@neat.is/core 0.3.7 → 0.4.0

package/dist/{chunk-ZU2RQRCN.js → chunk-UPW4CMOH.js}

@@ -1,3 +1,7 @@
+import {
+  mountBearerAuth
+} from "./chunk-4V23KYOP.js";
+
 // src/graph.ts
 import GraphDefault from "graphology";
 var MultiDirectedGraph = GraphDefault.MultiDirectedGraph;
@@ -1100,52 +1104,64 @@ function cacheSpanService(span, now) {
   if (!span.traceId || !span.spanId) return;
   const key = parentSpanKey(span.traceId, span.spanId);
   parentSpanCache.delete(key);
-  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  parentSpanCache.set(key, {
+    service: span.service,
+    env: span.env ?? "unknown",
+    expiresAt: now + PARENT_SPAN_CACHE_TTL_MS
+  });
   while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
     const oldest = parentSpanCache.keys().next().value;
     if (!oldest) break;
     parentSpanCache.delete(oldest);
   }
 }
-function lookupParentSpanService(traceId, parentSpanId, now) {
+function lookupParentSpan(traceId, parentSpanId, now) {
   const entry = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
   if (!entry) return null;
   if (entry.expiresAt <= now) {
     parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
     return null;
   }
-  return entry.service;
+  return { service: entry.service, env: entry.env };
 }
-function resolveServiceId(graph, host) {
-  const direct = serviceId(host);
-  if (graph.hasNode(direct)) return direct;
-  let found = null;
+function resolveServiceId(graph, host, env) {
+  const envTagged = serviceId(host, env);
+  if (graph.hasNode(envTagged)) return envTagged;
+  const envLess = serviceId(host);
+  if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
+  let sameEnv = null;
+  let envLessMatch = null;
+  let anyMatch = null;
   graph.forEachNode((id, attrs) => {
-    if (found) return;
+    if (sameEnv) return;
     const a = attrs;
     if (a.type !== NodeType3.ServiceNode) return;
-    if (a.name === host) {
-      found = id;
+    const matchesByName = a.name === host;
+    const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
+    if (!matchesByName && !matchesByAlias) return;
+    const nodeEnv = a.env ?? "unknown";
+    if (nodeEnv === env) {
+      sameEnv = id;
       return;
     }
-    if (a.aliases && a.aliases.includes(host)) {
-      found = id;
-    }
+    if (nodeEnv === "unknown" && !envLessMatch) envLessMatch = id;
+    else if (!anyMatch) anyMatch = id;
   });
-  return found;
+  return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
   return frontierId(host);
 }
-function ensureServiceNode(graph, serviceName) {
-  const id = serviceId(serviceName);
+function ensureServiceNode(graph, serviceName, env) {
+  const id = serviceId(serviceName, env);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
     type: NodeType3.ServiceNode,
     name: serviceName,
     language: "unknown",
-    discoveredVia: "otel"
+    discoveredVia: "otel",
+    ...env !== "unknown" ? { env } : {}
   };
   graph.addNode(id, node);
   return id;
@@ -1291,7 +1307,7 @@ function buildErrorEventForReceiver(span) {
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: serviceId(span.service)
+    affectedNode: serviceId(span.service, span.env)
   };
 }
 function makeErrorSpanWriter(errorsPath) {
@@ -1305,7 +1321,8 @@ function makeErrorSpanWriter(errorsPath) {
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
-  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const env = span.env ?? "unknown";
+  const sourceId = ensureServiceNode(ctx.graph, span.service, env);
   const isError = span.statusCode === 2;
   cacheSpanService(span, nowMs);
   let affectedNode = sourceId;
@@ -1328,7 +1345,7 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
     if (host && host !== span.service) {
-      const targetId = resolveServiceId(ctx.graph, host);
+      const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
@@ -1355,9 +1372,9 @@ async function handleSpan(ctx, span) {
       }
     }
     if (!resolvedViaAddress && span.parentSpanId) {
-      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
-      if (parentService && parentService !== span.service) {
-        const parentId = ensureServiceNode(ctx.graph, parentService);
+      const parent = lookupParentSpan(span.traceId, span.parentSpanId, nowMs);
+      if (parent && parent.service !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         upsertObservedEdge(
           ctx.graph,
           EdgeType2.CALLS,
@@ -1553,6 +1570,28 @@ async function readErrorEvents(errorsPath) {
     throw err;
   }
 }
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of exported.nodes ?? []) {
+    if (graph.hasNode(node.key)) continue;
+    if (!node.attributes) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of exported.edges ?? []) {
+    const attrs = edge.attributes;
+    if (!attrs) continue;
+    const id = edge.key ?? attrs.id;
+    if (!id) continue;
+    if (graph.hasEdge(id)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/errors.ts
 import { promises as fs4 } from "fs";
@@ -1956,6 +1995,18 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   }
   return [...found];
 }
+function detectJsFramework(pkg) {
+  const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  if (deps["next"] !== void 0) return "next";
+  if (deps["remix"] !== void 0) return "remix";
+  for (const k of Object.keys(deps)) {
+    if (k.startsWith("@remix-run/")) return "remix";
+  }
+  if (deps["@sveltejs/kit"] !== void 0) return "sveltekit";
+  if (deps["nuxt"] !== void 0) return "nuxt";
+  if (deps["astro"] !== void 0) return "astro";
+  return void 0;
+}
 async function discoverNodeService(scanPath, dir) {
   const pkgPath = path8.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
@@ -1967,6 +2018,7 @@ async function discoverNodeService(scanPath, dir) {
     return null;
   }
   if (!pkg.name) return null;
+  const framework = detectJsFramework(pkg);
   const node = {
     id: serviceId2(pkg.name),
     type: NodeType4.ServiceNode,
@@ -1975,7 +2027,8 @@ async function discoverNodeService(scanPath, dir) {
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
     repoPath: path8.relative(scanPath, dir),
-    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
+    ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
@@ -3759,11 +3812,253 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   return result;
 }
 
+// src/divergences.ts
+import {
+  DivergenceResultSchema,
+  EdgeType as EdgeType9,
+  NodeType as NodeType10,
+  parseEdgeId,
+  Provenance as Provenance9
+} from "@neat.is/types";
+function bucketKey(source, target, type) {
+  return `${type}|${source}|${target}`;
+}
+function bucketEdges(graph) {
+  const buckets = /* @__PURE__ */ new Map();
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    const parsed = parseEdgeId(id);
+    const provenance = parsed?.provenance ?? e.provenance;
+    const key = bucketKey(e.source, e.target, e.type);
+    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    switch (provenance) {
+      case Provenance9.EXTRACTED:
+        cur.extracted = e;
+        break;
+      case Provenance9.OBSERVED:
+        cur.observed = e;
+        break;
+      case Provenance9.INFERRED:
+        cur.inferred = e;
+        break;
+      default:
+        if (e.provenance === Provenance9.STALE) cur.stale = e;
+    }
+    buckets.set(key, cur);
+  });
+  return buckets;
+}
+function nodeIsFrontier(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === NodeType10.FrontierNode;
+}
+function clampConfidence(n) {
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.min(1, n));
+}
+function reasonForMissingObserved(source, target, type) {
+  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
+}
+function reasonForMissingExtracted(source, target, type) {
+  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
+}
+var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
+var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
+var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
+function gradedConfidence(edge) {
+  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
+  return clampConfidence(confidenceForEdge(edge));
+}
+function detectMissingDivergences(graph, bucket) {
+  const out = [];
+  if (bucket.extracted && !bucket.observed) {
+    if (!nodeIsFrontier(graph, bucket.target)) {
+      out.push({
+        type: "missing-observed",
+        source: bucket.source,
+        target: bucket.target,
+        edgeType: bucket.type,
+        extracted: bucket.extracted,
+        confidence: gradedConfidence(bucket.extracted),
+        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
+        recommendation: RECOMMENDATION_MISSING_OBSERVED
+      });
+    }
+  }
+  if (bucket.observed && !bucket.extracted) {
+    out.push({
+      type: "missing-extracted",
+      source: bucket.source,
+      target: bucket.target,
+      edgeType: bucket.type,
+      observed: bucket.observed,
+      confidence: gradedConfidence(bucket.observed),
+      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
+      recommendation: RECOMMENDATION_MISSING_EXTRACTED
+    });
+  }
+  return out;
+}
+function declaredHostFor(svc) {
+  const raw = svc.dbConnectionTarget?.trim();
+  if (!raw) return null;
+  const colon = raw.lastIndexOf(":");
+  if (colon === -1) return raw;
+  const port = raw.slice(colon + 1);
+  if (/^\d+$/.test(port)) return raw.slice(0, colon);
+  return raw;
+}
+function hasExtractedConfiguredBy(graph, svcId) {
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance9.EXTRACTED) {
+      return true;
+    }
+  }
+  return false;
+}
+function detectHostMismatch(graph, svcId, svc) {
+  const declaredHost = declaredHostFor(svc);
+  if (!declaredHost) return [];
+  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
+  const out = [];
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance9.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== NodeType10.DatabaseNode) continue;
+    const observedHost = target.host?.trim();
+    if (!observedHost) continue;
+    if (observedHost === declaredHost) continue;
+    out.push({
+      type: "host-mismatch",
+      source: svcId,
+      target: edge.target,
+      extractedHost: declaredHost,
+      observedHost,
+      confidence: clampConfidence(confidenceForEdge(edge)),
+      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
+      recommendation: RECOMMENDATION_HOST_MISMATCH
+    });
+  }
+  return out;
+}
+function detectCompatDivergences(graph, svcId, svc) {
+  const out = [];
+  const deps = svc.dependencies ?? {};
+  for (const edgeId of graph.outboundEdges(svcId)) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance9.OBSERVED) continue;
+    const target = graph.getNodeAttributes(edge.target);
+    if (target.type !== NodeType10.DatabaseNode) continue;
+    for (const pair of compatPairs()) {
+      if (pair.engine !== target.engine) continue;
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        target.engine,
+        target.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        out.push({
+          type: "version-mismatch",
+          source: svcId,
+          target: edge.target,
+          extractedVersion: declared,
+          observedVersion: target.engineVersion,
+          compatibility: "incompatible",
+          confidence: 1,
+          reason: result.reason,
+          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
+        });
+      }
+    }
+    for (const rule of deprecatedApis()) {
+      const declared = deps[rule.package];
+      if (!declared) continue;
+      const result = checkDeprecatedApi(rule, declared);
+      if (!result.compatible && result.reason) {
+        const ruleRef = {
+          kind: rule.kind ?? "deprecated-api",
+          reason: result.reason,
+          package: rule.package
+        };
+        out.push({
+          type: "compat-violation",
+          source: svcId,
+          target: edge.target,
+          rule: ruleRef,
+          observed: edge,
+          confidence: 1,
+          reason: result.reason,
+          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
+        });
+      }
+    }
+  }
+  return out;
+}
+function involvesNode(d, nodeId) {
+  return d.source === nodeId || d.target === nodeId;
+}
+function computeDivergences(graph, opts = {}) {
+  const all = [];
+  const buckets = bucketEdges(graph);
+  for (const bucket of buckets.values()) {
+    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
+  }
+  graph.forEachNode((nodeId, attrs) => {
+    const n = attrs;
+    if (n.type !== NodeType10.ServiceNode) return;
+    const svc = n;
+    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
+    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+  });
+  let filtered = all;
+  if (opts.type) {
+    const allowed = opts.type;
+    filtered = filtered.filter((d) => allowed.has(d.type));
+  }
+  if (opts.minConfidence !== void 0) {
+    const threshold = opts.minConfidence;
+    filtered = filtered.filter((d) => d.confidence >= threshold);
+  }
+  if (opts.node) {
+    const target = opts.node;
+    filtered = filtered.filter((d) => involvesNode(d, target));
+  }
+  const TYPE_LEADERSHIP = {
+    "missing-extracted": 0,
+    "missing-observed": 1,
+    "version-mismatch": 2,
+    "host-mismatch": 3,
+    "compat-violation": 4
+  };
+  filtered.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
+    if (lead !== 0) return lead;
+    if (a.type !== b.type) return a.type.localeCompare(b.type);
+    if (a.source !== b.source) return a.source.localeCompare(b.source);
+    return a.target.localeCompare(b.target);
+  });
+  return DivergenceResultSchema.parse({
+    divergences: filtered,
+    totalAffected: filtered.length,
+    computedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
 // src/persist.ts
 import { promises as fs17 } from "fs";
 import path31 from "path";
-import { Provenance as Provenance9, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
-var SCHEMA_VERSION = 3;
+import { Provenance as Provenance10, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -3775,13 +4070,16 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV3ToV4(payload) {
+  return { ...payload, schemaVersion: 4 };
+}
 function migrateV2ToV3(payload) {
   const edges = payload.graph.edges;
   if (Array.isArray(edges)) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = Provenance9.OBSERVED;
+      attrs.provenance = Provenance10.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
@@ -3823,6 +4121,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 2) {
     payload = migrateV2ToV3(payload);
   }
+  if (payload.schemaVersion === 3) {
+    payload = migrateV3ToV4(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -4170,248 +4471,6 @@ import Fastify from "fastify";
 import cors from "@fastify/cors";
 import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
 
-// src/divergences.ts
-import {
-  DivergenceResultSchema,
-  EdgeType as EdgeType9,
-  NodeType as NodeType10,
-  parseEdgeId,
-  Provenance as Provenance10
-} from "@neat.is/types";
-function bucketKey(source, target, type) {
-  return `${type}|${source}|${target}`;
-}
-function bucketEdges(graph) {
-  const buckets = /* @__PURE__ */ new Map();
-  graph.forEachEdge((id, attrs) => {
-    const e = attrs;
-    const parsed = parseEdgeId(id);
-    const provenance = parsed?.provenance ?? e.provenance;
-    const key = bucketKey(e.source, e.target, e.type);
-    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
-    switch (provenance) {
-      case Provenance10.EXTRACTED:
-        cur.extracted = e;
-        break;
-      case Provenance10.OBSERVED:
-        cur.observed = e;
-        break;
-      case Provenance10.INFERRED:
-        cur.inferred = e;
-        break;
-      default:
-        if (e.provenance === Provenance10.STALE) cur.stale = e;
-    }
-    buckets.set(key, cur);
-  });
-  return buckets;
-}
-function nodeIsFrontier(graph, nodeId) {
-  if (!graph.hasNode(nodeId)) return false;
-  const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType10.FrontierNode;
-}
-function clampConfidence(n) {
-  if (!Number.isFinite(n)) return 0;
-  return Math.max(0, Math.min(1, n));
-}
-function reasonForMissingObserved(source, target, type) {
-  return `Code declares ${source} \u2192 ${target} (${type}) but no production traffic has been observed for this edge.`;
-}
-function reasonForMissingExtracted(source, target, type) {
-  return `Production observed ${source} \u2192 ${target} (${type}) but static analysis did not surface this edge.`;
-}
-var RECOMMENDATION_MISSING_OBSERVED = "Verify the code path is exercised in production; check feature flags or conditional branches that might gate the call.";
-var RECOMMENDATION_MISSING_EXTRACTED = "Likely dynamic dispatch, reflection, or a coverage gap in tree-sitter extraction. Consider an `aliases` entry on the source service or file an extractor issue.";
-var RECOMMENDATION_HOST_MISMATCH = "Check environment-specific config overrides \u2014 the runtime host differs from what static configuration declares.";
-function gradedConfidence(edge) {
-  if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
-  return clampConfidence(confidenceForEdge(edge));
-}
-function detectMissingDivergences(graph, bucket) {
-  const out = [];
-  if (bucket.extracted && !bucket.observed) {
-    if (!nodeIsFrontier(graph, bucket.target)) {
-      out.push({
-        type: "missing-observed",
-        source: bucket.source,
-        target: bucket.target,
-        edgeType: bucket.type,
-        extracted: bucket.extracted,
-        confidence: gradedConfidence(bucket.extracted),
-        reason: reasonForMissingObserved(bucket.source, bucket.target, bucket.type),
-        recommendation: RECOMMENDATION_MISSING_OBSERVED
-      });
-    }
-  }
-  if (bucket.observed && !bucket.extracted) {
-    out.push({
-      type: "missing-extracted",
-      source: bucket.source,
-      target: bucket.target,
-      edgeType: bucket.type,
-      observed: bucket.observed,
-      confidence: gradedConfidence(bucket.observed),
-      reason: reasonForMissingExtracted(bucket.source, bucket.target, bucket.type),
-      recommendation: RECOMMENDATION_MISSING_EXTRACTED
-    });
-  }
-  return out;
-}
-function declaredHostFor(svc) {
-  const raw = svc.dbConnectionTarget?.trim();
-  if (!raw) return null;
-  const colon = raw.lastIndexOf(":");
-  if (colon === -1) return raw;
-  const port = raw.slice(colon + 1);
-  if (/^\d+$/.test(port)) return raw.slice(0, colon);
-  return raw;
-}
-function hasExtractedConfiguredBy(graph, svcId) {
-  for (const edgeId of graph.outboundEdges(svcId)) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType9.CONFIGURED_BY && e.provenance === Provenance10.EXTRACTED) {
-      return true;
-    }
-  }
-  return false;
-}
-function detectHostMismatch(graph, svcId, svc) {
-  const declaredHost = declaredHostFor(svc);
-  if (!declaredHost) return [];
-  if (!hasExtractedConfiguredBy(graph, svcId)) return [];
-  const out = [];
-  for (const edgeId of graph.outboundEdges(svcId)) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance10.OBSERVED) continue;
-    const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType10.DatabaseNode) continue;
-    const observedHost = target.host?.trim();
-    if (!observedHost) continue;
-    if (observedHost === declaredHost) continue;
-    out.push({
-      type: "host-mismatch",
-      source: svcId,
-      target: edge.target,
-      extractedHost: declaredHost,
-      observedHost,
-      confidence: clampConfidence(confidenceForEdge(edge)),
-      reason: `Config declares ${svcId} connects to ${declaredHost}; production connects to ${observedHost}.`,
-      recommendation: RECOMMENDATION_HOST_MISMATCH
-    });
-  }
-  return out;
-}
-function detectCompatDivergences(graph, svcId, svc) {
-  const out = [];
-  const deps = svc.dependencies ?? {};
-  for (const edgeId of graph.outboundEdges(svcId)) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType9.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance10.OBSERVED) continue;
-    const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType10.DatabaseNode) continue;
-    for (const pair of compatPairs()) {
-      if (pair.engine !== target.engine) continue;
-      const declared = deps[pair.driver];
-      if (!declared) continue;
-      const result = checkCompatibility(
-        pair.driver,
-        declared,
-        target.engine,
-        target.engineVersion
-      );
-      if (!result.compatible && result.reason) {
-        out.push({
-          type: "version-mismatch",
-          source: svcId,
-          target: edge.target,
-          extractedVersion: declared,
-          observedVersion: target.engineVersion,
-          compatibility: "incompatible",
-          confidence: 1,
-          reason: result.reason,
-          recommendation: result.minDriverVersion ? `Upgrade ${pair.driver} to >= ${result.minDriverVersion}.` : `Update the ${pair.driver} driver to a version compatible with ${target.engine} ${target.engineVersion}.`
-        });
-      }
-    }
-    for (const rule of deprecatedApis()) {
-      const declared = deps[rule.package];
-      if (!declared) continue;
-      const result = checkDeprecatedApi(rule, declared);
-      if (!result.compatible && result.reason) {
-        const ruleRef = {
-          kind: rule.kind ?? "deprecated-api",
-          reason: result.reason,
-          package: rule.package
-        };
-        out.push({
-          type: "compat-violation",
-          source: svcId,
-          target: edge.target,
-          rule: ruleRef,
-          observed: edge,
-          confidence: 1,
-          reason: result.reason,
-          recommendation: `Replace deprecated ${rule.package}@${declared} with a supported version.`
-        });
-      }
-    }
-  }
-  return out;
-}
-function involvesNode(d, nodeId) {
-  return d.source === nodeId || d.target === nodeId;
-}
-function computeDivergences(graph, opts = {}) {
-  const all = [];
-  const buckets = bucketEdges(graph);
-  for (const bucket of buckets.values()) {
-    for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
-  }
-  graph.forEachNode((nodeId, attrs) => {
-    const n = attrs;
-    if (n.type !== NodeType10.ServiceNode) return;
-    const svc = n;
-    for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
-    for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
-  });
-  let filtered = all;
-  if (opts.type) {
-    const allowed = opts.type;
-    filtered = filtered.filter((d) => allowed.has(d.type));
-  }
-  if (opts.minConfidence !== void 0) {
-    const threshold = opts.minConfidence;
-    filtered = filtered.filter((d) => d.confidence >= threshold);
-  }
-  if (opts.node) {
-    const target = opts.node;
-    filtered = filtered.filter((d) => involvesNode(d, target));
-  }
-  const TYPE_LEADERSHIP = {
-    "missing-extracted": 0,
-    "missing-observed": 1,
-    "version-mismatch": 2,
-    "host-mismatch": 3,
-    "compat-violation": 4
-  };
-  filtered.sort((a, b) => {
-    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
-    const lead = TYPE_LEADERSHIP[a.type] - TYPE_LEADERSHIP[b.type];
-    if (lead !== 0) return lead;
-    if (a.type !== b.type) return a.type.localeCompare(b.type);
-    if (a.source !== b.source) return a.source.localeCompare(b.source);
-    return a.target.localeCompare(b.target);
-  });
-  return DivergenceResultSchema.parse({
-    divergences: filtered,
-    totalAffected: filtered.length,
-    computedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-}
-
 // src/streaming.ts
 var SSE_HEARTBEAT_MS = 3e4;
 var SSE_BACKPRESSURE_CAP = 1e3;
@@ -4739,6 +4798,35 @@ function registerRoutes(scope, ctx) {
       }
     }
   );
+  scope.post("/snapshot", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const body = req.body;
+    if (!body || typeof body !== "object" || !body.snapshot) {
+      return reply.code(400).send({ error: "request body must be { snapshot: <persisted-graph> }" });
+    }
+    const snap = body.snapshot;
+    if (typeof snap.schemaVersion !== "number" || snap.schemaVersion !== SCHEMA_VERSION) {
+      return reply.code(400).send({
+        error: `unsupported snapshot schemaVersion ${snap.schemaVersion} (expected ${SCHEMA_VERSION})`
+      });
+    }
+    try {
+      const result = mergeSnapshot(proj.graph, snap);
+      return {
+        project: proj.name,
+        nodesAdded: result.nodesAdded,
+        edgesAdded: result.edgesAdded,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size
+      };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "snapshot merge failed",
+        details: err.message
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply);
     if (!proj) return;
@@ -4832,6 +4920,15 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = Fastify({ logger: false });
   await app.register(cors, { origin: true });
+  mountBearerAuth(app, {
+    token: opts.authToken,
+    trustProxy: opts.trustProxy,
+    publicRead: opts.publicRead
+  });
+  app.get("/api/config", async () => ({
+    publicRead: opts.publicRead === true,
+    authProxy: opts.trustProxy === true
+  }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -4930,6 +5027,7 @@ export {
   addInfra,
   retireEdgesByFile,
   extractFromDirectory,
+  computeDivergences,
   saveGraphToDisk,
   loadGraphFromDisk,
   startPersistLoop,
@@ -4952,4 +5050,4 @@ export {
   removeProject,
   buildApi
 };
-//# sourceMappingURL=chunk-ZU2RQRCN.js.map
+//# sourceMappingURL=chunk-UPW4CMOH.js.map