@backthread/extractor 0.1.0

package/dist/infra/sst/sst.js

@@ -0,0 +1,236 @@
+// the SST InfraAdapter (net-new infra coverage, child of ).
+//
+// SST v3 ("Ion") is an AWS-targeting IaC framework for TS apps: `sst.config.ts`
+// declares Functions, Services, static sites, buckets, queues, secrets, etc. as
+// `new sst.aws.*(...)` call sites. This is the config-as-code sibling of the
+// Pulumi adapter — it reuses the same ts-morph construct extraction (sst-parse.ts)
+// and the same  image resolver for container image refs.
+//
+// Kind mapping (locked 8-kind InfraModuleKind enum — map onto it, never weaken):
+//   Function / Cron / Api / AppSync        → worker       (serverless compute)
+//   Nextjs / Astro / Remix / StaticSite /… → static-site  (built artifact on a CDN)
+//   Service / Cluster / Task               → container    (ECS/Fargate workloads)
+//   Bucket / Dynamo / Postgres / Aurora /… → datastore
+//   Queue / SnsTopic / Bus / Realtime      → queue
+//   Secret                                 → secret-store
+//   Cdn / Router                           → cdn
+// (NB: the epic ticket loosely grouped `Service` under worker/static-site; the
+// locked enum has a dedicated `container` kind for exactly ECS/Fargate, so a
+// Service maps to `container` — the more precise label, per the adapter discipline
+// "map onto the enum correctly; fix the classifier, never weaken it.")
+// An UNKNOWN `sst.*` construct (Vpc, Router-as-plumbing, a future type) emits NO
+// node and is logged — graceful degradation with no catch-all guessed kind.
+//
+// sourceRoots, kind-aware + deterministic (literal strings only; a
+// `${…}` interpolation is unresolvable → skipped, never guessed):
+//   worker      → `handler:` / `job:` file path → its DIR
+//   static-site → `path:` → that dir
+//   container   → `image: { context }` / `dockerfile:` → its dir; a bare
+//                 `image: "ref"` → the  resolver (image → in-repo Dockerfile
+//                 build context). Unresolvable → none (honest "Other").
+// A source root that resolves to the repo root ('') is dropped (never a catch-all).
+//
+// Edges: a construct that references another construct's variable (`link: [bucket]`,
+// `{ cluster }`) → an edge, verb by the TARGET's kind (datastore→stores-in,
+// queue→publishes, secret-store→reads, else calls) — the docker-compose precedent.
+//
+// Zone label: "SST" (PROVIDER_ZONE_LABEL['sst'] in assemble/zones.ts).
+// Config-only (no scansSourcePath — it reads sst.config.ts, not app source; the
+// relevance gate catches sst.config.* via diffTouchesInfra). Deterministic, no LLM.
+import { existsSync, readFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { buildDockerfileIndex, resolveImageToSourceRoots } from '../image-resolve.js';
+import { extractSstConstructs } from './sst-parse.js';
+const CONFIG_NAMES = ['sst.config.ts', 'sst.config.mjs', 'sst.config.js', 'sst.config.cjs'];
+// ---------------------------------------------------------------------------
+// Construct → InfraModuleKind. Match on the construct's last segment.
+const KIND_RULES = [
+    // Static sites / SSR frameworks (built artifact served from a CDN).
+    [/^(?:Nextjs|Astro|Remix|SvelteKit|SolidStart|Nuxt|React|Vue|Angular|TanStackStart|StaticSite)$/, 'static-site'],
+    // Serverless compute.
+    [/^(?:Function|Cron|Api|ApiGatewayV2|ApiGatewayV1|AppSync)$/, 'worker'],
+    // Long-running containers (ECS / Fargate).
+    [/^(?:Service|Cluster|Task)$/, 'container'],
+    // Persistent storage / databases.
+    [/^(?:Bucket|Dynamo|Postgres|Aurora|Mysql|Database|Redis|Efs|OpenSearch|Vector)$/, 'datastore'],
+    // Queues / pub-sub.
+    [/^(?:Queue|SnsTopic|Topic|Bus|EventBus|Realtime)$/, 'queue'],
+    // Secrets.
+    [/^Secret$/, 'secret-store'],
+    // CDN / edge routing.
+    [/^(?:Cdn|Router)$/, 'cdn'],
+];
+/** The InfraModuleKind for an SST construct type, or null when unrecognized. */
+export function sstKind(constructType) {
+    for (const [re, kind] of KIND_RULES)
+        if (re.test(constructType))
+            return kind;
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Path helpers (repo-relative, normalized) — same idiom as pulumi.ts/compose.ts.
+/** Normalize a repo-relative path: backslashes→/, collapse `.`/`./`, strip trailing `/`. */
+function normalizeRoot(p) {
+    return p.replace(/\\/g, '/').replace(/^\.(?:\/|$)/, '').replace(/\/+$/, '');
+}
+/** The repo-relative directory of a repo-relative file path ('' = repo root). */
+function dirOfPath(relPath) {
+    const n = normalizeRoot(relPath);
+    const i = n.lastIndexOf('/');
+    return i === -1 ? '' : n.slice(0, i);
+}
+/** An SST handler `path/to/file.exportName` → the handler file's DIR. */
+function handlerDir(handler) {
+    // Strip the trailing `.export` segment to recover the file path, then its dir.
+    const file = handler.replace(/\.[^./]+$/, '');
+    return dirOfPath(file);
+}
+/** Literal capture-group-1 matches of `re` over `text`. */
+function literalValues(text, re) {
+    const out = [];
+    let m;
+    re.lastIndex = 0;
+    while ((m = re.exec(text)) !== null)
+        out.push(m[1]);
+    return out;
+}
+// ---------------------------------------------------------------------------
+// kind-aware deployment-target source roots (deterministic, no LLM).
+/**
+ * The repo-relative source roots an SST construct deploys, from its props-args
+ * text. Kind-aware so a static-site's `path:` and a route's `path:` can't
+ * cross-contaminate. `dockerfileIndex` powers the image→source resolver. Pure.
+ */
+export function sstSourceRoots(kind, argsText, dockerfileIndex) {
+    if (!argsText)
+        return [];
+    const roots = new Set();
+    const add = (d) => {
+        if (d)
+            roots.add(d);
+    };
+    if (kind === 'worker') {
+        // `handler: "src/api.handler"` / `job: "src/cron.handler"` → the file's dir.
+        for (const v of literalValues(argsText, /\b(?:handler|job|function)\s*:\s*["'`]([^"'`$]+)["'`]/g)) {
+            add(handlerDir(v));
+        }
+    }
+    else if (kind === 'static-site') {
+        // `path: "packages/web"` → that dir IS the site source.
+        for (const v of literalValues(argsText, /\bpath\s*:\s*["'`]([^"'`$]+)["'`]/g)) {
+            add(normalizeRoot(v));
+        }
+    }
+    else if (kind === 'container') {
+        // `image: { context: "packages/api" }` → the build-context dir.
+        for (const v of literalValues(argsText, /\bcontext\s*:\s*["'`]([^"'`$]+)["'`]/g))
+            add(normalizeRoot(v));
+        // `dockerfile: "packages/api/Dockerfile"` → its dir.
+        for (const v of literalValues(argsText, /\bdockerfile\s*:\s*["'`]([^"'`$]+)["'`]/g))
+            add(dirOfPath(v));
+        // A bare `image: "myorg/api:1"` (string) → the  resolver. `image: {` has
+        // no quote after the colon, so this regex only matches the string form.
+        if (dockerfileIndex) {
+            for (const v of literalValues(argsText, /\bimage\s*:\s*["'`]([^"'`$]+)["'`]/g)) {
+                for (const r of resolveImageToSourceRoots(v, dockerfileIndex))
+                    roots.add(r);
+            }
+        }
+    }
+    return [...roots].sort();
+}
+// ---------------------------------------------------------------------------
+// Pure graph builder. ts-morph-extracted constructs injected so it's
+// unit-testable with no real repo (the pulumi/netlify split).
+/** Edge verb for a reference whose TARGET has `kind` (the docker-compose mapping). */
+function edgeVerb(targetKind) {
+    if (targetKind === 'datastore')
+        return 'stores-in';
+    if (targetKind === 'queue')
+        return 'publishes';
+    if (targetKind === 'secret-store')
+        return 'reads';
+    return 'calls';
+}
+export function buildSstGraph({ constructs, root, dockerfileIndex, }) {
+    const nodes = [];
+    const kindByVar = new Map();
+    const nodeIdByVar = new Map();
+    // Keep only classifiable constructs; remember each one's resolved kind so edges
+    // can pick the right verb and so a ref to an unknown construct emits no edge.
+    const kept = [];
+    for (const c of constructs) {
+        const kind = sstKind(c.constructType);
+        if (!kind) {
+            console.warn(`  [sst] skipping unrecognized construct '${c.construct}' (no InfraModuleKind mapping)`);
+            continue;
+        }
+        const nodeId = `resource:${c.refAddr}`;
+        kept.push({ c, kind, nodeId });
+        if (c.varName) {
+            kindByVar.set(c.varName, kind);
+            nodeIdByVar.set(c.varName, nodeId);
+        }
+    }
+    for (const { c, kind, nodeId } of kept) {
+        const roots = sstSourceRoots(kind, c.argsText, dockerfileIndex);
+        const label = c.name && !c.name.includes(':') ? c.name : c.constructType;
+        nodes.push({
+            id: nodeId,
+            label,
+            kind,
+            provenance: 'declared',
+            metadata: { provider: 'sst', construct: c.construct, ...(c.varName ? { varName: c.varName } : {}) },
+            ...(roots.length ? { sourceRoots: roots } : {}),
+        });
+    }
+    // Edges: a construct's referenced identifiers that name another construct's var.
+    // ts-morph identifier extraction never descends into string literals, so a name
+    // string can't invent a phantom edge (the pulumi-ref reasoning).
+    const edges = [];
+    const seen = new Set();
+    for (const { c, nodeId } of kept) {
+        for (const ident of c.referencedIdentifiers) {
+            const tgt = nodeIdByVar.get(ident);
+            if (!tgt || tgt === nodeId)
+                continue;
+            const key = `${nodeId}→${tgt}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            edges.push({ source: nodeId, target: tgt, kind: edgeVerb(kindByVar.get(ident)), metadata: { via: 'sst-link' } });
+        }
+    }
+    return { root, adapter: 'sst', nodes, edges, classificationsNeeded: [] };
+}
+// ---------------------------------------------------------------------------
+// Adapter.
+function findConfig(repoDir) {
+    for (const name of CONFIG_NAMES) {
+        const p = join(repoDir, name);
+        if (existsSync(p))
+            return p;
+    }
+    return undefined;
+}
+export const sstAdapter = {
+    name: 'sst',
+    async detect(repoDir) {
+        return findConfig(repoDir) !== undefined;
+    },
+    async extract(repoDir) {
+        const configPath = findConfig(repoDir);
+        if (!configPath)
+            return { root: repoDir, adapter: 'sst', nodes: [], edges: [], classificationsNeeded: [] };
+        let constructs = [];
+        try {
+            constructs = extractSstConstructs(readFileSync(configPath, 'utf8'), relative(repoDir, configPath));
+        }
+        catch (err) {
+            console.warn(`  [sst] could not parse ${relative(repoDir, configPath)}: ${err.message}`);
+        }
+        // The image resolver needs the repo's Dockerfile index (Service image refs).
+        return buildSstGraph({ constructs, root: repoDir, dockerfileIndex: buildDockerfileIndex(repoDir) });
+    },
+};
+//# sourceMappingURL=sst.js.map

package/dist/infra/sst/sst.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sst.js","sourceRoot":"","sources":["../../../src/infra/sst/sst.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,mFAAmF;AACnF,yDAAyD;AACzD,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,oFAAoF;AACpF,kFAAkF;AAClF,uDAAuD;AACvD,mDAAmD;AACnD,0DAA0D;AAC1D,iDAAiD;AACjD,+EAA+E;AAC/E,6EAA6E;AAC7E,mFAAmF;AACnF,uEAAuE;AACvE,iFAAiF;AACjF,4EAA4E;AAC5E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,0DAA0D;AAC1D,qCAAqC;AACrC,yEAAyE;AACzE,6EAA6E;AAC7E,wEAAwE;AACxE,oFAAoF;AACpF,EAAE;AACF,qFAAqF;AACrF,4EAA4E;AAC5E,mFAAmF;AACnF,EAAE;AACF,uEAAuE;AACvE,gFAAgF;AAChF,oFAAoF;AAEpF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAwB,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAqB,MAAM,gBAAgB,CAAC;AAEzE,MAAM,YAAY,GAAG,CAAC,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAE5F,8EAA8E;AAC9E,sEAAsE;AAEtE,MAAM,UAAU,GAAqC;IACnD,oEAAoE;IACpE,CAAC,+FAA+F,EAAE,aAAa,CAAC;IAChH,sBAAsB;IACtB,CAAC,2DAA2D,EAAE,QAAQ,CAAC;IACvE,2CAA2C;IAC3C,CAAC,4BAA4B,EAAE,WAAW,CAAC;IAC3C,kCAAkC;IAClC,CAAC,gFAAgF,EAAE,WAAW,CAAC;IAC/F,oBAAoB;IACpB,CAAC,kDAAkD,EAAE,OAAO,CAAC;IAC7D,WAAW;IACX,CAAC,UAAU,EAAE,cAAc,CAAC;IAC5B,sBAAsB;IACtB,CAAC,kBAAkB,EAAE,KAAK,CAAC;CAC5B,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,OAAO,CAAC,aAAqB;IAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,UAAU;QAAE,IAAI,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AAEjF,4FAA4F;AAC5F,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AACD,iFAAiF;AACjF,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,yEAAyE;AACzE,SAAS,UAAU,CAAC,OAAe;IACjC,+EAA+E;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AACD,2DAA2D;AAC3D,SAAS,aAAa,CAAC,IAAY,EAAE,EAAU;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AAErE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAqB,EACrB,QAAgB,EAChB,eAAiC;IAEjC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,6EAA6E;QAC7E,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,wDAAwD,CAAC,EAAE,CAAC;YAClG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,wDAAwD;QACxD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,oCAAoC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,uCAAuC,CAAC;YAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,qDAAqD;QACrD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,0CAA0C,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,eAAe,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,qCAAqC,CAAC,EAAE,CAAC;gBAC/E,KAAK,MAAM,CAAC,IAAI,yBAAyB,CAAC,CAAC,EAAE,eAAe,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8DAA8D;AAE9D,sFAAsF;AACtF,SAAS,QAAQ,CAAC,UAA2B;IAC3C,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IACnD,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAC5B,UAAU,EACV,IAAI,EACJ,eAAe,GAKhB;IACC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,IAAI,GAAsE,EAAE,CAAC;IAEnF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,SAAS,gCAAgC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,MAAM;YACV,KAAK;YACL,IAAI;YACJ,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACnG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,gFAAgF;IAChF,iEAAiE;IACjE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,qBAAqB,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM;gBAAE,SAAS;YACrC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,WAAW;AAEX,SAAS,UAAU,CAAC,OAAe;IACjC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAiB;IACtC,IAAI,EAAE,KAAK;IAEX,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;QAC3G,IAAI,UAAU,GAAmB,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,6EAA6E;QAC7E,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;CACF,CAAC"}

package/dist/infra/supabase/supabase-parse.d.ts

@@ -0,0 +1,34 @@
+/** Table names declared by a migration SQL file (public-schema CREATE TABLE). */
+export declare function parseTableNames(sql: string): string[];
+export interface TableRef {
+    /** repo-relative posix path of the file the reference was found in. */
+    file: string;
+    table: string;
+    op: 'reads' | 'writes';
+}
+export interface SupabaseUsage {
+    tableRefs: TableRef[];
+    usesAuth: boolean;
+    usesStorage: boolean;
+    usesRealtime: boolean;
+}
+/**
+ * Pure scan of one source file's text for Supabase usage. `file` is the
+ * repo-relative posix path stamped onto each TableRef (so the assemble join can
+ * resolve it to a code module via fileModuleMap).
+ */
+export declare function parseSupabaseUsage(content: string, file: string): SupabaseUsage;
+/** Merge per-file usage scans into one repo-level signal (refs deduped). */
+export declare function mergeUsage(scans: SupabaseUsage[]): SupabaseUsage;
+export interface SubServiceFlags {
+    auth?: boolean;
+    storage?: boolean;
+    realtime?: boolean;
+}
+/**
+ * Read `[auth]/[storage]/[realtime]` `enabled` flags from a parsed config.toml
+ * tree (see parseTomlSubset). A section that's present with no explicit
+ * `enabled = false` counts as enabled (Supabase's default).
+ */
+export declare function readSubServiceFlags(tree: Record<string, unknown>): SubServiceFlags;
+//# sourceMappingURL=supabase-parse.d.ts.map

package/dist/infra/supabase/supabase-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-parse.d.ts","sourceRoot":"","sources":["../../../src/infra/supabase/supabase-parse.ts"],"names":[],"mappings":"AAaA,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBrD;AAED,MAAM,WAAW,QAAQ;IACvB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,GAAG,QAAQ,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;CACvB;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CA+B/E;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,aAAa,CAkBhE;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAQlF"}

package/dist/infra/supabase/supabase-parse.js

@@ -0,0 +1,113 @@
+// Supabase config + migration + source-usage parsers.
+//
+// All pure (string/regex in, data out) and dependency-free — the same vitest
+// invariant as classify/env-vars.ts and the CF parser: unit-testable without
+// the Supabase/Anthropic import chain.
+//
+// Three deterministic signals feed the adapter:
+//   1. supabase/migrations/*.sql  → the table inventory (CREATE TABLE names)
+//   2. source `.from('table')`    → app→datastore read/write edges, with the
+//                                    operation verb inferred from the chain
+//   3. source auth/storage/realtime usage → which managed sub-services are
+//      actually used (evidence-gated, so we never hallucinate a sub-service)
+/** Table names declared by a migration SQL file (public-schema CREATE TABLE). */
+export function parseTableNames(sql) {
+    const tables = new Set();
+    // Strip SQL comments first (PR #9 review): a `-- create table foo` line or a
+    // `/* … */` block must not register a phantom table.
+    const src = sql.replace(/--[^\n]*/g, ' ').replace(/\/\*[\s\S]*?\*\//g, ' ');
+    // create [ [global] temp|temporary | unlogged ] table [if not exists]
+    //   [schema.]name — schema and name may be double-quoted, and a quoted name
+    //   can contain non-word chars (e.g. "my-orders"), so capture the quoted and
+    //   bare forms separately instead of the old loose `"?(\w+)"?` (which dropped
+    //   everything after the first hyphen and missed temp/unlogged tables).
+    const re = /create\s+(?:(?:global\s+)?(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?(?:(?:"([^"]+)"|(\w+))\s*\.\s*)?(?:"([^"]+)"|(\w+))/gi;
+    let m;
+    while ((m = re.exec(src))) {
+        const schema = m[1] ?? m[2];
+        const name = m[3] ?? m[4];
+        if (!name)
+            continue;
+        // Skip non-public schemas (auth.*, storage.*, realtime.*) — those are
+        // Supabase-internal, not the app's own tables.
+        if (schema && schema !== 'public')
+            continue;
+        tables.add(name);
+    }
+    return [...tables].sort();
+}
+const WRITE_OPS = /\.(insert|update|upsert|delete)\s*\(/;
+/**
+ * Pure scan of one source file's text for Supabase usage. `file` is the
+ * repo-relative posix path stamped onto each TableRef (so the assemble join can
+ * resolve it to a code module via fileModuleMap).
+ */
+export function parseSupabaseUsage(content, file) {
+    const tableRefs = [];
+    // `.from('table')` — but NOT `.storage.from('bucket')` (a storage bucket, not
+    // a DB table), and NOT JS built-ins that also expose a string-arg `.from`
+    // (Array.from('abc'), Buffer.from(...), typed-array `.from`, etc.). The old
+    // code only excluded `storage`, so `Array.from('abc')` produced a phantom
+    // table `abc` (PR #9 review). We skip when the receiver token is one of these.
+    const re = /\.from\(\s*['"`]([^'"`]+)['"`]\s*\)/g;
+    const NOT_SUPABASE = /(?:^|[^A-Za-z0-9_$])(?:storage|Array|Buffer|Object|Promise|Set|Map|Date|String|Number|JSON|Reflect|Int8Array|Uint8Array|Uint8ClampedArray|Int16Array|Uint16Array|Int32Array|Uint32Array|Float32Array|Float64Array|BigInt64Array|BigUint64Array)$/;
+    let m;
+    while ((m = re.exec(content))) {
+        // Look back far enough to see the full receiver identifier before `.from`.
+        const before = content.slice(Math.max(0, m.index - 24), m.index);
+        if (NOT_SUPABASE.test(before))
+            continue;
+        // Infer the operation from THIS `.from(...)` chain only — bound the window
+        // at the next `.from(` call (and a 200-char hard cap) so a write op in a
+        // later statement doesn't bleed onto this read.
+        const tail = content.slice(m.index + m[0].length);
+        const nextFrom = tail.search(/\.from\(/);
+        const end = m.index + m[0].length + (nextFrom === -1 ? 200 : Math.min(nextFrom, 200));
+        const window = content.slice(m.index, end);
+        const op = WRITE_OPS.test(window) ? 'writes' : 'reads';
+        tableRefs.push({ file, table: m[1], op });
+    }
+    return {
+        tableRefs,
+        usesAuth: /\.auth\./.test(content) || /supabase\.auth\b/.test(content),
+        usesStorage: /\.storage\./.test(content),
+        usesRealtime: /\.channel\s*\(/.test(content) || /\.realtime\b/.test(content),
+    };
+}
+/** Merge per-file usage scans into one repo-level signal (refs deduped). */
+export function mergeUsage(scans) {
+    const seen = new Set();
+    const tableRefs = [];
+    let usesAuth = false;
+    let usesStorage = false;
+    let usesRealtime = false;
+    for (const s of scans) {
+        for (const r of s.tableRefs) {
+            const key = `${r.file}\x1f${r.table}\x1f${r.op}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            tableRefs.push(r);
+        }
+        usesAuth ||= s.usesAuth;
+        usesStorage ||= s.usesStorage;
+        usesRealtime ||= s.usesRealtime;
+    }
+    return { tableRefs, usesAuth, usesStorage, usesRealtime };
+}
+/**
+ * Read `[auth]/[storage]/[realtime]` `enabled` flags from a parsed config.toml
+ * tree (see parseTomlSubset). A section that's present with no explicit
+ * `enabled = false` counts as enabled (Supabase's default).
+ */
+export function readSubServiceFlags(tree) {
+    const flag = (key) => {
+        const section = tree[key];
+        if (!section || typeof section !== 'object')
+            return undefined;
+        const enabled = section.enabled;
+        return enabled === false ? false : true;
+    };
+    return { auth: flag('auth'), storage: flag('storage'), realtime: flag('realtime') };
+}
+//# sourceMappingURL=supabase-parse.js.map

package/dist/infra/supabase/supabase-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-parse.js","sourceRoot":"","sources":["../../../src/infra/supabase/supabase-parse.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,uCAAuC;AACvC,EAAE;AACF,gDAAgD;AAChD,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAE7E,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,GACN,kJAAkJ,CAAC;IACrJ,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,sEAAsE;QACtE,+CAA+C;QAC/C,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAgBD,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,EAAE,GAAG,sCAAsC,CAAC;IAClD,MAAM,YAAY,GAChB,kPAAkP,CAAC;IACrP,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACxC,2EAA2E;QAC3E,yEAAyE;QACzE,gDAAgD;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAmB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QACtE,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC;QACxB,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC;QAC9B,YAAY,KAAK,CAAC,CAAC,YAAY,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC5D,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAuB,EAAE;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,MAAM,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC;QAC7D,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AACtF,CAAC"}

package/dist/infra/supabase/supabase.d.ts

@@ -0,0 +1,15 @@
+import type { InfraAdapter, InfraGraph } from '../types.js';
+import { type SubServiceFlags, type SupabaseUsage } from './supabase-parse.js';
+/**
+ * Pure graph builder. Separated from the fs/grep IO so it's unit-testable with
+ * synthetic inputs.
+ */
+export declare function buildSupabaseGraph(args: {
+    tables: string[];
+    functions: string[];
+    flags: SubServiceFlags;
+    usage: SupabaseUsage;
+    root: string;
+}): InfraGraph;
+export declare const supabaseAdapter: InfraAdapter;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/infra/supabase/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../../src/infra/supabase/supabase.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAa,UAAU,EAAa,MAAM,aAAa,CAAC;AAGlF,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAqF7B;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,UAAU,CA+Db;AAED,eAAO,MAAM,eAAe,EAAE,YAuB7B,CAAC"}

package/dist/infra/supabase/supabase.js

@@ -0,0 +1,198 @@
+// the Supabase InfraAdapter (v0).
+//
+// Surfaces the managed-backend topology the code-import graph can't see: the
+// Postgres datastore (with its table inventory), the edge functions, and the
+// auth/storage/realtime sub-services — plus the app→datastore read/write edges
+// that come from grepping `supabase.from('table')` call sites.
+//
+// Evidence-gated, never hallucinated (the DoD): a sub-service node is emitted
+// only when config.toml enables it OR a source grep proves the app uses it.
+// backthread's repo has no config.toml, so the dogfood path is pure source evidence.
+//
+// Kind mapping (respecting the locked 8-kind InfraModuleKind enum — we map onto
+// it, never weaken it):
+//   Postgres / Storage → datastore   (the enum's "DB, blob store, cache")
+//   Edge function      → worker       (serverless compute)
+//   Realtime           → queue        (pub/sub message bus)
+//   Auth               → external-api (a managed identity service you call)
+//
+// v0 scope: tables live on the datastore node's metadata (per-table child nodes
+// are a later refinement); app→datastore edges carry the table in edge metadata
+// but resolve at datastore granularity.
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { walkRepo } from '../walk.js';
+import { parseTomlSubset } from '../cloudflare/wrangler-parse.js';
+import { parseTableNames, parseSupabaseUsage, mergeUsage, readSubServiceFlags, } from './supabase-parse.js';
+const SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const supabaseDir = (repoDir) => join(repoDir, 'supabase');
+function hasSupabaseLayout(repoDir) {
+    const dir = supabaseDir(repoDir);
+    if (!existsSync(dir))
+        return false;
+    return (existsSync(join(dir, 'config.toml')) ||
+        existsSync(join(dir, 'migrations')) ||
+        existsSync(join(dir, 'functions')));
+}
+function listDir(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+}
+/** Concatenate every migration SQL file's table declarations. */
+function collectTables(repoDir) {
+    const dir = join(supabaseDir(repoDir), 'migrations');
+    if (!existsSync(dir))
+        return [];
+    const tables = new Set();
+    for (const e of listDir(dir)) {
+        if (e.isFile() && e.name.endsWith('.sql')) {
+            try {
+                for (const t of parseTableNames(readFileSync(join(dir, e.name), 'utf8')))
+                    tables.add(t);
+            }
+            catch {
+                /* skip unreadable migration */
+            }
+        }
+    }
+    return [...tables].sort();
+}
+/** Each immediate subdirectory of supabase/functions is one edge function. */
+function collectFunctions(repoDir) {
+    const dir = join(supabaseDir(repoDir), 'functions');
+    if (!existsSync(dir))
+        return [];
+    return listDir(dir)
+        .filter((e) => e.isDirectory() && !e.name.startsWith('_'))
+        .map((e) => e.name)
+        .sort();
+}
+function readConfigFlags(repoDir) {
+    const cfg = join(supabaseDir(repoDir), 'config.toml');
+    if (!existsSync(cfg))
+        return {};
+    try {
+        return readSubServiceFlags(parseTomlSubset(readFileSync(cfg, 'utf8')));
+    }
+    catch {
+        return {};
+    }
+}
+/** Walk repo source files and grep each for Supabase usage. */
+function grepUsage(repoDir) {
+    const scans = [];
+    walkRepo(repoDir, {
+        onFile: (abs, e) => {
+            if (!SOURCE_EXT.test(e.name))
+                return;
+            let content;
+            try {
+                content = readFileSync(abs, 'utf8');
+            }
+            catch {
+                return;
+            }
+            if (!content.includes('.from(') && !content.includes('.auth') && !content.includes('.storage') && !content.includes('.channel') && !content.includes('.realtime')) {
+                return; // cheap pre-filter
+            }
+            const rel = relative(repoDir, abs).split('\\').join('/');
+            scans.push(parseSupabaseUsage(content, rel));
+        },
+    });
+    return mergeUsage(scans);
+}
+const DB_ID = 'db';
+/**
+ * Pure graph builder. Separated from the fs/grep IO so it's unit-testable with
+ * synthetic inputs.
+ */
+export function buildSupabaseGraph(args) {
+    const { tables, functions, flags, usage, root } = args;
+    const nodes = [];
+    const edges = [];
+    // The Postgres datastore — the always-present anchor. Table inventory lives
+    // on its metadata.
+    nodes.push({
+        id: DB_ID,
+        label: 'Supabase Postgres',
+        kind: 'datastore',
+        provenance: 'declared',
+        metadata: { provider: 'supabase', tables: tables.slice(0, 50), tableCount: tables.length },
+    });
+    // Sub-services — evidence-gated. config.toml flag OR source grep proves use.
+    const subServices = [
+        ['auth', 'Supabase Auth', 'external-api', flags.auth === true || usage.usesAuth],
+        ['storage', 'Supabase Storage', 'datastore', flags.storage === true || usage.usesStorage],
+        ['realtime', 'Supabase Realtime', 'queue', flags.realtime === true || usage.usesRealtime],
+    ];
+    for (const [id, label, kind, present] of subServices) {
+        if (!present)
+            continue;
+        const node = { id, label, kind, provenance: 'declared', metadata: { provider: 'supabase' } };
+        nodes.push(node);
+    }
+    // Edge functions → worker nodes. each function deploys the code under
+    // `supabase/functions/<name>`, so its source attributes to the Supabase box.
+    for (const fn of functions) {
+        nodes.push({
+            id: `function:${fn}`,
+            label: `${fn} (edge function)`,
+            kind: 'worker',
+            provenance: 'declared',
+            metadata: { provider: 'supabase', function: fn },
+            sourceRoots: [`supabase/functions/${fn}`],
+        });
+    }
+    // App→datastore read/write edges. Source is a repo-relative file path the
+    // assemble join resolves to a code module via fileModuleMap; unresolved refs
+    // (e.g. Deno edge-function files outside the TS cluster) drop there. Dedupe to
+    // one edge per (file, op) — the table set rides along in metadata.
+    const edgeKey = new Map();
+    for (const r of usage.tableRefs) {
+        const key = `${r.file} ${r.op}`;
+        const existing = edgeKey.get(key);
+        if (existing) {
+            const tablesMeta = existing.metadata.tables;
+            if (!tablesMeta.includes(r.table))
+                tablesMeta.push(r.table);
+            continue;
+        }
+        edgeKey.set(key, {
+            source: r.file,
+            target: DB_ID,
+            kind: r.op,
+            metadata: { tables: [r.table], via: 'supabase-js' },
+        });
+    }
+    edges.push(...edgeKey.values());
+    return { root, adapter: 'supabase', nodes, edges, classificationsNeeded: [] };
+}
+export const supabaseAdapter = {
+    name: 'supabase',
+    async detect(repoDir) {
+        return hasSupabaseLayout(repoDir);
+    },
+    // this adapter greps ANY app source file (SOURCE_EXT) for
+    // `.from(`/`.auth`/`.storage`/`.channel`/`.realtime` to build app→Postgres
+    // edges and gate the Auth/Storage/Realtime sub-service nodes. So a change to
+    // any such source path can change the infra graph and MUST force a re-extract
+    // in the diff-driven hosted walk — the dogfood target (example-app, no
+    // config.toml) derives its ENTIRE Supabase topology from this source grep.
+    scansSourcePath(path) {
+        return SOURCE_EXT.test(path);
+    },
+    async extract(repoDir) {
+        return buildSupabaseGraph({
+            tables: collectTables(repoDir),
+            functions: collectFunctions(repoDir),
+            flags: readConfigFlags(repoDir),
+            usage: grepUsage(repoDir),
+            root: repoDir,
+        });
+    },
+};
+//# sourceMappingURL=supabase.js.map

package/dist/infra/supabase/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../../src/infra/supabase/supabase.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,qFAAqF;AACrF,EAAE;AACF,gFAAgF;AAChF,wBAAwB;AACxB,0EAA0E;AAC1E,2DAA2D;AAC3D,4DAA4D;AAC5D,4EAA4E;AAC5E,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,wCAAwC;AAExC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAe,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAEhD,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAEnE,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1F,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE;QAChB,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACjB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO;YACrC,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClK,OAAO,CAAC,mBAAmB;YAC7B,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,CAAC;AAEnB;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAMlC;IACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,4EAA4E;IAC5E,mBAAmB;IACnB,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;KAC3F,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,WAAW,GAAwD;QACvE,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;QAChF,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,CAAC;QACzF,CAAC,UAAU,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC;KAC1F,CAAC;IACF,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAc,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC;QACxG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,sEAAsE;IACtE,6EAA6E;IAC7E,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,YAAY,EAAE,EAAE;YACpB,KAAK,EAAE,GAAG,EAAE,kBAAkB;YAC9B,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;YAChD,WAAW,EAAE,CAAC,sBAAsB,EAAE,EAAE,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,mEAAmE;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,UAAU,GAAI,QAAQ,CAAC,QAAS,CAAC,MAAmB,CAAC;YAC3D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACf,MAAM,EAAE,CAAC,CAAC,IAAI;YACd,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,CAAC,EAAE;YACV,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,IAAI,EAAE,UAAU;IAChB,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,0DAA0D;IAC1D,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,eAAe,CAAC,IAAY;QAC1B,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;YAC9B,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC;YACzB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}