@sdd-method/author-cli 0.0.0-stage → 0.1.0

package/dist/lib/api-surface/analyzers/serverless.js

@@ -0,0 +1,336 @@
+import { parse as parseYaml } from "yaml";
+import { allBySuffix } from "../file-set.js";
+// node-serverless analyzer.
+//
+// The serverless.yml in these repos is Go/Helm-templated (`{{ ... }}`, `${self:...}`, `${opt:...}`).
+// Strategy: sanitise the template directives so the YAML parser succeeds, then read functions/events
+// /provider/resources structurally. If the sanitised doc still won't parse, fall back to a line-based
+// regex sweep so we never come back empty on a real (messy) file.
+export async function analyzeServerless(fileSet) {
+    const serverlessFiles = fileSet.files.filter((f) => {
+        const lower = f.toLowerCase();
+        return lower.endsWith("serverless.yml") || lower.endsWith("serverless.yaml");
+    });
+    const endpoints = [];
+    const downstream = [];
+    const sharedInfra = new Set();
+    const externalContracts = new Set();
+    let runtime = "";
+    for (const slPath of serverlessFiles) {
+        const raw = await fileSet.read(slPath);
+        if (raw === "")
+            continue;
+        const sanitised = sanitiseTemplate(raw);
+        let doc = null;
+        try {
+            doc = parseYaml(sanitised);
+        }
+        catch {
+            doc = null;
+        }
+        if (isRecord(doc)) {
+            runtime = runtime || extractRuntime(doc);
+            collectFromStructured(doc, endpoints, downstream, sharedInfra);
+        }
+        else {
+            // Structured parse failed — fall back to regex extraction over the raw text.
+            collectFromRegex(raw, endpoints, downstream, sharedInfra);
+            runtime = runtime || (raw.match(/^\s*runtime:\s*([\w.-]+)/m)?.[1] ?? "");
+        }
+    }
+    // Scan handler source for AWS SDK clients + outbound HTTP base URLs → downstream deps.
+    await scanHandlerSources(fileSet, downstream, externalContracts);
+    dedupeDownstream(downstream);
+    return {
+        stack: "node-serverless",
+        component_type: "service",
+        endpoints,
+        dependencies: { downstream, upstream: [] },
+        external_contracts: [...externalContracts].sort(),
+        deployment: { runtime, shared_infra: [...sharedInfra].sort() },
+    };
+}
+/**
+ * Make a Helm/Go-templated serverless.yml parseable as YAML:
+ *  - drop whole control lines (`{{- if ... }}`, `{{ range ... }}`, `{{ end }}`) — they're block
+ *    directives, not values, so removing the line keeps the surrounding structure valid;
+ *  - replace inline `{{ expr }}` with a quoted placeholder so a value position stays a scalar;
+ *  - leave `${self:...}` / `${opt:...}` serverless vars alone (they're valid YAML scalars already,
+ *    just quote bare ones that would otherwise be read as a mapping).
+ */
+export function sanitiseTemplate(raw) {
+    const out = [];
+    for (const line of raw.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        // A line whose entire content is one template directive (control flow `{{ if }}`/`{{ end }}`,
+        // an assignment `{{ $x := ... }}`, or a bare expression `{{ .Values.X }}`) is a directive, not a
+        // mapping/value — drop the whole line so the surrounding YAML structure stays valid. Detected by:
+        // starts with `{{`/`{{-` and ends with `}}`/`-}}` with no YAML payload before/after the braces.
+        if (/^\{\{-?[\s\S]*?-?\}\}$/.test(trimmed)) {
+            continue;
+        }
+        // Inline `{{ ... }}` in a value position → placeholder scalar.
+        const replaced = line.replace(/\{\{-?.*?-?\}\}/g, "TEMPLATED");
+        out.push(replaced);
+    }
+    return out.join("\n");
+}
+function extractRuntime(doc) {
+    const provider = doc["provider"];
+    if (isRecord(provider) && typeof provider["runtime"] === "string") {
+        return provider["runtime"];
+    }
+    return "";
+}
+function collectFromStructured(doc, endpoints, downstream, sharedInfra) {
+    const functions = doc["functions"];
+    if (isRecord(functions)) {
+        for (const [fnName, fnDef] of Object.entries(functions)) {
+            if (!isRecord(fnDef))
+                continue;
+            const handler = typeof fnDef["handler"] === "string" ? fnDef["handler"] : fnName;
+            const events = fnDef["events"];
+            if (!Array.isArray(events))
+                continue;
+            for (const evt of events) {
+                if (!isRecord(evt))
+                    continue;
+                const httpEvt = evt["http"] ?? evt["httpApi"];
+                if (httpEvt !== undefined) {
+                    endpoints.push(httpEndpoint(httpEvt, handler));
+                }
+                // Non-http event sources (sqs/sns/eventBridge) are dependency signals, not endpoints.
+                collectEventSource(evt, fnName, downstream, sharedInfra);
+            }
+        }
+    }
+    // provider.iam + resources + environment → infra + downstream.
+    const provider = doc["provider"];
+    if (isRecord(provider)) {
+        collectInfraFromNode(provider, downstream, sharedInfra);
+    }
+    const resources = doc["resources"];
+    if (resources !== undefined) {
+        collectInfraFromNode(resources, downstream, sharedInfra);
+    }
+}
+function httpEndpoint(httpEvt, handler) {
+    let method = "ANY";
+    let path = "/";
+    let auth = "none";
+    if (typeof httpEvt === "string") {
+        // `http: GET users/list` shorthand.
+        const parts = httpEvt.trim().split(/\s+/);
+        if (parts.length >= 2) {
+            method = parts[0].toUpperCase();
+            path = normalisePath(parts[1]);
+        }
+        else {
+            path = normalisePath(httpEvt);
+        }
+    }
+    else if (isRecord(httpEvt)) {
+        if (typeof httpEvt["method"] === "string")
+            method = httpEvt["method"].toUpperCase();
+        if (typeof httpEvt["path"] === "string")
+            path = normalisePath(httpEvt["path"]);
+        const authorizer = httpEvt["authorizer"];
+        if (typeof authorizer === "string")
+            auth = `authorizer:${authorizer}`;
+        else if (isRecord(authorizer)) {
+            const name = authorizer["name"] ?? authorizer["type"] ?? authorizer["arn"];
+            auth = typeof name === "string" ? `authorizer:${name}` : "authorizer:custom";
+        }
+        else if (httpEvt["private"] === true) {
+            auth = "api-key";
+        }
+    }
+    return { method, path, auth, handler };
+}
+function collectEventSource(evt, fnName, downstream, sharedInfra) {
+    if ("sqs" in evt) {
+        const detail = describeArnRef(evt["sqs"]) || `${fnName}-sqs`;
+        downstream.push({ target: detail, kind: "sqs", detail, load_bearing: true });
+        if (detail)
+            sharedInfra.add(detail);
+    }
+    if ("sns" in evt) {
+        const detail = describeArnRef(evt["sns"]) || `${fnName}-sns`;
+        downstream.push({ target: detail, kind: "sns", detail, load_bearing: true });
+        if (detail)
+            sharedInfra.add(detail);
+    }
+    if ("stream" in evt) {
+        const detail = describeArnRef(evt["stream"]) || `${fnName}-stream`;
+        downstream.push({ target: detail, kind: "dynamodb", detail, load_bearing: true });
+    }
+    if ("eventBridge" in evt) {
+        const eb = evt["eventBridge"];
+        const detail = isRecord(eb) && typeof eb["name"] === "string" ? eb["name"] : `${fnName}-eb`;
+        downstream.push({ target: detail, kind: "eventbridge", detail, load_bearing: false });
+    }
+}
+/** Recursively collect DynamoDB tables, SQS/SNS refs, S3 buckets, VPC from a provider/resources node. */
+function collectInfraFromNode(node, downstream, sharedInfra) {
+    walk(node, (key, value) => {
+        if (!isRecord(value))
+            return;
+        const type = value["Type"];
+        if (typeof type === "string") {
+            const props = isRecord(value["Properties"]) ? value["Properties"] : {};
+            if (type === "AWS::SQS::Queue") {
+                const name = strProp(props, "QueueName") || key;
+                downstream.push({ target: name, kind: "sqs", detail: name, load_bearing: true });
+                sharedInfra.add(name);
+            }
+            else if (type === "AWS::SNS::Topic") {
+                const name = strProp(props, "TopicName") || key;
+                downstream.push({ target: name, kind: "sns", detail: name, load_bearing: true });
+                sharedInfra.add(name);
+            }
+            else if (type === "AWS::DynamoDB::Table") {
+                const name = strProp(props, "TableName") || key;
+                downstream.push({ target: name, kind: "dynamodb", detail: name, load_bearing: true });
+                sharedInfra.add(name);
+            }
+            else if (type === "AWS::S3::Bucket") {
+                const name = strProp(props, "BucketName") || key;
+                downstream.push({ target: name, kind: "s3", detail: name, load_bearing: false });
+                sharedInfra.add(name);
+            }
+        }
+    });
+}
+function strProp(props, key) {
+    const v = props[key];
+    return typeof v === "string" ? v : "";
+}
+/** Visit every (key,value) pair in a nested object/array tree. */
+function walk(node, visit) {
+    if (Array.isArray(node)) {
+        for (const el of node)
+            walk(el, visit);
+        return;
+    }
+    if (isRecord(node)) {
+        for (const [k, v] of Object.entries(node)) {
+            visit(k, v);
+            walk(v, visit);
+        }
+    }
+}
+function describeArnRef(node) {
+    if (typeof node === "string")
+        return node;
+    if (isRecord(node)) {
+        const arn = node["arn"];
+        if (typeof arn === "string")
+            return arn;
+        if (isRecord(arn)) {
+            const getAtt = arn["Fn::GetAtt"];
+            if (Array.isArray(getAtt) && typeof getAtt[0] === "string")
+                return getAtt[0];
+        }
+        const ref = node["Ref"];
+        if (typeof ref === "string")
+            return ref;
+    }
+    return "";
+}
+// --- regex fallback (when YAML won't parse even after sanitising) ---
+function collectFromRegex(raw, endpoints, downstream, sharedInfra) {
+    const lines = raw.split(/\r?\n/);
+    let currentHandler = "";
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const handlerM = line.match(/^\s*handler:\s*([\w.\/-]+)/);
+        if (handlerM)
+            currentHandler = handlerM[1];
+        const methodM = line.match(/^\s*method:\s*([A-Za-z]+)/);
+        if (methodM) {
+            // Look a few lines around for a path:.
+            const path = findNearby(lines, i, /^\s*path:\s*([^\s]+)/) ?? "/";
+            const auth = findNearby(lines, i, /^\s*authorizer:\s*([\w-]+)/) ?? "none";
+            endpoints.push({
+                method: methodM[1].toUpperCase(),
+                path: normalisePath(path),
+                auth: auth === "none" ? "none" : `authorizer:${auth}`,
+                handler: currentHandler || "unknown",
+            });
+        }
+        const sqsM = line.match(/QueueName:\s*['"]?([\w${}:.\-]+)/);
+        if (sqsM) {
+            downstream.push({ target: sqsM[1], kind: "sqs", detail: sqsM[1], load_bearing: true });
+            sharedInfra.add(sqsM[1]);
+        }
+        const tableM = line.match(/TableName:\s*['"]?([\w${}:.\-]+)/);
+        if (tableM) {
+            downstream.push({ target: tableM[1], kind: "dynamodb", detail: tableM[1], load_bearing: true });
+            sharedInfra.add(tableM[1]);
+        }
+    }
+}
+function findNearby(lines, idx, re) {
+    for (let j = Math.max(0, idx - 3); j <= Math.min(lines.length - 1, idx + 3); j++) {
+        const m = lines[j].match(re);
+        if (m)
+            return m[1];
+    }
+    return null;
+}
+// --- handler source scan ---
+const AWS_CLIENT_RE = [
+    { re: /\bnew\s+(?:AWS\.)?DynamoDB(?:Client|\.DocumentClient)?\b|DynamoDbClient\b/, kind: "dynamodb" },
+    { re: /\bnew\s+(?:AWS\.)?SQS\b|SqsClient\b|AmazonSQS\b/, kind: "sqs" },
+    { re: /\bnew\s+(?:AWS\.)?SNS\b|SnsClient\b|AmazonSNS\b/, kind: "sns" },
+    { re: /\bnew\s+(?:AWS\.)?S3\b|S3Client\b|AmazonS3\b/, kind: "s3" },
+    { re: /SecretsManager(?:Client)?\b|AWSSecretsManager\b/, kind: "secretsmanager" },
+];
+async function scanHandlerSources(fileSet, downstream, externalContracts) {
+    const sources = [
+        ...allBySuffix(fileSet.files, ".js"),
+        ...allBySuffix(fileSet.files, ".ts"),
+        ...allBySuffix(fileSet.files, ".java"),
+    ].filter((f) => !/(^|\/)(node_modules|target|dist|build)\//.test(f) && !/\.test\.|Test\.java$/.test(f));
+    for (const path of sources) {
+        const src = await fileSet.read(path);
+        if (src === "")
+            continue;
+        for (const { re, kind } of AWS_CLIENT_RE) {
+            if (re.test(src)) {
+                downstream.push({ target: kind, kind, detail: `client in ${path}`, load_bearing: false });
+            }
+        }
+        // Outbound HTTP base URLs.
+        for (const m of src.matchAll(/axios\.create\(\s*\{\s*baseURL:\s*['"`]([^'"`]+)/g)) {
+            externalContracts.add(m[1]);
+            downstream.push({ target: m[1], kind: "http", detail: m[1], load_bearing: false });
+        }
+        for (const m of src.matchAll(/fetch\(\s*['"`](https?:\/\/[^'"`]+)/g)) {
+            externalContracts.add(m[1]);
+            downstream.push({ target: m[1], kind: "http", detail: m[1], load_bearing: false });
+        }
+    }
+}
+function dedupeDownstream(deps) {
+    const seen = new Set();
+    for (let i = deps.length - 1; i >= 0; i--) {
+        const dep = deps[i];
+        const key = `${dep.kind}|${dep.detail}`;
+        if (seen.has(key))
+            deps.splice(i, 1);
+        else
+            seen.add(key);
+    }
+    deps.sort((a, b) => (a.kind + a.detail).localeCompare(b.kind + b.detail));
+}
+function normalisePath(p) {
+    let s = p.trim().replace(/^['"]|['"]$/g, "");
+    if (!s.startsWith("/"))
+        s = `/${s}`;
+    return s;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=serverless.js.map

package/dist/lib/api-surface/analyzers/spring.js

@@ -0,0 +1,237 @@
+import { allBySuffix, findBySuffix } from "../file-set.js";
+// java-spring analyzer. Scans **/*.java for Spring-web controllers and outbound dependencies, and
+// pom.xml / build.gradle for the Java runtime version. application.yml/properties → shared_infra.
+const HTTP_METHOD_BY_ANNOTATION = {
+    GetMapping: "GET",
+    PostMapping: "POST",
+    PutMapping: "PUT",
+    DeleteMapping: "DELETE",
+    PatchMapping: "PATCH",
+};
+export async function analyzeSpring(fileSet) {
+    const javaFiles = allBySuffix(fileSet.files, ".java").filter((f) => !/(^|\/)(target|build)\//.test(f) && !/Test\.java$/.test(f));
+    const endpoints = [];
+    const downstream = [];
+    const sharedInfra = new Set();
+    const externalContracts = new Set();
+    for (const path of javaFiles) {
+        const src = await fileSet.read(path);
+        if (src === "")
+            continue;
+        collectEndpoints(src, path, endpoints);
+        collectDownstream(src, downstream, sharedInfra, externalContracts);
+    }
+    // Datasource / queue / topic names from config.
+    await collectConfigInfra(fileSet, sharedInfra);
+    const runtime = await detectJavaRuntime(fileSet);
+    dedupeDownstream(downstream);
+    endpoints.sort((a, b) => (a.path + a.method).localeCompare(b.path + b.method));
+    return {
+        stack: "java-spring",
+        component_type: "service",
+        endpoints,
+        dependencies: { downstream, upstream: [] },
+        external_contracts: [...externalContracts].sort(),
+        deployment: { runtime, shared_infra: [...sharedInfra].sort() },
+    };
+}
+function collectEndpoints(src, path, endpoints) {
+    const isController = /@(Rest)?Controller\b/.test(src);
+    if (!isController)
+        return;
+    const classBase = extractClassRequestMapping(src);
+    const classAuth = extractAuth(classLevelSlice(src));
+    // Walk method-mapping annotations. We pair each mapping annotation with the auth annotation(s)
+    // immediately preceding the method (within a small look-back window). The class-level
+    // @RequestMapping (which sits before the `class`/`interface` declaration) is the path prefix, not a
+    // method mapping — skip any mapping annotation that appears before the type declaration line.
+    const lines = src.split(/\r?\n/);
+    const typeDeclLine = lines.findIndex((l) => /\b(class|interface|enum)\s+\w+/.test(l));
+    for (let i = 0; i < lines.length; i++) {
+        if (typeDeclLine >= 0 && i < typeDeclLine)
+            continue;
+        const line = lines[i];
+        // @GetMapping("/x") / @PostMapping(value="/x") / @RequestMapping(value="/x", method=...).
+        const mappingM = line.match(/@(Get|Post|Put|Delete|Patch|Request)Mapping\b\s*(?:\(([^)]*)\))?/);
+        if (!mappingM)
+            continue;
+        const annotation = `${mappingM[1]}Mapping`;
+        const args = mappingM[2] ?? "";
+        let method = HTTP_METHOD_BY_ANNOTATION[annotation] ?? "";
+        if (annotation === "RequestMapping") {
+            const methodM = args.match(/method\s*=\s*(?:RequestMethod\.)?([A-Z]+)/);
+            method = methodM ? methodM[1] : "GET";
+        }
+        if (method === "")
+            method = "GET";
+        const subPath = extractPathArg(args);
+        const fullPath = joinPaths(classBase, subPath);
+        const methodAuth = extractAuth(lookBack(lines, i, 4)) || classAuth || "none";
+        endpoints.push({ method, path: fullPath, auth: methodAuth, handler: `${baseName(path)}` });
+    }
+}
+function classLevelSlice(src) {
+    // The annotations between the class's RequestMapping and the first method — best-effort: take the
+    // text up to the first mapping method annotation.
+    const idx = src.search(/@(Get|Post|Put|Delete|Patch)Mapping\b/);
+    return idx >= 0 ? src.slice(0, idx) : src;
+}
+function extractClassRequestMapping(src) {
+    // Class-level @RequestMapping("/x") sits before the class body's method mappings.
+    const m = src.match(/@RequestMapping\s*\(\s*([^)]*)\)/);
+    if (!m)
+        return "";
+    // Make sure this is the class-level one (appears before any method mapping).
+    const firstMethodMapping = src.search(/@(Get|Post|Put|Delete|Patch)Mapping\b/);
+    if (firstMethodMapping >= 0 && (m.index ?? 0) > firstMethodMapping)
+        return "";
+    return extractPathArg(m[1] ?? "");
+}
+function extractPathArg(args) {
+    // `"/events"` | `value = "/events"` | `path = "/events"` | `{"/a","/b"}` → first string literal.
+    const m = args.match(/(?:value|path)?\s*=?\s*\{?\s*"([^"]*)"/);
+    return m ? m[1] : "";
+}
+function extractAuth(text) {
+    const pre = text.match(/@PreAuthorize\s*\(\s*"([^"]+)"/);
+    if (pre)
+        return `preauthorize:${pre[1]}`;
+    const secured = text.match(/@Secured\s*\(\s*\{?\s*"?([^")}]+)/);
+    if (secured)
+        return `secured:${secured[1].trim()}`;
+    const roles = text.match(/@RolesAllowed\s*\(\s*\{?\s*"?([^")}]+)/);
+    if (roles)
+        return `roles:${roles[1].trim()}`;
+    return "";
+}
+function collectDownstream(src, downstream, sharedInfra, externalContracts) {
+    // @FeignClient(name = "x", url = "...") → feign.
+    for (const m of src.matchAll(/@FeignClient\s*\(([^)]*)\)/g)) {
+        const args = m[1] ?? "";
+        const name = args.match(/name\s*=\s*"([^"]+)"/)?.[1] ?? "feign-client";
+        const url = args.match(/url\s*=\s*"([^"]+)"/)?.[1];
+        downstream.push({ target: name, kind: "feign", detail: url ?? name, load_bearing: true });
+        if (url)
+            externalContracts.add(url);
+    }
+    // RestTemplate / WebClient → http.
+    if (/\bRestTemplate\b|\bWebClient\b/.test(src)) {
+        for (const m of src.matchAll(/["'](https?:\/\/[^"']+)["']/g)) {
+            downstream.push({ target: m[1], kind: "http", detail: m[1], load_bearing: false });
+            externalContracts.add(m[1]);
+        }
+        if (![...src.matchAll(/["'](https?:\/\/[^"']+)["']/g)].length) {
+            downstream.push({ target: "rest-client", kind: "http", detail: "RestTemplate/WebClient", load_bearing: false });
+        }
+    }
+    // @JmsListener / JmsTemplate → jms (+ destination literal where present).
+    for (const m of src.matchAll(/@JmsListener\s*\(([^)]*)\)/g)) {
+        const dest = (m[1] ?? "").match(/destination\s*=\s*"([^"]+)"/)?.[1] ?? "jms-destination";
+        downstream.push({ target: dest, kind: "jms", detail: dest, load_bearing: true });
+        sharedInfra.add(dest);
+    }
+    if (/\bJmsTemplate\b/.test(src)) {
+        downstream.push({ target: "jms", kind: "jms", detail: "JmsTemplate", load_bearing: true });
+    }
+    // @KafkaListener / KafkaTemplate → kafka.
+    for (const m of src.matchAll(/@KafkaListener\s*\(([^)]*)\)/g)) {
+        const topic = (m[1] ?? "").match(/topics\s*=\s*\{?\s*"([^"]+)"/)?.[1] ?? "kafka-topic";
+        downstream.push({ target: topic, kind: "kafka", detail: topic, load_bearing: true });
+        sharedInfra.add(topic);
+    }
+    if (/\bKafkaTemplate\b/.test(src)) {
+        downstream.push({ target: "kafka", kind: "kafka", detail: "KafkaTemplate producer", load_bearing: true });
+    }
+    // Spring Data repositories + entity/document annotations → datastore kind.
+    if (/interface\s+\w+\s+extends\s+\w*Repository\b/.test(src)) {
+        if (/@Document\b/.test(src)) {
+            downstream.push({ target: "mongo", kind: "mongo", detail: "Spring Data MongoRepository", load_bearing: true });
+        }
+        else if (/@Entity\b/.test(src)) {
+            downstream.push({ target: "jdbc", kind: "jdbc", detail: "Spring Data JpaRepository", load_bearing: true });
+        }
+        else {
+            downstream.push({ target: "datastore", kind: "jdbc", detail: "Spring Data Repository", load_bearing: true });
+        }
+    }
+    else if (/@Document\b/.test(src)) {
+        downstream.push({ target: "mongo", kind: "mongo", detail: "@Document entity", load_bearing: true });
+    }
+}
+async function collectConfigInfra(fileSet, sharedInfra) {
+    const configs = fileSet.files.filter((f) => /application(-[\w]+)?\.(ya?ml|properties)$/.test(f));
+    for (const path of configs) {
+        const src = await fileSet.read(path);
+        if (src === "")
+            continue;
+        // datasource url, kafka topics, jms queues, mongo uri.
+        for (const m of src.matchAll(/(?:datasource[._]url|spring\.datasource\.url)\s*[:=]\s*(\S+)/gi)) {
+            sharedInfra.add(`jdbc:${stripVar(m[1])}`);
+        }
+        for (const m of src.matchAll(/(?:topic|telemetrytopic)\s*[:=]\s*(\S+)/gi)) {
+            const v = stripVar(m[1]);
+            if (v)
+                sharedInfra.add(`topic:${v}`);
+        }
+        for (const m of src.matchAll(/(?:mongo[._]?uri|spring\.data\.mongodb\.uri)\s*[:=]\s*(\S+)/gi)) {
+            sharedInfra.add(`mongo:${stripVar(m[1])}`);
+        }
+        for (const m of src.matchAll(/bootstrap-servers\s*[:=]\s*(\S+)/gi)) {
+            sharedInfra.add(`kafka:${stripVar(m[1])}`);
+        }
+    }
+}
+function stripVar(v) {
+    // Keep env-var placeholders readable: `${GATEWAY_KAFKAPRODUCERTOPIC}` → GATEWAY_KAFKAPRODUCERTOPIC.
+    const m = v.match(/\$\{([^:}]+)/);
+    if (m)
+        return m[1];
+    return v.replace(/^['"]|['"]$/g, "").trim();
+}
+async function detectJavaRuntime(fileSet) {
+    const pom = findBySuffix(fileSet.files, "pom.xml");
+    if (pom) {
+        const src = await fileSet.read(pom);
+        const v = src.match(/<maven\.compiler\.release>\s*([\d.]+)/)?.[1] ??
+            src.match(/<maven\.compiler\.target>\s*([\d.]+)/)?.[1] ??
+            src.match(/<maven\.compiler\.source>\s*([\d.]+)/)?.[1] ??
+            src.match(/<java\.version>\s*([\d.]+)/)?.[1];
+        if (v)
+            return `java${v}`;
+    }
+    const gradle = findBySuffix(fileSet.files, "build.gradle");
+    if (gradle) {
+        const src = await fileSet.read(gradle);
+        const v = src.match(/JavaLanguageVersion\.of\(\s*([\d]+)\s*\)/)?.[1] ??
+            src.match(/(?:source|target)Compatibility\s*=?\s*['"]?(?:JavaVersion\.VERSION_)?([\d.]+)/)?.[1] ??
+            src.match(/java-openjdk(\d+)/)?.[1];
+        if (v)
+            return `java${v}`;
+    }
+    return "";
+}
+function joinPaths(base, sub) {
+    const b = base.replace(/\/$/, "");
+    const s = sub.startsWith("/") ? sub : sub ? `/${sub}` : "";
+    const joined = `${b}${s}`;
+    return joined.startsWith("/") ? joined : `/${joined}`;
+}
+function lookBack(lines, idx, n) {
+    return lines.slice(Math.max(0, idx - n), idx + 1).join("\n");
+}
+function baseName(p) {
+    return p.split("/").pop() ?? p;
+}
+function dedupeDownstream(deps) {
+    const seen = new Set();
+    for (let i = deps.length - 1; i >= 0; i--) {
+        const dep = deps[i];
+        const key = `${dep.kind}|${dep.detail}`;
+        if (seen.has(key))
+            deps.splice(i, 1);
+        else
+            seen.add(key);
+    }
+    deps.sort((a, b) => (a.kind + a.detail).localeCompare(b.kind + b.detail));
+}
+//# sourceMappingURL=spring.js.map

package/dist/lib/api-surface/analyzers/terraform.js

@@ -0,0 +1,109 @@
+import { allBySuffix } from "../file-set.js";
+// terraform analyzer. No endpoints. Enumerate `resource "<type>" "<name>"` (grouped by type with
+// counts), `data "<type>"`, `module "<name>"`, and IAM roles. Provisioned resources → shared_infra
+// + a provisioned_resources summary; IAM roles + module sources → deployment.notes.
+const RESOURCE_RE = /resource\s+"([^"]+)"\s+"([^"]+)"/g;
+const DATA_RE = /data\s+"([^"]+)"\s+"([^"]+)"/g;
+const MODULE_RE = /module\s+"([^"]+)"\s*\{/g;
+const MODULE_SOURCE_RE = /module\s+"([^"]+)"\s*\{[^}]*?source\s*=\s*"([^"]+)"/gs;
+const INFRA_RESOURCE_TYPES = new Set([
+    "aws_sqs_queue",
+    "aws_sns_topic",
+    "aws_dynamodb_table",
+    "aws_s3_bucket",
+    "aws_kinesis_stream",
+    "aws_lambda_function",
+    "aws_db_instance",
+    "aws_rds_cluster",
+    "aws_vpc",
+    "aws_cognito_user_pool",
+    "aws_cognito_identity_pool",
+    "aws_api_gateway_rest_api",
+    "aws_apigatewayv2_api",
+]);
+export async function analyzeTerraform(fileSet) {
+    const tfFiles = allBySuffix(fileSet.files, ".tf").filter((f) => !/(^|\/)\.terraform\//.test(f));
+    const resourceCounts = new Map();
+    const sharedInfra = new Set();
+    const downstream = [];
+    const dataSources = new Set();
+    const modules = new Set();
+    const iamRoles = [];
+    for (const path of tfFiles) {
+        const src = await fileSet.read(path);
+        if (src === "")
+            continue;
+        for (const m of src.matchAll(RESOURCE_RE)) {
+            const type = m[1];
+            const name = m[2];
+            resourceCounts.set(type, (resourceCounts.get(type) ?? 0) + 1);
+            if (type === "aws_iam_role" || /iam_(role|policy)/.test(type)) {
+                iamRoles.push(name);
+            }
+            if (INFRA_RESOURCE_TYPES.has(type)) {
+                sharedInfra.add(`${type}.${name}`);
+            }
+            pushDependency(type, name, downstream);
+        }
+        for (const m of src.matchAll(DATA_RE)) {
+            dataSources.add(`${m[1]}.${m[2]}`);
+        }
+        for (const m of src.matchAll(MODULE_RE)) {
+            modules.add(m[1]);
+        }
+        for (const m of src.matchAll(MODULE_SOURCE_RE)) {
+            modules.add(`${m[1]} (source=${m[2]})`);
+        }
+    }
+    const provisioned = [...resourceCounts.entries()]
+        .map(([type, count]) => ({ type, count }))
+        .sort((a, b) => b.count - a.count || a.type.localeCompare(b.type));
+    const notes = [];
+    if (iamRoles.length > 0) {
+        notes.push(`iam roles/policies: ${[...new Set(iamRoles)].sort().join(", ")}`);
+    }
+    if (dataSources.size > 0) {
+        notes.push(`data sources: ${[...dataSources].sort().join(", ")}`);
+    }
+    if (modules.size > 0) {
+        notes.push(`modules: ${[...modules].sort().join(", ")}`);
+    }
+    dedupeDownstream(downstream);
+    return {
+        stack: "terraform",
+        component_type: "infra",
+        endpoints: [],
+        dependencies: { downstream, upstream: [] },
+        external_contracts: [],
+        deployment: {
+            runtime: "terraform",
+            shared_infra: [...sharedInfra].sort(),
+            provisioned_resources: provisioned,
+            ...(notes.length > 0 ? { notes } : {}),
+        },
+    };
+}
+function pushDependency(type, name, downstream) {
+    const target = `${type}.${name}`;
+    if (type === "aws_sqs_queue")
+        downstream.push({ target, kind: "sqs", detail: name, load_bearing: true });
+    else if (type === "aws_sns_topic")
+        downstream.push({ target, kind: "sns", detail: name, load_bearing: true });
+    else if (type === "aws_dynamodb_table")
+        downstream.push({ target, kind: "dynamodb", detail: name, load_bearing: true });
+    else if (type === "aws_s3_bucket")
+        downstream.push({ target, kind: "s3", detail: name, load_bearing: false });
+}
+function dedupeDownstream(deps) {
+    const seen = new Set();
+    for (let i = deps.length - 1; i >= 0; i--) {
+        const dep = deps[i];
+        const key = `${dep.kind}|${dep.target}`;
+        if (seen.has(key))
+            deps.splice(i, 1);
+        else
+            seen.add(key);
+    }
+    deps.sort((a, b) => (a.kind + a.target).localeCompare(b.kind + b.target));
+}
+//# sourceMappingURL=terraform.js.map