[APPS][Connections Part 2] Extract inline backend connection IDs

[sdkennedy2]

Motivation

This is part 2 of the connection ID manifest stack. After part 1 adds manifest plumbing with empty allowlists, this PR introduces the smallest useful static analysis behavior: inline string literal connectionId values in same-file action-catalog calls.

Changes

Adds extract-connection-ids.ts and wires it into backend proxy generation so every export in a backend file receives the same sorted, deduped file-level union of inline connection IDs. This PR also refactors backend export discovery around enumerateBackendExports, keeping existing extractExportedFunctions behavior while making export-shape validation shared and testable.

Supported in this PR:

import { request } from '@datadog/action-catalog/http/http';

export function run() {
  return request({ connectionId: 'conn-id', inputs: {} });
}

The extractor recognizes named/default/namespace action-catalog imports from the package root and subpaths. It ignores unrelated calls with connectionId, ignores action-catalog object arguments that visibly lack connectionId, and fails closed for unsupported call shapes that could hide a connection ID.

Same-module identifiers, object members, and imported values are intentionally deferred to later PRs.

QA Instructions

• Run NODE_OPTIONS=--experimental-vm-modules ~/.yarn/switch/bin/yarn workspace @dd/tests jest --config jest.config.ts ../plugins/apps/src/backend/discovery.test.ts ../plugins/apps/src/backend/extract-connection-ids.test.ts ../plugins/apps/src/index.test.ts ../plugins/apps/src/vite/index.test.ts ../plugins/apps/src/vite/dev-server.test.ts ../plugins/apps/src/upload.test.ts --runInBand.
• Run ~/.yarn/switch/bin/yarn workspace @dd/apps-plugin typecheck.
• Run ~/.yarn/switch/bin/yarn workspace @dd/tests typecheck.
• Confirm unsupported identifier/template/member/call expressions still fail clearly in extractor tests.

Blast Radius

This affects apps backend function proxy generation and static analysis for action-catalog calls inside backend entry files only. It does not traverse imported local modules and does not add dependency on a connections registry.

Documentation

• How to reliably make frontend production changes
• PR Description Guidelines
• Deploy steps

[sdkennedy2]

• [APPS][Connections Part 4] Analyze backend connection IDs across modules #341
• [APPS][Connections Part 3] Resolve same-module backend connection IDs #340
• [APPS][Connections Part 2] Extract inline backend connection IDs #339 👈 (View in Graphite)
• [APPS][Connections Part 1] Add backend connection manifest upload plumbing #338
• [APPS] Stop exposing raw index.html standalone URL #329 : 1 other dependent PR (#330 )
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9320d3ef3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Follow or reject re-exported backend implementations

For supported facades such as export { run } from './impl' or import { run } from './impl'; export { run }, the transform registers run as a backend function but this call only scans the facade AST. If ./impl contains the inline action-catalog call with connectionId, the generated backend bundle still executes it while the manifest records an empty allowedConnectionIds, so those functions fail once the action requires that connection.

Useful? React with 👍 / 👎.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e1b24d7de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97a160dd20

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9bcbfc188e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve allowlists for re-exported backend handlers

When a .backend file uses the supported export { run } from './impl' shape, extractExportedFunctions still registers run, but this call only scans the wrapper file's AST, not the re-export source. If ./impl contains the action-catalog call with an inline connectionId, the generated manifest records allowedConnectionIds: [] for that backend function even though the bundled function will execute the action, so re-exported handlers are denied/misrepresented at runtime. The new enumerateBackendExports metadata includes source, but the transform discards it here.

Useful? React with 👍 / 👎.

[datadog-datadog-prod-us1-2]

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c3c12a6 | Docs | Datadog PR Page | Give us feedback!}