@neat.is/core 0.2.5

package/dist/chunk-6SFEITLJ.js

@@ -0,0 +1,3371 @@
+// src/graph.ts
+import GraphDefault from "graphology";
+var MultiDirectedGraph = GraphDefault.MultiDirectedGraph;
+var DEFAULT_PROJECT = "default";
+var graphs = /* @__PURE__ */ new Map();
+function makeGraph() {
+  return new MultiDirectedGraph({ allowSelfLoops: false });
+}
+function getGraph(project = DEFAULT_PROJECT) {
+  let g = graphs.get(project);
+  if (!g) {
+    g = makeGraph();
+    graphs.set(project, g);
+  }
+  return g;
+}
+function resetGraph(project) {
+  if (project === void 0) {
+    graphs.clear();
+    return;
+  }
+  graphs.delete(project);
+}
+
+// src/compat.ts
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
+import semver from "semver";
+
+// compat.json
+var compat_default = {
+  pairs: [
+    {
+      kind: "driver-engine",
+      driver: "pg",
+      engine: "postgresql",
+      minDriverVersion: "8.0.0",
+      minEngineVersion: "14",
+      reason: "PostgreSQL 14+ requires scram-sha-256 auth by default; pg < 8.0.0 only speaks md5."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mysql2",
+      engine: "mysql",
+      minDriverVersion: "3.0.0",
+      minEngineVersion: "8",
+      reason: "MySQL 8 defaults to caching_sha2_password; mysql2 < 3.0.0 doesn't negotiate it."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mongoose",
+      engine: "mongodb",
+      minDriverVersion: "7.0.0",
+      minEngineVersion: "7",
+      reason: "MongoDB 7 drops legacy wire-protocol opcodes that mongoose < 7.0.0 still emits."
+    },
+    {
+      kind: "driver-engine",
+      driver: "psycopg2",
+      engine: "postgresql",
+      minDriverVersion: "2.9.0",
+      minEngineVersion: "14",
+      reason: "PostgreSQL 14+ requires scram-sha-256 auth by default; psycopg2 < 2.9.0 only speaks md5."
+    },
+    {
+      kind: "driver-engine",
+      driver: "pymongo",
+      engine: "mongodb",
+      minDriverVersion: "4.0.0",
+      minEngineVersion: "7",
+      reason: "MongoDB 7 drops legacy wire-protocol opcodes that pymongo < 4.0.0 still emits."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mysql-connector-python",
+      engine: "mysql",
+      minDriverVersion: "8.0.0",
+      minEngineVersion: "8",
+      reason: "MySQL 8 defaults to caching_sha2_password; mysql-connector-python < 8.0.0 doesn't negotiate it."
+    }
+  ],
+  nodeEngineConstraints: [
+    {
+      kind: "node-engine",
+      package: "vitest",
+      packageMinVersion: "2.0.0",
+      minNodeVersion: "18.0.0",
+      reason: "vitest >= 2.0 drops Node 16 support; requires Node 18+."
+    },
+    {
+      kind: "node-engine",
+      package: "next",
+      packageMinVersion: "14.0.0",
+      minNodeVersion: "18.17.0",
+      reason: "Next 14+ requires Node 18.17+ (uses APIs introduced in that minor)."
+    },
+    {
+      kind: "node-engine",
+      package: "@modelcontextprotocol/sdk",
+      packageMinVersion: "1.0.0",
+      minNodeVersion: "18.0.0",
+      reason: "@modelcontextprotocol/sdk >= 1 requires Node 18+ (web-streams polyfill removed)."
+    }
+  ],
+  packageConflicts: [
+    {
+      kind: "package-conflict",
+      package: "@tanstack/react-query",
+      packageMinVersion: "5.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.0.0"
+      },
+      reason: "@tanstack/react-query 5+ uses useSyncExternalStore \u2014 only available in React 18+."
+    },
+    {
+      kind: "package-conflict",
+      package: "react-router-dom",
+      packageMinVersion: "7.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.0.0"
+      },
+      reason: "react-router-dom 7+ requires React 18+."
+    },
+    {
+      kind: "package-conflict",
+      package: "next",
+      packageMinVersion: "14.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.2.0"
+      },
+      reason: "Next.js 14+ requires React 18.2+."
+    }
+  ],
+  deprecatedApis: [
+    {
+      kind: "deprecated-api",
+      package: "request",
+      packageMaxVersion: "2.88.2",
+      reason: "request is deprecated; use undici, node-fetch, or axios instead."
+    },
+    {
+      kind: "deprecated-api",
+      package: "node-uuid",
+      reason: "node-uuid is deprecated; use the `uuid` package."
+    }
+  ]
+};
+
+// src/compat.ts
+var bundledMatrix = compat_default;
+var mergedMatrix = null;
+var remoteLoadAttempted = false;
+var REMOTE_CACHE_DIR = path.join(os.homedir(), ".neat");
+var REMOTE_CACHE_PATH = path.join(REMOTE_CACHE_DIR, "compat-cache.json");
+var REMOTE_TTL_MS = 24 * 60 * 60 * 1e3;
+function engineMeetsThreshold(engineVersion, threshold) {
+  const e = parseInt(engineVersion, 10);
+  const t = parseInt(threshold, 10);
+  if (Number.isFinite(e) && Number.isFinite(t)) return e >= t;
+  const ec = semver.coerce(engineVersion);
+  const tc = semver.coerce(threshold);
+  if (ec && tc) return semver.gte(ec, tc);
+  return false;
+}
+function checkCompatibility(driver, driverVersion, engine, engineVersion) {
+  const matrix = currentMatrix();
+  const pair = matrix.pairs.find((p) => p.driver === driver && p.engine === engine);
+  if (!pair) return { compatible: true };
+  if (pair.minEngineVersion && !engineMeetsThreshold(engineVersion, pair.minEngineVersion)) {
+    return { compatible: true };
+  }
+  const driverCoerced = semver.coerce(driverVersion);
+  if (!driverCoerced) return { compatible: true };
+  if (semver.lt(driverCoerced, pair.minDriverVersion)) {
+    return {
+      compatible: false,
+      reason: pair.reason,
+      minDriverVersion: pair.minDriverVersion
+    };
+  }
+  return { compatible: true };
+}
+function rangeAdmitsVersion(serviceNodeRange, requiredNodeVersion) {
+  try {
+    const required = semver.coerce(requiredNodeVersion);
+    if (!required) return true;
+    return semver.subset(serviceNodeRange, `>=${required.version}`, {
+      includePrerelease: false
+    });
+  } catch {
+    return true;
+  }
+}
+function checkNodeEngineConstraint(constraint, declaredPackageVersion, serviceNodeRange) {
+  if (constraint.packageMinVersion && declaredPackageVersion) {
+    const v = semver.coerce(declaredPackageVersion);
+    if (v && semver.lt(v, constraint.packageMinVersion)) {
+      return { compatible: true };
+    }
+  }
+  if (!serviceNodeRange) {
+    return { compatible: true };
+  }
+  if (rangeAdmitsVersion(serviceNodeRange, constraint.minNodeVersion)) {
+    return { compatible: true };
+  }
+  return {
+    compatible: false,
+    reason: constraint.reason,
+    requiredNodeVersion: constraint.minNodeVersion
+  };
+}
+function checkPackageConflict(conflict, declaredPackageVersion, declaredRequiredVersion) {
+  if (!declaredPackageVersion) return { compatible: true };
+  if (conflict.packageMinVersion) {
+    const v = semver.coerce(declaredPackageVersion);
+    if (v && semver.lt(v, conflict.packageMinVersion)) {
+      return { compatible: true };
+    }
+  }
+  if (!declaredRequiredVersion) {
+    return {
+      compatible: false,
+      reason: conflict.reason,
+      requires: conflict.requires
+    };
+  }
+  const requiredCoerced = semver.coerce(declaredRequiredVersion);
+  if (!requiredCoerced) return { compatible: true };
+  if (semver.lt(requiredCoerced, conflict.requires.minVersion)) {
+    return {
+      compatible: false,
+      reason: conflict.reason,
+      requires: conflict.requires,
+      foundVersion: declaredRequiredVersion
+    };
+  }
+  return { compatible: true };
+}
+function checkDeprecatedApi(rule, declaredVersion) {
+  if (declaredVersion === void 0) return { compatible: true };
+  if (rule.packageMaxVersion) {
+    const v = semver.coerce(declaredVersion);
+    const max = semver.coerce(rule.packageMaxVersion);
+    if (v && max && semver.gt(v, max)) return { compatible: true };
+  }
+  return { compatible: false, reason: rule.reason };
+}
+function currentMatrix() {
+  return mergedMatrix ?? bundledMatrix;
+}
+function mergeMatrices(a, b) {
+  return {
+    pairs: [...a.pairs, ...b.pairs ?? []],
+    nodeEngineConstraints: [
+      ...a.nodeEngineConstraints ?? [],
+      ...b.nodeEngineConstraints ?? []
+    ],
+    packageConflicts: [...a.packageConflicts ?? [], ...b.packageConflicts ?? []],
+    deprecatedApis: [...a.deprecatedApis ?? [], ...b.deprecatedApis ?? []]
+  };
+}
+async function readRemoteCache(url) {
+  try {
+    const raw = await fs.readFile(REMOTE_CACHE_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.url !== url) return null;
+    const age = Date.now() - new Date(parsed.fetchedAt).getTime();
+    if (age > REMOTE_TTL_MS) return null;
+    return parsed.matrix;
+  } catch {
+    return null;
+  }
+}
+async function writeRemoteCache(url, matrix) {
+  const file = {
+    fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    url,
+    matrix
+  };
+  try {
+    await fs.mkdir(REMOTE_CACHE_DIR, { recursive: true });
+    await fs.writeFile(REMOTE_CACHE_PATH, JSON.stringify(file), "utf8");
+  } catch (err) {
+    console.warn(`[neat] failed to cache compat matrix: ${err.message}`);
+  }
+}
+async function ensureCompatLoaded() {
+  if (mergedMatrix) return mergedMatrix;
+  if (remoteLoadAttempted) {
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+  remoteLoadAttempted = true;
+  const url = process.env.NEAT_COMPAT_URL;
+  if (!url) {
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+  const cached = await readRemoteCache(url);
+  if (cached) {
+    mergedMatrix = mergeMatrices(bundledMatrix, cached);
+    return mergedMatrix;
+  }
+  try {
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
+    const remote = await res.json();
+    await writeRemoteCache(url, remote);
+    mergedMatrix = mergeMatrices(bundledMatrix, remote);
+    return mergedMatrix;
+  } catch (err) {
+    console.warn(
+      `[neat] NEAT_COMPAT_URL fetch failed (${err.message}); using bundled matrix only`
+    );
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+}
+function compatPairs() {
+  return currentMatrix().pairs;
+}
+function nodeEngineConstraints() {
+  return currentMatrix().nodeEngineConstraints ?? [];
+}
+function packageConflicts() {
+  return currentMatrix().packageConflicts ?? [];
+}
+function deprecatedApis() {
+  return currentMatrix().deprecatedApis ?? [];
+}
+
+// src/traverse.ts
+import {
+  BlastRadiusResultSchema,
+  NodeType,
+  PROV_RANK,
+  Provenance,
+  RootCauseResultSchema,
+  TransitiveDependenciesResultSchema
+} from "@neat.is/types";
+var ROOT_CAUSE_MAX_DEPTH = 5;
+var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function bestEdgeBySource(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (e.provenance === Provenance.FRONTIER) continue;
+    const cur = best.get(e.source);
+    if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
+      best.set(e.source, e);
+    }
+  }
+  return best;
+}
+function bestEdgeByTarget(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (e.provenance === Provenance.FRONTIER) continue;
+    const cur = best.get(e.target);
+    if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
+      best.set(e.target, e);
+    }
+  }
+  return best;
+}
+var PROVENANCE_CEILING = {
+  OBSERVED: 1,
+  INFERRED: 0.7,
+  EXTRACTED: 0.5,
+  STALE: 0.3,
+  FRONTIER: 0.3
+};
+function volumeWeight(spanCount) {
+  if (!spanCount || spanCount <= 0) return 0.5;
+  const w = 0.5 + Math.log10(spanCount + 1) / 3;
+  return Math.min(1, w);
+}
+function recencyWeight(ageMs) {
+  if (ageMs === void 0) return 0.8;
+  const hour = 60 * 60 * 1e3;
+  if (ageMs <= hour) return 1;
+  if (ageMs <= 24 * hour) {
+    const t = (ageMs - hour) / (23 * hour);
+    return 1 - 0.5 * t;
+  }
+  return 0.3;
+}
+function cleanlinessWeight(spanCount, errorCount) {
+  if (!spanCount || spanCount <= 0) return 1;
+  const rate = (errorCount ?? 0) / spanCount;
+  if (rate <= 0.01) return 1;
+  if (rate >= 0.5) return 0.3;
+  return 1 - rate * 1.4;
+}
+function confidenceForEdge(edge, now = Date.now()) {
+  const ceiling = PROVENANCE_CEILING[edge.provenance] ?? 0.5;
+  const spanCount = edge.signal?.spanCount ?? edge.callCount;
+  const ageMs = edge.signal?.lastObservedAgeMs ?? lastObservedAge(edge, now);
+  if (spanCount === void 0 && ageMs === void 0 && edge.signal === void 0) {
+    return ceiling;
+  }
+  const v = volumeWeight(spanCount);
+  const r = recencyWeight(ageMs);
+  const c = cleanlinessWeight(spanCount, edge.signal?.errorCount);
+  return Math.max(0, Math.min(1, ceiling * v * r * c));
+}
+function lastObservedAge(edge, now) {
+  if (!edge.lastObserved) return void 0;
+  const t = Date.parse(edge.lastObserved);
+  if (!Number.isFinite(t)) return void 0;
+  return Math.max(0, now - t);
+}
+function confidenceFromMix(edges, now = Date.now()) {
+  if (edges.length === 0) return 1;
+  let product = 1;
+  for (const e of edges) {
+    product *= confidenceForEdge(e, now);
+  }
+  return Math.max(0, Math.min(1, product));
+}
+function longestIncomingWalk(graph, start, maxDepth) {
+  let best = { path: [start], edges: [] };
+  const visited = /* @__PURE__ */ new Set([start]);
+  function step(node, path29, edges) {
+    if (path29.length > best.path.length) {
+      best = { path: [...path29], edges: [...edges] };
+    }
+    if (path29.length - 1 >= maxDepth) return;
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
+    for (const [srcId, edge] of incoming) {
+      if (visited.has(srcId)) continue;
+      visited.add(srcId);
+      path29.push(srcId);
+      edges.push(edge);
+      step(srcId, path29, edges);
+      path29.pop();
+      edges.pop();
+      visited.delete(srcId);
+    }
+  }
+  step(start, [start], []);
+  return best;
+}
+function databaseRootCauseShape(graph, origin, walk) {
+  const targetDb = origin;
+  const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
+  if (candidatePairs.length === 0) return null;
+  for (const id of walk.path) {
+    const attrs = graph.getNodeAttributes(id);
+    if (attrs.type !== NodeType.ServiceNode) continue;
+    const svc = attrs;
+    const deps = svc.dependencies ?? {};
+    for (const pair of candidatePairs) {
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        targetDb.engine,
+        targetDb.engineVersion
+      );
+      if (!result.compatible) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason ?? "incompatible driver",
+          ...result.minDriverVersion ? {
+            fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
+          } : {}
+        };
+      }
+    }
+  }
+  return null;
+}
+function serviceRootCauseShape(graph, _origin, walk) {
+  for (const id of walk.path) {
+    const attrs = graph.getNodeAttributes(id);
+    if (attrs.type !== NodeType.ServiceNode) continue;
+    const svc = attrs;
+    const deps = svc.dependencies ?? {};
+    const serviceNodeEngine = svc.nodeEngine;
+    for (const constraint of nodeEngineConstraints()) {
+      const declared = deps[constraint.package];
+      if (!declared) continue;
+      const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason,
+          ...result.requiredNodeVersion ? {
+            fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
+          } : {}
+        };
+      }
+    }
+    for (const conflict of packageConflicts()) {
+      const declared = deps[conflict.package];
+      if (!declared) continue;
+      const requiredDeclared = deps[conflict.requires.name];
+      const result = checkPackageConflict(conflict, declared, requiredDeclared);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason,
+          fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
+        };
+      }
+    }
+  }
+  return null;
+}
+var rootCauseShapes = {
+  [NodeType.DatabaseNode]: databaseRootCauseShape,
+  [NodeType.ServiceNode]: serviceRootCauseShape
+};
+function getRootCause(graph, errorNodeId, errorEvent) {
+  if (!graph.hasNode(errorNodeId)) return null;
+  const origin = graph.getNodeAttributes(errorNodeId);
+  const shape = rootCauseShapes[origin.type];
+  if (!shape) return null;
+  const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+  const match = shape(graph, origin, walk);
+  if (!match) return null;
+  const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+  return RootCauseResultSchema.parse({
+    rootCauseNode: match.rootCauseNode,
+    rootCauseReason: reason,
+    traversalPath: walk.path,
+    edgeProvenances: walk.edges.map((e) => e.provenance),
+    confidence: confidenceFromMix(walk.edges),
+    fixRecommendation: match.fixRecommendation
+  });
+}
+function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return BlastRadiusResultSchema.parse({ origin: nodeId, affectedNodes: [], totalAffected: 0 });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, path: [nodeId], pathEdges: [] }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.pathEdges.length > 0) {
+      const lastEdge = frame.pathEdges[frame.pathEdges.length - 1];
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeProvenance: lastEdge.provenance,
+        path: frame.path,
+        confidence: confidenceFromMix(frame.pathEdges)
+      });
+    }
+    if (frame.distance >= maxDepth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({
+        nodeId: tgtId,
+        distance: frame.distance + 1,
+        path: [...frame.path, tgtId],
+        pathEdges: [...frame.pathEdges, edge]
+      });
+    }
+  }
+  const affectedNodes = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return BlastRadiusResultSchema.parse({
+    origin: nodeId,
+    affectedNodes,
+    totalAffected: affectedNodes.length
+  });
+}
+var TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH = 3;
+var TRANSITIVE_DEPENDENCIES_MAX_DEPTH = 10;
+function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return TransitiveDependenciesResultSchema.parse({
+      origin: nodeId,
+      depth,
+      dependencies: [],
+      total: 0
+    });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, edge: null }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.edge) {
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeType: frame.edge.type,
+        provenance: frame.edge.provenance
+      });
+    }
+    if (frame.distance >= depth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({ nodeId: tgtId, distance: frame.distance + 1, edge });
+    }
+  }
+  const dependencies = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return TransitiveDependenciesResultSchema.parse({
+    origin: nodeId,
+    depth,
+    dependencies,
+    total: dependencies.length
+  });
+}
+
+// src/ingest.ts
+import { promises as fs3 } from "fs";
+import path3 from "path";
+
+// src/policy.ts
+import { promises as fs2 } from "fs";
+import path2 from "path";
+import {
+  EdgeType,
+  NodeType as NodeType2,
+  PolicyFileSchema,
+  Provenance as Provenance2
+} from "@neat.is/types";
+var DEFAULT_ACTION_BY_SEVERITY = {
+  info: "log",
+  warning: "alert",
+  error: "alert",
+  critical: "block"
+};
+function resolveOnViolation(policy) {
+  return policy.onViolation ?? DEFAULT_ACTION_BY_SEVERITY[policy.severity];
+}
+function makeViolation(policy, rule, contextSuffix, message, subject, ctx) {
+  return {
+    id: `${policy.id}:${contextSuffix}`,
+    policyId: policy.id,
+    policyName: policy.name,
+    severity: policy.severity,
+    onViolation: resolveOnViolation(policy),
+    ruleType: rule.type,
+    subject,
+    message,
+    observedAt: new Date(ctx.now()).toISOString()
+  };
+}
+var evaluateStructural = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.fromNodeType) return;
+    let satisfied = false;
+    for (const edgeId of graph.outboundEdges(id)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== rule.edgeType) continue;
+      if (e.provenance === Provenance2.FRONTIER) continue;
+      const target = graph.getNodeAttributes(e.target);
+      if (target.type === rule.toNodeType) {
+        satisfied = true;
+        break;
+      }
+    }
+    if (!satisfied) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.fromNodeType} ${id} has no ${rule.edgeType} edge to a ${rule.toNodeType}`,
+          { nodeId: id },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateOwnership = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const value = a[rule.field];
+    if (typeof value !== "string" || value.length === 0) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} is missing required field "${rule.field}"`,
+          { nodeId: id },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateProvenance = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const required = Array.isArray(rule.required) ? new Set(rule.required) : /* @__PURE__ */ new Set([rule.required]);
+  const violations = [];
+  graph.forEachEdge((edgeId, attrs) => {
+    const e = attrs;
+    if (e.type !== rule.edgeType) return;
+    if (rule.targetNodeId && e.target !== rule.targetNodeId) return;
+    if (!required.has(e.provenance)) {
+      const requiredList = [...required].join(" | ");
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          edgeId,
+          `${rule.edgeType} edge ${edgeId} has provenance ${e.provenance}; required ${requiredList}`,
+          { edgeId },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateBlastRadius = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const depth = rule.depth;
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const result = depth !== void 0 ? getBlastRadius(graph, id, depth) : getBlastRadius(graph, id);
+    if (result.totalAffected > rule.maxAffected) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} has blast radius ${result.totalAffected} > ${rule.maxAffected}`,
+          { nodeId: id, path: [id] },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateCompatibility = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const wantsKind = (kind) => rule.kind === void 0 || rule.kind === kind;
+  graph.forEachNode((svcId, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType2.ServiceNode) return;
+    const svc = a;
+    const deps = svc.dependencies ?? {};
+    if (wantsKind("driver-engine")) {
+      for (const edgeId of graph.outboundEdges(svcId)) {
+        const e = graph.getEdgeAttributes(edgeId);
+        if (e.type !== EdgeType.CONNECTS_TO) continue;
+        if (e.provenance === Provenance2.FRONTIER) continue;
+        const dbAttrs = graph.getNodeAttributes(e.target);
+        if (dbAttrs.type !== NodeType2.DatabaseNode) continue;
+        const db = dbAttrs;
+        for (const pair of compatPairs()) {
+          if (pair.engine !== db.engine) continue;
+          const declared = deps[pair.driver];
+          if (!declared) continue;
+          const result = checkCompatibility(pair.driver, declared, db.engine, db.engineVersion);
+          if (!result.compatible && result.reason) {
+            violations.push(
+              makeViolation(
+                policy,
+                rule,
+                `${svcId}:driver-engine:${pair.driver}@${declared}:${db.engine}@${db.engineVersion}`,
+                result.reason,
+                { nodeId: svcId, edgeId },
+                ctx
+              )
+            );
+          }
+        }
+      }
+    }
+    if (wantsKind("node-engine")) {
+      const serviceNodeRange = svc.nodeEngine;
+      for (const constraint of nodeEngineConstraints()) {
+        const declared = deps[constraint.package];
+        if (!declared) continue;
+        const result = checkNodeEngineConstraint(constraint, declared, serviceNodeRange);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:node-engine:${constraint.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+    if (wantsKind("package-conflict")) {
+      for (const conflict of packageConflicts()) {
+        const declared = deps[conflict.package];
+        if (!declared) continue;
+        const requiredDeclared = deps[conflict.requires.name];
+        const result = checkPackageConflict(conflict, declared, requiredDeclared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:package-conflict:${conflict.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+    if (wantsKind("deprecated-api")) {
+      for (const dep of deprecatedApis()) {
+        const declared = deps[dep.package];
+        if (!declared) continue;
+        const result = checkDeprecatedApi(dep, declared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:deprecated-api:${dep.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+  });
+  return violations;
+};
+var policyEvaluators = {
+  structural: evaluateStructural,
+  ownership: evaluateOwnership,
+  provenance: evaluateProvenance,
+  "blast-radius": evaluateBlastRadius,
+  compatibility: evaluateCompatibility
+};
+function canPromoteFrontier(graph, frontierId2, policies, ctx) {
+  if (policies.length === 0) return { allowed: true, violations: [] };
+  const all = evaluateAllPolicies(graph, policies, ctx);
+  const blocking = all.filter((v) => {
+    if (v.onViolation !== "block") return false;
+    return v.subject.nodeId === frontierId2 || v.subject.path?.includes(frontierId2) === true;
+  });
+  return { allowed: blocking.length === 0, violations: blocking };
+}
+function evaluateAllPolicies(graph, policies, ctx) {
+  const out = [];
+  for (const policy of policies) {
+    const evaluator = policyEvaluators[policy.rule.type];
+    const violations = evaluator({ graph, policy, rule: policy.rule, ctx });
+    for (const v of violations) out.push(v);
+  }
+  return out;
+}
+async function loadPolicyFile(policyPath) {
+  let raw;
+  try {
+    raw = await fs2.readFile(policyPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  const json = JSON.parse(raw);
+  const file = PolicyFileSchema.parse(json);
+  return file.policies;
+}
+var PolicyViolationsLog = class {
+  path;
+  seen = null;
+  constructor(logPath) {
+    this.path = logPath;
+  }
+  async append(v) {
+    if (!this.seen) await this.hydrate();
+    if (this.seen.has(v.id)) return false;
+    this.seen.add(v.id);
+    await fs2.mkdir(path2.dirname(this.path), { recursive: true });
+    await fs2.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
+    return true;
+  }
+  async readAll() {
+    try {
+      const raw = await fs2.readFile(this.path, "utf8");
+      return raw.split("\n").filter(Boolean).map((line) => JSON.parse(line));
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+  }
+  async hydrate() {
+    this.seen = /* @__PURE__ */ new Set();
+    const existing = await this.readAll();
+    for (const v of existing) this.seen.add(v.id);
+  }
+};
+
+// src/ingest.ts
+import {
+  EdgeType as EdgeType2,
+  NodeType as NodeType3,
+  Provenance as Provenance3,
+  databaseId,
+  extractedEdgeId,
+  frontierEdgeId,
+  frontierId,
+  inferredEdgeId,
+  observedEdgeId,
+  serviceId
+} from "@neat.is/types";
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_STALE_THRESHOLDS = {
+  CALLS: HOUR_MS,
+  CONNECTS_TO: 4 * HOUR_MS,
+  PUBLISHES_TO: 4 * HOUR_MS,
+  CONSUMES_FROM: 4 * HOUR_MS,
+  DEPENDS_ON: DAY_MS,
+  CONFIGURED_BY: DAY_MS,
+  RUNS_ON: DAY_MS
+};
+var FALLBACK_STALE_THRESHOLD_MS = DAY_MS;
+function loadStaleThresholdsFromEnv() {
+  const raw = process.env.NEAT_STALE_THRESHOLDS;
+  if (!raw) return DEFAULT_STALE_THRESHOLDS;
+  try {
+    const overrides = JSON.parse(raw);
+    const merged = { ...DEFAULT_STALE_THRESHOLDS };
+    for (const [k, v] of Object.entries(overrides)) {
+      if (typeof v === "number" && Number.isFinite(v) && v >= 0) merged[k] = v;
+    }
+    return merged;
+  } catch (err) {
+    console.warn(
+      `[neat] NEAT_STALE_THRESHOLDS could not be parsed (${err.message}); using defaults`
+    );
+    return DEFAULT_STALE_THRESHOLDS;
+  }
+}
+function thresholdForEdgeType(edgeType, overrides) {
+  const map = overrides ?? loadStaleThresholdsFromEnv();
+  return map[edgeType] ?? FALLBACK_STALE_THRESHOLD_MS;
+}
+function nowIso(ctx) {
+  return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
+}
+function pickAttr(span, ...keys) {
+  for (const k of keys) {
+    const v = span.attributes[k];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function hostFromUrl(u) {
+  if (!u) return void 0;
+  try {
+    return new URL(u).hostname;
+  } catch {
+    return void 0;
+  }
+}
+function pickAddress(span) {
+  return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
+}
+function makeObservedEdgeId(type, source, target) {
+  return observedEdgeId(source, target, type);
+}
+function makeInferredEdgeId(type, source, target) {
+  return inferredEdgeId(source, target, type);
+}
+var INFERRED_CONFIDENCE = 0.6;
+var STITCH_MAX_DEPTH = 2;
+var PARENT_SPAN_CACHE_SIZE = 1e4;
+var PARENT_SPAN_CACHE_TTL_MS = 5 * 60 * 1e3;
+var parentSpanCache = /* @__PURE__ */ new Map();
+function parentSpanKey(traceId, spanId) {
+  return `${traceId}:${spanId}`;
+}
+function cacheSpanService(span, now) {
+  if (!span.traceId || !span.spanId) return;
+  const key = parentSpanKey(span.traceId, span.spanId);
+  parentSpanCache.delete(key);
+  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
+    const oldest = parentSpanCache.keys().next().value;
+    if (!oldest) break;
+    parentSpanCache.delete(oldest);
+  }
+}
+function lookupParentSpanService(traceId, parentSpanId, now) {
+  const entry = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
+  if (!entry) return null;
+  if (entry.expiresAt <= now) {
+    parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
+    return null;
+  }
+  return entry.service;
+}
+function resolveServiceId(graph, host) {
+  const direct = serviceId(host);
+  if (graph.hasNode(direct)) return direct;
+  let found = null;
+  graph.forEachNode((id, attrs) => {
+    if (found) return;
+    const a = attrs;
+    if (a.type !== NodeType3.ServiceNode) return;
+    if (a.name === host) {
+      found = id;
+      return;
+    }
+    if (a.aliases && a.aliases.includes(host)) {
+      found = id;
+    }
+  });
+  return found;
+}
+function frontierIdFor(host) {
+  return frontierId(host);
+}
+function ensureServiceNode(graph, serviceName) {
+  const id = serviceId(serviceName);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: NodeType3.ServiceNode,
+    name: serviceName,
+    language: "unknown",
+    discoveredVia: "otel"
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function ensureDatabaseNode(graph, host, engine) {
+  const id = databaseId(host);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: NodeType3.DatabaseNode,
+    name: host,
+    engine,
+    engineVersion: "unknown",
+    compatibleDrivers: [],
+    host,
+    discoveredVia: "otel"
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function ensureFrontierNode(graph, host, ts) {
+  const id = frontierIdFor(host);
+  if (graph.hasNode(id)) {
+    const existing = graph.getNodeAttributes(id);
+    graph.replaceNodeAttributes(id, { ...existing, lastObserved: ts });
+    return id;
+  }
+  const node = {
+    id,
+    type: NodeType3.FrontierNode,
+    name: host,
+    host,
+    firstObserved: ts,
+    lastObserved: ts
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function upsertFrontierEdge(graph, type, source, target, ts) {
+  const id = frontierEdgeId(source, target, type);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const updated = {
+      ...existing,
+      provenance: Provenance3.FRONTIER,
+      lastObserved: ts,
+      callCount: (existing.callCount ?? 0) + 1
+    };
+    graph.replaceEdgeAttributes(id, updated);
+    return;
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: Provenance3.FRONTIER,
+    confidence: 1,
+    lastObserved: ts,
+    callCount: 1
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+}
+function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
+  if (!graph.hasNode(source) || !graph.hasNode(target)) return null;
+  const id = makeObservedEdgeId(type, source, target);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const newSpanCount = (existing.signal?.spanCount ?? existing.callCount ?? 0) + 1;
+    const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
+    const updated = {
+      ...existing,
+      provenance: Provenance3.OBSERVED,
+      lastObserved: ts,
+      callCount: newSpanCount,
+      signal: {
+        spanCount: newSpanCount,
+        errorCount: newErrorCount,
+        lastObservedAgeMs: 0
+      },
+      confidence: 1
+    };
+    graph.replaceEdgeAttributes(id, updated);
+    return { edge: updated, created: false };
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: Provenance3.OBSERVED,
+    confidence: 1,
+    lastObserved: ts,
+    callCount: 1,
+    signal: {
+      spanCount: 1,
+      errorCount: isError ? 1 : 0,
+      lastObservedAgeMs: 0
+    }
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+  return { edge, created: true };
+}
+function stitchTrace(graph, sourceServiceId, ts) {
+  if (!graph.hasNode(sourceServiceId)) return;
+  const visited = /* @__PURE__ */ new Set([sourceServiceId]);
+  const queue = [{ nodeId: sourceServiceId, depth: 0 }];
+  while (queue.length > 0) {
+    const { nodeId, depth } = queue.shift();
+    if (depth >= STITCH_MAX_DEPTH) continue;
+    const outbound = graph.outboundEdges(nodeId);
+    for (const edgeId of outbound) {
+      const edge = graph.getEdgeAttributes(edgeId);
+      if (edge.provenance !== Provenance3.EXTRACTED) continue;
+      if (graph.hasEdge(observedEdgeId(edge.source, edge.target, edge.type))) continue;
+      upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
+      if (!visited.has(edge.target)) {
+        visited.add(edge.target);
+        queue.push({ nodeId: edge.target, depth: depth + 1 });
+      }
+    }
+  }
+}
+function upsertInferredEdge(graph, type, source, target, ts) {
+  const id = makeInferredEdgeId(type, source, target);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const updated = { ...existing, lastObserved: ts };
+    graph.replaceEdgeAttributes(id, updated);
+    return;
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: Provenance3.INFERRED,
+    confidence: INFERRED_CONFIDENCE,
+    lastObserved: ts
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+}
+async function appendErrorEvent(ctx, ev) {
+  await fs3.mkdir(path3.dirname(ctx.errorsPath), { recursive: true });
+  await fs3.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
+}
+function buildErrorEventForReceiver(span) {
+  if (span.statusCode !== 2) return null;
+  const ts = span.startTimeIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: `${span.traceId}:${span.spanId}`,
+    timestamp: ts,
+    service: span.service,
+    traceId: span.traceId,
+    spanId: span.spanId,
+    errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+    ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+    ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+    affectedNode: serviceId(span.service)
+  };
+}
+function makeErrorSpanWriter(errorsPath) {
+  return async (span) => {
+    const ev = buildErrorEventForReceiver(span);
+    if (!ev) return;
+    await fs3.mkdir(path3.dirname(errorsPath), { recursive: true });
+    await fs3.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
+  };
+}
+async function handleSpan(ctx, span) {
+  const ts = span.startTimeIso ?? nowIso(ctx);
+  const nowMs = ctx.now ? ctx.now() : Date.now();
+  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const isError = span.statusCode === 2;
+  cacheSpanService(span, nowMs);
+  let affectedNode = sourceId;
+  if (span.dbSystem) {
+    const host = pickAddress(span);
+    if (host) {
+      ensureDatabaseNode(ctx.graph, host, span.dbSystem);
+      const targetId = databaseId(host);
+      const result = upsertObservedEdge(
+        ctx.graph,
+        EdgeType2.CONNECTS_TO,
+        sourceId,
+        targetId,
+        ts,
+        isError
+      );
+      if (result) affectedNode = targetId;
+    }
+  } else {
+    const host = pickAddress(span);
+    let resolvedViaAddress = false;
+    if (host && host !== span.service) {
+      const targetId = resolveServiceId(ctx.graph, host);
+      if (targetId && targetId !== sourceId) {
+        upsertObservedEdge(
+          ctx.graph,
+          EdgeType2.CALLS,
+          sourceId,
+          targetId,
+          ts,
+          isError
+        );
+        affectedNode = targetId;
+        resolvedViaAddress = true;
+      } else if (!targetId) {
+        const frontierId2 = ensureFrontierNode(ctx.graph, host, ts);
+        if (ctx.graph.hasNode(sourceId)) {
+          upsertFrontierEdge(ctx.graph, EdgeType2.CALLS, sourceId, frontierId2, ts);
+        }
+        affectedNode = frontierId2;
+        resolvedViaAddress = true;
+      }
+    }
+    if (!resolvedViaAddress && span.parentSpanId) {
+      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
+      if (parentService && parentService !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parentService);
+        upsertObservedEdge(
+          ctx.graph,
+          EdgeType2.CALLS,
+          parentId,
+          sourceId,
+          ts,
+          isError
+        );
+      }
+    }
+  }
+  if (span.statusCode === 2) {
+    stitchTrace(ctx.graph, sourceId, ts);
+    if (ctx.writeErrorEventInline !== false) {
+      const ev = {
+        id: `${span.traceId}:${span.spanId}`,
+        timestamp: ts,
+        service: span.service,
+        traceId: span.traceId,
+        spanId: span.spanId,
+        errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+        ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+        ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+        affectedNode
+      };
+      await appendErrorEvent(ctx, ev);
+    }
+  }
+  void affectedNode;
+  if (ctx.onPolicyTrigger) await ctx.onPolicyTrigger(ctx.graph);
+}
+function promoteFrontierNodes(graph, opts = {}) {
+  const aliasIndex = /* @__PURE__ */ new Map();
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType3.ServiceNode) return;
+    aliasIndex.set(a.name, id);
+    if (a.aliases) {
+      for (const alias of a.aliases) aliasIndex.set(alias, id);
+    }
+  });
+  const toPromote = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType3.FrontierNode) return;
+    const target = aliasIndex.get(a.host);
+    if (!target) return;
+    if (target === id) return;
+    toPromote.push({ frontierId: id, serviceId: target });
+  });
+  let promoted = 0;
+  for (const { frontierId: frontierId2, serviceId: serviceId3 } of toPromote) {
+    if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
+      const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
+      if (!gate.allowed) {
+        continue;
+      }
+    }
+    rewireFrontierEdges(graph, frontierId2, serviceId3);
+    graph.dropNode(frontierId2);
+    promoted++;
+  }
+  return promoted;
+}
+function rewireFrontierEdges(graph, frontierId2, serviceId3) {
+  const inbound = [...graph.inboundEdges(frontierId2)];
+  const outbound = [...graph.outboundEdges(frontierId2)];
+  for (const edgeId of inbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId3, edgeId);
+  }
+  for (const edgeId of outbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, serviceId3, edge.target, edgeId);
+  }
+}
+function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
+  graph.dropEdge(oldEdgeId);
+  const promotedProvenance = edge.provenance === Provenance3.FRONTIER ? Provenance3.OBSERVED : edge.provenance;
+  const newId = promotedProvenance === Provenance3.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : promotedProvenance === Provenance3.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : promotedProvenance === Provenance3.EXTRACTED ? extractedEdgeId(newSource, newTarget, edge.type) : frontierEdgeId(newSource, newTarget, edge.type);
+  if (graph.hasEdge(newId)) {
+    const existing = graph.getEdgeAttributes(newId);
+    const merged = {
+      ...existing,
+      callCount: (existing.callCount ?? 0) + (edge.callCount ?? 0),
+      lastObserved: pickLater(existing.lastObserved, edge.lastObserved)
+    };
+    graph.replaceEdgeAttributes(newId, merged);
+    return;
+  }
+  const rebuilt = {
+    ...edge,
+    id: newId,
+    source: newSource,
+    target: newTarget,
+    provenance: promotedProvenance
+  };
+  graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
+}
+function pickLater(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return new Date(a).getTime() >= new Date(b).getTime() ? a : b;
+}
+function makeSpanHandler(ctx) {
+  return (span) => handleSpan(ctx, span);
+}
+async function markStaleEdges(graph, options = {}) {
+  const thresholds = options.thresholds ?? loadStaleThresholdsFromEnv();
+  const now = options.now ?? Date.now();
+  const events = [];
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    if (e.provenance !== Provenance3.OBSERVED) return;
+    if (!e.lastObserved) return;
+    const threshold = thresholdForEdgeType(e.type, thresholds);
+    const age = now - new Date(e.lastObserved).getTime();
+    if (age > threshold) {
+      const updated = { ...e, provenance: Provenance3.STALE, confidence: 0.3 };
+      graph.replaceEdgeAttributes(id, updated);
+      events.push({
+        edgeId: id,
+        source: e.source,
+        target: e.target,
+        edgeType: e.type,
+        thresholdMs: threshold,
+        ageMs: age,
+        lastObserved: e.lastObserved,
+        transitionedAt: new Date(now).toISOString()
+      });
+    }
+  });
+  if (options.staleEventsPath && events.length > 0) {
+    await appendStaleEvents(options.staleEventsPath, events);
+  }
+  return { count: events.length, events };
+}
+async function appendStaleEvents(staleEventsPath, events) {
+  await fs3.mkdir(path3.dirname(staleEventsPath), { recursive: true });
+  const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
+  await fs3.appendFile(staleEventsPath, lines, "utf8");
+}
+async function readStaleEvents(staleEventsPath) {
+  try {
+    const raw = await fs3.readFile(staleEventsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+function startStalenessLoop(graph, options = {}) {
+  let stopped = false;
+  const intervalMs = options.intervalMs ?? 6e4;
+  const tick = () => {
+    if (stopped) return;
+    void (async () => {
+      try {
+        await markStaleEdges(graph, {
+          thresholds: options.thresholds,
+          staleEventsPath: options.staleEventsPath
+        });
+        if (options.onPolicyTrigger) await options.onPolicyTrigger(graph);
+      } catch (err) {
+        console.error("staleness tick failed", err);
+      }
+    })();
+  };
+  const interval = setInterval(tick, intervalMs);
+  if (typeof interval.unref === "function") interval.unref();
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+  };
+}
+async function readErrorEvents(errorsPath) {
+  try {
+    const raw = await fs3.readFile(errorsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+
+// src/extract/services.ts
+import { promises as fs6 } from "fs";
+import path6 from "path";
+import ignore from "ignore";
+import { minimatch } from "minimatch";
+import { NodeType as NodeType4, serviceId as serviceId2 } from "@neat.is/types";
+
+// src/extract/shared.ts
+import { promises as fs4 } from "fs";
+import path4 from "path";
+import { parse as parseYaml } from "yaml";
+import { extractedEdgeId as extractedEdgeId2 } from "@neat.is/types";
+var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py"]);
+var CONFIG_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".yaml", ".yml"]);
+var IGNORED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".turbo",
+  "dist",
+  "build",
+  ".next"
+]);
+function isConfigFile(name) {
+  const ext = path4.extname(name);
+  if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
+  if (name === ".env" || name.startsWith(".env.")) return { match: true, fileType: "env" };
+  return { match: false, fileType: "" };
+}
+function cleanVersion(raw) {
+  if (!raw) return void 0;
+  return raw.replace(/^[\^~><=v\s]+/, "").trim() || void 0;
+}
+async function readJson(filePath) {
+  const raw = await fs4.readFile(filePath, "utf8");
+  return JSON.parse(raw);
+}
+async function readYaml(filePath) {
+  const raw = await fs4.readFile(filePath, "utf8");
+  return parseYaml(raw);
+}
+async function exists(p) {
+  try {
+    await fs4.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/extract/python.ts
+import { promises as fs5 } from "fs";
+import path5 from "path";
+import { parse as parseToml } from "smol-toml";
+var REQUIREMENT_LINE = /^\s*([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?\s*(?:(==)\s*([A-Za-z0-9_.+-]+))?/;
+function parseRequirementsTxt(content) {
+  const out = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.split("#")[0]?.trim();
+    if (!line) continue;
+    if (line.startsWith("-")) continue;
+    const match = REQUIREMENT_LINE.exec(line);
+    if (!match) continue;
+    const name = match[1].toLowerCase();
+    const version = match[3] ?? "";
+    out[name] = version;
+  }
+  return out;
+}
+function depsFromPyProject(pyproject) {
+  const out = {};
+  for (const entry of pyproject.project?.dependencies ?? []) {
+    const match = REQUIREMENT_LINE.exec(entry);
+    if (!match) continue;
+    out[match[1].toLowerCase()] = match[3] ?? "";
+  }
+  const poetryDeps = pyproject.tool?.poetry?.dependencies ?? {};
+  for (const [name, value] of Object.entries(poetryDeps)) {
+    if (name.toLowerCase() === "python") continue;
+    const raw = typeof value === "string" ? value : value?.version ?? "";
+    out[name.toLowerCase()] = raw.replace(/^[\^~><=v\s]+/, "");
+  }
+  return out;
+}
+async function discoverPythonService(serviceDir) {
+  const pyprojectPath = path5.join(serviceDir, "pyproject.toml");
+  const requirementsPath = path5.join(serviceDir, "requirements.txt");
+  const setupPath = path5.join(serviceDir, "setup.py");
+  const hasPyproject = await exists(pyprojectPath);
+  const hasRequirements = await exists(requirementsPath);
+  const hasSetup = await exists(setupPath);
+  if (!hasPyproject && !hasRequirements && !hasSetup) return null;
+  let name = path5.basename(serviceDir);
+  let version;
+  const dependencies = {};
+  if (hasPyproject) {
+    const raw = await fs5.readFile(pyprojectPath, "utf8");
+    const pyproject = parseToml(raw);
+    name = pyproject.project?.name ?? pyproject.tool?.poetry?.name ?? name;
+    version = pyproject.project?.version ?? pyproject.tool?.poetry?.version ?? void 0;
+    Object.assign(dependencies, depsFromPyProject(pyproject));
+  }
+  if (hasRequirements) {
+    const raw = await fs5.readFile(requirementsPath, "utf8");
+    Object.assign(dependencies, parseRequirementsTxt(raw));
+  }
+  return { name, version, dependencies };
+}
+function pythonToPackage(service) {
+  return {
+    name: service.name,
+    version: service.version,
+    dependencies: service.dependencies
+  };
+}
+
+// src/extract/services.ts
+var DEFAULT_SCAN_DEPTH = 5;
+function parseScanDepth() {
+  const raw = process.env.NEAT_SCAN_DEPTH;
+  if (!raw) return DEFAULT_SCAN_DEPTH;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_SCAN_DEPTH;
+}
+function workspaceGlobs(pkg) {
+  const ws = pkg.workspaces;
+  if (!ws) return null;
+  if (Array.isArray(ws)) return ws.length > 0 ? ws : null;
+  if (Array.isArray(ws.packages)) return ws.packages.length > 0 ? ws.packages : null;
+  return null;
+}
+async function loadGitignore(scanPath) {
+  const gitignorePath = path6.join(scanPath, ".gitignore");
+  if (!await exists(gitignorePath)) return null;
+  const raw = await fs6.readFile(gitignorePath, "utf8");
+  return ignore().add(raw);
+}
+async function walkDirs(start, scanPath, options, visit) {
+  async function recurse(current, depth) {
+    if (depth > options.maxDepth) return;
+    const entries = await fs6.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      const child = path6.join(current, entry.name);
+      if (options.ig) {
+        const rel = path6.relative(scanPath, child).split(path6.sep).join("/");
+        if (rel && options.ig.ignores(rel + "/")) continue;
+      }
+      await visit(child);
+      await recurse(child, depth + 1);
+    }
+  }
+  await recurse(start, 0);
+}
+async function expandWorkspaceGlobs(scanPath, globs) {
+  const found = /* @__PURE__ */ new Set();
+  const scanDepth = parseScanDepth();
+  for (const raw of globs) {
+    const pattern = raw.replace(/^\.\//, "");
+    if (!pattern.includes("*")) {
+      const candidate = path6.join(scanPath, pattern);
+      if (await exists(path6.join(candidate, "package.json"))) found.add(candidate);
+      continue;
+    }
+    const segments = pattern.split("/");
+    const staticSegments = [];
+    for (const seg of segments) {
+      if (seg.includes("*")) break;
+      staticSegments.push(seg);
+    }
+    const start = path6.join(scanPath, ...staticSegments);
+    if (!await exists(start)) continue;
+    const hasDoubleStar = pattern.includes("**");
+    const walkDepth = hasDoubleStar ? scanDepth : Math.max(0, segments.length - staticSegments.length - 1);
+    await walkDirs(start, scanPath, { maxDepth: walkDepth, ig: null }, async (dir) => {
+      const rel = path6.relative(scanPath, dir).split(path6.sep).join("/");
+      if (minimatch(rel, pattern) && await exists(path6.join(dir, "package.json"))) {
+        found.add(dir);
+      }
+    });
+  }
+  return [...found];
+}
+async function discoverNodeService(scanPath, dir) {
+  const pkgPath = path6.join(dir, "package.json");
+  if (!await exists(pkgPath)) return null;
+  const pkg = await readJson(pkgPath);
+  if (!pkg.name) return null;
+  const node = {
+    id: serviceId2(pkg.name),
+    type: NodeType4.ServiceNode,
+    name: pkg.name,
+    language: "javascript",
+    version: pkg.version,
+    dependencies: pkg.dependencies ?? {},
+    repoPath: path6.relative(scanPath, dir),
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+  };
+  return { pkg, dir, node };
+}
+async function discoverPyService(scanPath, dir) {
+  const py = await discoverPythonService(dir);
+  if (!py) return null;
+  const pkg = pythonToPackage(py);
+  const node = {
+    id: serviceId2(py.name),
+    type: NodeType4.ServiceNode,
+    name: py.name,
+    language: "python",
+    version: py.version,
+    dependencies: py.dependencies,
+    repoPath: path6.relative(scanPath, dir)
+  };
+  return { pkg, dir, node };
+}
+async function discoverServices(scanPath) {
+  const rootPkgPath = path6.join(scanPath, "package.json");
+  const rootPkg = await exists(rootPkgPath) ? await readJson(rootPkgPath) : null;
+  const wsGlobs = rootPkg ? workspaceGlobs(rootPkg) : null;
+  const candidateDirs = [];
+  if (wsGlobs) {
+    candidateDirs.push(...await expandWorkspaceGlobs(scanPath, wsGlobs));
+  } else {
+    if (rootPkg && rootPkg.name) candidateDirs.push(scanPath);
+    const ig = await loadGitignore(scanPath);
+    await walkDirs(
+      scanPath,
+      scanPath,
+      { maxDepth: parseScanDepth(), ig },
+      async (dir) => {
+        if (await exists(path6.join(dir, "package.json"))) {
+          candidateDirs.push(dir);
+        } else if (await exists(path6.join(dir, "pyproject.toml")) || await exists(path6.join(dir, "requirements.txt")) || await exists(path6.join(dir, "setup.py"))) {
+          candidateDirs.push(dir);
+        }
+      }
+    );
+  }
+  candidateDirs.sort();
+  const seen = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const dir of candidateDirs) {
+    const service = await discoverNodeService(scanPath, dir) ?? await discoverPyService(scanPath, dir);
+    if (!service) continue;
+    const existingDir = seen.get(service.node.name);
+    if (existingDir !== void 0) {
+      const a = path6.relative(scanPath, existingDir) || ".";
+      const b = path6.relative(scanPath, dir) || ".";
+      console.warn(
+        `[neat] duplicate package name "${service.node.name}" \u2014 keeping ${a}, ignoring ${b}`
+      );
+      continue;
+    }
+    seen.set(service.node.name, dir);
+    out.push(service);
+  }
+  return out;
+}
+function addServiceNodes(graph, services) {
+  let nodesAdded = 0;
+  for (const service of services) {
+    if (!graph.hasNode(service.node.id)) {
+      graph.addNode(service.node.id, { ...service.node, discoveredVia: "static" });
+      nodesAdded++;
+      continue;
+    }
+    const existing = graph.getNodeAttributes(service.node.id);
+    const mergedDiscoveredVia = existing.discoveredVia === "otel" ? "merged" : "static";
+    graph.replaceNodeAttributes(service.node.id, {
+      ...existing,
+      ...service.node,
+      discoveredVia: mergedDiscoveredVia
+    });
+  }
+  return nodesAdded;
+}
+
+// src/extract/aliases.ts
+import path7 from "path";
+import { promises as fs7 } from "fs";
+import { parseAllDocuments } from "yaml";
+import { NodeType as NodeType5 } from "@neat.is/types";
+var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
+  "Service",
+  "Deployment",
+  "StatefulSet",
+  "DaemonSet"
+]);
+function addAliases(graph, serviceId3, candidates) {
+  if (!graph.hasNode(serviceId3)) return;
+  const node = graph.getNodeAttributes(serviceId3);
+  if (node.type !== NodeType5.ServiceNode) return;
+  const set = new Set(node.aliases ?? []);
+  for (const c of candidates) {
+    if (!c) continue;
+    if (c === node.name) continue;
+    set.add(c);
+  }
+  if (set.size === 0) return;
+  const updated = { ...node, aliases: [...set].sort() };
+  graph.replaceNodeAttributes(serviceId3, updated);
+}
+function indexServicesByName(services) {
+  const map = /* @__PURE__ */ new Map();
+  for (const s of services) {
+    map.set(s.node.name, s.node.id);
+    map.set(path7.basename(s.dir), s.node.id);
+  }
+  return map;
+}
+async function collectComposeAliases(graph, scanPath, serviceIndex) {
+  let composePath = null;
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = path7.join(scanPath, name);
+    if (await exists(abs)) {
+      composePath = abs;
+      break;
+    }
+  }
+  if (!composePath) return;
+  const compose = await readYaml(composePath);
+  if (!compose?.services) return;
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const serviceId3 = serviceIndex.get(composeName);
+    if (!serviceId3) continue;
+    const aliases = /* @__PURE__ */ new Set([composeName]);
+    if (svc.container_name) aliases.add(svc.container_name);
+    if (svc.hostname) aliases.add(svc.hostname);
+    addAliases(graph, serviceId3, aliases);
+  }
+}
+var LABEL_KEYS = /* @__PURE__ */ new Set([
+  "service",
+  "service.name",
+  "app",
+  "app.name",
+  "com.docker.compose.service",
+  "org.opencontainers.image.title"
+]);
+function parseDockerfileLabels(content) {
+  const out = [];
+  const lineRegex = /^\s*label\s+(.+)$/i;
+  for (const raw of content.split("\n")) {
+    const m = lineRegex.exec(raw);
+    if (!m) continue;
+    const rest = m[1];
+    const pairRegex = /([\w.-]+)\s*=\s*("([^"]*)"|'([^']*)'|([^\s]+))/g;
+    let pair;
+    while ((pair = pairRegex.exec(rest)) !== null) {
+      const key = pair[1].toLowerCase();
+      if (!LABEL_KEYS.has(key)) continue;
+      const value = pair[3] ?? pair[4] ?? pair[5] ?? "";
+      if (value) out.push(value);
+    }
+  }
+  return out;
+}
+async function collectDockerfileAliases(graph, services) {
+  for (const service of services) {
+    const dockerfilePath = path7.join(service.dir, "Dockerfile");
+    if (!await exists(dockerfilePath)) continue;
+    const content = await fs7.readFile(dockerfilePath, "utf8");
+    const aliases = parseDockerfileLabels(content);
+    if (aliases.length > 0) addAliases(graph, service.node.id, aliases);
+  }
+}
+async function walkYamlFiles(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await fs7.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      out.push(...await walkYamlFiles(path7.join(start, entry.name), depth + 1, max));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path7.extname(entry.name))) {
+      out.push(path7.join(start, entry.name));
+    }
+  }
+  return out;
+}
+function k8sHostnames(name, namespace) {
+  const ns = namespace ?? "default";
+  return [
+    name,
+    `${name}.${ns}`,
+    `${name}.${ns}.svc`,
+    `${name}.${ns}.svc.cluster.local`
+  ];
+}
+function k8sServiceTarget(doc, byName) {
+  const selector = doc.spec?.selector;
+  const selectorApp = selector?.app ?? selector?.matchLabels?.app;
+  if (selectorApp && byName.has(selectorApp)) return byName.get(selectorApp);
+  const labelApp = doc.metadata?.labels?.app;
+  if (labelApp && byName.has(labelApp)) return byName.get(labelApp);
+  const metaName = doc.metadata?.name;
+  if (metaName && byName.has(metaName)) return byName.get(metaName);
+  return null;
+}
+async function collectK8sAliases(graph, scanPath, serviceIndex) {
+  const files = await walkYamlFiles(scanPath);
+  for (const file of files) {
+    const content = await fs7.readFile(file, "utf8");
+    let docs;
+    try {
+      docs = parseAllDocuments(content).map((d) => d.toJSON());
+    } catch {
+      continue;
+    }
+    for (const doc of docs) {
+      if (!doc?.kind || !doc.metadata?.name) continue;
+      if (!K8S_KINDS_WITH_HOSTNAMES.has(doc.kind)) continue;
+      const target = k8sServiceTarget(doc, serviceIndex);
+      if (!target) continue;
+      addAliases(graph, target, k8sHostnames(doc.metadata.name, doc.metadata.namespace));
+    }
+  }
+}
+async function addServiceAliases(graph, scanPath, services) {
+  const byName = indexServicesByName(services);
+  await collectComposeAliases(graph, scanPath, byName);
+  await collectDockerfileAliases(graph, services);
+  await collectK8sAliases(graph, scanPath, byName);
+}
+
+// src/extract/databases/index.ts
+import path15 from "path";
+import { EdgeType as EdgeType3, NodeType as NodeType6, Provenance as Provenance4, databaseId as databaseId2 } from "@neat.is/types";
+
+// src/extract/databases/db-config-yaml.ts
+import path8 from "path";
+async function parse(serviceDir) {
+  const yamlPath = path8.join(serviceDir, "db-config.yaml");
+  if (!await exists(yamlPath)) return [];
+  const raw = await readYaml(yamlPath);
+  return [
+    {
+      host: raw.host,
+      port: raw.port,
+      database: raw.database,
+      engine: raw.engine,
+      engineVersion: raw.engineVersion !== void 0 ? String(raw.engineVersion) : "unknown",
+      sourceFile: yamlPath
+    }
+  ];
+}
+var dbConfigYamlParser = { name: "db-config.yaml", parse };
+
+// src/extract/databases/dotenv.ts
+import { promises as fs9 } from "fs";
+import path10 from "path";
+
+// src/extract/databases/shared.ts
+import { promises as fs8 } from "fs";
+import path9 from "path";
+function schemeToEngine(scheme) {
+  const s = scheme.toLowerCase().split("+")[0];
+  switch (s) {
+    case "postgres":
+    case "postgresql":
+      return "postgresql";
+    case "mysql":
+    case "mariadb":
+      return "mysql";
+    case "mongodb":
+    case "mongodb+srv":
+      return "mongodb";
+    case "redis":
+    case "rediss":
+      return "redis";
+    case "sqlite":
+      return "sqlite";
+    default:
+      return null;
+  }
+}
+function parseConnectionString(url) {
+  const m = url.match(
+    /^(?<scheme>[a-z][a-z+]*):\/\/(?:[^@/]+(?::[^@]*)?@)?(?<host>[^:/?]+)(?::(?<port>\d+))?(?:\/(?<db>[^?#]*))?/i
+  );
+  if (!m || !m.groups) return null;
+  const engine = schemeToEngine(m.groups.scheme);
+  if (!engine) return null;
+  return {
+    host: m.groups.host,
+    port: m.groups.port ? Number(m.groups.port) : void 0,
+    database: m.groups.db ?? "",
+    engine,
+    engineVersion: "unknown"
+  };
+}
+async function readIfExists(filePath) {
+  try {
+    return await fs8.readFile(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function findFirst(serviceDir, candidates) {
+  for (const rel of candidates) {
+    const abs = path9.join(serviceDir, rel);
+    const content = await readIfExists(abs);
+    if (content !== null) return abs;
+  }
+  return null;
+}
+function engineFromImage(image) {
+  const lower = image.toLowerCase();
+  const colon = lower.lastIndexOf(":");
+  const repo = colon >= 0 ? lower.slice(0, colon) : lower;
+  const tag = colon >= 0 ? lower.slice(colon + 1) : "latest";
+  const last = repo.split("/").pop() ?? repo;
+  let engine = null;
+  if (last.startsWith("postgres")) engine = "postgresql";
+  else if (last.startsWith("mysql") || last.startsWith("mariadb")) engine = "mysql";
+  else if (last.startsWith("mongo")) engine = "mongodb";
+  else if (last.startsWith("redis")) engine = "redis";
+  else if (last.startsWith("sqlite")) engine = "sqlite";
+  if (!engine) return null;
+  const versionMatch = tag.match(/^(\d+(?:\.\d+){0,2})/);
+  return {
+    engine,
+    engineVersion: versionMatch ? versionMatch[1] : "unknown"
+  };
+}
+
+// src/extract/databases/dotenv.ts
+var CONNECTION_KEYS = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DB_URL",
+  "POSTGRES_URL",
+  "POSTGRESQL_URL",
+  "MYSQL_URL",
+  "MONGODB_URI",
+  "MONGO_URL",
+  "MONGO_URI",
+  "REDIS_URL"
+]);
+function parseDotenvLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return null;
+  const eq = trimmed.indexOf("=");
+  if (eq < 0) return null;
+  const key = trimmed.slice(0, eq).trim();
+  let value = trimmed.slice(eq + 1).trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return { key, value };
+}
+async function parse2(serviceDir) {
+  const entries = await fs9.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const configs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const match = isConfigFile(entry.name);
+    if (!match.match || match.fileType !== "env") continue;
+    const filePath = path10.join(serviceDir, entry.name);
+    const content = await fs9.readFile(filePath, "utf8");
+    for (const line of content.split("\n")) {
+      const parsed = parseDotenvLine(line);
+      if (!parsed) continue;
+      if (!CONNECTION_KEYS.has(parsed.key.toUpperCase())) continue;
+      const config = parseConnectionString(parsed.value);
+      if (!config) continue;
+      const key = `${config.engine}://${config.host}:${config.port ?? ""}/${config.database}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      configs.push({ ...config, sourceFile: filePath });
+    }
+  }
+  return configs;
+}
+var dotenvParser = { name: ".env", parse: parse2 };
+
+// src/extract/databases/prisma.ts
+import path11 from "path";
+async function parse3(serviceDir) {
+  const schemaPath = path11.join(serviceDir, "prisma", "schema.prisma");
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  const block = content.match(/datasource\s+\w+\s*\{([^}]*)\}/s);
+  if (!block) return [];
+  const body = block[1] ?? "";
+  const providerMatch = body.match(/provider\s*=\s*"([^"]+)"/);
+  if (!providerMatch) return [];
+  const engine = schemeToEngine(providerMatch[1]);
+  if (!engine) return [];
+  const urlMatch = body.match(/url\s*=\s*"([^"]+)"/);
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: schemaPath }];
+  }
+  return [
+    {
+      host: `${engine}-prisma`,
+      database: "",
+      engine,
+      engineVersion: "unknown",
+      sourceFile: schemaPath
+    }
+  ];
+}
+var prismaParser = { name: "prisma", parse: parse3 };
+
+// src/extract/databases/drizzle.ts
+var DIALECT_TO_ENGINE = {
+  postgresql: "postgresql",
+  postgres: "postgresql",
+  pg: "postgresql",
+  mysql: "mysql",
+  mysql2: "mysql",
+  sqlite: "sqlite",
+  "better-sqlite": "sqlite"
+};
+async function parse4(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "drizzle.config.ts",
+    "drizzle.config.js",
+    "drizzle.config.mjs"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const dialectMatch = content.match(/dialect\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (!dialectMatch) return [];
+  const engine = DIALECT_TO_ENGINE[dialectMatch[1].toLowerCase()] ?? schemeToEngine(dialectMatch[1]);
+  if (!engine) return [];
+  const urlMatch = content.match(
+    /(?:url|connectionString)\s*:\s*['"`]([a-z][a-z+]*:\/\/[^'"`]+)['"`]/i
+  );
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
+  const hostMatch = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (hostMatch) {
+    const portMatch = content.match(/port\s*:\s*(\d+)/);
+    const dbMatch = content.match(/database\s*:\s*['"`]([^'"`]+)['"`]/);
+    return [
+      {
+        host: hostMatch[1],
+        port: portMatch ? Number(portMatch[1]) : void 0,
+        database: dbMatch?.[1] ?? "",
+        engine,
+        engineVersion: "unknown",
+        sourceFile: filePath
+      }
+    ];
+  }
+  return [
+    { host: `${engine}-drizzle`, database: "", engine, engineVersion: "unknown", sourceFile: filePath }
+  ];
+}
+var drizzleParser = { name: "drizzle", parse: parse4 };
+
+// src/extract/databases/knex.ts
+var CLIENT_TO_ENGINE = {
+  pg: "postgresql",
+  postgres: "postgresql",
+  postgresql: "postgresql",
+  mysql: "mysql",
+  mysql2: "mysql",
+  sqlite3: "sqlite",
+  "better-sqlite3": "sqlite"
+};
+async function parse5(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "knexfile.js",
+    "knexfile.ts",
+    "knexfile.cjs",
+    "knexfile.mjs"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const clientMatch = content.match(/client\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (!clientMatch) return [];
+  const engine = CLIENT_TO_ENGINE[clientMatch[1].toLowerCase()];
+  if (!engine) return [];
+  const urlMatch = content.match(
+    /connection\s*:\s*['"`]([a-z][a-z+]*:\/\/[^'"`]+)['"`]/i
+  );
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
+  const host = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
+  if (host) {
+    const port = content.match(/port\s*:\s*(\d+)/)?.[1];
+    const database = content.match(/database\s*:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? "";
+    return [
+      {
+        host,
+        port: port ? Number(port) : void 0,
+        database,
+        engine,
+        engineVersion: "unknown",
+        sourceFile: filePath
+      }
+    ];
+  }
+  return [{ host: `${engine}-knex`, database: "", engine, engineVersion: "unknown", sourceFile: filePath }];
+}
+var knexParser = { name: "knex", parse: parse5 };
+
+// src/extract/databases/ormconfig.ts
+import path12 from "path";
+async function parse6(serviceDir) {
+  for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
+    const abs = path12.join(serviceDir, candidate);
+    if (!await exists(abs)) continue;
+    const raw = candidate.endsWith(".json") ? await readJson(abs) : await readYaml(abs);
+    const entries = Array.isArray(raw) ? raw : [raw];
+    const out = [];
+    for (const entry of entries) {
+      if (!entry?.type || !entry.host) continue;
+      const engine = schemeToEngine(entry.type);
+      if (!engine) continue;
+      out.push({
+        host: entry.host,
+        port: entry.port,
+        database: entry.database ?? "",
+        engine,
+        engineVersion: "unknown",
+        sourceFile: abs
+      });
+    }
+    if (out.length > 0) return out;
+  }
+  return [];
+}
+var ormconfigParser = { name: "ormconfig", parse: parse6 };
+
+// src/extract/databases/typeorm.ts
+async function parse7(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "data-source.ts",
+    "data-source.js",
+    "src/data-source.ts",
+    "src/data-source.js"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const block = content.match(/new\s+DataSource\s*\(\s*\{([\s\S]*?)\}\s*\)/);
+  const body = block ? block[1] : content;
+  const typeMatch = body.match(/type\s*:\s*['"`]([^'"`]+)['"`]/);
+  const host = body.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
+  if (!typeMatch || !host) return [];
+  const engine = schemeToEngine(typeMatch[1]);
+  if (!engine) return [];
+  const port = body.match(/port\s*:\s*(\d+)/)?.[1];
+  const database = body.match(/database\s*:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? "";
+  return [
+    {
+      host,
+      port: port ? Number(port) : void 0,
+      database,
+      engine,
+      engineVersion: "unknown",
+      sourceFile: filePath
+    }
+  ];
+}
+var typeormParser = { name: "typeorm", parse: parse7 };
+
+// src/extract/databases/sequelize.ts
+import path13 from "path";
+async function parse8(serviceDir) {
+  const configPath = path13.join(serviceDir, "config", "config.json");
+  if (!await exists(configPath)) return [];
+  const raw = await readJson(configPath);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of Object.values(raw)) {
+    if (!entry?.dialect || !entry.host) continue;
+    const engine = schemeToEngine(entry.dialect);
+    if (!engine) continue;
+    const key = `${engine}://${entry.host}:${entry.port ?? ""}/${entry.database ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      host: entry.host,
+      port: entry.port,
+      database: entry.database ?? "",
+      engine,
+      engineVersion: "unknown",
+      sourceFile: configPath
+    });
+  }
+  return out;
+}
+var sequelizeParser = { name: "sequelize", parse: parse8 };
+
+// src/extract/databases/docker-compose.ts
+import path14 from "path";
+function portFromService(svc) {
+  for (const raw of svc.ports ?? []) {
+    const str = String(raw);
+    const last = str.split(":").pop();
+    const n = Number(last);
+    if (Number.isFinite(n) && n > 0) return n;
+  }
+  return void 0;
+}
+function databaseFromEnv(svc) {
+  const env = svc.environment;
+  const get = (key) => {
+    if (!env) return void 0;
+    if (Array.isArray(env)) {
+      for (const line of env) {
+        const [k, v] = line.split("=");
+        if (k === key) return v;
+      }
+      return void 0;
+    }
+    return env[key];
+  };
+  return get("POSTGRES_DB") ?? get("MYSQL_DATABASE") ?? get("MONGO_INITDB_DATABASE") ?? "";
+}
+async function parse9(serviceDir) {
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = path14.join(serviceDir, name);
+    if (!await exists(abs)) continue;
+    const raw = await readYaml(abs);
+    if (!raw?.services) return [];
+    const out = [];
+    for (const [serviceName, svc] of Object.entries(raw.services)) {
+      if (!svc.image) continue;
+      const meta = engineFromImage(svc.image);
+      if (!meta) continue;
+      out.push({
+        host: serviceName,
+        port: portFromService(svc),
+        database: databaseFromEnv(svc),
+        engine: meta.engine,
+        engineVersion: meta.engineVersion,
+        sourceFile: abs
+      });
+    }
+    return out;
+  }
+  return [];
+}
+var dockerComposeParser = { name: "docker-compose", parse: parse9 };
+
+// src/extract/databases/index.ts
+var DB_PARSERS = [
+  dbConfigYamlParser,
+  dotenvParser,
+  prismaParser,
+  drizzleParser,
+  knexParser,
+  ormconfigParser,
+  typeormParser,
+  sequelizeParser,
+  dockerComposeParser
+];
+function compatibleDriversFor(engine) {
+  return compatPairs().filter((p) => p.engine === engine).map((p) => ({ name: p.driver, minVersion: p.minDriverVersion }));
+}
+function toDatabaseNode(config) {
+  return {
+    id: databaseId2(config.host),
+    type: NodeType6.DatabaseNode,
+    name: config.database || config.host,
+    engine: config.engine,
+    engineVersion: config.engineVersion,
+    compatibleDrivers: compatibleDriversFor(config.engine),
+    host: config.host,
+    port: config.port
+  };
+}
+function attachIncompatibilities(service, configs) {
+  const deps = { ...service.pkg.dependencies ?? {}, ...service.pkg.devDependencies ?? {} };
+  const incompatibilities = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const config of configs) {
+    for (const pair of compatPairs()) {
+      if (pair.engine !== config.engine) continue;
+      const declaredVersion = cleanVersion(deps[pair.driver]);
+      if (!declaredVersion) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declaredVersion,
+        config.engine,
+        config.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        const key = `driver-engine|${pair.driver}@${declaredVersion}|${config.engine}@${config.engineVersion}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        incompatibilities.push({
+          kind: "driver-engine",
+          driver: pair.driver,
+          driverVersion: declaredVersion,
+          engine: config.engine,
+          engineVersion: config.engineVersion,
+          reason: result.reason
+        });
+      }
+    }
+  }
+  const serviceNodeEngine = service.node.nodeEngine ?? service.pkg.engines?.node;
+  for (const constraint of nodeEngineConstraints()) {
+    const declared = cleanVersion(deps[constraint.package]);
+    if (!declared) continue;
+    const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+    if (!result.compatible && result.reason) {
+      const key = `node-engine|${constraint.package}@${declared}|${serviceNodeEngine ?? ""}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "node-engine",
+        package: constraint.package,
+        packageVersion: declared,
+        requiredNodeVersion: result.requiredNodeVersion ?? constraint.minNodeVersion,
+        ...serviceNodeEngine ? { declaredNodeEngine: serviceNodeEngine } : {},
+        reason: result.reason
+      });
+    }
+  }
+  for (const conflict of packageConflicts()) {
+    const declared = cleanVersion(deps[conflict.package]);
+    if (!declared) continue;
+    const requiredVersion = cleanVersion(deps[conflict.requires.name]);
+    const result = checkPackageConflict(conflict, declared, requiredVersion);
+    if (!result.compatible && result.reason) {
+      const key = `package-conflict|${conflict.package}@${declared}|${conflict.requires.name}@${requiredVersion ?? "missing"}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "package-conflict",
+        package: conflict.package,
+        packageVersion: declared,
+        requires: conflict.requires,
+        ...requiredVersion ? { foundVersion: requiredVersion } : {},
+        reason: result.reason
+      });
+    }
+  }
+  for (const rule of deprecatedApis()) {
+    const declared = cleanVersion(deps[rule.package]);
+    if (declared === void 0) continue;
+    const result = checkDeprecatedApi(rule, declared);
+    if (!result.compatible && result.reason) {
+      const key = `deprecated-api|${rule.package}@${declared}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "deprecated-api",
+        package: rule.package,
+        packageVersion: declared,
+        reason: result.reason
+      });
+    }
+  }
+  if (incompatibilities.length > 0) service.node.incompatibilities = incompatibilities;
+}
+async function addDatabasesAndCompat(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const merged = /* @__PURE__ */ new Map();
+    for (const parser of DB_PARSERS) {
+      let configs;
+      try {
+        configs = await parser.parse(service.dir);
+      } catch (err) {
+        console.warn(
+          `[neat] ${parser.name} parser failed on ${service.node.name}: ${err.message}`
+        );
+        continue;
+      }
+      for (const config of configs) {
+        if (!config.host) continue;
+        if (!merged.has(config.host)) merged.set(config.host, config);
+      }
+    }
+    const allConfigs = [...merged.values()];
+    for (const config of allConfigs) {
+      const dbNode = toDatabaseNode(config);
+      if (!graph.hasNode(dbNode.id)) {
+        graph.addNode(dbNode.id, { ...dbNode, discoveredVia: "static" });
+        nodesAdded++;
+      } else {
+        const existing = graph.getNodeAttributes(dbNode.id);
+        const mergedDiscoveredVia = existing.discoveredVia === "otel" ? "merged" : "static";
+        graph.replaceNodeAttributes(dbNode.id, {
+          ...existing,
+          ...dbNode,
+          discoveredVia: mergedDiscoveredVia
+        });
+      }
+      const edge = {
+        id: extractedEdgeId2(service.node.id, dbNode.id, EdgeType3.CONNECTS_TO),
+        source: service.node.id,
+        target: dbNode.id,
+        type: EdgeType3.CONNECTS_TO,
+        provenance: Provenance4.EXTRACTED,
+        ...config.sourceFile ? {
+          evidence: {
+            file: path15.relative(scanPath, config.sourceFile).split(path15.sep).join("/")
+          }
+        } : {}
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+    attachIncompatibilities(service, allConfigs);
+    if (graph.hasNode(service.node.id)) {
+      const current = graph.getNodeAttributes(service.node.id);
+      const updated = {
+        ...current,
+        ...service.node,
+        ...current.aliases ? { aliases: current.aliases } : {}
+      };
+      if (!service.node.incompatibilities || service.node.incompatibilities.length === 0) {
+        delete updated.incompatibilities;
+      }
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/configs.ts
+import { promises as fs10 } from "fs";
+import path16 from "path";
+import { EdgeType as EdgeType4, NodeType as NodeType7, Provenance as Provenance5, configId } from "@neat.is/types";
+async function walkConfigFiles(dir) {
+  const out = [];
+  async function walk(current) {
+    const entries = await fs10.readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path16.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry.name)) await walk(full);
+      } else if (entry.isFile() && isConfigFile(entry.name).match) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function addConfigNodes(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const configFiles = await walkConfigFiles(service.dir);
+    for (const file of configFiles) {
+      const relPath = path16.relative(scanPath, file);
+      const node = {
+        id: configId(relPath),
+        type: NodeType7.ConfigNode,
+        name: path16.basename(file),
+        path: relPath,
+        fileType: isConfigFile(path16.basename(file)).fileType
+      };
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+      const edge = {
+        id: extractedEdgeId2(service.node.id, node.id, EdgeType4.CONFIGURED_BY),
+        source: service.node.id,
+        target: node.id,
+        type: EdgeType4.CONFIGURED_BY,
+        provenance: Provenance5.EXTRACTED,
+        evidence: { file: relPath.split(path16.sep).join("/") }
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/calls/index.ts
+import { EdgeType as EdgeType6, NodeType as NodeType8, Provenance as Provenance7 } from "@neat.is/types";
+
+// src/extract/calls/http.ts
+import path18 from "path";
+import Parser from "tree-sitter";
+import JavaScript from "tree-sitter-javascript";
+import Python from "tree-sitter-python";
+import { EdgeType as EdgeType5, Provenance as Provenance6 } from "@neat.is/types";
+
+// src/extract/calls/shared.ts
+import { promises as fs11 } from "fs";
+import path17 from "path";
+async function walkSourceFiles(dir) {
+  const out = [];
+  async function walk(current) {
+    const entries = await fs11.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      const full = path17.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry.name)) await walk(full);
+      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path17.extname(entry.name))) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function loadSourceFiles(dir) {
+  const paths = await walkSourceFiles(dir);
+  const out = [];
+  for (const p of paths) {
+    try {
+      const content = await fs11.readFile(p, "utf8");
+      out.push({ path: p, content });
+    } catch {
+    }
+  }
+  return out;
+}
+function lineOf(text, needle) {
+  const idx = text.indexOf(needle);
+  if (idx < 0) return 1;
+  return text.slice(0, idx).split("\n").length;
+}
+function snippet(text, line) {
+  const lines = text.split("\n");
+  return (lines[line - 1] ?? "").trim();
+}
+
+// src/extract/calls/http.ts
+var STRING_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set(["string_fragment", "string_content"]);
+function collectStringLiterals(node, out) {
+  if (STRING_LITERAL_NODE_TYPES.has(node.type)) out.push(node.text);
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child) collectStringLiterals(child, out);
+  }
+}
+function callsFromSource(source, parser, knownHosts) {
+  const tree = parser.parse(source);
+  const literals = [];
+  collectStringLiterals(tree.rootNode, literals);
+  const targets = /* @__PURE__ */ new Set();
+  for (const lit of literals) {
+    for (const host of knownHosts) {
+      if (lit.includes(`//${host}`) || lit.includes(`//${host}:`)) {
+        targets.add(host);
+      }
+    }
+  }
+  return targets;
+}
+function makeJsParser() {
+  const p = new Parser();
+  p.setLanguage(JavaScript);
+  return p;
+}
+function makePyParser() {
+  const p = new Parser();
+  p.setLanguage(Python);
+  return p;
+}
+async function addHttpCallEdges(graph, services) {
+  const jsParser = makeJsParser();
+  const pyParser = makePyParser();
+  const knownHosts = /* @__PURE__ */ new Set();
+  const hostToNodeId = /* @__PURE__ */ new Map();
+  for (const service of services) {
+    knownHosts.add(path18.basename(service.dir));
+    knownHosts.add(service.pkg.name);
+    hostToNodeId.set(path18.basename(service.dir), service.node.id);
+    hostToNodeId.set(service.pkg.name, service.node.id);
+  }
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const seenTargets = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const parser = path18.extname(file.path) === ".py" ? pyParser : jsParser;
+      const targets = callsFromSource(file.content, parser, knownHosts);
+      for (const t of targets) {
+        const targetId = hostToNodeId.get(t);
+        if (!targetId || targetId === service.node.id) continue;
+        if (!seenTargets.has(targetId)) {
+          seenTargets.set(targetId, { file: file.path, host: t });
+        }
+      }
+    }
+    for (const [targetId, evidenceFile] of seenTargets) {
+      const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
+      const line = lineOf(fileContent, `//${evidenceFile.host}`);
+      const edge = {
+        id: extractedEdgeId2(service.node.id, targetId, EdgeType5.CALLS),
+        source: service.node.id,
+        target: targetId,
+        type: EdgeType5.CALLS,
+        provenance: Provenance6.EXTRACTED,
+        evidence: {
+          file: path18.relative(service.dir, evidenceFile.file),
+          line,
+          snippet: snippet(fileContent, line)
+        }
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return edgesAdded;
+}
+
+// src/extract/calls/kafka.ts
+import path19 from "path";
+import { infraId } from "@neat.is/types";
+var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
+var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
+function findAll(re, text) {
+  re.lastIndex = 0;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ topic: m[1], index: m.index });
+  }
+  return out;
+}
+function kafkaEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const make = (topic, edgeType) => {
+    const key = `${edgeType}|${topic}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    const line = lineOf(file.content, topic);
+    out.push({
+      infraId: infraId("kafka-topic", topic),
+      name: topic,
+      kind: "kafka-topic",
+      edgeType,
+      evidence: {
+        file: path19.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  for (const { topic } of findAll(PRODUCER_TOPIC_RE, file.content)) make(topic, "PUBLISHES_TO");
+  for (const { topic } of findAll(CONSUMER_TOPIC_RE, file.content)) make(topic, "CONSUMES_FROM");
+  return out;
+}
+
+// src/extract/calls/redis.ts
+import path20 from "path";
+import { infraId as infraId2 } from "@neat.is/types";
+var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
+function redisEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  REDIS_URL_RE.lastIndex = 0;
+  let m;
+  while ((m = REDIS_URL_RE.exec(file.content)) !== null) {
+    const host = m[1];
+    if (seen.has(host)) continue;
+    seen.add(host);
+    const line = lineOf(file.content, host);
+    out.push({
+      infraId: infraId2("redis", host),
+      name: host,
+      kind: "redis",
+      edgeType: "CALLS",
+      evidence: {
+        file: path20.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
+// src/extract/calls/aws.ts
+import path21 from "path";
+import { infraId as infraId3 } from "@neat.is/types";
+var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
+var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
+function hasMarker(text, markers) {
+  return markers.some((m) => text.includes(m));
+}
+function findAll2(re, text) {
+  re.lastIndex = 0;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ name: m[1], index: m.index });
+  }
+  return out;
+}
+function awsEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const make = (kind, name) => {
+    const key = `${kind}|${name}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    const line = lineOf(file.content, name);
+    out.push({
+      infraId: infraId3(kind, name),
+      name,
+      kind,
+      edgeType: "CALLS",
+      evidence: {
+        file: path21.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  if (hasMarker(file.content, ["S3Client", "PutObjectCommand", "GetObjectCommand", "DeleteObjectCommand"])) {
+    for (const { name } of findAll2(S3_BUCKET_RE, file.content)) make("s3-bucket", name);
+  }
+  if (hasMarker(file.content, [
+    "DynamoDBClient",
+    "DynamoDBDocumentClient",
+    "GetCommand",
+    "PutCommand",
+    "QueryCommand",
+    "UpdateCommand",
+    "DeleteCommand"
+  ])) {
+    for (const { name } of findAll2(DYNAMO_TABLE_RE, file.content)) make("dynamodb-table", name);
+  }
+  return out;
+}
+
+// src/extract/calls/grpc.ts
+import path22 from "path";
+import { infraId as infraId4 } from "@neat.is/types";
+var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
+function isLikelyAddress(value) {
+  if (!value) return false;
+  return /:\d{2,5}$/.test(value) || value.includes(".");
+}
+function grpcEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  GRPC_CLIENT_RE.lastIndex = 0;
+  let m;
+  while ((m = GRPC_CLIENT_RE.exec(file.content)) !== null) {
+    const symbol = m[1];
+    const addr = m[2]?.trim();
+    const name = isLikelyAddress(addr) ? addr : symbol;
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const line = lineOf(file.content, m[0]);
+    out.push({
+      infraId: infraId4("grpc-service", name),
+      name,
+      kind: "grpc-service",
+      edgeType: "CALLS",
+      evidence: {
+        file: path22.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
+// src/extract/calls/index.ts
+function edgeTypeFromEndpoint(ep) {
+  switch (ep.edgeType) {
+    case "PUBLISHES_TO":
+      return EdgeType6.PUBLISHES_TO;
+    case "CONSUMES_FROM":
+      return EdgeType6.CONSUMES_FROM;
+    default:
+      return EdgeType6.CALLS;
+  }
+}
+async function addExternalEndpointEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const endpoints = [];
+    for (const file of files) {
+      endpoints.push(...kafkaEndpointsFromFile(file, service.dir));
+      endpoints.push(...redisEndpointsFromFile(file, service.dir));
+      endpoints.push(...awsEndpointsFromFile(file, service.dir));
+      endpoints.push(...grpcEndpointsFromFile(file, service.dir));
+    }
+    if (endpoints.length === 0) continue;
+    const seenEdges = /* @__PURE__ */ new Set();
+    for (const ep of endpoints) {
+      if (!graph.hasNode(ep.infraId)) {
+        const node = {
+          id: ep.infraId,
+          type: NodeType8.InfraNode,
+          name: ep.name,
+          provider: ep.kind.startsWith("s3") || ep.kind.startsWith("dynamodb") ? "aws" : "self",
+          kind: ep.kind
+        };
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+      const edgeType = edgeTypeFromEndpoint(ep);
+      const edgeId = extractedEdgeId2(service.node.id, ep.infraId, edgeType);
+      if (seenEdges.has(edgeId)) continue;
+      seenEdges.add(edgeId);
+      if (!graph.hasEdge(edgeId)) {
+        const edge = {
+          id: edgeId,
+          source: service.node.id,
+          target: ep.infraId,
+          type: edgeType,
+          provenance: Provenance7.EXTRACTED,
+          evidence: ep.evidence
+        };
+        graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+async function addCallEdges(graph, services) {
+  const httpEdges = await addHttpCallEdges(graph, services);
+  const ext = await addExternalEndpointEdges(graph, services);
+  return {
+    nodesAdded: ext.nodesAdded,
+    edgesAdded: httpEdges + ext.edgesAdded
+  };
+}
+
+// src/extract/infra/docker-compose.ts
+import path23 from "path";
+import { EdgeType as EdgeType7, Provenance as Provenance8 } from "@neat.is/types";
+
+// src/extract/infra/shared.ts
+import { NodeType as NodeType9, infraId as infraId5 } from "@neat.is/types";
+function makeInfraNode(kind, name, provider = "self", extras) {
+  return {
+    id: infraId5(kind, name),
+    type: NodeType9.InfraNode,
+    name,
+    provider,
+    kind,
+    ...extras?.region ? { region: extras.region } : {}
+  };
+}
+function classifyImage(image) {
+  const lower = image.toLowerCase();
+  const repo = lower.split(":")[0];
+  const last = repo.split("/").pop() ?? repo;
+  if (last.startsWith("postgres")) return "postgres";
+  if (last.startsWith("mysql") || last.startsWith("mariadb")) return "mysql";
+  if (last.startsWith("mongo")) return "mongodb";
+  if (last.startsWith("redis")) return "redis";
+  if (last.startsWith("rabbitmq")) return "rabbitmq";
+  if (last.startsWith("kafka") || last.includes("kafka")) return "kafka";
+  if (last.startsWith("memcached")) return "memcached";
+  return "container";
+}
+
+// src/extract/infra/docker-compose.ts
+function dependsOnList(value) {
+  if (!value) return [];
+  if (Array.isArray(value)) return value;
+  return Object.keys(value);
+}
+function serviceNameToServiceNode(name, services) {
+  for (const s of services) {
+    if (s.node.name === name || path23.basename(s.dir) === name) return s.node.id;
+  }
+  return null;
+}
+async function addComposeInfra(graph, scanPath, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  let composePath = null;
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = path23.join(scanPath, name);
+    if (await exists(abs)) {
+      composePath = abs;
+      break;
+    }
+  }
+  if (!composePath) return { nodesAdded, edgesAdded };
+  const compose = await readYaml(composePath);
+  if (!compose?.services) return { nodesAdded, edgesAdded };
+  const evidenceFile = path23.relative(scanPath, composePath).split(path23.sep).join("/");
+  const composeNameToNodeId = /* @__PURE__ */ new Map();
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const matchedServiceId = serviceNameToServiceNode(composeName, services);
+    if (matchedServiceId) {
+      composeNameToNodeId.set(composeName, matchedServiceId);
+      continue;
+    }
+    const kind = svc.image ? classifyImage(svc.image) : "container";
+    const node = makeInfraNode(kind, composeName);
+    if (!graph.hasNode(node.id)) {
+      graph.addNode(node.id, node);
+      nodesAdded++;
+    }
+    composeNameToNodeId.set(composeName, node.id);
+  }
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const sourceId = composeNameToNodeId.get(composeName);
+    if (!sourceId) continue;
+    for (const dep of dependsOnList(svc.depends_on)) {
+      const targetId = composeNameToNodeId.get(dep);
+      if (!targetId) continue;
+      const edgeId = extractedEdgeId2(sourceId, targetId, EdgeType7.DEPENDS_ON);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: sourceId,
+        target: targetId,
+        type: EdgeType7.DEPENDS_ON,
+        provenance: Provenance8.EXTRACTED,
+        evidence: { file: evidenceFile }
+      };
+      graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/dockerfile.ts
+import path24 from "path";
+import { promises as fs12 } from "fs";
+import { EdgeType as EdgeType8, Provenance as Provenance9 } from "@neat.is/types";
+function runtimeImage(content) {
+  const lines = content.split("\n");
+  let last = null;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (!/^from\s+/i.test(line)) continue;
+    const tokens = line.split(/\s+/);
+    const image = tokens[1];
+    if (!image || image.toLowerCase() === "scratch") continue;
+    last = image;
+  }
+  return last;
+}
+async function addDockerfileRuntimes(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const dockerfilePath = path24.join(service.dir, "Dockerfile");
+    if (!await exists(dockerfilePath)) continue;
+    const content = await fs12.readFile(dockerfilePath, "utf8");
+    const image = runtimeImage(content);
+    if (!image) continue;
+    const node = makeInfraNode("container-image", image);
+    if (!graph.hasNode(node.id)) {
+      graph.addNode(node.id, node);
+      nodesAdded++;
+    }
+    const edgeId = extractedEdgeId2(service.node.id, node.id, EdgeType8.RUNS_ON);
+    if (!graph.hasEdge(edgeId)) {
+      const edge = {
+        id: edgeId,
+        source: service.node.id,
+        target: node.id,
+        type: EdgeType8.RUNS_ON,
+        provenance: Provenance9.EXTRACTED,
+        evidence: {
+          file: path24.relative(scanPath, dockerfilePath).split(path24.sep).join("/")
+        }
+      };
+      graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/terraform.ts
+import { promises as fs13 } from "fs";
+import path25 from "path";
+var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+async function walkTfFiles(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await fs13.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
+      out.push(...await walkTfFiles(path25.join(start, entry.name), depth + 1, max));
+    } else if (entry.isFile() && entry.name.endsWith(".tf")) {
+      out.push(path25.join(start, entry.name));
+    }
+  }
+  return out;
+}
+async function addTerraformResources(graph, scanPath) {
+  let nodesAdded = 0;
+  const files = await walkTfFiles(scanPath);
+  for (const file of files) {
+    const content = await fs13.readFile(file, "utf8");
+    RESOURCE_RE.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_RE.exec(content)) !== null) {
+      const kind = m[1];
+      const name = m[2];
+      const node = makeInfraNode(kind, name, "aws");
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded: 0 };
+}
+
+// src/extract/infra/k8s.ts
+import { promises as fs14 } from "fs";
+import path26 from "path";
+import { parseAllDocuments as parseAllDocuments2 } from "yaml";
+var K8S_KIND_TO_INFRA_KIND = {
+  Service: "k8s-service",
+  Deployment: "k8s-deployment",
+  StatefulSet: "k8s-statefulset",
+  DaemonSet: "k8s-daemonset",
+  CronJob: "k8s-cronjob",
+  Job: "k8s-job",
+  Ingress: "k8s-ingress"
+};
+async function walkYamlFiles2(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await fs14.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      out.push(...await walkYamlFiles2(path26.join(start, entry.name), depth + 1, max));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path26.extname(entry.name))) {
+      out.push(path26.join(start, entry.name));
+    }
+  }
+  return out;
+}
+async function addK8sResources(graph, scanPath) {
+  let nodesAdded = 0;
+  const files = await walkYamlFiles2(scanPath);
+  for (const file of files) {
+    const content = await fs14.readFile(file, "utf8");
+    let docs;
+    try {
+      docs = parseAllDocuments2(content).map((d) => d.toJSON());
+    } catch {
+      continue;
+    }
+    for (const doc of docs) {
+      if (!doc?.kind || !doc.metadata?.name) continue;
+      const infraKind = K8S_KIND_TO_INFRA_KIND[doc.kind];
+      if (!infraKind) continue;
+      const namespaced = doc.metadata.namespace ? `${doc.metadata.namespace}/${doc.metadata.name}` : doc.metadata.name;
+      const node = makeInfraNode(infraKind, namespaced, "kubernetes");
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded: 0 };
+}
+
+// src/extract/infra/index.ts
+async function addInfra(graph, scanPath, services) {
+  const compose = await addComposeInfra(graph, scanPath, services);
+  const dockerfile = await addDockerfileRuntimes(graph, services, scanPath);
+  const terraform = await addTerraformResources(graph, scanPath);
+  const k8s = await addK8sResources(graph, scanPath);
+  return {
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded
+  };
+}
+
+// src/extract/index.ts
+async function extractFromDirectory(graph, scanPath, opts = {}) {
+  await ensureCompatLoaded();
+  const services = await discoverServices(scanPath);
+  const phase1Nodes = addServiceNodes(graph, services);
+  await addServiceAliases(graph, scanPath, services);
+  const phase2 = await addDatabasesAndCompat(graph, services, scanPath);
+  const phase3 = await addConfigNodes(graph, services, scanPath);
+  const phase4 = await addCallEdges(graph, services);
+  const phase5 = await addInfra(graph, scanPath, services);
+  const frontiersPromoted = promoteFrontierNodes(graph);
+  if (opts.onPolicyTrigger) await opts.onPolicyTrigger(graph);
+  return {
+    nodesAdded: phase1Nodes + phase2.nodesAdded + phase3.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
+    edgesAdded: phase2.edgesAdded + phase3.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    frontiersPromoted
+  };
+}
+
+// src/persist.ts
+import { promises as fs15 } from "fs";
+import path27 from "path";
+var SCHEMA_VERSION = 2;
+function migrateV1ToV2(payload) {
+  const nodes = payload.graph.nodes;
+  if (Array.isArray(nodes)) {
+    for (const node of nodes) {
+      if (node.attributes && "pgDriverVersion" in node.attributes) {
+        delete node.attributes.pgDriverVersion;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 2 };
+}
+async function ensureDir(filePath) {
+  await fs15.mkdir(path27.dirname(filePath), { recursive: true });
+}
+async function saveGraphToDisk(graph, outPath) {
+  await ensureDir(outPath);
+  const payload = {
+    schemaVersion: SCHEMA_VERSION,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: graph.export()
+  };
+  const tmp = `${outPath}.tmp`;
+  await fs15.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await fs15.rename(tmp, outPath);
+}
+async function loadGraphFromDisk(graph, outPath) {
+  let raw;
+  try {
+    raw = await fs15.readFile(outPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  let payload = JSON.parse(raw);
+  if (payload.schemaVersion === 1) {
+    payload = migrateV1ToV2(payload);
+  }
+  if (payload.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
+    );
+  }
+  graph.clear();
+  graph.import(payload.graph);
+}
+function startPersistLoop(graph, outPath, intervalMs = 6e4) {
+  let stopped = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      await saveGraphToDisk(graph, outPath);
+    } catch (err) {
+      console.error("persist: periodic save failed", err);
+    }
+  };
+  const interval = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  const onSignal = (signal) => {
+    void (async () => {
+      try {
+        await saveGraphToDisk(graph, outPath);
+      } catch (err) {
+        console.error(`persist: ${signal} save failed`, err);
+      } finally {
+        process.exit(0);
+      }
+    })();
+  };
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+    process.off("SIGTERM", onSignal);
+    process.off("SIGINT", onSignal);
+  };
+}
+
+// src/projects.ts
+import path28 from "path";
+function pathsForProject(project, baseDir) {
+  if (project === DEFAULT_PROJECT) {
+    return {
+      snapshotPath: path28.join(baseDir, "graph.json"),
+      errorsPath: path28.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path28.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path28.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path28.join(baseDir, "policy-violations.ndjson")
+    };
+  }
+  return {
+    snapshotPath: path28.join(baseDir, `${project}.json`),
+    errorsPath: path28.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path28.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path28.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path28.join(baseDir, `policy-violations.${project}.ndjson`)
+  };
+}
+var Projects = class {
+  contexts = /* @__PURE__ */ new Map();
+  upsert(ctx) {
+    this.contexts.set(ctx.name, ctx);
+  }
+  set(name, init) {
+    const ctx = {
+      name,
+      graph: init.graph ?? getGraph(name),
+      scanPath: init.scanPath,
+      paths: init.paths,
+      searchIndex: init.searchIndex
+    };
+    this.contexts.set(name, ctx);
+    return ctx;
+  }
+  get(name) {
+    return this.contexts.get(name);
+  }
+  has(name) {
+    return this.contexts.has(name);
+  }
+  list() {
+    return [...this.contexts.keys()].sort();
+  }
+  attachSearchIndex(name, index) {
+    const ctx = this.contexts.get(name);
+    if (ctx) ctx.searchIndex = index;
+  }
+};
+function parseExtraProjects(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((p) => p.trim()).filter((p) => p.length > 0 && p !== DEFAULT_PROJECT);
+}
+
+export {
+  DEFAULT_PROJECT,
+  getGraph,
+  resetGraph,
+  checkCompatibility,
+  ensureCompatLoaded,
+  compatPairs,
+  confidenceForEdge,
+  getRootCause,
+  getBlastRadius,
+  TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH,
+  TRANSITIVE_DEPENDENCIES_MAX_DEPTH,
+  getTransitiveDependencies,
+  evaluateAllPolicies,
+  loadPolicyFile,
+  PolicyViolationsLog,
+  thresholdForEdgeType,
+  stitchTrace,
+  makeErrorSpanWriter,
+  handleSpan,
+  promoteFrontierNodes,
+  makeSpanHandler,
+  markStaleEdges,
+  readStaleEvents,
+  startStalenessLoop,
+  readErrorEvents,
+  discoverServices,
+  addServiceNodes,
+  addServiceAliases,
+  addDatabasesAndCompat,
+  addConfigNodes,
+  addCallEdges,
+  addInfra,
+  extractFromDirectory,
+  saveGraphToDisk,
+  loadGraphFromDisk,
+  startPersistLoop,
+  pathsForProject,
+  Projects,
+  parseExtraProjects
+};
+//# sourceMappingURL=chunk-6SFEITLJ.js.map