@neat.is/core 0.3.0 → 0.3.2

package/dist/{chunk-B7UUGIXB.js → chunk-FIXKIYNF.js}

@@ -3492,6 +3492,82 @@ function startPersistLoop(graph, outPath, intervalMs = 6e4) {
   };
 }
 
+// src/diff.ts
+import { promises as fs17 } from "fs";
+async function loadSnapshotForDiff(target) {
+  if (/^https?:\/\//i.test(target)) {
+    const res = await fetch(target);
+    if (!res.ok) {
+      throw new Error(`fetch ${target} failed: ${res.status} ${res.statusText}`);
+    }
+    return await res.json();
+  }
+  const raw = await fs17.readFile(target, "utf8");
+  return JSON.parse(raw);
+}
+function indexEntries(entries) {
+  const m = /* @__PURE__ */ new Map();
+  if (!entries) return m;
+  for (const entry of entries) {
+    const id = entry.attributes?.id ?? entry.key;
+    if (!id) continue;
+    m.set(id, entry.attributes);
+  }
+  return m;
+}
+function computeGraphDiff(liveGraph, baseSnapshot, currentExportedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const baseNodes = indexEntries(baseSnapshot.graph?.nodes);
+  const baseEdges = indexEntries(baseSnapshot.graph?.edges);
+  const liveNodes = /* @__PURE__ */ new Map();
+  liveGraph.forEachNode((id, attrs) => liveNodes.set(id, attrs));
+  const liveEdges = /* @__PURE__ */ new Map();
+  liveGraph.forEachEdge((id, attrs) => liveEdges.set(id, attrs));
+  const result = {
+    base: { exportedAt: baseSnapshot.exportedAt },
+    current: { exportedAt: currentExportedAt },
+    added: { nodes: [], edges: [] },
+    removed: { nodes: [], edges: [] },
+    changed: { nodes: [], edges: [] }
+  };
+  for (const [id, after] of liveNodes) {
+    const before = baseNodes.get(id);
+    if (!before) {
+      result.added.nodes.push(after);
+    } else if (!shallowEqual(before, after)) {
+      result.changed.nodes.push({ id, before, after });
+    }
+  }
+  for (const [id, before] of baseNodes) {
+    if (!liveNodes.has(id)) result.removed.nodes.push(before);
+  }
+  for (const [id, after] of liveEdges) {
+    const before = baseEdges.get(id);
+    if (!before) {
+      result.added.edges.push(after);
+    } else if (!shallowEqual(before, after)) {
+      result.changed.edges.push({ id, before, after });
+    }
+  }
+  for (const [id, before] of baseEdges) {
+    if (!liveEdges.has(id)) result.removed.edges.push(before);
+  }
+  return result;
+}
+function shallowEqual(a, b) {
+  return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(value) {
+  return JSON.stringify(value, (_key, v) => {
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      return Object.keys(v).sort().reduce((acc, k) => {
+        acc[k] = v[k];
+        return acc;
+      }, {});
+    }
+    return v;
+  });
+}
+
 // src/projects.ts
 import path29 from "path";
 function pathsForProject(project, baseDir) {
@@ -3548,7 +3624,7 @@ function parseExtraProjects(raw) {
 }
 
 // src/registry.ts
-import { promises as fs17 } from "fs";
+import { promises as fs18 } from "fs";
 import os2 from "os";
 import path30 from "path";
 import {
@@ -3570,29 +3646,29 @@ function registryLockPath() {
 async function normalizeProjectPath(input) {
   const resolved = path30.resolve(input);
   try {
-    return await fs17.realpath(resolved);
+    return await fs18.realpath(resolved);
   } catch {
     return resolved;
   }
 }
 async function writeAtomically(target, contents) {
-  await fs17.mkdir(path30.dirname(target), { recursive: true });
+  await fs18.mkdir(path30.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs17.open(tmp, "w");
+  const fd = await fs18.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await fs17.rename(tmp, target);
+  await fs18.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await fs17.mkdir(path30.dirname(lockPath), { recursive: true });
+  await fs18.mkdir(path30.dirname(lockPath), { recursive: true });
   while (true) {
     try {
-      const fd = await fs17.open(lockPath, "wx");
+      const fd = await fs18.open(lockPath, "wx");
       await fd.close();
       return;
     } catch (err) {
@@ -3608,7 +3684,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
   }
 }
 async function releaseLock(lockPath) {
-  await fs17.unlink(lockPath).catch(() => {
+  await fs18.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -3624,7 +3700,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await fs17.readFile(file, "utf8");
+    raw = await fs18.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -3716,25 +3792,746 @@ async function removeProject(name) {
   });
 }
 
+// src/api.ts
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
+
+// src/divergences.ts
+import {
+  DivergenceResultSchema,
+  EdgeType as EdgeType9,
+  NodeType as NodeType10,
+  parseEdgeId,
+  Provenance as Provenance10
+} from "@neat.is/types";
+function bucketKey(source, target, type) {
+  return `${type}|${source}|${target}`;
+}
+function bucketEdges(graph) {
+  const buckets = /* @__PURE__ */ new Map();
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    const parsed = parseEdgeId(id);
+    const provenance = parsed?.provenance ?? e.provenance;
+    const key = bucketKey(e.source, e.target, e.type);
+    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    switch (provenance) {
+      case Provenance10.EXTRACTED:
+        cur.extracted = e;
+        break;
+      case Provenance10.OBSERVED:
+        cur.observed = e;
+        break;
+      case Provenance10.INFERRED:
+        cur.inferred = e;
+        break;
+      case Provenance10.FRONTIER:
+        cur.frontier = e;
+        break;
+      default:
+        if (e.provenance === Provenance10.STALE) cur.stale = e;
+    }
+    buckets.set(key, cur);
+  });
+  return buckets;
+}
+function nodeIsFrontier(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === NodeType10.FrontierNode;
+}
+function hasAnyObservedFromSource(graph, sourceId) {
+  if (!graph.hasNode(sourceId)) return false;
+  for (const edgeId of graph.outboundEdges(sourceId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.provenance === Provenance10.OBSERVED) return true;
+  }
+  return false;
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(1, n));
+}
+function reasonForMissingObserved(source, target, type) {
+  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
+}
+function reasonForMissingExtracted(source, target, type) {
+  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
+}
+var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
+var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
+var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function detectMissingDivergences(graph, bucket) {
+  const out = [];
+  if (bucket.extracted && !bucket.observed) {
+    if (!nodeIsFrontier(graph, bucket.target)) {
+      const sourceHasTraffic = hasAnyObservedFromSource(graph, bucket.source);
+      out.push({
+        type: "missing-observed",
+        source: bucket.source,
+        target: bucket.target,
+        edgeType: bucket.type,
+        extracted: bucket.extracted,
+        confidence: sourceHasTraffic ? 1 : 0.5,
+        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
+        recommendation: RECOMMENDATION_MISSING_OBSERVED
+      });
+    }
+  }
+  if (bucket.observed && !bucket.extracted) {
+    const cascaded = clampConfidence(confidenceForEdge(bucket.observed));
+    out.push({
+      type: "missing-extracted",
+      source: bucket.source,
+      target: bucket.target,
+      edgeType: bucket.type,
+      observed: bucket.observed,
+      confidence: cascaded,
+      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
+      recommendation: RECOMMENDATION_MISSING_EXTRACTED
+    });
+  }
+  return out;
+}
+function declaredHostFor(svc) {
+  const raw = svc.dbConnectionTarget?.trim();
+  if (!raw) return null;
+  const colon = raw.lastIndexOf(":");
+  if (colon === -1) return raw;
+  const port = raw.slice(colon + 1);
+  if (/^\d+$/.test(port)) return raw.slice(0, colon);
+  return raw;
+}
+function hasExtractedConfiguredBy(graph, svcId) {
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance10.EXTRACTED) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectHostMismatch(graph, svcId, svc) {
+  const declaredHost = declaredHostFor(svc);
+  if (!declaredHost) return [];
+  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
+  const out = [];
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance10.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== NodeType10.DatabaseNode) continue;
+    const observedHost = target.host?.trim();
+    if (!observedHost) continue;
+    if (observedHost === declaredHost) continue;
+    out.push({
+      type: "host-mismatch",
+      source: svcId,
+      target: edge.target,
+      extractedHost: declaredHost,
+      observedHost,
+      confidence: clampConfidence(confidenceForEdge(edge)),
+      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
+      recommendation: RECOMMENDATION_HOST_MISMATCH
+    });
+  }
+  return out;
+}
+function detectCompatDivergences(graph, svcId, svc) {
+  const out = [];
+  const deps = svc.dependencies ?? {};
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance10.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== NodeType10.DatabaseNode) continue;
+    for (const pair of compatPairs()) {
+      if (pair.engine !== target.engine) continue;
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        target.engine,
+        target.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        out.push({
+          type: "version-mismatch",
+          source: svcId,
+          target: edge.target,
+          extractedVersion: declared,
+          observedVersion: target.engineVersion,
+          compatibility: "incompatible",
+          confidence: 1,
+          reason: result.reason,
+          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
+        });
+      }
+    }
+    for (const rule of deprecatedApis()) {
+      const declared = deps[rule.package];
+      if (!declared) continue;
+      const result = checkDeprecatedApi(rule, declared);
+      if (!result.compatible && result.reason) {
+        const ruleRef = {
+          kind: rule.kind ?? "deprecated-api",
+          reason: result.reason,
+          package: rule.package
+        };
+        out.push({
+          type: "compat-violation",
+          source: svcId,
+          target: edge.target,
+          rule: ruleRef,
+          observed: edge,
+          confidence: 1,
+          reason: result.reason,
+          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
+        });
+      }
+    }
+  }
+  return out;
+}
+function involvesNode(d, nodeId) {
+  return d.source === nodeId || d.target === nodeId;
+}
+function computeDivergences(graph, opts = {}) {
+  const all = [];
+  const buckets = bucketEdges(graph);
+  for (const bucket of buckets.values()) {
+    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
+  }
+  graph.forEachNode((nodeId, attrs) => {
+    const n = attrs;
+    if (n.type !== NodeType10.ServiceNode) return;
+    const svc = n;
+    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
+    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+  });
+  let filtered = all;
+  if (opts.type) {
+    const allowed = opts.type;
+    filtered = filtered.filter((d) => allowed.has(d.type));
+  }
+  if (opts.minConfidence !== void 0) {
+    const threshold = opts.minConfidence;
+    filtered = filtered.filter((d) => d.confidence >= threshold);
+  }
+  if (opts.node) {
+    const target = opts.node;
+    filtered = filtered.filter((d) => involvesNode(d, target));
+  }
+  filtered.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    if (a.type !== b.type) return a.type.localeCompare(b.type);
+    if (a.source !== b.source) return a.source.localeCompare(b.source);
+    return a.target.localeCompare(b.target);
+  });
+  return DivergenceResultSchema.parse({
+    divergences: filtered,
+    totalAffected: filtered.length,
+    computedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/streaming.ts
+var SSE_HEARTBEAT_MS = 3e4;
+var SSE_BACKPRESSURE_CAP = 1e3;
+function handleSse(req, reply, opts) {
+  const heartbeatMs = opts.heartbeatMs ?? SSE_HEARTBEAT_MS;
+  const backpressureCap = opts.backpressureCap ?? SSE_BACKPRESSURE_CAP;
+  reply.raw.setHeader("Content-Type", "text/event-stream");
+  reply.raw.setHeader("Cache-Control", "no-cache, no-transform");
+  reply.raw.setHeader("Connection", "keep-alive");
+  reply.raw.setHeader("X-Accel-Buffering", "no");
+  reply.raw.flushHeaders?.();
+  let pending = 0;
+  let dropped = false;
+  const closeConnection = () => {
+    if (dropped) return;
+    dropped = true;
+    eventBus.off(EVENT_BUS_CHANNEL, listener);
+    clearInterval(heartbeat);
+    if (!reply.raw.writableEnded) reply.raw.end();
+  };
+  const writeFrame = (frame) => {
+    if (dropped) return;
+    if (pending >= backpressureCap) {
+      const errFrame = `event: error
+data: ${JSON.stringify({ reason: "backpressure" })}
+
+`;
+      reply.raw.write(errFrame);
+      closeConnection();
+      return;
+    }
+    pending++;
+    reply.raw.write(frame, () => {
+      pending = Math.max(0, pending - 1);
+    });
+  };
+  const listener = (envelope) => {
+    if (envelope.project !== opts.project) return;
+    writeFrame(`event: ${envelope.type}
+data: ${JSON.stringify(envelope.payload)}
+
+`);
+  };
+  eventBus.on(EVENT_BUS_CHANNEL, listener);
+  const heartbeat = setInterval(() => {
+    if (dropped) return;
+    reply.raw.write(":heartbeat\n\n");
+  }, heartbeatMs);
+  if (typeof heartbeat.unref === "function") heartbeat.unref();
+  req.raw.on("close", closeConnection);
+  reply.raw.on("close", closeConnection);
+  reply.raw.on("error", closeConnection);
+}
+
+// src/api.ts
+function serializeGraph(graph) {
+  const nodes = [];
+  graph.forEachNode((_id, attrs) => {
+    nodes.push(attrs);
+  });
+  const edges = [];
+  graph.forEachEdge((_id, attrs) => {
+    edges.push(attrs);
+  });
+  return { nodes, edges };
+}
+function projectFromReq(req) {
+  const params = req.params;
+  return params.project ?? DEFAULT_PROJECT;
+}
+function resolveProject(registry, req, reply) {
+  const name = projectFromReq(req);
+  const ctx = registry.get(name);
+  if (!ctx) {
+    void reply.code(404).send({ error: "project not found", project: name });
+    return null;
+  }
+  return ctx;
+}
+function buildLegacyRegistry(opts) {
+  if (opts.projects) return opts.projects;
+  if (!opts.graph) {
+    throw new Error("buildApi: either `projects` or `graph` must be provided");
+  }
+  const registry = new Projects();
+  const paths = pathsForProject(DEFAULT_PROJECT, "");
+  registry.set(DEFAULT_PROJECT, {
+    graph: opts.graph,
+    scanPath: opts.scanPath,
+    paths: {
+      snapshotPath: paths.snapshotPath,
+      errorsPath: opts.errorsPath ?? paths.errorsPath,
+      staleEventsPath: opts.staleEventsPath ?? paths.staleEventsPath,
+      embeddingsCachePath: paths.embeddingsCachePath,
+      policyViolationsPath: paths.policyViolationsPath
+    },
+    searchIndex: opts.searchIndex
+  });
+  return registry;
+}
+function registerRoutes(scope, ctx) {
+  const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
+  scope.get("/events", (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    handleSse(req, reply, { project: proj.name });
+  });
+  scope.get("/health", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const uptimeMs = Date.now() - startedAt;
+    return {
+      ok: true,
+      project: proj.name,
+      uptimeMs,
+      // Legacy fields kept additively. The web shell's StatusBar reads
+      // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
+      // the canonical triple and lets the extras pass through.
+      uptime: Math.floor(uptimeMs / 1e3),
+      nodeCount: proj.graph.order,
+      edgeCount: proj.graph.size,
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  });
+  scope.get("/graph", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    return serializeGraph(proj.graph);
+  });
+  scope.get(
+    "/graph/node/:id",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const { id } = req.params;
+      if (!proj.graph.hasNode(id)) {
+        return reply.code(404).send({ error: "node not found", id });
+      }
+      return { node: proj.graph.getNodeAttributes(id) };
+    }
+  );
+  scope.get(
+    "/graph/edges/:id",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const { id } = req.params;
+      if (!proj.graph.hasNode(id)) {
+        return reply.code(404).send({ error: "node not found", id });
+      }
+      const inbound = proj.graph.inboundEdges(id).map((e) => proj.graph.getEdgeAttributes(e));
+      const outbound = proj.graph.outboundEdges(id).map((e) => proj.graph.getEdgeAttributes(e));
+      return { inbound, outbound };
+    }
+  );
+  scope.get("/graph/dependencies/:nodeId", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    const depth = req.query.depth ? Number(req.query.depth) : TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH;
+    if (!Number.isFinite(depth) || depth < 1 || depth > TRANSITIVE_DEPENDENCIES_MAX_DEPTH) {
+      return reply.code(400).send({
+        error: `depth must be an integer in [1, ${TRANSITIVE_DEPENDENCIES_MAX_DEPTH}]`
+      });
+    }
+    return getTransitiveDependencies(proj.graph, nodeId, depth);
+  });
+  scope.get("/graph/divergences", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    let typeFilter;
+    if (req.query.type) {
+      const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+      const parsed = [];
+      for (const c of candidates) {
+        const r = DivergenceTypeSchema.safeParse(c);
+        if (!r.success) {
+          return reply.code(400).send({
+            error: `unknown divergence type "${c}"`,
+            allowed: DivergenceTypeSchema.options
+          });
+        }
+        parsed.push(r.data);
+      }
+      typeFilter = new Set(parsed);
+    }
+    let minConfidence;
+    if (req.query.minConfidence !== void 0) {
+      const n = Number(req.query.minConfidence);
+      if (!Number.isFinite(n) || n < 0 || n > 1) {
+        return reply.code(400).send({
+          error: "minConfidence must be a number in [0, 1]"
+        });
+      }
+      minConfidence = n;
+    }
+    return computeDivergences(proj.graph, {
+      ...typeFilter ? { type: typeFilter } : {},
+      ...minConfidence !== void 0 ? { minConfidence } : {},
+      ...req.query.node ? { node: req.query.node } : {}
+    });
+  });
+  scope.get("/incidents", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const epath = errorsPathFor(proj);
+    if (!epath) return { count: 0, total: 0, events: [] };
+    const events = await readErrorEvents(epath);
+    const total = events.length;
+    const limit = req.query.limit ? Number(req.query.limit) : 50;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, 200) : 50;
+    const sliced = events.slice(0, safeLimit);
+    return { count: sliced.length, total, events: sliced };
+  });
+  scope.get("/stale-events", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const spath = staleEventsPathFor(proj);
+    if (!spath) return { count: 0, total: 0, events: [] };
+    const events = await readStaleEvents(spath);
+    const filtered = req.query.edgeType ? events.filter((e) => e.edgeType === req.query.edgeType) : events;
+    const ordered = [...filtered].reverse();
+    const total = ordered.length;
+    const limit = req.query.limit ? Number(req.query.limit) : 50;
+    const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
+    return { count: sliced.length, total, events: sliced };
+  });
+  scope.get(
+    "/incidents/:nodeId",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const { nodeId } = req.params;
+      if (!proj.graph.hasNode(nodeId)) {
+        return reply.code(404).send({ error: "node not found", id: nodeId });
+      }
+      const epath = errorsPathFor(proj);
+      if (!epath) return { count: 0, total: 0, events: [] };
+      const events = await readErrorEvents(epath);
+      const filtered = events.filter(
+        (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
+      );
+      return { count: filtered.length, total: filtered.length, events: filtered };
+    }
+  );
+  scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    let errorEvent;
+    const epath = errorsPathFor(proj);
+    if (req.query.errorId && epath) {
+      const events = await readErrorEvents(epath);
+      errorEvent = events.find((e) => e.id === req.query.errorId);
+      if (!errorEvent) {
+        return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
+      }
+    }
+    const result = getRootCause(proj.graph, nodeId, errorEvent);
+    if (!result) return reply.code(404).send({ error: "no root cause found", id: nodeId });
+    return result;
+  });
+  scope.get("/graph/blast-radius/:nodeId", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    const depth = req.query.depth ? Number(req.query.depth) : void 0;
+    if (depth !== void 0 && (!Number.isFinite(depth) || depth < 0)) {
+      return reply.code(400).send({ error: "depth must be a non-negative number" });
+    }
+    return getBlastRadius(proj.graph, nodeId, depth);
+  });
+  scope.get("/search", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const raw = (req.query.q ?? "").trim();
+    if (!raw) return reply.code(400).send({ error: "query parameter `q` is required" });
+    const limit = req.query.limit ? Number(req.query.limit) : void 0;
+    const safeLimit = limit !== void 0 && Number.isFinite(limit) && limit > 0 ? limit : void 0;
+    if (proj.searchIndex) {
+      const result = await proj.searchIndex.search(raw, safeLimit);
+      return {
+        query: result.query,
+        provider: result.provider,
+        matches: result.matches.map((m) => ({ ...m.node, score: m.score }))
+      };
+    }
+    const q = raw.toLowerCase();
+    const matches = [];
+    proj.graph.forEachNode((id, attrs) => {
+      const name = attrs.name ?? "";
+      if (id.toLowerCase().includes(q) || name.toLowerCase().includes(q)) {
+        matches.push({ ...attrs, score: 1 });
+      }
+    });
+    return {
+      query: q,
+      provider: "substring",
+      matches: matches.slice(0, safeLimit)
+    };
+  });
+  scope.get(
+    "/graph/diff",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const against = req.query.against;
+      if (!against) {
+        return reply.code(400).send({ error: "query parameter `against` is required" });
+      }
+      try {
+        const snapshot = await loadSnapshotForDiff(against);
+        return computeGraphDiff(proj.graph, snapshot);
+      } catch (err) {
+        return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
+      }
+    }
+  );
+  scope.post("/graph/scan", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    if (!proj.scanPath) {
+      return reply.code(409).send({ error: "scan path not configured for this project", project: proj.name });
+    }
+    const result = await extractFromDirectory(proj.graph, proj.scanPath);
+    return {
+      project: proj.name,
+      scanned: proj.scanPath,
+      nodesAdded: result.nodesAdded,
+      edgesAdded: result.edgesAdded,
+      nodeCount: proj.graph.order,
+      edgeCount: proj.graph.size
+    };
+  });
+  scope.get("/policies", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const policyPath = ctx.policyFilePathFor(proj);
+    if (!policyPath) {
+      return { version: 1, policies: [] };
+    }
+    try {
+      const policies = await loadPolicyFile(policyPath);
+      return { version: 1, policies };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "policy.json failed to parse",
+        details: err.message
+      });
+    }
+  });
+  scope.get("/policies/violations", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
+    let violations = await log.readAll();
+    if (req.query.severity) {
+      const sev = PolicySeveritySchema.safeParse(req.query.severity);
+      if (!sev.success) {
+        return reply.code(400).send({
+          error: "invalid severity",
+          details: sev.error.format()
+        });
+      }
+      violations = violations.filter((v) => v.severity === sev.data);
+    }
+    if (req.query.policyId) {
+      violations = violations.filter((v) => v.policyId === req.query.policyId);
+    }
+    return { violations };
+  });
+  scope.post("/policies/check", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const parsed = PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+      return reply.code(400).send({
+        error: "invalid /policies/check body",
+        details: parsed.error.format()
+      });
+    }
+    const policyPath = ctx.policyFilePathFor(proj);
+    let policies = [];
+    if (policyPath) {
+      try {
+        policies = await loadPolicyFile(policyPath);
+      } catch (err) {
+        return reply.code(400).send({
+          error: "policy.json failed to parse",
+          details: err.message
+        });
+      }
+    }
+    const evalCtx = { now: () => Date.now() };
+    if (!parsed.data.hypotheticalAction) {
+      const violations2 = evaluateAllPolicies(proj.graph, policies, evalCtx);
+      const blocking2 = violations2.filter((v) => v.onViolation === "block");
+      return { allowed: blocking2.length === 0, violations: violations2 };
+    }
+    const violations = evaluateAllPolicies(proj.graph, policies, evalCtx);
+    const blocking = violations.filter((v) => v.onViolation === "block");
+    return {
+      allowed: blocking.length === 0,
+      hypotheticalAction: parsed.data.hypotheticalAction,
+      violations
+    };
+  });
+}
+async function buildApi(opts) {
+  const app = Fastify({ logger: false });
+  await app.register(cors, { origin: true });
+  const startedAt = opts.startedAt ?? Date.now();
+  const registry = buildLegacyRegistry(opts);
+  const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
+  const legacyStaleExplicit = !opts.projects && opts.staleEventsPath !== void 0;
+  const errorsPathFor = (proj) => {
+    if (proj.name === DEFAULT_PROJECT && !opts.projects) {
+      return legacyErrorsExplicit ? opts.errorsPath : void 0;
+    }
+    return proj.paths.errorsPath;
+  };
+  const staleEventsPathFor = (proj) => {
+    if (proj.name === DEFAULT_PROJECT && !opts.projects) {
+      return legacyStaleExplicit ? opts.staleEventsPath : void 0;
+    }
+    return proj.paths.staleEventsPath;
+  };
+  const policyFilePathFor = (proj) => {
+    if (!proj.scanPath) return void 0;
+    return `${proj.scanPath}/policy.json`;
+  };
+  const routeCtx = {
+    registry,
+    startedAt,
+    errorsPathFor,
+    staleEventsPathFor,
+    policyFilePathFor
+  };
+  app.get("/projects", async (_req, reply) => {
+    try {
+      return await listProjects();
+    } catch (err) {
+      return reply.code(500).send({
+        error: "failed to read project registry",
+        details: err.message
+      });
+    }
+  });
+  app.get("/projects/:project", async (req, reply) => {
+    try {
+      const entry = await getProject(req.params.project);
+      if (!entry) {
+        return reply.code(404).send({ error: "project not found", project: req.params.project });
+      }
+      return { project: entry };
+    } catch (err) {
+      return reply.code(500).send({
+        error: "failed to read project registry",
+        details: err.message
+      });
+    }
+  });
+  registerRoutes(app, routeCtx);
+  await app.register(
+    async (scope) => {
+      registerRoutes(scope, routeCtx);
+    },
+    { prefix: "/projects/:project" }
+  );
+  return app;
+}
+
 export {
   DEFAULT_PROJECT,
   getGraph,
   resetGraph,
   checkCompatibility,
-  checkDeprecatedApi,
   ensureCompatLoaded,
   compatPairs,
-  deprecatedApis,
-  EVENT_BUS_CHANNEL,
-  eventBus,
   emitNeatEvent,
   attachGraphToEventBus,
   confidenceForEdge,
   getRootCause,
   getBlastRadius,
-  TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH,
-  TRANSITIVE_DEPENDENCIES_MAX_DEPTH,
-  getTransitiveDependencies,
   evaluateAllPolicies,
   loadPolicyFile,
   PolicyViolationsLog,
@@ -3759,6 +4556,8 @@ export {
   saveGraphToDisk,
   loadGraphFromDisk,
   startPersistLoop,
+  loadSnapshotForDiff,
+  computeGraphDiff,
   pathsForProject,
   Projects,
   parseExtraProjects,
@@ -3773,6 +4572,7 @@ export {
   listProjects,
   setStatus,
   touchLastSeen,
-  removeProject
+  removeProject,
+  buildApi
 };
-//# sourceMappingURL=chunk-B7UUGIXB.js.map
+//# sourceMappingURL=chunk-FIXKIYNF.js.map