Patch|All)\b")
 
 
 _TRAILING_IDENT = re.compile(r",\s*([A-Za-z_$][\w$]*)\s*\)?\s*$")
+_RECEIVER_ROOT = re.compile(r"^\s*([A-Za-z_$][\w$]*)")
+# HTTP-client and test-harness roots whose .get()/.post() are *requests*, not
+# route registrations: supertest/nock/chai/superagent and Node/browser clients.
+# Excludes them so test suites don't flood the route table (ghost 72%, strapi 99%).
+_CLIENT_ROOTS = frozenset(
+    {
+        "nock",
+        "supertest",
+        "request",
+        "superagent",
+        "agent",
+        "chai",
+        "axios",
+        "got",
+        "fetch",
+        "http",
+        "https",
+        "fastify",
+    }  # fastify.inject(...).get is a test call
+)
+
+
+def _receiver_root(receiver_text: str) -> str | None:
+    m = _RECEIVER_ROOT.match(receiver_text)
+    return m.group(1) if m else None
 
 
 def _router_routes(framework: str):
@@ -29,6 +54,7 @@ def _router_routes(framework: str):
             if (
                 ref.kind == "call"
                 and ref.receiver_text is not None
+                and _receiver_root(ref.receiver_text) not in _CLIENT_ROOTS
                 and ref.callee_name in _HTTP_METHODS
                 and ref.arg_preview
             ):

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/detect/entrypoints/python.py

@@ -53,8 +53,14 @@ def _flask_routes(x: FileExtraction) -> list[EntrypointHint]:
         else:
             verb = _HTTP_VERB.match(decorator)
             if verb:
-                route = first_string_arg(decorator)
-                methods = [verb.group(2).upper()]
+                candidate = first_string_arg(decorator)
+                # The @app.get/@router.post shorthand shares its shape with
+                # @mock.patch("dotted.target"), which the verb `patch` matches.
+                # A real Flask/FastAPI route is a URL path ("/..."); a mock target
+                # is a dotted import path. Require the URL shape to exclude mocks.
+                if candidate is not None and candidate.startswith("/"):
+                    route = candidate
+                    methods = [verb.group(2).upper()]
         if route is not None:
             hints.append(
                 EntrypointHint(

{entrygraph-0.1.26 → entrygraph-0.1.28}/src/entrygraph/extract/javascript.py

@@ -36,6 +36,22 @@ _SCOPE_TYPES = frozenset(
 _NAMED_SCOPES = frozenset({"function_declaration", "method_definition", "class_declaration"})
 _SRC_ROOTS = ("src", "lib", "app")
 _EXPORT_PARENTS = frozenset({"export_statement"})
+_JS_EXTS = (".d.ts", ".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx")
+
+
+def _atomic_segment(filename: str) -> str:
+    """A filename -> one module-path segment: strip a JS/TS extension, then map any
+    remaining internal dots to `_`.
+
+    A dotted stem like ``article.service`` must NOT become two dotted segments, or
+    ``.split(".")`` in relative-import resolution mis-counts package depth and
+    duplicates a directory name (``article.article.article.service``) — issue #42.
+    """
+    for ext in _JS_EXTS:
+        if filename.endswith(ext):
+            filename = filename[: -len(ext)]
+            break
+    return filename.replace(".", "_")
 
 
 class JavaScriptExtractor:
@@ -45,11 +61,7 @@ class JavaScriptExtractor:
         parts = repo_relative_path.split("/")
         if parts[0] in _SRC_ROOTS and len(parts) > 1:
             parts = parts[1:]
-        stem = parts[-1]
-        for ext in (".d.ts", ".ts", ".tsx", ".mts", ".cts", ".js", ".mjs", ".cjs", ".jsx"):
-            if stem.endswith(ext):
-                stem = stem[: -len(ext)]
-                break
+        stem = _atomic_segment(parts[-1])
         is_package = stem in ("index", "mod")
         parts = parts[:-1] if is_package else [*parts[:-1], stem]
         return ".".join(p for p in parts if p) or "_root", is_package
@@ -358,10 +370,7 @@ class JavaScriptExtractor:
             if segment == "..":
                 parts = parts[:-1]
             else:
-                seg = segment
-                for ext in (".ts", ".tsx", ".js", ".jsx"):
-                    if seg.endswith(ext):
-                        seg = seg[: -len(ext)]
+                seg = _atomic_segment(segment)
                 if seg not in ("index", "mod"):
                     parts.append(seg)
         return ".".join(p for p in parts if p) or "_root"