@neat.is/core 0.3.8 → 0.4.0

package/dist/index.d.cts

@@ -116,6 +116,7 @@ interface BuildApiOptions {
     searchIndex?: SearchIndex;
     authToken?: string;
     trustProxy?: boolean;
+    publicRead?: boolean;
 }
 declare function buildApi(opts: BuildApiOptions): Promise<FastifyInstance>;
 
@@ -130,6 +131,7 @@ interface ParsedSpan {
     endTimeUnixNano: string;
     startTimeIso?: string;
     durationNanos: bigint;
+    env: string;
     attributes: Record<string, AttributeValue>;
     dbSystem?: string;
     dbName?: string;

package/dist/index.d.ts

@@ -116,6 +116,7 @@ interface BuildApiOptions {
     searchIndex?: SearchIndex;
     authToken?: string;
     trustProxy?: boolean;
+    publicRead?: boolean;
 }
 declare function buildApi(opts: BuildApiOptions): Promise<FastifyInstance>;
 
@@ -130,6 +131,7 @@ interface ParsedSpan {
     endTimeUnixNano: string;
     startTimeIso?: string;
     durationNanos: bigint;
+    env: string;
     attributes: Record<string, AttributeValue>;
     dbSystem?: string;
     dbName?: string;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-LQ3JFBTX.js";
+} from "./chunk-N6RPINEJ.js";
 import {
   ProjectNameCollisionError,
   addProject,
@@ -37,15 +37,15 @@ import {
   thresholdForEdgeType,
   touchLastSeen,
   writeAtomically
-} from "./chunk-CZ3T6TE2.js";
+} from "./chunk-UPW4CMOH.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-V4TU7OKZ.js";
+} from "./chunk-IXIFJKMM.js";
 import {
   buildOtelReceiver,
   logSpanHandler,
   parseOtlpRequest
-} from "./chunk-7TYESDAI.js";
+} from "./chunk-4V23KYOP.js";
 export {
   ProjectNameCollisionError,
   addProject,

package/dist/neatd.cjs

@@ -55,6 +55,7 @@ function mountBearerAuth(app, opts) {
   if (opts.trustProxy) return;
   const expected = Buffer.from(opts.token, "utf8");
   const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req2, reply, done) => {
     const path39 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
     for (const suffix of suffixes) {
@@ -63,6 +64,10 @@ function mountBearerAuth(app, opts) {
         return;
       }
     }
+    if (publicRead && PUBLIC_READ_METHODS.has(req2.method)) {
+      done();
+      return;
+    }
     const header = req2.headers.authorization;
     if (typeof header !== "string" || !header.startsWith("Bearer ")) {
       void reply.code(401).send({ error: "unauthorized" });
@@ -76,16 +81,21 @@ function mountBearerAuth(app, opts) {
     done();
   });
 }
+function parseBoolEnv(v) {
+  if (!v) return false;
+  return v === "true" || v === "1";
+}
 function readAuthEnv(env = process.env) {
   const t = env.NEAT_AUTH_TOKEN;
   const ot = env.NEAT_OTEL_TOKEN;
   return {
     authToken: t && t.length > 0 ? t : void 0,
     otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
-    trustProxy: env.NEAT_AUTH_PROXY === "true"
+    trustProxy: env.NEAT_AUTH_PROXY === "true",
+    publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, DEFAULT_UNAUTH_SUFFIXES;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -105,7 +115,13 @@ var init_auth = __esm({
         this.name = "BindAuthorityError";
       }
     };
-    DEFAULT_UNAUTH_SUFFIXES = ["/health", "/healthz", "/readyz"];
+    PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+    DEFAULT_UNAUTH_SUFFIXES = [
+      "/health",
+      "/healthz",
+      "/readyz",
+      "/api/config"
+    ];
   }
 });
 
@@ -308,6 +324,15 @@ function isoFromUnixNano(nanos) {
     return void 0;
   }
 }
+function pickEnv(spanAttrs, resourceAttrs) {
+  for (const attrs of [spanAttrs, resourceAttrs]) {
+    for (const key of [ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT]) {
+      const v = attrs[key];
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+  }
+  return ENV_FALLBACK;
+}
 function parseOtlpRequest(body) {
   const out = [];
   for (const rs of body.resourceSpans ?? []) {
@@ -327,6 +352,7 @@ function parseOtlpRequest(body) {
           endTimeUnixNano: span.endTimeUnixNano ?? "0",
           startTimeIso: isoFromUnixNano(span.startTimeUnixNano),
           durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),
+          env: pickEnv(attrs, resourceAttrs),
           attributes: attrs,
           dbSystem: typeof attrs["db.system"] === "string" ? attrs["db.system"] : void 0,
           dbName: typeof attrs["db.name"] === "string" ? attrs["db.name"] : void 0,
@@ -465,7 +491,7 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
@@ -475,6 +501,9 @@ var init_otel = __esm({
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
     init_auth();
+    ENV_ATTR_CANONICAL = "deployment.environment.name";
+    ENV_ATTR_COMPAT = "deployment.environment";
+    ENV_FALLBACK = "unknown";
     exportTraceServiceRequestType = null;
     exportTraceServiceResponseType = null;
     cachedProtobufResponseBody = null;
@@ -1513,52 +1542,64 @@ function cacheSpanService(span, now) {
   if (!span.traceId || !span.spanId) return;
   const key = parentSpanKey(span.traceId, span.spanId);
   parentSpanCache.delete(key);
-  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  parentSpanCache.set(key, {
+    service: span.service,
+    env: span.env ?? "unknown",
+    expiresAt: now + PARENT_SPAN_CACHE_TTL_MS
+  });
   while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
     const oldest = parentSpanCache.keys().next().value;
     if (!oldest) break;
     parentSpanCache.delete(oldest);
   }
 }
-function lookupParentSpanService(traceId, parentSpanId, now) {
+function lookupParentSpan(traceId, parentSpanId, now) {
   const entry2 = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
   if (!entry2) return null;
   if (entry2.expiresAt <= now) {
     parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
     return null;
   }
-  return entry2.service;
+  return { service: entry2.service, env: entry2.env };
 }
-function resolveServiceId(graph, host) {
-  const direct = (0, import_types3.serviceId)(host);
-  if (graph.hasNode(direct)) return direct;
-  let found = null;
+function resolveServiceId(graph, host, env) {
+  const envTagged = (0, import_types3.serviceId)(host, env);
+  if (graph.hasNode(envTagged)) return envTagged;
+  const envLess = (0, import_types3.serviceId)(host);
+  if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
+  let sameEnv = null;
+  let envLessMatch = null;
+  let anyMatch = null;
   graph.forEachNode((id, attrs) => {
-    if (found) return;
+    if (sameEnv) return;
     const a = attrs;
     if (a.type !== import_types3.NodeType.ServiceNode) return;
-    if (a.name === host) {
-      found = id;
+    const matchesByName = a.name === host;
+    const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
+    if (!matchesByName && !matchesByAlias) return;
+    const nodeEnv = a.env ?? "unknown";
+    if (nodeEnv === env) {
+      sameEnv = id;
       return;
     }
-    if (a.aliases && a.aliases.includes(host)) {
-      found = id;
-    }
+    if (nodeEnv === "unknown" && !envLessMatch) envLessMatch = id;
+    else if (!anyMatch) anyMatch = id;
   });
-  return found;
+  return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
   return (0, import_types3.frontierId)(host);
 }
-function ensureServiceNode(graph, serviceName) {
-  const id = (0, import_types3.serviceId)(serviceName);
+function ensureServiceNode(graph, serviceName, env) {
+  const id = (0, import_types3.serviceId)(serviceName, env);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
     type: import_types3.NodeType.ServiceNode,
     name: serviceName,
     language: "unknown",
-    discoveredVia: "otel"
+    discoveredVia: "otel",
+    ...env !== "unknown" ? { env } : {}
   };
   graph.addNode(id, node);
   return id;
@@ -1704,7 +1745,7 @@ function buildErrorEventForReceiver(span) {
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: (0, import_types3.serviceId)(span.service)
+    affectedNode: (0, import_types3.serviceId)(span.service, span.env)
   };
 }
 function makeErrorSpanWriter(errorsPath) {
@@ -1718,7 +1759,8 @@ function makeErrorSpanWriter(errorsPath) {
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
-  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const env = span.env ?? "unknown";
+  const sourceId = ensureServiceNode(ctx.graph, span.service, env);
   const isError = span.statusCode === 2;
   cacheSpanService(span, nowMs);
   let affectedNode = sourceId;
@@ -1741,7 +1783,7 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
     if (host && host !== span.service) {
-      const targetId = resolveServiceId(ctx.graph, host);
+      const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
@@ -1768,9 +1810,9 @@ async function handleSpan(ctx, span) {
       }
     }
     if (!resolvedViaAddress && span.parentSpanId) {
-      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
-      if (parentService && parentService !== span.service) {
-        const parentId = ensureServiceNode(ctx.graph, parentService);
+      const parent = lookupParentSpan(span.traceId, span.parentSpanId, nowMs);
+      if (parent && parent.service !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         upsertObservedEdge(
           ctx.graph,
           import_types3.EdgeType.CALLS,
@@ -1893,6 +1935,28 @@ async function readErrorEvents(errorsPath) {
     throw err;
   }
 }
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of exported.nodes ?? []) {
+    if (graph.hasNode(node.key)) continue;
+    if (!node.attributes) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of exported.edges ?? []) {
+    const attrs = edge.attributes;
+    if (!attrs) continue;
+    const id = edge.key ?? attrs.id;
+    if (!id) continue;
+    if (graph.hasEdge(id)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/services.ts
 init_cjs_shims();
@@ -2289,6 +2353,18 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   }
   return [...found];
 }
+function detectJsFramework(pkg) {
+  const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  if (deps["next"] !== void 0) return "next";
+  if (deps["remix"] !== void 0) return "remix";
+  for (const k of Object.keys(deps)) {
+    if (k.startsWith("@remix-run/")) return "remix";
+  }
+  if (deps["@sveltejs/kit"] !== void 0) return "sveltekit";
+  if (deps["nuxt"] !== void 0) return "nuxt";
+  if (deps["astro"] !== void 0) return "astro";
+  return void 0;
+}
 async function discoverNodeService(scanPath, dir) {
   const pkgPath = import_node_path8.default.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
@@ -2300,6 +2376,7 @@ async function discoverNodeService(scanPath, dir) {
     return null;
   }
   if (!pkg.name) return null;
+  const framework = detectJsFramework(pkg);
   const node = {
     id: (0, import_types5.serviceId)(pkg.name),
     type: import_types5.NodeType.ServiceNode,
@@ -2308,7 +2385,8 @@ async function discoverNodeService(scanPath, dir) {
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
     repoPath: import_node_path8.default.relative(scanPath, dir),
-    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
+    ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
@@ -4091,7 +4169,7 @@ init_cjs_shims();
 var import_node_fs18 = require("fs");
 var import_node_path31 = __toESM(require("path"), 1);
 var import_types19 = require("@neat.is/types");
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -4103,6 +4181,9 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV3ToV4(payload) {
+  return { ...payload, schemaVersion: 4 };
+}
 function migrateV2ToV3(payload) {
   const edges = payload.graph.edges;
   if (Array.isArray(edges)) {
@@ -4151,6 +4232,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 2) {
     payload = migrateV2ToV3(payload);
   }
+  if (payload.schemaVersion === 3) {
+    payload = migrateV3ToV4(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -5004,6 +5088,35 @@ function registerRoutes(scope, ctx) {
       }
     }
   );
+  scope.post("/snapshot", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply);
+    if (!proj) return;
+    const body = req2.body;
+    if (!body || typeof body !== "object" || !body.snapshot) {
+      return reply.code(400).send({ error: "request body must be { snapshot: <persisted-graph> }" });
+    }
+    const snap = body.snapshot;
+    if (typeof snap.schemaVersion !== "number" || snap.schemaVersion !== SCHEMA_VERSION) {
+      return reply.code(400).send({
+        error: `unsupported snapshot schemaVersion ${snap.schemaVersion} (expected ${SCHEMA_VERSION})`
+      });
+    }
+    try {
+      const result = mergeSnapshot(proj.graph, snap);
+      return {
+        project: proj.name,
+        nodesAdded: result.nodesAdded,
+        edgesAdded: result.edgesAdded,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size
+      };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "snapshot merge failed",
+        details: err.message
+      });
+    }
+  });
   scope.post("/graph/scan", async (req2, reply) => {
     const proj = resolveProject(registry, req2, reply);
     if (!proj) return;
@@ -5097,7 +5210,15 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
-  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
+  mountBearerAuth(app, {
+    token: opts.authToken,
+    trustProxy: opts.trustProxy,
+    publicRead: opts.publicRead
+  });
+  app.get("/api/config", async () => ({
+    publicRead: opts.publicRead === true,
+    authProxy: opts.trustProxy === true
+  }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -5374,7 +5495,8 @@ async function startDaemon(opts = {}) {
       restApp = await buildApi({
         projects: registry,
         authToken: auth.authToken,
-        trustProxy: auth.trustProxy
+        trustProxy: auth.trustProxy,
+        publicRead: auth.publicRead
       });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);