@neat.is/core 0.3.7 → 0.4.0

package/dist/server.cjs

@@ -39,6 +39,91 @@ var init_cjs_shims = __esm({
   }
 });
 
+// src/auth.ts
+function isLoopbackHost(host) {
+  if (!host) return false;
+  return LOOPBACK_HOSTS.has(host);
+}
+function assertBindAuthority(host, token) {
+  if (token && token.length > 0) return;
+  if (isLoopbackHost(host)) return;
+  throw new BindAuthorityError(host);
+}
+function mountBearerAuth(app, opts) {
+  if (!opts.token || opts.token.length === 0) return;
+  if (opts.trustProxy) return;
+  const expected = Buffer.from(opts.token, "utf8");
+  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const publicRead = opts.publicRead === true;
+  app.addHook("preHandler", (req, reply, done) => {
+    const path38 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    for (const suffix of suffixes) {
+      if (path38 === suffix || path38.endsWith(suffix)) {
+        done();
+        return;
+      }
+    }
+    if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
+      done();
+      return;
+    }
+    const header = req.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    const provided = Buffer.from(header.slice("Bearer ".length).trim(), "utf8");
+    if (provided.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(provided, expected)) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    done();
+  });
+}
+function parseBoolEnv(v) {
+  if (!v) return false;
+  return v === "true" || v === "1";
+}
+function readAuthEnv(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  const ot = env.NEAT_OTEL_TOKEN;
+  return {
+    authToken: t && t.length > 0 ? t : void 0,
+    otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
+    trustProxy: env.NEAT_AUTH_PROXY === "true",
+    publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
+  };
+}
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
+var init_auth = __esm({
+  "src/auth.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto = require("crypto");
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+      "127.0.0.1",
+      "localhost",
+      "::1",
+      "::ffff:127.0.0.1"
+    ]);
+    BindAuthorityError = class extends Error {
+      constructor(host) {
+        super(
+          `NEAT refuses to bind on a public interface without \`NEAT_AUTH_TOKEN\` set (host="${host}"). Set the token or bind to loopback only.`
+        );
+        this.name = "BindAuthorityError";
+      }
+    };
+    PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+    DEFAULT_UNAUTH_SUFFIXES = [
+      "/health",
+      "/healthz",
+      "/readyz",
+      "/api/config"
+    ];
+  }
+});
+
 // src/otel-grpc.ts
 var otel_grpc_exports = {};
 __export(otel_grpc_exports, {
@@ -121,8 +206,21 @@ function loadTraceService() {
 async function startOtelGrpcReceiver(opts) {
   const server = new grpc.Server();
   const service = loadTraceService();
+  const requiresAuth = !opts.trustProxy && !!opts.authToken && opts.authToken.length > 0;
+  const expectedHeader = requiresAuth ? `Bearer ${opts.authToken}` : "";
   server.addService(service, {
     Export: (call, callback) => {
+      if (requiresAuth) {
+        const meta = call.metadata.get("authorization");
+        const got = meta.length > 0 ? String(meta[0]) : "";
+        const a = Buffer.from(got, "utf8");
+        const b = Buffer.from(expectedHeader, "utf8");
+        const ok = a.length === b.length && (0, import_node_crypto2.timingSafeEqual)(a, b);
+        if (!ok) {
+          callback({ code: grpc.status.UNAUTHENTICATED, message: "unauthorized" });
+          return;
+        }
+      }
       void (async () => {
         try {
           const reshaped = reshapeGrpcRequest(call.request ?? {});
@@ -155,13 +253,14 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path34, grpc, protoLoader;
+var import_node_url, import_node_path34, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
     import_node_path34 = __toESM(require("path"), 1);
+    import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
     init_otel();
@@ -224,6 +323,15 @@ function isoFromUnixNano(nanos) {
     return void 0;
   }
 }
+function pickEnv(spanAttrs, resourceAttrs) {
+  for (const attrs of [spanAttrs, resourceAttrs]) {
+    for (const key of [ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT]) {
+      const v = attrs[key];
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+  }
+  return ENV_FALLBACK;
+}
 function parseOtlpRequest(body) {
   const out = [];
   for (const rs of body.resourceSpans ?? []) {
@@ -243,6 +351,7 @@ function parseOtlpRequest(body) {
           endTimeUnixNano: span.endTimeUnixNano ?? "0",
           startTimeIso: isoFromUnixNano(span.startTimeUnixNano),
           durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),
+          env: pickEnv(attrs, resourceAttrs),
           attributes: attrs,
           dbSystem: typeof attrs["db.system"] === "string" ? attrs["db.system"] : void 0,
           dbName: typeof attrs["db.name"] === "string" ? attrs["db.name"] : void 0,
@@ -302,6 +411,7 @@ async function buildOtelReceiver(opts) {
     logger: false,
     bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024
   });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const queue = [];
   let draining = false;
   let drainPromise = Promise.resolve();
@@ -380,7 +490,7 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
@@ -389,6 +499,10 @@ var init_otel = __esm({
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
+    init_auth();
+    ENV_ATTR_CANONICAL = "deployment.environment.name";
+    ENV_ATTR_COMPAT = "deployment.environment";
+    ENV_FALLBACK = "unknown";
     exportTraceServiceRequestType = null;
     exportTraceServiceResponseType = null;
     cachedProtobufResponseBody = null;
@@ -421,7 +535,7 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types21 = require("@neat.is/types");
+var import_types22 = require("@neat.is/types");
 
 // src/divergences.ts
 init_cjs_shims();
@@ -1678,52 +1792,64 @@ function cacheSpanService(span, now) {
   if (!span.traceId || !span.spanId) return;
   const key = parentSpanKey(span.traceId, span.spanId);
   parentSpanCache.delete(key);
-  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  parentSpanCache.set(key, {
+    service: span.service,
+    env: span.env ?? "unknown",
+    expiresAt: now + PARENT_SPAN_CACHE_TTL_MS
+  });
   while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
     const oldest = parentSpanCache.keys().next().value;
     if (!oldest) break;
     parentSpanCache.delete(oldest);
   }
 }
-function lookupParentSpanService(traceId, parentSpanId, now) {
+function lookupParentSpan(traceId, parentSpanId, now) {
   const entry = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
   if (!entry) return null;
   if (entry.expiresAt <= now) {
     parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
     return null;
   }
-  return entry.service;
+  return { service: entry.service, env: entry.env };
 }
-function resolveServiceId(graph, host) {
-  const direct = (0, import_types4.serviceId)(host);
-  if (graph.hasNode(direct)) return direct;
-  let found = null;
+function resolveServiceId(graph, host, env) {
+  const envTagged = (0, import_types4.serviceId)(host, env);
+  if (graph.hasNode(envTagged)) return envTagged;
+  const envLess = (0, import_types4.serviceId)(host);
+  if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
+  let sameEnv = null;
+  let envLessMatch = null;
+  let anyMatch = null;
   graph.forEachNode((id, attrs) => {
-    if (found) return;
+    if (sameEnv) return;
     const a = attrs;
     if (a.type !== import_types4.NodeType.ServiceNode) return;
-    if (a.name === host) {
-      found = id;
+    const matchesByName = a.name === host;
+    const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
+    if (!matchesByName && !matchesByAlias) return;
+    const nodeEnv = a.env ?? "unknown";
+    if (nodeEnv === env) {
+      sameEnv = id;
       return;
     }
-    if (a.aliases && a.aliases.includes(host)) {
-      found = id;
-    }
+    if (nodeEnv === "unknown" && !envLessMatch) envLessMatch = id;
+    else if (!anyMatch) anyMatch = id;
   });
-  return found;
+  return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
   return (0, import_types4.frontierId)(host);
 }
-function ensureServiceNode(graph, serviceName) {
-  const id = (0, import_types4.serviceId)(serviceName);
+function ensureServiceNode(graph, serviceName, env) {
+  const id = (0, import_types4.serviceId)(serviceName, env);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
     type: import_types4.NodeType.ServiceNode,
     name: serviceName,
     language: "unknown",
-    discoveredVia: "otel"
+    discoveredVia: "otel",
+    ...env !== "unknown" ? { env } : {}
   };
   graph.addNode(id, node);
   return id;
@@ -1858,7 +1984,8 @@ function sanitizeAttributes(attrs) {
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
-  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const env = span.env ?? "unknown";
+  const sourceId = ensureServiceNode(ctx.graph, span.service, env);
   const isError = span.statusCode === 2;
   cacheSpanService(span, nowMs);
   let affectedNode = sourceId;
@@ -1881,7 +2008,7 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
     if (host && host !== span.service) {
-      const targetId = resolveServiceId(ctx.graph, host);
+      const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
@@ -1908,9 +2035,9 @@ async function handleSpan(ctx, span) {
       }
     }
     if (!resolvedViaAddress && span.parentSpanId) {
-      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
-      if (parentService && parentService !== span.service) {
-        const parentId = ensureServiceNode(ctx.graph, parentService);
+      const parent = lookupParentSpan(span.traceId, span.parentSpanId, nowMs);
+      if (parent && parent.service !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         upsertObservedEdge(
           ctx.graph,
           import_types4.EdgeType.CALLS,
@@ -2106,6 +2233,28 @@ async function readErrorEvents(errorsPath) {
     throw err;
   }
 }
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of exported.nodes ?? []) {
+    if (graph.hasNode(node.key)) continue;
+    if (!node.attributes) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of exported.edges ?? []) {
+    const attrs = edge.attributes;
+    if (!attrs) continue;
+    const id = edge.key ?? attrs.id;
+    if (!id) continue;
+    if (graph.hasEdge(id)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/services.ts
 init_cjs_shims();
@@ -2502,6 +2651,18 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   }
   return [...found];
 }
+function detectJsFramework(pkg) {
+  const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  if (deps["next"] !== void 0) return "next";
+  if (deps["remix"] !== void 0) return "remix";
+  for (const k of Object.keys(deps)) {
+    if (k.startsWith("@remix-run/")) return "remix";
+  }
+  if (deps["@sveltejs/kit"] !== void 0) return "sveltekit";
+  if (deps["nuxt"] !== void 0) return "nuxt";
+  if (deps["astro"] !== void 0) return "astro";
+  return void 0;
+}
 async function discoverNodeService(scanPath, dir) {
   const pkgPath = import_node_path8.default.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
@@ -2513,6 +2674,7 @@ async function discoverNodeService(scanPath, dir) {
     return null;
   }
   if (!pkg.name) return null;
+  const framework = detectJsFramework(pkg);
   const node = {
     id: (0, import_types6.serviceId)(pkg.name),
     type: import_types6.NodeType.ServiceNode,
@@ -2521,7 +2683,8 @@ async function discoverNodeService(scanPath, dir) {
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
     repoPath: import_node_path8.default.relative(scanPath, dir),
-    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
+    ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
@@ -4376,25 +4539,138 @@ function canonicalJson(value) {
   });
 }
 
-// src/projects.ts
+// src/persist.ts
 init_cjs_shims();
+var import_node_fs19 = require("fs");
 var import_node_path31 = __toESM(require("path"), 1);
+var import_types20 = require("@neat.is/types");
+var SCHEMA_VERSION = 4;
+function migrateV1ToV2(payload) {
+  const nodes = payload.graph.nodes;
+  if (Array.isArray(nodes)) {
+    for (const node of nodes) {
+      if (node.attributes && "pgDriverVersion" in node.attributes) {
+        delete node.attributes.pgDriverVersion;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 2 };
+}
+function migrateV3ToV4(payload) {
+  return { ...payload, schemaVersion: 4 };
+}
+function migrateV2ToV3(payload) {
+  const edges = payload.graph.edges;
+  if (Array.isArray(edges)) {
+    for (const edge of edges) {
+      const attrs = edge.attributes;
+      if (!attrs || attrs.provenance !== "FRONTIER") continue;
+      attrs.provenance = import_types20.Provenance.OBSERVED;
+      const type = typeof attrs.type === "string" ? attrs.type : void 0;
+      const source = typeof attrs.source === "string" ? attrs.source : void 0;
+      const target = typeof attrs.target === "string" ? attrs.target : void 0;
+      if (type && source && target) {
+        const newId = (0, import_types20.observedEdgeId)(source, target, type);
+        attrs.id = newId;
+        if (edge.key) edge.key = newId;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 3 };
+}
+async function ensureDir(filePath) {
+  await import_node_fs19.promises.mkdir(import_node_path31.default.dirname(filePath), { recursive: true });
+}
+async function saveGraphToDisk(graph, outPath) {
+  await ensureDir(outPath);
+  const payload = {
+    schemaVersion: SCHEMA_VERSION,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: graph.export()
+  };
+  const tmp = `${outPath}.tmp`;
+  await import_node_fs19.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await import_node_fs19.promises.rename(tmp, outPath);
+}
+async function loadGraphFromDisk(graph, outPath) {
+  let raw;
+  try {
+    raw = await import_node_fs19.promises.readFile(outPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  let payload = JSON.parse(raw);
+  if (payload.schemaVersion === 1) {
+    payload = migrateV1ToV2(payload);
+  }
+  if (payload.schemaVersion === 2) {
+    payload = migrateV2ToV3(payload);
+  }
+  if (payload.schemaVersion === 3) {
+    payload = migrateV3ToV4(payload);
+  }
+  if (payload.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
+    );
+  }
+  graph.clear();
+  graph.import(payload.graph);
+}
+function startPersistLoop(graph, outPath, intervalMs = 6e4) {
+  let stopped = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      await saveGraphToDisk(graph, outPath);
+    } catch (err) {
+      console.error("persist: periodic save failed", err);
+    }
+  };
+  const interval = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  const onSignal = (signal) => {
+    void (async () => {
+      try {
+        await saveGraphToDisk(graph, outPath);
+      } catch (err) {
+        console.error(`persist: ${signal} save failed`, err);
+      } finally {
+        process.exit(0);
+      }
+    })();
+  };
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+    process.off("SIGTERM", onSignal);
+    process.off("SIGINT", onSignal);
+  };
+}
+
+// src/projects.ts
+init_cjs_shims();
+var import_node_path32 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: import_node_path31.default.join(baseDir, "graph.json"),
-      errorsPath: import_node_path31.default.join(baseDir, "errors.ndjson"),
-      staleEventsPath: import_node_path31.default.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: import_node_path31.default.join(baseDir, "embeddings.json"),
-      policyViolationsPath: import_node_path31.default.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: import_node_path32.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path32.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path32.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path32.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path32.default.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: import_node_path31.default.join(baseDir, `${project}.json`),
-    errorsPath: import_node_path31.default.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: import_node_path31.default.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: import_node_path31.default.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: import_node_path31.default.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: import_node_path32.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path32.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path32.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path32.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path32.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -4434,23 +4710,23 @@ function parseExtraProjects(raw) {
 
 // src/registry.ts
 init_cjs_shims();
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
-var import_node_path32 = __toESM(require("path"), 1);
-var import_types20 = require("@neat.is/types");
+var import_node_path33 = __toESM(require("path"), 1);
+var import_types21 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path32.default.resolve(override);
-  return import_node_path32.default.join(import_node_os2.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path33.default.resolve(override);
+  return import_node_path33.default.join(import_node_os2.default.homedir(), ".neat");
 }
 function registryPath() {
-  return import_node_path32.default.join(neatHome(), "projects.json");
+  return import_node_path33.default.join(neatHome(), "projects.json");
 }
 async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await import_node_fs19.promises.readFile(file, "utf8");
+    raw = await import_node_fs20.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -4458,7 +4734,7 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types20.RegistryFileSchema.parse(parsed);
+  return import_types21.RegistryFileSchema.parse(parsed);
 }
 async function getProject(name) {
   const reg = await readRegistry();
@@ -4525,6 +4801,7 @@ data: ${JSON.stringify(envelope.payload)}
 }
 
 // src/api.ts
+init_auth();
 function serializeGraph(graph) {
   const nodes = [];
   graph.forEachNode((_id, attrs) => {
@@ -4648,11 +4925,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types21.DivergenceTypeSchema.safeParse(c);
+        const r = import_types22.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types21.DivergenceTypeSchema.options
+            allowed: import_types22.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -4797,6 +5074,35 @@ function registerRoutes(scope, ctx) {
       }
     }
   );
+  scope.post("/snapshot", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const body = req.body;
+    if (!body || typeof body !== "object" || !body.snapshot) {
+      return reply.code(400).send({ error: "request body must be { snapshot: <persisted-graph> }" });
+    }
+    const snap = body.snapshot;
+    if (typeof snap.schemaVersion !== "number" || snap.schemaVersion !== SCHEMA_VERSION) {
+      return reply.code(400).send({
+        error: `unsupported snapshot schemaVersion ${snap.schemaVersion} (expected ${SCHEMA_VERSION})`
+      });
+    }
+    try {
+      const result = mergeSnapshot(proj.graph, snap);
+      return {
+        project: proj.name,
+        nodesAdded: result.nodesAdded,
+        edgesAdded: result.edgesAdded,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size
+      };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "snapshot merge failed",
+        details: err.message
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply);
     if (!proj) return;
@@ -4836,7 +5142,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types21.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types22.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -4853,7 +5159,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply);
     if (!proj) return;
-    const parsed = import_types21.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types22.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -4890,6 +5196,15 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
+  mountBearerAuth(app, {
+    token: opts.authToken,
+    trustProxy: opts.trustProxy,
+    publicRead: opts.publicRead
+  });
+  app.get("/api/config", async () => ({
+    publicRead: opts.publicRead === true,
+    authProxy: opts.trustProxy === true
+  }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -4951,113 +5266,6 @@ async function buildApi(opts) {
   return app;
 }
 
-// src/persist.ts
-init_cjs_shims();
-var import_node_fs20 = require("fs");
-var import_node_path33 = __toESM(require("path"), 1);
-var import_types22 = require("@neat.is/types");
-var SCHEMA_VERSION = 3;
-function migrateV1ToV2(payload) {
-  const nodes = payload.graph.nodes;
-  if (Array.isArray(nodes)) {
-    for (const node of nodes) {
-      if (node.attributes && "pgDriverVersion" in node.attributes) {
-        delete node.attributes.pgDriverVersion;
-      }
-    }
-  }
-  return { ...payload, schemaVersion: 2 };
-}
-function migrateV2ToV3(payload) {
-  const edges = payload.graph.edges;
-  if (Array.isArray(edges)) {
-    for (const edge of edges) {
-      const attrs = edge.attributes;
-      if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types22.Provenance.OBSERVED;
-      const type = typeof attrs.type === "string" ? attrs.type : void 0;
-      const source = typeof attrs.source === "string" ? attrs.source : void 0;
-      const target = typeof attrs.target === "string" ? attrs.target : void 0;
-      if (type && source && target) {
-        const newId = (0, import_types22.observedEdgeId)(source, target, type);
-        attrs.id = newId;
-        if (edge.key) edge.key = newId;
-      }
-    }
-  }
-  return { ...payload, schemaVersion: 3 };
-}
-async function ensureDir(filePath) {
-  await import_node_fs20.promises.mkdir(import_node_path33.default.dirname(filePath), { recursive: true });
-}
-async function saveGraphToDisk(graph, outPath) {
-  await ensureDir(outPath);
-  const payload = {
-    schemaVersion: SCHEMA_VERSION,
-    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    graph: graph.export()
-  };
-  const tmp = `${outPath}.tmp`;
-  await import_node_fs20.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await import_node_fs20.promises.rename(tmp, outPath);
-}
-async function loadGraphFromDisk(graph, outPath) {
-  let raw;
-  try {
-    raw = await import_node_fs20.promises.readFile(outPath, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return;
-    throw err;
-  }
-  let payload = JSON.parse(raw);
-  if (payload.schemaVersion === 1) {
-    payload = migrateV1ToV2(payload);
-  }
-  if (payload.schemaVersion === 2) {
-    payload = migrateV2ToV3(payload);
-  }
-  if (payload.schemaVersion !== SCHEMA_VERSION) {
-    throw new Error(
-      `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
-    );
-  }
-  graph.clear();
-  graph.import(payload.graph);
-}
-function startPersistLoop(graph, outPath, intervalMs = 6e4) {
-  let stopped = false;
-  const tick = async () => {
-    if (stopped) return;
-    try {
-      await saveGraphToDisk(graph, outPath);
-    } catch (err) {
-      console.error("persist: periodic save failed", err);
-    }
-  };
-  const interval = setInterval(() => {
-    void tick();
-  }, intervalMs);
-  const onSignal = (signal) => {
-    void (async () => {
-      try {
-        await saveGraphToDisk(graph, outPath);
-      } catch (err) {
-        console.error(`persist: ${signal} save failed`, err);
-      } finally {
-        process.exit(0);
-      }
-    })();
-  };
-  process.on("SIGTERM", onSignal);
-  process.on("SIGINT", onSignal);
-  return () => {
-    stopped = true;
-    clearInterval(interval);
-    process.off("SIGTERM", onSignal);
-    process.off("SIGINT", onSignal);
-  };
-}
-
 // src/server.ts
 init_otel();
 init_otel_grpc();
@@ -5066,7 +5274,7 @@ init_otel_grpc();
 init_cjs_shims();
 var import_node_fs21 = require("fs");
 var import_node_path36 = __toESM(require("path"), 1);
-var import_node_crypto = require("crypto");
+var import_node_crypto3 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
 var MINI_LM_DIM = 384;
@@ -5106,7 +5314,7 @@ function embedText(node) {
   return parts.join(" ");
 }
 function attrsHash(node) {
-  return (0, import_node_crypto.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto3.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
 }
 function cosine(a, b) {
   if (a.length !== b.length) return 0;
@@ -5350,6 +5558,7 @@ async function buildSearchIndex(graph, options = {}) {
 }
 
 // src/server.ts
+init_auth();
 async function bootProject(registry, name, scanPath, baseDir) {
   const paths = pathsForProject(name, baseDir);
   const graph = getGraph(name);
@@ -5396,7 +5605,14 @@ async function main() {
   const host = process.env.HOST ?? "0.0.0.0";
   const port = Number(process.env.PORT ?? 8080);
   const otelPort = Number(process.env.OTEL_PORT ?? 4318);
-  const app = await buildApi({ projects: registry });
+  const auth = readAuthEnv();
+  assertBindAuthority(host, auth.authToken);
+  const app = await buildApi({
+    projects: registry,
+    authToken: auth.authToken,
+    trustProxy: auth.trustProxy,
+    publicRead: auth.publicRead
+  });
   await app.listen({ port, host });
   console.log(`neat-core listening on http://${host}:${port}`);
   console.log(`  base dir:      ${baseDir}`);
@@ -5407,12 +5623,22 @@ async function main() {
       graph: defaultCtx.graph,
       errorsPath: defaultCtx.paths.errorsPath
     });
-    const otelApp = await buildOtelReceiver({ onSpan });
+    const otelApp = await buildOtelReceiver({
+      onSpan,
+      authToken: auth.otelToken,
+      trustProxy: auth.trustProxy
+    });
     await otelApp.listen({ port: otelPort, host });
     console.log(`neat-core OTLP receiver on http://${host}:${otelPort}/v1/traces`);
     if (process.env.NEAT_OTLP_GRPC === "true") {
       const grpcPort = Number(process.env.NEAT_OTLP_GRPC_PORT ?? 4317);
-      const grpcReceiver = await startOtelGrpcReceiver({ onSpan, host, port: grpcPort });
+      const grpcReceiver = await startOtelGrpcReceiver({
+        onSpan,
+        host,
+        port: grpcPort,
+        authToken: auth.otelToken,
+        trustProxy: auth.trustProxy
+      });
       console.log(`neat-core OTLP/gRPC receiver on ${grpcReceiver.address}`);
     }
   }