Motivation

#338 added root manifest.json upload plumbing and required allowedConnectionIds arrays for backend functions, but those arrays are still empty. This PR is the first behavior-changing PR in the new discovery parsing stack: it fills allowlists for the safest static case, inline string literal connectionId values inside the backend entry module.

Changes

Adds a new AST extractor under backend/ast-parsing that scans the already-parsed backend file for action-catalog imports and direct action-catalog calls. It recognizes @datadog/action-catalog package root and subpaths, supports named/default/namespace imports, ignores type-only imports, and ignores unrelated functions that happen to accept a connectionId property.

The extractor intentionally stays file-local for this PR. It accepts only inline string literals like:

import { request } from '@datadog/action-catalog/http/http';

request({ connectionId: '77c14b8b-27e1-4901-985d-8817908b9706', inputs: {} });

Unsupported action-catalog shapes that could hide a connection ID fail closed, including identifier/template/member/call expressions, object spreads, computed keys, non-object call arguments, and optional action calls. Extracted IDs are deduped, sorted, and assigned as the same file-level union to every backend export from that entry file.

QA Instructions

Run:

~/.yarn/switch/bin/yarn eslint packages/plugins/apps/src/backend/ast-parsing/extract-connection-ids.ts packages/plugins/apps/src/backend/ast-parsing/extract-connection-ids.test.ts packages/plugins/apps/src/index.ts packages/plugins/apps/src/index.test.ts --quiet
~/.yarn/switch/bin/yarn workspace @dd/apps-plugin typecheck
~/.yarn/switch/bin/yarn workspace @dd/tests test:unit packages/plugins/apps/src/backend/ast-parsing/extract-connection-ids.test.ts packages/plugins/apps/src/index.test.ts --runInBand
~/.yarn/switch/bin/yarn workspace @dd/tests test:unit packages/plugins/apps/src/backend/discovery.test.ts packages/plugins/apps/src/vite/dev-server.test.ts --runInBand

I also verified against /Users/scott.kennedy/dd/test-action-catalog-app by capturing the uploaded ZIP from npm run build and inspecting manifest.json. The helper path backend/helpers/httpProbe.ts uses CONNECTIONS.HTTP through an imported helper module, so this PR correctly leaves moduleGraphHttpProbe.allowedConnectionIds empty; later stack PRs own same-module and module-graph resolution.

Blast Radius

This affects only @dd/apps-plugin backend discovery for High Code Apps. The frontend proxy shape is unchanged. The manifest allowlist remains empty unless a backend entry file contains supported inline action-catalog connectionId strings. Known action-catalog calls with unsupported connection ID shapes now fail during build instead of silently emitting an incomplete allowlist.

Documentation

• No docs change for this internal stack PR.