@neat.is/core 0.3.3 → 0.3.5

package/dist/server.cjs

@@ -99,8 +99,8 @@ function reshapeGrpcRequest(req) {
   };
 }
 function resolveProtoRoot() {
-  const here = import_node_path33.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
-  return import_node_path33.default.resolve(here, "..", "proto");
+  const here = import_node_path34.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path34.default.resolve(here, "..", "proto");
 }
 function loadTraceService() {
   const protoRoot = resolveProtoRoot();
@@ -155,13 +155,13 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path33, grpc, protoLoader;
+var import_node_url, import_node_path34, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
-    import_node_path33 = __toESM(require("path"), 1);
+    import_node_path34 = __toESM(require("path"), 1);
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
     init_otel();
@@ -258,10 +258,10 @@ function parseOtlpRequest(body) {
 }
 function loadProtobufDecoder() {
   if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
-  const here = import_node_path34.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
-  const protoRoot = import_node_path34.default.resolve(here, "..", "proto");
+  const here = import_node_path35.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path35.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
-  root.resolvePath = (_origin, target) => import_node_path34.default.resolve(protoRoot, target);
+  root.resolvePath = (_origin, target) => import_node_path35.default.resolve(protoRoot, target);
   root.loadSync(
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
@@ -353,12 +353,12 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path34, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType;
+var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path34 = __toESM(require("path"), 1);
+    import_node_path35 = __toESM(require("path"), 1);
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
@@ -368,7 +368,7 @@ var init_otel = __esm({
 
 // src/server.ts
 init_cjs_shims();
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
 
 // src/graph.ts
 init_cjs_shims();
@@ -716,11 +716,16 @@ init_cjs_shims();
 var import_types = require("@neat.is/types");
 var ROOT_CAUSE_MAX_DEPTH = 5;
 var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function isFrontierNode(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === import_types.NodeType.FrontierNode;
+}
 function bestEdgeBySource(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (e.provenance === import_types.Provenance.FRONTIER) continue;
+    if (isFrontierNode(graph, e.source)) continue;
     const cur = best.get(e.source);
     if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
       best.set(e.source, e);
@@ -732,7 +737,7 @@ function bestEdgeByTarget(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (e.provenance === import_types.Provenance.FRONTIER) continue;
+    if (isFrontierNode(graph, e.target)) continue;
     const cur = best.get(e.target);
     if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
       best.set(e.target, e);
@@ -744,8 +749,7 @@ var PROVENANCE_CEILING = {
   OBSERVED: 1,
   INFERRED: 0.7,
   EXTRACTED: 0.5,
-  STALE: 0.3,
-  FRONTIER: 0.3
+  STALE: 0.3
 };
 function volumeWeight(spanCount) {
   if (!spanCount || spanCount <= 0) return 0.5;
@@ -798,19 +802,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path37, edges) {
-    if (path37.length > best.path.length) {
-      best = { path: [...path37], edges: [...edges] };
+  function step(node, path38, edges) {
+    if (path38.length > best.path.length) {
+      best = { path: [...path38], edges: [...edges] };
     }
-    if (path37.length - 1 >= maxDepth) return;
+    if (path38.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path37.push(srcId);
+      path38.push(srcId);
       edges.push(edge);
-      step(srcId, path37, edges);
-      path37.pop();
+      step(srcId, path38, edges);
+      path38.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1014,9 +1018,6 @@ function bucketEdges(graph) {
       case import_types2.Provenance.INFERRED:
         cur.inferred = e;
         break;
-      case import_types2.Provenance.FRONTIER:
-        cur.frontier = e;
-        break;
       default:
         if (e.provenance === import_types2.Provenance.STALE) cur.stale = e;
     }
@@ -1029,14 +1030,6 @@ function nodeIsFrontier(graph, nodeId) {
   const attrs = graph.getNodeAttributes(nodeId);
   return attrs.type === import_types2.NodeType.FrontierNode;
 }
-function hasAnyObservedFromSource(graph, sourceId) {
-  if (!graph.hasNode(sourceId)) return false;
-  for (const edgeId of graph.outboundEdges(sourceId)) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.provenance === import_types2.Provenance.OBSERVED) return true;
-  }
-  return false;
-}
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
   return Math.max(0, Math.min(1, n));
@@ -1050,32 +1043,34 @@ function reasonForMissingExtracted(source, target, type) {
 var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
 var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
 var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function gradedConfidence(edge) {
+  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
+  return clampConfidence(confidenceForEdge(edge));
+}
 function detectMissingDivergences(graph, bucket) {
   const out = [];
   if (bucket.extracted && !bucket.observed) {
     if (!nodeIsFrontier(graph, bucket.target)) {
-      const sourceHasTraffic = hasAnyObservedFromSource(graph, bucket.source);
       out.push({
         type: "missing-observed",
         source: bucket.source,
         target: bucket.target,
         edgeType: bucket.type,
         extracted: bucket.extracted,
-        confidence: sourceHasTraffic ? 1 : 0.5,
+        confidence: gradedConfidence(bucket.extracted),
         reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
         recommendation: RECOMMENDATION_MISSING_OBSERVED
       });
     }
   }
   if (bucket.observed && !bucket.extracted) {
-    const cascaded = clampConfidence(confidenceForEdge(bucket.observed));
     out.push({
       type: "missing-extracted",
       source: bucket.source,
       target: bucket.target,
       edgeType: bucket.type,
       observed: bucket.observed,
-      confidence: cascaded,
+      confidence: gradedConfidence(bucket.observed),
       reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
       recommendation: RECOMMENDATION_MISSING_EXTRACTED
     });
@@ -1214,8 +1209,17 @@ function computeDivergences(graph, opts = {}) {
     const target = opts.node;
     filtered = filtered.filter((d) => involvesNode(d, target));
   }
+  const TYPE_LEADERSHIP = {
+    "missing-extracted": 0,
+    "missing-observed": 1,
+    "version-mismatch": 2,
+    "host-mismatch": 3,
+    "compat-violation": 4
+  };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
+    if (lead !== 0) return lead;
     if (a.type !== b.type) return a.type.localeCompare(b.type);
     if (a.source !== b.source) return a.source.localeCompare(b.source);
     return a.target.localeCompare(b.target);
@@ -1282,8 +1286,8 @@ var evaluateStructural = ({
     for (const edgeId of graph.outboundEdges(id)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type !== rule.edgeType) continue;
-      if (e.provenance === import_types3.Provenance.FRONTIER) continue;
       const target = graph.getNodeAttributes(e.target);
+      if (target.type === import_types3.NodeType.FrontierNode) continue;
       if (target.type === rule.toNodeType) {
         satisfied = true;
         break;
@@ -1402,8 +1406,8 @@ var evaluateCompatibility = ({
       for (const edgeId of graph.outboundEdges(svcId)) {
         const e = graph.getEdgeAttributes(edgeId);
         if (e.type !== import_types3.EdgeType.CONNECTS_TO) continue;
-        if (e.provenance === import_types3.Provenance.FRONTIER) continue;
         const dbAttrs = graph.getNodeAttributes(e.target);
+        if (dbAttrs.type === import_types3.NodeType.FrontierNode) continue;
         if (dbAttrs.type !== import_types3.NodeType.DatabaseNode) continue;
         const db = dbAttrs;
         for (const pair of compatPairs()) {
@@ -1729,31 +1733,6 @@ function ensureFrontierNode(graph, host, ts) {
   graph.addNode(id, node);
   return id;
 }
-function upsertFrontierEdge(graph, type, source, target, ts) {
-  const id = (0, import_types4.frontierEdgeId)(source, target, type);
-  if (graph.hasEdge(id)) {
-    const existing = graph.getEdgeAttributes(id);
-    const updated = {
-      ...existing,
-      provenance: import_types4.Provenance.FRONTIER,
-      lastObserved: ts,
-      callCount: (existing.callCount ?? 0) + 1
-    };
-    graph.replaceEdgeAttributes(id, updated);
-    return;
-  }
-  const edge = {
-    id,
-    source,
-    target,
-    type,
-    provenance: import_types4.Provenance.FRONTIER,
-    confidence: 1,
-    lastObserved: ts,
-    callCount: 1
-  };
-  graph.addEdgeWithKey(id, source, target, edge);
-}
 function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
   if (!graph.hasNode(source) || !graph.hasNode(target)) return null;
   const id = makeObservedEdgeId(type, source, target);
@@ -1761,35 +1740,37 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
     const existing = graph.getEdgeAttributes(id);
     const newSpanCount = (existing.signal?.spanCount ?? existing.callCount ?? 0) + 1;
     const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
+    const newSignal = {
+      spanCount: newSpanCount,
+      errorCount: newErrorCount,
+      lastObservedAgeMs: 0
+    };
     const updated = {
       ...existing,
       provenance: import_types4.Provenance.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
-      signal: {
-        spanCount: newSpanCount,
-        errorCount: newErrorCount,
-        lastObservedAgeMs: 0
-      },
-      confidence: 1
+      signal: newSignal,
+      confidence: (0, import_types4.confidenceForObservedSignal)(newSignal)
     };
     graph.replaceEdgeAttributes(id, updated);
     return { edge: updated, created: false };
   }
+  const signal = {
+    spanCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedAgeMs: 0
+  };
   const edge = {
     id,
     source,
     target,
     type,
     provenance: import_types4.Provenance.OBSERVED,
-    confidence: 1,
+    confidence: (0, import_types4.confidenceForObservedSignal)(signal),
     lastObserved: ts,
     callCount: 1,
-    signal: {
-      spanCount: 1,
-      errorCount: isError ? 1 : 0,
-      lastObservedAgeMs: 0
-    }
+    signal
   };
   graph.addEdgeWithKey(id, source, target, edge);
   return { edge, created: true };
@@ -1837,6 +1818,14 @@ async function appendErrorEvent(ctx, ev) {
   await import_node_fs3.promises.mkdir(import_node_path3.default.dirname(ctx.errorsPath), { recursive: true });
   await import_node_fs3.promises.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
 }
+function sanitizeAttributes(attrs) {
+  const out = {};
+  for (const [k, v] of Object.entries(attrs)) {
+    if (typeof v === "bigint") out[k] = v.toString();
+    else out[k] = v;
+  }
+  return out;
+}
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
@@ -1876,11 +1865,16 @@ async function handleSpan(ctx, span) {
         affectedNode = targetId;
         resolvedViaAddress = true;
       } else if (!targetId) {
-        const frontierId2 = ensureFrontierNode(ctx.graph, host, ts);
-        if (ctx.graph.hasNode(sourceId)) {
-          upsertFrontierEdge(ctx.graph, import_types4.EdgeType.CALLS, sourceId, frontierId2, ts);
-        }
-        affectedNode = frontierId2;
+        const frontierNodeId = ensureFrontierNode(ctx.graph, host, ts);
+        upsertObservedEdge(
+          ctx.graph,
+          import_types4.EdgeType.CALLS,
+          sourceId,
+          frontierNodeId,
+          ts,
+          isError
+        );
+        affectedNode = frontierNodeId;
         resolvedViaAddress = true;
       }
     }
@@ -1902,15 +1896,17 @@ async function handleSpan(ctx, span) {
   if (span.statusCode === 2) {
     stitchTrace(ctx.graph, sourceId, ts);
     if (ctx.writeErrorEventInline !== false) {
+      const attrs = sanitizeAttributes(span.attributes);
       const ev = {
         id: `${span.traceId}:${span.spanId}`,
         timestamp: ts,
         service: span.service,
         traceId: span.traceId,
         spanId: span.spanId,
-        errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+        errorMessage: span.exception?.message ?? span.name ?? "unknown error",
         ...span.exception?.type ? { exceptionType: span.exception.type } : {},
         ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+        ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
         affectedNode
       };
       await appendErrorEvent(ctx, ev);
@@ -1966,8 +1962,7 @@ function rewireFrontierEdges(graph, frontierId2, serviceId3) {
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
   graph.dropEdge(oldEdgeId);
-  const promotedProvenance = edge.provenance === import_types4.Provenance.FRONTIER ? import_types4.Provenance.OBSERVED : edge.provenance;
-  const newId = promotedProvenance === import_types4.Provenance.OBSERVED ? (0, import_types4.observedEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types4.Provenance.INFERRED ? (0, import_types4.inferredEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types4.Provenance.EXTRACTED ? (0, import_types4.extractedEdgeId)(newSource, newTarget, edge.type) : (0, import_types4.frontierEdgeId)(newSource, newTarget, edge.type);
+  const newId = edge.provenance === import_types4.Provenance.OBSERVED ? (0, import_types4.observedEdgeId)(newSource, newTarget, edge.type) : edge.provenance === import_types4.Provenance.INFERRED ? (0, import_types4.inferredEdgeId)(newSource, newTarget, edge.type) : (0, import_types4.extractedEdgeId)(newSource, newTarget, edge.type);
   if (graph.hasEdge(newId)) {
     const existing = graph.getEdgeAttributes(newId);
     const merged = {
@@ -1982,8 +1977,7 @@ function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
     ...edge,
     id: newId,
     source: newSource,
-    target: newTarget,
-    provenance: promotedProvenance
+    target: newTarget
   };
   graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
 }
@@ -2393,6 +2387,23 @@ async function writeExtractionErrors(errors, errorsPath) {
   const lines = errors.map((e) => JSON.stringify(e)).join("\n") + "\n";
   await import_node_fs7.promises.appendFile(errorsPath, lines, "utf8");
 }
+var droppedSink = [];
+function noteExtractedDropped(edge) {
+  droppedSink.push(edge);
+}
+function drainDroppedExtracted() {
+  return droppedSink.splice(0, droppedSink.length);
+}
+function isRejectedLogEnabled() {
+  const raw = process.env.NEAT_EXTRACTED_REJECTED_LOG;
+  return raw === "1" || raw === "true";
+}
+async function writeRejectedExtracted(drops, rejectedPath) {
+  if (drops.length === 0) return;
+  await import_node_fs7.promises.mkdir(import_node_path7.default.dirname(rejectedPath), { recursive: true });
+  const lines = drops.map((d) => JSON.stringify({ ...d, ts: (/* @__PURE__ */ new Date()).toISOString() })).join("\n") + "\n";
+  await import_node_fs7.promises.appendFile(rejectedPath, lines, "utf8");
+}
 
 // src/extract/services.ts
 var DEFAULT_SCAN_DEPTH = 5;
@@ -3331,6 +3342,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         target: dbNode.id,
         type: import_types8.EdgeType.CONNECTS_TO,
         provenance: import_types8.Provenance.EXTRACTED,
+        confidence: (0, import_types8.confidenceForExtracted)("structural"),
         // ADR-032 / #140 — every EXTRACTED edge carries evidence.file.
         // Ghost-edge cleanup keys retirement on this; the conditional
         // sourceFile spread that used to live here was a v0.1.x leftover.
@@ -3405,6 +3417,7 @@ async function addConfigNodes(graph, services, scanPath) {
         target: node.id,
         type: import_types9.EdgeType.CONFIGURED_BY,
         provenance: import_types9.Provenance.EXTRACTED,
+        confidence: (0, import_types9.confidenceForExtracted)("structural"),
         evidence: { file: relPath.split(import_node_path18.default.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
@@ -3559,17 +3572,32 @@ async function addHttpCallEdges(graph, services) {
     for (const [targetId, evidenceFile] of seenTargets) {
       const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
       const line = lineOf(fileContent, `//${evidenceFile.host}`);
+      const confidence = (0, import_types10.confidenceForExtracted)("hostname-shape-match");
+      const ev = {
+        file: import_node_path20.default.relative(service.dir, evidenceFile.file),
+        line,
+        snippet: snippet(fileContent, line)
+      };
+      const edgeId = (0, import_types5.extractedEdgeId)(service.node.id, targetId, import_types10.EdgeType.CALLS);
+      if (!(0, import_types10.passesExtractedFloor)(confidence)) {
+        noteExtractedDropped({
+          source: service.node.id,
+          target: targetId,
+          type: import_types10.EdgeType.CALLS,
+          confidence,
+          confidenceKind: "hostname-shape-match",
+          evidence: ev
+        });
+        continue;
+      }
       const edge = {
-        id: (0, import_types5.extractedEdgeId)(service.node.id, targetId, import_types10.EdgeType.CALLS),
+        id: edgeId,
         source: service.node.id,
         target: targetId,
         type: import_types10.EdgeType.CALLS,
         provenance: import_types10.Provenance.EXTRACTED,
-        evidence: {
-          file: import_node_path20.default.relative(service.dir, evidenceFile.file),
-          line,
-          snippet: snippet(fileContent, line)
-        }
+        confidence,
+        evidence: ev
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -3608,6 +3636,10 @@ function kafkaEndpointsFromFile(file, serviceDir) {
       name: topic,
       kind: "kafka-topic",
       edgeType,
+      // `producer.send({topic: 'x'})` / `consumer.subscribe({topic: 'x'})` —
+      // framework-aware (kafkajs / node-rdkafka shape). Verified-call-site
+      // tier (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: import_node_path21.default.relative(serviceDir, file.path),
         line,
@@ -3640,6 +3672,10 @@ function redisEndpointsFromFile(file, serviceDir) {
       name: host,
       kind: "redis",
       edgeType: "CALLS",
+      // `redis://host` URL literal — the scheme is structural support, but no
+      // call expression is verified to wire it through. URL-with-structural-
+      // support tier (ADR-066).
+      confidenceKind: "url-with-structural-support",
       evidence: {
         file: import_node_path22.default.relative(serviceDir, file.path),
         line,
@@ -3681,6 +3717,10 @@ function awsEndpointsFromFile(file, serviceDir) {
       name,
       kind,
       edgeType: "CALLS",
+      // SDK marker (S3Client, GetCommand, etc.) plus a Bucket/TableName
+      // literal — framework-aware recognizer, verified-call-site tier
+      // (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: import_node_path23.default.relative(serviceDir, file.path),
         line,
@@ -3760,6 +3800,10 @@ function grpcEndpointsFromFile(file, serviceDir) {
       name,
       kind,
       edgeType: "CALLS",
+      // `new <Name>Client(...)` with @aws-sdk/* or @grpc/grpc-js import
+      // context — import-aware classification per #238. Verified-call-site
+      // tier (ADR-066).
+      confidenceKind: "verified-call-site",
       evidence: {
         file: import_node_path24.default.relative(serviceDir, file.path),
         line,
@@ -3820,6 +3864,18 @@ async function addExternalEndpointEdges(graph, services) {
       const edgeId = (0, import_types5.extractedEdgeId)(service.node.id, ep.infraId, edgeType);
       if (seenEdges.has(edgeId)) continue;
       seenEdges.add(edgeId);
+      const confidence = (0, import_types15.confidenceForExtracted)(ep.confidenceKind);
+      if (!(0, import_types15.passesExtractedFloor)(confidence)) {
+        noteExtractedDropped({
+          source: service.node.id,
+          target: ep.infraId,
+          type: edgeType,
+          confidence,
+          confidenceKind: ep.confidenceKind,
+          evidence: ep.evidence
+        });
+        continue;
+      }
       if (!graph.hasEdge(edgeId)) {
         const edge = {
           id: edgeId,
@@ -3827,6 +3883,7 @@ async function addExternalEndpointEdges(graph, services) {
           target: ep.infraId,
           type: edgeType,
           provenance: import_types15.Provenance.EXTRACTED,
+          confidence,
           evidence: ep.evidence
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -3946,6 +4003,7 @@ async function addComposeInfra(graph, scanPath, services) {
         target: targetId,
         type: import_types17.EdgeType.DEPENDS_ON,
         provenance: import_types17.Provenance.EXTRACTED,
+        confidence: (0, import_types17.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -4006,6 +4064,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         target: node.id,
         type: import_types18.EdgeType.RUNS_ON,
         provenance: import_types18.Provenance.EXTRACTED,
+        confidence: (0, import_types18.confidenceForExtracted)("structural"),
         evidence: {
           file: import_node_path26.default.relative(scanPath, dockerfilePath).split(import_node_path26.default.sep).join("/")
         }
@@ -4122,6 +4181,9 @@ async function addInfra(graph, scanPath, services) {
   };
 }
 
+// src/extract/index.ts
+var import_node_path30 = __toESM(require("path"), 1);
+
 // src/extract/retire.ts
 init_cjs_shims();
 var import_node_fs17 = require("fs");
@@ -4174,13 +4236,26 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
       );
     }
   }
+  const droppedEntries = drainDroppedExtracted();
+  if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
+    const rejectedPath = import_node_path30.default.join(import_node_path30.default.dirname(opts.errorsPath), "rejected.ndjson");
+    try {
+      await writeRejectedExtracted(droppedEntries, rejectedPath);
+    } catch (err) {
+      console.warn(
+        `[neat] failed to write rejected extracted edges to ${rejectedPath}: ${err.message}`
+      );
+    }
+  }
   const result = {
     nodesAdded: phase1Nodes + phase2.nodesAdded + phase3.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
     edgesAdded: phase2.edgesAdded + phase3.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
-    ghostsRetired
+    ghostsRetired,
+    extractedDropped: droppedEntries.length,
+    droppedEntries
   };
   emitNeatEvent({
     type: "extraction-complete",
@@ -4274,23 +4349,23 @@ function canonicalJson(value) {
 
 // src/projects.ts
 init_cjs_shims();
-var import_node_path30 = __toESM(require("path"), 1);
+var import_node_path31 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: import_node_path30.default.join(baseDir, "graph.json"),
-      errorsPath: import_node_path30.default.join(baseDir, "errors.ndjson"),
-      staleEventsPath: import_node_path30.default.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: import_node_path30.default.join(baseDir, "embeddings.json"),
-      policyViolationsPath: import_node_path30.default.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: import_node_path31.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path31.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path31.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path31.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path31.default.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: import_node_path30.default.join(baseDir, `${project}.json`),
-    errorsPath: import_node_path30.default.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: import_node_path30.default.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: import_node_path30.default.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: import_node_path30.default.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: import_node_path31.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path31.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path31.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path31.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path31.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -4332,15 +4407,15 @@ function parseExtraProjects(raw) {
 init_cjs_shims();
 var import_node_fs19 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
-var import_node_path31 = __toESM(require("path"), 1);
+var import_node_path32 = __toESM(require("path"), 1);
 var import_types20 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path31.default.resolve(override);
-  return import_node_path31.default.join(import_node_os2.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path32.default.resolve(override);
+  return import_node_path32.default.join(import_node_os2.default.homedir(), ".neat");
 }
 function registryPath() {
-  return import_node_path31.default.join(neatHome(), "projects.json");
+  return import_node_path32.default.join(neatHome(), "projects.json");
 }
 async function readRegistry() {
   const file = registryPath();
@@ -4850,8 +4925,9 @@ async function buildApi(opts) {
 // src/persist.ts
 init_cjs_shims();
 var import_node_fs20 = require("fs");
-var import_node_path32 = __toESM(require("path"), 1);
-var SCHEMA_VERSION = 2;
+var import_node_path33 = __toESM(require("path"), 1);
+var import_types22 = require("@neat.is/types");
+var SCHEMA_VERSION = 3;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -4863,8 +4939,27 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV2ToV3(payload) {
+  const edges = payload.graph.edges;
+  if (Array.isArray(edges)) {
+    for (const edge of edges) {
+      const attrs = edge.attributes;
+      if (!attrs || attrs.provenance !== "FRONTIER") continue;
+      attrs.provenance = import_types22.Provenance.OBSERVED;
+      const type = typeof attrs.type === "string" ? attrs.type : void 0;
+      const source = typeof attrs.source === "string" ? attrs.source : void 0;
+      const target = typeof attrs.target === "string" ? attrs.target : void 0;
+      if (type && source && target) {
+        const newId = (0, import_types22.observedEdgeId)(source, target, type);
+        attrs.id = newId;
+        if (edge.key) edge.key = newId;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 3 };
+}
 async function ensureDir(filePath) {
-  await import_node_fs20.promises.mkdir(import_node_path32.default.dirname(filePath), { recursive: true });
+  await import_node_fs20.promises.mkdir(import_node_path33.default.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -4889,6 +4984,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 1) {
     payload = migrateV1ToV2(payload);
   }
+  if (payload.schemaVersion === 2) {
+    payload = migrateV2ToV3(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -4938,7 +5036,7 @@ init_otel_grpc();
 // src/search.ts
 init_cjs_shims();
 var import_node_fs21 = require("fs");
-var import_node_path35 = __toESM(require("path"), 1);
+var import_node_path36 = __toESM(require("path"), 1);
 var import_node_crypto = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
@@ -5077,7 +5175,7 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  await import_node_fs21.promises.mkdir(import_node_path35.default.dirname(cachePath), { recursive: true });
+  await import_node_fs21.promises.mkdir(import_node_path36.default.dirname(cachePath), { recursive: true });
   await import_node_fs21.promises.writeFile(cachePath, JSON.stringify(cache));
 }
 var VectorIndex = class {
@@ -5257,14 +5355,14 @@ async function bootProject(registry, name, scanPath, baseDir) {
 async function main() {
   const baseDirEnv = process.env.NEAT_OUT_DIR;
   const legacyOutPath = process.env.NEAT_OUT_PATH;
-  const baseDir = baseDirEnv ? import_node_path36.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path36.default.resolve(import_node_path36.default.dirname(legacyOutPath)) : import_node_path36.default.resolve("./neat-out");
-  const defaultScanPath = import_node_path36.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
+  const baseDir = baseDirEnv ? import_node_path37.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path37.default.resolve(import_node_path37.default.dirname(legacyOutPath)) : import_node_path37.default.resolve("./neat-out");
+  const defaultScanPath = import_node_path37.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
   const registry = new Projects();
   await bootProject(registry, DEFAULT_PROJECT, defaultScanPath, baseDir);
   for (const name of parseExtraProjects(process.env.NEAT_PROJECTS)) {
     const envKey = `NEAT_PROJECT_SCAN_PATH_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
     const projectScan = process.env[envKey];
-    await bootProject(registry, name, projectScan ? import_node_path36.default.resolve(projectScan) : void 0, baseDir);
+    await bootProject(registry, name, projectScan ? import_node_path37.default.resolve(projectScan) : void 0, baseDir);
   }
   const host = process.env.HOST ?? "0.0.0.0";
   const port = Number(process.env.PORT ?? 8080);