graph-dependency-analyzer 0.2.0__py3-none-any.whl

src/domain/services/dependency_extractor.py

@@ -0,0 +1,962 @@
+"""DependencyExtractor domain service - extracts dependencies from code."""
+import re
+from typing import Optional
+
+from src.domain.entities.ast_node import ASTNode
+from src.domain.entities.dependency_graph import DependencyGraph, DependencyNode, DependencyEdge
+from src.domain.value_objects.dependency_type import DependencyType
+
+
+class DependencyExtractor:
+    """
+    Domain service for extracting dependencies from multiple sources.
+
+    Extracts:
+    - Internal dependencies from AST (imports, method calls)
+    - External libraries from build files (Maven, Gradle)
+    - API endpoints from config files and string literals
+    - Database connections from config files and JDBC strings
+
+    Note:
+        This is a domain service that orchestrates dependency extraction.
+        Actual parsing is delegated to infrastructure parsers (injected).
+    """
+
+    # Regex patterns for string literal detection (fallback)
+    URL_PATTERN = re.compile(r'https?://[^\s"\'<>]+')
+    JDBC_PATTERN = re.compile(r'jdbc:([^:]+)://([^:/\s"\']+):?(\d+)?/([^\s"\']+)')
+
+    def __init__(
+        self,
+        maven_parser=None,
+        gradle_parser=None,
+        config_parser=None,
+        typescript_parser=None,
+        npm_parser=None,
+        microfrontend_parser=None
+    ):
+        """
+        Initialize DependencyExtractor with optional parsers.
+
+        Args:
+            maven_parser: MavenDependencyParser instance (injected)
+            gradle_parser: GradleDependencyParser instance (injected)
+            config_parser: ConfigFileParser instance (injected)
+            typescript_parser: TreeSitterTypeScriptParser instance (injected) - Task 4.1
+            npm_parser: NpmPackageDependencyParser instance (injected) - Task 4.1
+            microfrontend_parser: MicrofrontendConfigParser instance (injected) - Task 4.1
+
+        Note:
+            Parsers are optional to maintain backward compatibility and allow
+            testing without full infrastructure setup.
+        """
+        self.maven_parser = maven_parser
+        self.gradle_parser = gradle_parser
+        self.config_parser = config_parser
+        self.typescript_parser = typescript_parser
+        self.npm_parser = npm_parser
+        self.microfrontend_parser = microfrontend_parser
+
+    def extract_dependencies(
+        self,
+        ast_nodes: list[ASTNode],
+        build_files: dict[str, str],
+        config_files: dict[str, str],
+        repository: str = "unknown",
+    ) -> DependencyGraph:
+        """
+        Extract dependencies from all sources.
+
+        Args:
+            ast_nodes: Parsed AST nodes from Tree-sitter
+            build_files: Build file contents (pom.xml, build.gradle)
+            config_files: Config file contents (application.properties, etc)
+            repository: Repository name — stored on DATABASE/API nodes for discovery
+
+        Returns:
+            DependencyGraph with extracted nodes and edges
+        """
+        graph = DependencyGraph()
+        self._current_repository = repository
+
+        # Extract from AST (internal dependencies)
+        self._extract_from_ast(ast_nodes, graph)
+
+        # Extract from build files (external libraries)
+        self._extract_from_build_files(build_files, graph)
+
+        # Extract from config files (APIs, databases, services)
+        self._extract_from_config_files(config_files, graph)
+
+        return graph
+
+    # DB object node types from SqlSchemaParser
+    _DB_OBJECT_TYPES = frozenset({
+        "DB_TABLE", "DB_VIEW", "DB_PROCEDURE", "DB_PACKAGE",
+        "DB_TRIGGER", "DB_SEQUENCE", "DB_FUNCTION", "DB_INDEX",
+        "DB_TYPE", "DB_COLLECTION",
+    })
+
+    def _extract_from_ast(self, ast_nodes: list[ASTNode], graph: DependencyGraph) -> None:
+        """Extract dependencies from AST nodes."""
+        for node in ast_nodes:
+            if node.node_type == "IMPORT":
+                self._handle_import_node(node, graph)
+            elif node.node_type == "METHOD_CALL":
+                self._handle_method_call_node(node, graph)
+            elif node.node_type == "API_CALL":
+                self._handle_api_call_node(node, graph)
+            elif node.node_type == "BACKEND_ENDPOINT":
+                self._handle_backend_endpoint_node(node, graph)
+            elif node.node_type in self._DB_OBJECT_TYPES:
+                self._handle_db_object_node(node, graph)
+            elif node.node_type == "DB_REF":
+                self._handle_db_ref_node(node, graph)
+            elif node.node_type == "CLASS":
+                # Persist CLASS nodes from any language (Groovy, Python, Java, TS)
+                # so they appear in the graph even if they have no imports.
+                self._handle_class_node(node, graph)
+            elif node.node_type == "METHOD":
+                # Check for URLs/JDBC in string literals (Task 4.2)
+                string_literals = node.metadata.get("string_literals", [])
+                self._extract_from_string_literals(string_literals, graph, source_node=node)
+
+    def _handle_class_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """
+        Persist a CLASS node from any language (Java, Python, Groovy, TS).
+        Called when a class has no imports — without this, the node would
+        never be created because _handle_import_node is the only place
+        that creates source nodes.
+        """
+        qname = node.qualified_name or node.name
+        if not qname or qname in ("Unknown", ""):
+            return
+
+        repo = node.metadata.get("repository",
+               getattr(self, "_current_repository", "unknown"))
+        lang = node.metadata.get("language", "unknown")
+        file_path = node.metadata.get("file_path", "")
+
+        # Only persist if the node isn't already in the graph
+        existing_ids = {n.id for n in graph.nodes}
+        if qname in existing_ids:
+            return
+
+        graph.add_node(DependencyNode(
+            id=qname,
+            node_type="CLASS",
+            properties={
+                "qualified_name": qname,
+                "name": node.name,
+                "type": DependencyType.INTERNAL_CLASS.value,
+                "repository": repo,
+                "language": lang,
+                "file_path": file_path,
+            }
+        ))
+
+    def _handle_import_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """Handle import statement node."""
+        import_path = node.metadata.get("import_path", node.qualified_name)
+        current_package = node.metadata.get("current_package", "")
+        file_path = node.metadata.get("file_path", "")
+        repository = node.metadata.get("repository", "unknown")
+
+        source_id = current_package if current_package else "unknown"
+        target_id = import_path
+
+        # Create source node (the class doing the import)
+        if source_id != "unknown":
+            source_node = DependencyNode(
+                id=source_id,
+                node_type="CLASS",
+                properties={
+                    "qualified_name": source_id,
+                    "type": DependencyType.INTERNAL_CLASS.value,
+                    "repository": repository,
+                    "file_path": file_path
+                }
+            )
+            graph.add_node(source_node)
+
+        # Create target node (the imported class)
+        target_node = DependencyNode(
+            id=target_id,
+            node_type="CLASS",
+            properties={
+                "qualified_name": target_id,
+                "type": DependencyType.INTERNAL_CLASS.value if not self._is_external_import(import_path) else DependencyType.LIBRARY.value,
+                "repository": repository if not self._is_external_import(import_path) else "external"
+            }
+        )
+        graph.add_node(target_node)
+
+        # Create edge for import
+        edge = DependencyEdge(
+            source=source_id,
+            target=target_id,
+            edge_type="IMPORTS",
+            properties={"line": node.line_start, "repository": repository}
+        )
+        graph.add_edge(edge)
+
+    def _handle_db_object_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """Store a DB schema object (table, view, procedure, package, etc.) as a graph node."""
+        repo = node.metadata.get("repository", getattr(self, "_current_repository", "unknown"))
+        dialect = node.metadata.get("dialect", "sql")
+        schema = node.metadata.get("schema", "")
+        columns = node.metadata.get("columns", [])
+
+        db_node = DependencyNode(
+            id=node.qualified_name,
+            node_type=node.node_type,
+            properties={
+                "qualified_name": node.qualified_name,
+                "name": node.name,
+                "schema": schema,
+                "dialect": dialect,
+                "repository": repo,
+                "file_path": node.metadata.get("file_path", ""),
+                "columns": ",".join(columns[:50]) if columns else "",
+                "type": node.node_type.lower(),
+            }
+        )
+        graph.add_node(db_node)
+
+        # Link to the repo node
+        graph.add_edge(DependencyEdge(
+            source=repo,
+            target=node.qualified_name,
+            edge_type="CONTAINS_DB_OBJECT",
+            properties={"object_type": node.node_type, "repository": repo},
+        ))
+
+    def _handle_db_ref_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """
+        Store a cross-object SQL reference (READS_TABLE, WRITES_TABLE, CALLS_PROCEDURE).
+
+        Source: the DB object that owns this file (procedure/package/trigger).
+                We look it up in the graph by file_path; fall back to file stem.
+        Target: the referenced table/procedure — always create a stub node so the
+                edge endpoint always exists in Neo4j (even for cross-schema refs).
+        """
+        from pathlib import Path as _Path
+        repo = node.metadata.get("repository", getattr(self, "_current_repository", "unknown"))
+        ref_type = node.metadata.get("ref_type", "READS_TABLE")
+        target = node.metadata.get("target", node.qualified_name)
+        file_path = node.metadata.get("file_path", "")
+
+        # Find the source node: look for a DB object in the same file
+        file_path_str = file_path
+        src_node = None
+        for n in graph.nodes:
+            if (n.node_type in self._DB_OBJECT_TYPES and
+                    n.properties.get("file_path") == file_path_str):
+                src_node = n
+                break
+
+        if src_node:
+            src_id = src_node.id
+        else:
+            # Fallback: use file stem as synthetic source node
+            src_id = _Path(file_path_str).stem.upper() if file_path_str else repo
+            # Create a stub CLASS node so the edge can be stored
+            if not any(n.id == src_id for n in graph.nodes):
+                graph.add_node(DependencyNode(
+                    id=src_id,
+                    node_type="DB_SCRIPT",
+                    properties={
+                        "qualified_name": src_id,
+                        "name": src_id,
+                        "repository": repo,
+                        "file_path": file_path_str,
+                        "type": "db_script",
+                    }
+                ))
+
+        if not target:
+            return
+
+        # Always create a stub node for the target if it doesn't exist yet.
+        # This ensures the Neo4j MATCH always succeeds for both endpoints.
+        if not any(n.id == target for n in graph.nodes):
+            # Infer type from ref_type
+            stub_type = "DB_PROCEDURE" if ref_type == "CALLS_PROCEDURE" else "DB_TABLE"
+            # Derive name and schema from qualified target
+            parts = target.split(".")
+            tgt_name = parts[-1]
+            tgt_schema = parts[0] if len(parts) > 1 else ""
+            graph.add_node(DependencyNode(
+                id=target,
+                node_type=stub_type,
+                properties={
+                    "qualified_name": target,
+                    "name": tgt_name,
+                    "schema": tgt_schema,
+                    "repository": repo,   # same repo — may be overwritten if owned elsewhere
+                    "type": stub_type.lower(),
+                    "is_stub": "true",    # marks as stub (inferred, not from DDL)
+                }
+            ))
+
+        graph.add_edge(DependencyEdge(
+            source=src_id,
+            target=target,
+            edge_type=ref_type,
+            properties={
+                "repository": repo,
+                "file_path": file_path_str,
+                "line": node.line_start,
+            },
+        ))
+
+    def _handle_api_call_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """Handle HTTP wrapper API call node — creates API + CALLS_API edge."""
+        api_path: str = node.metadata.get("api_path", "")
+        callee: str = node.metadata.get("callee", "")
+        repository: str = node.metadata.get("repository", "unknown")
+        file_path: str = node.metadata.get("file_path", "")
+
+        if not api_path:
+            return
+
+        # Normalise path — strip leading slash for consistency
+        endpoint = api_path.strip()
+
+        api_node = DependencyNode(
+            id=endpoint,
+            node_type="API",
+            properties={
+                "url": endpoint,
+                "qualified_name": endpoint,
+                "type": DependencyType.API.value,
+                "http_client": callee,
+            }
+        )
+        graph.add_node(api_node)
+
+        # Source CLASS node (the file that makes the call)
+        source_id = node.qualified_name
+        source_node = DependencyNode(
+            id=source_id,
+            node_type="CLASS",
+            properties={
+                "qualified_name": source_id,
+                "type": DependencyType.INTERNAL_CLASS.value,
+                "repository": repository,
+                "file_path": file_path,
+            }
+        )
+        graph.add_node(source_node)
+
+        edge = DependencyEdge(
+            source=source_id,
+            target=endpoint,
+            edge_type="CALLS_API",
+            properties={
+                "line": node.line_start,
+                "repository": repository,
+                "file_path": file_path,
+                "http_client": callee,
+            }
+        )
+        graph.add_edge(edge)
+
+    # Regex to normalise path params: /{id} and /:id → /{param}
+    _PARAM_RE = re.compile(r'/(?:\{[^}]+\}|:[^/]+)')
+
+    @staticmethod
+    def _normalise_path(path: str) -> str:
+        """Lowercase, strip leading slash, collapse path params to {p}."""
+        p = path.strip().lstrip("/").lower()
+        p = re.sub(r'(?:\{[^}]+\}|:[^/]+)', '{p}', p)
+        return p
+
+    def _handle_backend_endpoint_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """Store a Spring REST endpoint as an ENDPOINT node."""
+        path: str = node.metadata.get("path", "")
+        http_method: str = node.metadata.get("http_method", "ANY")
+        repository: str = node.metadata.get("repository", "unknown")
+        file_path: str = node.metadata.get("file_path", "")
+        class_name: str = node.metadata.get("class_name", "")
+        method_name: str = node.metadata.get("method_name", "")
+
+        if not path:
+            return
+
+        endpoint_id = f"{repository}:{http_method}:{path}"
+        ep_node = DependencyNode(
+            id=endpoint_id,
+            node_type="ENDPOINT",
+            properties={
+                "url": path,
+                "qualified_name": endpoint_id,
+                "http_method": http_method,
+                "type": "endpoint",
+                "repository": repository,
+                "file_path": file_path,
+                "class_name": class_name,
+                "method_name": method_name,
+                "path_normalised": self._normalise_path(path),
+            }
+        )
+        graph.add_node(ep_node)
+
+        # Link ENDPOINT to the class that declares it
+        if class_name:
+            class_node = DependencyNode(
+                id=class_name,
+                node_type="CLASS",
+                properties={
+                    "qualified_name": class_name,
+                    "type": DependencyType.INTERNAL_CLASS.value,
+                    "repository": repository,
+                    "file_path": file_path,
+                }
+            )
+            graph.add_node(class_node)
+            graph.add_edge(DependencyEdge(
+                source=class_name,
+                target=endpoint_id,
+                edge_type="EXPOSES",
+                properties={"repository": repository}
+            ))
+
+    def link_cross_language(self, graph: DependencyGraph) -> int:
+        """
+        Generic cross-language linker: match frontend API nodes to backend ENDPOINT nodes.
+
+        Matching strategy (framework-agnostic):
+        - Normalise both paths: lowercase, strip leading '/', collapse {id}/:id → {p}
+        - Consider a match when the normalised frontend path is a suffix of (or equal to)
+          the normalised backend path — handles base-URL prefix differences.
+
+        Returns number of CALLS_BACKEND edges created.
+        """
+        api_nodes = [n for n in graph.nodes if n.node_type == "API"]
+        endpoint_nodes = [n for n in graph.nodes if n.node_type == "ENDPOINT"]
+
+        if not api_nodes or not endpoint_nodes:
+            return 0
+
+        # Build index: normalised_path -> endpoint_id
+        ep_index: dict[str, str] = {}
+        for ep in endpoint_nodes:
+            norm = ep.properties.get("path_normalised") or self._normalise_path(
+                ep.properties.get("url", "")
+            )
+            ep_index[norm] = ep.id
+
+        # Build edge map: api_node -> [caller_ids]
+        caller_map: dict[str, list[str]] = {}
+        for edge in graph.edges:
+            if edge.edge_type == "CALLS_API":
+                caller_map.setdefault(edge.target, []).append(edge.source)
+
+        created = 0
+        for api in api_nodes:
+            api_norm = self._normalise_path(api.properties.get("url", ""))
+            if not api_norm:
+                continue
+
+            # Find matching endpoints (suffix match)
+            for ep_norm, ep_id in ep_index.items():
+                if api_norm == ep_norm or ep_norm.endswith("/" + api_norm):
+                    # Create CALLS_BACKEND for each caller of this API node
+                    for caller_id in caller_map.get(api.id, [api.id]):
+                        edge = DependencyEdge(
+                            source=caller_id,
+                            target=ep_id,
+                            edge_type="CALLS_BACKEND",
+                            properties={
+                                "frontend_path": api.properties.get("url", ""),
+                                "backend_path": ep_id.split(":", 2)[-1] if ":" in ep_id else ep_id,
+                                "match": "path_suffix",
+                            }
+                        )
+                        graph.add_edge(edge)
+                        created += 1
+
+        return created
+
+    def _handle_method_call_node(self, node: ASTNode, graph: DependencyGraph) -> None:
+        """Handle method call node."""
+        caller = node.metadata.get("caller")
+        callee = node.metadata.get("callee")
+        repository = node.metadata.get("repository", "unknown")
+
+        if caller and callee:
+            # Create caller node (method doing the call)
+            caller_node = DependencyNode(
+                id=caller,
+                node_type="METHOD",
+                properties={
+                    "qualified_name": caller,
+                    "type": DependencyType.INTERNAL_METHOD.value,
+                    "repository": repository
+                }
+            )
+            graph.add_node(caller_node)
+
+            # Create callee node (method being called)
+            callee_node = DependencyNode(
+                id=callee,
+                node_type="METHOD",
+                properties={
+                    "qualified_name": callee,
+                    "type": DependencyType.INTERNAL_METHOD.value,
+                    "repository": repository
+                }
+            )
+            graph.add_node(callee_node)
+
+            # Create edge for call
+            edge = DependencyEdge(
+                source=caller,
+                target=callee,
+                edge_type="CALLS",
+                properties={"line": node.line_start, "repository": repository}
+            )
+            graph.add_edge(edge)
+
+    def _extract_from_build_files(self, build_files: dict[str, str], graph: DependencyGraph) -> None:
+        """Extract library dependencies from build files using specialized parsers."""
+        for filename, content in build_files.items():
+            if filename.endswith("pom.xml"):
+                self._extract_maven_dependencies(content, graph)
+            elif filename.endswith((".gradle", ".gradle.kts")):
+                self._extract_gradle_dependencies(content, graph)
+
+    def _extract_maven_dependencies(self, content: str, graph: DependencyGraph) -> None:
+        """
+        Extract dependencies from Maven pom.xml using MavenDependencyParser.
+
+        Falls back to simple regex if parser not available.
+        """
+        if self.maven_parser:
+            # Use specialized parser (preferred)
+            dependencies = self.maven_parser.parse(content)
+
+            for dep in dependencies:
+                node = DependencyNode(
+                    id=f"{dep['group_id']}:{dep['artifact_id']}",
+                    node_type="LIBRARY",
+                    properties={
+                        "group_id": dep["group_id"],
+                        "artifact_id": dep["artifact_id"],
+                        "version": dep["version"],
+                        "scope": dep["scope"],
+                        "type": DependencyType.LIBRARY.value
+                    }
+                )
+                graph.add_node(node)
+        else:
+            # Fallback to regex (legacy compatibility)
+            self._extract_maven_dependencies_regex(content, graph)
+
+    def _extract_maven_dependencies_regex(self, content: str, graph: DependencyGraph) -> None:
+        """Fallback regex-based Maven extraction (legacy)."""
+        pattern = re.compile(
+            r'<groupId>([^<]+)</groupId>.*?<artifactId>([^<]+)</artifactId>',
+            re.DOTALL
+        )
+        matches = pattern.findall(content)
+
+        for group_id, artifact_id in matches:
+            # Skip test dependencies
+            if "test" in content[max(0, content.find(group_id)-100):content.find(group_id)+100].lower():
+                continue
+
+            node = DependencyNode(
+                id=f"{group_id}:{artifact_id}",
+                node_type="LIBRARY",
+                properties={
+                    "group_id": group_id.strip(),
+                    "artifact_id": artifact_id.strip(),
+                    "type": DependencyType.LIBRARY.value
+                }
+            )
+            graph.add_node(node)
+
+    def _extract_gradle_dependencies(self, content: str, graph: DependencyGraph) -> None:
+        """
+        Extract dependencies from Gradle build files using GradleDependencyParser.
+
+        Falls back to simple regex if parser not available.
+        """
+        if self.gradle_parser:
+            # Use specialized parser (preferred)
+            dependencies = self.gradle_parser.parse(content)
+
+            for dep in dependencies:
+                node = DependencyNode(
+                    id=f"{dep['group_id']}:{dep['artifact_id']}",
+                    node_type="LIBRARY",
+                    properties={
+                        "group_id": dep["group_id"],
+                        "artifact_id": dep["artifact_id"],
+                        "version": dep["version"],
+                        "scope": dep["scope"],
+                        "type": DependencyType.LIBRARY.value
+                    }
+                )
+                graph.add_node(node)
+        else:
+            # Fallback to regex (legacy compatibility)
+            self._extract_gradle_dependencies_regex(content, graph)
+
+    def _extract_gradle_dependencies_regex(self, content: str, graph: DependencyGraph) -> None:
+        """Fallback regex-based Gradle extraction (legacy)."""
+        pattern = re.compile(
+            r"(?:implementation|api|compileOnly|runtimeOnly)\s+['\"]([^:'\"]+):([^:'\"]+)(?::([^'\"]+))?['\"]"
+        )
+        matches = pattern.findall(content)
+
+        for group_id, artifact_id, version in matches:
+            node = DependencyNode(
+                id=f"{group_id}:{artifact_id}",
+                node_type="LIBRARY",
+                properties={
+                    "group_id": group_id,
+                    "artifact_id": artifact_id,
+                    "version": version if version else "unspecified",
+                    "type": DependencyType.LIBRARY.value
+                }
+            )
+            graph.add_node(node)
+
+    def _extract_from_config_files(self, config_files: dict[str, str], graph: DependencyGraph) -> None:
+        """
+        Extract API and DB dependencies from config files using ConfigFileParser.
+
+        Falls back to regex if parser not available.
+        """
+        if self.config_parser:
+            # Use specialized parser (preferred)
+            for filename, content in config_files.items():
+                fname_lower = filename.lower()
+                if fname_lower.endswith(".properties"):
+                    result = self.config_parser.parse_properties(content)
+                elif fname_lower.endswith((".yml", ".yaml")):
+                    result = self.config_parser.parse_yaml(content)
+                elif fname_lower.endswith(".env") or "/.env" in fname_lower or fname_lower.startswith(".env"):
+                    result = self.config_parser.parse_env(content)
+                else:
+                    continue
+
+                # Add databases
+                for db in result.databases:
+                    self._add_database_from_parsed(db, graph)
+
+                # Add APIs
+                for api in result.apis:
+                    self._add_api_node(api["url"], graph)
+
+                # Add services
+                for service in result.services:
+                    self._add_service_node(service["name"], graph)
+        else:
+            # Fallback to regex (legacy compatibility)
+            self._extract_from_config_files_regex(config_files, graph)
+
+    def _extract_from_config_files_regex(self, config_files: dict[str, str], graph: DependencyGraph) -> None:
+        """Fallback regex-based config extraction (legacy)."""
+        for filename, content in config_files.items():
+            # Extract HTTP/HTTPS URLs
+            url_matches = self.URL_PATTERN.findall(content)
+            for url in url_matches:
+                self._add_api_node(url, graph)
+
+            # Extract JDBC connections
+            jdbc_matches = self.JDBC_PATTERN.findall(content)
+            repo = getattr(self, "_current_repository", "unknown")
+            for db_type, host, port, database in jdbc_matches:
+                self._add_database_node(db_type, host, port or "default", database, graph, repo)
+
+    def _extract_from_string_literals(
+        self,
+        string_literals: list[str],
+        graph: DependencyGraph,
+        source_node: Optional[ASTNode] = None
+    ) -> None:
+        """
+        Extract URLs and JDBC strings from string literals (Task 4.2).
+
+        Args:
+            string_literals: List of string literals from code
+            graph: Dependency graph to add nodes/edges to
+            source_node: Optional source ASTNode (component/method calling the API)
+        """
+        for literal in string_literals:
+            # Check for HTTP/HTTPS URLs
+            url_matches = self.URL_PATTERN.findall(literal)
+            for url in url_matches:
+                self._add_api_node(url, graph, source_node)
+
+            # Check for JDBC strings
+            jdbc_matches = self.JDBC_PATTERN.findall(literal)
+            repo = getattr(self, "_current_repository", "unknown")
+            for db_type, host, port, database in jdbc_matches:
+                self._add_database_node(db_type, host, port or "default", database, graph, repo)
+
+    def _add_api_node(
+        self,
+        url: str,
+        graph: DependencyGraph,
+        source_node: Optional[ASTNode] = None
+    ) -> None:
+        """
+        Add API node to graph and create CALLS_API edge if source provided (Task 4.2).
+
+        Args:
+            url: API URL
+            graph: Dependency graph
+            source_node: Optional component/method calling this API
+        """
+        # Extract base URL (without query params)
+        base_url = url.split('?')[0]
+
+        # Create API node
+        repo = getattr(self, "_current_repository", "unknown")
+        api_node = DependencyNode(
+            id=base_url,
+            node_type="API",
+            properties={
+                "url": base_url,
+                "qualified_name": base_url,
+                "type": DependencyType.API.value,
+                "repository": repo,
+            }
+        )
+        graph.add_node(api_node)
+
+        # Create CALLS_API edge if source is provided
+        if source_node:
+            repository = source_node.metadata.get("repository", "unknown")
+            edge = DependencyEdge(
+                source=source_node.qualified_name,
+                target=base_url,
+                edge_type="CALLS_API",
+                properties={
+                    "line": source_node.line_start,
+                    "repository": repository,
+                    "file_path": source_node.metadata.get("file_path", "")
+                }
+            )
+            graph.add_edge(edge)
+
+    def _add_database_from_parsed(self, db_info: dict, graph: DependencyGraph) -> None:
+        """Add database node from parsed config info."""
+        url = db_info["url"]
+        repo = getattr(self, "_current_repository", "unknown")
+
+        # Extract components from JDBC URL
+        jdbc_match = self.JDBC_PATTERN.match(url)
+        if jdbc_match:
+            db_type, host, port, database = jdbc_match.groups()
+            self._add_database_node(db_type, host, port or "default", database, graph, repo)
+        else:
+            node = DependencyNode(
+                id=url,
+                node_type="DATABASE",
+                properties={
+                    "type": DependencyType.DATABASE.value,
+                    "url": url,
+                    "repository": repo,
+                }
+            )
+            graph.add_node(node)
+
+    def _add_database_node(
+        self, db_type: str, host: str, port: str, database: str,
+        graph: DependencyGraph, repository: str = "unknown"
+    ) -> None:
+        """Add DATABASE node to graph."""
+        node_id = f"jdbc:{db_type}://{host}:{port}/{database}"
+
+        node = DependencyNode(
+            id=node_id,
+            node_type="DATABASE",
+            properties={
+                "type": DependencyType.DATABASE.value,
+                "db_type": db_type,
+                "host": host,
+                "port": port,
+                "database": database,
+                "repository": repository,
+            }
+        )
+        graph.add_node(node)
+
+    def _add_service_node(self, service_name: str, graph: DependencyGraph) -> None:
+        """Add MICROSERVICE node to graph."""
+        node = DependencyNode(
+            id=service_name,
+            node_type="MICROSERVICE",
+            properties={
+                "name": service_name,
+                "type": DependencyType.MICROSERVICE.value
+            }
+        )
+        graph.add_node(node)
+
+    def extract_frontend_dependencies(
+        self,
+        typescript_nodes: list,
+        npm_files: dict[str, str] = None
+    ) -> DependencyGraph:
+        """
+        Extract frontend dependencies from TypeScript/JavaScript code (Task 4.1).
+
+        Args:
+            typescript_nodes: Parsed TypeScript/JavaScript AST result dicts
+            npm_files: NPM package files (package.json, package-lock.json)
+
+        Returns:
+            DependencyGraph with frontend dependencies
+        """
+        graph = DependencyGraph()
+
+        # Extract from TypeScript imports
+        if self.typescript_parser and typescript_nodes:
+            self._extract_from_typescript_nodes(typescript_nodes, graph)
+
+        # Extract from NPM files
+        if self.npm_parser and npm_files:
+            self._extract_from_npm_files(npm_files, graph)
+
+        return graph
+
+    def _extract_from_typescript_nodes(self, nodes: list, graph: DependencyGraph) -> None:
+        """Extract dependencies from TypeScript parse results."""
+        for parse_result in nodes:
+            file_path = str(parse_result.file_path) if hasattr(parse_result, 'file_path') else "unknown"
+
+            # Extract imports
+            for imp in (parse_result.imports if hasattr(parse_result, 'imports') else []):
+                module_path = imp.get("module_path", "")
+                if module_path:
+                    dep_node = DependencyNode(
+                        id=module_path,
+                        node_type="MODULE",
+                        properties={
+                            "module_path": module_path,
+                            "import_type": imp.get("import_type", ""),
+                            "type": "MODULE"
+                        }
+                    )
+                    graph.add_node(dep_node)
+
+    def _extract_from_npm_files(self, npm_files: dict[str, str], graph: DependencyGraph) -> None:
+        """Extract NPM package dependencies."""
+        for file_name, content in npm_files.items():
+            if "package.json" in file_name:
+                try:
+                    packages = self.npm_parser.parse_package_json(content)
+                    for pkg in packages:
+                        node = DependencyNode(
+                            id=pkg["name"],
+                            node_type="NPM_PACKAGE",
+                            properties={
+                                "name": pkg["name"],
+                                "version": pkg["version"],
+                                "scope": pkg["scope"],
+                                "type": DependencyType.LIBRARY.value
+                            }
+                        )
+                        graph.add_node(node)
+                except Exception:
+                    pass  # Skip malformed files
+
+    def _is_external_import(self, import_path: str) -> bool:
+        """
+        Determine if an import is external (library) or internal (project code).
+
+        Rules (language-agnostic):
+        - Relative paths (start with . or /) → always internal
+        - npm scoped packages (@scope/pkg) → always external
+        - npm bare packages with no dots/slashes that aren't relative → external
+        - Java well-known prefixes → external
+        """
+        if not import_path:
+            return False
+
+        # Relative imports are always internal
+        if import_path.startswith(".") or import_path.startswith("/"):
+            return False
+
+        # npm scoped packages: @scope/package
+        if import_path.startswith("@"):
+            return True
+
+        # Java external prefixes
+        java_external = [
+            "java.", "javax.", "jakarta.",
+            "org.springframework.", "org.apache.", "org.hibernate.",
+            "com.google.", "com.fasterxml.", "com.amazonaws.",
+            "io.netty.", "io.grpc.", "io.micrometer.",
+            "lombok.", "slf4j.", "logback.",
+        ]
+        if any(import_path.startswith(p) for p in java_external):
+            return True
+
+        # Python well-known external packages
+        python_external_prefixes = [
+            # Azure SDK
+            "azure.", "msrest.", "msal.",
+            # AWS
+            "boto3.", "botocore.", "aws_cdk.",
+            # Google
+            "google.", "googleapiclient.",
+            # Web frameworks
+            "fastapi.", "flask.", "django.", "starlette.", "uvicorn.",
+            # HTTP clients
+            "requests.", "httpx.", "aiohttp.", "urllib3.",
+            # Data / ML
+            "pandas.", "numpy.", "sklearn.", "tensorflow.", "torch.",
+            "pydantic.", "sqlalchemy.", "alembic.",
+            # Testing
+            "pytest.", "unittest.", "mock.",
+            # Infra
+            "docker.", "kubernetes.", "ansible.",
+            # Other common libs
+            "yaml.", "dotenv.", "celery.", "redis.", "pymongo.",
+            "psycopg2.", "asyncpg.", "motor.",
+        ]
+        if any(import_path.startswith(p) for p in python_external_prefixes):
+            return True
+
+        # Python stdlib single-word modules → external
+        python_stdlib = {
+            "os", "sys", "re", "json", "pathlib", "typing", "datetime",
+            "collections", "itertools", "functools", "abc", "io", "math",
+            "random", "hashlib", "base64", "subprocess", "threading",
+            "asyncio", "logging", "argparse", "shutil", "tempfile",
+            "urllib", "http", "email", "csv", "xml", "html",
+            "time", "copy", "enum", "dataclasses", "contextlib",
+            "inspect", "traceback", "warnings", "platform", "socket",
+            "struct", "codecs", "unicodedata", "string", "textwrap",
+        }
+        first_segment = import_path.split(".")[0].split("/")[0]
+        if first_segment in python_stdlib:
+            return True
+
+        # npm/JS bare package names (no dots, no slashes) → external
+        # BUT only if it's clearly a JS package (lowercase, hyphens allowed)
+        # Skip Python module names that happen to have no dots (they're internal)
+        if "/" not in import_path and "." not in import_path:
+            # Heuristic: JS packages are typically lowercase with hyphens
+            # and are imported in JS/TS files. Python internal modules
+            # use underscores. We conservatively mark as external only
+            # if it doesn't look like a Python internal name.
+            # Since we can't know the language here, mark as external
+            # only for clearly external names (well-known JS libs or
+            # npm-style names with hyphens).
+            if "-" in import_path:
+                return True  # npm-style: react-dom, @scope/pkg
+            # Single word without hyphen — could be Python internal or npm
+            # For safety: keep existing behavior (mark as external) since
+            # it was working correctly for Java/TS before this change.
+            return True
+
+        return False