@neat.is/core 0.3.0 → 0.3.2

package/dist/neatd.cjs

@@ -6,6 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -23,15 +30,355 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// ../../node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl, importMetaUrl;
+var init_cjs_shims = __esm({
+  "../../node_modules/tsup/assets/cjs_shims.js"() {
+    "use strict";
+    getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+    importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+  }
+});
+
+// src/otel-grpc.ts
+var otel_grpc_exports = {};
+__export(otel_grpc_exports, {
+  reshapeGrpcRequest: () => reshapeGrpcRequest,
+  startOtelGrpcReceiver: () => startOtelGrpcReceiver
+});
+function bytesToHex(buf) {
+  if (!buf) return "";
+  return Buffer.isBuffer(buf) ? buf.toString("hex") : "";
+}
+function nanosToString(n) {
+  if (n === void 0 || n === null) return "0";
+  return typeof n === "string" ? n : String(n);
+}
+function reshapeAttributes(attrs) {
+  const out = (attrs ?? []).map((kv) => ({
+    key: kv.key ?? "",
+    value: kv.value ? {
+      stringValue: kv.value.string_value,
+      boolValue: kv.value.bool_value,
+      intValue: kv.value.int_value,
+      doubleValue: kv.value.double_value,
+      arrayValue: kv.value.array_value ? {
+        values: (kv.value.array_value.values ?? []).map((v) => ({
+          stringValue: v.string_value,
+          boolValue: v.bool_value,
+          intValue: v.int_value,
+          doubleValue: v.double_value
+        }))
+      } : void 0
+    } : void 0
+  }));
+  return out;
+}
+function reshapeGrpcRequest(req2) {
+  return {
+    resourceSpans: (req2.resource_spans ?? []).map((rs) => ({
+      resource: rs.resource ? { attributes: reshapeAttributes(rs.resource.attributes) } : void 0,
+      scopeSpans: (rs.scope_spans ?? []).map((ss) => ({
+        spans: (ss.spans ?? []).map((s) => ({
+          traceId: bytesToHex(s.trace_id),
+          spanId: bytesToHex(s.span_id),
+          parentSpanId: s.parent_span_id ? bytesToHex(s.parent_span_id) : void 0,
+          name: s.name,
+          kind: s.kind,
+          startTimeUnixNano: nanosToString(s.start_time_unix_nano),
+          endTimeUnixNano: nanosToString(s.end_time_unix_nano),
+          attributes: reshapeAttributes(s.attributes),
+          events: (s.events ?? []).map((e) => ({
+            name: e.name,
+            timeUnixNano: nanosToString(e.time_unix_nano),
+            attributes: reshapeAttributes(e.attributes)
+          })),
+          status: s.status ? { code: s.status.code, message: s.status.message } : void 0
+        }))
+      }))
+    }))
+  };
+}
+function resolveProtoRoot() {
+  const here = import_node_path31.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path31.default.resolve(here, "..", "proto");
+}
+function loadTraceService() {
+  const protoRoot = resolveProtoRoot();
+  const def = protoLoader.loadSync(
+    "opentelemetry/proto/collector/trace/v1/trace_service.proto",
+    {
+      keepCase: true,
+      longs: String,
+      enums: Number,
+      defaults: true,
+      oneofs: true,
+      includeDirs: [protoRoot]
+    }
+  );
+  const pkg = grpc.loadPackageDefinition(def);
+  return pkg.opentelemetry.proto.collector.trace.v1.TraceService.service;
+}
+async function startOtelGrpcReceiver(opts) {
+  const server = new grpc.Server();
+  const service = loadTraceService();
+  server.addService(service, {
+    Export: (call, callback) => {
+      void (async () => {
+        try {
+          const reshaped = reshapeGrpcRequest(call.request ?? {});
+          const spans = parseOtlpRequest(reshaped);
+          for (const span of spans) {
+            await opts.onSpan(span);
+          }
+          callback(null, { partial_success: {} });
+        } catch (err) {
+          callback({
+            code: grpc.status.INTERNAL,
+            message: err instanceof Error ? err.message : String(err)
+          });
+        }
+      })();
+    }
+  });
+  const host = opts.host ?? "0.0.0.0";
+  const port = opts.port ?? 4317;
+  const boundPort = await new Promise((resolve, reject) => {
+    server.bindAsync(`${host}:${port}`, grpc.ServerCredentials.createInsecure(), (err, p) => {
+      if (err) return reject(err);
+      resolve(p);
+    });
+  });
+  return {
+    address: `${host}:${boundPort}`,
+    stop: () => new Promise((resolve) => {
+      server.tryShutdown(() => resolve());
+    })
+  };
+}
+var import_node_url, import_node_path31, grpc, protoLoader;
+var init_otel_grpc = __esm({
+  "src/otel-grpc.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_url = require("url");
+    import_node_path31 = __toESM(require("path"), 1);
+    grpc = __toESM(require("@grpc/grpc-js"), 1);
+    protoLoader = __toESM(require("@grpc/proto-loader"), 1);
+    init_otel();
+  }
+});
+
+// src/otel.ts
+function extractExceptionFromEvents(events) {
+  if (!events) return void 0;
+  for (const ev of events) {
+    if (ev.name !== "exception") continue;
+    const attrs = attrsToRecord(ev.attributes);
+    const out = {};
+    const t = attrs["exception.type"];
+    const m = attrs["exception.message"];
+    const s = attrs["exception.stacktrace"];
+    if (typeof t === "string") out.type = t;
+    if (typeof m === "string") out.message = m;
+    if (typeof s === "string") out.stacktrace = s;
+    if (out.type || out.message || out.stacktrace) return out;
+  }
+  return void 0;
+}
+function flattenAttribute(v) {
+  if (!v) return null;
+  if (v.stringValue !== void 0) return v.stringValue;
+  if (v.boolValue !== void 0) return v.boolValue;
+  if (v.intValue !== void 0) {
+    return typeof v.intValue === "string" ? Number(v.intValue) : v.intValue;
+  }
+  if (v.doubleValue !== void 0) return v.doubleValue;
+  if (v.arrayValue?.values) {
+    return v.arrayValue.values.map((x) => flattenAttribute(x));
+  }
+  return null;
+}
+function attrsToRecord(attrs) {
+  const out = {};
+  if (!attrs) return out;
+  for (const kv of attrs) {
+    if (kv.key) out[kv.key] = flattenAttribute(kv.value);
+  }
+  return out;
+}
+function durationNanos(start, end) {
+  if (!start || !end) return 0n;
+  try {
+    return BigInt(end) - BigInt(start);
+  } catch {
+    return 0n;
+  }
+}
+function isoFromUnixNano(nanos) {
+  if (!nanos || nanos === "0") return void 0;
+  try {
+    const ms = Number(BigInt(nanos) / 1000000n);
+    if (!Number.isFinite(ms)) return void 0;
+    return new Date(ms).toISOString();
+  } catch {
+    return void 0;
+  }
+}
+function parseOtlpRequest(body) {
+  const out = [];
+  for (const rs of body.resourceSpans ?? []) {
+    const resourceAttrs = attrsToRecord(rs.resource?.attributes);
+    const service = typeof resourceAttrs["service.name"] === "string" ? resourceAttrs["service.name"] : "unknown";
+    for (const ss of rs.scopeSpans ?? []) {
+      for (const span of ss.spans ?? []) {
+        const attrs = attrsToRecord(span.attributes);
+        const parsed = {
+          service,
+          traceId: span.traceId ?? "",
+          spanId: span.spanId ?? "",
+          parentSpanId: span.parentSpanId || void 0,
+          name: span.name ?? "",
+          kind: span.kind,
+          startTimeUnixNano: span.startTimeUnixNano ?? "0",
+          endTimeUnixNano: span.endTimeUnixNano ?? "0",
+          startTimeIso: isoFromUnixNano(span.startTimeUnixNano),
+          durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),
+          attributes: attrs,
+          dbSystem: typeof attrs["db.system"] === "string" ? attrs["db.system"] : void 0,
+          dbName: typeof attrs["db.name"] === "string" ? attrs["db.name"] : void 0,
+          statusCode: span.status?.code,
+          errorMessage: span.status?.message,
+          exception: extractExceptionFromEvents(span.events)
+        };
+        out.push(parsed);
+      }
+    }
+  }
+  return out;
+}
+function loadProtobufDecoder() {
+  if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
+  const here = import_node_path32.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path32.default.resolve(here, "..", "proto");
+  const root = new import_protobufjs.default.Root();
+  root.resolvePath = (_origin, target) => import_node_path32.default.resolve(protoRoot, target);
+  root.loadSync(
+    "opentelemetry/proto/collector/trace/v1/trace_service.proto",
+    { keepCase: true }
+  );
+  exportTraceServiceRequestType = root.lookupType(
+    "opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest"
+  );
+  return exportTraceServiceRequestType;
+}
+async function decodeProtobufBody(buf) {
+  const Type = loadProtobufDecoder();
+  const decoded = Type.decode(buf).toJSON();
+  const { reshapeGrpcRequest: reshapeGrpcRequest2 } = await Promise.resolve().then(() => (init_otel_grpc(), otel_grpc_exports));
+  return reshapeGrpcRequest2(decoded);
+}
+async function buildOtelReceiver(opts) {
+  const app = (0, import_fastify2.default)({
+    logger: false,
+    bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024
+  });
+  const queue = [];
+  let draining = false;
+  let drainPromise = Promise.resolve();
+  const drain = async () => {
+    if (draining) return;
+    draining = true;
+    try {
+      while (queue.length > 0) {
+        const span = queue.shift();
+        try {
+          await opts.onSpan(span);
+        } catch (err) {
+          console.warn(`[neat] otel handler error: ${err.message}`);
+        }
+      }
+    } finally {
+      draining = false;
+    }
+  };
+  const enqueue = (spans) => {
+    if (spans.length === 0) return;
+    for (const s of spans) queue.push(s);
+    drainPromise = drainPromise.then(() => drain());
+  };
+  app.addContentTypeParser(
+    "application/x-protobuf",
+    { parseAs: "buffer", bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024 },
+    (_req, body, done) => {
+      done(null, body);
+    }
+  );
+  app.get("/health", async () => ({ ok: true }));
+  app.post("/v1/traces", async (req2, reply) => {
+    const ct = (req2.headers["content-type"] ?? "").toString().split(";")[0].trim().toLowerCase();
+    let body;
+    if (ct === "application/x-protobuf") {
+      try {
+        body = await decodeProtobufBody(req2.body);
+      } catch (err) {
+        return reply.code(400).send({
+          error: `protobuf decode failed: ${err.message}`
+        });
+      }
+    } else if (!ct || ct === "application/json") {
+      body = req2.body ?? {};
+    } else {
+      return reply.code(415).send({ error: `unsupported content-type: ${ct}` });
+    }
+    const spans = parseOtlpRequest(body);
+    if (opts.onErrorSpanSync) {
+      try {
+        for (const span of spans) {
+          if (span.statusCode === 2) await opts.onErrorSpanSync(span);
+        }
+      } catch (err) {
+        return reply.code(500).send({
+          error: `error-event write failed: ${err.message}`
+        });
+      }
+    }
+    enqueue(spans);
+    return reply.code(200).send({ partialSuccess: {} });
+  });
+  const decorated = app;
+  decorated.flushPending = async () => {
+    while (queue.length > 0 || draining) {
+      await drainPromise;
+    }
+  };
+  return decorated;
+}
+var import_node_path32, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType;
+var init_otel = __esm({
+  "src/otel.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_path32 = __toESM(require("path"), 1);
+    import_node_url2 = require("url");
+    import_fastify2 = __toESM(require("fastify"), 1);
+    import_protobufjs = __toESM(require("protobufjs"), 1);
+    exportTraceServiceRequestType = null;
+  }
+});
+
 // src/neatd.ts
-var import_node_fs19 = require("fs");
-var import_node_path33 = __toESM(require("path"), 1);
+init_cjs_shims();
+var import_node_fs20 = require("fs");
+var import_node_path35 = __toESM(require("path"), 1);
 
 // src/daemon.ts
-var import_node_fs18 = require("fs");
-var import_node_path31 = __toESM(require("path"), 1);
+init_cjs_shims();
+var import_node_fs19 = require("fs");
+var import_node_path33 = __toESM(require("path"), 1);
 
 // src/graph.ts
+init_cjs_shims();
 var import_graphology = __toESM(require("graphology"), 1);
 var MultiDirectedGraph = import_graphology.default.MultiDirectedGraph;
 var DEFAULT_PROJECT = "default";
@@ -55,16 +402,25 @@ function resetGraph(project) {
   graphs.delete(project);
 }
 
+// src/extract.ts
+init_cjs_shims();
+
+// src/extract/index.ts
+init_cjs_shims();
+
 // src/ingest.ts
+init_cjs_shims();
 var import_node_fs3 = require("fs");
 var import_node_path3 = __toESM(require("path"), 1);
 
 // src/policy.ts
+init_cjs_shims();
 var import_node_fs2 = require("fs");
 var import_node_path2 = __toESM(require("path"), 1);
 var import_types2 = require("@neat.is/types");
 
 // src/compat.ts
+init_cjs_shims();
 var import_node_fs = require("fs");
 var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
@@ -377,6 +733,7 @@ function deprecatedApis() {
 }
 
 // src/events.ts
+init_cjs_shims();
 var import_node_events = require("events");
 var EVENT_BUS_CHANNEL = "event";
 var NeatEventBus = class extends import_node_events.EventEmitter {
@@ -388,8 +745,22 @@ function emitNeatEvent(envelope) {
 }
 
 // src/traverse.ts
+init_cjs_shims();
 var import_types = require("@neat.is/types");
+var ROOT_CAUSE_MAX_DEPTH = 5;
 var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function bestEdgeBySource(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (e.provenance === import_types.Provenance.FRONTIER) continue;
+    const cur = best.get(e.source);
+    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+      best.set(e.source, e);
+    }
+  }
+  return best;
+}
 function bestEdgeByTarget(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
@@ -457,6 +828,29 @@ function confidenceFromMix(edges, now = Date.now()) {
   }
   return Math.max(0, Math.min(1, product));
 }
+function longestIncomingWalk(graph, start, maxDepth) {
+  let best = { path: [start], edges: [] };
+  const visited = /* @__PURE__ */ new Set([start]);
+  function step(node, path36, edges) {
+    if (path36.length > best.path.length) {
+      best = { path: [...path36], edges: [...edges] };
+    }
+    if (path36.length - 1 >= maxDepth) return;
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
+    for (const [srcId, edge] of incoming) {
+      if (visited.has(srcId)) continue;
+      visited.add(srcId);
+      path36.push(srcId);
+      edges.push(edge);
+      step(srcId, path36, edges);
+      path36.pop();
+      edges.pop();
+      visited.delete(srcId);
+    }
+  }
+  step(start, [start], []);
+  return best;
+}
 function databaseRootCauseShape(graph, origin, walk) {
   const targetDb = origin;
   const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
@@ -529,6 +923,24 @@ var rootCauseShapes = {
   [import_types.NodeType.DatabaseNode]: databaseRootCauseShape,
   [import_types.NodeType.ServiceNode]: serviceRootCauseShape
 };
+function getRootCause(graph, errorNodeId, errorEvent) {
+  if (!graph.hasNode(errorNodeId)) return null;
+  const origin = graph.getNodeAttributes(errorNodeId);
+  const shape = rootCauseShapes[origin.type];
+  if (!shape) return null;
+  const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+  const match = shape(graph, origin, walk);
+  if (!match) return null;
+  const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+  return import_types.RootCauseResultSchema.parse({
+    rootCauseNode: match.rootCauseNode,
+    rootCauseReason: reason,
+    traversalPath: walk.path,
+    edgeProvenances: walk.edges.map((e) => e.provenance),
+    confidence: confidenceFromMix(walk.edges),
+    fixRecommendation: match.fixRecommendation
+  });
+}
 function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
   if (!graph.hasNode(nodeId)) {
     return import_types.BlastRadiusResultSchema.parse({ origin: nodeId, affectedNodes: [], totalAffected: 0 });
@@ -570,6 +982,48 @@ function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
     totalAffected: affectedNodes.length
   });
 }
+var TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH = 3;
+var TRANSITIVE_DEPENDENCIES_MAX_DEPTH = 10;
+function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return import_types.TransitiveDependenciesResultSchema.parse({
+      origin: nodeId,
+      depth,
+      dependencies: [],
+      total: 0
+    });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, edge: null }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.edge) {
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeType: frame.edge.type,
+        provenance: frame.edge.provenance
+      });
+    }
+    if (frame.distance >= depth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({ nodeId: tgtId, distance: frame.distance + 1, edge });
+    }
+  }
+  const dependencies = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return import_types.TransitiveDependenciesResultSchema.parse({
+    origin: nodeId,
+    depth,
+    dependencies,
+    total: dependencies.length
+  });
+}
 
 // src/policy.ts
 var DEFAULT_ACTION_BY_SEVERITY = {
@@ -839,6 +1293,54 @@ function evaluateAllPolicies(graph, policies, ctx) {
   }
   return out;
 }
+async function loadPolicyFile(policyPath) {
+  let raw;
+  try {
+    raw = await import_node_fs2.promises.readFile(policyPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  const json = JSON.parse(raw);
+  const file = import_types2.PolicyFileSchema.parse(json);
+  return file.policies;
+}
+var PolicyViolationsLog = class {
+  path;
+  project;
+  seen = null;
+  constructor(logPath, project = DEFAULT_PROJECT) {
+    this.path = logPath;
+    this.project = project;
+  }
+  async append(v) {
+    if (!this.seen) await this.hydrate();
+    if (this.seen.has(v.id)) return false;
+    this.seen.add(v.id);
+    await import_node_fs2.promises.mkdir(import_node_path2.default.dirname(this.path), { recursive: true });
+    await import_node_fs2.promises.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
+    emitNeatEvent({
+      type: "policy-violation",
+      project: this.project,
+      payload: { violation: v }
+    });
+    return true;
+  }
+  async readAll() {
+    try {
+      const raw = await import_node_fs2.promises.readFile(this.path, "utf8");
+      return raw.split("\n").filter(Boolean).map((line) => JSON.parse(line));
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+  }
+  async hydrate() {
+    this.seen = /* @__PURE__ */ new Set();
+    const existing = await this.readAll();
+    for (const v of existing) this.seen.add(v.id);
+  }
+};
 
 // src/ingest.ts
 var import_types3 = require("@neat.is/types");
@@ -853,7 +1355,342 @@ var DEFAULT_STALE_THRESHOLDS = {
   CONFIGURED_BY: DAY_MS,
   RUNS_ON: DAY_MS
 };
+function nowIso(ctx) {
+  return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
+}
+function pickAttr(span, ...keys) {
+  for (const k of keys) {
+    const v = span.attributes[k];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function hostFromUrl(u) {
+  if (!u) return void 0;
+  try {
+    return new URL(u).hostname;
+  } catch {
+    return void 0;
+  }
+}
+function pickAddress(span) {
+  return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
+}
+function makeObservedEdgeId(type, source, target) {
+  return (0, import_types3.observedEdgeId)(source, target, type);
+}
+function makeInferredEdgeId(type, source, target) {
+  return (0, import_types3.inferredEdgeId)(source, target, type);
+}
+var INFERRED_CONFIDENCE = 0.6;
+var STITCH_MAX_DEPTH = 2;
+var PARENT_SPAN_CACHE_SIZE = 1e4;
 var PARENT_SPAN_CACHE_TTL_MS = 5 * 60 * 1e3;
+var parentSpanCache = /* @__PURE__ */ new Map();
+function parentSpanKey(traceId, spanId) {
+  return `${traceId}:${spanId}`;
+}
+function cacheSpanService(span, now) {
+  if (!span.traceId || !span.spanId) return;
+  const key = parentSpanKey(span.traceId, span.spanId);
+  parentSpanCache.delete(key);
+  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
+    const oldest = parentSpanCache.keys().next().value;
+    if (!oldest) break;
+    parentSpanCache.delete(oldest);
+  }
+}
+function lookupParentSpanService(traceId, parentSpanId, now) {
+  const entry2 = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
+  if (!entry2) return null;
+  if (entry2.expiresAt <= now) {
+    parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
+    return null;
+  }
+  return entry2.service;
+}
+function resolveServiceId(graph, host) {
+  const direct = (0, import_types3.serviceId)(host);
+  if (graph.hasNode(direct)) return direct;
+  let found = null;
+  graph.forEachNode((id, attrs) => {
+    if (found) return;
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.ServiceNode) return;
+    if (a.name === host) {
+      found = id;
+      return;
+    }
+    if (a.aliases && a.aliases.includes(host)) {
+      found = id;
+    }
+  });
+  return found;
+}
+function frontierIdFor(host) {
+  return (0, import_types3.frontierId)(host);
+}
+function ensureServiceNode(graph, serviceName) {
+  const id = (0, import_types3.serviceId)(serviceName);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: import_types3.NodeType.ServiceNode,
+    name: serviceName,
+    language: "unknown",
+    discoveredVia: "otel"
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function ensureDatabaseNode(graph, host, engine) {
+  const id = (0, import_types3.databaseId)(host);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: import_types3.NodeType.DatabaseNode,
+    name: host,
+    engine,
+    engineVersion: "unknown",
+    compatibleDrivers: [],
+    host,
+    discoveredVia: "otel"
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function ensureFrontierNode(graph, host, ts) {
+  const id = frontierIdFor(host);
+  if (graph.hasNode(id)) {
+    const existing = graph.getNodeAttributes(id);
+    graph.replaceNodeAttributes(id, { ...existing, lastObserved: ts });
+    return id;
+  }
+  const node = {
+    id,
+    type: import_types3.NodeType.FrontierNode,
+    name: host,
+    host,
+    firstObserved: ts,
+    lastObserved: ts
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function upsertFrontierEdge(graph, type, source, target, ts) {
+  const id = (0, import_types3.frontierEdgeId)(source, target, type);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const updated = {
+      ...existing,
+      provenance: import_types3.Provenance.FRONTIER,
+      lastObserved: ts,
+      callCount: (existing.callCount ?? 0) + 1
+    };
+    graph.replaceEdgeAttributes(id, updated);
+    return;
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: import_types3.Provenance.FRONTIER,
+    confidence: 1,
+    lastObserved: ts,
+    callCount: 1
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+}
+function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
+  if (!graph.hasNode(source) || !graph.hasNode(target)) return null;
+  const id = makeObservedEdgeId(type, source, target);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const newSpanCount = (existing.signal?.spanCount ?? existing.callCount ?? 0) + 1;
+    const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
+    const updated = {
+      ...existing,
+      provenance: import_types3.Provenance.OBSERVED,
+      lastObserved: ts,
+      callCount: newSpanCount,
+      signal: {
+        spanCount: newSpanCount,
+        errorCount: newErrorCount,
+        lastObservedAgeMs: 0
+      },
+      confidence: 1
+    };
+    graph.replaceEdgeAttributes(id, updated);
+    return { edge: updated, created: false };
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: import_types3.Provenance.OBSERVED,
+    confidence: 1,
+    lastObserved: ts,
+    callCount: 1,
+    signal: {
+      spanCount: 1,
+      errorCount: isError ? 1 : 0,
+      lastObservedAgeMs: 0
+    }
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+  return { edge, created: true };
+}
+function stitchTrace(graph, sourceServiceId, ts) {
+  if (!graph.hasNode(sourceServiceId)) return;
+  const visited = /* @__PURE__ */ new Set([sourceServiceId]);
+  const queue = [{ nodeId: sourceServiceId, depth: 0 }];
+  while (queue.length > 0) {
+    const { nodeId, depth } = queue.shift();
+    if (depth >= STITCH_MAX_DEPTH) continue;
+    const outbound = graph.outboundEdges(nodeId);
+    for (const edgeId of outbound) {
+      const edge = graph.getEdgeAttributes(edgeId);
+      if (edge.provenance !== import_types3.Provenance.EXTRACTED) continue;
+      if (graph.hasEdge((0, import_types3.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
+      upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
+      if (!visited.has(edge.target)) {
+        visited.add(edge.target);
+        queue.push({ nodeId: edge.target, depth: depth + 1 });
+      }
+    }
+  }
+}
+function upsertInferredEdge(graph, type, source, target, ts) {
+  const id = makeInferredEdgeId(type, source, target);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const updated = { ...existing, lastObserved: ts };
+    graph.replaceEdgeAttributes(id, updated);
+    return;
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: import_types3.Provenance.INFERRED,
+    confidence: INFERRED_CONFIDENCE,
+    lastObserved: ts
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+}
+async function appendErrorEvent(ctx, ev) {
+  await import_node_fs3.promises.mkdir(import_node_path3.default.dirname(ctx.errorsPath), { recursive: true });
+  await import_node_fs3.promises.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
+}
+function buildErrorEventForReceiver(span) {
+  if (span.statusCode !== 2) return null;
+  const ts = span.startTimeIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    id: `${span.traceId}:${span.spanId}`,
+    timestamp: ts,
+    service: span.service,
+    traceId: span.traceId,
+    spanId: span.spanId,
+    errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+    ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+    ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+    affectedNode: (0, import_types3.serviceId)(span.service)
+  };
+}
+function makeErrorSpanWriter(errorsPath) {
+  return async (span) => {
+    const ev = buildErrorEventForReceiver(span);
+    if (!ev) return;
+    await import_node_fs3.promises.mkdir(import_node_path3.default.dirname(errorsPath), { recursive: true });
+    await import_node_fs3.promises.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
+  };
+}
+async function handleSpan(ctx, span) {
+  const ts = span.startTimeIso ?? nowIso(ctx);
+  const nowMs = ctx.now ? ctx.now() : Date.now();
+  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const isError = span.statusCode === 2;
+  cacheSpanService(span, nowMs);
+  let affectedNode = sourceId;
+  if (span.dbSystem) {
+    const host = pickAddress(span);
+    if (host) {
+      ensureDatabaseNode(ctx.graph, host, span.dbSystem);
+      const targetId = (0, import_types3.databaseId)(host);
+      const result = upsertObservedEdge(
+        ctx.graph,
+        import_types3.EdgeType.CONNECTS_TO,
+        sourceId,
+        targetId,
+        ts,
+        isError
+      );
+      if (result) affectedNode = targetId;
+    }
+  } else {
+    const host = pickAddress(span);
+    let resolvedViaAddress = false;
+    if (host && host !== span.service) {
+      const targetId = resolveServiceId(ctx.graph, host);
+      if (targetId && targetId !== sourceId) {
+        upsertObservedEdge(
+          ctx.graph,
+          import_types3.EdgeType.CALLS,
+          sourceId,
+          targetId,
+          ts,
+          isError
+        );
+        affectedNode = targetId;
+        resolvedViaAddress = true;
+      } else if (!targetId) {
+        const frontierId2 = ensureFrontierNode(ctx.graph, host, ts);
+        if (ctx.graph.hasNode(sourceId)) {
+          upsertFrontierEdge(ctx.graph, import_types3.EdgeType.CALLS, sourceId, frontierId2, ts);
+        }
+        affectedNode = frontierId2;
+        resolvedViaAddress = true;
+      }
+    }
+    if (!resolvedViaAddress && span.parentSpanId) {
+      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
+      if (parentService && parentService !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parentService);
+        upsertObservedEdge(
+          ctx.graph,
+          import_types3.EdgeType.CALLS,
+          parentId,
+          sourceId,
+          ts,
+          isError
+        );
+      }
+    }
+  }
+  if (span.statusCode === 2) {
+    stitchTrace(ctx.graph, sourceId, ts);
+    if (ctx.writeErrorEventInline !== false) {
+      const ev = {
+        id: `${span.traceId}:${span.spanId}`,
+        timestamp: ts,
+        service: span.service,
+        traceId: span.traceId,
+        spanId: span.spanId,
+        errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+        ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+        ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+        affectedNode
+      };
+      await appendErrorEvent(ctx, ev);
+    }
+  }
+  void affectedNode;
+  if (ctx.onPolicyTrigger) await ctx.onPolicyTrigger(ctx.graph);
+}
 function promoteFrontierNodes(graph, opts = {}) {
   const aliasIndex = /* @__PURE__ */ new Map();
   graph.forEachNode((id, attrs) => {
@@ -927,8 +1764,27 @@ function pickLater(a, b) {
   if (!b) return a;
   return new Date(a).getTime() >= new Date(b).getTime() ? a : b;
 }
+async function readStaleEvents(staleEventsPath) {
+  try {
+    const raw = await import_node_fs3.promises.readFile(staleEventsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+async function readErrorEvents(errorsPath) {
+  try {
+    const raw = await import_node_fs3.promises.readFile(errorsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
 
 // src/extract/services.ts
+init_cjs_shims();
 var import_node_fs7 = require("fs");
 var import_node_path7 = __toESM(require("path"), 1);
 var import_ignore = __toESM(require("ignore"), 1);
@@ -936,6 +1792,7 @@ var import_minimatch2 = require("minimatch");
 var import_types5 = require("@neat.is/types");
 
 // src/extract/shared.ts
+init_cjs_shims();
 var import_node_fs4 = require("fs");
 var import_node_path4 = __toESM(require("path"), 1);
 var import_yaml = require("yaml");
@@ -978,6 +1835,7 @@ async function exists(p) {
 }
 
 // src/extract/python.ts
+init_cjs_shims();
 var import_node_fs5 = require("fs");
 var import_node_path5 = __toESM(require("path"), 1);
 var import_smol_toml = require("smol-toml");
@@ -1044,6 +1902,7 @@ function pythonToPackage(service) {
 }
 
 // src/extract/owners.ts
+init_cjs_shims();
 var import_node_fs6 = require("fs");
 var import_node_path6 = __toESM(require("path"), 1);
 var import_minimatch = require("minimatch");
@@ -1294,6 +2153,7 @@ function addServiceNodes(graph, services) {
 }
 
 // src/extract/aliases.ts
+init_cjs_shims();
 var import_node_path8 = __toESM(require("path"), 1);
 var import_node_fs8 = require("fs");
 var import_yaml2 = require("yaml");
@@ -1458,10 +2318,12 @@ async function addServiceAliases(graph, scanPath, services) {
 }
 
 // src/extract/databases/index.ts
+init_cjs_shims();
 var import_node_path16 = __toESM(require("path"), 1);
 var import_types7 = require("@neat.is/types");
 
 // src/extract/databases/db-config-yaml.ts
+init_cjs_shims();
 var import_node_path9 = __toESM(require("path"), 1);
 async function parse(serviceDir) {
   const yamlPath = import_node_path9.default.join(serviceDir, "db-config.yaml");
@@ -1481,10 +2343,12 @@ async function parse(serviceDir) {
 var dbConfigYamlParser = { name: "db-config.yaml", parse };
 
 // src/extract/databases/dotenv.ts
+init_cjs_shims();
 var import_node_fs10 = require("fs");
 var import_node_path11 = __toESM(require("path"), 1);
 
 // src/extract/databases/shared.ts
+init_cjs_shims();
 var import_node_fs9 = require("fs");
 var import_node_path10 = __toESM(require("path"), 1);
 function schemeToEngine(scheme) {
@@ -1609,6 +2473,7 @@ async function parse2(serviceDir) {
 var dotenvParser = { name: ".env", parse: parse2 };
 
 // src/extract/databases/prisma.ts
+init_cjs_shims();
 var import_node_path12 = __toESM(require("path"), 1);
 async function parse3(serviceDir) {
   const schemaPath = import_node_path12.default.join(serviceDir, "prisma", "schema.prisma");
@@ -1639,6 +2504,7 @@ async function parse3(serviceDir) {
 var prismaParser = { name: "prisma", parse: parse3 };
 
 // src/extract/databases/drizzle.ts
+init_cjs_shims();
 var DIALECT_TO_ENGINE = {
   postgresql: "postgresql",
   postgres: "postgresql",
@@ -1690,6 +2556,7 @@ async function parse4(serviceDir) {
 var drizzleParser = { name: "drizzle", parse: parse4 };
 
 // src/extract/databases/knex.ts
+init_cjs_shims();
 var CLIENT_TO_ENGINE = {
   pg: "postgresql",
   postgres: "postgresql",
@@ -1740,6 +2607,7 @@ async function parse5(serviceDir) {
 var knexParser = { name: "knex", parse: parse5 };
 
 // src/extract/databases/ormconfig.ts
+init_cjs_shims();
 var import_node_path13 = __toESM(require("path"), 1);
 async function parse6(serviceDir) {
   for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
@@ -1768,6 +2636,7 @@ async function parse6(serviceDir) {
 var ormconfigParser = { name: "ormconfig", parse: parse6 };
 
 // src/extract/databases/typeorm.ts
+init_cjs_shims();
 async function parse7(serviceDir) {
   const filePath = await findFirst(serviceDir, [
     "data-source.ts",
@@ -1801,6 +2670,7 @@ async function parse7(serviceDir) {
 var typeormParser = { name: "typeorm", parse: parse7 };
 
 // src/extract/databases/sequelize.ts
+init_cjs_shims();
 var import_node_path14 = __toESM(require("path"), 1);
 async function parse8(serviceDir) {
   const configPath = import_node_path14.default.join(serviceDir, "config", "config.json");
@@ -1829,6 +2699,7 @@ async function parse8(serviceDir) {
 var sequelizeParser = { name: "sequelize", parse: parse8 };
 
 // src/extract/databases/docker-compose.ts
+init_cjs_shims();
 var import_node_path15 = __toESM(require("path"), 1);
 function portFromService(svc) {
   for (const raw of svc.ports ?? []) {
@@ -2063,6 +2934,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 }
 
 // src/extract/configs.ts
+init_cjs_shims();
 var import_node_fs11 = require("fs");
 var import_node_path17 = __toESM(require("path"), 1);
 var import_types8 = require("@neat.is/types");
@@ -2118,9 +2990,11 @@ async function addConfigNodes(graph, services, scanPath) {
 }
 
 // src/extract/calls/index.ts
+init_cjs_shims();
 var import_types14 = require("@neat.is/types");
 
 // src/extract/calls/http.ts
+init_cjs_shims();
 var import_node_path19 = __toESM(require("path"), 1);
 var import_tree_sitter = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript = __toESM(require("tree-sitter-javascript"), 1);
@@ -2128,6 +3002,7 @@ var import_tree_sitter_python = __toESM(require("tree-sitter-python"), 1);
 var import_types9 = require("@neat.is/types");
 
 // src/extract/calls/shared.ts
+init_cjs_shims();
 var import_node_fs12 = require("fs");
 var import_node_path18 = __toESM(require("path"), 1);
 async function walkSourceFiles(dir) {
@@ -2260,6 +3135,7 @@ async function addHttpCallEdges(graph, services) {
 }
 
 // src/extract/calls/kafka.ts
+init_cjs_shims();
 var import_node_path20 = __toESM(require("path"), 1);
 var import_types10 = require("@neat.is/types");
 var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
@@ -2299,6 +3175,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/redis.ts
+init_cjs_shims();
 var import_node_path21 = __toESM(require("path"), 1);
 var import_types11 = require("@neat.is/types");
 var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
@@ -2328,6 +3205,7 @@ function redisEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/aws.ts
+init_cjs_shims();
 var import_node_path22 = __toESM(require("path"), 1);
 var import_types12 = require("@neat.is/types");
 var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
@@ -2382,6 +3260,7 @@ function awsEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/grpc.ts
+init_cjs_shims();
 var import_node_path23 = __toESM(require("path"), 1);
 var import_types13 = require("@neat.is/types");
 var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
@@ -2482,11 +3361,16 @@ async function addCallEdges(graph, services) {
   };
 }
 
+// src/extract/infra/index.ts
+init_cjs_shims();
+
 // src/extract/infra/docker-compose.ts
+init_cjs_shims();
 var import_node_path24 = __toESM(require("path"), 1);
 var import_types16 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
+init_cjs_shims();
 var import_types15 = require("@neat.is/types");
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
@@ -2586,6 +3470,7 @@ async function addComposeInfra(graph, scanPath, services) {
 }
 
 // src/extract/infra/dockerfile.ts
+init_cjs_shims();
 var import_node_path25 = __toESM(require("path"), 1);
 var import_node_fs13 = require("fs");
 var import_types17 = require("@neat.is/types");
@@ -2645,6 +3530,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 }
 
 // src/extract/infra/terraform.ts
+init_cjs_shims();
 var import_node_fs14 = require("fs");
 var import_node_path26 = __toESM(require("path"), 1);
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
@@ -2683,6 +3569,7 @@ async function addTerraformResources(graph, scanPath) {
 }
 
 // src/extract/infra/k8s.ts
+init_cjs_shims();
 var import_node_fs15 = require("fs");
 var import_node_path27 = __toESM(require("path"), 1);
 var import_yaml3 = require("yaml");
@@ -2778,6 +3665,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 }
 
 // src/persist.ts
+init_cjs_shims();
 var import_node_fs16 = require("fs");
 var import_node_path28 = __toESM(require("path"), 1);
 var SCHEMA_VERSION = 2;
@@ -2861,6 +3749,7 @@ function startPersistLoop(graph, outPath, intervalMs = 6e4) {
 }
 
 // src/projects.ts
+init_cjs_shims();
 var import_node_path29 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
@@ -2880,12 +3769,363 @@ function pathsForProject(project, baseDir) {
     policyViolationsPath: import_node_path29.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
+var Projects = class {
+  contexts = /* @__PURE__ */ new Map();
+  upsert(ctx) {
+    this.contexts.set(ctx.name, ctx);
+  }
+  set(name, init) {
+    const ctx = {
+      name,
+      graph: init.graph ?? getGraph(name),
+      scanPath: init.scanPath,
+      paths: init.paths,
+      searchIndex: init.searchIndex
+    };
+    this.contexts.set(name, ctx);
+    return ctx;
+  }
+  get(name) {
+    return this.contexts.get(name);
+  }
+  has(name) {
+    return this.contexts.has(name);
+  }
+  list() {
+    return [...this.contexts.keys()].sort();
+  }
+  attachSearchIndex(name, index) {
+    const ctx = this.contexts.get(name);
+    if (ctx) ctx.searchIndex = index;
+  }
+};
 
-// src/registry.ts
+// src/api.ts
+init_cjs_shims();
+var import_fastify = __toESM(require("fastify"), 1);
+var import_cors = __toESM(require("@fastify/cors"), 1);
+var import_types20 = require("@neat.is/types");
+
+// src/divergences.ts
+init_cjs_shims();
+var import_types18 = require("@neat.is/types");
+function bucketKey(source, target, type) {
+  return `${type}|${source}|${target}`;
+}
+function bucketEdges(graph) {
+  const buckets = /* @__PURE__ */ new Map();
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    const parsed = (0, import_types18.parseEdgeId)(id);
+    const provenance = parsed?.provenance ?? e.provenance;
+    const key = bucketKey(e.source, e.target, e.type);
+    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    switch (provenance) {
+      case import_types18.Provenance.EXTRACTED:
+        cur.extracted = e;
+        break;
+      case import_types18.Provenance.OBSERVED:
+        cur.observed = e;
+        break;
+      case import_types18.Provenance.INFERRED:
+        cur.inferred = e;
+        break;
+      case import_types18.Provenance.FRONTIER:
+        cur.frontier = e;
+        break;
+      default:
+        if (e.provenance === import_types18.Provenance.STALE) cur.stale = e;
+    }
+    buckets.set(key, cur);
+  });
+  return buckets;
+}
+function nodeIsFrontier(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === import_types18.NodeType.FrontierNode;
+}
+function hasAnyObservedFromSource(graph, sourceId) {
+  if (!graph.hasNode(sourceId)) return false;
+  for (const edgeId of graph.outboundEdges(sourceId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.provenance === import_types18.Provenance.OBSERVED) return true;
+  }
+  return false;
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(1, n));
+}
+function reasonForMissingObserved(source, target, type) {
+  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
+}
+function reasonForMissingExtracted(source, target, type) {
+  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
+}
+var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
+var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
+var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function detectMissingDivergences(graph, bucket) {
+  const out = [];
+  if (bucket.extracted && !bucket.observed) {
+    if (!nodeIsFrontier(graph, bucket.target)) {
+      const sourceHasTraffic = hasAnyObservedFromSource(graph, bucket.source);
+      out.push({
+        type: "missing-observed",
+        source: bucket.source,
+        target: bucket.target,
+        edgeType: bucket.type,
+        extracted: bucket.extracted,
+        confidence: sourceHasTraffic ? 1 : 0.5,
+        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
+        recommendation: RECOMMENDATION_MISSING_OBSERVED
+      });
+    }
+  }
+  if (bucket.observed && !bucket.extracted) {
+    const cascaded = clampConfidence(confidenceForEdge(bucket.observed));
+    out.push({
+      type: "missing-extracted",
+      source: bucket.source,
+      target: bucket.target,
+      edgeType: bucket.type,
+      observed: bucket.observed,
+      confidence: cascaded,
+      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
+      recommendation: RECOMMENDATION_MISSING_EXTRACTED
+    });
+  }
+  return out;
+}
+function declaredHostFor(svc) {
+  const raw = svc.dbConnectionTarget?.trim();
+  if (!raw) return null;
+  const colon = raw.lastIndexOf(":");
+  if (colon === -1) return raw;
+  const port = raw.slice(colon + 1);
+  if (/^\d+$/.test(port)) return raw.slice(0, colon);
+  return raw;
+}
+function hasExtractedConfiguredBy(graph, svcId) {
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type === import_types18.EdgeType.CONFIGURED_BY && e.provenance === import_types18.Provenance.EXTRACTED) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectHostMismatch(graph, svcId, svc) {
+  const declaredHost = declaredHostFor(svc);
+  if (!declaredHost) return [];
+  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
+  const out = [];
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== import_types18.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types18.Provenance.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== import_types18.NodeType.DatabaseNode) continue;
+    const observedHost = target.host?.trim();
+    if (!observedHost) continue;
+    if (observedHost === declaredHost) continue;
+    out.push({
+      type: "host-mismatch",
+      source: svcId,
+      target: edge.target,
+      extractedHost: declaredHost,
+      observedHost,
+      confidence: clampConfidence(confidenceForEdge(edge)),
+      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
+      recommendation: RECOMMENDATION_HOST_MISMATCH
+    });
+  }
+  return out;
+}
+function detectCompatDivergences(graph, svcId, svc) {
+  const out = [];
+  const deps = svc.dependencies ?? {};
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== import_types18.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types18.Provenance.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== import_types18.NodeType.DatabaseNode) continue;
+    for (const pair of compatPairs()) {
+      if (pair.engine !== target.engine) continue;
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        target.engine,
+        target.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        out.push({
+          type: "version-mismatch",
+          source: svcId,
+          target: edge.target,
+          extractedVersion: declared,
+          observedVersion: target.engineVersion,
+          compatibility: "incompatible",
+          confidence: 1,
+          reason: result.reason,
+          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
+        });
+      }
+    }
+    for (const rule of deprecatedApis()) {
+      const declared = deps[rule.package];
+      if (!declared) continue;
+      const result = checkDeprecatedApi(rule, declared);
+      if (!result.compatible && result.reason) {
+        const ruleRef = {
+          kind: rule.kind ?? "deprecated-api",
+          reason: result.reason,
+          package: rule.package
+        };
+        out.push({
+          type: "compat-violation",
+          source: svcId,
+          target: edge.target,
+          rule: ruleRef,
+          observed: edge,
+          confidence: 1,
+          reason: result.reason,
+          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
+        });
+      }
+    }
+  }
+  return out;
+}
+function involvesNode(d, nodeId) {
+  return d.source === nodeId || d.target === nodeId;
+}
+function computeDivergences(graph, opts = {}) {
+  const all = [];
+  const buckets = bucketEdges(graph);
+  for (const bucket of buckets.values()) {
+    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
+  }
+  graph.forEachNode((nodeId, attrs) => {
+    const n = attrs;
+    if (n.type !== import_types18.NodeType.ServiceNode) return;
+    const svc = n;
+    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
+    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+  });
+  let filtered = all;
+  if (opts.type) {
+    const allowed = opts.type;
+    filtered = filtered.filter((d) => allowed.has(d.type));
+  }
+  if (opts.minConfidence !== void 0) {
+    const threshold = opts.minConfidence;
+    filtered = filtered.filter((d) => d.confidence >= threshold);
+  }
+  if (opts.node) {
+    const target = opts.node;
+    filtered = filtered.filter((d) => involvesNode(d, target));
+  }
+  filtered.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    if (a.type !== b.type) return a.type.localeCompare(b.type);
+    if (a.source !== b.source) return a.source.localeCompare(b.source);
+    return a.target.localeCompare(b.target);
+  });
+  return import_types18.DivergenceResultSchema.parse({
+    divergences: filtered,
+    totalAffected: filtered.length,
+    computedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/diff.ts
+init_cjs_shims();
 var import_node_fs17 = require("fs");
+async function loadSnapshotForDiff(target) {
+  if (/^https?:\/\//i.test(target)) {
+    const res = await fetch(target);
+    if (!res.ok) {
+      throw new Error(`fetch ${target} failed: ${res.status} ${res.statusText}`);
+    }
+    return await res.json();
+  }
+  const raw = await import_node_fs17.promises.readFile(target, "utf8");
+  return JSON.parse(raw);
+}
+function indexEntries(entries) {
+  const m = /* @__PURE__ */ new Map();
+  if (!entries) return m;
+  for (const entry2 of entries) {
+    const id = entry2.attributes?.id ?? entry2.key;
+    if (!id) continue;
+    m.set(id, entry2.attributes);
+  }
+  return m;
+}
+function computeGraphDiff(liveGraph, baseSnapshot, currentExportedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const baseNodes = indexEntries(baseSnapshot.graph?.nodes);
+  const baseEdges = indexEntries(baseSnapshot.graph?.edges);
+  const liveNodes = /* @__PURE__ */ new Map();
+  liveGraph.forEachNode((id, attrs) => liveNodes.set(id, attrs));
+  const liveEdges = /* @__PURE__ */ new Map();
+  liveGraph.forEachEdge((id, attrs) => liveEdges.set(id, attrs));
+  const result = {
+    base: { exportedAt: baseSnapshot.exportedAt },
+    current: { exportedAt: currentExportedAt },
+    added: { nodes: [], edges: [] },
+    removed: { nodes: [], edges: [] },
+    changed: { nodes: [], edges: [] }
+  };
+  for (const [id, after] of liveNodes) {
+    const before = baseNodes.get(id);
+    if (!before) {
+      result.added.nodes.push(after);
+    } else if (!shallowEqual(before, after)) {
+      result.changed.nodes.push({ id, before, after });
+    }
+  }
+  for (const [id, before] of baseNodes) {
+    if (!liveNodes.has(id)) result.removed.nodes.push(before);
+  }
+  for (const [id, after] of liveEdges) {
+    const before = baseEdges.get(id);
+    if (!before) {
+      result.added.edges.push(after);
+    } else if (!shallowEqual(before, after)) {
+      result.changed.edges.push({ id, before, after });
+    }
+  }
+  for (const [id, before] of baseEdges) {
+    if (!liveEdges.has(id)) result.removed.edges.push(before);
+  }
+  return result;
+}
+function shallowEqual(a, b) {
+  return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(value) {
+  return JSON.stringify(value, (_key, v) => {
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      return Object.keys(v).sort().reduce((acc, k) => {
+        acc[k] = v[k];
+        return acc;
+      }, {});
+    }
+    return v;
+  });
+}
+
+// src/registry.ts
+init_cjs_shims();
+var import_node_fs18 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
 var import_node_path30 = __toESM(require("path"), 1);
-var import_types18 = require("@neat.is/types");
+var import_types19 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
@@ -2900,23 +4140,23 @@ function registryLockPath() {
   return import_node_path30.default.join(neatHome(), "projects.json.lock");
 }
 async function writeAtomically(target, contents) {
-  await import_node_fs17.promises.mkdir(import_node_path30.default.dirname(target), { recursive: true });
+  await import_node_fs18.promises.mkdir(import_node_path30.default.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await import_node_fs17.promises.open(tmp, "w");
+  const fd = await import_node_fs18.promises.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await import_node_fs17.promises.rename(tmp, target);
+  await import_node_fs18.promises.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await import_node_fs17.promises.mkdir(import_node_path30.default.dirname(lockPath), { recursive: true });
+  await import_node_fs18.promises.mkdir(import_node_path30.default.dirname(lockPath), { recursive: true });
   while (true) {
     try {
-      const fd = await import_node_fs17.promises.open(lockPath, "wx");
+      const fd = await import_node_fs18.promises.open(lockPath, "wx");
       await fd.close();
       return;
     } catch (err) {
@@ -2932,7 +4172,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
   }
 }
 async function releaseLock(lockPath) {
-  await import_node_fs17.promises.unlink(lockPath).catch(() => {
+  await import_node_fs18.promises.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -2948,7 +4188,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await import_node_fs17.promises.readFile(file, "utf8");
+    raw = await import_node_fs18.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -2956,22 +4196,26 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types18.RegistryFileSchema.parse(parsed);
+  return import_types19.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types18.RegistryFileSchema.parse(reg);
+  const validated = import_types19.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
+async function getProject(name) {
+  const reg = await readRegistry();
+  return reg.projects.find((p) => p.name === name);
+}
 async function listProjects() {
   const reg = await readRegistry();
   return reg.projects;
 }
-async function setStatus(name, status) {
+async function setStatus(name, status2) {
   return withLock(async () => {
     const reg = await readRegistry();
     const entry2 = reg.projects.find((p) => p.name === name);
     if (!entry2) throw new Error(`neat registry: no project named "${name}"`);
-    entry2.status = status;
+    entry2.status = status2;
     await writeRegistry(reg);
     return entry2;
   });
@@ -2986,17 +4230,511 @@ async function touchLastSeen(name, at = (/* @__PURE__ */ new Date()).toISOString
   });
 }
 
+// src/streaming.ts
+init_cjs_shims();
+var SSE_HEARTBEAT_MS = 3e4;
+var SSE_BACKPRESSURE_CAP = 1e3;
+function handleSse(req2, reply, opts) {
+  const heartbeatMs = opts.heartbeatMs ?? SSE_HEARTBEAT_MS;
+  const backpressureCap = opts.backpressureCap ?? SSE_BACKPRESSURE_CAP;
+  reply.raw.setHeader("Content-Type", "text/event-stream");
+  reply.raw.setHeader("Cache-Control", "no-cache, no-transform");
+  reply.raw.setHeader("Connection", "keep-alive");
+  reply.raw.setHeader("X-Accel-Buffering", "no");
+  reply.raw.flushHeaders?.();
+  let pending = 0;
+  let dropped = false;
+  const closeConnection = () => {
+    if (dropped) return;
+    dropped = true;
+    eventBus.off(EVENT_BUS_CHANNEL, listener);
+    clearInterval(heartbeat);
+    if (!reply.raw.writableEnded) reply.raw.end();
+  };
+  const writeFrame = (frame) => {
+    if (dropped) return;
+    if (pending >= backpressureCap) {
+      const errFrame = `event: error
+data: ${JSON.stringify({ reason: "backpressure" })}
+
+`;
+      reply.raw.write(errFrame);
+      closeConnection();
+      return;
+    }
+    pending++;
+    reply.raw.write(frame, () => {
+      pending = Math.max(0, pending - 1);
+    });
+  };
+  const listener = (envelope) => {
+    if (envelope.project !== opts.project) return;
+    writeFrame(`event: ${envelope.type}
+data: ${JSON.stringify(envelope.payload)}
+
+`);
+  };
+  eventBus.on(EVENT_BUS_CHANNEL, listener);
+  const heartbeat = setInterval(() => {
+    if (dropped) return;
+    reply.raw.write(":heartbeat\n\n");
+  }, heartbeatMs);
+  if (typeof heartbeat.unref === "function") heartbeat.unref();
+  req2.raw.on("close", closeConnection);
+  reply.raw.on("close", closeConnection);
+  reply.raw.on("error", closeConnection);
+}
+
+// src/api.ts
+function serializeGraph(graph) {
+  const nodes = [];
+  graph.forEachNode((_id, attrs) => {
+    nodes.push(attrs);
+  });
+  const edges = [];
+  graph.forEachEdge((_id, attrs) => {
+    edges.push(attrs);
+  });
+  return { nodes, edges };
+}
+function projectFromReq(req2) {
+  const params = req2.params;
+  return params.project ?? DEFAULT_PROJECT;
+}
+function resolveProject(registry, req2, reply) {
+  const name = projectFromReq(req2);
+  const ctx = registry.get(name);
+  if (!ctx) {
+    void reply.code(404).send({ error: "project not found", project: name });
+    return null;
+  }
+  return ctx;
+}
+function buildLegacyRegistry(opts) {
+  if (opts.projects) return opts.projects;
+  if (!opts.graph) {
+    throw new Error("buildApi: either `projects` or `graph` must be provided");
+  }
+  const registry = new Projects();
+  const paths = pathsForProject(DEFAULT_PROJECT, "");
+  registry.set(DEFAULT_PROJECT, {
+    graph: opts.graph,
+    scanPath: opts.scanPath,
+    paths: {
+      snapshotPath: paths.snapshotPath,
+      errorsPath: opts.errorsPath ?? paths.errorsPath,
+      staleEventsPath: opts.staleEventsPath ?? paths.staleEventsPath,
+      embeddingsCachePath: paths.embeddingsCachePath,
+      policyViolationsPath: paths.policyViolationsPath
+    },
+    searchIndex: opts.searchIndex
+  });
+  return registry;
+}
+function registerRoutes(scope, ctx) {
+  const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
+  scope.get("/events", (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    handleSse(req2, reply, { project: proj.name });
+  });
+  scope.get("/health", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const uptimeMs = Date.now() - startedAt;
+    return {
+      ok: true,
+      project: proj.name,
+      uptimeMs,
+      // Legacy fields kept additively. The web shell's StatusBar reads
+      // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
+      // the canonical triple and lets the extras pass through.
+      uptime: Math.floor(uptimeMs / 1e3),
+      nodeCount: proj.graph.order,
+      edgeCount: proj.graph.size,
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  });
+  scope.get("/graph", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    return serializeGraph(proj.graph);
+  });
+  scope.get(
+    "/graph/node/:id",
+    async (req2, reply) => {
+      const proj = resolveProject(registry, req2, reply);
+      if (!proj) return;
+      const { id } = req2.params;
+      if (!proj.graph.hasNode(id)) {
+        return reply.code(404).send({ error: "node not found", id });
+      }
+      return { node: proj.graph.getNodeAttributes(id) };
+    }
+  );
+  scope.get(
+    "/graph/edges/:id",
+    async (req2, reply) => {
+      const proj = resolveProject(registry, req2, reply);
+      if (!proj) return;
+      const { id } = req2.params;
+      if (!proj.graph.hasNode(id)) {
+        return reply.code(404).send({ error: "node not found", id });
+      }
+      const inbound = proj.graph.inboundEdges(id).map((e) => proj.graph.getEdgeAttributes(e));
+      const outbound = proj.graph.outboundEdges(id).map((e) => proj.graph.getEdgeAttributes(e));
+      return { inbound, outbound };
+    }
+  );
+  scope.get("/graph/dependencies/:nodeId", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const { nodeId } = req2.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    const depth = req2.query.depth ? Number(req2.query.depth) : TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH;
+    if (!Number.isFinite(depth) || depth < 1 || depth > TRANSITIVE_DEPENDENCIES_MAX_DEPTH) {
+      return reply.code(400).send({
+        error: `depth must be an integer in [1, ${TRANSITIVE_DEPENDENCIES_MAX_DEPTH}]`
+      });
+    }
+    return getTransitiveDependencies(proj.graph, nodeId, depth);
+  });
+  scope.get("/graph/divergences", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    let typeFilter;
+    if (req2.query.type) {
+      const candidates = req2.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+      const parsed = [];
+      for (const c of candidates) {
+        const r = import_types20.DivergenceTypeSchema.safeParse(c);
+        if (!r.success) {
+          return reply.code(400).send({
+            error: `unknown divergence type "${c}"`,
+            allowed: import_types20.DivergenceTypeSchema.options
+          });
+        }
+        parsed.push(r.data);
+      }
+      typeFilter = new Set(parsed);
+    }
+    let minConfidence;
+    if (req2.query.minConfidence !== void 0) {
+      const n = Number(req2.query.minConfidence);
+      if (!Number.isFinite(n) || n < 0 || n > 1) {
+        return reply.code(400).send({
+          error: "minConfidence must be a number in [0, 1]"
+        });
+      }
+      minConfidence = n;
+    }
+    return computeDivergences(proj.graph, {
+      ...typeFilter ? { type: typeFilter } : {},
+      ...minConfidence !== void 0 ? { minConfidence } : {},
+      ...req2.query.node ? { node: req2.query.node } : {}
+    });
+  });
+  scope.get("/incidents", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const epath = errorsPathFor(proj);
+    if (!epath) return { count: 0, total: 0, events: [] };
+    const events = await readErrorEvents(epath);
+    const total = events.length;
+    const limit = req2.query.limit ? Number(req2.query.limit) : 50;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, 200) : 50;
+    const sliced = events.slice(0, safeLimit);
+    return { count: sliced.length, total, events: sliced };
+  });
+  scope.get("/stale-events", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const spath = staleEventsPathFor(proj);
+    if (!spath) return { count: 0, total: 0, events: [] };
+    const events = await readStaleEvents(spath);
+    const filtered = req2.query.edgeType ? events.filter((e) => e.edgeType === req2.query.edgeType) : events;
+    const ordered = [...filtered].reverse();
+    const total = ordered.length;
+    const limit = req2.query.limit ? Number(req2.query.limit) : 50;
+    const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
+    return { count: sliced.length, total, events: sliced };
+  });
+  scope.get(
+    "/incidents/:nodeId",
+    async (req2, reply) => {
+      const proj = resolveProject(registry, req2, reply);
+      if (!proj) return;
+      const { nodeId } = req2.params;
+      if (!proj.graph.hasNode(nodeId)) {
+        return reply.code(404).send({ error: "node not found", id: nodeId });
+      }
+      const epath = errorsPathFor(proj);
+      if (!epath) return { count: 0, total: 0, events: [] };
+      const events = await readErrorEvents(epath);
+      const filtered = events.filter(
+        (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
+      );
+      return { count: filtered.length, total: filtered.length, events: filtered };
+    }
+  );
+  scope.get("/graph/root-cause/:nodeId", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const { nodeId } = req2.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    let errorEvent;
+    const epath = errorsPathFor(proj);
+    if (req2.query.errorId && epath) {
+      const events = await readErrorEvents(epath);
+      errorEvent = events.find((e) => e.id === req2.query.errorId);
+      if (!errorEvent) {
+        return reply.code(404).send({ error: "error event not found", id: req2.query.errorId });
+      }
+    }
+    const result = getRootCause(proj.graph, nodeId, errorEvent);
+    if (!result) return reply.code(404).send({ error: "no root cause found", id: nodeId });
+    return result;
+  });
+  scope.get("/graph/blast-radius/:nodeId", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const { nodeId } = req2.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    const depth = req2.query.depth ? Number(req2.query.depth) : void 0;
+    if (depth !== void 0 && (!Number.isFinite(depth) || depth < 0)) {
+      return reply.code(400).send({ error: "depth must be a non-negative number" });
+    }
+    return getBlastRadius(proj.graph, nodeId, depth);
+  });
+  scope.get("/search", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const raw = (req2.query.q ?? "").trim();
+    if (!raw) return reply.code(400).send({ error: "query parameter `q` is required" });
+    const limit = req2.query.limit ? Number(req2.query.limit) : void 0;
+    const safeLimit = limit !== void 0 && Number.isFinite(limit) && limit > 0 ? limit : void 0;
+    if (proj.searchIndex) {
+      const result = await proj.searchIndex.search(raw, safeLimit);
+      return {
+        query: result.query,
+        provider: result.provider,
+        matches: result.matches.map((m) => ({ ...m.node, score: m.score }))
+      };
+    }
+    const q = raw.toLowerCase();
+    const matches = [];
+    proj.graph.forEachNode((id, attrs) => {
+      const name = attrs.name ?? "";
+      if (id.toLowerCase().includes(q) || name.toLowerCase().includes(q)) {
+        matches.push({ ...attrs, score: 1 });
+      }
+    });
+    return {
+      query: q,
+      provider: "substring",
+      matches: matches.slice(0, safeLimit)
+    };
+  });
+  scope.get(
+    "/graph/diff",
+    async (req2, reply) => {
+      const proj = resolveProject(registry, req2, reply);
+      if (!proj) return;
+      const against = req2.query.against;
+      if (!against) {
+        return reply.code(400).send({ error: "query parameter `against` is required" });
+      }
+      try {
+        const snapshot = await loadSnapshotForDiff(against);
+        return computeGraphDiff(proj.graph, snapshot);
+      } catch (err) {
+        return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
+      }
+    }
+  );
+  scope.post("/graph/scan", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    if (!proj.scanPath) {
+      return reply.code(409).send({ error: "scan path not configured for this project", project: proj.name });
+    }
+    const result = await extractFromDirectory(proj.graph, proj.scanPath);
+    return {
+      project: proj.name,
+      scanned: proj.scanPath,
+      nodesAdded: result.nodesAdded,
+      edgesAdded: result.edgesAdded,
+      nodeCount: proj.graph.order,
+      edgeCount: proj.graph.size
+    };
+  });
+  scope.get("/policies", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const policyPath = ctx.policyFilePathFor(proj);
+    if (!policyPath) {
+      return { version: 1, policies: [] };
+    }
+    try {
+      const policies = await loadPolicyFile(policyPath);
+      return { version: 1, policies };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "policy.json failed to parse",
+        details: err.message
+      });
+    }
+  });
+  scope.get("/policies/violations", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
+    let violations = await log.readAll();
+    if (req2.query.severity) {
+      const sev = import_types20.PolicySeveritySchema.safeParse(req2.query.severity);
+      if (!sev.success) {
+        return reply.code(400).send({
+          error: "invalid severity",
+          details: sev.error.format()
+        });
+      }
+      violations = violations.filter((v) => v.severity === sev.data);
+    }
+    if (req2.query.policyId) {
+      violations = violations.filter((v) => v.policyId === req2.query.policyId);
+    }
+    return { violations };
+  });
+  scope.post("/policies/check", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const parsed = import_types20.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
+    if (!parsed.success) {
+      return reply.code(400).send({
+        error: "invalid /policies/check body",
+        details: parsed.error.format()
+      });
+    }
+    const policyPath = ctx.policyFilePathFor(proj);
+    let policies = [];
+    if (policyPath) {
+      try {
+        policies = await loadPolicyFile(policyPath);
+      } catch (err) {
+        return reply.code(400).send({
+          error: "policy.json failed to parse",
+          details: err.message
+        });
+      }
+    }
+    const evalCtx = { now: () => Date.now() };
+    if (!parsed.data.hypotheticalAction) {
+      const violations2 = evaluateAllPolicies(proj.graph, policies, evalCtx);
+      const blocking2 = violations2.filter((v) => v.onViolation === "block");
+      return { allowed: blocking2.length === 0, violations: violations2 };
+    }
+    const violations = evaluateAllPolicies(proj.graph, policies, evalCtx);
+    const blocking = violations.filter((v) => v.onViolation === "block");
+    return {
+      allowed: blocking.length === 0,
+      hypotheticalAction: parsed.data.hypotheticalAction,
+      violations
+    };
+  });
+}
+async function buildApi(opts) {
+  const app = (0, import_fastify.default)({ logger: false });
+  await app.register(import_cors.default, { origin: true });
+  const startedAt = opts.startedAt ?? Date.now();
+  const registry = buildLegacyRegistry(opts);
+  const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
+  const legacyStaleExplicit = !opts.projects && opts.staleEventsPath !== void 0;
+  const errorsPathFor = (proj) => {
+    if (proj.name === DEFAULT_PROJECT && !opts.projects) {
+      return legacyErrorsExplicit ? opts.errorsPath : void 0;
+    }
+    return proj.paths.errorsPath;
+  };
+  const staleEventsPathFor = (proj) => {
+    if (proj.name === DEFAULT_PROJECT && !opts.projects) {
+      return legacyStaleExplicit ? opts.staleEventsPath : void 0;
+    }
+    return proj.paths.staleEventsPath;
+  };
+  const policyFilePathFor = (proj) => {
+    if (!proj.scanPath) return void 0;
+    return `${proj.scanPath}/policy.json`;
+  };
+  const routeCtx = {
+    registry,
+    startedAt,
+    errorsPathFor,
+    staleEventsPathFor,
+    policyFilePathFor
+  };
+  app.get("/projects", async (_req, reply) => {
+    try {
+      return await listProjects();
+    } catch (err) {
+      return reply.code(500).send({
+        error: "failed to read project registry",
+        details: err.message
+      });
+    }
+  });
+  app.get("/projects/:project", async (req2, reply) => {
+    try {
+      const entry2 = await getProject(req2.params.project);
+      if (!entry2) {
+        return reply.code(404).send({ error: "project not found", project: req2.params.project });
+      }
+      return { project: entry2 };
+    } catch (err) {
+      return reply.code(500).send({
+        error: "failed to read project registry",
+        details: err.message
+      });
+    }
+  });
+  registerRoutes(app, routeCtx);
+  await app.register(
+    async (scope) => {
+      registerRoutes(scope, routeCtx);
+    },
+    { prefix: "/projects/:project" }
+  );
+  return app;
+}
+
 // src/daemon.ts
+init_otel();
 function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path31.default.resolve(opts.neatHome);
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path33.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path31.default.resolve(env);
+  if (env && env.length > 0) return import_node_path33.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path31.default.join(home, ".neat");
+  return import_node_path33.default.join(home, ".neat");
+}
+function routeSpanToProject(serviceName, projects) {
+  if (!serviceName) return DEFAULT_PROJECT;
+  for (const entry2 of projects) {
+    if (entry2.status !== "active") continue;
+    if (entry2.languages.length === 0) {
+    }
+    if (entry2.name === serviceName) return entry2.name;
+  }
+  return DEFAULT_PROJECT;
 }
 async function bootstrapProject(entry2) {
+  const paths = pathsForProject(entry2.name, import_node_path33.default.join(entry2.path, "neat-out"));
   try {
-    const stat = await import_node_fs18.promises.stat(entry2.path);
+    const stat = await import_node_fs19.promises.stat(entry2.path);
     if (!stat.isDirectory()) {
       throw new Error(`registered path ${entry2.path} is not a directory`);
     }
@@ -3009,6 +4747,7 @@ async function bootstrapProject(entry2) {
       // output; nothing routes to it because it's not 'active'.
       graph: getGraph(`__broken__:${entry2.name}`),
       outPath: "",
+      paths,
       stopPersist: () => {
       },
       status: "broken",
@@ -3017,10 +4756,7 @@ async function bootstrapProject(entry2) {
   }
   resetGraph(entry2.name);
   const graph = getGraph(entry2.name);
-  const outPath = pathsForProject(
-    entry2.name,
-    import_node_path31.default.join(entry2.path, "neat-out")
-  ).snapshotPath;
+  const outPath = paths.snapshotPath;
   await loadGraphFromDisk(graph, outPath);
   await extractFromDirectory(graph, entry2.path);
   const stopPersist = startPersistLoop(graph, outPath);
@@ -3030,24 +4766,58 @@ async function bootstrapProject(entry2) {
     entry: entry2,
     graph,
     outPath,
+    paths,
     stopPersist,
     status: "active"
   };
 }
+function resolveRestPort(opts) {
+  if (typeof opts.restPort === "number") return opts.restPort;
+  const env = process.env.PORT;
+  if (env && env.length > 0) {
+    const n = Number.parseInt(env, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  return 8080;
+}
+function resolveOtlpPort(opts) {
+  if (typeof opts.otlpPort === "number") return opts.otlpPort;
+  const env = process.env.OTEL_PORT;
+  if (env && env.length > 0) {
+    const n = Number.parseInt(env, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  return 4318;
+}
+function resolveHost(opts) {
+  if (opts.host && opts.host.length > 0) return opts.host;
+  const env = process.env.HOST;
+  if (env && env.length > 0) return env;
+  return "0.0.0.0";
+}
 async function startDaemon(opts = {}) {
   const home = neatHomeFor(opts);
   const regPath = registryPath();
   try {
-    await import_node_fs18.promises.access(regPath);
+    await import_node_fs19.promises.access(regPath);
   } catch {
     throw new Error(
       `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
     );
   }
-  const pidPath = import_node_path31.default.join(home, "neatd.pid");
+  const pidPath = import_node_path33.default.join(home, "neatd.pid");
   await writeAtomically(pidPath, `${process.pid}
 `);
   const slots = /* @__PURE__ */ new Map();
+  const registry = new Projects();
+  function upsertRegistryFromSlot(slot) {
+    if (slot.status !== "active") return;
+    registry.set(slot.entry.name, {
+      scanPath: slot.entry.path,
+      paths: slot.paths,
+      graph: slot.graph
+    });
+  }
   async function loadAll() {
     const projects = await listProjects();
     const seen = /* @__PURE__ */ new Set();
@@ -3057,6 +4827,7 @@ async function startDaemon(opts = {}) {
       try {
         const slot = await bootstrapProject(entry2);
         slots.set(entry2.name, slot);
+        upsertRegistryFromSlot(slot);
         if (slot.status === "broken") {
           console.warn(`neatd: project "${entry2.name}" broken \u2014 ${slot.errorReason}`);
         } else {
@@ -3081,6 +4852,80 @@ async function startDaemon(opts = {}) {
     }
   }
   await loadAll();
+  const bind = opts.bindListeners !== false;
+  let restApp = null;
+  let otlpApp = null;
+  let restAddress = "";
+  let otlpAddress = "";
+  if (bind) {
+    const host = resolveHost(opts);
+    const restPort = resolveRestPort(opts);
+    const otlpPort = resolveOtlpPort(opts);
+    try {
+      restApp = await buildApi({ projects: registry });
+      restAddress = await restApp.listen({ port: restPort, host });
+      console.log(`neatd: REST listening on ${restAddress}`);
+    } catch (err) {
+      for (const slot of slots.values()) {
+        try {
+          slot.stopPersist();
+        } catch {
+        }
+      }
+      if (restApp) await restApp.close().catch(() => {
+      });
+      await import_node_fs19.promises.unlink(pidPath).catch(() => {
+      });
+      throw new Error(
+        `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
+      );
+    }
+    try {
+      otlpApp = await buildOtelReceiver({
+        onSpan: async (span) => {
+          const liveEntries = await listProjects().catch(() => []);
+          const target = routeSpanToProject(span.service, liveEntries);
+          const slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
+          if (!slot || slot.status !== "active") return;
+          await handleSpan(
+            {
+              graph: slot.graph,
+              errorsPath: slot.paths.errorsPath,
+              project: slot.entry.name,
+              // Receiver already wrote the error event synchronously below.
+              writeErrorEventInline: false
+            },
+            span
+          );
+        },
+        onErrorSpanSync: async (span) => {
+          const liveEntries = await listProjects().catch(() => []);
+          const target = routeSpanToProject(span.service, liveEntries);
+          const slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
+          if (!slot || slot.status !== "active") return;
+          await makeErrorSpanWriter(slot.paths.errorsPath)(span);
+        }
+      });
+      otlpAddress = await otlpApp.listen({ port: otlpPort, host });
+      console.log(`neatd: OTLP listening on ${otlpAddress}/v1/traces`);
+    } catch (err) {
+      for (const slot of slots.values()) {
+        try {
+          slot.stopPersist();
+        } catch {
+        }
+      }
+      if (restApp) await restApp.close().catch(() => {
+      });
+      if (otlpApp) await otlpApp.close().catch(() => {
+      });
+      await import_node_fs19.promises.unlink(pidPath).catch(() => {
+      });
+      throw new Error(
+        `neatd: failed to bind OTLP on port ${otlpPort} \u2014 ${err.message}`
+      );
+    }
+  }
   let reloading = null;
   const reload = async () => {
     if (reloading) return reloading;
@@ -3104,22 +4949,27 @@ async function startDaemon(opts = {}) {
     if (stopped) return;
     stopped = true;
     process.off("SIGHUP", sighupHandler);
+    if (otlpApp) await otlpApp.close().catch(() => {
+    });
+    if (restApp) await restApp.close().catch(() => {
+    });
     for (const slot of slots.values()) {
       try {
         slot.stopPersist();
       } catch {
       }
     }
-    await import_node_fs18.promises.unlink(pidPath).catch(() => {
+    await import_node_fs19.promises.unlink(pidPath).catch(() => {
     });
   };
-  return { slots, reload, stop, pidPath };
+  return { slots, reload, stop, pidPath, restAddress, otlpAddress };
 }
 
 // src/web-spawn.ts
+init_cjs_shims();
 var import_node_child_process = require("child_process");
 var import_node_net = __toESM(require("net"), 1);
-var import_node_path32 = __toESM(require("path"), 1);
+var import_node_path34 = __toESM(require("path"), 1);
 var DEFAULT_WEB_PORT = 6328;
 async function assertPortFree(port) {
   await new Promise((resolve, reject) => {
@@ -3147,7 +4997,10 @@ function resolveWebPackageDir() {
     eval("require")
   );
   const pkgJsonPath = req.resolve("@neat.is/web/package.json");
-  return import_node_path32.default.dirname(pkgJsonPath);
+  return import_node_path34.default.dirname(pkgJsonPath);
+}
+function resolveStandaloneServerEntry(webDir) {
+  return import_node_path34.default.join(webDir, ".next/standalone/packages/web/server.js");
 }
 async function spawnWebUI(restPort) {
   const portRaw = process.env.NEAT_WEB_PORT;
@@ -3157,13 +5010,22 @@ async function spawnWebUI(restPort) {
   }
   await assertPortFree(port);
   const cwd = resolveWebPackageDir();
+  const serverEntry = resolveStandaloneServerEntry(cwd);
+  try {
+    require.resolve(serverEntry);
+  } catch {
+    throw new Error(
+      `neatd: web UI standalone build missing at ${serverEntry}. The published @neat.is/web tarball should include it; if you're running from a monorepo checkout, run \`npm run build --workspace @neat.is/web\` first, or set NEAT_WEB_DISABLED=1 to skip the web UI.`
+    );
+  }
   const env = {
     ...process.env,
     PORT: String(port),
+    HOSTNAME: process.env.HOSTNAME ?? "0.0.0.0",
     NEAT_API_URL: process.env.NEAT_API_URL ?? `http://localhost:${restPort}`
   };
-  const child = (0, import_node_child_process.spawn)("npm", ["exec", "--", "next", "start", "-p", String(port)], {
-    cwd,
+  const child = (0, import_node_child_process.spawn)(process.execPath, [serverEntry], {
+    cwd: import_node_path34.default.dirname(serverEntry),
     env,
     stdio: ["ignore", "inherit", "inherit"],
     detached: false
@@ -3200,14 +5062,14 @@ async function spawnWebUI(restPort) {
 // src/neatd.ts
 function neatHome2() {
   if (process.env.NEAT_HOME && process.env.NEAT_HOME.length > 0) {
-    return import_node_path33.default.resolve(process.env.NEAT_HOME);
+    return import_node_path35.default.resolve(process.env.NEAT_HOME);
   }
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path33.default.join(home, ".neat");
+  return import_node_path35.default.join(home, ".neat");
 }
 async function readPid() {
   try {
-    const raw = await import_node_fs19.promises.readFile(import_node_path33.default.join(neatHome2(), "neatd.pid"), "utf8");
+    const raw = await import_node_fs20.promises.readFile(import_node_path35.default.join(neatHome2(), "neatd.pid"), "utf8");
     const n = Number.parseInt(raw.trim(), 10);
     return Number.isFinite(n) ? n : null;
   } catch {
@@ -3225,6 +5087,8 @@ async function cmdStart() {
   const handle = await startDaemon();
   console.log(`neatd: started, PID ${process.pid}, ${handle.slots.size} project(s)`);
   console.log(`neatd: registry at ${registryPath()}`);
+  if (handle.restAddress) console.log(`neatd: REST  \u2192 ${handle.restAddress}`);
+  if (handle.otlpAddress) console.log(`neatd: OTLP  \u2192 ${handle.otlpAddress}`);
   const skipWeb = process.env.NEAT_WEB_DISABLED === "1";
   let web = null;
   if (!skipWeb) {