@backthread/extractor 0.1.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AACrE,wBAAwB;AACxB,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,mEAAmE;AAEnE,0BAA0B;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,+DAA+D;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,sDAAsD;AACtD,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAWpB,2CAA2C;AAC3C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAQ3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAW/B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEpH,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,0DAA0D;AAC1D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEzF,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AAStC,OAAO,EACL,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC,2BAA2B;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,iFAAiF;AACjF,4EAA4E;AAC5E,mFAAmF;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAgB7D,kDAAkD;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAOrD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAU1G,mDAAmD;AACnD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/infra/aws/aws-parse.d.ts

@@ -0,0 +1,39 @@
+export interface CfnResource {
+    /** CloudFormation logical ID (the map key under `Resources:`). */
+    logicalId: string;
+    /** AWS resource type, e.g. `AWS::Lambda::Function`. */
+    type: string;
+    /**
+     * Raw text representation of this resource's block — used for reference
+     * scanning. We JSON-serialize the parsed JS value so tag quirks (which may
+     * leave some values as strings like "!Ref Foo") are preserved as-is and
+     * still searchable.
+     */
+    rawText: string;
+    /**
+     * Source discriminator: 'cfn' for resources from CloudFormation/SAM
+     * Resources blocks; 'serverless-fn' for synthetic Lambda nodes synthesized
+     * from a Serverless Framework `functions:` block. Used by aws.ts to
+     * namespace node IDs and avoid collisions between the two flat namespaces.
+     */
+    source: 'cfn' | 'serverless-fn';
+    /**
+     * repo-relative dir of the template/serverless file this resource came
+     * from ('' = repo root). parseCfnTemplate/parseServerlessConfig don't set it
+     * (they parse one text blob); aws.ts's extract() stamps it per file so a SAM
+     * `CodeUri` resolves against the template dir. Optional for back-compat.
+     */
+    dir?: string;
+}
+/**
+ * Parse a CloudFormation or SAM template from text (YAML or JSON).
+ * Returns [] (never throws) on any parse failure — callers skip-and-warn.
+ */
+export declare function parseCfnTemplate(text: string): CfnResource[];
+export declare function parseServerlessConfig(text: string): CfnResource[];
+/** Returns true if the text looks like a CloudFormation template.
+ * Accepts both YAML (`AWSTemplateFormatVersion: '...'`, `Transform: AWS::Serverless`)
+ * and JSON (`"AWSTemplateFormatVersion"`, `"Transform": "AWS::Serverless-2016-10-31"`).
+ */
+export declare function isCfnTemplate(text: string): boolean;
+//# sourceMappingURL=aws-parse.d.ts.map

package/dist/infra/aws/aws-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-parse.d.ts","sourceRoot":"","sources":["../../../src/infra/aws/aws-parse.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,MAAM,EAAE,KAAK,GAAG,eAAe,CAAC;IAChC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAY5D;AAsBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAmCjE;AAKD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/infra/aws/aws-parse.js

@@ -0,0 +1,149 @@
+// AWS-native cluster adapter: CloudFormation/SAM/serverless.yml parser.
+//
+// Parses CloudFormation (YAML/JSON), SAM templates, synthesized CDK templates
+// (cdk.out/*.template.json — which ARE just CFN JSON), and Serverless Framework
+// (serverless.yml) into a flat list of { logicalId, type, rawText } records.
+//
+// CloudFormation YAML CAVEAT: CFN templates use YAML intrinsic short-form tags
+// (!Ref, !GetAtt, !Sub, !Join, !Select, !If, !Equals, etc.). The `yaml`
+// package v2 handles unknown tags gracefully when `logLevel: 'silent'` is set:
+// scalar-tagged nodes resolve to their raw scalar value string, so
+// `!Ref OrdersTable` → the string `"OrdersTable"` and
+// `!GetAtt AssetsBucket.Arn` → the string `"AssetsBucket.Arn"`.
+// This is exactly what we need: the logicalId appears in the JSON-serialized
+// rawText as a quoted string value (or as a prefix of "Id.Attr" for GetAtt),
+// enabling correct reference detection. Registering custom tags that return
+// empty strings would ERASE the reference information we need, so we use
+// logLevel:'silent' only.
+//
+// v0 scope: implemented here — CFN YAML/JSON, SAM, serverless.yml, cdk.out.
+// DEFERRED: raw ECS task-def JSON (no declarative resource map), Elastic
+// Beanstalk .elasticbeanstalk/config.yml (deployment config, not topology),
+// CDK TypeScript source (synthesized cdk.out is handled as CFN JSON).
+import { parse as parseYaml } from 'yaml';
+// ---------------------------------------------------------------------------
+// Internal helpers.
+function tryParseYaml(text) {
+    // Use logLevel:'silent' — yaml v2 resolves unknown tags (!Ref, !GetAtt, etc.)
+    // to their scalar string value instead of throwing. This preserves the
+    // logicalId references we need for edge detection in rawText.
+    try {
+        return parseYaml(text, { logLevel: 'silent' });
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract CfnResource[] from a parsed CloudFormation/SAM template object. */
+function extractFromCfnObject(obj) {
+    if (!obj || typeof obj !== 'object')
+        return [];
+    const top = obj;
+    const resources = top['Resources'];
+    if (!resources || typeof resources !== 'object')
+        return [];
+    const map = resources;
+    const out = [];
+    for (const [logicalId, entry] of Object.entries(map)) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        const type = typeof e['Type'] === 'string' ? e['Type'] : undefined;
+        if (!type)
+            continue;
+        // Serialize the whole resource block as the raw text for reference scanning.
+        let rawText;
+        try {
+            rawText = JSON.stringify(e);
+        }
+        catch {
+            rawText = String(e);
+        }
+        out.push({ logicalId, type, rawText, source: 'cfn' });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Public: parse a CFN/SAM template (YAML or JSON).
+/**
+ * Parse a CloudFormation or SAM template from text (YAML or JSON).
+ * Returns [] (never throws) on any parse failure — callers skip-and-warn.
+ */
+export function parseCfnTemplate(text) {
+    // Attempt JSON first (CDK synthesized output, plain CFN JSON).
+    try {
+        const obj = JSON.parse(text);
+        const result = extractFromCfnObject(obj);
+        if (result.length > 0)
+            return result;
+    }
+    catch {
+        // not JSON
+    }
+    // Try YAML (CFN YAML, SAM templates).
+    const obj = tryParseYaml(text);
+    return extractFromCfnObject(obj);
+}
+// ---------------------------------------------------------------------------
+// Public: parse a Serverless Framework serverless.yml.
+//
+// Serverless Framework format:
+//   provider:
+//     name: aws
+//   functions:
+//     myFunction:
+//       handler: handler.main
+//       ...
+//   resources:
+//     Resources:
+//       MyTable:
+//         Type: AWS::DynamoDB::Table
+//         ...
+//
+// We synthesize:
+//   - One AWS::Lambda::Function node per `functions:` entry.
+//   - All raw CFN resources under `resources.Resources`.
+export function parseServerlessConfig(text) {
+    const obj = tryParseYaml(text);
+    if (!obj || typeof obj !== 'object')
+        return [];
+    const top = obj;
+    const out = [];
+    // Functions → synthetic Lambda nodes.
+    const functions = top['functions'];
+    if (functions && typeof functions === 'object' && !Array.isArray(functions)) {
+        const fns = functions;
+        for (const [fnName, fnDef] of Object.entries(fns)) {
+            let rawText;
+            try {
+                rawText = JSON.stringify(fnDef ?? {});
+            }
+            catch {
+                rawText = '{}';
+            }
+            out.push({
+                logicalId: fnName,
+                type: 'AWS::Lambda::Function',
+                rawText,
+                source: 'serverless-fn',
+            });
+        }
+    }
+    // resources.Resources → raw CFN passthrough.
+    const resBlock = top['resources'];
+    if (resBlock && typeof resBlock === 'object') {
+        const synth = { Resources: resBlock['Resources'] };
+        out.push(...extractFromCfnObject(synth));
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Detect helpers (used by the bounded walk in aws.ts).
+/** Returns true if the text looks like a CloudFormation template.
+ * Accepts both YAML (`AWSTemplateFormatVersion: '...'`, `Transform: AWS::Serverless`)
+ * and JSON (`"AWSTemplateFormatVersion"`, `"Transform": "AWS::Serverless-2016-10-31"`).
+ */
+export function isCfnTemplate(text) {
+    return text.includes('AWSTemplateFormatVersion') || text.includes('AWS::Serverless');
+}
+//# sourceMappingURL=aws-parse.js.map

package/dist/infra/aws/aws-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-parse.js","sourceRoot":"","sources":["../../../src/infra/aws/aws-parse.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,mEAAmE;AACnE,sDAAsD;AACtD,gEAAgE;AAChE,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,0BAA0B;AAC1B,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AAEtE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAiC1C,8EAA8E;AAC9E,oBAAoB;AAEpB,SAAS,YAAY,CAAC,IAAY;IAChC,8EAA8E;IAC9E,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAoC,CAAC;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,6EAA6E;QAC7E,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,mDAAmD;AAEnD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IACD,sCAAsC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,+BAA+B;AAC/B,cAAc;AACd,gBAAgB;AAChB,eAAe;AACf,kBAAkB;AAClB,8BAA8B;AAC9B,YAAY;AACZ,eAAe;AACf,iBAAiB;AACjB,iBAAiB;AACjB,qCAAqC;AACrC,cAAc;AACd,EAAE;AACF,iBAAiB;AACjB,6DAA6D;AAC7D,yDAAyD;AAEzD,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAE9B,sCAAsC;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,SAAoC,CAAC;QACjD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO;gBACP,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,KAAK,GAA4B,EAAE,SAAS,EAAG,QAAoC,CAAC,WAAW,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AACvF,CAAC"}

package/dist/infra/aws/aws.d.ts

@@ -0,0 +1,6 @@
+import type { InfraAdapter, InfraGraph } from '../types.js';
+import { type DockerfileIndex } from '../image-resolve.js';
+import { type CfnResource } from './aws-parse.js';
+export declare function buildAwsGraph(templates: CfnResource[], root: string, dockerfileIndex?: DockerfileIndex): InfraGraph;
+export declare const awsAdapter: InfraAdapter;
+//# sourceMappingURL=aws.d.ts.map

package/dist/infra/aws/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/infra/aws/aws.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAa,UAAU,EAAgC,MAAM,aAAa,CAAC;AAGrG,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAA0D,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA2R1G,wBAAgB,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,eAAe,GAAG,UAAU,CAyDnH;AAKD,eAAO,MAAM,UAAU,EAAE,YAkExB,CAAC"}

package/dist/infra/aws/aws.js

@@ -0,0 +1,425 @@
+// AWS-native cluster InfraAdapter (v0).
+//
+// Covers: CloudFormation YAML/JSON, SAM templates (AWS::Serverless::*),
+// Serverless Framework (serverless.yml/yaml), and synthesized CDK output
+// (cdk.out/*.template.json — which is plain CFN JSON, so it's handled
+// automatically by parseCfnTemplate).
+//
+// DEFERRED (tracked under  expansion):
+//   * Raw ECS task-def JSON — no declarative resource map, topology requires
+//     ecs-compose or task-def relationship analysis, not a single template.
+//   * Elastic Beanstalk .elasticbeanstalk/config.yml — describes deployment
+//     environment, not the application topology. Worth a separate adapter when
+//     EB repos appear in the corpus.
+//   * CDK TypeScript source — synthesized cdk.out/*.template.json is CFN JSON
+//     and IS handled here. Raw CDK source (constructs) would need CDK API
+//     analysis; the synthesized output is the authoritative topology.
+//
+// Architecture mirrors terraform.ts:
+//   - Open-ended AWS resource types → heuristic `inferred` kind.
+//   - Per-resource `classificationsNeeded` entry (provider: 'aws/cloudformation').
+//     This SHARES the aws taxonomy with terraform (provider prefix 'aws/...' on
+//     both sides is intentional: the  cache key is (provider, resourceType),
+//     so an `aws_lambda_function` from Terraform and an `AWS::Lambda::Function`
+//     from CFN use DIFFERENT keys — they're different type namespaces).
+//   - Cross-resource edges via reference-surface scan (Ref/GetAtt/DependsOn/Sub).
+//
+// Node ids are adapter-local; the registry prefixes 'aws:' at merge time.
+import { readFileSync } from 'node:fs';
+import { relative, sep } from 'node:path';
+import { walkRepo } from '../walk.js';
+import { buildDockerfileIndex, resolveImageToSourceRoots } from '../image-resolve.js';
+import { parseCfnTemplate, parseServerlessConfig, isCfnTemplate } from './aws-parse.js';
+// ---------------------------------------------------------------------------
+// Source-root extraction. Deterministic, no LLM.
+//   * SAM/Lambda `CodeUri` (a local dir/zip) → that dir.
+//   * ECS task-def container `Image` → the  resolver.
+// CodeUri resolves against the template's dir; an s3:// CodeUri or a `${…}`
+// intrinsic is unresolvable → skipped (honest "Other", never guess).
+/** Normalize a repo-relative path: backslashes→/, collapse `.`/`./`, strip trailing `/`. */
+function normalizeRoot(p) {
+    return p.replace(/\\/g, '/').replace(/^\.(?:\/|$)/, '').replace(/\/+$/, '');
+}
+/** The repo-relative directory of a repo-relative file path ('' = repo root). */
+function dirOfPath(relPath) {
+    const n = normalizeRoot(relPath);
+    const i = n.lastIndexOf('/');
+    return i === -1 ? '' : n.slice(0, i);
+}
+/** Resolve `rel` against repo-relative `baseDir` → normalized. */
+function resolveRel(baseDir, rel) {
+    const parts = (baseDir ? baseDir.split('/') : []).concat(rel.split('/'));
+    const out = [];
+    for (const p of parts) {
+        if (p === '' || p === '.')
+            continue;
+        if (p === '..')
+            out.pop();
+        else
+            out.push(p);
+    }
+    return out.join('/');
+}
+/** A CodeUri path → its source dir: a built artifact (.zip/.jar) → its dir; else the dir itself. */
+function codeUriToDir(p) {
+    return /\.(zip|jar)$/i.test(p) ? dirOfPath(p) : normalizeRoot(p);
+}
+function awsSourceRoots(rawText, moduleDir, index) {
+    const roots = new Set();
+    // (1) SAM/Lambda CodeUri (skip s3:// remote packages + ${…} intrinsics).
+    const codeUriRe = /"CodeUri"\s*:\s*"([^"]+)"/g;
+    let m;
+    while ((m = codeUriRe.exec(rawText)) !== null) {
+        const v = m[1];
+        if (/^s3:\/\//i.test(v) || v.includes('${'))
+            continue;
+        const d = codeUriToDir(resolveRel(moduleDir, v));
+        if (d)
+            roots.add(d);
+    }
+    // (2) ECS task-def (and any) container Image refs → resolver.
+    if (index) {
+        const imageRe = /"Image"\s*:\s*"([^"]+)"/g;
+        while ((m = imageRe.exec(rawText)) !== null) {
+            const v = m[1];
+            if (v.includes('${'))
+                continue;
+            for (const r of resolveImageToSourceRoots(v, index))
+                roots.add(r);
+        }
+    }
+    return [...roots].sort();
+}
+// ---------------------------------------------------------------------------
+// File discovery constants.
+// `cdk.out` is deliberately NOT skipped — it holds synthesized CFN JSON we want.
+const AWS_SKIP_DIRS = ['node_modules', '.git', 'dist', '.wrangler', '.next', 'build', 'coverage', '__pycache__', '.venv', 'vendor'];
+// Names that always denote a Serverless Framework config.
+const SERVERLESS_CONFIG_NAMES = new Set(['serverless.yml', 'serverless.yaml']);
+// Names that are candidate CFN template files (heuristic; we check content).
+const TEMPLATE_NAMES = new Set([
+    'template.yaml', 'template.yml', 'template.json',
+    'cloudformation.yaml', 'cloudformation.yml', 'cloudformation.json',
+    'sam.yaml', 'sam.yml', 'sam.json',
+    'stack.yaml', 'stack.yml', 'stack.json',
+]);
+/**
+ * Walk the repo and collect AWS template files.
+ * - Always descend into cdk.out/ to pick up *.template.json (it's not in
+ *   AWS_SKIP_DIRS, so the shared walker descends it like any other dir).
+ * - Skip AWS_SKIP_DIRS otherwise.
+ * - Returns files sorted by absolute path (localeCompare) so first-wins
+ *   deduplication is deterministic across machines and CI.
+ */
+function findAwsTemplates(repoDir) {
+    const found = [];
+    walkRepo(repoDir, {
+        skipDirs: AWS_SKIP_DIRS,
+        onFile: (abs, e) => {
+            const name = e.name;
+            if (SERVERLESS_CONFIG_NAMES.has(name)) {
+                found.push({ abs, kind: 'serverless' });
+                return;
+            }
+            // `inCdkOut`: true iff any ancestor directory of this file is `cdk.out`.
+            // (The legacy walk threaded a flag set on entering cdk.out; recovering it
+            // from the path is equivalent and keeps the shared walker stateless.)
+            const inCdkOut = relative(repoDir, abs).split(sep).slice(0, -1).includes('cdk.out');
+            if (inCdkOut && name.endsWith('.template.json')) {
+                // Synthesized CDK output — always CFN JSON.
+                found.push({ abs, kind: 'cfn' });
+            }
+            else if (TEMPLATE_NAMES.has(name)) {
+                // Check content before committing — avoid false positives.
+                // We'll verify in the extraction loop.
+                found.push({ abs, kind: 'cfn' });
+            }
+        },
+    });
+    // Sort by absolute path so first-wins deduplication is deterministic.
+    found.sort((a, b) => a.abs.localeCompare(b.abs));
+    return found;
+}
+// ---------------------------------------------------------------------------
+// Kind heuristic (mirrors terraform.ts KIND_RULES; adapted for CFN type names).
+// The LLM cache is the authority; this ensures a usable topology under
+// --no-llm. Most-specific rules listed first.
+const CFN_KIND_RULES = [
+    // Compute / function
+    [/AWS::Lambda::|AWS::Serverless::Function/, 'worker'],
+    [/AWS::AppRunner::|AWS::Batch::|AWS::ECS::TaskDefinition/, 'worker'],
+    // Container / ECS service
+    [/AWS::ECS::Service|AWS::EC2::Instance|AWS::ElasticBeanstalk::/, 'container'],
+    // Queue / event bus
+    [/AWS::SQS::|AWS::SNS::|AWS::Kinesis::|AWS::EventBridge::|AWS::Events::/, 'queue'],
+    // Datastore
+    [/AWS::DynamoDB::Table|AWS::Serverless::SimpleTable|AWS::RDS::/, 'datastore'],
+    [/AWS::S3::Bucket/, 'datastore'],
+    [/AWS::ElastiCache::|AWS::DAX::/, 'datastore'],
+    // Secret store / KMS
+    [/AWS::SecretsManager::|AWS::KMS::|AWS::SSM::Parameter/, 'secret-store'],
+    // CDN / distribution
+    [/AWS::CloudFront::/, 'cdn'],
+    // API gateway — no `gateway` kind in enum; map to `worker` (least-bad)
+    [/AWS::ApiGateway::|AWS::ApiGatewayV2::|AWS::Serverless::Api|AWS::Serverless::HttpApi/, 'worker'],
+];
+function heuristicKind(resourceType) {
+    for (const [re, kind] of CFN_KIND_RULES) {
+        if (re.test(resourceType)) {
+            return { kind };
+        }
+    }
+    // Unknown type → datastore fallback (same rationale as terraform.ts).
+    return { kind: 'datastore' };
+}
+// ---------------------------------------------------------------------------
+// Reference extraction via parsed object walk.
+//
+// CFN references between resources use:
+//   - { Ref: LogicalId }              → we expect the string value to equal a logicalId
+//   - { Fn::GetAtt: [LId, Attr] }     → first array element is the logicalId
+//   - DependsOn: LogicalId | [LId…]   → string or array of strings
+//   - { Fn::Sub: "${LogicalId.Attr}" }→ placeholder in the Sub string
+//
+// We walk the parsed JS object once per resource, collecting every logicalId
+// that appears as a Ref value, first element of Fn::GetAtt, DependsOn entry,
+// or ${…} placeholder in Fn::Sub strings. This is O(R) (one walk per
+// resource, not O(R²) re-compilation per pair) and eliminates the substring
+// phantom-edge risk from the old rawText approach.
+function extractRefs(value, knownIds, out) {
+    if (typeof value === 'string') {
+        // Case A: YAML-resolved scalar string.
+        //   !Ref OrdersTable         → the string "OrdersTable"  (exact match)
+        //   !GetAtt AssetsBucket.Arn → the string "AssetsBucket.Arn"  (id.attr)
+        //   !Sub "${OrdersTable.Arn}/..." → check ${…} placeholders below
+        // Check exact match first (covers !Ref).
+        if (knownIds.has(value)) {
+            out.add(value);
+            return;
+        }
+        // Check for id.attr form (covers !GetAtt resolved as scalar string).
+        const dotIdx = value.indexOf('.');
+        if (dotIdx > 0) {
+            const prefix = value.slice(0, dotIdx);
+            if (knownIds.has(prefix))
+                out.add(prefix);
+        }
+        // Check for ${LogicalId} / ${LogicalId.Attr} placeholders in Sub strings.
+        const placeholderRe = /\$\{([A-Za-z0-9]+)(?:\.[^}]*)?\}/g;
+        let m;
+        while ((m = placeholderRe.exec(value)) !== null) {
+            if (knownIds.has(m[1]))
+                out.add(m[1]);
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            extractRefs(item, knownIds, out);
+        return;
+    }
+    // Case B: JSON-form object with explicit CFN intrinsic function keys.
+    const obj = value;
+    for (const [key, val] of Object.entries(obj)) {
+        if (key === 'Ref' && typeof val === 'string') {
+            if (knownIds.has(val))
+                out.add(val);
+        }
+        else if (key === 'Fn::GetAtt' && Array.isArray(val) && val.length >= 1 && typeof val[0] === 'string') {
+            if (knownIds.has(val[0]))
+                out.add(val[0]);
+        }
+        else if (key === 'DependsOn') {
+            const deps = Array.isArray(val) ? val : [val];
+            for (const d of deps) {
+                if (typeof d === 'string' && knownIds.has(d))
+                    out.add(d);
+            }
+        }
+        else if (key === 'Fn::Sub' && typeof val === 'string') {
+            const placeholderRe = /\$\{([A-Za-z0-9]+)(?:\.[^}]*)?\}/g;
+            let m;
+            while ((m = placeholderRe.exec(val)) !== null) {
+                if (knownIds.has(m[1]))
+                    out.add(m[1]);
+            }
+        }
+        else {
+            extractRefs(val, knownIds, out);
+        }
+    }
+}
+/**
+ * Build a map from each resource's nodeId to the set of nodeIds it references,
+ * by walking the parsed object of each resource's rawText.
+ *
+ * We match against logicalIds (plain names in rawText like "OrdersTable"),
+ * then translate back to nodeIds via the logicalId→nodeId map.
+ *
+ * Returns Map<srcNodeId, Set<tgtNodeId>>.
+ */
+function buildRefMap(resources) {
+    // Index logicalId → nodeId for translation after matching.
+    const logicalToNode = new Map(resources.map((r) => [r.logicalId, r.nodeId]));
+    // All logicalIds as a set for O(1) membership checks inside extractRefs.
+    const allLogicalIds = new Set(resources.map((r) => r.logicalId));
+    // Index nodeId → parsed rawText object.
+    const parsed = new Map();
+    for (const { nodeId, rawText } of resources) {
+        try {
+            parsed.set(nodeId, JSON.parse(rawText));
+        }
+        catch {
+            parsed.set(nodeId, null);
+        }
+    }
+    const result = new Map();
+    for (const { nodeId, logicalId } of resources) {
+        // Collect referenced logicalIds (not nodeIds) — rawText contains plain names.
+        const otherLogicalIds = new Set([...allLogicalIds].filter((id) => id !== logicalId));
+        const refLogicalIds = new Set();
+        extractRefs(parsed.get(nodeId), otherLogicalIds, refLogicalIds);
+        // Translate logicalId references → nodeIds.
+        const refNodeIds = new Set();
+        for (const refLogicalId of refLogicalIds) {
+            const refNodeId = logicalToNode.get(refLogicalId);
+            if (refNodeId)
+                refNodeIds.add(refNodeId);
+        }
+        result.set(nodeId, refNodeIds);
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Node ID helpers.
+//
+// Serverless Framework `functions:` entries get ids in the `fn:<name>` namespace
+// to avoid collisions with PascalCase CFN logical IDs from the same template's
+// `resources.Resources` block (e.g. a function named `Api` would otherwise collide
+// with a CFN resource `Api`).
+function nodeIdForResource(r) {
+    return r.source === 'serverless-fn' ? `fn:${r.logicalId}` : `resource:${r.logicalId}`;
+}
+// ---------------------------------------------------------------------------
+// Pure graph builder.
+export function buildAwsGraph(templates, root, dockerfileIndex) {
+    const nodes = [];
+    const classificationsNeeded = [];
+    for (const r of templates) {
+        const { kind } = heuristicKind(r.type);
+        const nodeId = nodeIdForResource(r);
+        // CodeUri / container Image → source roots.
+        const roots = awsSourceRoots(r.rawText, r.dir ?? '', dockerfileIndex);
+        nodes.push({
+            id: nodeId,
+            label: `${r.logicalId} (${r.type})`,
+            kind,
+            provenance: 'inferred',
+            metadata: {
+                provider: 'aws/cloudformation',
+                resourceType: r.type,
+            },
+            ...(roots.length ? { sourceRoots: roots } : {}),
+        });
+        classificationsNeeded.push({
+            provider: 'aws/cloudformation',
+            resourceType: r.type,
+            forNodeId: nodeId,
+        });
+    }
+    // Cross-resource edges: walk each resource's parsed rawText for Ref /
+    // Fn::GetAtt / DependsOn / Fn::Sub references to other resources' nodeIds.
+    // Using a pre-built ref-map is O(R) rather than O(R²) and avoids false
+    // positives from substring matches in the old rawText regex approach.
+    const edges = [];
+    const seenEdges = new Set();
+    const resourcesWithNodeIds = templates.map((r) => ({
+        nodeId: nodeIdForResource(r),
+        logicalId: r.logicalId,
+        rawText: r.rawText,
+    }));
+    const refMap = buildRefMap(resourcesWithNodeIds);
+    for (const [srcId, refs] of refMap) {
+        for (const tgtId of refs) {
+            if (srcId === tgtId)
+                continue;
+            const key = `${srcId}→${tgtId}`;
+            if (seenEdges.has(key))
+                continue;
+            seenEdges.add(key);
+            edges.push({
+                source: srcId,
+                target: tgtId,
+                kind: 'calls',
+                metadata: { via: 'cfn-ref' },
+            });
+        }
+    }
+    return { root, adapter: 'aws', nodes, edges, classificationsNeeded };
+}
+// ---------------------------------------------------------------------------
+// Adapter: detect + extract.
+export const awsAdapter = {
+    name: 'aws',
+    async detect(repoDir) {
+        return findAwsTemplates(repoDir).length > 0;
+    },
+    async extract(repoDir) {
+        const found = findAwsTemplates(repoDir); // already sorted by abs path
+        const allResources = [];
+        // Track (templateFile, logicalId) pairs to deduplicate within a single
+        // template. Sibling stacks (dev/prod, per-service templates) legitimately
+        // reuse logical IDs like `Api` or `Table` — those are DISTINCT resources
+        // and must all be included; only within one template file is a duplicate
+        // logicalId a no-op (CFN itself forbids duplicate keys in a Resources map).
+        const seenPerFile = new Map();
+        for (const { abs, kind } of found) {
+            let text;
+            try {
+                text = readFileSync(abs, 'utf8');
+            }
+            catch (err) {
+                console.warn(`  [aws] skipping unreadable ${relative(repoDir, abs)}: ${err.message}`);
+                continue;
+            }
+            // For candidate CFN files (not serverless), verify content before parsing.
+            if (kind === 'cfn' && !abs.endsWith('.template.json') && !isCfnTemplate(text)) {
+                // The file exists in a template-named location but isn't actually a CFN
+                // template — skip silently (e.g. a plain JSON config named template.json).
+                continue;
+            }
+            let resources;
+            try {
+                if (kind === 'serverless') {
+                    resources = parseServerlessConfig(text);
+                }
+                else {
+                    resources = parseCfnTemplate(text);
+                }
+            }
+            catch (err) {
+                console.warn(`  [aws] skipping unparseable ${relative(repoDir, abs)}: ${err.message}`);
+                continue;
+            }
+            // Dedupe within this file only. The nodeId incorporates source ('fn:'
+            // vs 'resource:') so a serverless-fn and a CFN resource with the same
+            // bare name won't collide globally either.
+            const fileSeenIds = seenPerFile.get(abs) ?? new Set();
+            seenPerFile.set(abs, fileSeenIds);
+            // stamp the template's repo-relative dir for CodeUri resolution.
+            const fileDir = dirOfPath((relative(repoDir, abs) || abs).split('\\').join('/'));
+            for (const r of resources) {
+                const nodeId = nodeIdForResource(r);
+                if (!fileSeenIds.has(nodeId)) {
+                    fileSeenIds.add(nodeId);
+                    allResources.push({ ...r, dir: fileDir });
+                }
+            }
+        }
+        // Dockerfile index for ECS image refs.
+        return buildAwsGraph(allResources, repoDir, buildDockerfileIndex(repoDir));
+    },
+};
+//# sourceMappingURL=aws.js.map