@neat.is/core 0.3.8 → 0.4.0

package/dist/{chunk-7TYESDAI.js → chunk-4V23KYOP.js}

@@ -30,12 +30,19 @@ function assertBindAuthority(host, token) {
   if (isLoopbackHost(host)) return;
   throw new BindAuthorityError(host);
 }
-var DEFAULT_UNAUTH_SUFFIXES = ["/health", "/healthz", "/readyz"];
+var PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var DEFAULT_UNAUTH_SUFFIXES = [
+  "/health",
+  "/healthz",
+  "/readyz",
+  "/api/config"
+];
 function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
   const expected = Buffer.from(opts.token, "utf8");
   const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
     const path2 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
     for (const suffix of suffixes) {
@@ -44,6 +51,10 @@ function mountBearerAuth(app, opts) {
         return;
       }
     }
+    if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
+      done();
+      return;
+    }
     const header = req.headers.authorization;
     if (typeof header !== "string" || !header.startsWith("Bearer ")) {
       void reply.code(401).send({ error: "unauthorized" });
@@ -57,13 +68,18 @@ function mountBearerAuth(app, opts) {
     done();
   });
 }
+function parseBoolEnv(v) {
+  if (!v) return false;
+  return v === "true" || v === "1";
+}
 function readAuthEnv(env = process.env) {
   const t = env.NEAT_AUTH_TOKEN;
   const ot = env.NEAT_OTEL_TOKEN;
   return {
     authToken: t && t.length > 0 ? t : void 0,
     otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
-    trustProxy: env.NEAT_AUTH_PROXY === "true"
+    trustProxy: env.NEAT_AUTH_PROXY === "true",
+    publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
 
@@ -127,6 +143,18 @@ function isoFromUnixNano(nanos) {
     return void 0;
   }
 }
+var ENV_ATTR_CANONICAL = "deployment.environment.name";
+var ENV_ATTR_COMPAT = "deployment.environment";
+var ENV_FALLBACK = "unknown";
+function pickEnv(spanAttrs, resourceAttrs) {
+  for (const attrs of [spanAttrs, resourceAttrs]) {
+    for (const key of [ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT]) {
+      const v = attrs[key];
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+  }
+  return ENV_FALLBACK;
+}
 function parseOtlpRequest(body) {
   const out = [];
   for (const rs of body.resourceSpans ?? []) {
@@ -146,6 +174,7 @@ function parseOtlpRequest(body) {
           endTimeUnixNano: span.endTimeUnixNano ?? "0",
           startTimeIso: isoFromUnixNano(span.startTimeUnixNano),
           durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),
+          env: pickEnv(attrs, resourceAttrs),
           attributes: attrs,
           dbSystem: typeof attrs["db.system"] === "string" ? attrs["db.system"] : void 0,
           dbName: typeof attrs["db.name"] === "string" ? attrs["db.name"] : void 0,
@@ -200,7 +229,7 @@ function encodeProtobufResponseBody() {
 async function decodeProtobufBody(buf) {
   const Type = loadProtobufDecoder();
   const decoded = Type.decode(buf).toJSON();
-  const { reshapeGrpcRequest } = await import("./otel-grpc-S3AENOZ6.js");
+  const { reshapeGrpcRequest } = await import("./otel-grpc-GGZHR7VM.js");
   return reshapeGrpcRequest(decoded);
 }
 async function buildOtelReceiver(opts) {
@@ -306,4 +335,4 @@ export {
   buildOtelReceiver,
   logSpanHandler
 };
-//# sourceMappingURL=chunk-7TYESDAI.js.map
+//# sourceMappingURL=chunk-4V23KYOP.js.map

package/dist/chunk-4V23KYOP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.ts","../src/otel.ts"],"sourcesContent":["/**\n * Delegated auth at the daemon boundary (ADR-073 §3 + §4).\n *\n * NEAT does not issue, rotate, or distribute the token — that is the deploy\n * platform's job. This module provides the two surfaces the daemon needs:\n *\n *   - `assertBindAuthority(host, token)` — fail-loud pre-bind check. When no\n *     token is set, the daemon refuses to bind on any non-loopback address.\n *     Loopback-only without a token stays unauthenticated (laptop dev path).\n *\n *   - `mountBearerAuth(app, opts)` — Fastify `preHandler` that requires\n *     `Authorization: Bearer <token>` on every request other than the\n *     unauthenticated health/readiness probes. Constant-time comparison.\n *\n * The same shape covers both the REST host and the OTLP receivers; the OTLP\n * side passes a different token (`NEAT_OTEL_TOKEN ?? NEAT_AUTH_TOKEN`) so the\n * two surfaces rotate independently.\n */\n\nimport { timingSafeEqual } from 'node:crypto'\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'\n\n// Hosts that count as loopback for the bind-authority gate. `0.0.0.0` is\n// explicitly not loopback — it binds on every interface, including any\n// public one the operator's box happens to have.\nconst LOOPBACK_HOSTS: ReadonlySet<string> = new Set([\n  '127.0.0.1',\n  'localhost',\n  '::1',\n  '::ffff:127.0.0.1',\n])\n\nexport function isLoopbackHost(host: string | undefined | null): boolean {\n  if (!host) return false\n  return LOOPBACK_HOSTS.has(host)\n}\n\nexport class BindAuthorityError extends Error {\n  constructor(host: string) {\n    super(\n      `NEAT refuses to bind on a public interface without \\`NEAT_AUTH_TOKEN\\` set (host=\"${host}\"). Set the token or bind to loopback only.`,\n    )\n    this.name = 'BindAuthorityError'\n  }\n}\n\nexport function assertBindAuthority(host: string, token: string | undefined): void {\n  if (token && token.length > 0) return\n  if (isLoopbackHost(host)) return\n  throw new BindAuthorityError(host)\n}\n\nexport interface AuthOptions {\n  // Bearer token required on every protected route. Undefined / empty → the\n  // middleware is not mounted and the route stays unauthenticated. The\n  // loopback-only gate above is what keeps that case from being public.\n  token?: string\n  // When `true`, trust an upstream reverse proxy and skip the request-side\n  // check. The fail-loud bind-authority gate still applies upstream. Wired\n  // to `NEAT_AUTH_PROXY=true` in production.\n  trustProxy?: boolean\n  // ADR-073 §3 amendment — public-read mode for reference deployments.\n  // When `true`, GET / HEAD / OPTIONS pass through without a bearer; every\n  // other verb still requires the token. OTLP ingest is excluded — that\n  // surface stays gated unconditionally (the receiver mounts its own\n  // middleware without this flag).\n  publicRead?: boolean\n  // Extra paths (or path suffixes) to leave unauthenticated. Used by tests\n  // and by ad-hoc callers that mount their own probes.\n  extraUnauthenticatedSuffixes?: ReadonlyArray<string>\n}\n\n// Verbs the public-read split treats as reads. Everything else is a write\n// and keeps the bearer requirement.\nconst PUBLIC_READ_METHODS: ReadonlySet<string> = new Set(['GET', 'HEAD', 'OPTIONS'])\n\n// Probes that always stay open. Dual-mounted under `/projects/:project/` too,\n// so the check is a suffix match — `/projects/foo/health` is skipped along\n// with the top-level `/health`. ADR-073 §3 names `/healthz` and `/readyz`\n// explicitly; `/health` is the existing endpoint the web shell and CI smoke\n// already lean on, so it keeps the unauthenticated treatment. `/api/config`\n// is the public-read negotiation endpoint — the web shell hits it before any\n// authed call to learn which mode the daemon is running in.\nconst DEFAULT_UNAUTH_SUFFIXES: ReadonlyArray<string> = [\n  '/health',\n  '/healthz',\n  '/readyz',\n  '/api/config',\n]\n\nexport function mountBearerAuth(app: FastifyInstance, opts: AuthOptions): void {\n  if (!opts.token || opts.token.length === 0) return\n  if (opts.trustProxy) return\n\n  const expected = Buffer.from(opts.token, 'utf8')\n  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...(opts.extraUnauthenticatedSuffixes ?? [])]\n  const publicRead = opts.publicRead === true\n\n  app.addHook('preHandler', (req: FastifyRequest, reply: FastifyReply, done: (err?: Error) => void) => {\n    const path = (req.url.split('?')[0] ?? '').replace(/\\/+$/, '')\n    for (const suffix of suffixes) {\n      if (path === suffix || path.endsWith(suffix)) {\n        done()\n        return\n      }\n    }\n\n    // Public-read split: GET / HEAD / OPTIONS pass through anonymously, every\n    // other verb keeps the bearer check. The token still authorizes writes,\n    // and the bind-authority gate above still demands a token for non-loopback\n    // binds — public-read enables anonymous reads on top of that, it doesn't\n    // replace either invariant.\n    if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {\n      done()\n      return\n    }\n\n    const header = req.headers.authorization\n    if (typeof header !== 'string' || !header.startsWith('Bearer ')) {\n      void reply.code(401).send({ error: 'unauthorized' })\n      return\n    }\n    const provided = Buffer.from(header.slice('Bearer '.length).trim(), 'utf8')\n    if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {\n      void reply.code(401).send({ error: 'unauthorized' })\n      return\n    }\n    done()\n  })\n}\n\n// Read both tokens from the environment in one place so server.ts, daemon.ts,\n// and the OTel receivers all agree on precedence (ADR-073 §4). `publicRead`\n// rides the same shape so callers don't need a second env read.\nexport interface AuthEnv {\n  authToken: string | undefined\n  otelToken: string | undefined\n  trustProxy: boolean\n  publicRead: boolean\n}\n\nfunction parseBoolEnv(v: string | undefined): boolean {\n  if (!v) return false\n  return v === 'true' || v === '1'\n}\n\nexport function readAuthEnv(env: NodeJS.ProcessEnv = process.env): AuthEnv {\n  const t = env.NEAT_AUTH_TOKEN\n  const ot = env.NEAT_OTEL_TOKEN\n  return {\n    authToken: t && t.length > 0 ? t : undefined,\n    otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : undefined,\n    trustProxy: env.NEAT_AUTH_PROXY === 'true',\n    publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ),\n  }\n}\n","import path from 'node:path'\nimport { fileURLToPath } from 'node:url'\nimport Fastify, { type FastifyInstance } from 'fastify'\nimport protobuf from 'protobufjs'\nimport { mountBearerAuth } from './auth.js'\n\n// OTLP/HTTP receiver. Listens on /v1/traces and decodes the JSON wire format\n// (collector's `otlphttp` exporter with `encoding: json`). Each span is\n// flattened into a ParsedSpan and handed to the configured handler. The\n// handler is the seam #8 wires its edge mapper into; #7 itself stays decoupled\n// from graph mutation.\n\nexport interface ParsedSpan {\n  service: string\n  traceId: string\n  spanId: string\n  parentSpanId?: string\n  name: string\n  kind?: number\n  startTimeUnixNano: string\n  endTimeUnixNano: string\n  // ISO8601 derived from startTimeUnixNano. Production paths (lastObserved on\n  // OBSERVED edges) read this so the recorded time reflects when the span fired,\n  // not when the receiver received it. Undefined only when startTimeUnixNano is\n  // missing or unparseable — handler falls back to wall-clock in that case.\n  // See docs/contracts/otel-ingest.md §lastObserved-from-span-time.\n  startTimeIso?: string\n  // bigint so the 9-digit-nanos arithmetic doesn't lose precision on long traces.\n  durationNanos: bigint\n  // Deployment environment from `deployment.environment(.name)`. Span attrs\n  // win over resource attrs (per-span overrides a resource-wide declaration);\n  // the canonical `deployment.environment.name` (OTel SC v1.27+) wins over\n  // the compat form `deployment.environment`. Literal `'unknown'` is the\n  // honest fallback when no env signal is present anywhere on the span or\n  // its resource. See ADR-074 §2 / docs/contracts/env-dimension.md.\n  env: string\n  attributes: Record<string, AttributeValue>\n  // Convenience accessors for the attributes #8 cares about.\n  dbSystem?: string\n  dbName?: string\n  // 0 = UNSET, 1 = OK, 2 = ERROR per OTLP. We only care that 2 means error.\n  statusCode?: number\n  errorMessage?: string\n  // Pre-extracted from a span event with name=\"exception\". OTLP SDKs record\n  // exceptions this way (richer than status.message). handleSpan reads these\n  // first, falling back to status.message and span.name. See\n  // docs/contracts/otel-ingest.md §exception-data-from-span-events.\n  exception?: {\n    type?: string\n    message?: string\n    stacktrace?: string\n  }\n}\n\nexport type AttributeValue =\n  | string\n  | number\n  | boolean\n  | bigint\n  | string[]\n  | number[]\n  | boolean[]\n  | null\n\nexport type SpanHandler = (span: ParsedSpan) => void | Promise<void>\n\nexport interface BuildOtelReceiverOptions {\n  onSpan: SpanHandler\n  // Synchronous handler for spans with statusCode === 2. The receiver awaits\n  // it before replying, so a write failure can return 500 → OTel SDK retries.\n  // Optional — wiring is expected to plumb appendErrorEvent here when error\n  // durability matters; ad-hoc receivers leave it undefined.\n  // See docs/contracts/otel-ingest.md §Error events.\n  onErrorSpanSync?: (span: ParsedSpan) => Promise<void>\n  // Fastify body limit. OTLP batches can be large; default is 16 MB.\n  bodyLimit?: number\n  // ADR-073 §4 — bearer required on `/v1/traces`. Defaults to `NEAT_AUTH_TOKEN`\n  // when unset; `NEAT_OTEL_TOKEN` overrides at the call site so the REST and\n  // OTLP surfaces rotate on independent schedules.\n  authToken?: string\n  // Same shape as the REST middleware: skip the request-side check when an\n  // upstream reverse proxy already authenticated.\n  trustProxy?: boolean\n}\n\ninterface OtlpKeyValue {\n  key: string\n  value?: OtlpAnyValue\n}\n\ninterface OtlpAnyValue {\n  stringValue?: string\n  intValue?: string | number\n  doubleValue?: number\n  boolValue?: boolean\n  arrayValue?: { values?: OtlpAnyValue[] }\n  // kvlistValue / bytesValue are skipped — neither is on the demo path.\n}\n\ninterface OtlpStatus {\n  code?: number\n  message?: string\n}\n\ninterface OtlpEvent {\n  name?: string\n  timeUnixNano?: string\n  attributes?: OtlpKeyValue[]\n}\n\ninterface OtlpSpan {\n  traceId?: string\n  spanId?: string\n  parentSpanId?: string\n  name?: string\n  kind?: number\n  startTimeUnixNano?: string\n  endTimeUnixNano?: string\n  attributes?: OtlpKeyValue[]\n  events?: OtlpEvent[]\n  status?: OtlpStatus\n}\n\nfunction extractExceptionFromEvents(events: OtlpEvent[] | undefined): ParsedSpan['exception'] {\n  if (!events) return undefined\n  for (const ev of events) {\n    if (ev.name !== 'exception') continue\n    const attrs = attrsToRecord(ev.attributes)\n    const out: ParsedSpan['exception'] = {}\n    const t = attrs['exception.type']\n    const m = attrs['exception.message']\n    const s = attrs['exception.stacktrace']\n    if (typeof t === 'string') out.type = t\n    if (typeof m === 'string') out.message = m\n    if (typeof s === 'string') out.stacktrace = s\n    if (out.type || out.message || out.stacktrace) return out\n  }\n  return undefined\n}\n\ninterface OtlpScopeSpans {\n  spans?: OtlpSpan[]\n}\n\ninterface OtlpResourceSpans {\n  resource?: { attributes?: OtlpKeyValue[] }\n  scopeSpans?: OtlpScopeSpans[]\n}\n\nexport interface OtlpTracesRequest {\n  resourceSpans?: OtlpResourceSpans[]\n}\n\nfunction flattenAttribute(v: OtlpAnyValue | undefined): AttributeValue {\n  if (!v) return null\n  if (v.stringValue !== undefined) return v.stringValue\n  if (v.boolValue !== undefined) return v.boolValue\n  if (v.intValue !== undefined) {\n    return typeof v.intValue === 'string' ? Number(v.intValue) : v.intValue\n  }\n  if (v.doubleValue !== undefined) return v.doubleValue\n  if (v.arrayValue?.values) {\n    return v.arrayValue.values.map((x) => flattenAttribute(x)) as AttributeValue\n  }\n  return null\n}\n\nfunction attrsToRecord(attrs: OtlpKeyValue[] | undefined): Record<string, AttributeValue> {\n  const out: Record<string, AttributeValue> = {}\n  if (!attrs) return out\n  for (const kv of attrs) {\n    if (kv.key) out[kv.key] = flattenAttribute(kv.value)\n  }\n  return out\n}\n\nfunction durationNanos(start?: string, end?: string): bigint {\n  if (!start || !end) return 0n\n  try {\n    return BigInt(end) - BigInt(start)\n  } catch {\n    return 0n\n  }\n}\n\n// Convert OTLP's startTimeUnixNano (a base-10 string of nanoseconds since the\n// Unix epoch) to ISO8601. Returns undefined when the input is missing, zero,\n// or unparseable, so the caller can fall back to wall-clock without surfacing\n// a fake timestamp on the edge.\nexport function isoFromUnixNano(nanos: string | undefined): string | undefined {\n  if (!nanos || nanos === '0') return undefined\n  try {\n    const ms = Number(BigInt(nanos) / 1_000_000n)\n    if (!Number.isFinite(ms)) return undefined\n    return new Date(ms).toISOString()\n  } catch {\n    return undefined\n  }\n}\n\n// Resolve `deployment.environment` per ADR-074 §2. The four-step fallback\n// is: span-attr canonical form → span-attr compat form → resource-attr\n// canonical form → resource-attr compat form → literal `'unknown'`. The\n// literal `'unknown'` is the honest sentinel; defaulting to `'production'`\n// or `'development'` would bake an incorrect assumption into every span\n// from a workload that hasn't yet wired its env signal.\nconst ENV_ATTR_CANONICAL = 'deployment.environment.name'\nconst ENV_ATTR_COMPAT = 'deployment.environment'\nconst ENV_FALLBACK = 'unknown'\n\nfunction pickEnv(\n  spanAttrs: Record<string, AttributeValue>,\n  resourceAttrs: Record<string, AttributeValue>,\n): string {\n  for (const attrs of [spanAttrs, resourceAttrs]) {\n    for (const key of [ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT]) {\n      const v = attrs[key]\n      if (typeof v === 'string' && v.length > 0) return v\n    }\n  }\n  return ENV_FALLBACK\n}\n\nexport function parseOtlpRequest(body: OtlpTracesRequest): ParsedSpan[] {\n  const out: ParsedSpan[] = []\n  for (const rs of body.resourceSpans ?? []) {\n    const resourceAttrs = attrsToRecord(rs.resource?.attributes)\n    const service = typeof resourceAttrs['service.name'] === 'string'\n      ? (resourceAttrs['service.name'] as string)\n      : 'unknown'\n\n    for (const ss of rs.scopeSpans ?? []) {\n      for (const span of ss.spans ?? []) {\n        const attrs = attrsToRecord(span.attributes)\n        const parsed: ParsedSpan = {\n          service,\n          traceId: span.traceId ?? '',\n          spanId: span.spanId ?? '',\n          parentSpanId: span.parentSpanId || undefined,\n          name: span.name ?? '',\n          kind: span.kind,\n          startTimeUnixNano: span.startTimeUnixNano ?? '0',\n          endTimeUnixNano: span.endTimeUnixNano ?? '0',\n          startTimeIso: isoFromUnixNano(span.startTimeUnixNano),\n          durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),\n          env: pickEnv(attrs, resourceAttrs),\n          attributes: attrs,\n          dbSystem: typeof attrs['db.system'] === 'string' ? (attrs['db.system'] as string) : undefined,\n          dbName: typeof attrs['db.name'] === 'string' ? (attrs['db.name'] as string) : undefined,\n          statusCode: span.status?.code,\n          errorMessage: span.status?.message,\n          exception: extractExceptionFromEvents(span.events),\n        }\n        out.push(parsed)\n      }\n    }\n  }\n  return out\n}\n\nexport interface OtelReceiver {\n  app: FastifyInstance\n  // Resolves once every span enqueued so far has been handed to opts.onSpan.\n  // Test seam — production code never awaits this.\n  flushPending: () => Promise<void>\n}\n\n// Lazy-loaded protobuf decoder for ExportTraceServiceRequest. The bundled\n// .proto tree at packages/core/proto/ is shared with the gRPC receiver\n// (ADR-020). Cached after first load so successive receiver builds reuse it.\nlet exportTraceServiceRequestType: protobuf.Type | null = null\nlet exportTraceServiceResponseType: protobuf.Type | null = null\n\nfunction loadProtoRoot(): protobuf.Root {\n  const here = path.dirname(fileURLToPath(import.meta.url))\n  const protoRoot = path.resolve(here, '..', 'proto')\n  const root = new protobuf.Root()\n  root.resolvePath = (_origin, target) => path.resolve(protoRoot, target)\n  root.loadSync(\n    'opentelemetry/proto/collector/trace/v1/trace_service.proto',\n    { keepCase: true },\n  )\n  return root\n}\n\nfunction loadProtobufDecoder(): protobuf.Type {\n  if (exportTraceServiceRequestType) return exportTraceServiceRequestType\n  const root = loadProtoRoot()\n  exportTraceServiceRequestType = root.lookupType(\n    'opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest',\n  )\n  return exportTraceServiceRequestType\n}\n\nfunction loadProtobufResponseEncoder(): protobuf.Type {\n  if (exportTraceServiceResponseType) return exportTraceServiceResponseType\n  const root = loadProtoRoot()\n  exportTraceServiceResponseType = root.lookupType(\n    'opentelemetry.proto.collector.trace.v1.ExportTraceServiceResponse',\n  )\n  return exportTraceServiceResponseType\n}\n\n// Empty-partial-success response, encoded once and cached. Per ADR-033 the\n// receiver always reports \"all accepted\" today — there's no per-span reject\n// path. Caching the bytes avoids re-running the protobuf encoder per request.\nlet cachedProtobufResponseBody: Buffer | null = null\n\nfunction encodeProtobufResponseBody(): Buffer {\n  if (cachedProtobufResponseBody) return cachedProtobufResponseBody\n  const Type = loadProtobufResponseEncoder()\n  // `partial_success` left unset = empty submessage = \"everything accepted\".\n  // verify() returns null on success; the empty payload is always valid.\n  const msg = Type.create({})\n  const encoded = Type.encode(msg).finish()\n  cachedProtobufResponseBody = Buffer.from(encoded)\n  return cachedProtobufResponseBody\n}\n\nasync function decodeProtobufBody(buf: Buffer): Promise<OtlpTracesRequest> {\n  const Type = loadProtobufDecoder()\n  // Decode keeps the proto field names verbatim (keepCase: true), matching the\n  // GrpcExportRequest shape that reshapeGrpcRequest already understands.\n  // Dynamic import sidesteps the circular module dep with otel-grpc.ts.\n  const decoded = Type.decode(buf).toJSON() as Record<string, unknown>\n  const { reshapeGrpcRequest } = await import('./otel-grpc.js')\n  return reshapeGrpcRequest(decoded as never)\n}\n\nexport async function buildOtelReceiver(\n  opts: BuildOtelReceiverOptions,\n): Promise<FastifyInstance & { flushPending: () => Promise<void> }> {\n  const app = Fastify({\n    logger: false,\n    bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024,\n  })\n\n  // ADR-073 §4 — bearer on `/v1/traces`. `/health` stays unauthenticated via\n  // the default suffix list (the CI smoke and supervisors lean on it for\n  // liveness probes).\n  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy })\n\n  // Non-blocking ingest (ADR-033). The receiver replies 200 OK as soon as the\n  // body is parsed; mutation runs through this queue, drained on the next tick.\n  // OTel SDK exporters retry on timeout, so blocking ingest produces observable\n  // backpressure on the system being observed — ambient observation requires no\n  // observable effect.\n  const queue: ParsedSpan[] = []\n  let draining = false\n  let drainPromise: Promise<void> = Promise.resolve()\n\n  const drain = async (): Promise<void> => {\n    if (draining) return\n    draining = true\n    try {\n      while (queue.length > 0) {\n        const span = queue.shift()!\n        try {\n          await opts.onSpan(span)\n        } catch (err) {\n          console.warn(`[neat] otel handler error: ${(err as Error).message}`)\n        }\n      }\n    } finally {\n      draining = false\n    }\n  }\n\n  const enqueue = (spans: ParsedSpan[]): void => {\n    if (spans.length === 0) return\n    for (const s of spans) queue.push(s)\n    // Schedule on the next tick so the 200 response is on the wire before any\n    // mutation runs. Each call gets its own promise so flushPending() can wait\n    // on the latest drain cycle.\n    drainPromise = drainPromise.then(() => drain())\n  }\n\n  // Buffer application/x-protobuf bodies as raw bytes; the route handler\n  // decodes them via the bundled .proto tree (ADR-020).\n  app.addContentTypeParser(\n    'application/x-protobuf',\n    { parseAs: 'buffer', bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024 },\n    (_req, body, done) => {\n      done(null, body)\n    },\n  )\n\n  app.get('/health', async () => ({ ok: true }))\n\n  app.post('/v1/traces', async (req, reply) => {\n    // Content-Type dispatch (ADR-033). Both JSON and protobuf decode to the\n    // same OtlpTracesRequest shape, then feed parseOtlpRequest unchanged.\n    // The response encoding mirrors the request encoding per the OTLP spec —\n    // a JSON exporter receives JSON, a protobuf exporter receives protobuf.\n    // Mismatched encodings cause client SDKs to log decode errors every batch.\n    const ct = (req.headers['content-type'] ?? '').toString().split(';')[0]!.trim().toLowerCase()\n    let body: OtlpTracesRequest\n    let responseFlavor: 'json' | 'protobuf'\n    if (ct === 'application/x-protobuf') {\n      responseFlavor = 'protobuf'\n      try {\n        body = await decodeProtobufBody(req.body as Buffer)\n      } catch (err) {\n        return reply.code(400).send({\n          error: `protobuf decode failed: ${(err as Error).message}`,\n        })\n      }\n    } else if (!ct || ct === 'application/json') {\n      responseFlavor = 'json'\n      body = (req.body ?? {}) as OtlpTracesRequest\n    } else {\n      return reply.code(415).send({ error: `unsupported content-type: ${ct}` })\n    }\n    const spans = parseOtlpRequest(body)\n    // Synchronous error-event write before reply (ADR-033 §Error events).\n    // Graph mutation stays on the async queue, but the receiver awaits the\n    // file write so a write failure surfaces as 500 → OTel SDK retries.\n    if (opts.onErrorSpanSync) {\n      try {\n        for (const span of spans) {\n          if (span.statusCode === 2) await opts.onErrorSpanSync(span)\n        }\n      } catch (err) {\n        return reply.code(500).send({\n          error: `error-event write failed: ${(err as Error).message}`,\n        })\n      }\n    }\n    enqueue(spans)\n    // OTLP success response is `{ partialSuccess: {} }` for \"all accepted\".\n    // Match the response Content-Type to the request: protobuf in → protobuf\n    // out, JSON in → JSON out. Default Fastify JSON reply path stays as the\n    // historical shape for JSON callers.\n    if (responseFlavor === 'protobuf') {\n      const buf = encodeProtobufResponseBody()\n      return reply\n        .code(200)\n        .header('content-type', 'application/x-protobuf')\n        .send(buf)\n    }\n    return reply\n      .code(200)\n      .header('content-type', 'application/json')\n      .send({ partialSuccess: {} })\n  })\n\n  // Attach flushPending so tests can wait for the queue without exporting a\n  // separate handle. The cast goes through `unknown` because Fastify's typing\n  // is parameterised over the raw server type and the simple intersection\n  // confuses TS's structural narrowing.\n  const decorated = app as unknown as FastifyInstance & { flushPending: () => Promise<void> }\n  decorated.flushPending = async () => {\n    // Settle the current drain chain, then loop until the queue is fully empty\n    // (a span enqueued mid-flush would otherwise be missed).\n    while (queue.length > 0 || draining) {\n      await drainPromise\n    }\n  }\n  return decorated\n}\n\nexport function logSpanHandler(span: ParsedSpan): void {\n  const parent = span.parentSpanId ? span.parentSpanId.slice(0, 8) : '<root>'\n  const status = span.statusCode === 2 ? 'ERROR' : 'OK'\n  const db = span.dbSystem ? ` db=${span.dbSystem}/${span.dbName ?? '?'}` : ''\n  console.log(\n    `otel: ${span.service} ${span.name} parent=${parent} status=${status}${db}`,\n  )\n}\n"],"mappings":";;;;;;;;AAmBA,SAAS,uBAAuB;AAMhC,IAAM,iBAAsC,oBAAI,IAAI;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,eAAe,MAA0C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,eAAe,IAAI,IAAI;AAChC;AAEO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAY,MAAc;AACxB;AAAA,MACE,qFAAqF,IAAI;AAAA,IAC3F;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,oBAAoB,MAAc,OAAiC;AACjF,MAAI,SAAS,MAAM,SAAS,EAAG;AAC/B,MAAI,eAAe,IAAI,EAAG;AAC1B,QAAM,IAAI,mBAAmB,IAAI;AACnC;AAwBA,IAAM,sBAA2C,oBAAI,IAAI,CAAC,OAAO,QAAQ,SAAS,CAAC;AASnF,IAAM,0BAAiD;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,gBAAgB,KAAsB,MAAyB;AAC7E,MAAI,CAAC,KAAK,SAAS,KAAK,MAAM,WAAW,EAAG;AAC5C,MAAI,KAAK,WAAY;AAErB,QAAM,WAAW,OAAO,KAAK,KAAK,OAAO,MAAM;AAC/C,QAAM,WAAW,CAAC,GAAG,yBAAyB,GAAI,KAAK,gCAAgC,CAAC,CAAE;AAC1F,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI,QAAQ,cAAc,CAAC,KAAqB,OAAqB,SAAgC;AACnG,UAAMA,SAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,QAAQ,QAAQ,EAAE;AAC7D,eAAW,UAAU,UAAU;AAC7B,UAAIA,UAAS,UAAUA,MAAK,SAAS,MAAM,GAAG;AAC5C,aAAK;AACL;AAAA,MACF;AAAA,IACF;AAOA,QAAI,cAAc,oBAAoB,IAAI,IAAI,MAAM,GAAG;AACrD,WAAK;AACL;AAAA,IACF;AAEA,UAAM,SAAS,IAAI,QAAQ;AAC3B,QAAI,OAAO,WAAW,YAAY,CAAC,OAAO,WAAW,SAAS,GAAG;AAC/D,WAAK,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AACnD;AAAA,IACF;AACA,UAAM,WAAW,OAAO,KAAK,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,GAAG,MAAM;AAC1E,QAAI,SAAS,WAAW,SAAS,UAAU,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAC/E,WAAK,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AACnD;AAAA,IACF;AACA,SAAK;AAAA,EACP,CAAC;AACH;AAYA,SAAS,aAAa,GAAgC;AACpD,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,MAAM,UAAU,MAAM;AAC/B;AAEO,SAAS,YAAY,MAAyB,QAAQ,KAAc;AACzE,QAAM,IAAI,IAAI;AACd,QAAM,KAAK,IAAI;AACf,SAAO;AAAA,IACL,WAAW,KAAK,EAAE,SAAS,IAAI,IAAI;AAAA,IACnC,WAAW,MAAM,GAAG,SAAS,IAAI,KAAK,KAAK,EAAE,SAAS,IAAI,IAAI;AAAA,IAC9D,YAAY,IAAI,oBAAoB;AAAA,IACpC,YAAY,aAAa,IAAI,gBAAgB;AAAA,EAC/C;AACF;;;AC3JA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAC9B,OAAO,aAAuC;AAC9C,OAAO,cAAc;AAwHrB,SAAS,2BAA2B,QAA0D;AAC5F,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,MAAM,QAAQ;AACvB,QAAI,GAAG,SAAS,YAAa;AAC7B,UAAM,QAAQ,cAAc,GAAG,UAAU;AACzC,UAAM,MAA+B,CAAC;AACtC,UAAM,IAAI,MAAM,gBAAgB;AAChC,UAAM,IAAI,MAAM,mBAAmB;AACnC,UAAM,IAAI,MAAM,sBAAsB;AACtC,QAAI,OAAO,MAAM,SAAU,KAAI,OAAO;AACtC,QAAI,OAAO,MAAM,SAAU,KAAI,UAAU;AACzC,QAAI,OAAO,MAAM,SAAU,KAAI,aAAa;AAC5C,QAAI,IAAI,QAAQ,IAAI,WAAW,IAAI,WAAY,QAAO;AAAA,EACxD;AACA,SAAO;AACT;AAeA,SAAS,iBAAiB,GAA6C;AACrE,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,EAAE,gBAAgB,OAAW,QAAO,EAAE;AAC1C,MAAI,EAAE,cAAc,OAAW,QAAO,EAAE;AACxC,MAAI,EAAE,aAAa,QAAW;AAC5B,WAAO,OAAO,EAAE,aAAa,WAAW,OAAO,EAAE,QAAQ,IAAI,EAAE;AAAA,EACjE;AACA,MAAI,EAAE,gBAAgB,OAAW,QAAO,EAAE;AAC1C,MAAI,EAAE,YAAY,QAAQ;AACxB,WAAO,EAAE,WAAW,OAAO,IAAI,CAAC,MAAM,iBAAiB,CAAC,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAmE;AACxF,QAAM,MAAsC,CAAC;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,MAAM,OAAO;AACtB,QAAI,GAAG,IAAK,KAAI,GAAG,GAAG,IAAI,iBAAiB,GAAG,KAAK;AAAA,EACrD;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAgB,KAAsB;AAC3D,MAAI,CAAC,SAAS,CAAC,IAAK,QAAO;AAC3B,MAAI;AACF,WAAO,OAAO,GAAG,IAAI,OAAO,KAAK;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,gBAAgB,OAA+C;AAC7E,MAAI,CAAC,SAAS,UAAU,IAAK,QAAO;AACpC,MAAI;AACF,UAAM,KAAK,OAAO,OAAO,KAAK,IAAI,QAAU;AAC5C,QAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,WAAO,IAAI,KAAK,EAAE,EAAE,YAAY;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAErB,SAAS,QACP,WACA,eACQ;AACR,aAAW,SAAS,CAAC,WAAW,aAAa,GAAG;AAC9C,eAAW,OAAO,CAAC,oBAAoB,eAAe,GAAG;AACvD,YAAM,IAAI,MAAM,GAAG;AACnB,UAAI,OAAO,MAAM,YAAY,EAAE,SAAS,EAAG,QAAO;AAAA,IACpD;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAuC;AACtE,QAAM,MAAoB,CAAC;AAC3B,aAAW,MAAM,KAAK,iBAAiB,CAAC,GAAG;AACzC,UAAM,gBAAgB,cAAc,GAAG,UAAU,UAAU;AAC3D,UAAM,UAAU,OAAO,cAAc,cAAc,MAAM,WACpD,cAAc,cAAc,IAC7B;AAEJ,eAAW,MAAM,GAAG,cAAc,CAAC,GAAG;AACpC,iBAAW,QAAQ,GAAG,SAAS,CAAC,GAAG;AACjC,cAAM,QAAQ,cAAc,KAAK,UAAU;AAC3C,cAAM,SAAqB;AAAA,UACzB;AAAA,UACA,SAAS,KAAK,WAAW;AAAA,UACzB,QAAQ,KAAK,UAAU;AAAA,UACvB,cAAc,KAAK,gBAAgB;AAAA,UACnC,MAAM,KAAK,QAAQ;AAAA,UACnB,MAAM,KAAK;AAAA,UACX,mBAAmB,KAAK,qBAAqB;AAAA,UAC7C,iBAAiB,KAAK,mBAAmB;AAAA,UACzC,cAAc,gBAAgB,KAAK,iBAAiB;AAAA,UACpD,eAAe,cAAc,KAAK,mBAAmB,KAAK,eAAe;AAAA,UACzE,KAAK,QAAQ,OAAO,aAAa;AAAA,UACjC,YAAY;AAAA,UACZ,UAAU,OAAO,MAAM,WAAW,MAAM,WAAY,MAAM,WAAW,IAAe;AAAA,UACpF,QAAQ,OAAO,MAAM,SAAS,MAAM,WAAY,MAAM,SAAS,IAAe;AAAA,UAC9E,YAAY,KAAK,QAAQ;AAAA,UACzB,cAAc,KAAK,QAAQ;AAAA,UAC3B,WAAW,2BAA2B,KAAK,MAAM;AAAA,QACnD;AACA,YAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAYA,IAAI,gCAAsD;AAC1D,IAAI,iCAAuD;AAE3D,SAAS,gBAA+B;AACtC,QAAM,OAAO,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AACxD,QAAM,YAAY,KAAK,QAAQ,MAAM,MAAM,OAAO;AAClD,QAAM,OAAO,IAAI,SAAS,KAAK;AAC/B,OAAK,cAAc,CAAC,SAAS,WAAW,KAAK,QAAQ,WAAW,MAAM;AACtE,OAAK;AAAA,IACH;AAAA,IACA,EAAE,UAAU,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAEA,SAAS,sBAAqC;AAC5C,MAAI,8BAA+B,QAAO;AAC1C,QAAM,OAAO,cAAc;AAC3B,kCAAgC,KAAK;AAAA,IACnC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,8BAA6C;AACpD,MAAI,+BAAgC,QAAO;AAC3C,QAAM,OAAO,cAAc;AAC3B,mCAAiC,KAAK;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAKA,IAAI,6BAA4C;AAEhD,SAAS,6BAAqC;AAC5C,MAAI,2BAA4B,QAAO;AACvC,QAAM,OAAO,4BAA4B;AAGzC,QAAM,MAAM,KAAK,OAAO,CAAC,CAAC;AAC1B,QAAM,UAAU,KAAK,OAAO,GAAG,EAAE,OAAO;AACxC,+BAA6B,OAAO,KAAK,OAAO;AAChD,SAAO;AACT;AAEA,eAAe,mBAAmB,KAAyC;AACzE,QAAM,OAAO,oBAAoB;AAIjC,QAAM,UAAU,KAAK,OAAO,GAAG,EAAE,OAAO;AACxC,QAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,yBAAgB;AAC5D,SAAO,mBAAmB,OAAgB;AAC5C;AAEA,eAAsB,kBACpB,MACkE;AAClE,QAAM,MAAM,QAAQ;AAAA,IAClB,QAAQ;AAAA,IACR,WAAW,KAAK,aAAa,KAAK,OAAO;AAAA,EAC3C,CAAC;AAKD,kBAAgB,KAAK,EAAE,OAAO,KAAK,WAAW,YAAY,KAAK,WAAW,CAAC;AAO3E,QAAM,QAAsB,CAAC;AAC7B,MAAI,WAAW;AACf,MAAI,eAA8B,QAAQ,QAAQ;AAElD,QAAM,QAAQ,YAA2B;AACvC,QAAI,SAAU;AACd,eAAW;AACX,QAAI;AACF,aAAO,MAAM,SAAS,GAAG;AACvB,cAAM,OAAO,MAAM,MAAM;AACzB,YAAI;AACF,gBAAM,KAAK,OAAO,IAAI;AAAA,QACxB,SAAS,KAAK;AACZ,kBAAQ,KAAK,8BAA+B,IAAc,OAAO,EAAE;AAAA,QACrE;AAAA,MACF;AAAA,IACF,UAAE;AACA,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,UAAU,CAAC,UAA8B;AAC7C,QAAI,MAAM,WAAW,EAAG;AACxB,eAAW,KAAK,MAAO,OAAM,KAAK,CAAC;AAInC,mBAAe,aAAa,KAAK,MAAM,MAAM,CAAC;AAAA,EAChD;AAIA,MAAI;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,WAAW,KAAK,aAAa,KAAK,OAAO,KAAK;AAAA,IACnE,CAAC,MAAM,MAAM,SAAS;AACpB,WAAK,MAAM,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,IAAI,WAAW,aAAa,EAAE,IAAI,KAAK,EAAE;AAE7C,MAAI,KAAK,cAAc,OAAO,KAAK,UAAU;AAM3C,UAAM,MAAM,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK,EAAE,YAAY;AAC5F,QAAI;AACJ,QAAI;AACJ,QAAI,OAAO,0BAA0B;AACnC,uBAAiB;AACjB,UAAI;AACF,eAAO,MAAM,mBAAmB,IAAI,IAAc;AAAA,MACpD,SAAS,KAAK;AACZ,eAAO,MAAM,KAAK,GAAG,EAAE,KAAK;AAAA,UAC1B,OAAO,2BAA4B,IAAc,OAAO;AAAA,QAC1D,CAAC;AAAA,MACH;AAAA,IACF,WAAW,CAAC,MAAM,OAAO,oBAAoB;AAC3C,uBAAiB;AACjB,aAAQ,IAAI,QAAQ,CAAC;AAAA,IACvB,OAAO;AACL,aAAO,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,6BAA6B,EAAE,GAAG,CAAC;AAAA,IAC1E;AACA,UAAM,QAAQ,iBAAiB,IAAI;AAInC,QAAI,KAAK,iBAAiB;AACxB,UAAI;AACF,mBAAW,QAAQ,OAAO;AACxB,cAAI,KAAK,eAAe,EAAG,OAAM,KAAK,gBAAgB,IAAI;AAAA,QAC5D;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,MAAM,KAAK,GAAG,EAAE,KAAK;AAAA,UAC1B,OAAO,6BAA8B,IAAc,OAAO;AAAA,QAC5D,CAAC;AAAA,MACH;AAAA,IACF;AACA,YAAQ,KAAK;AAKb,QAAI,mBAAmB,YAAY;AACjC,YAAM,MAAM,2BAA2B;AACvC,aAAO,MACJ,KAAK,GAAG,EACR,OAAO,gBAAgB,wBAAwB,EAC/C,KAAK,GAAG;AAAA,IACb;AACA,WAAO,MACJ,KAAK,GAAG,EACR,OAAO,gBAAgB,kBAAkB,EACzC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;AAAA,EAChC,CAAC;AAMD,QAAM,YAAY;AAClB,YAAU,eAAe,YAAY;AAGnC,WAAO,MAAM,SAAS,KAAK,UAAU;AACnC,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,eAAe,MAAwB;AACrD,QAAM,SAAS,KAAK,eAAe,KAAK,aAAa,MAAM,GAAG,CAAC,IAAI;AACnE,QAAM,SAAS,KAAK,eAAe,IAAI,UAAU;AACjD,QAAM,KAAK,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK,UAAU,GAAG,KAAK;AAC1E,UAAQ;AAAA,IACN,SAAS,KAAK,OAAO,IAAI,KAAK,IAAI,WAAW,MAAM,WAAW,MAAM,GAAG,EAAE;AAAA,EAC3E;AACF;","names":["path"]}

package/dist/{chunk-V4TU7OKZ.js → chunk-IXIFJKMM.js}

@@ -1,6 +1,6 @@
 import {
   parseOtlpRequest
-} from "./chunk-7TYESDAI.js";
+} from "./chunk-4V23KYOP.js";
 
 // src/otel-grpc.ts
 import { fileURLToPath } from "url";
@@ -136,4 +136,4 @@ export {
   reshapeGrpcRequest,
   startOtelGrpcReceiver
 };
-//# sourceMappingURL=chunk-V4TU7OKZ.js.map
+//# sourceMappingURL=chunk-IXIFJKMM.js.map

package/dist/{chunk-LQ3JFBTX.js → chunk-N6RPINEJ.js}

@@ -15,12 +15,12 @@ import {
   startPersistLoop,
   touchLastSeen,
   writeAtomically
-} from "./chunk-CZ3T6TE2.js";
+} from "./chunk-UPW4CMOH.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
   readAuthEnv
-} from "./chunk-7TYESDAI.js";
+} from "./chunk-4V23KYOP.js";
 
 // src/daemon.ts
 import { promises as fs } from "fs";
@@ -237,7 +237,8 @@ async function startDaemon(opts = {}) {
       restApp = await buildApi({
         projects: registry,
         authToken: auth.authToken,
-        trustProxy: auth.trustProxy
+        trustProxy: auth.trustProxy,
+        publicRead: auth.publicRead
       });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);
@@ -360,4 +361,4 @@ export {
   routeSpanToProject,
   startDaemon
 };
-//# sourceMappingURL=chunk-LQ3JFBTX.js.map
+//# sourceMappingURL=chunk-N6RPINEJ.js.map

package/dist/{chunk-LQ3JFBTX.js.map → chunk-N6RPINEJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/daemon.ts"],"sourcesContent":["/**\n * Multi-project daemon (ADR-049).\n *\n * Single long-lived process watching every project in the machine-level registry.\n * Per-project graph isolation: each registered project owns its own\n * `MultiDirectedGraph` slot keyed by name (ADR-026), and a failure during\n * one project's bootstrap is logged + marked `broken` without taking down\n * the rest of the daemon.\n *\n * MVP scope (v0.2.5):\n *  - Read registry; refuse to boot when it's missing.\n *  - Write PID at `~/.neat/neatd.pid` for external supervisors.\n *  - Per project: load any existing snapshot, run initial extraction,\n *    start a per-project persist loop.\n *  - SIGHUP triggers a reload — re-reads the registry, picks up new\n *    projects, drops removed ones, leaves untouched ones in place.\n *  - Provide `routeSpanToProject(serviceName, projects)` for OTel ingest\n *    to dispatch by `service.name` across registered projects, falling\n *    back to `default` for unknown services per ADR-033.\n *\n * Out of MVP scope (deferred):\n *  - Live OTel listener wiring per project — daemon exposes the routing\n *    primitive; the actual receiver attachment lands alongside v0.2.6.\n *  - Policy reload on `policy.json` mtime — `startWatch` already does this\n *    per-project; the daemon-level loop reuses that machinery in a follow-up.\n *  - Auto-restart on crash. PID file is the supervisor handoff.\n */\n\nimport { promises as fs } from 'node:fs'\nimport path from 'node:path'\nimport type { FastifyInstance } from 'fastify'\nimport { DEFAULT_PROJECT, getGraph, resetGraph, type NeatGraph } from './graph.js'\nimport { extractFromDirectory } from './extract.js'\nimport { loadGraphFromDisk, startPersistLoop } from './persist.js'\nimport { Projects, pathsForProject, type ProjectPaths } from './projects.js'\nimport { buildApi } from './api.js'\nimport { buildOtelReceiver } from './otel.js'\nimport { handleSpan, makeErrorSpanWriter } from './ingest.js'\nimport {\n  listProjects,\n  registryPath,\n  setStatus,\n  touchLastSeen,\n  writeAtomically,\n} from './registry.js'\nimport { assertBindAuthority, readAuthEnv } from './auth.js'\nimport type { RegistryEntry } from '@neat.is/types'\n\nexport interface DaemonOptions {\n  // Defaults to `~/.neat/`. Honors NEAT_HOME the same way registry.ts does.\n  // Tests override via NEAT_HOME and don't pass this directly.\n  neatHome?: string\n  // ADR-063 — bind targets. Defaults to PORT (8080) / OTEL_PORT (4318) env\n  // vars, matching server.ts. Tests pass 0 to get ephemeral ports.\n  restPort?: number\n  otlpPort?: number\n  // ADR-063 — bind host. Defaults to HOST env (0.0.0.0).\n  host?: string\n  // ADR-063 — opt out of binding entirely (e.g. integration tests that\n  // exercise daemon slots without needing the listeners). Production\n  // `neatd start` never sets this.\n  bindListeners?: boolean\n}\n\nexport interface ProjectSlot {\n  entry: RegistryEntry\n  graph: NeatGraph\n  outPath: string\n  paths: ProjectPaths\n  stopPersist: () => void\n  status: 'active' | 'broken'\n  errorReason?: string\n}\n\nexport interface DaemonHandle {\n  // The slots currently being managed, keyed by project name. Tests inspect\n  // this to assert isolation properties.\n  slots: Map<string, ProjectSlot>\n  // Re-read the registry. New entries get bootstrapped, removed ones get\n  // their persist loops stopped, existing ones stay running.\n  reload: () => Promise<void>\n  // Graceful shutdown — stop every project's persist loop and remove the\n  // PID file.\n  stop: () => Promise<void>\n  // Path to the PID file the daemon owns. Useful for test assertions.\n  pidPath: string\n  // ADR-063 — addresses where consumers reach the daemon. Empty string when\n  // bindListeners is false. REST is the Fastify app's listening address;\n  // OTLP is the receiver's.\n  restAddress: string\n  otlpAddress: string\n}\n\nfunction neatHomeFor(opts: DaemonOptions): string {\n  if (opts.neatHome && opts.neatHome.length > 0) return path.resolve(opts.neatHome)\n  const env = process.env.NEAT_HOME\n  if (env && env.length > 0) return path.resolve(env)\n  const home = process.env.HOME ?? process.env.USERPROFILE ?? ''\n  return path.join(home, '.neat')\n}\n\n/**\n * Resolve which project's graph an OTel span belongs to. Looks up the\n * `service.name` against the registry and returns the matching project's\n * name, or `DEFAULT_PROJECT` for unknown services so the FrontierNode\n * auto-creation flow keeps working per ADR-033.\n *\n * Pure function. Daemon callers pass a snapshot of the registry to avoid\n * per-span fs reads.\n *\n * Matching order (ADR-072 — real-world `service.name` rarely equals project\n * name; monorepos publish per-package names like `brief-api` under a\n * project named `brief`):\n *\n *   1. Exact: `entry.name === serviceName`.\n *   2. Hyphen/underscore-separated prefix: `entry.name` is a leading token\n *      of `serviceName` (`brief` matches `brief-api`, `brief_worker`).\n *      Longest-match wins so `brief-api` beats `brief` when both are\n *      registered.\n *   3. Containment as a separator-delimited token (`api` inside\n *      `brief-api-staging`).\n *\n * Routing eligibility (ADR-071):\n * - `active` matches at every pass (the steady-state path).\n * - `broken` also matches — the daemon needs the span to reach the broken\n *   slot so the ingest-time auto-recover path can attempt a bootstrap and\n *   lift the project back to `active`. The router only chooses the target;\n *   whether the span actually lands is the ingest handler's decision.\n * - `paused` is intentionally not routed; the operator paused it on\n *   purpose, so the span falls through to the default-project flow.\n *\n * Falls back to `DEFAULT_PROJECT` when nothing matches.\n */\nexport function routeSpanToProject(\n  serviceName: string | undefined,\n  projects: ReadonlyArray<RegistryEntry>,\n): string {\n  if (!serviceName) return DEFAULT_PROJECT\n  // Pass 1 — exact match.\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (entry.name === serviceName) return entry.name\n  }\n  // Pass 2 — hyphen/underscore-separated prefix. Longest project name wins\n  // so a registered `brief-api` outranks a registered `brief` when the\n  // span's service.name is `brief-api-staging`.\n  const candidates: RegistryEntry[] = []\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (isTokenPrefix(entry.name, serviceName)) candidates.push(entry)\n  }\n  if (candidates.length > 0) {\n    candidates.sort((a, b) => b.name.length - a.name.length)\n    return candidates[0]!.name\n  }\n  // Pass 3 — containment as a separator-delimited token. Last-resort match\n  // for `api` inside `brief-api-staging` when only `api` is registered.\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (isTokenContained(entry.name, serviceName)) return entry.name\n  }\n  return DEFAULT_PROJECT\n}\n\n// True when `prefix` matches the first hyphen/underscore-separated token(s)\n// of `full`. `brief` matches `brief-api`, `brief_worker`, but not `briefcase`.\nfunction isTokenPrefix(prefix: string, full: string): boolean {\n  if (prefix.length >= full.length) return false\n  if (!full.startsWith(prefix)) return false\n  const sep = full.charAt(prefix.length)\n  return sep === '-' || sep === '_'\n}\n\n// True when `needle` appears in `haystack` bordered by separators on both\n// sides (so it's a complete token, not a substring of a longer word).\nfunction isTokenContained(needle: string, haystack: string): boolean {\n  if (!haystack.includes(needle)) return false\n  const tokens = haystack.split(/[-_]/)\n  return tokens.includes(needle)\n}\n\nasync function bootstrapProject(entry: RegistryEntry): Promise<ProjectSlot> {\n  const paths = pathsForProject(entry.name, path.join(entry.path, 'neat-out'))\n\n  // Path missing on disk → mark broken and surface the reason. Daemon\n  // continues with the rest of the registry.\n  try {\n    const stat = await fs.stat(entry.path)\n    if (!stat.isDirectory()) {\n      throw new Error(`registered path ${entry.path} is not a directory`)\n    }\n  } catch (err) {\n    await setStatus(entry.name, 'broken').catch(() => {})\n    return {\n      entry,\n      // Empty graph is fine — `slots` keeps the entry visible in `status`\n      // output; nothing routes to it because it's not 'active'.\n      graph: getGraph(`__broken__:${entry.name}`),\n      outPath: '',\n      paths,\n      stopPersist: () => {},\n      status: 'broken',\n      errorReason: (err as Error).message,\n    }\n  }\n\n  // Use the project name as the in-memory graph key. Any prior contents\n  // are wiped because the daemon owns the slot for the lifetime of this\n  // bootstrap (ADR-030 — mutation authority).\n  resetGraph(entry.name)\n  const graph = getGraph(entry.name)\n  const outPath = paths.snapshotPath\n\n  await loadGraphFromDisk(graph, outPath)\n  await extractFromDirectory(graph, entry.path)\n  const stopPersist = startPersistLoop(graph, outPath)\n  await touchLastSeen(entry.name).catch(() => {})\n\n  return {\n    entry,\n    graph,\n    outPath,\n    paths,\n    stopPersist,\n    status: 'active',\n  }\n}\n\nfunction resolveRestPort(opts: DaemonOptions): number {\n  if (typeof opts.restPort === 'number') return opts.restPort\n  const env = process.env.PORT\n  if (env && env.length > 0) {\n    const n = Number.parseInt(env, 10)\n    if (Number.isFinite(n)) return n\n  }\n  return 8080\n}\n\nfunction resolveOtlpPort(opts: DaemonOptions): number {\n  if (typeof opts.otlpPort === 'number') return opts.otlpPort\n  const env = process.env.OTEL_PORT\n  if (env && env.length > 0) {\n    const n = Number.parseInt(env, 10)\n    if (Number.isFinite(n)) return n\n  }\n  return 4318\n}\n\nfunction resolveHost(opts: DaemonOptions): string {\n  if (opts.host && opts.host.length > 0) return opts.host\n  const env = process.env.HOST\n  if (env && env.length > 0) return env\n  return '0.0.0.0'\n}\n\nexport async function startDaemon(opts: DaemonOptions = {}): Promise<DaemonHandle> {\n  const home = neatHomeFor(opts)\n  const regPath = registryPath()\n  // Graceful degradation per ADR-049 #6: missing registry refuses to boot\n  // with a clear error rather than silently coming up empty.\n  try {\n    await fs.access(regPath)\n  } catch {\n    throw new Error(\n      `neatd: registry not found at ${regPath}. Run \\`neat init <path>\\` to register a project before starting the daemon.`,\n    )\n  }\n\n  const pidPath = path.join(home, 'neatd.pid')\n  await writeAtomically(pidPath, `${process.pid}\\n`)\n\n  const slots = new Map<string, ProjectSlot>()\n  // Projects registry mirrors slots for the REST listener (ADR-063). buildApi\n  // reads from this; we keep it in sync as slots come and go.\n  const registry = new Projects()\n\n  // Rate-limit the dropped-span warning to one log line per project per\n  // 60 seconds. OTel exporters retry on a tight cadence; without this we\n  // flood the console with the same line per batch when a broken project\n  // is sitting in the registry.\n  const DROP_WARN_INTERVAL_MS = 60_000\n  const lastDropWarnAt = new Map<string, number>()\n  function warnDroppedSpan(project: string, reason: string): void {\n    const now = Date.now()\n    const prev = lastDropWarnAt.get(project) ?? 0\n    if (now - prev < DROP_WARN_INTERVAL_MS) return\n    lastDropWarnAt.set(project, now)\n    console.warn(\n      `[neatd] dropping span for project \"${project}\" — project status: broken (${reason}). Run \\`neatd reload\\` to retry bootstrap.`,\n    )\n  }\n\n  function upsertRegistryFromSlot(slot: ProjectSlot): void {\n    if (slot.status !== 'active') return\n    registry.set(slot.entry.name, {\n      scanPath: slot.entry.path,\n      paths: slot.paths,\n      graph: slot.graph,\n    })\n  }\n\n  // Attempt to bring a broken slot back online. Used both on SIGHUP reload\n  // and inline on ingest when a span arrives for a broken project. Returns\n  // the new slot status so callers can decide whether to deliver the span.\n  async function tryRecoverSlot(entry: RegistryEntry): Promise<ProjectSlot> {\n    try {\n      const fresh = await bootstrapProject(entry)\n      slots.set(entry.name, fresh)\n      upsertRegistryFromSlot(fresh)\n      if (fresh.status === 'active') {\n        await setStatus(entry.name, 'active').catch(() => {})\n        console.log(\n          `neatd: project \"${entry.name}\" recovered from broken — active`,\n        )\n      }\n      return fresh\n    } catch (err) {\n      console.warn(\n        `neatd: project \"${entry.name}\" still broken after recovery attempt — ${(err as Error).message}`,\n      )\n      // Leave the existing broken slot in place; nothing changed.\n      return slots.get(entry.name)!\n    }\n  }\n\n  async function loadAll(): Promise<void> {\n    const projects = await listProjects()\n    const seen = new Set<string>()\n    for (const entry of projects) {\n      seen.add(entry.name)\n      const existing = slots.get(entry.name)\n      if (existing) {\n        // SIGHUP shortcut: re-bootstrap any slot currently in `broken`. The\n        // operator's mental model for `neatd reload` is \"look at the world\n        // again,\" so a broken slot that became reachable between boots gets\n        // a second chance.\n        if (existing.status === 'broken') {\n          await tryRecoverSlot(entry)\n        }\n        continue\n      }\n      try {\n        const slot = await bootstrapProject(entry)\n        slots.set(entry.name, slot)\n        upsertRegistryFromSlot(slot)\n        if (slot.status === 'broken') {\n          console.warn(`neatd: project \"${entry.name}\" broken — ${slot.errorReason}`)\n        } else {\n          console.log(`neatd: project \"${entry.name}\" active (${entry.path})`)\n        }\n      } catch (err) {\n        console.warn(\n          `neatd: project \"${entry.name}\" failed to bootstrap — ${(err as Error).message}`,\n        )\n        await setStatus(entry.name, 'broken').catch(() => {})\n      }\n    }\n    // Drop entries the registry no longer carries.\n    for (const [name, slot] of [...slots.entries()]) {\n      if (seen.has(name)) continue\n      try {\n        slot.stopPersist()\n      } catch {\n        // best-effort\n      }\n      slots.delete(name)\n      console.log(`neatd: project \"${name}\" removed from registry — stopped`)\n    }\n  }\n\n  await loadAll()\n\n  // ADR-063 — bind the REST host and the OTLP HTTP receiver. One listener\n  // each, multi-tenant by project name in the URL (REST) and by service.name\n  // dispatch (OTLP). Failure on either listen aborts startDaemon with a\n  // surfacing error rather than letting the supervisor sit half-up.\n  const bind = opts.bindListeners !== false\n  let restApp: FastifyInstance | null = null\n  let otlpApp:\n    | (FastifyInstance & { flushPending: () => Promise<void> })\n    | null = null\n  let restAddress = ''\n  let otlpAddress = ''\n\n  if (bind) {\n    const host = resolveHost(opts)\n    const restPort = resolveRestPort(opts)\n    const otlpPort = resolveOtlpPort(opts)\n\n    // ADR-073 §3 — fail-loud before binding. Loopback-only without a token is\n    // fine (laptop dev); a public bind without one is not.\n    const auth = readAuthEnv()\n    assertBindAuthority(host, auth.authToken)\n\n    try {\n      restApp = await buildApi({\n        projects: registry,\n        authToken: auth.authToken,\n        trustProxy: auth.trustProxy,\n      })\n      restAddress = await restApp.listen({ port: restPort, host })\n      console.log(`neatd: REST listening on ${restAddress}`)\n    } catch (err) {\n      // Roll back anything we started so far before surfacing the error.\n      for (const slot of slots.values()) {\n        try {\n          slot.stopPersist()\n        } catch {\n          // best-effort\n        }\n      }\n      if (restApp) await restApp.close().catch(() => {})\n      await fs.unlink(pidPath).catch(() => {})\n      throw new Error(\n        `neatd: failed to bind REST on port ${restPort} — ${(err as Error).message}`,\n      )\n    }\n\n    // Resolve a span's target slot — running the broken-state recovery\n    // when the routed slot is currently broken. Returns null when the span\n    // can't be delivered after the recovery attempt; the caller drops with\n    // a rate-limited warning.\n    async function resolveTargetSlot(\n      serviceName: string | undefined,\n    ): Promise<ProjectSlot | null> {\n      const liveEntries = await listProjects().catch(() => [])\n      const target = routeSpanToProject(serviceName, liveEntries)\n      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT)\n      if (!slot) return null\n      if (slot.status === 'broken') {\n        const entry = liveEntries.find((e) => e.name === slot!.entry.name)\n        if (entry) {\n          slot = await tryRecoverSlot(entry)\n        }\n        if (slot.status !== 'active') {\n          warnDroppedSpan(slot.entry.name, slot.errorReason ?? 'unknown')\n          return null\n        }\n      }\n      return slot.status === 'active' ? slot : null\n    }\n\n    try {\n      otlpApp = await buildOtelReceiver({\n        authToken: auth.otelToken,\n        trustProxy: auth.trustProxy,\n        onSpan: async (span) => {\n          // ADR-049 OTel routing — dispatch by service.name. Broken slots\n          // get a single inline recovery attempt before the span is dropped\n          // with a rate-limited log line. Unknown services route to\n          // DEFAULT_PROJECT so the FrontierNode auto-creation flow keeps\n          // working (ADR-033).\n          const slot = await resolveTargetSlot(span.service)\n          if (!slot) return\n          await handleSpan(\n            {\n              graph: slot.graph,\n              errorsPath: slot.paths.errorsPath,\n              project: slot.entry.name,\n              // Receiver already wrote the error event synchronously below.\n              writeErrorEventInline: false,\n            },\n            span,\n          )\n        },\n        onErrorSpanSync: async (span) => {\n          const slot = await resolveTargetSlot(span.service)\n          if (!slot) return\n          await makeErrorSpanWriter(slot.paths.errorsPath)(span)\n        },\n      })\n      otlpAddress = await otlpApp.listen({ port: otlpPort, host })\n      console.log(`neatd: OTLP listening on ${otlpAddress}/v1/traces`)\n    } catch (err) {\n      for (const slot of slots.values()) {\n        try {\n          slot.stopPersist()\n        } catch {\n          // best-effort\n        }\n      }\n      if (restApp) await restApp.close().catch(() => {})\n      if (otlpApp) await otlpApp.close().catch(() => {})\n      await fs.unlink(pidPath).catch(() => {})\n      throw new Error(\n        `neatd: failed to bind OTLP on port ${otlpPort} — ${(err as Error).message}`,\n      )\n    }\n  }\n\n  let reloading: Promise<void> | null = null\n  const reload = async (): Promise<void> => {\n    if (reloading) return reloading\n    reloading = (async () => {\n      try {\n        await loadAll()\n      } finally {\n        reloading = null\n      }\n    })()\n    return reloading\n  }\n\n  // SIGHUP — external \"reload your config\" signal. ADR-049 #2.\n  const sighupHandler = (): void => {\n    void reload().catch((err) => {\n      console.warn(`neatd: SIGHUP reload failed — ${(err as Error).message}`)\n    })\n  }\n  process.on('SIGHUP', sighupHandler)\n\n  let stopped = false\n  const stop = async (): Promise<void> => {\n    if (stopped) return\n    stopped = true\n    process.off('SIGHUP', sighupHandler)\n    if (otlpApp) await otlpApp.close().catch(() => {})\n    if (restApp) await restApp.close().catch(() => {})\n    for (const slot of slots.values()) {\n      try {\n        slot.stopPersist()\n      } catch {\n        // best-effort\n      }\n    }\n    await fs.unlink(pidPath).catch(() => {})\n  }\n\n  return { slots, reload, stop, pidPath, restAddress, otlpAddress }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AAgEjB,SAAS,YAAY,MAA6B;AAChD,MAAI,KAAK,YAAY,KAAK,SAAS,SAAS,EAAG,QAAO,KAAK,QAAQ,KAAK,QAAQ;AAChF,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,EAAG,QAAO,KAAK,QAAQ,GAAG;AAClD,QAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,SAAO,KAAK,KAAK,MAAM,OAAO;AAChC;AAkCO,SAAS,mBACd,aACA,UACQ;AACR,MAAI,CAAC,YAAa,QAAO;AAEzB,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,MAAM,SAAS,YAAa,QAAO,MAAM;AAAA,EAC/C;AAIA,QAAM,aAA8B,CAAC;AACrC,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,cAAc,MAAM,MAAM,WAAW,EAAG,YAAW,KAAK,KAAK;AAAA,EACnE;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,eAAW,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,MAAM;AACvD,WAAO,WAAW,CAAC,EAAG;AAAA,EACxB;AAGA,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,iBAAiB,MAAM,MAAM,WAAW,EAAG,QAAO,MAAM;AAAA,EAC9D;AACA,SAAO;AACT;AAIA,SAAS,cAAc,QAAgB,MAAuB;AAC5D,MAAI,OAAO,UAAU,KAAK,OAAQ,QAAO;AACzC,MAAI,CAAC,KAAK,WAAW,MAAM,EAAG,QAAO;AACrC,QAAM,MAAM,KAAK,OAAO,OAAO,MAAM;AACrC,SAAO,QAAQ,OAAO,QAAQ;AAChC;AAIA,SAAS,iBAAiB,QAAgB,UAA2B;AACnE,MAAI,CAAC,SAAS,SAAS,MAAM,EAAG,QAAO;AACvC,QAAM,SAAS,SAAS,MAAM,MAAM;AACpC,SAAO,OAAO,SAAS,MAAM;AAC/B;AAEA,eAAe,iBAAiB,OAA4C;AAC1E,QAAM,QAAQ,gBAAgB,MAAM,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU,CAAC;AAI3E,MAAI;AACF,UAAM,OAAO,MAAM,GAAG,KAAK,MAAM,IAAI;AACrC,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,YAAM,IAAI,MAAM,mBAAmB,MAAM,IAAI,qBAAqB;AAAA,IACpE;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACpD,WAAO;AAAA,MACL;AAAA;AAAA;AAAA,MAGA,OAAO,SAAS,cAAc,MAAM,IAAI,EAAE;AAAA,MAC1C,SAAS;AAAA,MACT;AAAA,MACA,aAAa,MAAM;AAAA,MAAC;AAAA,MACpB,QAAQ;AAAA,MACR,aAAc,IAAc;AAAA,IAC9B;AAAA,EACF;AAKA,aAAW,MAAM,IAAI;AACrB,QAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,QAAM,UAAU,MAAM;AAEtB,QAAM,kBAAkB,OAAO,OAAO;AACtC,QAAM,qBAAqB,OAAO,MAAM,IAAI;AAC5C,QAAM,cAAc,iBAAiB,OAAO,OAAO;AACnD,QAAM,cAAc,MAAM,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAE9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,gBAAgB,MAA6B;AACpD,MAAI,OAAO,KAAK,aAAa,SAAU,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,GAAG;AACzB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,QAAI,OAAO,SAAS,CAAC,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,MAA6B;AACpD,MAAI,OAAO,KAAK,aAAa,SAAU,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,GAAG;AACzB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,QAAI,OAAO,SAAS,CAAC,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6B;AAChD,MAAI,KAAK,QAAQ,KAAK,KAAK,SAAS,EAAG,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,EAAG,QAAO;AAClC,SAAO;AACT;AAEA,eAAsB,YAAY,OAAsB,CAAC,GAA0B;AACjF,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,UAAU,aAAa;AAG7B,MAAI;AACF,UAAM,GAAG,OAAO,OAAO;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,UAAU,KAAK,KAAK,MAAM,WAAW;AAC3C,QAAM,gBAAgB,SAAS,GAAG,QAAQ,GAAG;AAAA,CAAI;AAEjD,QAAM,QAAQ,oBAAI,IAAyB;AAG3C,QAAM,WAAW,IAAI,SAAS;AAM9B,QAAM,wBAAwB;AAC9B,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,WAAS,gBAAgB,SAAiB,QAAsB;AAC9D,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO,eAAe,IAAI,OAAO,KAAK;AAC5C,QAAI,MAAM,OAAO,sBAAuB;AACxC,mBAAe,IAAI,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,sCAAsC,OAAO,oCAA+B,MAAM;AAAA,IACpF;AAAA,EACF;AAEA,WAAS,uBAAuB,MAAyB;AACvD,QAAI,KAAK,WAAW,SAAU;AAC9B,aAAS,IAAI,KAAK,MAAM,MAAM;AAAA,MAC5B,UAAU,KAAK,MAAM;AAAA,MACrB,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAKA,iBAAe,eAAe,OAA4C;AACxE,QAAI;AACF,YAAM,QAAQ,MAAM,iBAAiB,KAAK;AAC1C,YAAM,IAAI,MAAM,MAAM,KAAK;AAC3B,6BAAuB,KAAK;AAC5B,UAAI,MAAM,WAAW,UAAU;AAC7B,cAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACpD,gBAAQ;AAAA,UACN,mBAAmB,MAAM,IAAI;AAAA,QAC/B;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,mBAAmB,MAAM,IAAI,gDAA4C,IAAc,OAAO;AAAA,MAChG;AAEA,aAAO,MAAM,IAAI,MAAM,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,iBAAe,UAAyB;AACtC,UAAM,WAAW,MAAM,aAAa;AACpC,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,SAAS,UAAU;AAC5B,WAAK,IAAI,MAAM,IAAI;AACnB,YAAM,WAAW,MAAM,IAAI,MAAM,IAAI;AACrC,UAAI,UAAU;AAKZ,YAAI,SAAS,WAAW,UAAU;AAChC,gBAAM,eAAe,KAAK;AAAA,QAC5B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,MAAM,iBAAiB,KAAK;AACzC,cAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,+BAAuB,IAAI;AAC3B,YAAI,KAAK,WAAW,UAAU;AAC5B,kBAAQ,KAAK,mBAAmB,MAAM,IAAI,mBAAc,KAAK,WAAW,EAAE;AAAA,QAC5E,OAAO;AACL,kBAAQ,IAAI,mBAAmB,MAAM,IAAI,aAAa,MAAM,IAAI,GAAG;AAAA,QACrE;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mBAAmB,MAAM,IAAI,gCAA4B,IAAc,OAAO;AAAA,QAChF;AACA,cAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACtD;AAAA,IACF;AAEA,eAAW,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG;AAC/C,UAAI,KAAK,IAAI,IAAI,EAAG;AACpB,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AACA,YAAM,OAAO,IAAI;AACjB,cAAQ,IAAI,mBAAmB,IAAI,wCAAmC;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,QAAQ;AAMd,QAAM,OAAO,KAAK,kBAAkB;AACpC,MAAI,UAAkC;AACtC,MAAI,UAEO;AACX,MAAI,cAAc;AAClB,MAAI,cAAc;AAElB,MAAI,MAAM;AACR,UAAM,OAAO,YAAY,IAAI;AAC7B,UAAM,WAAW,gBAAgB,IAAI;AACrC,UAAM,WAAW,gBAAgB,IAAI;AAIrC,UAAM,OAAO,YAAY;AACzB,wBAAoB,MAAM,KAAK,SAAS;AAExC,QAAI;AACF,gBAAU,MAAM,SAAS;AAAA,QACvB,UAAU;AAAA,QACV,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,MACnB,CAAC;AACD,oBAAc,MAAM,QAAQ,OAAO,EAAE,MAAM,UAAU,KAAK,CAAC;AAC3D,cAAQ,IAAI,4BAA4B,WAAW,EAAE;AAAA,IACvD,SAAS,KAAK;AAEZ,iBAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,YAAI;AACF,eAAK,YAAY;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,YAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACvC,YAAM,IAAI;AAAA,QACR,sCAAsC,QAAQ,WAAO,IAAc,OAAO;AAAA,MAC5E;AAAA,IACF;AAMA,mBAAe,kBACb,aAC6B;AAC7B,YAAM,cAAc,MAAM,aAAa,EAAE,MAAM,MAAM,CAAC,CAAC;AACvD,YAAM,SAAS,mBAAmB,aAAa,WAAW;AAC1D,UAAI,OAAO,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,eAAe;AACzD,UAAI,CAAC,KAAM,QAAO;AAClB,UAAI,KAAK,WAAW,UAAU;AAC5B,cAAM,QAAQ,YAAY,KAAK,CAAC,MAAM,EAAE,SAAS,KAAM,MAAM,IAAI;AACjE,YAAI,OAAO;AACT,iBAAO,MAAM,eAAe,KAAK;AAAA,QACnC;AACA,YAAI,KAAK,WAAW,UAAU;AAC5B,0BAAgB,KAAK,MAAM,MAAM,KAAK,eAAe,SAAS;AAC9D,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,WAAW,WAAW,OAAO;AAAA,IAC3C;AAEA,QAAI;AACF,gBAAU,MAAM,kBAAkB;AAAA,QAChC,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,QACjB,QAAQ,OAAO,SAAS;AAMtB,gBAAM,OAAO,MAAM,kBAAkB,KAAK,OAAO;AACjD,cAAI,CAAC,KAAM;AACX,gBAAM;AAAA,YACJ;AAAA,cACE,OAAO,KAAK;AAAA,cACZ,YAAY,KAAK,MAAM;AAAA,cACvB,SAAS,KAAK,MAAM;AAAA;AAAA,cAEpB,uBAAuB;AAAA,YACzB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,iBAAiB,OAAO,SAAS;AAC/B,gBAAM,OAAO,MAAM,kBAAkB,KAAK,OAAO;AACjD,cAAI,CAAC,KAAM;AACX,gBAAM,oBAAoB,KAAK,MAAM,UAAU,EAAE,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AACD,oBAAc,MAAM,QAAQ,OAAO,EAAE,MAAM,UAAU,KAAK,CAAC;AAC3D,cAAQ,IAAI,4BAA4B,WAAW,YAAY;AAAA,IACjE,SAAS,KAAK;AACZ,iBAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,YAAI;AACF,eAAK,YAAY;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,YAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACvC,YAAM,IAAI;AAAA,QACR,sCAAsC,QAAQ,WAAO,IAAc,OAAO;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAkC;AACtC,QAAM,SAAS,YAA2B;AACxC,QAAI,UAAW,QAAO;AACtB,iBAAa,YAAY;AACvB,UAAI;AACF,cAAM,QAAQ;AAAA,MAChB,UAAE;AACA,oBAAY;AAAA,MACd;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,MAAY;AAChC,SAAK,OAAO,EAAE,MAAM,CAAC,QAAQ;AAC3B,cAAQ,KAAK,sCAAkC,IAAc,OAAO,EAAE;AAAA,IACxE,CAAC;AAAA,EACH;AACA,UAAQ,GAAG,UAAU,aAAa;AAElC,MAAI,UAAU;AACd,QAAM,OAAO,YAA2B;AACtC,QAAI,QAAS;AACb,cAAU;AACV,YAAQ,IAAI,UAAU,aAAa;AACnC,QAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,QAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,eAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACzC;AAEA,SAAO,EAAE,OAAO,QAAQ,MAAM,SAAS,aAAa,YAAY;AAClE;","names":[]}
+{"version":3,"sources":["../src/daemon.ts"],"sourcesContent":["/**\n * Multi-project daemon (ADR-049).\n *\n * Single long-lived process watching every project in the machine-level registry.\n * Per-project graph isolation: each registered project owns its own\n * `MultiDirectedGraph` slot keyed by name (ADR-026), and a failure during\n * one project's bootstrap is logged + marked `broken` without taking down\n * the rest of the daemon.\n *\n * MVP scope (v0.2.5):\n *  - Read registry; refuse to boot when it's missing.\n *  - Write PID at `~/.neat/neatd.pid` for external supervisors.\n *  - Per project: load any existing snapshot, run initial extraction,\n *    start a per-project persist loop.\n *  - SIGHUP triggers a reload — re-reads the registry, picks up new\n *    projects, drops removed ones, leaves untouched ones in place.\n *  - Provide `routeSpanToProject(serviceName, projects)` for OTel ingest\n *    to dispatch by `service.name` across registered projects, falling\n *    back to `default` for unknown services per ADR-033.\n *\n * Out of MVP scope (deferred):\n *  - Live OTel listener wiring per project — daemon exposes the routing\n *    primitive; the actual receiver attachment lands alongside v0.2.6.\n *  - Policy reload on `policy.json` mtime — `startWatch` already does this\n *    per-project; the daemon-level loop reuses that machinery in a follow-up.\n *  - Auto-restart on crash. PID file is the supervisor handoff.\n */\n\nimport { promises as fs } from 'node:fs'\nimport path from 'node:path'\nimport type { FastifyInstance } from 'fastify'\nimport { DEFAULT_PROJECT, getGraph, resetGraph, type NeatGraph } from './graph.js'\nimport { extractFromDirectory } from './extract.js'\nimport { loadGraphFromDisk, startPersistLoop } from './persist.js'\nimport { Projects, pathsForProject, type ProjectPaths } from './projects.js'\nimport { buildApi } from './api.js'\nimport { buildOtelReceiver } from './otel.js'\nimport { handleSpan, makeErrorSpanWriter } from './ingest.js'\nimport {\n  listProjects,\n  registryPath,\n  setStatus,\n  touchLastSeen,\n  writeAtomically,\n} from './registry.js'\nimport { assertBindAuthority, readAuthEnv } from './auth.js'\nimport type { RegistryEntry } from '@neat.is/types'\n\nexport interface DaemonOptions {\n  // Defaults to `~/.neat/`. Honors NEAT_HOME the same way registry.ts does.\n  // Tests override via NEAT_HOME and don't pass this directly.\n  neatHome?: string\n  // ADR-063 — bind targets. Defaults to PORT (8080) / OTEL_PORT (4318) env\n  // vars, matching server.ts. Tests pass 0 to get ephemeral ports.\n  restPort?: number\n  otlpPort?: number\n  // ADR-063 — bind host. Defaults to HOST env (0.0.0.0).\n  host?: string\n  // ADR-063 — opt out of binding entirely (e.g. integration tests that\n  // exercise daemon slots without needing the listeners). Production\n  // `neatd start` never sets this.\n  bindListeners?: boolean\n}\n\nexport interface ProjectSlot {\n  entry: RegistryEntry\n  graph: NeatGraph\n  outPath: string\n  paths: ProjectPaths\n  stopPersist: () => void\n  status: 'active' | 'broken'\n  errorReason?: string\n}\n\nexport interface DaemonHandle {\n  // The slots currently being managed, keyed by project name. Tests inspect\n  // this to assert isolation properties.\n  slots: Map<string, ProjectSlot>\n  // Re-read the registry. New entries get bootstrapped, removed ones get\n  // their persist loops stopped, existing ones stay running.\n  reload: () => Promise<void>\n  // Graceful shutdown — stop every project's persist loop and remove the\n  // PID file.\n  stop: () => Promise<void>\n  // Path to the PID file the daemon owns. Useful for test assertions.\n  pidPath: string\n  // ADR-063 — addresses where consumers reach the daemon. Empty string when\n  // bindListeners is false. REST is the Fastify app's listening address;\n  // OTLP is the receiver's.\n  restAddress: string\n  otlpAddress: string\n}\n\nfunction neatHomeFor(opts: DaemonOptions): string {\n  if (opts.neatHome && opts.neatHome.length > 0) return path.resolve(opts.neatHome)\n  const env = process.env.NEAT_HOME\n  if (env && env.length > 0) return path.resolve(env)\n  const home = process.env.HOME ?? process.env.USERPROFILE ?? ''\n  return path.join(home, '.neat')\n}\n\n/**\n * Resolve which project's graph an OTel span belongs to. Looks up the\n * `service.name` against the registry and returns the matching project's\n * name, or `DEFAULT_PROJECT` for unknown services so the FrontierNode\n * auto-creation flow keeps working per ADR-033.\n *\n * Pure function. Daemon callers pass a snapshot of the registry to avoid\n * per-span fs reads.\n *\n * Matching order (ADR-072 — real-world `service.name` rarely equals project\n * name; monorepos publish per-package names like `brief-api` under a\n * project named `brief`):\n *\n *   1. Exact: `entry.name === serviceName`.\n *   2. Hyphen/underscore-separated prefix: `entry.name` is a leading token\n *      of `serviceName` (`brief` matches `brief-api`, `brief_worker`).\n *      Longest-match wins so `brief-api` beats `brief` when both are\n *      registered.\n *   3. Containment as a separator-delimited token (`api` inside\n *      `brief-api-staging`).\n *\n * Routing eligibility (ADR-071):\n * - `active` matches at every pass (the steady-state path).\n * - `broken` also matches — the daemon needs the span to reach the broken\n *   slot so the ingest-time auto-recover path can attempt a bootstrap and\n *   lift the project back to `active`. The router only chooses the target;\n *   whether the span actually lands is the ingest handler's decision.\n * - `paused` is intentionally not routed; the operator paused it on\n *   purpose, so the span falls through to the default-project flow.\n *\n * Falls back to `DEFAULT_PROJECT` when nothing matches.\n */\nexport function routeSpanToProject(\n  serviceName: string | undefined,\n  projects: ReadonlyArray<RegistryEntry>,\n): string {\n  if (!serviceName) return DEFAULT_PROJECT\n  // Pass 1 — exact match.\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (entry.name === serviceName) return entry.name\n  }\n  // Pass 2 — hyphen/underscore-separated prefix. Longest project name wins\n  // so a registered `brief-api` outranks a registered `brief` when the\n  // span's service.name is `brief-api-staging`.\n  const candidates: RegistryEntry[] = []\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (isTokenPrefix(entry.name, serviceName)) candidates.push(entry)\n  }\n  if (candidates.length > 0) {\n    candidates.sort((a, b) => b.name.length - a.name.length)\n    return candidates[0]!.name\n  }\n  // Pass 3 — containment as a separator-delimited token. Last-resort match\n  // for `api` inside `brief-api-staging` when only `api` is registered.\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (isTokenContained(entry.name, serviceName)) return entry.name\n  }\n  return DEFAULT_PROJECT\n}\n\n// True when `prefix` matches the first hyphen/underscore-separated token(s)\n// of `full`. `brief` matches `brief-api`, `brief_worker`, but not `briefcase`.\nfunction isTokenPrefix(prefix: string, full: string): boolean {\n  if (prefix.length >= full.length) return false\n  if (!full.startsWith(prefix)) return false\n  const sep = full.charAt(prefix.length)\n  return sep === '-' || sep === '_'\n}\n\n// True when `needle` appears in `haystack` bordered by separators on both\n// sides (so it's a complete token, not a substring of a longer word).\nfunction isTokenContained(needle: string, haystack: string): boolean {\n  if (!haystack.includes(needle)) return false\n  const tokens = haystack.split(/[-_]/)\n  return tokens.includes(needle)\n}\n\nasync function bootstrapProject(entry: RegistryEntry): Promise<ProjectSlot> {\n  const paths = pathsForProject(entry.name, path.join(entry.path, 'neat-out'))\n\n  // Path missing on disk → mark broken and surface the reason. Daemon\n  // continues with the rest of the registry.\n  try {\n    const stat = await fs.stat(entry.path)\n    if (!stat.isDirectory()) {\n      throw new Error(`registered path ${entry.path} is not a directory`)\n    }\n  } catch (err) {\n    await setStatus(entry.name, 'broken').catch(() => {})\n    return {\n      entry,\n      // Empty graph is fine — `slots` keeps the entry visible in `status`\n      // output; nothing routes to it because it's not 'active'.\n      graph: getGraph(`__broken__:${entry.name}`),\n      outPath: '',\n      paths,\n      stopPersist: () => {},\n      status: 'broken',\n      errorReason: (err as Error).message,\n    }\n  }\n\n  // Use the project name as the in-memory graph key. Any prior contents\n  // are wiped because the daemon owns the slot for the lifetime of this\n  // bootstrap (ADR-030 — mutation authority).\n  resetGraph(entry.name)\n  const graph = getGraph(entry.name)\n  const outPath = paths.snapshotPath\n\n  await loadGraphFromDisk(graph, outPath)\n  await extractFromDirectory(graph, entry.path)\n  const stopPersist = startPersistLoop(graph, outPath)\n  await touchLastSeen(entry.name).catch(() => {})\n\n  return {\n    entry,\n    graph,\n    outPath,\n    paths,\n    stopPersist,\n    status: 'active',\n  }\n}\n\nfunction resolveRestPort(opts: DaemonOptions): number {\n  if (typeof opts.restPort === 'number') return opts.restPort\n  const env = process.env.PORT\n  if (env && env.length > 0) {\n    const n = Number.parseInt(env, 10)\n    if (Number.isFinite(n)) return n\n  }\n  return 8080\n}\n\nfunction resolveOtlpPort(opts: DaemonOptions): number {\n  if (typeof opts.otlpPort === 'number') return opts.otlpPort\n  const env = process.env.OTEL_PORT\n  if (env && env.length > 0) {\n    const n = Number.parseInt(env, 10)\n    if (Number.isFinite(n)) return n\n  }\n  return 4318\n}\n\nfunction resolveHost(opts: DaemonOptions): string {\n  if (opts.host && opts.host.length > 0) return opts.host\n  const env = process.env.HOST\n  if (env && env.length > 0) return env\n  return '0.0.0.0'\n}\n\nexport async function startDaemon(opts: DaemonOptions = {}): Promise<DaemonHandle> {\n  const home = neatHomeFor(opts)\n  const regPath = registryPath()\n  // Graceful degradation per ADR-049 #6: missing registry refuses to boot\n  // with a clear error rather than silently coming up empty.\n  try {\n    await fs.access(regPath)\n  } catch {\n    throw new Error(\n      `neatd: registry not found at ${regPath}. Run \\`neat init <path>\\` to register a project before starting the daemon.`,\n    )\n  }\n\n  const pidPath = path.join(home, 'neatd.pid')\n  await writeAtomically(pidPath, `${process.pid}\\n`)\n\n  const slots = new Map<string, ProjectSlot>()\n  // Projects registry mirrors slots for the REST listener (ADR-063). buildApi\n  // reads from this; we keep it in sync as slots come and go.\n  const registry = new Projects()\n\n  // Rate-limit the dropped-span warning to one log line per project per\n  // 60 seconds. OTel exporters retry on a tight cadence; without this we\n  // flood the console with the same line per batch when a broken project\n  // is sitting in the registry.\n  const DROP_WARN_INTERVAL_MS = 60_000\n  const lastDropWarnAt = new Map<string, number>()\n  function warnDroppedSpan(project: string, reason: string): void {\n    const now = Date.now()\n    const prev = lastDropWarnAt.get(project) ?? 0\n    if (now - prev < DROP_WARN_INTERVAL_MS) return\n    lastDropWarnAt.set(project, now)\n    console.warn(\n      `[neatd] dropping span for project \"${project}\" — project status: broken (${reason}). Run \\`neatd reload\\` to retry bootstrap.`,\n    )\n  }\n\n  function upsertRegistryFromSlot(slot: ProjectSlot): void {\n    if (slot.status !== 'active') return\n    registry.set(slot.entry.name, {\n      scanPath: slot.entry.path,\n      paths: slot.paths,\n      graph: slot.graph,\n    })\n  }\n\n  // Attempt to bring a broken slot back online. Used both on SIGHUP reload\n  // and inline on ingest when a span arrives for a broken project. Returns\n  // the new slot status so callers can decide whether to deliver the span.\n  async function tryRecoverSlot(entry: RegistryEntry): Promise<ProjectSlot> {\n    try {\n      const fresh = await bootstrapProject(entry)\n      slots.set(entry.name, fresh)\n      upsertRegistryFromSlot(fresh)\n      if (fresh.status === 'active') {\n        await setStatus(entry.name, 'active').catch(() => {})\n        console.log(\n          `neatd: project \"${entry.name}\" recovered from broken — active`,\n        )\n      }\n      return fresh\n    } catch (err) {\n      console.warn(\n        `neatd: project \"${entry.name}\" still broken after recovery attempt — ${(err as Error).message}`,\n      )\n      // Leave the existing broken slot in place; nothing changed.\n      return slots.get(entry.name)!\n    }\n  }\n\n  async function loadAll(): Promise<void> {\n    const projects = await listProjects()\n    const seen = new Set<string>()\n    for (const entry of projects) {\n      seen.add(entry.name)\n      const existing = slots.get(entry.name)\n      if (existing) {\n        // SIGHUP shortcut: re-bootstrap any slot currently in `broken`. The\n        // operator's mental model for `neatd reload` is \"look at the world\n        // again,\" so a broken slot that became reachable between boots gets\n        // a second chance.\n        if (existing.status === 'broken') {\n          await tryRecoverSlot(entry)\n        }\n        continue\n      }\n      try {\n        const slot = await bootstrapProject(entry)\n        slots.set(entry.name, slot)\n        upsertRegistryFromSlot(slot)\n        if (slot.status === 'broken') {\n          console.warn(`neatd: project \"${entry.name}\" broken — ${slot.errorReason}`)\n        } else {\n          console.log(`neatd: project \"${entry.name}\" active (${entry.path})`)\n        }\n      } catch (err) {\n        console.warn(\n          `neatd: project \"${entry.name}\" failed to bootstrap — ${(err as Error).message}`,\n        )\n        await setStatus(entry.name, 'broken').catch(() => {})\n      }\n    }\n    // Drop entries the registry no longer carries.\n    for (const [name, slot] of [...slots.entries()]) {\n      if (seen.has(name)) continue\n      try {\n        slot.stopPersist()\n      } catch {\n        // best-effort\n      }\n      slots.delete(name)\n      console.log(`neatd: project \"${name}\" removed from registry — stopped`)\n    }\n  }\n\n  await loadAll()\n\n  // ADR-063 — bind the REST host and the OTLP HTTP receiver. One listener\n  // each, multi-tenant by project name in the URL (REST) and by service.name\n  // dispatch (OTLP). Failure on either listen aborts startDaemon with a\n  // surfacing error rather than letting the supervisor sit half-up.\n  const bind = opts.bindListeners !== false\n  let restApp: FastifyInstance | null = null\n  let otlpApp:\n    | (FastifyInstance & { flushPending: () => Promise<void> })\n    | null = null\n  let restAddress = ''\n  let otlpAddress = ''\n\n  if (bind) {\n    const host = resolveHost(opts)\n    const restPort = resolveRestPort(opts)\n    const otlpPort = resolveOtlpPort(opts)\n\n    // ADR-073 §3 — fail-loud before binding. Loopback-only without a token is\n    // fine (laptop dev); a public bind without one is not.\n    const auth = readAuthEnv()\n    assertBindAuthority(host, auth.authToken)\n\n    try {\n      restApp = await buildApi({\n        projects: registry,\n        authToken: auth.authToken,\n        trustProxy: auth.trustProxy,\n        publicRead: auth.publicRead,\n      })\n      restAddress = await restApp.listen({ port: restPort, host })\n      console.log(`neatd: REST listening on ${restAddress}`)\n    } catch (err) {\n      // Roll back anything we started so far before surfacing the error.\n      for (const slot of slots.values()) {\n        try {\n          slot.stopPersist()\n        } catch {\n          // best-effort\n        }\n      }\n      if (restApp) await restApp.close().catch(() => {})\n      await fs.unlink(pidPath).catch(() => {})\n      throw new Error(\n        `neatd: failed to bind REST on port ${restPort} — ${(err as Error).message}`,\n      )\n    }\n\n    // Resolve a span's target slot — running the broken-state recovery\n    // when the routed slot is currently broken. Returns null when the span\n    // can't be delivered after the recovery attempt; the caller drops with\n    // a rate-limited warning.\n    async function resolveTargetSlot(\n      serviceName: string | undefined,\n    ): Promise<ProjectSlot | null> {\n      const liveEntries = await listProjects().catch(() => [])\n      const target = routeSpanToProject(serviceName, liveEntries)\n      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT)\n      if (!slot) return null\n      if (slot.status === 'broken') {\n        const entry = liveEntries.find((e) => e.name === slot!.entry.name)\n        if (entry) {\n          slot = await tryRecoverSlot(entry)\n        }\n        if (slot.status !== 'active') {\n          warnDroppedSpan(slot.entry.name, slot.errorReason ?? 'unknown')\n          return null\n        }\n      }\n      return slot.status === 'active' ? slot : null\n    }\n\n    try {\n      otlpApp = await buildOtelReceiver({\n        authToken: auth.otelToken,\n        trustProxy: auth.trustProxy,\n        onSpan: async (span) => {\n          // ADR-049 OTel routing — dispatch by service.name. Broken slots\n          // get a single inline recovery attempt before the span is dropped\n          // with a rate-limited log line. Unknown services route to\n          // DEFAULT_PROJECT so the FrontierNode auto-creation flow keeps\n          // working (ADR-033).\n          const slot = await resolveTargetSlot(span.service)\n          if (!slot) return\n          await handleSpan(\n            {\n              graph: slot.graph,\n              errorsPath: slot.paths.errorsPath,\n              project: slot.entry.name,\n              // Receiver already wrote the error event synchronously below.\n              writeErrorEventInline: false,\n            },\n            span,\n          )\n        },\n        onErrorSpanSync: async (span) => {\n          const slot = await resolveTargetSlot(span.service)\n          if (!slot) return\n          await makeErrorSpanWriter(slot.paths.errorsPath)(span)\n        },\n      })\n      otlpAddress = await otlpApp.listen({ port: otlpPort, host })\n      console.log(`neatd: OTLP listening on ${otlpAddress}/v1/traces`)\n    } catch (err) {\n      for (const slot of slots.values()) {\n        try {\n          slot.stopPersist()\n        } catch {\n          // best-effort\n        }\n      }\n      if (restApp) await restApp.close().catch(() => {})\n      if (otlpApp) await otlpApp.close().catch(() => {})\n      await fs.unlink(pidPath).catch(() => {})\n      throw new Error(\n        `neatd: failed to bind OTLP on port ${otlpPort} — ${(err as Error).message}`,\n      )\n    }\n  }\n\n  let reloading: Promise<void> | null = null\n  const reload = async (): Promise<void> => {\n    if (reloading) return reloading\n    reloading = (async () => {\n      try {\n        await loadAll()\n      } finally {\n        reloading = null\n      }\n    })()\n    return reloading\n  }\n\n  // SIGHUP — external \"reload your config\" signal. ADR-049 #2.\n  const sighupHandler = (): void => {\n    void reload().catch((err) => {\n      console.warn(`neatd: SIGHUP reload failed — ${(err as Error).message}`)\n    })\n  }\n  process.on('SIGHUP', sighupHandler)\n\n  let stopped = false\n  const stop = async (): Promise<void> => {\n    if (stopped) return\n    stopped = true\n    process.off('SIGHUP', sighupHandler)\n    if (otlpApp) await otlpApp.close().catch(() => {})\n    if (restApp) await restApp.close().catch(() => {})\n    for (const slot of slots.values()) {\n      try {\n        slot.stopPersist()\n      } catch {\n        // best-effort\n      }\n    }\n    await fs.unlink(pidPath).catch(() => {})\n  }\n\n  return { slots, reload, stop, pidPath, restAddress, otlpAddress }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AAgEjB,SAAS,YAAY,MAA6B;AAChD,MAAI,KAAK,YAAY,KAAK,SAAS,SAAS,EAAG,QAAO,KAAK,QAAQ,KAAK,QAAQ;AAChF,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,EAAG,QAAO,KAAK,QAAQ,GAAG;AAClD,QAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,SAAO,KAAK,KAAK,MAAM,OAAO;AAChC;AAkCO,SAAS,mBACd,aACA,UACQ;AACR,MAAI,CAAC,YAAa,QAAO;AAEzB,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,MAAM,SAAS,YAAa,QAAO,MAAM;AAAA,EAC/C;AAIA,QAAM,aAA8B,CAAC;AACrC,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,cAAc,MAAM,MAAM,WAAW,EAAG,YAAW,KAAK,KAAK;AAAA,EACnE;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,eAAW,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,MAAM;AACvD,WAAO,WAAW,CAAC,EAAG;AAAA,EACxB;AAGA,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,iBAAiB,MAAM,MAAM,WAAW,EAAG,QAAO,MAAM;AAAA,EAC9D;AACA,SAAO;AACT;AAIA,SAAS,cAAc,QAAgB,MAAuB;AAC5D,MAAI,OAAO,UAAU,KAAK,OAAQ,QAAO;AACzC,MAAI,CAAC,KAAK,WAAW,MAAM,EAAG,QAAO;AACrC,QAAM,MAAM,KAAK,OAAO,OAAO,MAAM;AACrC,SAAO,QAAQ,OAAO,QAAQ;AAChC;AAIA,SAAS,iBAAiB,QAAgB,UAA2B;AACnE,MAAI,CAAC,SAAS,SAAS,MAAM,EAAG,QAAO;AACvC,QAAM,SAAS,SAAS,MAAM,MAAM;AACpC,SAAO,OAAO,SAAS,MAAM;AAC/B;AAEA,eAAe,iBAAiB,OAA4C;AAC1E,QAAM,QAAQ,gBAAgB,MAAM,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU,CAAC;AAI3E,MAAI;AACF,UAAM,OAAO,MAAM,GAAG,KAAK,MAAM,IAAI;AACrC,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,YAAM,IAAI,MAAM,mBAAmB,MAAM,IAAI,qBAAqB;AAAA,IACpE;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACpD,WAAO;AAAA,MACL;AAAA;AAAA;AAAA,MAGA,OAAO,SAAS,cAAc,MAAM,IAAI,EAAE;AAAA,MAC1C,SAAS;AAAA,MACT;AAAA,MACA,aAAa,MAAM;AAAA,MAAC;AAAA,MACpB,QAAQ;AAAA,MACR,aAAc,IAAc;AAAA,IAC9B;AAAA,EACF;AAKA,aAAW,MAAM,IAAI;AACrB,QAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,QAAM,UAAU,MAAM;AAEtB,QAAM,kBAAkB,OAAO,OAAO;AACtC,QAAM,qBAAqB,OAAO,MAAM,IAAI;AAC5C,QAAM,cAAc,iBAAiB,OAAO,OAAO;AACnD,QAAM,cAAc,MAAM,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAE9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,gBAAgB,MAA6B;AACpD,MAAI,OAAO,KAAK,aAAa,SAAU,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,GAAG;AACzB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,QAAI,OAAO,SAAS,CAAC,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,MAA6B;AACpD,MAAI,OAAO,KAAK,aAAa,SAAU,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,GAAG;AACzB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,QAAI,OAAO,SAAS,CAAC,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6B;AAChD,MAAI,KAAK,QAAQ,KAAK,KAAK,SAAS,EAAG,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,EAAG,QAAO;AAClC,SAAO;AACT;AAEA,eAAsB,YAAY,OAAsB,CAAC,GAA0B;AACjF,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,UAAU,aAAa;AAG7B,MAAI;AACF,UAAM,GAAG,OAAO,OAAO;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,UAAU,KAAK,KAAK,MAAM,WAAW;AAC3C,QAAM,gBAAgB,SAAS,GAAG,QAAQ,GAAG;AAAA,CAAI;AAEjD,QAAM,QAAQ,oBAAI,IAAyB;AAG3C,QAAM,WAAW,IAAI,SAAS;AAM9B,QAAM,wBAAwB;AAC9B,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,WAAS,gBAAgB,SAAiB,QAAsB;AAC9D,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO,eAAe,IAAI,OAAO,KAAK;AAC5C,QAAI,MAAM,OAAO,sBAAuB;AACxC,mBAAe,IAAI,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,sCAAsC,OAAO,oCAA+B,MAAM;AAAA,IACpF;AAAA,EACF;AAEA,WAAS,uBAAuB,MAAyB;AACvD,QAAI,KAAK,WAAW,SAAU;AAC9B,aAAS,IAAI,KAAK,MAAM,MAAM;AAAA,MAC5B,UAAU,KAAK,MAAM;AAAA,MACrB,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAKA,iBAAe,eAAe,OAA4C;AACxE,QAAI;AACF,YAAM,QAAQ,MAAM,iBAAiB,KAAK;AAC1C,YAAM,IAAI,MAAM,MAAM,KAAK;AAC3B,6BAAuB,KAAK;AAC5B,UAAI,MAAM,WAAW,UAAU;AAC7B,cAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACpD,gBAAQ;AAAA,UACN,mBAAmB,MAAM,IAAI;AAAA,QAC/B;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,mBAAmB,MAAM,IAAI,gDAA4C,IAAc,OAAO;AAAA,MAChG;AAEA,aAAO,MAAM,IAAI,MAAM,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,iBAAe,UAAyB;AACtC,UAAM,WAAW,MAAM,aAAa;AACpC,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,SAAS,UAAU;AAC5B,WAAK,IAAI,MAAM,IAAI;AACnB,YAAM,WAAW,MAAM,IAAI,MAAM,IAAI;AACrC,UAAI,UAAU;AAKZ,YAAI,SAAS,WAAW,UAAU;AAChC,gBAAM,eAAe,KAAK;AAAA,QAC5B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,MAAM,iBAAiB,KAAK;AACzC,cAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,+BAAuB,IAAI;AAC3B,YAAI,KAAK,WAAW,UAAU;AAC5B,kBAAQ,KAAK,mBAAmB,MAAM,IAAI,mBAAc,KAAK,WAAW,EAAE;AAAA,QAC5E,OAAO;AACL,kBAAQ,IAAI,mBAAmB,MAAM,IAAI,aAAa,MAAM,IAAI,GAAG;AAAA,QACrE;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mBAAmB,MAAM,IAAI,gCAA4B,IAAc,OAAO;AAAA,QAChF;AACA,cAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACtD;AAAA,IACF;AAEA,eAAW,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG;AAC/C,UAAI,KAAK,IAAI,IAAI,EAAG;AACpB,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AACA,YAAM,OAAO,IAAI;AACjB,cAAQ,IAAI,mBAAmB,IAAI,wCAAmC;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,QAAQ;AAMd,QAAM,OAAO,KAAK,kBAAkB;AACpC,MAAI,UAAkC;AACtC,MAAI,UAEO;AACX,MAAI,cAAc;AAClB,MAAI,cAAc;AAElB,MAAI,MAAM;AACR,UAAM,OAAO,YAAY,IAAI;AAC7B,UAAM,WAAW,gBAAgB,IAAI;AACrC,UAAM,WAAW,gBAAgB,IAAI;AAIrC,UAAM,OAAO,YAAY;AACzB,wBAAoB,MAAM,KAAK,SAAS;AAExC,QAAI;AACF,gBAAU,MAAM,SAAS;AAAA,QACvB,UAAU;AAAA,QACV,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,QACjB,YAAY,KAAK;AAAA,MACnB,CAAC;AACD,oBAAc,MAAM,QAAQ,OAAO,EAAE,MAAM,UAAU,KAAK,CAAC;AAC3D,cAAQ,IAAI,4BAA4B,WAAW,EAAE;AAAA,IACvD,SAAS,KAAK;AAEZ,iBAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,YAAI;AACF,eAAK,YAAY;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,YAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACvC,YAAM,IAAI;AAAA,QACR,sCAAsC,QAAQ,WAAO,IAAc,OAAO;AAAA,MAC5E;AAAA,IACF;AAMA,mBAAe,kBACb,aAC6B;AAC7B,YAAM,cAAc,MAAM,aAAa,EAAE,MAAM,MAAM,CAAC,CAAC;AACvD,YAAM,SAAS,mBAAmB,aAAa,WAAW;AAC1D,UAAI,OAAO,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,eAAe;AACzD,UAAI,CAAC,KAAM,QAAO;AAClB,UAAI,KAAK,WAAW,UAAU;AAC5B,cAAM,QAAQ,YAAY,KAAK,CAAC,MAAM,EAAE,SAAS,KAAM,MAAM,IAAI;AACjE,YAAI,OAAO;AACT,iBAAO,MAAM,eAAe,KAAK;AAAA,QACnC;AACA,YAAI,KAAK,WAAW,UAAU;AAC5B,0BAAgB,KAAK,MAAM,MAAM,KAAK,eAAe,SAAS;AAC9D,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,WAAW,WAAW,OAAO;AAAA,IAC3C;AAEA,QAAI;AACF,gBAAU,MAAM,kBAAkB;AAAA,QAChC,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,QACjB,QAAQ,OAAO,SAAS;AAMtB,gBAAM,OAAO,MAAM,kBAAkB,KAAK,OAAO;AACjD,cAAI,CAAC,KAAM;AACX,gBAAM;AAAA,YACJ;AAAA,cACE,OAAO,KAAK;AAAA,cACZ,YAAY,KAAK,MAAM;AAAA,cACvB,SAAS,KAAK,MAAM;AAAA;AAAA,cAEpB,uBAAuB;AAAA,YACzB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,iBAAiB,OAAO,SAAS;AAC/B,gBAAM,OAAO,MAAM,kBAAkB,KAAK,OAAO;AACjD,cAAI,CAAC,KAAM;AACX,gBAAM,oBAAoB,KAAK,MAAM,UAAU,EAAE,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AACD,oBAAc,MAAM,QAAQ,OAAO,EAAE,MAAM,UAAU,KAAK,CAAC;AAC3D,cAAQ,IAAI,4BAA4B,WAAW,YAAY;AAAA,IACjE,SAAS,KAAK;AACZ,iBAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,YAAI;AACF,eAAK,YAAY;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,YAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACvC,YAAM,IAAI;AAAA,QACR,sCAAsC,QAAQ,WAAO,IAAc,OAAO;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAkC;AACtC,QAAM,SAAS,YAA2B;AACxC,QAAI,UAAW,QAAO;AACtB,iBAAa,YAAY;AACvB,UAAI;AACF,cAAM,QAAQ;AAAA,MAChB,UAAE;AACA,oBAAY;AAAA,MACd;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,MAAY;AAChC,SAAK,OAAO,EAAE,MAAM,CAAC,QAAQ;AAC3B,cAAQ,KAAK,sCAAkC,IAAc,OAAO,EAAE;AAAA,IACxE,CAAC;AAAA,EACH;AACA,UAAQ,GAAG,UAAU,aAAa;AAElC,MAAI,UAAU;AACd,QAAM,OAAO,YAA2B;AACtC,QAAI,QAAS;AACb,cAAU;AACV,YAAQ,IAAI,UAAU,aAAa;AACnC,QAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,QAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,eAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACzC;AAEA,SAAO,EAAE,OAAO,QAAQ,MAAM,SAAS,aAAa,YAAY;AAClE;","names":[]}

package/dist/{chunk-CZ3T6TE2.js → chunk-UPW4CMOH.js}

@@ -1,6 +1,6 @@
 import {
   mountBearerAuth
-} from "./chunk-7TYESDAI.js";
+} from "./chunk-4V23KYOP.js";
 
 // src/graph.ts
 import GraphDefault from "graphology";
@@ -1104,52 +1104,64 @@ function cacheSpanService(span, now) {
   if (!span.traceId || !span.spanId) return;
   const key = parentSpanKey(span.traceId, span.spanId);
   parentSpanCache.delete(key);
-  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  parentSpanCache.set(key, {
+    service: span.service,
+    env: span.env ?? "unknown",
+    expiresAt: now + PARENT_SPAN_CACHE_TTL_MS
+  });
   while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
     const oldest = parentSpanCache.keys().next().value;
     if (!oldest) break;
     parentSpanCache.delete(oldest);
   }
 }
-function lookupParentSpanService(traceId, parentSpanId, now) {
+function lookupParentSpan(traceId, parentSpanId, now) {
   const entry = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
   if (!entry) return null;
   if (entry.expiresAt <= now) {
     parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
     return null;
   }
-  return entry.service;
+  return { service: entry.service, env: entry.env };
 }
-function resolveServiceId(graph, host) {
-  const direct = serviceId(host);
-  if (graph.hasNode(direct)) return direct;
-  let found = null;
+function resolveServiceId(graph, host, env) {
+  const envTagged = serviceId(host, env);
+  if (graph.hasNode(envTagged)) return envTagged;
+  const envLess = serviceId(host);
+  if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
+  let sameEnv = null;
+  let envLessMatch = null;
+  let anyMatch = null;
   graph.forEachNode((id, attrs) => {
-    if (found) return;
+    if (sameEnv) return;
     const a = attrs;
     if (a.type !== NodeType3.ServiceNode) return;
-    if (a.name === host) {
-      found = id;
+    const matchesByName = a.name === host;
+    const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
+    if (!matchesByName && !matchesByAlias) return;
+    const nodeEnv = a.env ?? "unknown";
+    if (nodeEnv === env) {
+      sameEnv = id;
       return;
     }
-    if (a.aliases && a.aliases.includes(host)) {
-      found = id;
-    }
+    if (nodeEnv === "unknown" && !envLessMatch) envLessMatch = id;
+    else if (!anyMatch) anyMatch = id;
   });
-  return found;
+  return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
   return frontierId(host);
 }
-function ensureServiceNode(graph, serviceName) {
-  const id = serviceId(serviceName);
+function ensureServiceNode(graph, serviceName, env) {
+  const id = serviceId(serviceName, env);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
     type: NodeType3.ServiceNode,
     name: serviceName,
     language: "unknown",
-    discoveredVia: "otel"
+    discoveredVia: "otel",
+    ...env !== "unknown" ? { env } : {}
   };
   graph.addNode(id, node);
   return id;
@@ -1295,7 +1307,7 @@ function buildErrorEventForReceiver(span) {
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: serviceId(span.service)
+    affectedNode: serviceId(span.service, span.env)
   };
 }
 function makeErrorSpanWriter(errorsPath) {
@@ -1309,7 +1321,8 @@ function makeErrorSpanWriter(errorsPath) {
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
-  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const env = span.env ?? "unknown";
+  const sourceId = ensureServiceNode(ctx.graph, span.service, env);
   const isError = span.statusCode === 2;
   cacheSpanService(span, nowMs);
   let affectedNode = sourceId;
@@ -1332,7 +1345,7 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
     if (host && host !== span.service) {
-      const targetId = resolveServiceId(ctx.graph, host);
+      const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
@@ -1359,9 +1372,9 @@ async function handleSpan(ctx, span) {
       }
     }
     if (!resolvedViaAddress && span.parentSpanId) {
-      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
-      if (parentService && parentService !== span.service) {
-        const parentId = ensureServiceNode(ctx.graph, parentService);
+      const parent = lookupParentSpan(span.traceId, span.parentSpanId, nowMs);
+      if (parent && parent.service !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         upsertObservedEdge(
           ctx.graph,
           EdgeType2.CALLS,
@@ -1557,6 +1570,28 @@ async function readErrorEvents(errorsPath) {
     throw err;
   }
 }
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of exported.nodes ?? []) {
+    if (graph.hasNode(node.key)) continue;
+    if (!node.attributes) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of exported.edges ?? []) {
+    const attrs = edge.attributes;
+    if (!attrs) continue;
+    const id = edge.key ?? attrs.id;
+    if (!id) continue;
+    if (graph.hasEdge(id)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/errors.ts
 import { promises as fs4 } from "fs";
@@ -1960,6 +1995,18 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   }
   return [...found];
 }
+function detectJsFramework(pkg) {
+  const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  if (deps["next"] !== void 0) return "next";
+  if (deps["remix"] !== void 0) return "remix";
+  for (const k of Object.keys(deps)) {
+    if (k.startsWith("@remix-run/")) return "remix";
+  }
+  if (deps["@sveltejs/kit"] !== void 0) return "sveltekit";
+  if (deps["nuxt"] !== void 0) return "nuxt";
+  if (deps["astro"] !== void 0) return "astro";
+  return void 0;
+}
 async function discoverNodeService(scanPath, dir) {
   const pkgPath = path8.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
@@ -1971,6 +2018,7 @@ async function discoverNodeService(scanPath, dir) {
     return null;
   }
   if (!pkg.name) return null;
+  const framework = detectJsFramework(pkg);
   const node = {
     id: serviceId2(pkg.name),
     type: NodeType4.ServiceNode,
@@ -1979,7 +2027,8 @@ async function discoverNodeService(scanPath, dir) {
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
     repoPath: path8.relative(scanPath, dir),
-    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
+    ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
@@ -4009,7 +4058,7 @@ function computeDivergences(graph, opts = {}) {
 import { promises as fs17 } from "fs";
 import path31 from "path";
 import { Provenance as Provenance10, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -4021,6 +4070,9 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV3ToV4(payload) {
+  return { ...payload, schemaVersion: 4 };
+}
 function migrateV2ToV3(payload) {
   const edges = payload.graph.edges;
   if (Array.isArray(edges)) {
@@ -4069,6 +4121,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 2) {
     payload = migrateV2ToV3(payload);
   }
+  if (payload.schemaVersion === 3) {
+    payload = migrateV3ToV4(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -4743,6 +4798,35 @@ function registerRoutes(scope, ctx) {
       }
     }
   );
+  scope.post("/snapshot", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const body = req.body;
+    if (!body || typeof body !== "object" || !body.snapshot) {
+      return reply.code(400).send({ error: "request body must be { snapshot: <persisted-graph> }" });
+    }
+    const snap = body.snapshot;
+    if (typeof snap.schemaVersion !== "number" || snap.schemaVersion !== SCHEMA_VERSION) {
+      return reply.code(400).send({
+        error: `unsupported snapshot schemaVersion ${snap.schemaVersion} (expected ${SCHEMA_VERSION})`
+      });
+    }
+    try {
+      const result = mergeSnapshot(proj.graph, snap);
+      return {
+        project: proj.name,
+        nodesAdded: result.nodesAdded,
+        edgesAdded: result.edgesAdded,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size
+      };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "snapshot merge failed",
+        details: err.message
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply);
     if (!proj) return;
@@ -4836,7 +4920,15 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = Fastify({ logger: false });
   await app.register(cors, { origin: true });
-  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
+  mountBearerAuth(app, {
+    token: opts.authToken,
+    trustProxy: opts.trustProxy,
+    publicRead: opts.publicRead
+  });
+  app.get("/api/config", async () => ({
+    publicRead: opts.publicRead === true,
+    authProxy: opts.trustProxy === true
+  }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -4958,4 +5050,4 @@ export {
   removeProject,
   buildApi
 };
-//# sourceMappingURL=chunk-CZ3T6TE2.js.map
+//# sourceMappingURL=chunk-UPW4CMOH.js.map