@neat.is/core 0.3.3 → 0.3.4

package/dist/{chunk-VABXPLDT.js → chunk-33ZZ2ZID.js}

@@ -427,19 +427,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path33, edges) {
-    if (path33.length > best.path.length) {
-      best = { path: [...path33], edges: [...edges] };
+  function step(node, path34, edges) {
+    if (path34.length > best.path.length) {
+      best = { path: [...path34], edges: [...edges] };
     }
-    if (path33.length - 1 >= maxDepth) return;
+    if (path34.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path33.push(srcId);
+      path34.push(srcId);
       edges.push(edge);
-      step(srcId, path33, edges);
-      path33.pop();
+      step(srcId, path34, edges);
+      path34.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1018,6 +1018,7 @@ import {
   EdgeType as EdgeType2,
   NodeType as NodeType3,
   Provenance as Provenance3,
+  confidenceForObservedSignal,
   databaseId,
   extractedEdgeId,
   frontierEdgeId,
@@ -1214,35 +1215,37 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
     const existing = graph.getEdgeAttributes(id);
     const newSpanCount = (existing.signal?.spanCount ?? existing.callCount ?? 0) + 1;
     const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
+    const newSignal = {
+      spanCount: newSpanCount,
+      errorCount: newErrorCount,
+      lastObservedAgeMs: 0
+    };
     const updated = {
       ...existing,
       provenance: Provenance3.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
-      signal: {
-        spanCount: newSpanCount,
-        errorCount: newErrorCount,
-        lastObservedAgeMs: 0
-      },
-      confidence: 1
+      signal: newSignal,
+      confidence: confidenceForObservedSignal(newSignal)
     };
     graph.replaceEdgeAttributes(id, updated);
     return { edge: updated, created: false };
   }
+  const signal = {
+    spanCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedAgeMs: 0
+  };
   const edge = {
     id,
     source,
     target,
     type,
     provenance: Provenance3.OBSERVED,
-    confidence: 1,
+    confidence: confidenceForObservedSignal(signal),
     lastObserved: ts,
     callCount: 1,
-    signal: {
-      spanCount: 1,
-      errorCount: isError ? 1 : 0,
-      lastObservedAgeMs: 0
-    }
+    signal
   };
   graph.addEdgeWithKey(id, source, target, edge);
   return { edge, created: true };
@@ -1593,6 +1596,27 @@ function formatExtractionBanner(count) {
   if (count === 1) return `[neat] 1 file skipped due to parse errors`;
   return `[neat] ${count} files skipped due to parse errors`;
 }
+var droppedSink = [];
+function noteExtractedDropped(edge) {
+  droppedSink.push(edge);
+}
+function drainDroppedExtracted() {
+  return droppedSink.splice(0, droppedSink.length);
+}
+function isRejectedLogEnabled() {
+  const raw = process.env.NEAT_EXTRACTED_REJECTED_LOG;
+  return raw === "1" || raw === "true";
+}
+async function writeRejectedExtracted(drops, rejectedPath) {
+  if (drops.length === 0) return;
+  await fs4.mkdir(path4.dirname(rejectedPath), { recursive: true });
+  const lines = drops.map((d) => JSON.stringify({ ...d, ts: (/* @__PURE__ */ new Date()).toISOString() })).join("\n") + "\n";
+  await fs4.appendFile(rejectedPath, lines, "utf8");
+}
+function formatPrecisionFloorBanner(count) {
+  if (count === 1) return `[neat] 1 extracted edge dropped below precision floor`;
+  return `[neat] ${count} extracted edges dropped below precision floor`;
+}
 
 // src/extract/services.ts
 import { promises as fs8 } from "fs";
@@ -2223,7 +2247,13 @@ async function addServiceAliases(graph, scanPath, services) {
 
 // src/extract/databases/index.ts
 import path17 from "path";
-import { EdgeType as EdgeType3, NodeType as NodeType6, Provenance as Provenance4, databaseId as databaseId2 } from "@neat.is/types";
+import {
+  EdgeType as EdgeType3,
+  NodeType as NodeType6,
+  Provenance as Provenance4,
+  databaseId as databaseId2,
+  confidenceForExtracted
+} from "@neat.is/types";
 
 // src/extract/databases/db-config-yaml.ts
 import path10 from "path";
@@ -2798,6 +2828,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         target: dbNode.id,
         type: EdgeType3.CONNECTS_TO,
         provenance: Provenance4.EXTRACTED,
+        confidence: confidenceForExtracted("structural"),
         // ADR-032 / #140 — every EXTRACTED edge carries evidence.file.
         // Ghost-edge cleanup keys retirement on this; the conditional
         // sourceFile spread that used to live here was a v0.1.x leftover.
@@ -2830,7 +2861,13 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 // src/extract/configs.ts
 import { promises as fs12 } from "fs";
 import path18 from "path";
-import { EdgeType as EdgeType4, NodeType as NodeType7, Provenance as Provenance5, configId } from "@neat.is/types";
+import {
+  EdgeType as EdgeType4,
+  NodeType as NodeType7,
+  Provenance as Provenance5,
+  configId,
+  confidenceForExtracted as confidenceForExtracted2
+} from "@neat.is/types";
 async function walkConfigFiles(dir) {
   const out = [];
   async function walk(current) {
@@ -2871,6 +2908,7 @@ async function addConfigNodes(graph, services, scanPath) {
         target: node.id,
         type: EdgeType4.CONFIGURED_BY,
         provenance: Provenance5.EXTRACTED,
+        confidence: confidenceForExtracted2("structural"),
         evidence: { file: relPath.split(path18.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
@@ -2883,14 +2921,25 @@ async function addConfigNodes(graph, services, scanPath) {
 }
 
 // src/extract/calls/index.ts
-import { EdgeType as EdgeType6, NodeType as NodeType8, Provenance as Provenance7 } from "@neat.is/types";
+import {
+  EdgeType as EdgeType6,
+  NodeType as NodeType8,
+  Provenance as Provenance7,
+  confidenceForExtracted as confidenceForExtracted4,
+  passesExtractedFloor as passesExtractedFloor2
+} from "@neat.is/types";
 
 // src/extract/calls/http.ts
 import path20 from "path";
 import Parser from "tree-sitter";
 import JavaScript from "tree-sitter-javascript";
 import Python from "tree-sitter-python";
-import { EdgeType as EdgeType5, Provenance as Provenance6 } from "@neat.is/types";
+import {
+  EdgeType as EdgeType5,
+  Provenance as Provenance6,
+  confidenceForExtracted as confidenceForExtracted3,
+  passesExtractedFloor
+} from "@neat.is/types";
 
 // src/extract/calls/shared.ts
 import { promises as fs13 } from "fs";
@@ -3022,17 +3071,32 @@ async function addHttpCallEdges(graph, services) {
     for (const [targetId, evidenceFile] of seenTargets) {
       const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
       const line = lineOf(fileContent, `//${evidenceFile.host}`);
+      const confidence = confidenceForExtracted3("hostname-shape-match");
+      const ev = {
+        file: path20.relative(service.dir, evidenceFile.file),
+        line,
+        snippet: snippet(fileContent, line)
+      };
+      const edgeId = extractedEdgeId2(service.node.id, targetId, EdgeType5.CALLS);
+      if (!passesExtractedFloor(confidence)) {
+        noteExtractedDropped({
+          source: service.node.id,
+          target: targetId,
+          type: EdgeType5.CALLS,
+          confidence,
+          confidenceKind: "hostname-shape-match",
+          evidence: ev
+        });
+        continue;
+      }
       const edge = {
-        id: extractedEdgeId2(service.node.id, targetId, EdgeType5.CALLS),
+        id: edgeId,
         source: service.node.id,
         target: targetId,
         type: EdgeType5.CALLS,
         provenance: Provenance6.EXTRACTED,
-        evidence: {
-          file: path20.relative(service.dir, evidenceFile.file),
-          line,
-          snippet: snippet(fileContent, line)
-        }
+        confidence,
+        evidence: ev
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -3070,6 +3134,10 @@ function kafkaEndpointsFromFile(file, serviceDir) {
       name: topic,
       kind: "kafka-topic",
       edgeType,
+      // `producer.send({topic: 'x'})` / `consumer.subscribe({topic: 'x'})` —
+      // framework-aware (kafkajs / node-rdkafka shape). Verified-call-site
+      // tier (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: path21.relative(serviceDir, file.path),
         line,
@@ -3101,6 +3169,10 @@ function redisEndpointsFromFile(file, serviceDir) {
       name: host,
       kind: "redis",
       edgeType: "CALLS",
+      // `redis://host` URL literal — the scheme is structural support, but no
+      // call expression is verified to wire it through. URL-with-structural-
+      // support tier (ADR-066).
+      confidenceKind: "url-with-structural-support",
       evidence: {
         file: path22.relative(serviceDir, file.path),
         line,
@@ -3141,6 +3213,10 @@ function awsEndpointsFromFile(file, serviceDir) {
       name,
       kind,
       edgeType: "CALLS",
+      // SDK marker (S3Client, GetCommand, etc.) plus a Bucket/TableName
+      // literal — framework-aware recognizer, verified-call-site tier
+      // (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: path23.relative(serviceDir, file.path),
         line,
@@ -3219,6 +3295,10 @@ function grpcEndpointsFromFile(file, serviceDir) {
       name,
       kind,
       edgeType: "CALLS",
+      // `new <Name>Client(...)` with @aws-sdk/* or @grpc/grpc-js import
+      // context — import-aware classification per #238. Verified-call-site
+      // tier (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: path24.relative(serviceDir, file.path),
         line,
@@ -3279,6 +3359,18 @@ async function addExternalEndpointEdges(graph, services) {
       const edgeId = extractedEdgeId2(service.node.id, ep.infraId, edgeType);
       if (seenEdges.has(edgeId)) continue;
       seenEdges.add(edgeId);
+      const confidence = confidenceForExtracted4(ep.confidenceKind);
+      if (!passesExtractedFloor2(confidence)) {
+        noteExtractedDropped({
+          source: service.node.id,
+          target: ep.infraId,
+          type: edgeType,
+          confidence,
+          confidenceKind: ep.confidenceKind,
+          evidence: ep.evidence
+        });
+        continue;
+      }
       if (!graph.hasEdge(edgeId)) {
         const edge = {
           id: edgeId,
@@ -3286,6 +3378,7 @@ async function addExternalEndpointEdges(graph, services) {
           target: ep.infraId,
           type: edgeType,
           provenance: Provenance7.EXTRACTED,
+          confidence,
           evidence: ep.evidence
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3306,7 +3399,7 @@ async function addCallEdges(graph, services) {
 
 // src/extract/infra/docker-compose.ts
 import path25 from "path";
-import { EdgeType as EdgeType7, Provenance as Provenance8 } from "@neat.is/types";
+import { EdgeType as EdgeType7, Provenance as Provenance8, confidenceForExtracted as confidenceForExtracted5 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
 import { NodeType as NodeType9, infraId as infraId5 } from "@neat.is/types";
@@ -3400,6 +3493,7 @@ async function addComposeInfra(graph, scanPath, services) {
         target: targetId,
         type: EdgeType7.DEPENDS_ON,
         provenance: Provenance8.EXTRACTED,
+        confidence: confidenceForExtracted5("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3412,7 +3506,7 @@ async function addComposeInfra(graph, scanPath, services) {
 // src/extract/infra/dockerfile.ts
 import path26 from "path";
 import { promises as fs14 } from "fs";
-import { EdgeType as EdgeType8, Provenance as Provenance9 } from "@neat.is/types";
+import { EdgeType as EdgeType8, Provenance as Provenance9, confidenceForExtracted as confidenceForExtracted6 } from "@neat.is/types";
 function runtimeImage(content) {
   const lines = content.split("\n");
   let last = null;
@@ -3459,6 +3553,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         target: node.id,
         type: EdgeType8.RUNS_ON,
         provenance: Provenance9.EXTRACTED,
+        confidence: confidenceForExtracted6("structural"),
         evidence: {
           file: path26.relative(scanPath, dockerfilePath).split(path26.sep).join("/")
         }
@@ -3573,6 +3668,9 @@ async function addInfra(graph, scanPath, services) {
   };
 }
 
+// src/extract/index.ts
+import path30 from "path";
+
 // src/extract/retire.ts
 import { existsSync } from "fs";
 import path29 from "path";
@@ -3636,13 +3734,26 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
       );
     }
   }
+  const droppedEntries = drainDroppedExtracted();
+  if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
+    const rejectedPath = path30.join(path30.dirname(opts.errorsPath), "rejected.ndjson");
+    try {
+      await writeRejectedExtracted(droppedEntries, rejectedPath);
+    } catch (err) {
+      console.warn(
+        `[neat] failed to write rejected extracted edges to ${rejectedPath}: ${err.message}`
+      );
+    }
+  }
   const result = {
     nodesAdded: phase1Nodes + phase2.nodesAdded + phase3.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
     edgesAdded: phase2.edgesAdded + phase3.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
-    ghostsRetired
+    ghostsRetired,
+    extractedDropped: droppedEntries.length,
+    droppedEntries
   };
   emitNeatEvent({
     type: "extraction-complete",
@@ -3659,7 +3770,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/persist.ts
 import { promises as fs17 } from "fs";
-import path30 from "path";
+import path31 from "path";
 var SCHEMA_VERSION = 2;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -3673,7 +3784,7 @@ function migrateV1ToV2(payload) {
   return { ...payload, schemaVersion: 2 };
 }
 async function ensureDir(filePath) {
-  await fs17.mkdir(path30.dirname(filePath), { recursive: true });
+  await fs17.mkdir(path31.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -3817,23 +3928,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path31 from "path";
+import path32 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path31.join(baseDir, "graph.json"),
-      errorsPath: path31.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path31.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path31.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path31.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path32.join(baseDir, "graph.json"),
+      errorsPath: path32.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path32.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path32.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path32.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path31.join(baseDir, `${project}.json`),
-    errorsPath: path31.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path31.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path31.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path31.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path32.join(baseDir, `${project}.json`),
+    errorsPath: path32.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path32.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path32.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path32.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -3874,7 +3985,7 @@ function parseExtraProjects(raw) {
 // src/registry.ts
 import { promises as fs19 } from "fs";
 import os2 from "os";
-import path32 from "path";
+import path33 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -3882,17 +3993,17 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path32.resolve(override);
-  return path32.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path33.resolve(override);
+  return path33.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path32.join(neatHome(), "projects.json");
+  return path33.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path32.join(neatHome(), "projects.json.lock");
+  return path33.join(neatHome(), "projects.json.lock");
 }
 async function normalizeProjectPath(input) {
-  const resolved = path32.resolve(input);
+  const resolved = path33.resolve(input);
   try {
     return await fs19.realpath(resolved);
   } catch {
@@ -3900,7 +4011,7 @@ async function normalizeProjectPath(input) {
   }
 }
 async function writeAtomically(target, contents) {
-  await fs19.mkdir(path32.dirname(target), { recursive: true });
+  await fs19.mkdir(path33.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
   const fd = await fs19.open(tmp, "w");
   try {
@@ -3913,7 +4024,7 @@ async function writeAtomically(target, contents) {
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await fs19.mkdir(path32.dirname(lockPath), { recursive: true });
+  await fs19.mkdir(path33.dirname(lockPath), { recursive: true });
   while (true) {
     try {
       const fd = await fs19.open(lockPath, "wx");
@@ -4089,14 +4200,6 @@ function nodeIsFrontier(graph, nodeId) {
   const attrs = graph.getNodeAttributes(nodeId);
   return attrs.type === NodeType10.FrontierNode;
 }
-function hasAnyObservedFromSource(graph, sourceId) {
-  if (!graph.hasNode(sourceId)) return false;
-  for (const edgeId of graph.outboundEdges(sourceId)) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.provenance === Provenance11.OBSERVED) return true;
-  }
-  return false;
-}
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
   return Math.max(0, Math.min(1, n));
@@ -4110,32 +4213,34 @@ function reasonForMissingExtracted(source, target, type) {
 var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
 var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
 var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function gradedConfidence(edge) {
+  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
+  return clampConfidence(confidenceForEdge(edge));
+}
 function detectMissingDivergences(graph, bucket) {
   const out = [];
   if (bucket.extracted && !bucket.observed) {
     if (!nodeIsFrontier(graph, bucket.target)) {
-      const sourceHasTraffic = hasAnyObservedFromSource(graph, bucket.source);
       out.push({
         type: "missing-observed",
         source: bucket.source,
         target: bucket.target,
         edgeType: bucket.type,
         extracted: bucket.extracted,
-        confidence: sourceHasTraffic ? 1 : 0.5,
+        confidence: gradedConfidence(bucket.extracted),
         reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
         recommendation: RECOMMENDATION_MISSING_OBSERVED
       });
     }
   }
   if (bucket.observed && !bucket.extracted) {
-    const cascaded = clampConfidence(confidenceForEdge(bucket.observed));
     out.push({
       type: "missing-extracted",
       source: bucket.source,
       target: bucket.target,
       edgeType: bucket.type,
       observed: bucket.observed,
-      confidence: cascaded,
+      confidence: gradedConfidence(bucket.observed),
       reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
       recommendation: RECOMMENDATION_MISSING_EXTRACTED
     });
@@ -4274,8 +4379,17 @@ function computeDivergences(graph, opts = {}) {
     const target = opts.node;
     filtered = filtered.filter((d) => involvesNode(d, target));
   }
+  const TYPE_LEADERSHIP = {
+    "missing-extracted": 0,
+    "missing-observed": 1,
+    "version-mismatch": 2,
+    "host-mismatch": 3,
+    "compat-violation": 4
+  };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
+    if (lead !== 0) return lead;
     if (a.type !== b.type) return a.type.localeCompare(b.type);
     if (a.source !== b.source) return a.source.localeCompare(b.source);
     return a.target.localeCompare(b.target);
@@ -4795,6 +4909,7 @@ export {
   readErrorEvents,
   isStrictExtractionEnabled,
   formatExtractionBanner,
+  formatPrecisionFloorBanner,
   discoverServices,
   addServiceNodes,
   addServiceAliases,
@@ -4826,4 +4941,4 @@ export {
   removeProject,
   buildApi
 };
-//# sourceMappingURL=chunk-VABXPLDT.js.map
+//# sourceMappingURL=chunk-33ZZ2ZID.js.map