@neat.is/core 0.2.9 → 0.2.10

package/dist/server.cjs

@@ -392,12 +392,10 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types19 = require("@neat.is/types");
+var import_types20 = require("@neat.is/types");
 
-// src/policy.ts
+// src/divergences.ts
 init_cjs_shims();
-var import_node_fs2 = require("fs");
-var import_node_path2 = __toESM(require("path"), 1);
 var import_types2 = require("@neat.is/types");
 
 // src/compat.ts
@@ -713,18 +711,6 @@ function deprecatedApis() {
   return currentMatrix().deprecatedApis ?? [];
 }
 
-// src/events.ts
-init_cjs_shims();
-var import_node_events = require("events");
-var EVENT_BUS_CHANNEL = "event";
-var NeatEventBus = class extends import_node_events.EventEmitter {
-};
-var eventBus = new NeatEventBus();
-eventBus.setMaxListeners(0);
-function emitNeatEvent(envelope) {
-  eventBus.emit(EVENT_BUS_CHANNEL, envelope);
-}
-
 // src/traverse.ts
 init_cjs_shims();
 var import_types = require("@neat.is/types");
@@ -1006,6 +992,259 @@ function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIE
   });
 }
 
+// src/divergences.ts
+function bucketKey(source, target, type) {
+  return `${type}|${source}|${target}`;
+}
+function bucketEdges(graph) {
+  const buckets = /* @__PURE__ */ new Map();
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    const parsed = (0, import_types2.parseEdgeId)(id);
+    const provenance = parsed?.provenance ?? e.provenance;
+    const key = bucketKey(e.source, e.target, e.type);
+    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    switch (provenance) {
+      case import_types2.Provenance.EXTRACTED:
+        cur.extracted = e;
+        break;
+      case import_types2.Provenance.OBSERVED:
+        cur.observed = e;
+        break;
+      case import_types2.Provenance.INFERRED:
+        cur.inferred = e;
+        break;
+      case import_types2.Provenance.FRONTIER:
+        cur.frontier = e;
+        break;
+      default:
+        if (e.provenance === import_types2.Provenance.STALE) cur.stale = e;
+    }
+    buckets.set(key, cur);
+  });
+  return buckets;
+}
+function nodeIsFrontier(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === import_types2.NodeType.FrontierNode;
+}
+function hasAnyObservedFromSource(graph, sourceId) {
+  if (!graph.hasNode(sourceId)) return false;
+  for (const edgeId of graph.outboundEdges(sourceId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.provenance === import_types2.Provenance.OBSERVED) return true;
+  }
+  return false;
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(1, n));
+}
+function reasonForMissingObserved(source, target, type) {
+  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
+}
+function reasonForMissingExtracted(source, target, type) {
+  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
+}
+var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
+var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
+var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function detectMissingDivergences(graph, bucket) {
+  const out = [];
+  if (bucket.extracted && !bucket.observed) {
+    if (!nodeIsFrontier(graph, bucket.target)) {
+      const sourceHasTraffic = hasAnyObservedFromSource(graph, bucket.source);
+      out.push({
+        type: "missing-observed",
+        source: bucket.source,
+        target: bucket.target,
+        edgeType: bucket.type,
+        extracted: bucket.extracted,
+        confidence: sourceHasTraffic ? 1 : 0.5,
+        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
+        recommendation: RECOMMENDATION_MISSING_OBSERVED
+      });
+    }
+  }
+  if (bucket.observed && !bucket.extracted) {
+    const cascaded = clampConfidence(confidenceForEdge(bucket.observed));
+    out.push({
+      type: "missing-extracted",
+      source: bucket.source,
+      target: bucket.target,
+      edgeType: bucket.type,
+      observed: bucket.observed,
+      confidence: cascaded,
+      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
+      recommendation: RECOMMENDATION_MISSING_EXTRACTED
+    });
+  }
+  return out;
+}
+function declaredHostFor(svc) {
+  const raw = svc.dbConnectionTarget?.trim();
+  if (!raw) return null;
+  const colon = raw.lastIndexOf(":");
+  if (colon === -1) return raw;
+  const port = raw.slice(colon + 1);
+  if (/^\d+$/.test(port)) return raw.slice(0, colon);
+  return raw;
+}
+function hasExtractedConfiguredBy(graph, svcId) {
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type === import_types2.EdgeType.CONFIGURED_BY && e.provenance === import_types2.Provenance.EXTRACTED) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectHostMismatch(graph, svcId, svc) {
+  const declaredHost = declaredHostFor(svc);
+  if (!declaredHost) return [];
+  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
+  const out = [];
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== import_types2.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types2.Provenance.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== import_types2.NodeType.DatabaseNode) continue;
+    const observedHost = target.host?.trim();
+    if (!observedHost) continue;
+    if (observedHost === declaredHost) continue;
+    out.push({
+      type: "host-mismatch",
+      source: svcId,
+      target: edge.target,
+      extractedHost: declaredHost,
+      observedHost,
+      confidence: clampConfidence(confidenceForEdge(edge)),
+      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
+      recommendation: RECOMMENDATION_HOST_MISMATCH
+    });
+  }
+  return out;
+}
+function detectCompatDivergences(graph, svcId, svc) {
+  const out = [];
+  const deps = svc.dependencies ?? {};
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== import_types2.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types2.Provenance.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== import_types2.NodeType.DatabaseNode) continue;
+    for (const pair of compatPairs()) {
+      if (pair.engine !== target.engine) continue;
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        target.engine,
+        target.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        out.push({
+          type: "version-mismatch",
+          source: svcId,
+          target: edge.target,
+          extractedVersion: declared,
+          observedVersion: target.engineVersion,
+          compatibility: "incompatible",
+          confidence: 1,
+          reason: result.reason,
+          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
+        });
+      }
+    }
+    for (const rule of deprecatedApis()) {
+      const declared = deps[rule.package];
+      if (!declared) continue;
+      const result = checkDeprecatedApi(rule, declared);
+      if (!result.compatible && result.reason) {
+        const ruleRef = {
+          kind: rule.kind ?? "deprecated-api",
+          reason: result.reason,
+          package: rule.package
+        };
+        out.push({
+          type: "compat-violation",
+          source: svcId,
+          target: edge.target,
+          rule: ruleRef,
+          observed: edge,
+          confidence: 1,
+          reason: result.reason,
+          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
+        });
+      }
+    }
+  }
+  return out;
+}
+function involvesNode(d, nodeId) {
+  return d.source === nodeId || d.target === nodeId;
+}
+function computeDivergences(graph, opts = {}) {
+  const all = [];
+  const buckets = bucketEdges(graph);
+  for (const bucket of buckets.values()) {
+    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
+  }
+  graph.forEachNode((nodeId, attrs) => {
+    const n = attrs;
+    if (n.type !== import_types2.NodeType.ServiceNode) return;
+    const svc = n;
+    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
+    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+  });
+  let filtered = all;
+  if (opts.type) {
+    const allowed = opts.type;
+    filtered = filtered.filter((d) => allowed.has(d.type));
+  }
+  if (opts.minConfidence !== void 0) {
+    const threshold = opts.minConfidence;
+    filtered = filtered.filter((d) => d.confidence >= threshold);
+  }
+  if (opts.node) {
+    const target = opts.node;
+    filtered = filtered.filter((d) => involvesNode(d, target));
+  }
+  filtered.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    if (a.type !== b.type) return a.type.localeCompare(b.type);
+    if (a.source !== b.source) return a.source.localeCompare(b.source);
+    return a.target.localeCompare(b.target);
+  });
+  return import_types2.DivergenceResultSchema.parse({
+    divergences: filtered,
+    totalAffected: filtered.length,
+    computedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/policy.ts
+init_cjs_shims();
+var import_node_fs2 = require("fs");
+var import_node_path2 = __toESM(require("path"), 1);
+var import_types3 = require("@neat.is/types");
+
+// src/events.ts
+init_cjs_shims();
+var import_node_events = require("events");
+var EVENT_BUS_CHANNEL = "event";
+var NeatEventBus = class extends import_node_events.EventEmitter {
+};
+var eventBus = new NeatEventBus();
+eventBus.setMaxListeners(0);
+function emitNeatEvent(envelope) {
+  eventBus.emit(EVENT_BUS_CHANNEL, envelope);
+}
+
 // src/policy.ts
 var DEFAULT_ACTION_BY_SEVERITY = {
   info: "log",
@@ -1043,7 +1282,7 @@ var evaluateStructural = ({
     for (const edgeId of graph.outboundEdges(id)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type !== rule.edgeType) continue;
-      if (e.provenance === import_types2.Provenance.FRONTIER) continue;
+      if (e.provenance === import_types3.Provenance.FRONTIER) continue;
       const target = graph.getNodeAttributes(e.target);
       if (target.type === rule.toNodeType) {
         satisfied = true;
@@ -1156,16 +1395,16 @@ var evaluateCompatibility = ({
   const wantsKind = (kind) => rule.kind === void 0 || rule.kind === kind;
   graph.forEachNode((svcId, attrs) => {
     const a = attrs;
-    if (a.type !== import_types2.NodeType.ServiceNode) return;
+    if (a.type !== import_types3.NodeType.ServiceNode) return;
     const svc = a;
     const deps = svc.dependencies ?? {};
     if (wantsKind("driver-engine")) {
       for (const edgeId of graph.outboundEdges(svcId)) {
         const e = graph.getEdgeAttributes(edgeId);
-        if (e.type !== import_types2.EdgeType.CONNECTS_TO) continue;
-        if (e.provenance === import_types2.Provenance.FRONTIER) continue;
+        if (e.type !== import_types3.EdgeType.CONNECTS_TO) continue;
+        if (e.provenance === import_types3.Provenance.FRONTIER) continue;
         const dbAttrs = graph.getNodeAttributes(e.target);
-        if (dbAttrs.type !== import_types2.NodeType.DatabaseNode) continue;
+        if (dbAttrs.type !== import_types3.NodeType.DatabaseNode) continue;
         const db = dbAttrs;
         for (const pair of compatPairs()) {
           if (pair.engine !== db.engine) continue;
@@ -1283,7 +1522,7 @@ async function loadPolicyFile(policyPath) {
     throw err;
   }
   const json = JSON.parse(raw);
-  const file = import_types2.PolicyFileSchema.parse(json);
+  const file = import_types3.PolicyFileSchema.parse(json);
   return file.policies;
 }
 var PolicyViolationsLog = class {
@@ -1333,7 +1572,7 @@ init_cjs_shims();
 init_cjs_shims();
 var import_node_fs3 = require("fs");
 var import_node_path3 = __toESM(require("path"), 1);
-var import_types3 = require("@neat.is/types");
+var import_types4 = require("@neat.is/types");
 var HOUR_MS = 60 * 60 * 1e3;
 var DAY_MS = 24 * HOUR_MS;
 var DEFAULT_STALE_THRESHOLDS = {
@@ -1389,10 +1628,10 @@ function pickAddress(span) {
   return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
 }
 function makeObservedEdgeId(type, source, target) {
-  return (0, import_types3.observedEdgeId)(source, target, type);
+  return (0, import_types4.observedEdgeId)(source, target, type);
 }
 function makeInferredEdgeId(type, source, target) {
-  return (0, import_types3.inferredEdgeId)(source, target, type);
+  return (0, import_types4.inferredEdgeId)(source, target, type);
 }
 var INFERRED_CONFIDENCE = 0.6;
 var STITCH_MAX_DEPTH = 2;
@@ -1423,13 +1662,13 @@ function lookupParentSpanService(traceId, parentSpanId, now) {
   return entry.service;
 }
 function resolveServiceId(graph, host) {
-  const direct = (0, import_types3.serviceId)(host);
+  const direct = (0, import_types4.serviceId)(host);
   if (graph.hasNode(direct)) return direct;
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types3.NodeType.ServiceNode) return;
+    if (a.type !== import_types4.NodeType.ServiceNode) return;
     if (a.name === host) {
       found = id;
       return;
@@ -1441,14 +1680,14 @@ function resolveServiceId(graph, host) {
   return found;
 }
 function frontierIdFor(host) {
-  return (0, import_types3.frontierId)(host);
+  return (0, import_types4.frontierId)(host);
 }
 function ensureServiceNode(graph, serviceName) {
-  const id = (0, import_types3.serviceId)(serviceName);
+  const id = (0, import_types4.serviceId)(serviceName);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types3.NodeType.ServiceNode,
+    type: import_types4.NodeType.ServiceNode,
     name: serviceName,
     language: "unknown",
     discoveredVia: "otel"
@@ -1457,11 +1696,11 @@ function ensureServiceNode(graph, serviceName) {
   return id;
 }
 function ensureDatabaseNode(graph, host, engine) {
-  const id = (0, import_types3.databaseId)(host);
+  const id = (0, import_types4.databaseId)(host);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types3.NodeType.DatabaseNode,
+    type: import_types4.NodeType.DatabaseNode,
     name: host,
     engine,
     engineVersion: "unknown",
@@ -1481,7 +1720,7 @@ function ensureFrontierNode(graph, host, ts) {
   }
   const node = {
     id,
-    type: import_types3.NodeType.FrontierNode,
+    type: import_types4.NodeType.FrontierNode,
     name: host,
     host,
     firstObserved: ts,
@@ -1491,12 +1730,12 @@ function ensureFrontierNode(graph, host, ts) {
   return id;
 }
 function upsertFrontierEdge(graph, type, source, target, ts) {
-  const id = (0, import_types3.frontierEdgeId)(source, target, type);
+  const id = (0, import_types4.frontierEdgeId)(source, target, type);
   if (graph.hasEdge(id)) {
     const existing = graph.getEdgeAttributes(id);
     const updated = {
       ...existing,
-      provenance: import_types3.Provenance.FRONTIER,
+      provenance: import_types4.Provenance.FRONTIER,
       lastObserved: ts,
       callCount: (existing.callCount ?? 0) + 1
     };
@@ -1508,7 +1747,7 @@ function upsertFrontierEdge(graph, type, source, target, ts) {
     source,
     target,
     type,
-    provenance: import_types3.Provenance.FRONTIER,
+    provenance: import_types4.Provenance.FRONTIER,
     confidence: 1,
     lastObserved: ts,
     callCount: 1
@@ -1524,7 +1763,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
     const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
     const updated = {
       ...existing,
-      provenance: import_types3.Provenance.OBSERVED,
+      provenance: import_types4.Provenance.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
       signal: {
@@ -1542,7 +1781,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
     source,
     target,
     type,
-    provenance: import_types3.Provenance.OBSERVED,
+    provenance: import_types4.Provenance.OBSERVED,
     confidence: 1,
     lastObserved: ts,
     callCount: 1,
@@ -1565,8 +1804,8 @@ function stitchTrace(graph, sourceServiceId, ts) {
     const outbound = graph.outboundEdges(nodeId);
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.provenance !== import_types3.Provenance.EXTRACTED) continue;
-      if (graph.hasEdge((0, import_types3.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
+      if (edge.provenance !== import_types4.Provenance.EXTRACTED) continue;
+      if (graph.hasEdge((0, import_types4.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
       if (!visited.has(edge.target)) {
         visited.add(edge.target);
@@ -1588,7 +1827,7 @@ function upsertInferredEdge(graph, type, source, target, ts) {
     source,
     target,
     type,
-    provenance: import_types3.Provenance.INFERRED,
+    provenance: import_types4.Provenance.INFERRED,
     confidence: INFERRED_CONFIDENCE,
     lastObserved: ts
   };
@@ -1609,10 +1848,10 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     if (host) {
       ensureDatabaseNode(ctx.graph, host, span.dbSystem);
-      const targetId = (0, import_types3.databaseId)(host);
+      const targetId = (0, import_types4.databaseId)(host);
       const result = upsertObservedEdge(
         ctx.graph,
-        import_types3.EdgeType.CONNECTS_TO,
+        import_types4.EdgeType.CONNECTS_TO,
         sourceId,
         targetId,
         ts,
@@ -1628,7 +1867,7 @@ async function handleSpan(ctx, span) {
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
-          import_types3.EdgeType.CALLS,
+          import_types4.EdgeType.CALLS,
           sourceId,
           targetId,
           ts,
@@ -1639,7 +1878,7 @@ async function handleSpan(ctx, span) {
       } else if (!targetId) {
         const frontierId2 = ensureFrontierNode(ctx.graph, host, ts);
         if (ctx.graph.hasNode(sourceId)) {
-          upsertFrontierEdge(ctx.graph, import_types3.EdgeType.CALLS, sourceId, frontierId2, ts);
+          upsertFrontierEdge(ctx.graph, import_types4.EdgeType.CALLS, sourceId, frontierId2, ts);
         }
         affectedNode = frontierId2;
         resolvedViaAddress = true;
@@ -1651,7 +1890,7 @@ async function handleSpan(ctx, span) {
         const parentId = ensureServiceNode(ctx.graph, parentService);
         upsertObservedEdge(
           ctx.graph,
-          import_types3.EdgeType.CALLS,
+          import_types4.EdgeType.CALLS,
           parentId,
           sourceId,
           ts,
@@ -1684,7 +1923,7 @@ function promoteFrontierNodes(graph, opts = {}) {
   const aliasIndex = /* @__PURE__ */ new Map();
   graph.forEachNode((id, attrs) => {
     const a = attrs;
-    if (a.type !== import_types3.NodeType.ServiceNode) return;
+    if (a.type !== import_types4.NodeType.ServiceNode) return;
     aliasIndex.set(a.name, id);
     if (a.aliases) {
       for (const alias of a.aliases) aliasIndex.set(alias, id);
@@ -1693,7 +1932,7 @@ function promoteFrontierNodes(graph, opts = {}) {
   const toPromote = [];
   graph.forEachNode((id, attrs) => {
     const a = attrs;
-    if (a.type !== import_types3.NodeType.FrontierNode) return;
+    if (a.type !== import_types4.NodeType.FrontierNode) return;
     const target = aliasIndex.get(a.host);
     if (!target) return;
     if (target === id) return;
@@ -1727,8 +1966,8 @@ function rewireFrontierEdges(graph, frontierId2, serviceId3) {
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
   graph.dropEdge(oldEdgeId);
-  const promotedProvenance = edge.provenance === import_types3.Provenance.FRONTIER ? import_types3.Provenance.OBSERVED : edge.provenance;
-  const newId = promotedProvenance === import_types3.Provenance.OBSERVED ? (0, import_types3.observedEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types3.Provenance.INFERRED ? (0, import_types3.inferredEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types3.Provenance.EXTRACTED ? (0, import_types3.extractedEdgeId)(newSource, newTarget, edge.type) : (0, import_types3.frontierEdgeId)(newSource, newTarget, edge.type);
+  const promotedProvenance = edge.provenance === import_types4.Provenance.FRONTIER ? import_types4.Provenance.OBSERVED : edge.provenance;
+  const newId = promotedProvenance === import_types4.Provenance.OBSERVED ? (0, import_types4.observedEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types4.Provenance.INFERRED ? (0, import_types4.inferredEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types4.Provenance.EXTRACTED ? (0, import_types4.extractedEdgeId)(newSource, newTarget, edge.type) : (0, import_types4.frontierEdgeId)(newSource, newTarget, edge.type);
   if (graph.hasEdge(newId)) {
     const existing = graph.getEdgeAttributes(newId);
     const merged = {
@@ -1763,12 +2002,12 @@ async function markStaleEdges(graph, options = {}) {
   const project = options.project ?? DEFAULT_PROJECT;
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    if (e.provenance !== import_types3.Provenance.OBSERVED) return;
+    if (e.provenance !== import_types4.Provenance.OBSERVED) return;
     if (!e.lastObserved) return;
     const threshold = thresholdForEdgeType(e.type, thresholds);
     const age = now - new Date(e.lastObserved).getTime();
     if (age > threshold) {
-      const updated = { ...e, provenance: import_types3.Provenance.STALE, confidence: 0.3 };
+      const updated = { ...e, provenance: import_types4.Provenance.STALE, confidence: 0.3 };
       graph.replaceEdgeAttributes(id, updated);
       events.push({
         edgeId: id,
@@ -1785,8 +2024,8 @@ async function markStaleEdges(graph, options = {}) {
         project,
         payload: {
           edgeId: id,
-          from: import_types3.Provenance.OBSERVED,
-          to: import_types3.Provenance.STALE
+          from: import_types4.Provenance.OBSERVED,
+          to: import_types4.Provenance.STALE
         }
       });
     }
@@ -1851,14 +2090,14 @@ var import_node_fs7 = require("fs");
 var import_node_path7 = __toESM(require("path"), 1);
 var import_ignore = __toESM(require("ignore"), 1);
 var import_minimatch2 = require("minimatch");
-var import_types5 = require("@neat.is/types");
+var import_types6 = require("@neat.is/types");
 
 // src/extract/shared.ts
 init_cjs_shims();
 var import_node_fs4 = require("fs");
 var import_node_path4 = __toESM(require("path"), 1);
 var import_yaml = require("yaml");
-var import_types4 = require("@neat.is/types");
+var import_types5 = require("@neat.is/types");
 var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py"]);
 var CONFIG_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".yaml", ".yml"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
@@ -2112,8 +2351,8 @@ async function discoverNodeService(scanPath, dir) {
   }
   if (!pkg.name) return null;
   const node = {
-    id: (0, import_types5.serviceId)(pkg.name),
-    type: import_types5.NodeType.ServiceNode,
+    id: (0, import_types6.serviceId)(pkg.name),
+    type: import_types6.NodeType.ServiceNode,
     name: pkg.name,
     language: "javascript",
     version: pkg.version,
@@ -2128,8 +2367,8 @@ async function discoverPyService(scanPath, dir) {
   if (!py) return null;
   const pkg = pythonToPackage(py);
   const node = {
-    id: (0, import_types5.serviceId)(py.name),
-    type: import_types5.NodeType.ServiceNode,
+    id: (0, import_types6.serviceId)(py.name),
+    type: import_types6.NodeType.ServiceNode,
     name: py.name,
     language: "python",
     version: py.version,
@@ -2219,7 +2458,7 @@ init_cjs_shims();
 var import_node_path8 = __toESM(require("path"), 1);
 var import_node_fs8 = require("fs");
 var import_yaml2 = require("yaml");
-var import_types6 = require("@neat.is/types");
+var import_types7 = require("@neat.is/types");
 var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
   "Service",
   "Deployment",
@@ -2229,7 +2468,7 @@ var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
 function addAliases(graph, serviceId3, candidates) {
   if (!graph.hasNode(serviceId3)) return;
   const node = graph.getNodeAttributes(serviceId3);
-  if (node.type !== import_types6.NodeType.ServiceNode) return;
+  if (node.type !== import_types7.NodeType.ServiceNode) return;
   const set = new Set(node.aliases ?? []);
   for (const c of candidates) {
     if (!c) continue;
@@ -2382,7 +2621,7 @@ async function addServiceAliases(graph, scanPath, services) {
 // src/extract/databases/index.ts
 init_cjs_shims();
 var import_node_path16 = __toESM(require("path"), 1);
-var import_types7 = require("@neat.is/types");
+var import_types8 = require("@neat.is/types");
 
 // src/extract/databases/db-config-yaml.ts
 init_cjs_shims();
@@ -2830,8 +3069,8 @@ function compatibleDriversFor(engine) {
 }
 function toDatabaseNode(config) {
   return {
-    id: (0, import_types7.databaseId)(config.host),
-    type: import_types7.NodeType.DatabaseNode,
+    id: (0, import_types8.databaseId)(config.host),
+    type: import_types8.NodeType.DatabaseNode,
     name: config.database || config.host,
     engine: config.engine,
     engineVersion: config.engineVersion,
@@ -2962,11 +3201,11 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         });
       }
       const edge = {
-        id: (0, import_types4.extractedEdgeId)(service.node.id, dbNode.id, import_types7.EdgeType.CONNECTS_TO),
+        id: (0, import_types5.extractedEdgeId)(service.node.id, dbNode.id, import_types8.EdgeType.CONNECTS_TO),
         source: service.node.id,
         target: dbNode.id,
-        type: import_types7.EdgeType.CONNECTS_TO,
-        provenance: import_types7.Provenance.EXTRACTED,
+        type: import_types8.EdgeType.CONNECTS_TO,
+        provenance: import_types8.Provenance.EXTRACTED,
         ...config.sourceFile ? {
           evidence: {
             file: import_node_path16.default.relative(scanPath, config.sourceFile).split(import_node_path16.default.sep).join("/")
@@ -2999,7 +3238,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs11 = require("fs");
 var import_node_path17 = __toESM(require("path"), 1);
-var import_types8 = require("@neat.is/types");
+var import_types9 = require("@neat.is/types");
 async function walkConfigFiles(dir) {
   const out = [];
   async function walk(current) {
@@ -3024,8 +3263,8 @@ async function addConfigNodes(graph, services, scanPath) {
     for (const file of configFiles) {
       const relPath = import_node_path17.default.relative(scanPath, file);
       const node = {
-        id: (0, import_types8.configId)(relPath),
-        type: import_types8.NodeType.ConfigNode,
+        id: (0, import_types9.configId)(relPath),
+        type: import_types9.NodeType.ConfigNode,
         name: import_node_path17.default.basename(file),
         path: relPath,
         fileType: isConfigFile(import_node_path17.default.basename(file)).fileType
@@ -3035,11 +3274,11 @@ async function addConfigNodes(graph, services, scanPath) {
         nodesAdded++;
       }
       const edge = {
-        id: (0, import_types4.extractedEdgeId)(service.node.id, node.id, import_types8.EdgeType.CONFIGURED_BY),
+        id: (0, import_types5.extractedEdgeId)(service.node.id, node.id, import_types9.EdgeType.CONFIGURED_BY),
         source: service.node.id,
         target: node.id,
-        type: import_types8.EdgeType.CONFIGURED_BY,
-        provenance: import_types8.Provenance.EXTRACTED,
+        type: import_types9.EdgeType.CONFIGURED_BY,
+        provenance: import_types9.Provenance.EXTRACTED,
         evidence: { file: relPath.split(import_node_path17.default.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
@@ -3053,7 +3292,7 @@ async function addConfigNodes(graph, services, scanPath) {
 
 // src/extract/calls/index.ts
 init_cjs_shims();
-var import_types14 = require("@neat.is/types");
+var import_types15 = require("@neat.is/types");
 
 // src/extract/calls/http.ts
 init_cjs_shims();
@@ -3061,7 +3300,7 @@ var import_node_path19 = __toESM(require("path"), 1);
 var import_tree_sitter = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript = __toESM(require("tree-sitter-javascript"), 1);
 var import_tree_sitter_python = __toESM(require("tree-sitter-python"), 1);
-var import_types9 = require("@neat.is/types");
+var import_types10 = require("@neat.is/types");
 
 // src/extract/calls/shared.ts
 init_cjs_shims();
@@ -3176,11 +3415,11 @@ async function addHttpCallEdges(graph, services) {
       const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
       const line = lineOf(fileContent, `//${evidenceFile.host}`);
       const edge = {
-        id: (0, import_types4.extractedEdgeId)(service.node.id, targetId, import_types9.EdgeType.CALLS),
+        id: (0, import_types5.extractedEdgeId)(service.node.id, targetId, import_types10.EdgeType.CALLS),
         source: service.node.id,
         target: targetId,
-        type: import_types9.EdgeType.CALLS,
-        provenance: import_types9.Provenance.EXTRACTED,
+        type: import_types10.EdgeType.CALLS,
+        provenance: import_types10.Provenance.EXTRACTED,
         evidence: {
           file: import_node_path19.default.relative(service.dir, evidenceFile.file),
           line,
@@ -3199,7 +3438,7 @@ async function addHttpCallEdges(graph, services) {
 // src/extract/calls/kafka.ts
 init_cjs_shims();
 var import_node_path20 = __toESM(require("path"), 1);
-var import_types10 = require("@neat.is/types");
+var import_types11 = require("@neat.is/types");
 var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
 var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
 function findAll(re, text) {
@@ -3220,7 +3459,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
     seen.add(key);
     const line = lineOf(file.content, topic);
     out.push({
-      infraId: (0, import_types10.infraId)("kafka-topic", topic),
+      infraId: (0, import_types11.infraId)("kafka-topic", topic),
       name: topic,
       kind: "kafka-topic",
       edgeType,
@@ -3239,7 +3478,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/redis.ts
 init_cjs_shims();
 var import_node_path21 = __toESM(require("path"), 1);
-var import_types11 = require("@neat.is/types");
+var import_types12 = require("@neat.is/types");
 var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
 function redisEndpointsFromFile(file, serviceDir) {
   const out = [];
@@ -3252,7 +3491,7 @@ function redisEndpointsFromFile(file, serviceDir) {
     seen.add(host);
     const line = lineOf(file.content, host);
     out.push({
-      infraId: (0, import_types11.infraId)("redis", host),
+      infraId: (0, import_types12.infraId)("redis", host),
       name: host,
       kind: "redis",
       edgeType: "CALLS",
@@ -3269,7 +3508,7 @@ function redisEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/aws.ts
 init_cjs_shims();
 var import_node_path22 = __toESM(require("path"), 1);
-var import_types12 = require("@neat.is/types");
+var import_types13 = require("@neat.is/types");
 var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
 var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
 function hasMarker(text, markers) {
@@ -3293,7 +3532,7 @@ function awsEndpointsFromFile(file, serviceDir) {
     seen.add(key);
     const line = lineOf(file.content, name);
     out.push({
-      infraId: (0, import_types12.infraId)(kind, name),
+      infraId: (0, import_types13.infraId)(kind, name),
       name,
       kind,
       edgeType: "CALLS",
@@ -3324,7 +3563,7 @@ function awsEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/grpc.ts
 init_cjs_shims();
 var import_node_path23 = __toESM(require("path"), 1);
-var import_types13 = require("@neat.is/types");
+var import_types14 = require("@neat.is/types");
 var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
 function isLikelyAddress(value) {
   if (!value) return false;
@@ -3343,7 +3582,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
     seen.add(name);
     const line = lineOf(file.content, m[0]);
     out.push({
-      infraId: (0, import_types13.infraId)("grpc-service", name),
+      infraId: (0, import_types14.infraId)("grpc-service", name),
       name,
       kind: "grpc-service",
       edgeType: "CALLS",
@@ -3361,11 +3600,11 @@ function grpcEndpointsFromFile(file, serviceDir) {
 function edgeTypeFromEndpoint(ep) {
   switch (ep.edgeType) {
     case "PUBLISHES_TO":
-      return import_types14.EdgeType.PUBLISHES_TO;
+      return import_types15.EdgeType.PUBLISHES_TO;
     case "CONSUMES_FROM":
-      return import_types14.EdgeType.CONSUMES_FROM;
+      return import_types15.EdgeType.CONSUMES_FROM;
     default:
-      return import_types14.EdgeType.CALLS;
+      return import_types15.EdgeType.CALLS;
   }
 }
 async function addExternalEndpointEdges(graph, services) {
@@ -3386,7 +3625,7 @@ async function addExternalEndpointEdges(graph, services) {
       if (!graph.hasNode(ep.infraId)) {
         const node = {
           id: ep.infraId,
-          type: import_types14.NodeType.InfraNode,
+          type: import_types15.NodeType.InfraNode,
           name: ep.name,
           provider: ep.kind.startsWith("s3") || ep.kind.startsWith("dynamodb") ? "aws" : "self",
           kind: ep.kind
@@ -3395,7 +3634,7 @@ async function addExternalEndpointEdges(graph, services) {
         nodesAdded++;
       }
       const edgeType = edgeTypeFromEndpoint(ep);
-      const edgeId = (0, import_types4.extractedEdgeId)(service.node.id, ep.infraId, edgeType);
+      const edgeId = (0, import_types5.extractedEdgeId)(service.node.id, ep.infraId, edgeType);
       if (seenEdges.has(edgeId)) continue;
       seenEdges.add(edgeId);
       if (!graph.hasEdge(edgeId)) {
@@ -3404,7 +3643,7 @@ async function addExternalEndpointEdges(graph, services) {
           source: service.node.id,
           target: ep.infraId,
           type: edgeType,
-          provenance: import_types14.Provenance.EXTRACTED,
+          provenance: import_types15.Provenance.EXTRACTED,
           evidence: ep.evidence
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3429,15 +3668,15 @@ init_cjs_shims();
 // src/extract/infra/docker-compose.ts
 init_cjs_shims();
 var import_node_path24 = __toESM(require("path"), 1);
-var import_types16 = require("@neat.is/types");
+var import_types17 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
 init_cjs_shims();
-var import_types15 = require("@neat.is/types");
+var import_types16 = require("@neat.is/types");
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: (0, import_types15.infraId)(kind, name),
-    type: import_types15.NodeType.InfraNode,
+    id: (0, import_types16.infraId)(kind, name),
+    type: import_types16.NodeType.InfraNode,
     name,
     provider,
     kind,
@@ -3514,14 +3753,14 @@ async function addComposeInfra(graph, scanPath, services) {
     for (const dep of dependsOnList(svc.depends_on)) {
       const targetId = composeNameToNodeId.get(dep);
       if (!targetId) continue;
-      const edgeId = (0, import_types4.extractedEdgeId)(sourceId, targetId, import_types16.EdgeType.DEPENDS_ON);
+      const edgeId = (0, import_types5.extractedEdgeId)(sourceId, targetId, import_types17.EdgeType.DEPENDS_ON);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: sourceId,
         target: targetId,
-        type: import_types16.EdgeType.DEPENDS_ON,
-        provenance: import_types16.Provenance.EXTRACTED,
+        type: import_types17.EdgeType.DEPENDS_ON,
+        provenance: import_types17.Provenance.EXTRACTED,
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3535,7 +3774,7 @@ async function addComposeInfra(graph, scanPath, services) {
 init_cjs_shims();
 var import_node_path25 = __toESM(require("path"), 1);
 var import_node_fs13 = require("fs");
-var import_types17 = require("@neat.is/types");
+var import_types18 = require("@neat.is/types");
 function runtimeImage(content) {
   const lines = content.split("\n");
   let last = null;
@@ -3572,14 +3811,14 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
-    const edgeId = (0, import_types4.extractedEdgeId)(service.node.id, node.id, import_types17.EdgeType.RUNS_ON);
+    const edgeId = (0, import_types5.extractedEdgeId)(service.node.id, node.id, import_types18.EdgeType.RUNS_ON);
     if (!graph.hasEdge(edgeId)) {
       const edge = {
         id: edgeId,
         source: service.node.id,
         target: node.id,
-        type: import_types17.EdgeType.RUNS_ON,
-        provenance: import_types17.Provenance.EXTRACTED,
+        type: import_types18.EdgeType.RUNS_ON,
+        provenance: import_types18.Provenance.EXTRACTED,
         evidence: {
           file: import_node_path25.default.relative(scanPath, dockerfilePath).split(import_node_path25.default.sep).join("/")
         }
@@ -3864,7 +4103,7 @@ init_cjs_shims();
 var import_node_fs17 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
 var import_node_path29 = __toESM(require("path"), 1);
-var import_types18 = require("@neat.is/types");
+var import_types19 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
   if (override && override.length > 0) return import_node_path29.default.resolve(override);
@@ -3885,7 +4124,7 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types18.RegistryFileSchema.parse(parsed);
+  return import_types19.RegistryFileSchema.parse(parsed);
 }
 async function listProjects() {
   const reg = await readRegistry();
@@ -4057,6 +4296,41 @@ function registerRoutes(scope, ctx) {
     }
     return getTransitiveDependencies(proj.graph, id, depth);
   });
+  scope.get("/graph/divergences", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    let typeFilter;
+    if (req.query.type) {
+      const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+      const parsed = [];
+      for (const c of candidates) {
+        const r = import_types20.DivergenceTypeSchema.safeParse(c);
+        if (!r.success) {
+          return reply.code(400).send({
+            error: `unknown divergence type "${c}"`,
+            allowed: import_types20.DivergenceTypeSchema.options
+          });
+        }
+        parsed.push(r.data);
+      }
+      typeFilter = new Set(parsed);
+    }
+    let minConfidence;
+    if (req.query.minConfidence !== void 0) {
+      const n = Number(req.query.minConfidence);
+      if (!Number.isFinite(n) || n < 0 || n > 1) {
+        return reply.code(400).send({
+          error: "minConfidence must be a number in [0, 1]"
+        });
+      }
+      minConfidence = n;
+    }
+    return computeDivergences(proj.graph, {
+      ...typeFilter ? { type: typeFilter } : {},
+      ...minConfidence !== void 0 ? { minConfidence } : {},
+      ...req.query.node ? { node: req.query.node } : {}
+    });
+  });
   scope.get("/incidents", async (req, reply) => {
     const proj = resolveProject(registry, req, reply);
     if (!proj) return;
@@ -4210,7 +4484,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types19.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types20.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -4227,7 +4501,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply);
     if (!proj) return;
-    const parsed = import_types19.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types20.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",