@backthread/extractor 0.1.0

package/dist/infra/register.d.ts

@@ -0,0 +1,2 @@
+export declare function registerBuiltinInfraAdapters(): void;
+//# sourceMappingURL=register.d.ts.map

package/dist/infra/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/infra/register.ts"],"names":[],"mappings":"AAmCA,wBAAgB,4BAA4B,IAAI,IAAI,CA8CnD"}

package/dist/infra/register.js

@@ -0,0 +1,81 @@
+// builtin infra-adapter registration.
+//
+// Registration ORDER is the conflict-resolution priority for the merge step
+// (registry.ts): the first-registered adapter wins a `declared`-vs-`declared`
+// tie. The locked order is CF → Supabase → Terraform: a provider-specific
+// config (wrangler.toml, supabase/config.toml) is more authoritative about its
+// own resources than a generic Terraform `cloudflare_*` / `supabase_*` block,
+// and Terraform is the universal fallback. / slot their adapters
+// into this list in priority order.
+//
+// `registerInfraAdapter` is idempotent on name (replaces), so calling this more
+// than once across a process is safe.
+import { registerInfraAdapter } from './registry.js';
+import { cloudflareAdapter } from './cloudflare/cloudflare.js';
+import { supabaseAdapter } from './supabase/supabase.js';
+import { dockerComposeAdapter } from './compose/compose.js';
+import { netlifyAdapter } from './netlify/netlify.js';
+import { firebaseAdapter } from './firebase/firebase.js';
+import { convexAdapter } from './convex/convex.js';
+import { vercelAdapter } from './vercel/vercel.js';
+import { flyAdapter } from './fly/fly.js';
+import { renderAdapter } from './render/render.js';
+import { railwayAdapter } from './railway/railway.js';
+import { herokuAdapter } from './heroku/heroku.js';
+import { digitaloceanAdapter } from './digitalocean/digitalocean.js';
+import { kamalAdapter } from './kamal/kamal.js';
+import { sstAdapter } from './sst/sst.js';
+import { pulumiAdapter } from './pulumi/pulumi.js';
+import { opentofuAdapter } from './opentofu/opentofu.js';
+import { awsAdapter } from './aws/aws.js';
+import { gcpAdapter } from './gcp/gcp.js';
+import { azureAdapter } from './azure/azure.js';
+import { terraformAdapter } from './terraform/terraform.js';
+export function registerBuiltinInfraAdapters() {
+    registerInfraAdapter(cloudflareAdapter);
+    registerInfraAdapter(supabaseAdapter);
+    // docker-compose — a self-hosted container declaration; its id space
+    // (`compose:service:*`) is disjoint from the cloud adapters, so order is
+    // cosmetic, but it sits with the specific provider configs ahead of the
+    // generic IaC fallbacks.
+    registerInfraAdapter(dockerComposeAdapter);
+    // Netlify before Vercel: netlify.toml is the explicit, stronger frontend-host
+    // signal, so it's listed ahead of Vercel's bare `next.config.*` detection. (Their
+    // id spaces are disjoint, so this is intent-documenting; the attribution win comes
+    // from Netlify emitting sourceRoots where the Vercel next.config path doesn't.)
+    registerInfraAdapter(netlifyAdapter);
+    // Firebase — a BaaS like Supabase; disjoint id space (`firebase:*`), grouped
+    // with the other provider-specific configs ahead of the generic IaC fallbacks.
+    registerInfraAdapter(firebaseAdapter);
+    // Convex — a reactive-TS BaaS like Supabase/Firebase; disjoint id
+    // space (`convex:*`), grouped with the provider-specific configs ahead of the
+    // generic IaC fallbacks. Source-based (functions ARE code), no image resolver.
+    registerInfraAdapter(convexAdapter);
+    registerInfraAdapter(vercelAdapter);
+    registerInfraAdapter(flyAdapter);
+    registerInfraAdapter(renderAdapter);
+    registerInfraAdapter(railwayAdapter);
+    registerInfraAdapter(herokuAdapter);
+    // DigitalOcean App Platform — keyed off the `.do/` app spec (NOT bare app.yaml,
+    // which GCP App Engine owns). Disjoint id space (`digitalocean:*`).
+    registerInfraAdapter(digitaloceanAdapter);
+    // Kamal — Docker-to-VPS deploy; self-hosted-container-shaped like
+    // docker-compose. Keyed off config/deploy.yml (path-scoped); disjoint id space
+    // (`kamal:*`), so order is cosmetic — no detect() overlap with other adapters.
+    registerInfraAdapter(kamalAdapter);
+    // SST v3 "Ion" — config-as-code IaC like Pulumi (ts-morph over
+    // sst.config.ts); disjoint id space (`sst:*`). Triggers only on sst.config.*,
+    // so no detect() double-fire with Pulumi (Pulumi.yaml) or Terraform (*.tf);
+    // grouped with the code-IaC adapters ahead of the generic fallbacks.
+    registerInfraAdapter(sstAdapter);
+    registerInfraAdapter(pulumiAdapter);
+    registerInfraAdapter(opentofuAdapter);
+    registerInfraAdapter(awsAdapter);
+    registerInfraAdapter(gcpAdapter);
+    registerInfraAdapter(azureAdapter);
+    // Terraform last — the universal fallback. A provider-specific config
+    // (wrangler.toml, supabase/config.toml) is more authoritative about its own
+    // resources than a generic `cloudflare_*` / `supabase_*` Terraform block.
+    registerInfraAdapter(terraformAdapter);
+}
+//# sourceMappingURL=register.js.map

package/dist/infra/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/infra/register.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,iEAAiE;AACjE,oCAAoC;AACpC,EAAE;AACF,gFAAgF;AAChF,sCAAsC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,UAAU,4BAA4B;IAC1C,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACxC,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACtC,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,yBAAyB;IACzB,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;IAC3C,8EAA8E;IAC9E,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACrC,6EAA6E;IAC7E,+EAA+E;IAC/E,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACtC,kEAAkE;IAClE,8EAA8E;IAC9E,+EAA+E;IAC/E,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACrC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,gFAAgF;IAChF,oEAAoE;IACpE,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IAC1C,kEAAkE;IAClE,+EAA+E;IAC/E,+EAA+E;IAC/E,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,+DAA+D;IAC/D,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACpC,oBAAoB,CAAC,eAAe,CAAC,CAAC;IACtC,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACjC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACnC,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;AACzC,CAAC"}

package/dist/infra/registry.d.ts

@@ -0,0 +1,64 @@
+import type { InfraAdapter, InfraGraph, MergedInfraGraph } from './types.js';
+/**
+ * Register an adapter. Idempotent on `name` — re-registering replaces the
+ * existing entry (useful for tests that swap a mock implementation).
+ * Insertion order is the conflict-priority order for the merge step.
+ */
+export declare function registerInfraAdapter(adapter: InfraAdapter): void;
+/** Read-only view of registered adapters in registration order. */
+export declare function listInfraAdapters(): readonly InfraAdapter[];
+/**
+ * the `scansSourcePath` predicates of every registered adapter that
+ * (a) declares one AND (b) `detect()`-positive on `repoDir` — i.e. the
+ * source-grep adapters ACTIVE for this repo. The diff-driven hosted walk
+ * (container.ts) ORs these into its carry/re-extract decision so a source-only
+ * change a source-scanner would read forces an infra re-extract instead of
+ * reusing the stale carried graph.
+ *
+ * Detection runs in parallel (cheap file-exists checks), exactly like
+ * runInfraAdapters. Computed ONCE per re-extract (not per checkpoint): a diff
+ * that would flip an adapter's detect() necessarily touches its config/IaC
+ * trigger (supabase/**, package.json, next.config.*, vercel.json), all of which
+ * already force a re-extract (diffTouchesInfra / config-invalidator) — after
+ * which the walk recomputes this set. So a config-only adapter never starts
+ * scanning source mid-walk without us noticing.
+ */
+export declare function activeSourceScanners(repoDir: string): Promise<Array<(path: string) => boolean>>;
+/** Test helper — wipe the registry between specs. Never call from production. */
+export declare function clearInfraAdapters(): void;
+/**
+ * Run every `detect()`-positive adapter against `repoDir` and merge the
+ * outputs. Detection runs in parallel (cheap file-exists checks),
+ * extraction runs serially (cheap IO + parsing, but several adapters
+ * touching the same files saturates the kernel cache faster serially
+ * than in parallel — and serial keeps log output legible).
+ *
+ * If no adapter detects the repo, returns an empty MergedInfraGraph anchored
+ * at `repoDir` — the caller (assemble.ts) should still produce a snapshot;
+ * the infra layer just contributes nothing.
+ */
+export declare function runInfraAdapters(repoDir: string): Promise<MergedInfraGraph>;
+/**
+ * Merge per-adapter InfraGraphs into one. Conflict policy:
+ *
+ *   * Node id collisions resolve in favor of the higher-provenance node
+ *     (declared > inferred > llm-classified). Ties on provenance resolve in
+ *     favor of the earlier-listed graph (= earlier-registered adapter).
+ *
+ *   * Edges dedupe on (source, target, kind) — two adapters describing the
+ *     same Worker → Queue write produce one edge. Adapter-specific metadata
+ *     from the LOSING duplicate is dropped.
+ *
+ *   * ClassificationRef refs deduped on (provider, resourceType, forNodeId).
+ *
+ * Node ids are NAMESPACED by adapter (`<adapter>:<node.id>`) before merging,
+ * which means raw id collisions only happen if the same adapter emits the
+ * same id twice — that's an adapter bug, not a merge concern, and we throw.
+ */
+export declare function mergeInfraGraphs(graphs: InfraGraph[], root: string): MergedInfraGraph;
+/**
+ * Edges whose `source` or `target` resolves to neither a merged infra node nor
+ * a member of `knownIds`. Empty result = every endpoint is accounted for.
+ */
+export declare function validateMergedGraph(merged: MergedInfraGraph, knownIds?: ReadonlySet<string>): MergedInfraGraph['edges'];
+//# sourceMappingURL=registry.d.ts.map

package/dist/infra/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/infra/registry.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAEV,YAAY,EACZ,UAAU,EAEV,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAQpB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAIhE;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAE3D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAQ3C;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAKD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAWjF;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,EAAE,MAAM,GACX,gBAAgB,CA4ElB;AAcD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,gBAAgB,CAAC,OAAO,CAAC,CAI3B"}

package/dist/infra/registry.js

@@ -0,0 +1,205 @@
+// Adapter registry + merge.
+//
+// One ingest = run every detect()-positive InfraAdapter against the repo
+// dir, collect their InfraGraphs, dedupe + reconcile via mergeInfraGraphs,
+// then run any open ClassificationRef through  before handing the
+// MergedInfraGraph to the assemble step.
+//
+// Adapters run in REGISTRATION ORDER, and registration order is the
+// conflict-resolution priority for `declared` vs `declared` ties: the
+// first-registered adapter wins. Today that's CF → Supabase → Terraform.
+// Rationale (per the  ticket): wrangler.toml is more specific
+// about Cloudflare resources than a Terraform `cloudflare_*` resource is;
+// Terraform is the universal fallback. Same logic applies to Supabase
+// (config.toml beats Terraform).
+//
+// `declared > inferred > llm-classified` is the inverse priority on
+// provenance — a higher-priority provenance always wins regardless of
+// adapter order. Two adapters both `declared` a node → adapter-order tie
+// break (above). One `declared`, one `llm-classified` → declared wins.
+// ---------------------------------------------------------------------------
+// Adapter registration.
+const REGISTERED = [];
+/**
+ * Register an adapter. Idempotent on `name` — re-registering replaces the
+ * existing entry (useful for tests that swap a mock implementation).
+ * Insertion order is the conflict-priority order for the merge step.
+ */
+export function registerInfraAdapter(adapter) {
+    const existing = REGISTERED.findIndex((a) => a.name === adapter.name);
+    if (existing >= 0)
+        REGISTERED[existing] = adapter;
+    else
+        REGISTERED.push(adapter);
+}
+/** Read-only view of registered adapters in registration order. */
+export function listInfraAdapters() {
+    return REGISTERED;
+}
+/**
+ * the `scansSourcePath` predicates of every registered adapter that
+ * (a) declares one AND (b) `detect()`-positive on `repoDir` — i.e. the
+ * source-grep adapters ACTIVE for this repo. The diff-driven hosted walk
+ * (container.ts) ORs these into its carry/re-extract decision so a source-only
+ * change a source-scanner would read forces an infra re-extract instead of
+ * reusing the stale carried graph.
+ *
+ * Detection runs in parallel (cheap file-exists checks), exactly like
+ * runInfraAdapters. Computed ONCE per re-extract (not per checkpoint): a diff
+ * that would flip an adapter's detect() necessarily touches its config/IaC
+ * trigger (supabase/**, package.json, next.config.*, vercel.json), all of which
+ * already force a re-extract (diffTouchesInfra / config-invalidator) — after
+ * which the walk recomputes this set. So a config-only adapter never starts
+ * scanning source mid-walk without us noticing.
+ */
+export async function activeSourceScanners(repoDir) {
+    const scanners = REGISTERED.filter((a) => typeof a.scansSourcePath === 'function');
+    const detections = await Promise.all(scanners.map(async (a) => ({ adapter: a, detected: await a.detect(repoDir) })));
+    return detections
+        .filter((d) => d.detected)
+        .map((d) => (path) => d.adapter.scansSourcePath(path));
+}
+/** Test helper — wipe the registry between specs. Never call from production. */
+export function clearInfraAdapters() {
+    REGISTERED.length = 0;
+}
+// ---------------------------------------------------------------------------
+// Run + merge.
+/**
+ * Run every `detect()`-positive adapter against `repoDir` and merge the
+ * outputs. Detection runs in parallel (cheap file-exists checks),
+ * extraction runs serially (cheap IO + parsing, but several adapters
+ * touching the same files saturates the kernel cache faster serially
+ * than in parallel — and serial keeps log output legible).
+ *
+ * If no adapter detects the repo, returns an empty MergedInfraGraph anchored
+ * at `repoDir` — the caller (assemble.ts) should still produce a snapshot;
+ * the infra layer just contributes nothing.
+ */
+export async function runInfraAdapters(repoDir) {
+    const detections = await Promise.all(REGISTERED.map(async (a) => ({ adapter: a, detected: await a.detect(repoDir) })));
+    const matched = detections.filter((d) => d.detected).map((d) => d.adapter);
+    const graphs = [];
+    for (const adapter of matched) {
+        graphs.push(await adapter.extract(repoDir));
+    }
+    return mergeInfraGraphs(graphs, repoDir);
+}
+// ---------------------------------------------------------------------------
+// Pure merge — exported separately for tests + for callers that already
+// have the per-adapter outputs in hand.
+const PROVENANCE_PRIORITY = {
+    declared: 3,
+    inferred: 2,
+    'llm-classified': 1,
+};
+/**
+ * Merge per-adapter InfraGraphs into one. Conflict policy:
+ *
+ *   * Node id collisions resolve in favor of the higher-provenance node
+ *     (declared > inferred > llm-classified). Ties on provenance resolve in
+ *     favor of the earlier-listed graph (= earlier-registered adapter).
+ *
+ *   * Edges dedupe on (source, target, kind) — two adapters describing the
+ *     same Worker → Queue write produce one edge. Adapter-specific metadata
+ *     from the LOSING duplicate is dropped.
+ *
+ *   * ClassificationRef refs deduped on (provider, resourceType, forNodeId).
+ *
+ * Node ids are NAMESPACED by adapter (`<adapter>:<node.id>`) before merging,
+ * which means raw id collisions only happen if the same adapter emits the
+ * same id twice — that's an adapter bug, not a merge concern, and we throw.
+ */
+export function mergeInfraGraphs(graphs, root) {
+    const byId = new Map();
+    for (let g = 0; g < graphs.length; g++) {
+        const graph = graphs[g];
+        const seenLocal = new Set();
+        for (const raw of graph.nodes) {
+            if (seenLocal.has(raw.id)) {
+                throw new Error(`infra adapter '${graph.adapter}' emitted duplicate node id '${raw.id}'`);
+            }
+            seenLocal.add(raw.id);
+            const namespaced = { ...raw, id: `${graph.adapter}:${raw.id}` };
+            const existing = byId.get(namespaced.id);
+            if (!existing) {
+                byId.set(namespaced.id, { node: namespaced, graphOrder: g });
+                continue;
+            }
+            const incoming = PROVENANCE_PRIORITY[namespaced.provenance];
+            const incumbent = PROVENANCE_PRIORITY[existing.node.provenance];
+            if (incoming > incumbent) {
+                byId.set(namespaced.id, { node: namespaced, graphOrder: g });
+            }
+            else if (incoming === incumbent && g < existing.graphOrder) {
+                // Higher-priority adapter (earlier-registered) wins on ties.
+                byId.set(namespaced.id, { node: namespaced, graphOrder: g });
+            }
+            // Otherwise existing wins; nothing to do.
+        }
+    }
+    // 2. Edges — namespace endpoints, dedupe on (source, target, kind).
+    //
+    // Endpoints can be either an adapter-local infra node id, or a code-side
+    // module id (set during later cross-graph join). We prefix infra-local
+    // refs; anything that doesn't match a known infra node id is left
+    // untouched so the cross-graph join can bind it.
+    //
+    // PR #7 review #7: pre-compute the local-id set once per graph instead
+    // of `.some()`-scanning the nodes array per edge. The naive form is
+    // O(edges × nodes); at 's 10-adapter fan-out with one Terraform
+    // graph carrying thousands of resources, that compounded every ingest.
+    const edgeKey = (s, t, k) => `${s}→${t}:${k}`;
+    const edges = new Map();
+    for (const graph of graphs) {
+        const localIds = new Set(graph.nodes.map((n) => n.id));
+        for (const e of graph.edges) {
+            const src = localIds.has(e.source) ? `${graph.adapter}:${e.source}` : e.source;
+            const tgt = localIds.has(e.target) ? `${graph.adapter}:${e.target}` : e.target;
+            const key = edgeKey(src, tgt, e.kind);
+            if (!edges.has(key))
+                edges.set(key, { ...e, source: src, target: tgt });
+        }
+    }
+    // 3. ClassificationRefs — same namespacing for `forNodeId`, dedupe on
+    //    the (provider, resourceType, forNodeId) triple.
+    const classKey = (p, rt, f) => `${p}/${rt}/${f}`;
+    const classRefs = new Map();
+    for (const graph of graphs) {
+        for (const c of graph.classificationsNeeded) {
+            const forNs = `${graph.adapter}:${c.forNodeId}`;
+            const key = classKey(c.provider, c.resourceType, forNs);
+            if (!classRefs.has(key)) {
+                classRefs.set(key, { ...c, forNodeId: forNs });
+            }
+        }
+    }
+    return {
+        root,
+        nodes: [...byId.values()].map((t) => t.node),
+        edges: [...edges.values()],
+        classificationsNeeded: [...classRefs.values()],
+    };
+}
+// ---------------------------------------------------------------------------
+// Post-merge validation gate.
+//
+// `mergeInfraGraphs` deliberately leaves unresolved edge endpoints untouched
+// (a Terraform `depends_on` may point at a code module the cross-graph join
+// binds later). It is NOT the validation gate — this is (PR #7 review #8).
+// Once the full id space is known (post-join, /12), the caller passes the
+// code-module ids in `knownIds`; any edge endpoint that still doesn't resolve
+// is an adapter bug (a typo'd `depends_on`, a dangling ref) rather than a
+// pending join. Returns those offending edges so tests can assert on an empty
+// result and the join step can fail loud instead of rendering a phantom node.
+/**
+ * Edges whose `source` or `target` resolves to neither a merged infra node nor
+ * a member of `knownIds`. Empty result = every endpoint is accounted for.
+ */
+export function validateMergedGraph(merged, knownIds = new Set()) {
+    const ids = new Set(merged.nodes.map((n) => n.id));
+    for (const id of knownIds)
+        ids.add(id);
+    return merged.edges.filter((e) => !ids.has(e.source) || !ids.has(e.target));
+}
+//# sourceMappingURL=registry.js.map

package/dist/infra/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/infra/registry.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,kEAAkE;AAClE,yCAAyC;AACzC,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,8DAA8D;AAC9D,0EAA0E;AAC1E,sEAAsE;AACtE,iCAAiC;AACjC,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AAWvE,8EAA8E;AAC9E,wBAAwB;AAExB,MAAM,UAAU,GAAmB,EAAE,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAqB;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,QAAQ,IAAI,CAAC;QAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;;QAC7C,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe;IAEf,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC/E,CAAC;IACF,OAAO,UAAU;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB;IAChC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AAEf;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CACjF,CAAC;IACF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,wCAAwC;AAExC,MAAM,mBAAmB,GAAmC;IAC1D,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,gBAAgB,EAAE,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAoB,EACpB,IAAY;IAIZ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,CAAC,OAAO,gCAAgC,GAAG,CAAC,EAAE,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEtB,MAAM,UAAU,GAAc,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;YAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC7D,6DAA6D;gBAC7D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,iDAAiD;IACjD,EAAE;IACF,uEAAuE;IACvE,oEAAoE;IACpE,gEAAgE;IAChE,uEAAuE;IACvE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6C,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAU,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,qBAAqB,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAwB,EACxB,WAAgC,IAAI,GAAG,EAAE;IAEzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,KAAK,MAAM,EAAE,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/infra/relevance.d.ts

@@ -0,0 +1,16 @@
+/** Is this repo-relative path one an infra adapter would read? */
+export declare function isInfraRelevantPath(path: string): boolean;
+/** Do any of a diff's paths touch infra-relevant CONFIG/IaC files? */
+export declare function diffTouchesInfra(paths: readonly string[]): boolean;
+/**
+ * the source-aware carry/re-extract decision for the hosted walk.
+ *
+ * True iff the diff touches a CONFIG/IaC infra path (diffTouchesInfra) OR a
+ * SOURCE path that one of the ACTIVE source-grep adapters reads. `sourceScanners`
+ * is the list of `scansSourcePath` predicates for the adapters whose detect()
+ * is positive on this repo (registry.activeSourceScanners) — pass an empty list
+ * (or omit) for a repo with no source-grep adapter, and this collapses to
+ * `diffTouchesInfra`, preserving the carry optimization for config-only stacks.
+ */
+export declare function diffTouchesInfraWithSources(paths: readonly string[], sourceScanners?: ReadonlyArray<(path: string) => boolean>): boolean;
+//# sourceMappingURL=relevance.d.ts.map

package/dist/infra/relevance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relevance.d.ts","sourceRoot":"","sources":["../../src/infra/relevance.ts"],"names":[],"mappings":"AAwGA,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOzD;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,cAAc,GAAE,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAM,GAC5D,OAAO,CAIT"}

package/dist/infra/relevance.js

@@ -0,0 +1,132 @@
+// Stage A — infra-relevance gate for diff-driven ingestion.
+//
+// Decides whether a checkpoint's diff could change the INFRA topology: only
+// then is an infra re-extraction warranted; otherwise the previous
+// checkpoint's infra graph is reused.
+//
+// TWO classes of trigger ( fix):
+//   1. CONFIG/IaC paths — `diffTouchesInfra` below. Every adapter reads these;
+//      a config-DECLARED adapter (Cloudflare, Terraform, Fly, …) reads ONLY
+//      these, so a checkpoint that touches none can safely carry that adapter's
+//      graph.
+//   2. SOURCE paths a source-grep adapter reads — `diffTouchesInfraWithSources`.
+//      This is the carry-invariant fix: it is FALSE that "infra adapters read
+//      only config/IaC." The Supabase adapter greps app `.ts/.tsx/.js/…` for
+//      `.from(`/`.auth`/`.storage`/`.realtime` (→ app→Postgres edges + the
+//      Auth/Storage/Realtime nodes), and the Vercel adapter reads
+//      `app/**/route.ts`, `pages/api/**`, `middleware.ts`. A `supabase.from(...)`
+//      added in plain `src/**` changes the infra graph, so it MUST force a
+//      re-extract — otherwise the carried graph silently drops the new
+//      node/edge until the next full re-seed. This is acute on example-app,
+//      which has NO supabase/config.toml: its WHOLE Supabase topology is
+//      source-grep-derived, exactly the signal `diffTouchesInfra` alone misses.
+//      The source globs are NOT hard-coded here — they come from the active
+//      adapters' own `scansSourcePath` predicates (registry.activeSourceScanners)
+//      so the gate can't drift from what the adapters actually read.
+//
+// The CONFIG pattern list is DERIVED from the registered adapters' detect()/file
+// matchers (scripts/ingest/infra/*):
+//   cloudflare → wrangler.toml/jsonc/json            supabase → supabase/**
+//   terraform  → *.tf, *.tfvars                      opentofu → *.tofu(.json), tofu.tfvars
+//   vercel     → vercel.json, next.config.*          fly      → fly.toml
+//   netlify    → netlify.toml         firebase → firebase.json, .firebaserc
+//   convex     → convex.json (; convex/** source via scansSourcePath)
+//   render     → render.yaml/yml                     railway  → railway.json/toml, nixpacks.toml, Procfile
+//   heroku     → Procfile, app.json, heroku.yml      pulumi   → Pulumi.yaml
+//   sst        → sst.config.ts/.mjs/.js
+//   aws        → *.template.json, serverless.yml/yaml, samconfig.toml, template.yaml/yml, cdk.json
+//   gcp        → app.yaml, cloudbuild.yaml           azure    → *.bicep, function.json, host.json
+//   digitalocean → .do/*.y(a)ml app spec (path-scoped, NOT bare app.yaml)
+//   kamal      → config/deploy(.<env>)?.y(a)ml (path-scoped, NOT bare deploy.yml)
+//   + generic container signals: Dockerfile*, docker-compose*/compose* (.ya?ml), .dockerignore
+//     (the docker-compose adapter — reads these compose files)
+//   + root Vite SPA signal: vite.config.* — Cloudflare now reads it (+
+//     index.html) to emit the Pages frontend unit + its `src/**` source root. Only
+//     vite.config is gated (index.html is a noisy basename; a SPA appearing always
+//     lands a vite.config, so this still catches it).
+//
+// DELIBERATELY NARROWER than the broadest adapters (gcp/azure scan every
+// *.yaml): a "rerun infra" false-negative only delays an infra-topology update
+// to the next full extract, while matching every yaml would fire the gate on
+// CI workflows and i18n files constantly, making it useless. Conservative
+// where it's cheap (well-known names), not where it's noisy.
+//
+// NOTE: the HOSTED container pipeline now DOES run infra extraction
+// (container.ts → extractCheckpointInfra). This gate is the per-checkpoint
+// carry/re-extract decision + observability counter for that walk.
+const INFRA_BASENAME_RE = new RegExp('^(' +
+    [
+        'wrangler\\.(toml|jsonc|json)',
+        'netlify\\.toml', // 
+        'firebase\\.json', // 
+        '\\.firebaserc', // 
+        'convex\\.json', // Convex config (functions-dir override); the
+        // convex/** source signal is covered by scansSourcePath
+        'vercel\\.json',
+        'next\\.config\\.[^/]+',
+        'fly\\.toml',
+        'render\\.ya?ml',
+        'railway\\.(json|toml)',
+        'nixpacks\\.toml',
+        'Procfile',
+        'app\\.json',
+        'heroku\\.yml',
+        'Pulumi\\.ya?ml',
+        'sst\\.config\\.[^/]+', // SST v3 Ion config (sst.config.ts/.mjs/.js)
+        'serverless\\.ya?ml',
+        'samconfig\\.toml',
+        'template\\.ya?ml',
+        'cdk\\.json',
+        'app\\.yaml',
+        'cloudbuild\\.ya?ml',
+        'function\\.json',
+        'host\\.json',
+        'tofu\\.tfvars',
+        'Dockerfile[^/]*',
+        'docker-compose[^/]*\\.ya?ml',
+        'compose(\\.[^/]+)?\\.ya?ml', // Compose Spec default filename (compose.yaml / compose.prod.yml)
+        '\\.dockerignore',
+        'vite\\.config\\.[^/]+',
+    ].join('|') +
+    ')$');
+const INFRA_EXTENSION_RE = /\.(tf|tf\.json|tfvars|tofu|tofu\.json|bicep)$/;
+/** A DO App Platform spec under `.do/` — path-scoped, NOT bare app.yaml. */
+const DO_SPEC_RE = /(^|\/)\.do\/[^/]+\.ya?ml$/;
+/** A Kamal config — path-scoped `config/deploy(.<env>)?.y(a)ml`, NOT a
+ * bare `deploy.yml` basename (CI workflows use that). */
+const KAMAL_SPEC_RE = /(^|\/)config\/deploy(\.[A-Za-z0-9_-]+)?\.ya?ml$/;
+/** Is this repo-relative path one an infra adapter would read? */
+export function isInfraRelevantPath(path) {
+    if (path === 'supabase' || path.startsWith('supabase/'))
+        return true;
+    if (DO_SPEC_RE.test(path))
+        return true;
+    if (KAMAL_SPEC_RE.test(path))
+        return true;
+    if (INFRA_EXTENSION_RE.test(path))
+        return true;
+    const base = path.split('/').pop() ?? path;
+    return INFRA_BASENAME_RE.test(base);
+}
+/** Do any of a diff's paths touch infra-relevant CONFIG/IaC files? */
+export function diffTouchesInfra(paths) {
+    return paths.some(isInfraRelevantPath);
+}
+/**
+ * the source-aware carry/re-extract decision for the hosted walk.
+ *
+ * True iff the diff touches a CONFIG/IaC infra path (diffTouchesInfra) OR a
+ * SOURCE path that one of the ACTIVE source-grep adapters reads. `sourceScanners`
+ * is the list of `scansSourcePath` predicates for the adapters whose detect()
+ * is positive on this repo (registry.activeSourceScanners) — pass an empty list
+ * (or omit) for a repo with no source-grep adapter, and this collapses to
+ * `diffTouchesInfra`, preserving the carry optimization for config-only stacks.
+ */
+export function diffTouchesInfraWithSources(paths, sourceScanners = []) {
+    if (diffTouchesInfra(paths))
+        return true;
+    if (sourceScanners.length === 0)
+        return false;
+    return paths.some((p) => sourceScanners.some((scans) => scans(p)));
+}
+//# sourceMappingURL=relevance.js.map

package/dist/infra/relevance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relevance.js","sourceRoot":"","sources":["../../src/infra/relevance.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,4EAA4E;AAC5E,mEAAmE;AACnE,sCAAsC;AACtC,EAAE;AACF,iCAAiC;AACjC,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,cAAc;AACd,iFAAiF;AACjF,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,kFAAkF;AAClF,2EAA2E;AAC3E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,gFAAgF;AAChF,4EAA4E;AAC5E,kFAAkF;AAClF,qEAAqE;AACrE,EAAE;AACF,iFAAiF;AACjF,qCAAqC;AACrC,4EAA4E;AAC5E,2FAA2F;AAC3F,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,2GAA2G;AAC3G,4EAA4E;AAC5E,wCAAwC;AACxC,mGAAmG;AACnG,kGAAkG;AAClG,0EAA0E;AAC1E,kFAAkF;AAClF,+FAA+F;AAC/F,+DAA+D;AAC/D,uEAAuE;AACvE,mFAAmF;AACnF,mFAAmF;AACnF,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,oEAAoE;AACpE,2EAA2E;AAC3E,mEAAmE;AAEnE,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,IAAI;IACF;QACE,8BAA8B;QAC9B,gBAAgB,EAAE,GAAG;QACrB,iBAAiB,EAAE,GAAG;QACtB,eAAe,EAAE,GAAG;QACpB,eAAe,EAAE,8CAA8C;QAC9C,wDAAwD;QACzE,eAAe;QACf,uBAAuB;QACvB,YAAY;QACZ,gBAAgB;QAChB,uBAAuB;QACvB,iBAAiB;QACjB,UAAU;QACV,YAAY;QACZ,cAAc;QACd,gBAAgB;QAChB,sBAAsB,EAAE,6CAA6C;QACrE,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,YAAY;QACZ,YAAY;QACZ,oBAAoB;QACpB,iBAAiB;QACjB,aAAa;QACb,eAAe;QACf,iBAAiB;QACjB,6BAA6B;QAC7B,4BAA4B,EAAE,kEAAkE;QAChG,iBAAiB;QACjB,uBAAuB;KACxB,CAAC,IAAI,CAAC,GAAG,CAAC;IACX,IAAI,CACP,CAAC;AAEF,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAE3E,4EAA4E;AAC5E,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C;yDACyD;AACzD,MAAM,aAAa,GAAG,iDAAiD,CAAC;AAExE,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAwB,EACxB,iBAA2D,EAAE;IAE7D,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/infra/render/render-parse.d.ts

@@ -0,0 +1,76 @@
+export type RenderServiceType = 'web' | 'worker' | 'cron' | 'pserv' | 'static';
+export interface RenderEnvVar {
+    key?: string;
+    /** Literal string value. */
+    value?: string;
+    /** Auto-generated secret — treat as metadata only. */
+    generateValue?: boolean;
+    /** fromDatabase: { name: string; property: string } — the service reads from a db. */
+    fromDatabase?: {
+        name?: string;
+        property?: string;
+    };
+    /** fromService: { name: string; type: string; property: string } — reads a peer's prop. */
+    fromService?: {
+        name?: string;
+        type?: string;
+        property?: string;
+    };
+}
+export interface RenderService {
+    name: string;
+    type: RenderServiceType;
+    /**
+     * The original type string from the YAML, preserved verbatim.
+     * Equals `type` for known service types; differs when an unrecognised type
+     * caused the parser to fall back to 'web' so the metadata can record the
+     * actual declared value rather than the fallback.
+     */
+    rawType: string;
+    /** Runtime: node | python | ruby | go | rust | elixir | docker */
+    runtime?: string;
+    buildCommand?: string;
+    startCommand?: string;
+    /** Build plan tier. */
+    plan?: string;
+    /** The git branch to track. */
+    branch?: string;
+    autoDeploy?: boolean;
+    /**
+     * the monorepo base dir Render runs build/start from (the service's
+     * source root). Repo-relative.
+     */
+    rootDir?: string;
+    /** Docker runtime — path to the Dockerfile (its dir is the build context). */
+    dockerfilePath?: string;
+    /** Docker runtime — explicit build-context dir (overrides the Dockerfile's dir). */
+    dockerContext?: string;
+    envVars: RenderEnvVar[];
+    /** Routes for static sites. */
+    routes?: Array<{
+        type?: string;
+        source?: string;
+        destination?: string;
+    }>;
+}
+export interface RenderDatabase {
+    /** Logical name used as the target for fromDatabase references. */
+    name: string;
+    plan?: string;
+    region?: string;
+    postgresMajorVersion?: number | string;
+    databaseName?: string;
+    user?: string;
+}
+export interface RenderRedis {
+    name: string;
+    plan?: string;
+    region?: string;
+}
+export interface RenderConfig {
+    services: RenderService[];
+    databases: RenderDatabase[];
+    redis: RenderRedis[];
+}
+export declare function parseRenderConfig(yamlText: string): RenderConfig;
+//# sourceMappingURL=render-parse.d.ts.map

package/dist/infra/render/render-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-parse.d.ts","sourceRoot":"","sources":["../../../src/infra/render/render-parse.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sFAAsF;IACtF,YAAY,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,2FAA2F;IAC3F,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uBAAuB;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AA2HD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAyBhE"}