@neat.is/core 0.3.3 → 0.3.5

package/dist/{chunk-VABXPLDT.js → chunk-BUB3ASD5.js}

@@ -339,17 +339,21 @@ import {
   BlastRadiusResultSchema,
   NodeType,
   PROV_RANK,
-  Provenance,
   RootCauseResultSchema,
   TransitiveDependenciesResultSchema
 } from "@neat.is/types";
 var ROOT_CAUSE_MAX_DEPTH = 5;
 var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function isFrontierNode(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === NodeType.FrontierNode;
+}
 function bestEdgeBySource(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (e.provenance === Provenance.FRONTIER) continue;
+    if (isFrontierNode(graph, e.source)) continue;
     const cur = best.get(e.source);
     if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
       best.set(e.source, e);
@@ -361,7 +365,7 @@ function bestEdgeByTarget(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (e.provenance === Provenance.FRONTIER) continue;
+    if (isFrontierNode(graph, e.target)) continue;
     const cur = best.get(e.target);
     if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
       best.set(e.target, e);
@@ -373,8 +377,7 @@ var PROVENANCE_CEILING = {
   OBSERVED: 1,
   INFERRED: 0.7,
   EXTRACTED: 0.5,
-  STALE: 0.3,
-  FRONTIER: 0.3
+  STALE: 0.3
 };
 function volumeWeight(spanCount) {
   if (!spanCount || spanCount <= 0) return 0.5;
@@ -427,19 +430,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path33, edges) {
-    if (path33.length > best.path.length) {
-      best = { path: [...path33], edges: [...edges] };
+  function step(node, path34, edges) {
+    if (path34.length > best.path.length) {
+      best = { path: [...path34], edges: [...edges] };
     }
-    if (path33.length - 1 >= maxDepth) return;
+    if (path34.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path33.push(srcId);
+      path34.push(srcId);
       edges.push(edge);
-      step(srcId, path33, edges);
-      path33.pop();
+      step(srcId, path34, edges);
+      path34.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -631,8 +634,7 @@ import path2 from "path";
 import {
   EdgeType,
   NodeType as NodeType2,
-  PolicyFileSchema,
-  Provenance as Provenance2
+  PolicyFileSchema
 } from "@neat.is/types";
 
 // src/events.ts
@@ -733,8 +735,8 @@ var evaluateStructural = ({
     for (const edgeId of graph.outboundEdges(id)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type !== rule.edgeType) continue;
-      if (e.provenance === Provenance2.FRONTIER) continue;
       const target = graph.getNodeAttributes(e.target);
+      if (target.type === NodeType2.FrontierNode) continue;
       if (target.type === rule.toNodeType) {
         satisfied = true;
         break;
@@ -853,8 +855,8 @@ var evaluateCompatibility = ({
       for (const edgeId of graph.outboundEdges(svcId)) {
         const e = graph.getEdgeAttributes(edgeId);
         if (e.type !== EdgeType.CONNECTS_TO) continue;
-        if (e.provenance === Provenance2.FRONTIER) continue;
         const dbAttrs = graph.getNodeAttributes(e.target);
+        if (dbAttrs.type === NodeType2.FrontierNode) continue;
         if (dbAttrs.type !== NodeType2.DatabaseNode) continue;
         const db = dbAttrs;
         for (const pair of compatPairs()) {
@@ -1017,10 +1019,10 @@ var PolicyViolationsLog = class {
 import {
   EdgeType as EdgeType2,
   NodeType as NodeType3,
-  Provenance as Provenance3,
+  Provenance,
+  confidenceForObservedSignal,
   databaseId,
   extractedEdgeId,
-  frontierEdgeId,
   frontierId,
   inferredEdgeId,
   observedEdgeId,
@@ -1182,31 +1184,6 @@ function ensureFrontierNode(graph, host, ts) {
   graph.addNode(id, node);
   return id;
 }
-function upsertFrontierEdge(graph, type, source, target, ts) {
-  const id = frontierEdgeId(source, target, type);
-  if (graph.hasEdge(id)) {
-    const existing = graph.getEdgeAttributes(id);
-    const updated = {
-      ...existing,
-      provenance: Provenance3.FRONTIER,
-      lastObserved: ts,
-      callCount: (existing.callCount ?? 0) + 1
-    };
-    graph.replaceEdgeAttributes(id, updated);
-    return;
-  }
-  const edge = {
-    id,
-    source,
-    target,
-    type,
-    provenance: Provenance3.FRONTIER,
-    confidence: 1,
-    lastObserved: ts,
-    callCount: 1
-  };
-  graph.addEdgeWithKey(id, source, target, edge);
-}
 function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
   if (!graph.hasNode(source) || !graph.hasNode(target)) return null;
   const id = makeObservedEdgeId(type, source, target);
@@ -1214,35 +1191,37 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
     const existing = graph.getEdgeAttributes(id);
     const newSpanCount = (existing.signal?.spanCount ?? existing.callCount ?? 0) + 1;
     const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
+    const newSignal = {
+      spanCount: newSpanCount,
+      errorCount: newErrorCount,
+      lastObservedAgeMs: 0
+    };
     const updated = {
       ...existing,
-      provenance: Provenance3.OBSERVED,
+      provenance: Provenance.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
-      signal: {
-        spanCount: newSpanCount,
-        errorCount: newErrorCount,
-        lastObservedAgeMs: 0
-      },
-      confidence: 1
+      signal: newSignal,
+      confidence: confidenceForObservedSignal(newSignal)
     };
     graph.replaceEdgeAttributes(id, updated);
     return { edge: updated, created: false };
   }
+  const signal = {
+    spanCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedAgeMs: 0
+  };
   const edge = {
     id,
     source,
     target,
     type,
-    provenance: Provenance3.OBSERVED,
-    confidence: 1,
+    provenance: Provenance.OBSERVED,
+    confidence: confidenceForObservedSignal(signal),
     lastObserved: ts,
     callCount: 1,
-    signal: {
-      spanCount: 1,
-      errorCount: isError ? 1 : 0,
-      lastObservedAgeMs: 0
-    }
+    signal
   };
   graph.addEdgeWithKey(id, source, target, edge);
   return { edge, created: true };
@@ -1257,7 +1236,7 @@ function stitchTrace(graph, sourceServiceId, ts) {
     const outbound = graph.outboundEdges(nodeId);
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.provenance !== Provenance3.EXTRACTED) continue;
+      if (edge.provenance !== Provenance.EXTRACTED) continue;
       if (graph.hasEdge(observedEdgeId(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
       if (!visited.has(edge.target)) {
@@ -1280,7 +1259,7 @@ function upsertInferredEdge(graph, type, source, target, ts) {
     source,
     target,
     type,
-    provenance: Provenance3.INFERRED,
+    provenance: Provenance.INFERRED,
     confidence: INFERRED_CONFIDENCE,
     lastObserved: ts
   };
@@ -1290,18 +1269,28 @@ async function appendErrorEvent(ctx, ev) {
   await fs3.mkdir(path3.dirname(ctx.errorsPath), { recursive: true });
   await fs3.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
 }
+function sanitizeAttributes(attrs) {
+  const out = {};
+  for (const [k, v] of Object.entries(attrs)) {
+    if (typeof v === "bigint") out[k] = v.toString();
+    else out[k] = v;
+  }
+  return out;
+}
 function buildErrorEventForReceiver(span) {
   if (span.statusCode !== 2) return null;
   const ts = span.startTimeIso ?? (/* @__PURE__ */ new Date()).toISOString();
+  const attrs = sanitizeAttributes(span.attributes);
   return {
     id: `${span.traceId}:${span.spanId}`,
     timestamp: ts,
     service: span.service,
     traceId: span.traceId,
     spanId: span.spanId,
-    errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+    errorMessage: span.exception?.message ?? span.name ?? "unknown error",
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+    ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
     affectedNode: serviceId(span.service)
   };
 }
@@ -1352,11 +1341,16 @@ async function handleSpan(ctx, span) {
         affectedNode = targetId;
         resolvedViaAddress = true;
       } else if (!targetId) {
-        const frontierId2 = ensureFrontierNode(ctx.graph, host, ts);
-        if (ctx.graph.hasNode(sourceId)) {
-          upsertFrontierEdge(ctx.graph, EdgeType2.CALLS, sourceId, frontierId2, ts);
-        }
-        affectedNode = frontierId2;
+        const frontierNodeId = ensureFrontierNode(ctx.graph, host, ts);
+        upsertObservedEdge(
+          ctx.graph,
+          EdgeType2.CALLS,
+          sourceId,
+          frontierNodeId,
+          ts,
+          isError
+        );
+        affectedNode = frontierNodeId;
         resolvedViaAddress = true;
       }
     }
@@ -1378,15 +1372,17 @@ async function handleSpan(ctx, span) {
   if (span.statusCode === 2) {
     stitchTrace(ctx.graph, sourceId, ts);
     if (ctx.writeErrorEventInline !== false) {
+      const attrs = sanitizeAttributes(span.attributes);
       const ev = {
         id: `${span.traceId}:${span.spanId}`,
         timestamp: ts,
         service: span.service,
         traceId: span.traceId,
         spanId: span.spanId,
-        errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+        errorMessage: span.exception?.message ?? span.name ?? "unknown error",
         ...span.exception?.type ? { exceptionType: span.exception.type } : {},
         ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+        ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
         affectedNode
       };
       await appendErrorEvent(ctx, ev);
@@ -1442,8 +1438,7 @@ function rewireFrontierEdges(graph, frontierId2, serviceId3) {
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
   graph.dropEdge(oldEdgeId);
-  const promotedProvenance = edge.provenance === Provenance3.FRONTIER ? Provenance3.OBSERVED : edge.provenance;
-  const newId = promotedProvenance === Provenance3.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : promotedProvenance === Provenance3.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : promotedProvenance === Provenance3.EXTRACTED ? extractedEdgeId(newSource, newTarget, edge.type) : frontierEdgeId(newSource, newTarget, edge.type);
+  const newId = edge.provenance === Provenance.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : edge.provenance === Provenance.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : extractedEdgeId(newSource, newTarget, edge.type);
   if (graph.hasEdge(newId)) {
     const existing = graph.getEdgeAttributes(newId);
     const merged = {
@@ -1458,8 +1453,7 @@ function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
     ...edge,
     id: newId,
     source: newSource,
-    target: newTarget,
-    provenance: promotedProvenance
+    target: newTarget
   };
   graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
 }
@@ -1478,12 +1472,12 @@ async function markStaleEdges(graph, options = {}) {
   const project = options.project ?? DEFAULT_PROJECT;
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    if (e.provenance !== Provenance3.OBSERVED) return;
+    if (e.provenance !== Provenance.OBSERVED) return;
     if (!e.lastObserved) return;
     const threshold = thresholdForEdgeType(e.type, thresholds);
     const age = now - new Date(e.lastObserved).getTime();
     if (age > threshold) {
-      const updated = { ...e, provenance: Provenance3.STALE, confidence: 0.3 };
+      const updated = { ...e, provenance: Provenance.STALE, confidence: 0.3 };
       graph.replaceEdgeAttributes(id, updated);
       events.push({
         edgeId: id,
@@ -1500,8 +1494,8 @@ async function markStaleEdges(graph, options = {}) {
         project,
         payload: {
           edgeId: id,
-          from: Provenance3.OBSERVED,
-          to: Provenance3.STALE
+          from: Provenance.OBSERVED,
+          to: Provenance.STALE
         }
       });
     }
@@ -1593,6 +1587,27 @@ function formatExtractionBanner(count) {
   if (count === 1) return `[neat] 1 file skipped due to parse errors`;
   return `[neat] ${count} files skipped due to parse errors`;
 }
+var droppedSink = [];
+function noteExtractedDropped(edge) {
+  droppedSink.push(edge);
+}
+function drainDroppedExtracted() {
+  return droppedSink.splice(0, droppedSink.length);
+}
+function isRejectedLogEnabled() {
+  const raw = process.env.NEAT_EXTRACTED_REJECTED_LOG;
+  return raw === "1" || raw === "true";
+}
+async function writeRejectedExtracted(drops, rejectedPath) {
+  if (drops.length === 0) return;
+  await fs4.mkdir(path4.dirname(rejectedPath), { recursive: true });
+  const lines = drops.map((d) => JSON.stringify({ ...d, ts: (/* @__PURE__ */ new Date()).toISOString() })).join("\n") + "\n";
+  await fs4.appendFile(rejectedPath, lines, "utf8");
+}
+function formatPrecisionFloorBanner(count) {
+  if (count === 1) return `[neat] 1 extracted edge dropped below precision floor`;
+  return `[neat] ${count} extracted edges dropped below precision floor`;
+}
 
 // src/extract/services.ts
 import { promises as fs8 } from "fs";
@@ -2223,7 +2238,13 @@ async function addServiceAliases(graph, scanPath, services) {
 
 // src/extract/databases/index.ts
 import path17 from "path";
-import { EdgeType as EdgeType3, NodeType as NodeType6, Provenance as Provenance4, databaseId as databaseId2 } from "@neat.is/types";
+import {
+  EdgeType as EdgeType3,
+  NodeType as NodeType6,
+  Provenance as Provenance2,
+  databaseId as databaseId2,
+  confidenceForExtracted
+} from "@neat.is/types";
 
 // src/extract/databases/db-config-yaml.ts
 import path10 from "path";
@@ -2797,7 +2818,8 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         source: service.node.id,
         target: dbNode.id,
         type: EdgeType3.CONNECTS_TO,
-        provenance: Provenance4.EXTRACTED,
+        provenance: Provenance2.EXTRACTED,
+        confidence: confidenceForExtracted("structural"),
         // ADR-032 / #140 — every EXTRACTED edge carries evidence.file.
         // Ghost-edge cleanup keys retirement on this; the conditional
         // sourceFile spread that used to live here was a v0.1.x leftover.
@@ -2830,7 +2852,13 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 // src/extract/configs.ts
 import { promises as fs12 } from "fs";
 import path18 from "path";
-import { EdgeType as EdgeType4, NodeType as NodeType7, Provenance as Provenance5, configId } from "@neat.is/types";
+import {
+  EdgeType as EdgeType4,
+  NodeType as NodeType7,
+  Provenance as Provenance3,
+  configId,
+  confidenceForExtracted as confidenceForExtracted2
+} from "@neat.is/types";
 async function walkConfigFiles(dir) {
   const out = [];
   async function walk(current) {
@@ -2870,7 +2898,8 @@ async function addConfigNodes(graph, services, scanPath) {
         source: service.node.id,
         target: node.id,
         type: EdgeType4.CONFIGURED_BY,
-        provenance: Provenance5.EXTRACTED,
+        provenance: Provenance3.EXTRACTED,
+        confidence: confidenceForExtracted2("structural"),
         evidence: { file: relPath.split(path18.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
@@ -2883,14 +2912,25 @@ async function addConfigNodes(graph, services, scanPath) {
 }
 
 // src/extract/calls/index.ts
-import { EdgeType as EdgeType6, NodeType as NodeType8, Provenance as Provenance7 } from "@neat.is/types";
+import {
+  EdgeType as EdgeType6,
+  NodeType as NodeType8,
+  Provenance as Provenance5,
+  confidenceForExtracted as confidenceForExtracted4,
+  passesExtractedFloor as passesExtractedFloor2
+} from "@neat.is/types";
 
 // src/extract/calls/http.ts
 import path20 from "path";
 import Parser from "tree-sitter";
 import JavaScript from "tree-sitter-javascript";
 import Python from "tree-sitter-python";
-import { EdgeType as EdgeType5, Provenance as Provenance6 } from "@neat.is/types";
+import {
+  EdgeType as EdgeType5,
+  Provenance as Provenance4,
+  confidenceForExtracted as confidenceForExtracted3,
+  passesExtractedFloor
+} from "@neat.is/types";
 
 // src/extract/calls/shared.ts
 import { promises as fs13 } from "fs";
@@ -3022,17 +3062,32 @@ async function addHttpCallEdges(graph, services) {
     for (const [targetId, evidenceFile] of seenTargets) {
       const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
       const line = lineOf(fileContent, `//${evidenceFile.host}`);
+      const confidence = confidenceForExtracted3("hostname-shape-match");
+      const ev = {
+        file: path20.relative(service.dir, evidenceFile.file),
+        line,
+        snippet: snippet(fileContent, line)
+      };
+      const edgeId = extractedEdgeId2(service.node.id, targetId, EdgeType5.CALLS);
+      if (!passesExtractedFloor(confidence)) {
+        noteExtractedDropped({
+          source: service.node.id,
+          target: targetId,
+          type: EdgeType5.CALLS,
+          confidence,
+          confidenceKind: "hostname-shape-match",
+          evidence: ev
+        });
+        continue;
+      }
       const edge = {
-        id: extractedEdgeId2(service.node.id, targetId, EdgeType5.CALLS),
+        id: edgeId,
         source: service.node.id,
         target: targetId,
         type: EdgeType5.CALLS,
-        provenance: Provenance6.EXTRACTED,
-        evidence: {
-          file: path20.relative(service.dir, evidenceFile.file),
-          line,
-          snippet: snippet(fileContent, line)
-        }
+        provenance: Provenance4.EXTRACTED,
+        confidence,
+        evidence: ev
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -3070,6 +3125,10 @@ function kafkaEndpointsFromFile(file, serviceDir) {
       name: topic,
       kind: "kafka-topic",
       edgeType,
+      // `producer.send({topic: 'x'})` / `consumer.subscribe({topic: 'x'})` —
+      // framework-aware (kafkajs / node-rdkafka shape). Verified-call-site
+      // tier (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: path21.relative(serviceDir, file.path),
         line,
@@ -3101,6 +3160,10 @@ function redisEndpointsFromFile(file, serviceDir) {
       name: host,
       kind: "redis",
       edgeType: "CALLS",
+      // `redis://host` URL literal — the scheme is structural support, but no
+      // call expression is verified to wire it through. URL-with-structural-
+      // support tier (ADR-066).
+      confidenceKind: "url-with-structural-support",
       evidence: {
         file: path22.relative(serviceDir, file.path),
         line,
@@ -3141,6 +3204,10 @@ function awsEndpointsFromFile(file, serviceDir) {
       name,
       kind,
       edgeType: "CALLS",
+      // SDK marker (S3Client, GetCommand, etc.) plus a Bucket/TableName
+      // literal — framework-aware recognizer, verified-call-site tier
+      // (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: path23.relative(serviceDir, file.path),
         line,
@@ -3219,6 +3286,10 @@ function grpcEndpointsFromFile(file, serviceDir) {
       name,
       kind,
       edgeType: "CALLS",
+      // `new <Name>Client(...)` with @aws-sdk/* or @grpc/grpc-js import
+      // context — import-aware classification per #238. Verified-call-site
+      // tier (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: path24.relative(serviceDir, file.path),
         line,
@@ -3279,13 +3350,26 @@ async function addExternalEndpointEdges(graph, services) {
       const edgeId = extractedEdgeId2(service.node.id, ep.infraId, edgeType);
       if (seenEdges.has(edgeId)) continue;
       seenEdges.add(edgeId);
+      const confidence = confidenceForExtracted4(ep.confidenceKind);
+      if (!passesExtractedFloor2(confidence)) {
+        noteExtractedDropped({
+          source: service.node.id,
+          target: ep.infraId,
+          type: edgeType,
+          confidence,
+          confidenceKind: ep.confidenceKind,
+          evidence: ep.evidence
+        });
+        continue;
+      }
       if (!graph.hasEdge(edgeId)) {
         const edge = {
           id: edgeId,
           source: service.node.id,
           target: ep.infraId,
           type: edgeType,
-          provenance: Provenance7.EXTRACTED,
+          provenance: Provenance5.EXTRACTED,
+          confidence,
           evidence: ep.evidence
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3306,7 +3390,7 @@ async function addCallEdges(graph, services) {
 
 // src/extract/infra/docker-compose.ts
 import path25 from "path";
-import { EdgeType as EdgeType7, Provenance as Provenance8 } from "@neat.is/types";
+import { EdgeType as EdgeType7, Provenance as Provenance6, confidenceForExtracted as confidenceForExtracted5 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
 import { NodeType as NodeType9, infraId as infraId5 } from "@neat.is/types";
@@ -3399,7 +3483,8 @@ async function addComposeInfra(graph, scanPath, services) {
         source: sourceId,
         target: targetId,
         type: EdgeType7.DEPENDS_ON,
-        provenance: Provenance8.EXTRACTED,
+        provenance: Provenance6.EXTRACTED,
+        confidence: confidenceForExtracted5("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3412,7 +3497,7 @@ async function addComposeInfra(graph, scanPath, services) {
 // src/extract/infra/dockerfile.ts
 import path26 from "path";
 import { promises as fs14 } from "fs";
-import { EdgeType as EdgeType8, Provenance as Provenance9 } from "@neat.is/types";
+import { EdgeType as EdgeType8, Provenance as Provenance7, confidenceForExtracted as confidenceForExtracted6 } from "@neat.is/types";
 function runtimeImage(content) {
   const lines = content.split("\n");
   let last = null;
@@ -3458,7 +3543,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         source: service.node.id,
         target: node.id,
         type: EdgeType8.RUNS_ON,
-        provenance: Provenance9.EXTRACTED,
+        provenance: Provenance7.EXTRACTED,
+        confidence: confidenceForExtracted6("structural"),
         evidence: {
           file: path26.relative(scanPath, dockerfilePath).split(path26.sep).join("/")
         }
@@ -3573,16 +3659,19 @@ async function addInfra(graph, scanPath, services) {
   };
 }
 
+// src/extract/index.ts
+import path30 from "path";
+
 // src/extract/retire.ts
 import { existsSync } from "fs";
 import path29 from "path";
-import { Provenance as Provenance10 } from "@neat.is/types";
+import { Provenance as Provenance8 } from "@neat.is/types";
 function retireEdgesByFile(graph, file) {
   const normalized = file.split("\\").join("/");
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance10.EXTRACTED) return;
+    if (edge.provenance !== Provenance8.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -3594,7 +3683,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance10.EXTRACTED) return;
+    if (edge.provenance !== Provenance8.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (path29.isAbsolute(evidenceFile)) {
@@ -3636,13 +3725,26 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
       );
     }
   }
+  const droppedEntries = drainDroppedExtracted();
+  if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
+    const rejectedPath = path30.join(path30.dirname(opts.errorsPath), "rejected.ndjson");
+    try {
+      await writeRejectedExtracted(droppedEntries, rejectedPath);
+    } catch (err) {
+      console.warn(
+        `[neat] failed to write rejected extracted edges to ${rejectedPath}: ${err.message}`
+      );
+    }
+  }
   const result = {
     nodesAdded: phase1Nodes + phase2.nodesAdded + phase3.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
     edgesAdded: phase2.edgesAdded + phase3.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
-    ghostsRetired
+    ghostsRetired,
+    extractedDropped: droppedEntries.length,
+    droppedEntries
   };
   emitNeatEvent({
     type: "extraction-complete",
@@ -3659,8 +3761,9 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/persist.ts
 import { promises as fs17 } from "fs";
-import path30 from "path";
-var SCHEMA_VERSION = 2;
+import path31 from "path";
+import { Provenance as Provenance9, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+var SCHEMA_VERSION = 3;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -3672,8 +3775,27 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV2ToV3(payload) {
+  const edges = payload.graph.edges;
+  if (Array.isArray(edges)) {
+    for (const edge of edges) {
+      const attrs = edge.attributes;
+      if (!attrs || attrs.provenance !== "FRONTIER") continue;
+      attrs.provenance = Provenance9.OBSERVED;
+      const type = typeof attrs.type === "string" ? attrs.type : void 0;
+      const source = typeof attrs.source === "string" ? attrs.source : void 0;
+      const target = typeof attrs.target === "string" ? attrs.target : void 0;
+      if (type && source && target) {
+        const newId = observedEdgeId2(source, target, type);
+        attrs.id = newId;
+        if (edge.key) edge.key = newId;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 3 };
+}
 async function ensureDir(filePath) {
-  await fs17.mkdir(path30.dirname(filePath), { recursive: true });
+  await fs17.mkdir(path31.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -3698,6 +3820,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 1) {
     payload = migrateV1ToV2(payload);
   }
+  if (payload.schemaVersion === 2) {
+    payload = migrateV2ToV3(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -3817,23 +3942,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path31 from "path";
+import path32 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path31.join(baseDir, "graph.json"),
-      errorsPath: path31.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path31.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path31.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path31.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path32.join(baseDir, "graph.json"),
+      errorsPath: path32.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path32.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path32.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path32.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path31.join(baseDir, `${project}.json`),
-    errorsPath: path31.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path31.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path31.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path31.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path32.join(baseDir, `${project}.json`),
+    errorsPath: path32.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path32.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path32.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path32.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -3874,7 +3999,7 @@ function parseExtraProjects(raw) {
 // src/registry.ts
 import { promises as fs19 } from "fs";
 import os2 from "os";
-import path32 from "path";
+import path33 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -3882,17 +4007,17 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path32.resolve(override);
-  return path32.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path33.resolve(override);
+  return path33.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path32.join(neatHome(), "projects.json");
+  return path33.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path32.join(neatHome(), "projects.json.lock");
+  return path33.join(neatHome(), "projects.json.lock");
 }
 async function normalizeProjectPath(input) {
-  const resolved = path32.resolve(input);
+  const resolved = path33.resolve(input);
   try {
     return await fs19.realpath(resolved);
   } catch {
@@ -3900,7 +4025,7 @@ async function normalizeProjectPath(input) {
   }
 }
 async function writeAtomically(target, contents) {
-  await fs19.mkdir(path32.dirname(target), { recursive: true });
+  await fs19.mkdir(path33.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
   const fd = await fs19.open(tmp, "w");
   try {
@@ -3913,7 +4038,7 @@ async function writeAtomically(target, contents) {
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await fs19.mkdir(path32.dirname(lockPath), { recursive: true });
+  await fs19.mkdir(path33.dirname(lockPath), { recursive: true });
   while (true) {
     try {
       const fd = await fs19.open(lockPath, "wx");
@@ -4051,7 +4176,7 @@ import {
   EdgeType as EdgeType9,
   NodeType as NodeType10,
   parseEdgeId,
-  Provenance as Provenance11
+  Provenance as Provenance10
 } from "@neat.is/types";
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
@@ -4065,20 +4190,17 @@ function bucketEdges(graph) {
     const key = bucketKey(e.source, e.target, e.type);
     const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
-      case Provenance11.EXTRACTED:
+      case Provenance10.EXTRACTED:
         cur.extracted = e;
         break;
-      case Provenance11.OBSERVED:
+      case Provenance10.OBSERVED:
         cur.observed = e;
         break;
-      case Provenance11.INFERRED:
+      case Provenance10.INFERRED:
         cur.inferred = e;
         break;
-      case Provenance11.FRONTIER:
-        cur.frontier = e;
-        break;
       default:
-        if (e.provenance === Provenance11.STALE) cur.stale = e;
+        if (e.provenance === Provenance10.STALE) cur.stale = e;
     }
     buckets.set(key, cur);
   });
@@ -4089,14 +4211,6 @@ function nodeIsFrontier(graph, nodeId) {
   const attrs = graph.getNodeAttributes(nodeId);
   return attrs.type === NodeType10.FrontierNode;
 }
-function hasAnyObservedFromSource(graph, sourceId) {
-  if (!graph.hasNode(sourceId)) return false;
-  for (const edgeId of graph.outboundEdges(sourceId)) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.provenance === Provenance11.OBSERVED) return true;
-  }
-  return false;
-}
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
   return Math.max(0, Math.min(1, n));
@@ -4110,32 +4224,34 @@ function reasonForMissingExtracted(source, target, type) {
 var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
 var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
 var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function gradedConfidence(edge) {
+  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
+  return clampConfidence(confidenceForEdge(edge));
+}
 function detectMissingDivergences(graph, bucket) {
   const out = [];
   if (bucket.extracted && !bucket.observed) {
     if (!nodeIsFrontier(graph, bucket.target)) {
-      const sourceHasTraffic = hasAnyObservedFromSource(graph, bucket.source);
       out.push({
         type: "missing-observed",
         source: bucket.source,
         target: bucket.target,
         edgeType: bucket.type,
         extracted: bucket.extracted,
-        confidence: sourceHasTraffic ? 1 : 0.5,
+        confidence: gradedConfidence(bucket.extracted),
         reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
         recommendation: RECOMMENDATION_MISSING_OBSERVED
       });
     }
   }
   if (bucket.observed && !bucket.extracted) {
-    const cascaded = clampConfidence(confidenceForEdge(bucket.observed));
     out.push({
       type: "missing-extracted",
       source: bucket.source,
       target: bucket.target,
       edgeType: bucket.type,
       observed: bucket.observed,
-      confidence: cascaded,
+      confidence: gradedConfidence(bucket.observed),
       reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
       recommendation: RECOMMENDATION_MISSING_EXTRACTED
     });
@@ -4154,7 +4270,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance11.EXTRACTED) {
+    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance10.EXTRACTED) {
       return true;
     }
   }
@@ -4168,7 +4284,7 @@ function detectHostMismatch(graph, svcId, svc) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
     if (edge.type !== EdgeType9.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance11.OBSERVED) continue;
+    if (edge.provenance !== Provenance10.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType10.DatabaseNode) continue;
     const observedHost = target.host?.trim();
@@ -4193,7 +4309,7 @@ function detectCompatDivergences(graph, svcId, svc) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
     if (edge.type !== EdgeType9.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance11.OBSERVED) continue;
+    if (edge.provenance !== Provenance10.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType10.DatabaseNode) continue;
     for (const pair of compatPairs()) {
@@ -4274,8 +4390,17 @@ function computeDivergences(graph, opts = {}) {
     const target = opts.node;
     filtered = filtered.filter((d) => involvesNode(d, target));
   }
+  const TYPE_LEADERSHIP = {
+    "missing-extracted": 0,
+    "missing-observed": 1,
+    "version-mismatch": 2,
+    "host-mismatch": 3,
+    "compat-violation": 4
+  };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
+    if (lead !== 0) return lead;
     if (a.type !== b.type) return a.type.localeCompare(b.type);
     if (a.source !== b.source) return a.source.localeCompare(b.source);
     return a.target.localeCompare(b.target);
@@ -4795,6 +4920,7 @@ export {
   readErrorEvents,
   isStrictExtractionEnabled,
   formatExtractionBanner,
+  formatPrecisionFloorBanner,
   discoverServices,
   addServiceNodes,
   addServiceAliases,
@@ -4826,4 +4952,4 @@ export {
   removeProject,
   buildApi
 };
-//# sourceMappingURL=chunk-VABXPLDT.js.map
+//# sourceMappingURL=chunk-BUB3ASD5.js.map