@backthread/extractor 0.1.0

package/dist/infra/heroku/heroku.d.ts

@@ -0,0 +1,24 @@
+import type { InfraAdapter, InfraGraph } from '../types.js';
+export interface HerokuInputs {
+    procfileEntries: Array<{
+        processType: string;
+        command: string;
+    }>;
+    appJson: {
+        name?: string;
+        addons: Array<{
+            slug: string;
+            plan?: string;
+        }>;
+        env: Record<string, unknown>;
+        formation: Record<string, unknown>;
+    } | null;
+    hasHerokuYml: boolean;
+}
+/**
+ * Pure graph builder — takes pre-parsed Heroku config objects and emits an
+ * InfraGraph. Separated from fs IO for unit-testing without a real repo dir.
+ */
+export declare function buildHerokuGraph(inputs: HerokuInputs, root: string): InfraGraph;
+export declare const herokuAdapter: InfraAdapter;
+//# sourceMappingURL=heroku.d.ts.map

package/dist/infra/heroku/heroku.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heroku.d.ts","sourceRoot":"","sources":["../../../src/infra/heroku/heroku.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,YAAY,EAAa,UAAU,EAAa,MAAM,aAAa,CAAC;AA+IlF,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACpJ,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CA0E/E;AAKD,eAAO,MAAM,aAAa,EAAE,YAsC3B,CAAC"}

package/dist/infra/heroku/heroku.js

@@ -0,0 +1,253 @@
+// the Heroku InfraAdapter (v0).
+//
+// Surfaces the PaaS deployment topology from Procfile + app.json. Emits:
+//   - One `worker` node per Procfile process type (web/worker/release/clock/custom)
+//   - One node per app.json addon, kind decided by a static slug map
+//   - `stores-in` edges (dyno → datastore addon)
+//   - `calls` edges (dyno → external-api addon)
+//
+// Everything is `declared` provenance: the files literally name the dyno type
+// and the addon slug. No LLM, no inference → classificationsNeeded: [].
+//
+// heroku.yml (Docker-based deploys) is DEFERRED — it is YAML, and there is no
+// YAML parser available in this dependency-free adapter. Presence of
+// heroku.yml is used in detect() only. Parsing is tracked for .
+//
+// PaaS tight static model: an addon slug literally names the managed service,
+// so the kind decision is made by a static slug→kind map here rather than
+// delegating to the LLM classifier. Unknown slugs fall back to `external-api`
+// (a named managed service you don't own) — declared, not classified.
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseProcfile, parseAppJson } from './heroku-parse.js';
+/**
+ * Extract the root slug from an addon slug that may carry a plan suffix
+ * (e.g. 'heroku-postgresql:mini' → 'heroku-postgresql').
+ */
+function rootSlug(slug) {
+    return slug.split(':')[0].toLowerCase().trim();
+}
+const SLUG_MAP = {
+    // Relational / Postgres
+    'heroku-postgresql': { kind: 'datastore', label: 'Heroku Postgres' },
+    'jawsdb': { kind: 'datastore', label: 'JawsDB MySQL' },
+    'jawsdb-maria': { kind: 'datastore', label: 'JawsDB MariaDB' },
+    'cleardb': { kind: 'datastore', label: 'ClearDB MySQL' },
+    'xeround': { kind: 'datastore', label: 'Xeround' },
+    // Redis / Memcache
+    'heroku-redis': { kind: 'datastore', label: 'Heroku Redis' },
+    'rediscloud': { kind: 'datastore', label: 'Redis Cloud' },
+    'redistogo': { kind: 'datastore', label: 'RedisToGo' },
+    'memcachier': { kind: 'datastore', label: 'MemCachier' },
+    'memcachedcloud': { kind: 'datastore', label: 'Memcached Cloud' },
+    // Search / Time-series
+    'searchbox': { kind: 'datastore', label: 'SearchBox (Elasticsearch)' },
+    'bonsai': { kind: 'datastore', label: 'Bonsai (Elasticsearch)' },
+    'algoliasearch': { kind: 'external-api', label: 'Algolia' },
+    // Messaging / Email
+    'sendgrid': { kind: 'external-api', label: 'SendGrid' },
+    'mailgun': { kind: 'external-api', label: 'Mailgun' },
+    'mandrill': { kind: 'external-api', label: 'Mandrill' },
+    'postmark': { kind: 'external-api', label: 'Postmark' },
+    'sparkpost': { kind: 'external-api', label: 'SparkPost' },
+    // SMS / telephony
+    'twilio': { kind: 'external-api', label: 'Twilio' },
+    // Payments
+    'stripe': { kind: 'external-api', label: 'Stripe' },
+    // Monitoring / logging
+    'papertrail': { kind: 'external-api', label: 'Papertrail' },
+    'logentries': { kind: 'external-api', label: 'Logentries' },
+    'librato': { kind: 'external-api', label: 'Librato' },
+    'new-relic': { kind: 'external-api', label: 'New Relic' },
+    'rollbar': { kind: 'external-api', label: 'Rollbar' },
+    'sentry': { kind: 'external-api', label: 'Sentry' },
+    'scout': { kind: 'external-api', label: 'Scout APM' },
+    'airbrake': { kind: 'external-api', label: 'Airbrake' },
+    'honeybadger': { kind: 'external-api', label: 'Honeybadger' },
+    // Queuing / jobs
+    'cloudamqp': { kind: 'queue', label: 'CloudAMQP' },
+    'rabbitmq-bigwig': { kind: 'queue', label: 'RabbitMQ Bigwig' },
+    'iron-mq': { kind: 'queue', label: 'IronMQ' },
+    // Storage / CDN
+    'cloudinary': { kind: 'external-api', label: 'Cloudinary' },
+    'bucketeer': { kind: 'datastore', label: 'Bucketeer (S3)' },
+    // Auth
+    'auth0': { kind: 'external-api', label: 'Auth0' },
+    'stormpath': { kind: 'external-api', label: 'Stormpath' },
+    // Scheduled jobs helpers
+    'scheduler': { kind: 'external-api', label: 'Heroku Scheduler' },
+    'heroku-scheduler': { kind: 'external-api', label: 'Heroku Scheduler' },
+};
+function lookupAddon(slug) {
+    const root = rootSlug(slug);
+    return (SLUG_MAP[root] ?? {
+        kind: 'external-api',
+        label: slug, // use the raw slug as label for unknown addons
+    });
+}
+// ---------------------------------------------------------------------------
+// Source-root resolution.
+//
+// A Heroku app builds the whole repo (or a monorepo sub-dir) into one slug; the
+// dynos all run process types from that single slug, so every dyno shares ONE
+// source root. The only honest sub-root signal is the monorepo-buildpack base
+// dir, declared in app.json `env` as `APP_BASE` (heroku-buildpack-monorepo) or
+// `PROJECT_PATH`. With that → the dynos' code lives under that sub-dir. Without
+// it the app sits at the repo root, which is a catch-all: we emit NO source root
+// (the deployment consumer drops an empty root anyway, and a bare repo root must
+// never swallow sibling units) → the code honestly stays "Other".
+/** Normalize a repo-relative path: backslashes→/, collapse `.`/`./`, strip trailing `/`. */
+function normalizeRoot(p) {
+    return p.replace(/\\/g, '/').replace(/^\.(?:\/|$)/, '').replace(/\/+$/, '');
+}
+/** Read an app.json env value, which may be a bare string or `{ value: string }`. */
+function envValue(v) {
+    if (typeof v === 'string')
+        return v || undefined;
+    if (v && typeof v === 'object' && !Array.isArray(v)) {
+        const val = v.value;
+        return typeof val === 'string' && val ? val : undefined;
+    }
+    return undefined;
+}
+/**
+ * The repo-relative source root shared by every dyno: the monorepo-buildpack
+ * base dir from app.json env (`APP_BASE` / `PROJECT_PATH`), or '' (→ no source
+ * root) for a root-level app.
+ */
+function appSourceRoot(appJson) {
+    if (!appJson)
+        return '';
+    for (const key of ['APP_BASE', 'PROJECT_PATH']) {
+        const raw = envValue(appJson.env[key]);
+        if (raw)
+            return normalizeRoot(raw);
+    }
+    return '';
+}
+// ---------------------------------------------------------------------------
+// Node-id helpers — adapter-local natural keys.
+const dynoId = (processType) => `dyno:${processType}`;
+const addonId = (slug) => `addon:${rootSlug(slug)}`;
+// ---------------------------------------------------------------------------
+// Detection helpers.
+const HEROKU_FILES = ['Procfile', 'app.json', 'heroku.yml'];
+function detectHeroku(repoDir) {
+    return HEROKU_FILES.some((f) => existsSync(join(repoDir, f)));
+}
+/**
+ * Pure graph builder — takes pre-parsed Heroku config objects and emits an
+ * InfraGraph. Separated from fs IO for unit-testing without a real repo dir.
+ */
+export function buildHerokuGraph(inputs, root) {
+    const { procfileEntries, appJson } = inputs;
+    const nodes = new Map();
+    const edges = [];
+    const addNode = (n) => {
+        if (!nodes.has(n.id))
+            nodes.set(n.id, n);
+    };
+    // ---- Dynos (one `worker` node per Procfile process type) ----------------
+    // every dyno shares the app's single source root (the monorepo base
+    // dir, or none for a root-level app).
+    const srcRoot = appSourceRoot(appJson);
+    for (const { processType, command } of procfileEntries) {
+        addNode({
+            id: dynoId(processType),
+            label: `${processType} dyno`,
+            kind: 'worker',
+            provenance: 'declared',
+            metadata: { processType, command },
+            ...(srcRoot ? { sourceRoots: [srcRoot] } : {}),
+        });
+    }
+    // ---- Addons (from app.json) -----------------------------------------------
+    const addonMetas = [];
+    if (appJson) {
+        for (const { slug, plan } of appJson.addons) {
+            if (!slug)
+                continue;
+            const meta = lookupAddon(slug);
+            const id = addonId(slug);
+            const node = {
+                id,
+                label: meta.label,
+                kind: meta.kind,
+                provenance: 'declared',
+                metadata: { provider: 'heroku', slug: rootSlug(slug), ...(plan ? { plan } : {}) },
+            };
+            addNode(node);
+            addonMetas.push({ id, meta, slug });
+        }
+    }
+    // ---- Edges: each dyno → each addon, verb by addon kind -------------------
+    // Only emit edges when we have dynos (Procfile present).
+    // Edge verb follows the 8-verb taxonomy:
+    //   datastore  → stores-in
+    //   queue      → publishes  (can't distinguish producer/consumer from Procfile alone)
+    //   external-api / other → calls
+    if (procfileEntries.length > 0) {
+        for (const { processType } of procfileEntries) {
+            const srcId = dynoId(processType);
+            for (const { id: targetId, meta } of addonMetas) {
+                let kind;
+                if (meta.kind === 'datastore') {
+                    kind = 'stores-in';
+                }
+                else if (meta.kind === 'queue') {
+                    kind = 'publishes';
+                }
+                else {
+                    kind = 'calls';
+                }
+                edges.push({ source: srcId, target: targetId, kind });
+            }
+        }
+    }
+    return {
+        root,
+        adapter: 'heroku',
+        nodes: [...nodes.values()],
+        edges,
+        classificationsNeeded: [], // all declared via static slug map
+    };
+}
+// ---------------------------------------------------------------------------
+// Adapter.
+export const herokuAdapter = {
+    name: 'heroku',
+    async detect(repoDir) {
+        return detectHeroku(repoDir);
+    },
+    async extract(repoDir) {
+        // -- Procfile --
+        let procfileEntries = [];
+        const procfilePath = join(repoDir, 'Procfile');
+        if (existsSync(procfilePath)) {
+            try {
+                procfileEntries = parseProcfile(readFileSync(procfilePath, 'utf8'));
+            }
+            catch (err) {
+                console.warn(`  [heroku] skipping unparseable ${procfilePath}: ${err.message}`);
+            }
+        }
+        // -- app.json --
+        let appJson = null;
+        const appJsonPath = join(repoDir, 'app.json');
+        if (existsSync(appJsonPath)) {
+            try {
+                appJson = parseAppJson(readFileSync(appJsonPath, 'utf8'));
+            }
+            catch (err) {
+                console.warn(`  [heroku] skipping unparseable ${appJsonPath}: ${err.message}`);
+            }
+        }
+        // -- heroku.yml (presence check only — YAML parsing deferred) --
+        const hasHerokuYml = existsSync(join(repoDir, 'heroku.yml'));
+        if (hasHerokuYml) {
+            console.warn('  [heroku] heroku.yml detected but YAML parsing is deferred in v0 — skipping content extraction');
+        }
+        return buildHerokuGraph({ procfileEntries, appJson, hasHerokuYml }, repoDir);
+    },
+};
+//# sourceMappingURL=heroku.js.map

package/dist/infra/heroku/heroku.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heroku.js","sourceRoot":"","sources":["../../../src/infra/heroku/heroku.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,yEAAyE;AACzE,oFAAoF;AACpF,qEAAqE;AACrE,iDAAiD;AACjD,gDAAgD;AAChD,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,sEAAsE;AAEtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAYhE;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,QAAQ,GAA8B;IAC1C,wBAAwB;IACxB,mBAAmB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACpE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE;IACtD,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC9D,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE;IACxD,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE;IAClD,mBAAmB;IACnB,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE;IAC5D,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE;IACzD,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE;IACtD,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE;IACxD,gBAAgB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACjE,uBAAuB;IACvB,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACtE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAChE,eAAe,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;IAC3D,oBAAoB;IACpB,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE;IACvD,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE;IACvD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;IACzD,kBAAkB;IAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnD,WAAW;IACX,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnD,uBAAuB;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3D,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;IACrD,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;IACzD,SAAS,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE;IACrD,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnD,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;IACrD,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE;IACvD,aAAa,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE;IAC7D,iBAAiB;IACjB,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;IAClD,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAC9D,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC7C,gBAAgB;IAChB,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;IAC3D,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC3D,OAAO;IACP,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE;IACjD,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;IACzD,yBAAyB;IACzB,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAChE,kBAAkB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE;CACxE,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC,IAAI;QAChB,IAAI,EAAE,cAAiC;QACvC,KAAK,EAAE,IAAI,EAAE,+CAA+C;KAC7D,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,kEAAkE;AAElE,4FAA4F;AAC5F,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,SAAS,CAAC;IACjD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAI,CAA6B,CAAC,KAAK,CAAC;QACjD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAgC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAEhD,MAAM,MAAM,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,QAAQ,WAAW,EAAE,CAAC;AAC9D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAE5D,8EAA8E;AAC9E,qBAAqB;AAErB,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAE5D,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,IAAY;IACjE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,CAAC,CAAY,EAAE,EAAE;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,4EAA4E;IAC5E,oEAAoE;IACpE,sCAAsC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;QACvD,OAAO,CAAC;YACN,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC;YACvB,KAAK,EAAE,GAAG,WAAW,OAAO;YAC5B,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YAClC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAyD,EAAE,CAAC;IAC5E,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,IAAI,GAAc;gBACtB,EAAE;gBACF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAClF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yDAAyD;IACzD,yCAAyC;IACzC,2BAA2B;IAC3B,sFAAsF;IACtF,iCAAiC;IACjC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,WAAW,EAAE,IAAI,eAAe,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,KAAK,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;gBAChD,IAAI,IAAuB,CAAC;gBAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAC9B,IAAI,GAAG,WAAW,CAAC;gBACrB,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACjC,IAAI,GAAG,WAAW,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,OAAO,CAAC;gBACjB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,KAAK;QACL,qBAAqB,EAAE,EAAE,EAAE,mCAAmC;KAC/D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AAEX,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,IAAI,EAAE,QAAQ;IAEd,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,iBAAiB;QACjB,IAAI,eAAe,GAAoC,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,eAAe,GAAG,aAAa,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,mCAAmC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,GAA4B,IAAI,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,mCAAmC,WAAW,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;QAClH,CAAC;QAED,OAAO,gBAAgB,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;CACF,CAAC"}

package/dist/infra/image-resolve.d.ts

@@ -0,0 +1,56 @@
+/** An in-repo Dockerfile and its inferred build-context dir (the source root). */
+export interface DockerfileEntry {
+    /** Repo-relative path to the Dockerfile (provenance). */
+    dockerfile: string;
+    /** Repo-relative build-context dir = the source root ('' = repo root). */
+    context: string;
+}
+/** An explicit "this image ref is built from this context" pairing. */
+export interface ImagePairing {
+    /** The image ref this pairing builds (e.g. a compose service's `image:`). */
+    image: string;
+    /** Repo-relative build-context dir = the source root ('' = repo root). */
+    context: string;
+}
+/** Everything the pure resolver needs: the repo's Dockerfiles + known pairings. */
+export interface DockerfileIndex {
+    dockerfiles: DockerfileEntry[];
+    pairings: ImagePairing[];
+}
+export interface ParsedImageRef {
+    /** Registry host (`ghcr.io`, `123.dkr.ecr…`), or undefined for the default registry. */
+    registry?: string;
+    /** Repository path WITHOUT the registry (`acme/api`, `postgres`). */
+    repository: string;
+    /** Last path segment of the repository — the "base name" (`api`, `postgres`, `web`). */
+    name: string;
+    /** True iff the repository has no `/` after the registry — a Docker official-library image. */
+    officialLibrary: boolean;
+}
+/** Parse an image ref into its parts. Tolerant: never throws, best-effort. */
+export declare function parseImageRef(ref: string): ParsedImageRef;
+/**
+ * Is this image ref a PULLED public image (so it must NOT match a local
+ * Dockerfile heuristically)? True when it's a Docker official-library image
+ * (no org segment, e.g. `postgres:15`, `redis`) OR its base name carries a
+ * well-known data-store / message-bus / base-image token.
+ */
+export declare function isLikelyExternalImage(ref: string): boolean;
+/**
+ * Resolve an image ref to the repo-relative source-root dir(s) that build it,
+ * using only the injected index (no fs). Returns [] when unresolvable — the
+ * caller then emits NO `sourceRoots` (honest "Other"). Never returns the repo
+ * root ('') — that would be a catch-all swallowing sibling units.
+ *
+ * Deterministic: contexts are de-duped and sorted; ties at a signal degrade to
+ * [] rather than an arbitrary pick.
+ */
+export declare function resolveImageToSourceRoots(imageRef: string, index: DockerfileIndex): string[];
+/**
+ * Walk `repoDir` into a DockerfileIndex: every in-repo Dockerfile (context =
+ * its own dir, the docker-build convention) + every compose service that
+ * declares BOTH `build:` and `image:` as an explicit image→context pairing.
+ * Bounded + error-tolerant (shared walk.ts). Deterministic (sorted).
+ */
+export declare function buildDockerfileIndex(repoDir: string): DockerfileIndex;
+//# sourceMappingURL=image-resolve.d.ts.map

package/dist/infra/image-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-resolve.d.ts","sourceRoot":"","sources":["../../src/infra/image-resolve.ts"],"names":[],"mappings":"AA6CA,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AA2CD,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAuBzD;AAuBD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAK1D;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE,CA2B5F;AAgBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CA2BrE"}

package/dist/infra/image-resolve.js

@@ -0,0 +1,229 @@
+// shared image→source resolver (Phase 0 of , seam #2).
+//
+// Tier-1/2 adapters (compose, Vercel, Fly, Render, Railway, Heroku) point at a
+// SOURCE dir, so `sourceRoots` falls out cleanly. Tier-3 adapters (k8s,
+// Terraform, Pulumi, AWS/GCP/Azure-native) reference a PRE-BUILT image
+// (`image: myorg/api:1.2`) — there's no source dir in the config. This resolver
+// is the shared bridge: given an image ref + an index of the repo's in-repo
+// Dockerfiles (and any explicit image→context pairings the compose adapter
+// already knows), it answers "which repo dir builds this image?" → that
+// Dockerfile's build context = the source root the Tier-3 adapter emits.
+//
+// Hard rules:
+//   * Deterministic, NO LLM.
+//   * Graceful degradation — an image that resolves to no in-repo Dockerfile
+//     returns []; the adapter then emits NO `sourceRoots` and that unit's code
+//     honestly stays in "Other (not deployed)." NEVER guess.
+//   * Never a repo-root catch-all — a context that resolves to '' (the whole
+//     repo) is dropped, so it can't swallow sibling deploy units.
+//   * Pure core (`resolveImageToSourceRoots`) takes an injected index — no fs —
+//     so it's unit-testable, mirroring the netlify/compose builder split. The
+//     thin fs wrapper (`buildDockerfileIndex`) walks the repo.
+//
+// Matching signals, in priority order (best-effort, first hit wins):
+//   1. An explicit image→context PAIRING (a compose service that declares BOTH
+//      `build:` and `image:` is the authoritative "this image is built here").
+//   2. NAME-CONVENTION: the image's base name (`acme/api:1` → `api`) equals a
+//      Dockerfile build-context dir's last path segment. Exactly one match wins;
+//      ambiguous (≥2) → honest [] (never guess).
+//   3. SINGLE-CONTEXT repo: exactly one Dockerfile build context in the whole
+//      repo → the obvious context (guarded by the external-image exclusion so a
+//      pulled `postgres:15` never grabs your one Dockerfile).
+//
+// Pulled public images (official-library `postgres:15`, known data/queue/base
+// images) are excluded from the heuristic signals (2 + 3) — they run no code of
+// yours. An explicit pairing (signal 1) still wins for them, because the repo
+// literally said it builds that tag.
+import { readFileSync } from 'node:fs';
+import { relative } from 'node:path';
+import { findFiles } from './walk.js';
+import { parseComposeConfig } from './compose/compose-parse.js';
+// ---------------------------------------------------------------------------
+// Path helpers (repo-relative, normalized) — same idiom as netlify.ts/compose.ts.
+/** Normalize a repo-relative path: backslashes→/, collapse a bare `.`/leading `./`,
+ * strip trailing `/`. A lone `.` (the repo root) normalizes to '' so it's dropped. */
+function normalizeRoot(p) {
+    return p.replace(/\\/g, '/').replace(/^\.(?:\/|$)/, '').replace(/\/+$/, '');
+}
+/** The repo-relative directory of a repo-relative file path ('' = repo root). */
+function dirOf(relPath) {
+    const i = relPath.lastIndexOf('/');
+    return i === -1 ? '' : relPath.slice(0, i);
+}
+/** Resolve `rel` (may contain `./`/`../`) against repo-relative `baseDir` → normalized. */
+function resolveRel(baseDir, rel) {
+    const parts = (baseDir ? baseDir.split('/') : []).concat(rel.split('/'));
+    const out = [];
+    for (const p of parts) {
+        if (p === '' || p === '.')
+            continue;
+        if (p === '..')
+            out.pop();
+        else
+            out.push(p);
+    }
+    return out.join('/');
+}
+/** The last path segment of a repo-relative dir ('' for the repo root). */
+function lastSegment(dir) {
+    const norm = normalizeRoot(dir);
+    if (!norm)
+        return '';
+    const i = norm.lastIndexOf('/');
+    return i === -1 ? norm : norm.slice(i + 1);
+}
+/** Parse an image ref into its parts. Tolerant: never throws, best-effort. */
+export function parseImageRef(ref) {
+    let s = ref.trim();
+    // Strip a digest (`@sha256:…`) then a tag (the last `:` AFTER the last `/`,
+    // so a registry `host:port` isn't mistaken for a tag).
+    const at = s.indexOf('@');
+    if (at !== -1)
+        s = s.slice(0, at);
+    const lastSlash = s.lastIndexOf('/');
+    const lastColon = s.lastIndexOf(':');
+    if (lastColon > lastSlash)
+        s = s.slice(0, lastColon);
+    // The first segment is a registry iff it looks like a host (`.`/`:` or localhost).
+    const segs = s.split('/').filter((x) => x.length > 0);
+    let registry;
+    if (segs.length > 1) {
+        const first = segs[0];
+        if (first.includes('.') || first.includes(':') || first === 'localhost') {
+            registry = first;
+            segs.shift();
+        }
+    }
+    const repository = segs.join('/');
+    const name = segs.length ? segs[segs.length - 1] : repository;
+    return { registry, repository, name, officialLibrary: segs.length === 1 };
+}
+// ---------------------------------------------------------------------------
+// Pulled-public-image exclusion. These run no code of yours, so the heuristic
+// signals (name-convention + single-context) must never grab a local Dockerfile
+// for them. Reuses the compose data/queue token lists + common base images.
+const DATASTORE_TOKENS = [
+    'postgres', 'postgis', 'mysql', 'mariadb', 'mongo', 'redis', 'valkey', 'keydb',
+    'memcached', 'elasticsearch', 'opensearch', 'clickhouse', 'cassandra', 'scylla',
+    'cockroach', 'influxdb', 'neo4j', 'couchdb', 'rethinkdb', 'minio', 'timescale',
+];
+const QUEUE_TOKENS = [
+    'rabbitmq', 'kafka', 'redpanda', 'nats', 'zookeeper', 'activemq', 'pulsar',
+    'mosquitto', 'emqx',
+];
+// Common public base / sidecar / tooling images that are pulled, never built here.
+const PUBLIC_IMAGE_TOKENS = [
+    'nginx', 'httpd', 'caddy', 'traefik', 'envoy', 'haproxy', 'busybox', 'alpine',
+    'ubuntu', 'debian', 'node', 'python', 'golang', 'openjdk', 'ruby', 'php',
+    'registry', 'grafana', 'prometheus', 'pause', 'consul', 'vault', 'jaeger',
+];
+/**
+ * Is this image ref a PULLED public image (so it must NOT match a local
+ * Dockerfile heuristically)? True when it's a Docker official-library image
+ * (no org segment, e.g. `postgres:15`, `redis`) OR its base name carries a
+ * well-known data-store / message-bus / base-image token.
+ */
+export function isLikelyExternalImage(ref) {
+    const { name, officialLibrary } = parseImageRef(ref);
+    if (officialLibrary)
+        return true;
+    const base = name.toLowerCase();
+    return [...DATASTORE_TOKENS, ...QUEUE_TOKENS, ...PUBLIC_IMAGE_TOKENS].some((t) => base.includes(t));
+}
+/**
+ * Do two image refs name the same image? Matches on the repository path
+ * (registry + tag ignored — a k8s manifest's `ghcr.io/acme/api:prod` and a
+ * compose `acme/api` are the same image), with a base-name fallback for when
+ * one side qualifies the org and the other doesn't.
+ */
+function imageRefsMatch(a, b) {
+    const pa = parseImageRef(a);
+    const pb = parseImageRef(b);
+    if (pa.repository && pa.repository === pb.repository)
+        return true;
+    // Fallback: same base name ONLY when exactly one side is org-qualified and the
+    // other isn't — the genuine "registry/org-qualified ref vs an unqualified
+    // compose tag" case (e.g. `ghcr.io/acme/api` or ECR `…/api` vs compose `api`).
+    // Requiring `officialLibrary` to DIFFER means two distinct org-qualified refs
+    // (`acme/api` vs `other/api`) never collide on base name alone, and two bare
+    // names (`postgres` vs `postgres`) already matched on repository above.
+    return pa.name.length > 0 && pa.name === pb.name && pa.officialLibrary !== pb.officialLibrary;
+}
+// ---------------------------------------------------------------------------
+// The pure resolver.
+/**
+ * Resolve an image ref to the repo-relative source-root dir(s) that build it,
+ * using only the injected index (no fs). Returns [] when unresolvable — the
+ * caller then emits NO `sourceRoots` (honest "Other"). Never returns the repo
+ * root ('') — that would be a catch-all swallowing sibling units.
+ *
+ * Deterministic: contexts are de-duped and sorted; ties at a signal degrade to
+ * [] rather than an arbitrary pick.
+ */
+export function resolveImageToSourceRoots(imageRef, index) {
+    if (!imageRef || !imageRef.trim())
+        return [];
+    // Signal 1 — explicit pairing (authoritative; wins even for external-looking
+    // names, because the repo literally declared it builds that tag).
+    const paired = uniqSorted(index.pairings.filter((p) => imageRefsMatch(imageRef, p.image)).map((p) => normalizeRoot(p.context)));
+    if (paired.length)
+        return paired;
+    // Heuristic signals (2 + 3) never fire for a pulled public image.
+    if (isLikelyExternalImage(imageRef))
+        return [];
+    const contexts = uniqSorted(index.dockerfiles.map((d) => normalizeRoot(d.context)));
+    // Signal 2 — name-convention: image base name === a context's last segment.
+    const { name } = parseImageRef(imageRef);
+    if (name) {
+        const byName = contexts.filter((c) => lastSegment(c) === name);
+        if (byName.length === 1)
+            return byName;
+        if (byName.length > 1)
+            return []; // ambiguous → never guess
+    }
+    // Signal 3 — single-context repo: the one Dockerfile context is the obvious one.
+    if (contexts.length === 1)
+        return contexts;
+    return [];
+}
+/** De-dupe, drop the empty (repo-root) context, and sort for determinism. */
+function uniqSorted(roots) {
+    return [...new Set(roots.filter((r) => r.length > 0))].sort();
+}
+// ---------------------------------------------------------------------------
+// fs wrapper — walk the repo into a DockerfileIndex (the thin impure shell).
+// `Dockerfile`, `Dockerfile.prod`, `api.Dockerfile`, but NOT `.dockerignore`.
+const DOCKERFILE_RE = /^Dockerfile(\.[A-Za-z0-9_.-]+)?$|\.Dockerfile$/;
+// Compose-file basename (matches compose.ts) — the authoritative pairing source.
+const COMPOSE_RE = /^(docker-compose|compose)(\.[A-Za-z0-9_-]+)?\.ya?ml$/i;
+/**
+ * Walk `repoDir` into a DockerfileIndex: every in-repo Dockerfile (context =
+ * its own dir, the docker-build convention) + every compose service that
+ * declares BOTH `build:` and `image:` as an explicit image→context pairing.
+ * Bounded + error-tolerant (shared walk.ts). Deterministic (sorted).
+ */
+export function buildDockerfileIndex(repoDir) {
+    const rel = (abs) => (relative(repoDir, abs) || abs).split('\\').join('/');
+    const dockerfiles = findFiles(repoDir, (_abs, e) => DOCKERFILE_RE.test(e.name)).map((abs) => {
+        const file = rel(abs);
+        return { dockerfile: file, context: dirOf(file) };
+    });
+    const pairings = [];
+    for (const abs of findFiles(repoDir, (_a, e) => COMPOSE_RE.test(e.name), { maxDepth: 5 })) {
+        let config;
+        try {
+            config = parseComposeConfig(readFileSync(abs, 'utf8'));
+        }
+        catch {
+            continue; // a malformed compose file shouldn't sink the index
+        }
+        const composeDir = dirOf(rel(abs));
+        for (const svc of config.services) {
+            if (svc.build && svc.image) {
+                pairings.push({ image: svc.image, context: resolveRel(composeDir, svc.build.context) });
+            }
+        }
+    }
+    return { dockerfiles, pairings };
+}
+//# sourceMappingURL=image-resolve.js.map

package/dist/infra/image-resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-resolve.js","sourceRoot":"","sources":["../../src/infra/image-resolve.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,EAAE;AACF,cAAc;AACd,6BAA6B;AAC7B,6EAA6E;AAC7E,+EAA+E;AAC/E,6DAA6D;AAC7D,6EAA6E;AAC7E,kEAAkE;AAClE,gFAAgF;AAChF,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,iDAAiD;AACjD,8EAA8E;AAC9E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,qCAAqC;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AA2BhE,8EAA8E;AAC9E,kFAAkF;AAElF;sFACsF;AACtF,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,KAAK,CAAC,OAAe;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,2FAA2F;AAC3F,SAAS,UAAU,CAAC,OAAe,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QACpC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;YACrB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAmBD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,GAAG,SAAS;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAErD,mFAAmF;IACnF,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,QAA4B,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YACxE,QAAQ,GAAG,KAAK,CAAC;YACjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAE5E,MAAM,gBAAgB,GAAG;IACvB,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IAC9E,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ;IAC/E,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW;CAC/E,CAAC;AACF,MAAM,YAAY,GAAG;IACnB,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ;IAC1E,WAAW,EAAE,MAAM;CACpB,CAAC;AACF,mFAAmF;AACnF,MAAM,mBAAmB,GAAG;IAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;IAC7E,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;IACxE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;CAC1E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,YAAY,EAAE,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAClE,+EAA+E;IAC/E,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,eAAe,KAAK,EAAE,CAAC,eAAe,CAAC;AAChG,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AAErB;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,KAAsB;IAChF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAE7C,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,MAAM,GAAG,UAAU,CACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CACrG,CAAC;IACF,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEjC,kEAAkE;IAClE,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpF,4EAA4E;IAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACvC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC,CAAC,0BAA0B;IAC9D,CAAC;IAED,iFAAiF;IACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAe;IACjC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAE7E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE,iFAAiF;AACjF,MAAM,UAAU,GAAG,uDAAuD,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE3F,MAAM,WAAW,GAAsB,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CACpG,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACpD,CAAC,CACF,CAAC;IAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1F,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,oDAAoD;QAChE,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC"}

package/dist/infra/infra-step.d.ts

@@ -0,0 +1,39 @@
+import type { MergedInfraGraph } from './types.js';
+import type { InfraModuleKind } from '../types.js';
+/** A (provider, resourceType) pair an injected classifier must resolve. */
+export interface ResourceTypeRef {
+    provider: string;
+    resourceType: string;
+}
+/** The classifier's verdict for one ref. */
+export interface ResourceTypeResult {
+    provider: string;
+    resourceType: string;
+    nodeKind: InfraModuleKind;
+}
+/**
+ * Host-injected resolver for open-ended IaC resource types. Pure packages never
+ * ship one; the container/CLI passes a closure that calls the LLM classifier and
+ * accumulates cost in its own ledger. Deterministic dedupe happens here, before
+ * the callback, so the closure sees unique refs only.
+ */
+export type ResourceTypeClassifier = (refs: ResourceTypeRef[]) => Promise<ResourceTypeResult[]>;
+export interface InfraStepResult {
+    graph: MergedInfraGraph;
+    counts: {
+        nodes: number;
+        edges: number;
+        classified: number;
+    };
+}
+export declare function extractInfra(args: {
+    repoDir: string;
+    /**
+     * Optional host-injected classifier for open-ended IaC resource types. Omit
+     * (e.g. offline / --no-llm) to skip classification: deterministic adapter
+     * nodes still land; any classification-pending node keeps its adapter-emitted
+     * placeholder kind.
+     */
+    classifyResourceTypes?: ResourceTypeClassifier;
+}): Promise<InfraStepResult>;
+//# sourceMappingURL=infra-step.d.ts.map

package/dist/infra/infra-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-step.d.ts","sourceRoot":"","sources":["../../src/infra/infra-step.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE,eAAe,EAAE,KACpB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;CAChD,GAAG,OAAO,CAAC,eAAe,CAAC,CAoC3B"}