weavatrix 0.3.14 → 1.0.0

package/src/infra/infra-registry.js

@@ -1,184 +0,0 @@
-// Infra signature registry — generated by the infra-signature-registry workflow (parallel research across
-// Node/Python/Go/JVM/Ruby/PHP/.NET/Rust + docker/k8s/env conventions, then adversarial false-positive +
-// coverage + ground-truth verification, then a category-split synthesis). One row per backing service.
-// See main/repos/infra.js for matcher semantics: deps=exact manifest dep, images=path-segment suffix,
-// envPrefixes=KEY prefix (envWeak entries also require an infra suffix), imports=quoted source token.
-// ORMs / AWS-SDK monoliths / instrumentation libs / generic env prefixes were deliberately EXCLUDED as
-// non-attributing. Import tokens are normalized to bare module paths. Edit this file to tune; regenerate
-// by re-running the workflow (.claude/.../infra-signature-registry).
-export const INFRA_SERVICES = [
-  { id: "postgres", name: "POSTGRES", kind: "db", color: 0x4fd1ff,
-    deps: ["pg","pg-promise","postgres","@neondatabase/serverless","psycopg2-binary","asyncpg","github.com/jackc/pgx/v5","org.postgresql:postgresql"],
-    imports: ["pg-promise","@neondatabase/serverless","psycopg2","asyncpg","github.com/lib/pq","github.com/jackc/pgx","org.postgresql","tokio_postgres"], images: ["postgres","bitnami/postgresql","postgis/postgis","supabase/postgres","pgvector/pgvector"], envPrefixes: ["POSTGRES","POSTGRESQL","PGHOST","PGUSER","PGPASSWORD","PGDATABASE","POSTGRES_HOST"], envWeak: [] },
-  { id: "mysql", name: "MYSQL", kind: "db", color: 0x4fc6ff,
-    deps: ["mysql2","pymysql","mysqlclient","aiomysql","asyncmy","github.com/go-sql-driver/mysql","com.mysql:mysql-connector-j","MySqlConnector"],
-    imports: ["mysql2","pymysql","MySQLdb","aiomysql","asyncmy","github.com/go-sql-driver/mysql","com.mysql.cj","mysql_async"], images: ["mysql","bitnami/mysql","mysql/mysql-server","percona"], envPrefixes: ["MYSQL_HOST","MYSQL_PORT","MYSQL_USER","MYSQL_PASSWORD","MYSQL_DATABASE","MYSQL_ROOT_PASSWORD"], envWeak: [] },
-  { id: "mariadb", name: "MARIADB", kind: "db", color: 0x4fbfe6,
-    deps: ["mariadb","org.mariadb.jdbc:mariadb-java-client","org.mariadb:r2dbc-mariadb"],
-    imports: ["mariadb","org.mariadb.jdbc","org.mariadb.r2dbc"], images: ["mariadb","bitnami/mariadb"], envPrefixes: ["MARIADB_HOST","MARIADB_USER","MARIADB_PASSWORD","MARIADB_DATABASE","MARIADB_ROOT_PASSWORD"], envWeak: [] },
-  { id: "sqlserver", name: "SQLSERVER", kind: "db", color: 0x5fb0ff,
-    deps: ["mssql","tedious","pymssql","github.com/microsoft/go-mssqldb","com.microsoft.sqlserver:mssql-jdbc","tiberius","io.r2dbc:r2dbc-mssql"],
-    imports: ["mssql","tedious","pymssql","github.com/microsoft/go-mssqldb","com.microsoft.sqlserver.jdbc","tiberius","io.r2dbc.mssql"], images: ["mcr.microsoft.com/mssql/server","mcr.microsoft.com/azure-sql-edge"], envPrefixes: ["MSSQL_HOST","MSSQL_SA_PASSWORD","SQLSERVER_HOST","SQL_SERVER"], envWeak: [] },
-  { id: "sqlite", name: "SQLITE", kind: "db", color: 0x6fb8ff,
-    deps: ["better-sqlite3","sqlite3","aiosqlite","@libsql/client","github.com/mattn/go-sqlite3","org.xerial:sqlite-jdbc","rusqlite","modernc.org/sqlite"],
-    imports: ["better-sqlite3","sqlite3","aiosqlite","@libsql/client","github.com/mattn/go-sqlite3","org.sqlite","rusqlite","node:sqlite"], images: [], envPrefixes: ["SQLITE_PATH","TURSO","LIBSQL"], envWeak: [] },
-  { id: "cockroachdb", name: "COCKROACHDB", kind: "db", color: 0x4fd9d1,
-    deps: ["github.com/cockroachdb/cockroach-go/v2","sqlalchemy-cockroachdb"],
-    imports: ["github.com/cockroachdb/cockroach-go","sqlalchemy_cockroachdb"], images: ["cockroachdb/cockroach","bitnami/cockroachdb"], envPrefixes: ["COCKROACH","COCKROACHDB","CRDB_HOST","COCKROACH_URL"], envWeak: [] },
-  { id: "spanner", name: "SPANNER", kind: "db", color: 0x4fd1e0,
-    deps: ["cloud.google.com/go/spanner","com.google.cloud:google-cloud-spanner","com.google.cloud:google-cloud-spanner-jdbc"],
-    imports: ["cloud.google.com/go/spanner","com.google.cloud.spanner"], images: ["gcr.io/cloud-spanner-emulator/emulator"], envPrefixes: ["SPANNER"], envWeak: [] },
-  { id: "planetscale", name: "PLANETSCALE", kind: "db", color: 0x6fd1ff,
-    deps: ["@planetscale/database"],
-    imports: ["@planetscale/database"], images: ["vitess/vtgate","vitess/lite"], envPrefixes: ["PLANETSCALE","DATABASE_HOST","PSCALE"], envWeak: [] },
-  { id: "snowflake", name: "SNOWFLAKE", kind: "db", color: 0x4fb6ff,
-    deps: ["snowflake-sdk","snowflake-connector-python","github.com/snowflakedb/gosnowflake","net.snowflake:snowflake-jdbc","Snowflake.Data"],
-    imports: ["snowflake-sdk","snowflake.connector","github.com/snowflakedb/gosnowflake","net.snowflake.client","Snowflake.Data"], images: [], envPrefixes: ["SNOWFLAKE_ACCOUNT","SNOWFLAKE_USER","SNOWFLAKE_WAREHOUSE","SNOWFLAKE_DATABASE"], envWeak: [] },
-  { id: "bigquery", name: "BIGQUERY", kind: "db", color: 0x5fc0ff,
-    deps: ["@google-cloud/bigquery","google-cloud-bigquery","cloud.google.com/go/bigquery","com.google.cloud:google-cloud-bigquery"],
-    imports: ["@google-cloud/bigquery","google.cloud.bigquery","cloud.google.com/go/bigquery","com.google.cloud.bigquery"], images: ["ghcr.io/goccy/bigquery-emulator"], envPrefixes: ["BIGQUERY","GOOGLE_BIGQUERY"], envWeak: [] },
-  { id: "redshift", name: "REDSHIFT", kind: "db", color: 0x4fa8ff,
-    deps: ["@aws-sdk/client-redshift","@aws-sdk/client-redshift-data","redshift-connector","com.amazon.redshift:redshift-jdbc42"],
-    imports: ["@aws-sdk/client-redshift","redshift_connector","com.amazon.redshift"], images: [], envPrefixes: ["REDSHIFT_HOST","REDSHIFT_URL","REDSHIFT_CLUSTER"], envWeak: [] },
-  { id: "db2", name: "DB2", kind: "db", color: 0x4fcfff,
-    deps: ["com.ibm.db2:jcc","com.ibm.db2.jcc:db2jcc","ibm_db"],
-    imports: ["com.ibm.db2.jcc","ibm_db"], images: ["ibmcom/db2","icr.io/db2_community/db2"], envPrefixes: ["DB2"], envWeak: ["DB2"] },
-  { id: "mongodb", name: "MONGODB", kind: "db", color: 0x6fe26f,
-    deps: ["mongodb","mongoose","pymongo","motor","go.mongodb.org/mongo-driver","org.mongodb:mongodb-driver-sync","org.mongodb:mongo-java-driver","MongoDB.Driver"],
-    imports: ["mongoose","pymongo","motor.motor_asyncio","go.mongodb.org/mongo-driver/mongo","com.mongodb.","mongodb","Mongo::Client"], images: ["mongo","bitnami/mongodb","percona/percona-server-mongodb","mongodb/mongodb-community-server"], envPrefixes: ["MONGO","MONGODB","MONGO_URI","MONGO_HOST","MONGODB_URI"], envWeak: [] },
-  { id: "cassandra", name: "CASSANDRA", kind: "db", color: 0x66dd66,
-    deps: ["cassandra-driver","github.com/gocql/gocql","com.datastax.oss:java-driver-core","com.datastax.cassandra:cassandra-driver-core","CassandraCSharpDriver","scylla-driver","acsylla","cdrs-tokio"],
-    imports: ["cassandra-driver","github.com/gocql/gocql","com.datastax.oss.driver","com.datastax.driver.core","scylla"], images: ["cassandra","bitnami/cassandra","scylladb/scylla","scylladb/scylla-enterprise"], envPrefixes: ["CASSANDRA","SCYLLA","CASSANDRA_CONTACT_POINTS","CASSANDRA_KEYSPACE","SCYLLA_CONTACT_POINTS"], envWeak: [] },
-  { id: "dynamodb", name: "DYNAMODB", kind: "db", color: 0x5fd95f,
-    deps: ["@aws-sdk/client-dynamodb","@aws-sdk/lib-dynamodb","dynamoose","electrodb","pynamodb","github.com/aws/aws-sdk-go-v2/service/dynamodb","software.amazon.awssdk:dynamodb","github.com/guregu/dynamo"],
-    imports: ["@aws-sdk/client-dynamodb","@aws-sdk/lib-dynamodb","dynamoose","pynamodb","github.com/aws/aws-sdk-go-v2/service/dynamodb","software.amazon.awssdk.services.dynamodb","Amazon.DynamoDBv2"], images: ["amazon/dynamodb-local"], envPrefixes: ["DYNAMODB","DYNAMO","DYNAMODB_TABLE","DYNAMODB_ENDPOINT","AWS_DYNAMODB"], envWeak: [] },
-  { id: "elasticsearch", name: "ELASTICSEARCH", kind: "db", color: 0x7aea7a,
-    deps: ["@elastic/elasticsearch","@opensearch-project/opensearch","elasticsearch","elasticsearch-dsl","opensearch-py","github.com/elastic/go-elasticsearch","co.elastic.clients:elasticsearch-java","org.opensearch.client:opensearch-java"],
-    imports: ["@elastic/elasticsearch","@opensearch-project/opensearch","elasticsearch_dsl","opensearchpy","github.com/elastic/go-elasticsearch","co.elastic.clients.elasticsearch","org.opensearch.client"], images: ["elasticsearch","docker.elastic.co/elasticsearch/elasticsearch","bitnami/elasticsearch","opensearchproject/opensearch"], envPrefixes: ["ELASTICSEARCH","OPENSEARCH","ES_HOST","ES_URL","ELASTICSEARCH_URL","OPENSEARCH_URL"], envWeak: [] },
-  { id: "solr", name: "SOLR", kind: "db", color: 0x63e063,
-    deps: ["solr-client","solr-node","pysolr","aiosolr","github.com/vanng822/go-solr","org.apache.solr:solr-solrj"],
-    imports: ["solr-client","solr-node","pysolr","org.apache.solr.client.solrj","org.springframework.data.solr"], images: ["solr","bitnami/solr"], envPrefixes: ["SOLR","SOLR_HOST","SOLR_URL","SOLR_PORT"], envWeak: [] },
-  { id: "meilisearch", name: "MEILISEARCH", kind: "db", color: 0x72e672,
-    deps: ["meilisearch","@meilisearch/instant-meilisearch","meilisearch-python-sdk","github.com/meilisearch/meilisearch-go","com.meilisearch.sdk:meilisearch-java"],
-    imports: ["meilisearch","@meilisearch/instant-meilisearch","github.com/meilisearch/meilisearch-go","com.meilisearch.sdk"], images: ["getmeili/meilisearch"], envPrefixes: ["MEILI","MEILISEARCH","MEILI_HOST","MEILI_MASTER_KEY","MEILISEARCH_URL"], envWeak: [] },
-  { id: "typesense", name: "TYPESENSE", kind: "db", color: 0x59d959,
-    deps: ["typesense","typesense-instantsearch-adapter","typesense-python","github.com/typesense/typesense-go"],
-    imports: ["typesense","typesense-instantsearch-adapter","github.com/typesense/typesense-go"], images: ["typesense/typesense"], envPrefixes: ["TYPESENSE","TYPESENSE_HOST","TYPESENSE_API_KEY","TYPESENSE_URL"], envWeak: [] },
-  { id: "neo4j", name: "NEO4J", kind: "db", color: 0x6fe28a,
-    deps: ["neo4j-driver","neo4j","py2neo","neomodel","github.com/neo4j/neo4j-go-driver","org.neo4j.driver:neo4j-java-driver","neo4rs","@neo4j/graphql"],
-    imports: ["neo4j-driver","py2neo","neomodel","github.com/neo4j/neo4j-go-driver","org.neo4j.driver","neo4rs"], images: ["neo4j","bitnami/neo4j"], envPrefixes: ["NEO4J","NEO4J_URI","NEO4J_HOST","NEO4J_AUTH"], envWeak: [] },
-  { id: "couchbase", name: "COUCHBASE", kind: "db", color: 0x6fe27a,
-    deps: ["couchbase","acouchbase","github.com/couchbase/gocb/v2","com.couchbase.client:java-client","couchbase-rs"],
-    imports: ["couchbase","acouchbase","github.com/couchbase/gocb","com.couchbase.client"], images: ["couchbase","bitnami/couchbase"], envPrefixes: ["COUCHBASE","COUCHBASE_HOST","COUCHBASE_URL","COUCHBASE_BUCKET"], envWeak: [] },
-  { id: "qdrant", name: "QDRANT", kind: "db", color: 0x86e886,
-    deps: ["@qdrant/js-client-rest","@qdrant/qdrant-js","qdrant-client","github.com/qdrant/go-client","io.qdrant:client"],
-    imports: ["@qdrant/js-client-rest","qdrant_client","github.com/qdrant/go-client","io.qdrant.client"], images: ["qdrant/qdrant"], envPrefixes: ["QDRANT","QDRANT_URL","QDRANT_HOST","QDRANT_API_KEY"], envWeak: [] },
-  { id: "weaviate", name: "WEAVIATE", kind: "db", color: 0x90ee90,
-    deps: ["weaviate-client","weaviate-ts-client","weaviate-python-client","github.com/weaviate/weaviate-go-client","io.weaviate:client"],
-    imports: ["weaviate-client","weaviate-ts-client","github.com/weaviate/weaviate-go-client","io.weaviate.client"], images: ["semitechnologies/weaviate","cr.weaviate.io/semitechnologies/weaviate"], envPrefixes: ["WEAVIATE","WEAVIATE_URL","WEAVIATE_HOST","WEAVIATE_API_KEY"], envWeak: [] },
-  { id: "milvus", name: "MILVUS", kind: "db", color: 0x9cf09c,
-    deps: ["@zilliz/milvus2-sdk-node","pymilvus","github.com/milvus-io/milvus-sdk-go","io.milvus:milvus-sdk-java"],
-    imports: ["@zilliz/milvus2-sdk-node","pymilvus","github.com/milvus-io/milvus-sdk-go","io.milvus."], images: ["milvusdb/milvus","zilliz/milvus"], envPrefixes: ["MILVUS","MILVUS_HOST","MILVUS_URL","MILVUS_PORT"], envWeak: [] },
-  { id: "clickhouse", name: "CLICKHOUSE", kind: "ts", color: 0xffe14f,
-    deps: ["@clickhouse/client","@clickhouse/client-web","clickhouse-driver","clickhouse-connect","github.com/ClickHouse/clickhouse-go/v2","com.clickhouse:clickhouse-jdbc","com.clickhouse:clickhouse-client","ClickHouse.Client","clickhouse"],
-    imports: ["@clickhouse/client","clickhouse_driver","clickhouse_connect","github.com/ClickHouse/clickhouse-go","com.clickhouse.","ru.yandex.clickhouse","clickhouse","Octonica.ClickHouseClient"], images: ["clickhouse/clickhouse-server","clickhouse/clickhouse-keeper","bitnami/clickhouse","yandex/clickhouse-server"], envPrefixes: ["CLICKHOUSE","CH_HOST","CH_PORT","CH_PASSWORD"], envWeak: [] },
-  { id: "influxdb", name: "INFLUXDB", kind: "ts", color: 0xf5d800,
-    deps: ["@influxdata/influxdb-client","influxdb-client","github.com/influxdata/influxdb-client-go/v2","com.influxdb:influxdb-client-java","org.influxdb:influxdb-java","influxdb3-python","influxdb2","InfluxDB.Client","influx"],
-    imports: ["@influxdata/influxdb-client","influxdb_client","github.com/influxdata/influxdb-client-go","github.com/influxdata/influxdb1-client","com.influxdb.client","org.influxdb.","influx","influxdb"], images: ["influxdb","bitnami/influxdb","quay.io/influxdb/influxdb","telegraf"], envPrefixes: ["INFLUX","INFLUXDB","INFLUX_TOKEN","INFLUXDB_URL","INFLUX_ORG","INFLUX_BUCKET"], envWeak: [] },
-  { id: "timescaledb", name: "TIMESCALEDB", kind: "ts", color: 0xffea66,
-    deps: ["@timescale/toolkit"],
-    imports: ["@timescale/toolkit"], images: ["timescale/timescaledb","timescale/timescaledb-ha","timescaledev/timescaledb-ha"], envPrefixes: ["TIMESCALE","TIMESCALEDB"], envWeak: [] },
-  { id: "prometheus", name: "PROMETHEUS", kind: "ts", color: 0xfff04d,
-    deps: ["prometheus-query","prometheus-api-client","github.com/prometheus/client_golang/api"],
-    imports: ["prometheus-query","github.com/prometheus/client_golang/api","prometheus_api_client"], images: ["prom/prometheus","prom/pushgateway","bitnami/prometheus","prom/node-exporter"], envPrefixes: ["PROMETHEUS","PROMETHEUS_URL","PUSHGATEWAY"], envWeak: [] },
-  { id: "victoriametrics", name: "VICTORIAMETRICS", kind: "ts", color: 0xe6d633,
-    deps: ["github.com/VictoriaMetrics/VictoriaMetrics"],
-    imports: ["github.com/VictoriaMetrics/VictoriaMetrics"], images: ["victoriametrics/victoria-metrics","victoriametrics/vmagent","victoriametrics/vminsert","victoriametrics/vmselect"], envPrefixes: ["VICTORIA_METRICS","VICTORIAMETRICS"], envWeak: [] },
-  { id: "graphite", name: "GRAPHITE", kind: "ts", color: 0xf0e07a,
-    deps: ["graphyte","graphitesend","graphite-udp","io.micrometer:micrometer-registry-graphite","io.dropwizard.metrics:metrics-graphite"],
-    imports: ["graphyte","graphitesend","io.micrometer.graphite","com.codahale.metrics.graphite"], images: ["graphiteapp/graphite-statsd"], envPrefixes: ["GRAPHITE","CARBON"], envWeak: [] },
-  { id: "redis", name: "REDIS", kind: "cache", color: 0xff6b6b,
-    deps: ["ioredis","redis","@redis/client","redis-om","@upstash/redis","redis-py","github.com/redis/go-redis/v9","redis.clients:jedis"],
-    imports: ["ioredis","@redis/client","redis.asyncio","github.com/redis/go-redis","github.com/gomodule/redigo/redis","redis.clients.jedis","io.lettuce.core","org.redisson"], images: ["redis","redis/redis-stack","redis/redis-stack-server","bitnami/redis","redislabs/redismod","eqalpha/keydb"], envPrefixes: ["REDIS","REDIS_HOST","REDIS_URL","REDIS_PASSWORD"], envWeak: [] },
-  { id: "valkey", name: "VALKEY", kind: "cache", color: 0xff8585,
-    deps: ["valkey","iovalkey","valkey-glide","@valkey/valkey-glide","github.com/valkey-io/valkey-go","valkey-py"],
-    imports: ["iovalkey","valkey_glide","github.com/valkey-io/valkey-go"], images: ["valkey/valkey","bitnami/valkey"], envPrefixes: ["VALKEY","VALKEY_HOST","VALKEY_URL"], envWeak: [] },
-  { id: "memcached", name: "MEMCACHED", kind: "cache", color: 0xff5252,
-    deps: ["memjs","pymemcache","pylibmc","github.com/bradfitz/gomemcache","net.spy:spymemcached","com.googlecode.xmemcached:xmemcached","aiomcache","memcached","memcache"],
-    imports: ["memjs","pymemcache","pylibmc","github.com/bradfitz/gomemcache/memcache","net.spy.memcached","net.rubyeye.xmemcached"], images: ["memcached","bitnami/memcached"], envPrefixes: ["MEMCACHED","MEMCACHE","MEMCACHED_HOST","MEMCACHED_SERVERS"], envWeak: [] },
-  { id: "hazelcast", name: "HAZELCAST", kind: "cache", color: 0xff9494,
-    deps: ["com.hazelcast:hazelcast","com.hazelcast:hazelcast-spring","com.hazelcast:hazelcast-client"],
-    imports: ["com.hazelcast."], images: ["hazelcast/hazelcast","hazelcast/management-center"], envPrefixes: ["HAZELCAST"], envWeak: [] },
-  { id: "kafka", name: "KAFKA", kind: "queue", color: 0xff7ad9,
-    deps: ["kafkajs","node-rdkafka","@confluentinc/kafka-javascript","confluent-kafka","aiokafka","github.com/segmentio/kafka-go","org.apache.kafka:kafka-clients","github.com/twmb/franz-go"],
-    imports: ["kafkajs","node-rdkafka","confluent_kafka","aiokafka","github.com/segmentio/kafka-go","github.com/Shopify/sarama","org.apache.kafka.clients","org.springframework.kafka"], images: ["confluentinc/cp-kafka","confluentinc/cp-server","bitnami/kafka","apache/kafka","wurstmeister/kafka","redpandadata/redpanda","vectorized/redpanda","confluentinc/cp-zookeeper"], envPrefixes: ["KAFKA","KAFKA_BOOTSTRAP_SERVERS","KAFKA_BROKERS","CONFLUENT","REDPANDA","SCHEMA_REGISTRY"], envWeak: [] },
-  { id: "rabbitmq", name: "RABBITMQ", kind: "queue", color: 0xff86dd,
-    deps: ["amqplib","amqp-connection-manager","pika","aio-pika","github.com/rabbitmq/amqp091-go","com.rabbitmq:amqp-client","org.springframework.amqp:spring-rabbit","lapin"],
-    imports: ["amqplib","amqp-connection-manager","pika","aio_pika","github.com/rabbitmq/amqp091-go","com.rabbitmq.client","org.springframework.amqp","lapin"], images: ["rabbitmq","bitnami/rabbitmq","cloudamqp/lavinmq"], envPrefixes: ["RABBITMQ","RABBITMQ_HOST","RABBITMQ_URL","CLOUDAMQP"], envWeak: [] },
-  { id: "nats", name: "NATS", kind: "queue", color: 0xff6fd3,
-    deps: ["nats","nats.ws","nats-py","github.com/nats-io/nats.go","io.nats:jnats","async-nats","node-nats-streaming","@nats-io/jetstream"],
-    imports: ["github.com/nats-io/nats.go","io.nats.client","async_nats","node-nats-streaming","nats","nats.aio","nats.ws"], images: ["nats","synadia/nats-server","bitnami/nats","natsio/nats-box"], envPrefixes: ["NATS","NATS_URL","NATS_HOST","NATS_SERVERS"], envWeak: [] },
-  { id: "mqtt", name: "MQTT", kind: "queue", color: 0xff90e2,
-    deps: ["mqtt","async-mqtt","paho-mqtt","aiomqtt","github.com/eclipse/paho.mqtt.golang","org.eclipse.paho:org.eclipse.paho.client.mqttv3","rumqttc","MQTTnet"],
-    imports: ["async-mqtt","paho.mqtt","aiomqtt","github.com/eclipse/paho.mqtt.golang","org.eclipse.paho","rumqttc","mqtt"], images: ["eclipse-mosquitto","emqx/emqx","hivemq/hivemq-ce","vernemq/vernemq","nanomq/nanomq"], envPrefixes: ["MQTT","MQTT_HOST","MQTT_BROKER","MOSQUITTO","EMQX"], envWeak: [] },
-  { id: "pulsar", name: "PULSAR", kind: "queue", color: 0xff7ace,
-    deps: ["pulsar-client","github.com/apache/pulsar-client-go","org.apache.pulsar:pulsar-client","org.springframework.pulsar:spring-pulsar"],
-    imports: ["pulsar-client","github.com/apache/pulsar-client-go","org.apache.pulsar.client","org.springframework.pulsar","_pulsar"], images: ["apachepulsar/pulsar","apachepulsar/pulsar-all","streamnative/pulsar","bitnami/pulsar"], envPrefixes: ["PULSAR","PULSAR_URL","PULSAR_BROKER","PULSAR_SERVICE_URL"], envWeak: [] },
-  { id: "nsq", name: "NSQ", kind: "queue", color: 0xff64c9,
-    deps: ["github.com/nsqio/go-nsq"],
-    imports: ["github.com/nsqio/go-nsq"], images: ["nsqio/nsq"], envPrefixes: ["NSQ"], envWeak: ["NSQ"] },
-  { id: "activemq", name: "ACTIVEMQ", kind: "queue", color: 0xff9ce6,
-    deps: ["org.apache.activemq:activemq-client","org.apache.activemq:artemis-jms-client","org.springframework.boot:spring-boot-starter-activemq","org.springframework.boot:spring-boot-starter-artemis"],
-    imports: ["org.apache.activemq","org.apache.activemq.artemis"], images: ["apache/activemq-classic","apache/activemq-artemis","rmohr/activemq","vromero/activemq-artemis"], envPrefixes: ["ACTIVEMQ","ARTEMIS"], envWeak: [] },
-  { id: "sqs", name: "SQS", kind: "queue", color: 0xff72d0,
-    deps: ["@aws-sdk/client-sqs","sqs-consumer","sqs-producer","github.com/aws/aws-sdk-go-v2/service/sqs","software.amazon.awssdk:sqs","shoryuken"],
-    imports: ["@aws-sdk/client-sqs","sqs-consumer","sqs-producer","github.com/aws/aws-sdk-go-v2/service/sqs","software.amazon.awssdk.services.sqs","Aws::SQS"], images: ["softwaremill/elasticmq","roribio16/alpine-sqs"], envPrefixes: ["SQS","AWS_SQS","SQS_QUEUE_URL"], envWeak: ["SQS"] },
-  { id: "sns", name: "SNS", kind: "queue", color: 0xff82d9,
-    deps: ["@aws-sdk/client-sns","github.com/aws/aws-sdk-go-v2/service/sns","software.amazon.awssdk:sns","com.amazonaws:aws-java-sdk-sns"],
-    imports: ["@aws-sdk/client-sns","github.com/aws/aws-sdk-go-v2/service/sns","software.amazon.awssdk.services.sns","Amazon.SNS"], images: [], envPrefixes: ["SNS","AWS_SNS"], envWeak: ["SNS"] },
-  { id: "kinesis", name: "KINESIS", kind: "queue", color: 0xff6cce,
-    deps: ["@aws-sdk/client-kinesis","github.com/aws/aws-sdk-go-v2/service/kinesis","software.amazon.awssdk:kinesis","software.amazon.kinesis:amazon-kinesis-client"],
-    imports: ["@aws-sdk/client-kinesis","github.com/aws/aws-sdk-go-v2/service/kinesis","software.amazon.awssdk.services.kinesis","software.amazon.kinesis"], images: [], envPrefixes: ["KINESIS","AWS_KINESIS"], envWeak: [] },
-  { id: "gcp-pubsub", name: "GCP_PUBSUB", kind: "queue", color: 0xff7adf,
-    deps: ["@google-cloud/pubsub","google-cloud-pubsub","cloud.google.com/go/pubsub","com.google.cloud:google-cloud-pubsub"],
-    imports: ["@google-cloud/pubsub","google.cloud.pubsub","cloud.google.com/go/pubsub","com.google.cloud.pubsub"], images: ["messagebird/gcloud-pubsub-emulator"], envPrefixes: ["PUBSUB","PUBSUB_EMULATOR_HOST","GCP_PUBSUB"], envWeak: [] },
-  { id: "azure-servicebus", name: "AZURE_SERVICEBUS", kind: "queue", color: 0xff88e0,
-    deps: ["@azure/service-bus","azure-servicebus","com.azure:azure-messaging-servicebus","github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus"],
-    imports: ["@azure/service-bus","azure.servicebus","com.azure.messaging.servicebus","github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus"], images: [], envPrefixes: ["SERVICEBUS","AZURE_SERVICEBUS","SERVICE_BUS"], envWeak: [] },
-  { id: "s3", name: "S3", kind: "cloud", color: 0xb06bff,
-    deps: ["@aws-sdk/client-s3","@aws-sdk/s3-request-presigner","@aws-sdk/lib-storage","aws-sdk-s3","github.com/aws/aws-sdk-go-v2/service/s3","software.amazon.awssdk:s3","com.amazonaws:aws-java-sdk-s3","s3fs"],
-    imports: ["@aws-sdk/client-s3","github.com/aws/aws-sdk-go-v2/service/s3","github.com/aws/aws-sdk-go/service/s3","software.amazon.awssdk.services.s3","com.amazonaws.services.s3","aws_sdk_s3","rusoto_s3"], images: ["adobe/s3mock","zenko/cloudserver"], envPrefixes: ["S3","AWS_S3","S3_BUCKET","S3_ENDPOINT","AWS_S3_BUCKET"], envWeak: ["S3"] },
-  { id: "minio", name: "MINIO", kind: "cloud", color: 0xa64fff,
-    deps: ["minio","minio-py","github.com/minio/minio-go","github.com/minio/minio-go/v7","io.minio:minio"],
-    imports: ["minio","github.com/minio/minio-go","io.minio."], images: ["minio/minio","bitnami/minio","minio/mc"], envPrefixes: ["MINIO","MINIO_ENDPOINT","MINIO_ACCESS_KEY","MINIO_SECRET_KEY","MINIO_ROOT_USER","MINIO_BUCKET"], envWeak: [] },
-  { id: "r2", name: "R2", kind: "cloud", color: 0xc08bff,
-    deps: [],
-    imports: [], images: [], envPrefixes: ["R2_BUCKET","R2_ACCESS_KEY_ID","R2_SECRET_ACCESS_KEY","R2_ACCOUNT_ID","CLOUDFLARE_R2"], envWeak: [] },
-  { id: "gcs", name: "GCS", kind: "cloud", color: 0x9b5bff,
-    deps: ["@google-cloud/storage","google-cloud-storage","cloud.google.com/go/storage","com.google.cloud:google-cloud-storage","gcsfs","gcs-resumable-upload"],
-    imports: ["@google-cloud/storage","google.cloud.storage","cloud.google.com/go/storage","com.google.cloud.storage","gcsfs"], images: ["fsouza/fake-gcs-server"], envPrefixes: ["GCS_BUCKET","GOOGLE_CLOUD_STORAGE","GCP_BUCKET"], envWeak: [] },
-  { id: "azure-blob", name: "AZURE_BLOB", kind: "cloud", color: 0xb87bff,
-    deps: ["@azure/storage-blob","azure-storage-blob","github.com/Azure/azure-sdk-for-go/sdk/storage/azblob","com.azure:azure-storage-blob","adlfs"],
-    imports: ["@azure/storage-blob","azure.storage.blob","github.com/Azure/azure-sdk-for-go/sdk/storage/azblob","com.azure.storage.blob"], images: ["mcr.microsoft.com/azure-storage/azurite"], envPrefixes: ["AZURE_STORAGE","AZURE_BLOB","AZURE_STORAGE_CONNECTION_STRING","AZURE_STORAGE_ACCOUNT","AZURE_CONTAINER"], envWeak: [] },
-  { id: "keycloak", name: "KEYCLOAK", kind: "api", color: 0x66e0ff,
-    deps: ["@keycloak/keycloak-admin-client","keycloak-connect","keycloak-js","python-keycloak","github.com/Nerzal/gocloak","org.keycloak:keycloak-admin-client","org.keycloak:keycloak-spring-boot-starter","Keycloak.AuthServices.Authentication"],
-    imports: ["@keycloak/keycloak-admin-client","keycloak-connect","keycloak-js","github.com/Nerzal/gocloak","org.keycloak.","fastapi_keycloak","Keycloak.AuthServices"], images: ["quay.io/keycloak/keycloak","keycloak/keycloak","bitnami/keycloak"], envPrefixes: ["KEYCLOAK","KEYCLOAK_URL","KEYCLOAK_REALM","KEYCLOAK_CLIENT_ID","KEYCLOAK_BASE_URL"], envWeak: [] },
-  { id: "auth0", name: "AUTH0", kind: "api", color: 0x5cd9ff,
-    deps: ["auth0","@auth0/auth0-spa-js","@auth0/auth0-react","@auth0/nextjs-auth0","auth0-python","github.com/auth0/go-auth0","com.auth0:auth0","auth0/auth0-php"],
-    imports: ["@auth0/auth0-spa-js","@auth0/auth0-react","@auth0/nextjs-auth0","github.com/auth0/go-auth0","com.auth0.","Auth0\\SDK","auth0"], images: [], envPrefixes: ["AUTH0","AUTH0_DOMAIN","AUTH0_CLIENT_ID","AUTH0_CLIENT_SECRET","AUTH0_AUDIENCE"], envWeak: [] },
-  { id: "okta", name: "OKTA", kind: "api", color: 0x7ae6ff,
-    deps: ["@okta/okta-sdk-nodejs","@okta/okta-auth-js","@okta/okta-react","github.com/okta/okta-sdk-golang","com.okta.sdk:okta-sdk-api","okta-jwt-verifier","Okta.Sdk","okta/sdk"],
-    imports: ["@okta/okta-sdk-nodejs","@okta/okta-auth-js","github.com/okta/okta-sdk-golang","com.okta.","Okta.Sdk","okta_jwt_verifier"], images: [], envPrefixes: ["OKTA","OKTA_DOMAIN","OKTA_CLIENT_ID","OKTA_ISSUER","OKTA_ORG_URL"], envWeak: [] },
-  { id: "cognito", name: "COGNITO", kind: "api", color: 0x66d4ff,
-    deps: ["@aws-sdk/client-cognito-identity-provider","amazon-cognito-identity-js","pycognito","github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider","software.amazon.awssdk:cognitoidentityprovider","AWSSDK.CognitoIdentityProvider"],
-    imports: ["@aws-sdk/client-cognito-identity-provider","amazon-cognito-identity-js","pycognito","github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider","software.amazon.awssdk.services.cognitoidentityprovider","aws_sdk_cognitoidentityprovider"], images: [], envPrefixes: ["COGNITO","COGNITO_USER_POOL_ID","COGNITO_CLIENT_ID","AWS_COGNITO"], envWeak: [] },
-  { id: "firebase-auth", name: "FIREBASE_AUTH", kind: "api", color: 0x70ddff,
-    deps: ["@firebase/auth","firebase-admin","pyrebase"],
-    imports: ["@firebase/auth","firebase/auth","firebase_admin"], images: [], envPrefixes: ["FIREBASE_AUTH","FIREBASE_PROJECT_ID"], envWeak: [] },
-  { id: "vault", name: "VAULT", kind: "api", color: 0x5ce0ff,
-    deps: ["node-vault","hvac","github.com/hashicorp/vault/api","com.bettercloud:vault-java-driver","vaultrs","hashi-vault-js","VaultSharp","org.springframework.vault:spring-vault-core"],
-    imports: ["node-vault","hvac","github.com/hashicorp/vault/api","io.github.jopenlibs.vault","vaultrs","VaultSharp"], images: ["hashicorp/vault","vault"], envPrefixes: ["VAULT_ADDR","VAULT_TOKEN","VAULT_NAMESPACE","VAULT_ROLE_ID"], envWeak: [] },
-  { id: "oidc-generic", name: "OIDC", kind: "api", color: 0x88ecff,
-    deps: ["openid-client","passport-openidconnect","oidc-client-ts","github.com/coreos/go-oidc","github.com/coreos/go-oidc/v3"],
-    imports: ["openid-client","oidc-client-ts","passport-openidconnect","github.com/coreos/go-oidc"], images: [], envPrefixes: ["OIDC_ISSUER","OIDC_CLIENT_ID"], envWeak: [] },
-];

package/src/infra/infra.detect.js

@@ -1,119 +0,0 @@
-// Signature detection + cached public API for infrastructure detection. Split out of infra.js
-// (which remains the public facade); see that file's header for the pipeline overview and the
-// registry/matching contract documented next to the INFRA_SERVICES re-export.
-import { existsSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-// Concrete infra-item extraction + the shared leaf helpers (lc / safeRead / size caps) live in infra-items.js.
-import { collectInfraItems, itemMetaFor, safeRead, lc, IMPORT_SCAN_MAX_FILES, MAX_FILE_BYTES } from "./infra-items.js";
-import { INFRA_SERVICES } from "./infra-registry.js";
-import { depMatches, imageMatches, envMatches } from "./infra.match.js";
-import { scanRepo } from "./infra.scan.js";
-
-// ---- detection ----------------------------------------------------------------------------------
-export function detectInfraFromScan(scan, registry = INFRA_SERVICES) {
-  const found = new Map(); // id → { service, signals:Set, sources:Set, importTokens:[] }
-  const note = (svc, signal, source) => {
-    let e = found.get(svc.id);
-    if (!e) found.set(svc.id, (e = { service: svc, signals: new Set(), sources: new Set(), importTokens: [] }));
-    if (signal) e.signals.add(signal);
-    if (source) e.sources.add(source);
-  };
-
-  for (const svc of registry) {
-    // 1) manifest deps (highest confidence)
-    for (const tok of svc.deps || []) {
-      for (const d of scan.deps) { if (depMatches(d, tok)) { note(svc, `dep:${d}`, "manifest"); break; } }
-    }
-    // 2) container images
-    for (const tok of svc.images || []) {
-      for (const im of scan.imageSegs) { if (imageMatches(im.segs, tok)) { note(svc, `image:${im.raw}`, "image"); break; } }
-    }
-    // 3) env-var name conventions
-    const weakSet = new Set((svc.envWeak || []).map((s) => s.toUpperCase()));
-    for (const tok of svc.envPrefixes || []) {
-      for (const k of scan.envKeys) { if (envMatches(k, tok, weakSet.has(tok.toUpperCase()))) { note(svc, `env:${k}`, "env"); break; } }
-    }
-  }
-
-  // 4) source imports → attribute connector files (and a weak detection signal). Only scan if any
-  // service has import tokens; pre-filter files by a combined token regex (cheap), like apimap.
-  const importIndex = []; // { svc, token }
-  for (const svc of registry) for (const tok of svc.imports || []) importIndex.push({ svc, tok: lc(tok) });
-  const filesByService = new Map(); // id → Set(relPath)
-  if (importIndex.length && scan.codeFiles.length) {
-    const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const pre = new RegExp(importIndex.map((x) => esc(x.tok)).join("|"), "i");
-    // Reading every source file is the only O(repo-size) cost here and it runs synchronously, so cap it:
-    // connector-file attribution is best-effort and detection from manifests/images/env is already complete
-    // above. ~5k files keeps the cold scan well under a second even on a large monorepo (then it's cached).
-    const scanFiles = scan.codeFiles.length > IMPORT_SCAN_MAX_FILES ? scan.codeFiles.slice(0, IMPORT_SCAN_MAX_FILES) : scan.codeFiles;
-    for (const f of scanFiles) {
-      const text = safeRead(f.full);
-      if (!text || text.length > MAX_FILE_BYTES || !pre.test(text)) continue;
-      const lcText = text.toLowerCase();
-      for (const { svc, tok } of importIndex) {
-        // require a quoted/pathish occurrence so a stray word doesn't match: 'tok' "tok" `tok` tok/ tok"
-        if (lcText.includes(`"${tok}`) || lcText.includes(`'${tok}`) || lcText.includes("`" + tok) || lcText.includes(`/${tok}"`) || lcText.includes(tok + "/")) {
-          let set = filesByService.get(svc.id);
-          if (!set) filesByService.set(svc.id, (set = new Set()));
-          set.add(f.path);
-          // imports alone also count as a (weaker) detection signal
-          if (!found.has(svc.id)) note(svc, `import:${tok}`, "import");
-          else found.get(svc.id).sources.add("import");
-        }
-      }
-    }
-  }
-
-  const entries = [...found.values()];
-  const itemsByService = collectInfraItems(scan, entries, filesByService);
-  const services = entries.map(({ service, signals, sources }) => {
-    const files = [...(filesByService.get(service.id) || [])].sort().slice(0, 40);
-    const itemData = itemsByService.get(service.id) || { ...itemMetaFor(service), items: [] };
-    // confidence: a parsed manifest dep or image is hard evidence; env/import alone is softer.
-    const hard = sources.has("manifest") || sources.has("image");
-    const confidence = hard ? "high" : sources.has("env") && sources.has("import") ? "high" : sources.has("env") || sources.has("import") ? "medium" : "low";
-    return {
-      id: service.id, name: service.name, kind: service.kind, color: service.color,
-      confidence, sources: [...sources].sort(), signals: [...signals].sort().slice(0, 24), files,
-      items: itemData.items || [], itemLabel: itemData.itemLabel || itemData.label, unit: itemData.unit || "",
-    };
-  });
-  // stable, useful order: hard evidence first, then by source count, then name
-  const rank = (c) => (c === "high" ? 0 : c === "medium" ? 1 : 2);
-  services.sort((a, b) => rank(a.confidence) - rank(b.confidence) || b.signals.length - a.signals.length || a.name.localeCompare(b.name));
-  return services;
-}
-
-// ---- public API (cached by manifest/compose/env mtime) ------------------------------------------
-const _cache = new Map(); // repoPath → { sig, result }
-
-// cheap cache signature: newest mtime among the files that drive detection. If none change, reuse.
-function repoSignature(repoPath) {
-  let newest = 0, seen = 0;
-  const probe = (p) => { try { const st = statSync(p); if (st.isFile()) { newest = Math.max(newest, st.mtimeMs); seen++; } } catch { /* missing — skip */ } };
-  const roots = ["package.json", "go.mod", "go.sum", "requirements.txt", "pyproject.toml", "Pipfile", "Cargo.toml", "pom.xml", "build.gradle", "build.gradle.kts", "composer.json", "Gemfile", ".env", "docker-compose.yml", "docker-compose.yaml", "compose.yml", "Dockerfile", "skaffold.yaml"];
-  for (const r of roots) probe(join(repoPath, r));
-  for (const dir of ["k8s", "kubernetes", "deploy", "manifests", "helm", "charts", ".github"]) {
-    try { for (const e of readdirSync(join(repoPath, dir), { withFileTypes: true })) if (e.isFile()) probe(join(repoPath, dir, e.name)); } catch { /* no such dir */ }
-  }
-  return `${seen}:${Math.round(newest)}`;
-}
-
-// Detect the backing services a repo talks to. Cheap & cached; safe to call from repos:graph-analysis.
-export function detectInfra(repoPath, opts = {}) {
-  if (!repoPath || !existsSync(repoPath)) return { ok: false, error: "Repo path not found", services: [] };
-  const sig = repoSignature(repoPath);
-  const cached = _cache.get(repoPath);
-  if (!opts.force && cached && cached.sig === sig) return cached.result;
-  let result;
-  try {
-    const scan = scanRepo(repoPath);
-    const services = detectInfraFromScan(scan);
-    result = { ok: true, services, scanned: { manifests: scan.manifests, codeFiles: scan.codeFiles.length, envKeys: scan.envKeys.size, images: scan.imageSegs.length } };
-  } catch (error) {
-    result = { ok: false, error: error.message, services: [] };
-  }
-  _cache.set(repoPath, { sig, result });
-  return result;
-}

package/src/infra/infra.js

@@ -1,38 +0,0 @@
-// Infrastructure / backing-service detection. graph-builder's graph.json only contains code FILES and
-// symbols, so the GUI board's external-service towers were inferred purely from FILE PATHS
-// (relIsDb + a name-regex). That misses any datastore whose connector file isn't literally named
-// after it — e.g. a service that `import`s @clickhouse/client from services/metrics.js, or wires
-// Influx through a logging helper. This module reads the REAL high-signal sources instead:
-//   1. dependency manifests   (package.json / go.mod / requirements.txt / pom.xml / build.gradle /
-//                              Cargo.toml / *.csproj / Gemfile / composer.json)  — most reliable
-//   2. container/orchestration (docker-compose / Dockerfile / k8s manifests) — image names
-//   3. env / config            (.env*, k8s env:) — variable-NAME conventions (KEYS ONLY, never values)
-//   4. source imports          — to attribute each service to its connector file(s) for the io edges
-// and matches them against a curated signature registry → a structured list of services the repo
-// talks to, each with kind/name/colour + the files that connect to it.
-//
-// PRIVACY: env files are read for KEY NAMES only (the part before `=`); values are never parsed,
-// stored, logged, or returned. Secrets in .env stay in .env.
-//
-// This file is now a facade — the implementation lives in the sibling modules below; every public
-// export is re-exported here so existing import paths keep working unchanged:
-//   infra.match.js  — deterministic matchers (deps / images / env keys) + manifest dep extraction
-//   infra.scan.js   — the single filesystem walk (manifests, compose/k8s images, env KEY names)
-//   infra.detect.js — signature matching, connector-file attribution, cached public API
-
-// ---- signature registry ----
-// One row per backing service, loaded from infra-registry.js (generated + adversarially verified by the
-// infra-signature-registry workflow). Matching is DETERMINISTIC token comparison (no free-form regex over
-// arbitrary text), so false positives stay near zero:
-//   deps        — exact manifest dependency names; token T matches dep D when D===T or D starts with T/ T: T@.
-//   images      — docker image repo names, matched by path-segment SUFFIX ("redis" hits "bitnami/redis";
-//                 "mongo" misses "mongo-express").
-//   envPrefixes — UPPERCASE env-var KEY prefixes; token P matches key K when K===P or K starts with P_.
-//                 Prefixes listed in envWeak only count when the key ALSO ends in an infra suffix
-//                 (HOST/URL/DSN/PORT/BROKER/…), so DATABASE_URL-style keys can't over-fire.
-//   imports     — quoted substrings in source import/require lines; used to attribute connector files.
-// kind ∈ db|ts|cache|queue|cloud|api|fs|logs — drives the GUI board tower glyph/colour (GUI core KCFG).
-export { INFRA_SERVICES } from "./infra-registry.js";
-
-export { depMatches, normImageRepo, imageMatches, envMatches, depsFromManifest } from "./infra.match.js";
-export { detectInfraFromScan, detectInfra } from "./infra.detect.js";

package/src/infra/infra.match.js

@@ -1,102 +0,0 @@
-// Deterministic matchers + manifest dependency extraction for infrastructure detection.
-// Split out of infra.js (which remains the public facade); see that file's header for the full
-// detection pipeline and the registry/matching contract.
-import { lc } from "./infra-items.js";
-
-// env-var name suffixes that, when a generic prefix carries one, confirm it really configures a
-// backing service (so PG_/DATABASE_/S3_/ES_ only fire on PG_HOST, DATABASE_URL, S3_BUCKET, …).
-const ENV_SUFFIX = /_(HOSTS?|URLS?|URI|DSN|PORTS?|ADDR|ADDRESS(ES)?|BROKERS?|SERVERS?|ENDPOINTS?|CONN|CONNECTION(S)?|DB|DATABASE|PASS(WORD)?|USER(NAME)?|SECRET|TOPICS?|BUCKETS?|REGION|GROUP|CLUSTER|NAMESPACE|REPLICA(SET)?|MEASUREMENT|TLS|SSL|KEY|TOKEN)$/;
-
-// ---- matchers (exported for unit tests) ---------------------------------------------------------
-export function depMatches(manifestDep, token) {
-  const m = lc(manifestDep), d = lc(token);
-  if (!m || !d) return false;
-  return m === d || m.startsWith(d + "/") || m.startsWith(d + ":") || m.startsWith(d + "@");
-}
-
-// strip registry host + tag + digest → bare repo path (lowercased)
-export function normImageRepo(ref) {
-  let s = String(ref || "").trim().replace(/^['"]|['"]$/g, "");
-  if (!s) return "";
-  const at = s.indexOf("@");
-  if (at >= 0) s = s.slice(0, at); // strip @sha256:...
-  const slash = s.lastIndexOf("/");
-  const lastSeg = s.slice(slash + 1);
-  const colon = lastSeg.indexOf(":"); // tag lives only in the last path segment (host may have :port)
-  if (colon >= 0) s = s.slice(0, slash + 1) + lastSeg.slice(0, colon);
-  return lc(s);
-}
-// repo path-segments end with the token's segments (so "redis" hits "bitnami/redis", "mongo" misses "mongo-express")
-export function imageMatches(repoSegs, token) {
-  const t = lc(token).split("/").filter(Boolean);
-  if (!t.length || t.length > repoSegs.length) return false;
-  for (let i = 1; i <= t.length; i++) if (repoSegs[repoSegs.length - i] !== t[t.length - i]) return false;
-  return true;
-}
-
-export function envMatches(key, token, weak) {
-  const K = String(key || "").toUpperCase(), P = String(token || "").toUpperCase();
-  if (!K || !P) return false;
-  if (K !== P && !K.startsWith(P + "_")) return false;
-  if (weak) {
-    if (K === P) return false; // a bare generic prefix alone proves nothing
-    if (!ENV_SUFFIX.test(K.slice(P.length))) return false; // require an infra-ish suffix
-  }
-  return true;
-}
-
-// ---- manifest dependency extraction -------------------------------------------------------------
-
-// Returns a Set of dependency token strings pulled from one manifest file. PROD deps only where the
-// format distinguishes them (package.json/composer.json), so test-only clients (ioredis-mock,
-// mongodb-memory-server, testcontainers) don't manufacture a phantom service.
-// test doubles / in-memory fakes / emulators — these pull in a client name but mean "this is tested
-// against a fake", not "depends on the live service". Never let them register a backing service.
-const DEV_DOUBLE = /(-mock|_mock|mock-|fake|memory-server|inmemory|testcontainers|-local$|localstack|azurite)/i;
-
-export function depsFromManifest(name, text) {
-  const out = new Set();
-  const add = (v) => { const s = String(v || "").trim(); if (s && !DEV_DOUBLE.test(s)) out.add(s); };
-  const low = name.toLowerCase();
-  try {
-    if (low === "package.json") {
-      const j = JSON.parse(text);
-      for (const sect of ["dependencies", "optionalDependencies", "peerDependencies"]) {
-        if (j[sect] && typeof j[sect] === "object") for (const k of Object.keys(j[sect])) add(k);
-      }
-    } else if (low === "composer.json") {
-      const j = JSON.parse(text);
-      if (j.require && typeof j.require === "object") for (const k of Object.keys(j.require)) add(k);
-    } else if (low === "go.mod") {
-      // `require x.y/z v1` and `require ( … )` blocks
-      for (const m of text.matchAll(/^\s*(?:require\s+)?([a-z0-9.-]+\.[a-z]{2,}\/[^\s]+)\s+v[0-9]/gim)) add(m[1]);
-    } else if (low === "go.sum") {
-      for (const m of text.matchAll(/^([a-z0-9.-]+\.[a-z]{2,}\/[^\s]+)\s+v[0-9]/gim)) add(m[1]);
-    } else if (low === "requirements.txt" || low === "constraints.txt") {
-      for (const line of text.split(/\r?\n/)) {
-        const m = line.match(/^\s*([A-Za-z0-9._-]+)/);
-        if (m && !line.trim().startsWith("#")) add(m[1]);
-      }
-    } else if (low === "pipfile" || low === "pyproject.toml" || low === "cargo.toml") {
-      // TOML dependency tables — pull bare `name = ...` keys and array-of-strings `"name>=x"`.
-      for (const m of text.matchAll(/^\s*["']?([A-Za-z0-9._-]+)["']?\s*=/gm)) add(m[1]);
-      for (const m of text.matchAll(/["']([A-Za-z0-9._-]+)\s*[<>=~!^*]/g)) add(m[1]);
-    } else if (low === "pom.xml") {
-      // pair each <artifactId> with the nearest preceding <groupId> → group:artifact AND bare artifact
-      const re = /<groupId>\s*([^<]+?)\s*<\/groupId>\s*<artifactId>\s*([^<]+?)\s*<\/artifactId>/g;
-      let m;
-      while ((m = re.exec(text))) { add(`${m[1]}:${m[2]}`); add(m[2]); }
-      for (const a of text.matchAll(/<artifactId>\s*([^<]+?)\s*<\/artifactId>/g)) add(a[1]);
-    } else if (low.endsWith(".gradle") || low.endsWith(".gradle.kts")) {
-      // implementation('group:artifact:ver') / "group:artifact:ver"
-      for (const m of text.matchAll(/["']([A-Za-z0-9._-]+:[A-Za-z0-9._-]+)(?::[^"']*)?["']/g)) { add(m[1]); add(m[1].split(":")[1]); }
-    } else if (low.endsWith(".csproj") || low === "packages.config" || low.endsWith(".fsproj")) {
-      for (const m of text.matchAll(/(?:PackageReference|package)\s+(?:Include|id)\s*=\s*"([^"]+)"/gi)) add(m[1]);
-    } else if (low === "gemfile") {
-      for (const m of text.matchAll(/^\s*gem\s+["']([^"']+)["']/gim)) add(m[1]);
-    }
-  } catch {
-    /* malformed manifest — skip */
-  }
-  return out;
-}

package/src/infra/infra.scan.js

@@ -1,93 +0,0 @@
-// Repo filesystem scan for infrastructure detection: one walk collects manifest dependency tokens,
-// container image refs, env-var KEY names (never values — see the privacy note in infra.js), and
-// code files for the import-attribution pass. Split out of infra.js (which remains the public facade).
-import { readdirSync } from "node:fs";
-import { join } from "node:path";
-import { safeRead } from "./infra-items.js";
-import { depsFromManifest, normImageRepo } from "./infra.match.js";
-
-// ---- scanning bounds (mirror apimap.js) ---------------------------------------------------------
-const SKIP_DIRS = new Set([
-  ".git", "node_modules", "dist", "build", "out", ".next", "coverage", "vendor",
-  ".venv", "venv", "env", "target", "__pycache__", ".idea", ".vscode", ".cache", "bin", "obj",
-]);
-const CODE_EXT = new Set([
-  ".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".vue", ".svelte",
-  ".py", ".go", ".java", ".kt", ".rb", ".php", ".cs", ".scala", ".rs",
-]);
-const MAX_FILES = 60000;
-// graph-analysis IPC stays responsive on large repos — detection itself (manifests/images/env) is unaffected
-
-const MANIFEST_NAMES = new Set([
-  "package.json", "composer.json", "go.mod", "go.sum", "requirements.txt", "constraints.txt",
-  "pipfile", "pyproject.toml", "cargo.toml", "pom.xml", "packages.config", "gemfile",
-]);
-const isManifest = (name) => {
-  const n = name.toLowerCase();
-  return MANIFEST_NAMES.has(n) || n.endsWith(".gradle") || n.endsWith(".gradle.kts") || n.endsWith(".csproj") || n.endsWith(".fsproj");
-};
-const isComposeFile = (name) => /^(docker-)?compose([.-].*)?\.ya?ml$/i.test(name);
-const isDockerfile = (name) => /^dockerfile(\..+)?$/i.test(name) || /\.dockerfile$/i.test(name);
-const isYaml = (name) => /\.ya?ml$/i.test(name);
-
-// ---- the scan -----------------------------------------------------------------------------------
-export function scanRepo(repoPath) {
-  const deps = new Set();         // manifest dependency tokens
-  const imageRefs = [];           // normalized image repo paths
-  const envKeys = new Set();      // UPPERCASE env-var names (keys only)
-  const codeFiles = [];           // { path(rel, fwd-slash), full } for the import pass
-  const manifests = new Set();    // which manifest kinds were seen (for diagnostics)
-
-  let count = 0;
-  const stack = [repoPath];
-  while (stack.length) {
-    const cur = stack.pop();
-    let entries;
-    try { entries = readdirSync(cur, { withFileTypes: true }); } catch { continue; }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!SKIP_DIRS.has(entry.name)) stack.push(join(cur, entry.name));
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      if (++count > MAX_FILES) break;
-      const name = entry.name;
-      const full = join(cur, name);
-      const rel = full.slice(repoPath.length).replace(/^[\\/]/, "").replace(/\\/g, "/");
-
-      if (isManifest(name)) {
-        manifests.add(name.toLowerCase());
-        for (const d of depsFromManifest(name, safeRead(full))) deps.add(d);
-        continue;
-      }
-      if (/^\.env(\..+)?$/i.test(name)) {
-        const text = safeRead(full);
-        // KEYS ONLY — split on the first '=' and keep the left side; never read the value.
-        for (const line of text.split(/\r?\n/)) {
-          const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
-          if (m) envKeys.add(m[1].toUpperCase());
-        }
-        continue;
-      }
-      const dockery = isComposeFile(name) || isDockerfile(name);
-      if (dockery || isYaml(name)) {
-        const text = safeRead(full);
-        if (!text) continue;
-        const k8sLike = /(^|\n)\s*kind:\s*\S/.test(text) && /(^|\n)\s*(image|env):/.test(text);
-        if (!dockery && !k8sLike) continue; // a random *.yaml that isn't a manifest — skip
-        for (const m of text.matchAll(/(?:^|\n)\s*(?:-\s*)?image:\s*["']?([^\s"']+)/gi)) imageRefs.push(normImageRepo(m[1]));
-        for (const m of text.matchAll(/(?:^|\n)\s*FROM\s+(?:--platform=\S+\s+)?([^\s]+)/gi)) imageRefs.push(normImageRepo(m[1]));
-        // env var NAMES: k8s `- name: KEY`, compose `KEY: value` / `- KEY=value`, Dockerfile `ENV KEY`
-        for (const m of text.matchAll(/\bname:\s*["']?([A-Z_][A-Z0-9_]{2,})\b/g)) envKeys.add(m[1].toUpperCase());
-        for (const m of text.matchAll(/(?:^|\n)\s*(?:-\s*)?([A-Z_][A-Z0-9_]{2,})\s*[:=]/g)) envKeys.add(m[1].toUpperCase());
-        continue;
-      }
-      const dot = name.lastIndexOf(".");
-      const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
-      if (CODE_EXT.has(ext)) codeFiles.push({ path: rel, full });
-    }
-    if (count > MAX_FILES) break;
-  }
-  const imageSegs = imageRefs.filter(Boolean).map((r) => ({ raw: r, segs: r.split("/").filter(Boolean) }));
-  return { deps, imageSegs, envKeys, codeFiles, manifests: [...manifests] };
-}