[APPS][Connections Part 6] Collect backend action calls during backend builds

[sdkennedy2]

Motivation

Backend connection ID extraction previously only scanned the .backend.* entry module. That missed action-catalog calls hidden in local helper modules imported by a backend function, so the generated app manifest could omit required connection allowlists.

This PR sits on top of build-plugins#357, which contains the behavior-neutral getVitePlugin ownership refactor. This diff focuses on reachable helper-module action-catalog discovery.

Changes

Moves reachable action-catalog discovery out of the frontend .backend.* transform and into the dedicated backend build path. The frontend transform now stays narrow: it discovers backend exports, registers backend functions with placeholder allowlists, and generates proxy modules.

Adds a backend-build collector plugin that observes parsed modules during the backend vite.build used for production upload and dev execution. The collector records parsed module records keyed by normalized module ID, then computes the backend entry's conservative file-level allowlist from the collected backend module graph.

This avoids duplicating Rollup/Vite resolution and loading in the frontend transform. Production backend builds now return enriched BackendFunction[] before manifest upload, and dev execution enriches the selected backend function before sending allowedConnectionIds to Datadog.

The value boundary remains unchanged: inline strings, same-module constants, and same-module object reads in reachable helpers work, while imported connection ID values still fail closed for the next PR. Unsupported local graph shapes continue to fail closed when they could hide action-catalog calls, including local dynamic imports, non-literal dynamic imports, local require, and uncollected local static imports.

QA Instructions

Automated verification run locally:

• yarn workspace @dd/apps-plugin typecheck
• yarn workspace @dd/tests test:unit packages/plugins/apps/src/backend/ast-parsing/module-graph-connection-ids.test.ts packages/plugins/apps/src/vite/dev-server.test.ts packages/plugins/apps/src/index.test.ts packages/plugins/apps/src/vite/index.test.ts --runInBand
• yarn eslint packages/plugins/apps/src/backend/ast-parsing/module-graph-connection-ids.ts packages/plugins/apps/src/backend/ast-parsing/module-graph-connection-ids.test.ts packages/plugins/apps/src/vite/backend-connection-id-collector.ts packages/plugins/apps/src/vite/build-config.ts packages/plugins/apps/src/vite/build-backend-functions.ts packages/plugins/apps/src/vite/dev-server.ts packages/plugins/apps/src/vite/dev-server.test.ts packages/plugins/apps/src/vite/index.ts packages/plugins/apps/src/index.test.ts --quiet

Manual staging/test-app verification still needs to be rerun after this backend-build collector rewrite.

Blast Radius

Affects @dd/apps-plugin backend function build/upload and dev execution paths for .backend.ts / .backend.js files. Backend proxy generation and runtime execution contracts are unchanged.

Risk is primarily fail-closed behavior for unsupported local graph patterns or collector visibility edge cases in the backend build. The implementation intentionally keeps analysis scoped to modules observed by the backend build instead of scanning the full project.

Documentation

• How to reliably make frontend production changes
• PR Description Guidelines
• Deploy steps

[sdkennedy2]

• [APPS][Connections Part 6] Collect backend action calls during backend builds #353 👈 (View in Graphite)
• [APPS][Connections Part 5] Move apps Vite behavior into getVitePlugin #357
• [APPS][Connections Part 4] Resolve same-module connection ID object values #354
• [APPS][Connections Part 3] Resolve same-module connection ID constants #351
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e118c97bcd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve aliased local imports before skipping dependencies

For backend files that import local helpers through a Vite/TS path alias such as @/backend/helpers/http, this guard treats the bare specifier as a package and skips it before calling context.resolve. Vite supports aliases for import/require specifiers (https://vite.dev/config/shared-options/#resolve-alias), so an aliased helper can resolve back under buildRoot; skipping it means any action-catalog calls in that helper are never scanned and the generated manifest silently omits their allowedConnectionIds.

Useful? React with 👍 / 👎.

[datadog-official]

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

🧪 2 Tests failed

Bundling Bundler: esbuild Should not throw on easy project. from ../tools/src/rollupConfig.test.ts     (Fix with Cursor)

The blob could not be read

Bundling Bundler: esbuild Should not throw on hard project. from ../tools/src/rollupConfig.test.ts     (Fix with Cursor)

The blob could not be read

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b941937 | Docs | Datadog PR Page | Give us feedback!}