@neat.is/core 0.3.7 → 0.3.8

package/dist/{chunk-ZU2RQRCN.js → chunk-CZ3T6TE2.js}

@@ -1,3 +1,7 @@
+import {
+  mountBearerAuth
+} from "./chunk-7TYESDAI.js";
+
 // src/graph.ts
 import GraphDefault from "graphology";
 var MultiDirectedGraph = GraphDefault.MultiDirectedGraph;
@@ -3759,10 +3763,252 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   return result;
 }
 
+// src/divergences.ts
+import {
+  DivergenceResultSchema,
+  EdgeType as EdgeType9,
+  NodeType as NodeType10,
+  parseEdgeId,
+  Provenance as Provenance9
+} from "@neat.is/types";
+function bucketKey(source, target, type) {
+  return `${type}|${source}|${target}`;
+}
+function bucketEdges(graph) {
+  const buckets = /* @__PURE__ */ new Map();
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    const parsed = parseEdgeId(id);
+    const provenance = parsed?.provenance ?? e.provenance;
+    const key = bucketKey(e.source, e.target, e.type);
+    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    switch (provenance) {
+      case Provenance9.EXTRACTED:
+        cur.extracted = e;
+        break;
+      case Provenance9.OBSERVED:
+        cur.observed = e;
+        break;
+      case Provenance9.INFERRED:
+        cur.inferred = e;
+        break;
+      default:
+        if (e.provenance === Provenance9.STALE) cur.stale = e;
+    }
+    buckets.set(key, cur);
+  });
+  return buckets;
+}
+function nodeIsFrontier(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === NodeType10.FrontierNode;
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(1, n));
+}
+function reasonForMissingObserved(source, target, type) {
+  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
+}
+function reasonForMissingExtracted(source, target, type) {
+  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
+}
+var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
+var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
+var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function gradedConfidence(edge) {
+  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
+  return clampConfidence(confidenceForEdge(edge));
+}
+function detectMissingDivergences(graph, bucket) {
+  const out = [];
+  if (bucket.extracted && !bucket.observed) {
+    if (!nodeIsFrontier(graph, bucket.target)) {
+      out.push({
+        type: "missing-observed",
+        source: bucket.source,
+        target: bucket.target,
+        edgeType: bucket.type,
+        extracted: bucket.extracted,
+        confidence: gradedConfidence(bucket.extracted),
+        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
+        recommendation: RECOMMENDATION_MISSING_OBSERVED
+      });
+    }
+  }
+  if (bucket.observed && !bucket.extracted) {
+    out.push({
+      type: "missing-extracted",
+      source: bucket.source,
+      target: bucket.target,
+      edgeType: bucket.type,
+      observed: bucket.observed,
+      confidence: gradedConfidence(bucket.observed),
+      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
+      recommendation: RECOMMENDATION_MISSING_EXTRACTED
+    });
+  }
+  return out;
+}
+function declaredHostFor(svc) {
+  const raw = svc.dbConnectionTarget?.trim();
+  if (!raw) return null;
+  const colon = raw.lastIndexOf(":");
+  if (colon === -1) return raw;
+  const port = raw.slice(colon + 1);
+  if (/^\d+$/.test(port)) return raw.slice(0, colon);
+  return raw;
+}
+function hasExtractedConfiguredBy(graph, svcId) {
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance9.EXTRACTED) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectHostMismatch(graph, svcId, svc) {
+  const declaredHost = declaredHostFor(svc);
+  if (!declaredHost) return [];
+  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
+  const out = [];
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance9.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== NodeType10.DatabaseNode) continue;
+    const observedHost = target.host?.trim();
+    if (!observedHost) continue;
+    if (observedHost === declaredHost) continue;
+    out.push({
+      type: "host-mismatch",
+      source: svcId,
+      target: edge.target,
+      extractedHost: declaredHost,
+      observedHost,
+      confidence: clampConfidence(confidenceForEdge(edge)),
+      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
+      recommendation: RECOMMENDATION_HOST_MISMATCH
+    });
+  }
+  return out;
+}
+function detectCompatDivergences(graph, svcId, svc) {
+  const out = [];
+  const deps = svc.dependencies ?? {};
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance9.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== NodeType10.DatabaseNode) continue;
+    for (const pair of compatPairs()) {
+      if (pair.engine !== target.engine) continue;
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        target.engine,
+        target.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        out.push({
+          type: "version-mismatch",
+          source: svcId,
+          target: edge.target,
+          extractedVersion: declared,
+          observedVersion: target.engineVersion,
+          compatibility: "incompatible",
+          confidence: 1,
+          reason: result.reason,
+          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
+        });
+      }
+    }
+    for (const rule of deprecatedApis()) {
+      const declared = deps[rule.package];
+      if (!declared) continue;
+      const result = checkDeprecatedApi(rule, declared);
+      if (!result.compatible && result.reason) {
+        const ruleRef = {
+          kind: rule.kind ?? "deprecated-api",
+          reason: result.reason,
+          package: rule.package
+        };
+        out.push({
+          type: "compat-violation",
+          source: svcId,
+          target: edge.target,
+          rule: ruleRef,
+          observed: edge,
+          confidence: 1,
+          reason: result.reason,
+          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
+        });
+      }
+    }
+  }
+  return out;
+}
+function involvesNode(d, nodeId) {
+  return d.source === nodeId || d.target === nodeId;
+}
+function computeDivergences(graph, opts = {}) {
+  const all = [];
+  const buckets = bucketEdges(graph);
+  for (const bucket of buckets.values()) {
+    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
+  }
+  graph.forEachNode((nodeId, attrs) => {
+    const n = attrs;
+    if (n.type !== NodeType10.ServiceNode) return;
+    const svc = n;
+    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
+    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+  });
+  let filtered = all;
+  if (opts.type) {
+    const allowed = opts.type;
+    filtered = filtered.filter((d) => allowed.has(d.type));
+  }
+  if (opts.minConfidence !== void 0) {
+    const threshold = opts.minConfidence;
+    filtered = filtered.filter((d) => d.confidence >= threshold);
+  }
+  if (opts.node) {
+    const target = opts.node;
+    filtered = filtered.filter((d) => involvesNode(d, target));
+  }
+  const TYPE_LEADERSHIP = {
+    "missing-extracted": 0,
+    "missing-observed": 1,
+    "version-mismatch": 2,
+    "host-mismatch": 3,
+    "compat-violation": 4
+  };
+  filtered.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
+    if (lead !== 0) return lead;
+    if (a.type !== b.type) return a.type.localeCompare(b.type);
+    if (a.source !== b.source) return a.source.localeCompare(b.source);
+    return a.target.localeCompare(b.target);
+  });
+  return DivergenceResultSchema.parse({
+    divergences: filtered,
+    totalAffected: filtered.length,
+    computedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
 // src/persist.ts
 import { promises as fs17 } from "fs";
 import path31 from "path";
-import { Provenance as Provenance9, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+import { Provenance as Provenance10, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 3;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -3781,7 +4027,7 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = Provenance9.OBSERVED;
+      attrs.provenance = Provenance10.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
@@ -4170,248 +4416,6 @@ import Fastify from "fastify";
 import cors from "@fastify/cors";
 import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
 
-// src/divergences.ts
-import {
-  DivergenceResultSchema,
-  EdgeType as EdgeType9,
-  NodeType as NodeType10,
-  parseEdgeId,
-  Provenance as Provenance10
-} from "@neat.is/types";
-function bucketKey(source, target, type) {
-  return `${type}|${source}|${target}`;
-}
-function bucketEdges(graph) {
-  const buckets = /* @__PURE__ */ new Map();
-  graph.forEachEdge((id, attrs) => {
-    const e = attrs;
-    const parsed = parseEdgeId(id);
-    const provenance = parsed?.provenance ?? e.provenance;
-    const key = bucketKey(e.source, e.target, e.type);
-    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
-    switch (provenance) {
-      case Provenance10.EXTRACTED:
-        cur.extracted = e;
-        break;
-      case Provenance10.OBSERVED:
-        cur.observed = e;
-        break;
-      case Provenance10.INFERRED:
-        cur.inferred = e;
-        break;
-      default:
-        if (e.provenance === Provenance10.STALE) cur.stale = e;
-    }
-    buckets.set(key, cur);
-  });
-  return buckets;
-}
-function nodeIsFrontier(graph, nodeId) {
-  if (!graph.hasNode(nodeId)) return false;
-  const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType10.FrontierNode;
-}
-function clampConfidence(n) {
-  if (!Number.isFinite(n)) return 0;
-  return Math.max(0, Math.min(1, n));
-}
-function reasonForMissingObserved(source, target, type) {
-  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
-}
-function reasonForMissingExtracted(source, target, type) {
-  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
-}
-var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
-var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
-var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
-function gradedConfidence(edge) {
-  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
-  return clampConfidence(confidenceForEdge(edge));
-}
-function detectMissingDivergences(graph, bucket) {
-  const out = [];
-  if (bucket.extracted && !bucket.observed) {
-    if (!nodeIsFrontier(graph, bucket.target)) {
-      out.push({
-        type: "missing-observed",
-        source: bucket.source,
-        target: bucket.target,
-        edgeType: bucket.type,
-        extracted: bucket.extracted,
-        confidence: gradedConfidence(bucket.extracted),
-        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
-        recommendation: RECOMMENDATION_MISSING_OBSERVED
-      });
-    }
-  }
-  if (bucket.observed && !bucket.extracted) {
-    out.push({
-      type: "missing-extracted",
-      source: bucket.source,
-      target: bucket.target,
-      edgeType: bucket.type,
-      observed: bucket.observed,
-      confidence: gradedConfidence(bucket.observed),
-      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
-      recommendation: RECOMMENDATION_MISSING_EXTRACTED
-    });
-  }
-  return out;
-}
-function declaredHostFor(svc) {
-  const raw = svc.dbConnectionTarget?.trim();
-  if (!raw) return null;
-  const colon = raw.lastIndexOf(":");
-  if (colon === -1) return raw;
-  const port = raw.slice(colon + 1);
-  if (/^\d+$/.test(port)) return raw.slice(0, colon);
-  return raw;
-}
-function hasExtractedConfiguredBy(graph, svcId) {
-  for (const edgeId of graph.outboundEdges(svcId)) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance10.EXTRACTED) {
-      return true;
-    }
-  }
-  return false;
-}
-function detectHostMismatch(graph, svcId, svc) {
-  const declaredHost = declaredHostFor(svc);
-  if (!declaredHost) return [];
-  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
-  const out = [];
-  for (const edgeId of graph.outboundEdges(svcId)) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance10.OBSERVED) continue;
-    const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType10.DatabaseNode) continue;
-    const observedHost = target.host?.trim();
-    if (!observedHost) continue;
-    if (observedHost === declaredHost) continue;
-    out.push({
-      type: "host-mismatch",
-      source: svcId,
-      target: edge.target,
-      extractedHost: declaredHost,
-      observedHost,
-      confidence: clampConfidence(confidenceForEdge(edge)),
-      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
-      recommendation: RECOMMENDATION_HOST_MISMATCH
-    });
-  }
-  return out;
-}
-function detectCompatDivergences(graph, svcId, svc) {
-  const out = [];
-  const deps = svc.dependencies ?? {};
-  for (const edgeId of graph.outboundEdges(svcId)) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance10.OBSERVED) continue;
-    const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType10.DatabaseNode) continue;
-    for (const pair of compatPairs()) {
-      if (pair.engine !== target.engine) continue;
-      const declared = deps[pair.driver];
-      if (!declared) continue;
-      const result = checkCompatibility(
-        pair.driver,
-        declared,
-        target.engine,
-        target.engineVersion
-      );
-      if (!result.compatible && result.reason) {
-        out.push({
-          type: "version-mismatch",
-          source: svcId,
-          target: edge.target,
-          extractedVersion: declared,
-          observedVersion: target.engineVersion,
-          compatibility: "incompatible",
-          confidence: 1,
-          reason: result.reason,
-          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
-        });
-      }
-    }
-    for (const rule of deprecatedApis()) {
-      const declared = deps[rule.package];
-      if (!declared) continue;
-      const result = checkDeprecatedApi(rule, declared);
-      if (!result.compatible && result.reason) {
-        const ruleRef = {
-          kind: rule.kind ?? "deprecated-api",
-          reason: result.reason,
-          package: rule.package
-        };
-        out.push({
-          type: "compat-violation",
-          source: svcId,
-          target: edge.target,
-          rule: ruleRef,
-          observed: edge,
-          confidence: 1,
-          reason: result.reason,
-          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
-        });
-      }
-    }
-  }
-  return out;
-}
-function involvesNode(d, nodeId) {
-  return d.source === nodeId || d.target === nodeId;
-}
-function computeDivergences(graph, opts = {}) {
-  const all = [];
-  const buckets = bucketEdges(graph);
-  for (const bucket of buckets.values()) {
-    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
-  }
-  graph.forEachNode((nodeId, attrs) => {
-    const n = attrs;
-    if (n.type !== NodeType10.ServiceNode) return;
-    const svc = n;
-    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
-    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
-  });
-  let filtered = all;
-  if (opts.type) {
-    const allowed = opts.type;
-    filtered = filtered.filter((d) => allowed.has(d.type));
-  }
-  if (opts.minConfidence !== void 0) {
-    const threshold = opts.minConfidence;
-    filtered = filtered.filter((d) => d.confidence >= threshold);
-  }
-  if (opts.node) {
-    const target = opts.node;
-    filtered = filtered.filter((d) => involvesNode(d, target));
-  }
-  const TYPE_LEADERSHIP = {
-    "missing-extracted": 0,
-    "missing-observed": 1,
-    "version-mismatch": 2,
-    "host-mismatch": 3,
-    "compat-violation": 4
-  };
-  filtered.sort((a, b) => {
-    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
-    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
-    if (lead !== 0) return lead;
-    if (a.type !== b.type) return a.type.localeCompare(b.type);
-    if (a.source !== b.source) return a.source.localeCompare(b.source);
-    return a.target.localeCompare(b.target);
-  });
-  return DivergenceResultSchema.parse({
-    divergences: filtered,
-    totalAffected: filtered.length,
-    computedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-}
-
 // src/streaming.ts
 var SSE_HEARTBEAT_MS = 3e4;
 var SSE_BACKPRESSURE_CAP = 1e3;
@@ -4832,6 +4836,7 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = Fastify({ logger: false });
   await app.register(cors, { origin: true });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -4930,6 +4935,7 @@ export {
   addInfra,
   retireEdgesByFile,
   extractFromDirectory,
+  computeDivergences,
   saveGraphToDisk,
   loadGraphFromDisk,
   startPersistLoop,
@@ -4952,4 +4958,4 @@ export {
   removeProject,
   buildApi
 };
-//# sourceMappingURL=chunk-ZU2RQRCN.js.map
+//# sourceMappingURL=chunk-CZ3T6TE2.js.map