[APPS][Connections Part 3] Resolve same-module connection ID values

[sdkennedy2]

Motivation

This builds on the inline connection ID extractor in #349. Inline string literals are safe, but app authors commonly keep connection IDs in same-file constants or same-file connection maps. This PR lets backend manifest extraction support those static same-module patterns without crossing into imported module graph analysis.

Changes

Adds same-module static value resolution for supported connectionId forms:

const HTTP_CONNECTION_ID = '77c14b8b-27e1-4901-985d-8817908b9706';
request({ connectionId: HTTP_CONNECTION_ID, inputs: {} });

const CONNECTIONS = { HTTP: HTTP_CONNECTION_ID };
request({ connectionId: CONNECTIONS.HTTP, inputs: {} });

const NESTED_CONNECTIONS = { HTTP: { PROD: HTTP_CONNECTION_ID } };
request({ connectionId: NESTED_CONNECTIONS.HTTP.PROD, inputs: {} });

The resolver tracks bindings by eslint-scope variable identity, not raw name, so shadowing behavior stays aligned with #349. It supports top-level const string values, exported top-level consts, const-to-const chains, static template literals, static object member reads, and arbitrarily deep static object member chains such as CONNECTIONS.HTTP.PROD.US1.

Nested object reads are resolved one static property hop at a time. Intermediate values must also be visibly static object literals or safe same-module const aliases; otherwise the extractor fails closed instead of guessing.

It fails closed for mutable bindings, imported bindings, unresolved identifiers, dynamic templates, computed/spread object cases, non-object intermediate member values, call expressions, binary expressions, environment reads, and const cycles.

Imported helper modules remain intentionally unsupported here; that belongs to the next module-graph PR.

QA Instructions

Added extractor tests, including nested static object-member reads and nested fail-closed cases.

Also validated before the split with /Users/scott.kennedy/dd/test-action-catalog-app using a backend function containing both connectionId: HTTP_CONNECTION_ID and connectionId: CONNECTIONS.HTTP:

• Upload build succeeded with DD_APPS_UPLOAD_ASSETS=1 and published version ad4aef1e78e280ae.
• Dev server /__dd/executeAction succeeded for moduleGraphHttpProbe.
• Both action-catalog HTTP requests returned status 200 and ok: true.

Blast Radius

This affects Apps backend function discovery/upload/dev-server manifest generation for action-catalog connection allowlists. Runtime backend execution is unchanged. The new behavior is conservative: unsupported static analysis forms throw for known action-catalog calls rather than producing an incomplete allowlist.

Documentation

• PR Description Guidelines

[sdkennedy2]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• [APPS][Connections Part 3] Resolve same-module connection ID values #351 👈 (View in Graphite)
• [APPS][Connections Part 2] Extract inline backend connection IDs #349 : 1 other dependent PR (#352 )
• [APPS][Connections Part 1] Add internal AST traversal helper #350
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.