@neat.is/core 0.3.8 → 0.4.2

package/dist/{chunk-CZ3T6TE2.js → chunk-NTQHMXWE.js}

@@ -1,6 +1,6 @@
 import {
   mountBearerAuth
-} from "./chunk-7TYESDAI.js";
+} from "./chunk-KYRIQIPG.js";
 
 // src/graph.ts
 import GraphDefault from "graphology";
@@ -1104,52 +1104,64 @@ function cacheSpanService(span, now) {
   if (!span.traceId || !span.spanId) return;
   const key = parentSpanKey(span.traceId, span.spanId);
   parentSpanCache.delete(key);
-  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  parentSpanCache.set(key, {
+    service: span.service,
+    env: span.env ?? "unknown",
+    expiresAt: now + PARENT_SPAN_CACHE_TTL_MS
+  });
   while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
     const oldest = parentSpanCache.keys().next().value;
     if (!oldest) break;
     parentSpanCache.delete(oldest);
   }
 }
-function lookupParentSpanService(traceId, parentSpanId, now) {
+function lookupParentSpan(traceId, parentSpanId, now) {
   const entry = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
   if (!entry) return null;
   if (entry.expiresAt <= now) {
     parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
     return null;
   }
-  return entry.service;
+  return { service: entry.service, env: entry.env };
 }
-function resolveServiceId(graph, host) {
-  const direct = serviceId(host);
-  if (graph.hasNode(direct)) return direct;
-  let found = null;
+function resolveServiceId(graph, host, env) {
+  const envTagged = serviceId(host, env);
+  if (graph.hasNode(envTagged)) return envTagged;
+  const envLess = serviceId(host);
+  if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
+  let sameEnv = null;
+  let envLessMatch = null;
+  let anyMatch = null;
   graph.forEachNode((id, attrs) => {
-    if (found) return;
+    if (sameEnv) return;
     const a = attrs;
     if (a.type !== NodeType3.ServiceNode) return;
-    if (a.name === host) {
-      found = id;
+    const matchesByName = a.name === host;
+    const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
+    if (!matchesByName && !matchesByAlias) return;
+    const nodeEnv = a.env ?? "unknown";
+    if (nodeEnv === env) {
+      sameEnv = id;
       return;
     }
-    if (a.aliases && a.aliases.includes(host)) {
-      found = id;
-    }
+    if (nodeEnv === "unknown" && !envLessMatch) envLessMatch = id;
+    else if (!anyMatch) anyMatch = id;
   });
-  return found;
+  return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
   return frontierId(host);
 }
-function ensureServiceNode(graph, serviceName) {
-  const id = serviceId(serviceName);
+function ensureServiceNode(graph, serviceName, env) {
+  const id = serviceId(serviceName, env);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
     type: NodeType3.ServiceNode,
     name: serviceName,
     language: "unknown",
-    discoveredVia: "otel"
+    discoveredVia: "otel",
+    ...env !== "unknown" ? { env } : {}
   };
   graph.addNode(id, node);
   return id;
@@ -1295,7 +1307,7 @@ function buildErrorEventForReceiver(span) {
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: serviceId(span.service)
+    affectedNode: serviceId(span.service, span.env)
   };
 }
 function makeErrorSpanWriter(errorsPath) {
@@ -1309,7 +1321,8 @@ function makeErrorSpanWriter(errorsPath) {
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
-  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const env = span.env ?? "unknown";
+  const sourceId = ensureServiceNode(ctx.graph, span.service, env);
   const isError = span.statusCode === 2;
   cacheSpanService(span, nowMs);
   let affectedNode = sourceId;
@@ -1332,7 +1345,7 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
     if (host && host !== span.service) {
-      const targetId = resolveServiceId(ctx.graph, host);
+      const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
@@ -1359,9 +1372,9 @@ async function handleSpan(ctx, span) {
       }
     }
     if (!resolvedViaAddress && span.parentSpanId) {
-      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
-      if (parentService && parentService !== span.service) {
-        const parentId = ensureServiceNode(ctx.graph, parentService);
+      const parent = lookupParentSpan(span.traceId, span.parentSpanId, nowMs);
+      if (parent && parent.service !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         upsertObservedEdge(
           ctx.graph,
           EdgeType2.CALLS,
@@ -1557,6 +1570,28 @@ async function readErrorEvents(errorsPath) {
     throw err;
   }
 }
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of exported.nodes ?? []) {
+    if (graph.hasNode(node.key)) continue;
+    if (!node.attributes) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of exported.edges ?? []) {
+    const attrs = edge.attributes;
+    if (!attrs) continue;
+    const id = edge.key ?? attrs.id;
+    if (!id) continue;
+    if (graph.hasEdge(id)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/errors.ts
 import { promises as fs4 } from "fs";
@@ -1633,8 +1668,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   ".turbo",
   "dist",
   "build",
-  ".next"
+  ".next",
+  // Python virtualenv shapes (issue #344). Walking into a venv pulls in the
+  // entire CPython stdlib + every installed package as if it were first-party
+  // service code — 20k+ files, none of which the user wrote. The shape names
+  // cover the three common venv tools (`venv` / `python -m venv`,
+  // `virtualenv`) and the tox + PEP 582 conventions.
+  ".venv",
+  "venv",
+  "__pypackages__",
+  ".tox",
+  // `site-packages` shows up nested inside venvs that don't carry one of the
+  // outer names (system Python on macOS, in-place pyenv layouts). Listing it
+  // here means we stop the walk at the boundary even when the wrapper dir
+  // wasn't recognisable.
+  "site-packages"
 ]);
+var PYVENV_MARKER_CACHE = /* @__PURE__ */ new Map();
+async function isPythonVenvDir(dir) {
+  const cached = PYVENV_MARKER_CACHE.get(dir);
+  if (cached !== void 0) return cached;
+  try {
+    const stat = await fs5.stat(path5.join(dir, "pyvenv.cfg"));
+    const ok = stat.isFile();
+    PYVENV_MARKER_CACHE.set(dir, ok);
+    return ok;
+  } catch {
+    PYVENV_MARKER_CACHE.set(dir, false);
+    return false;
+  }
+}
 function isConfigFile(name) {
   const ext = path5.extname(name);
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
@@ -1925,6 +1988,7 @@ async function walkDirs(start, scanPath, options, visit) {
         const rel = path8.relative(scanPath, child).split(path8.sep).join("/");
         if (rel && options.ig.ignores(rel + "/")) continue;
       }
+      if (await isPythonVenvDir(child)) continue;
       await visit(child);
       await recurse(child, depth + 1);
     }
@@ -1960,6 +2024,18 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   }
   return [...found];
 }
+function detectJsFramework(pkg) {
+  const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  if (deps["next"] !== void 0) return "next";
+  if (deps["remix"] !== void 0) return "remix";
+  for (const k of Object.keys(deps)) {
+    if (k.startsWith("@remix-run/")) return "remix";
+  }
+  if (deps["@sveltejs/kit"] !== void 0) return "sveltekit";
+  if (deps["nuxt"] !== void 0) return "nuxt";
+  if (deps["astro"] !== void 0) return "astro";
+  return void 0;
+}
 async function discoverNodeService(scanPath, dir) {
   const pkgPath = path8.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
@@ -1971,6 +2047,7 @@ async function discoverNodeService(scanPath, dir) {
     return null;
   }
   if (!pkg.name) return null;
+  const framework = detectJsFramework(pkg);
   const node = {
     id: serviceId2(pkg.name),
     type: NodeType4.ServiceNode,
@@ -1979,7 +2056,8 @@ async function discoverNodeService(scanPath, dir) {
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
     repoPath: path8.relative(scanPath, dir),
-    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
+    ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
@@ -2188,7 +2266,9 @@ async function walkYamlFiles(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      out.push(...await walkYamlFiles(path9.join(start, entry.name), depth + 1, max));
+      const child = path9.join(start, entry.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkYamlFiles(child, depth + 1, max));
     } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path9.extname(entry.name))) {
       out.push(path9.join(start, entry.name));
     }
@@ -2870,7 +2950,9 @@ async function walkConfigFiles(dir) {
     for (const entry of entries) {
       const full = path18.join(current, entry.name);
       if (entry.isDirectory()) {
-        if (!IGNORED_DIRS.has(entry.name)) await walk(full);
+        if (IGNORED_DIRS.has(entry.name)) continue;
+        if (await isPythonVenvDir(full)) continue;
+        await walk(full);
       } else if (entry.isFile() && isConfigFile(entry.name).match) {
         out.push(full);
       }
@@ -2946,7 +3028,9 @@ async function walkSourceFiles(dir) {
     for (const entry of entries) {
       const full = path19.join(current, entry.name);
       if (entry.isDirectory()) {
-        if (!IGNORED_DIRS.has(entry.name)) await walk(full);
+        if (IGNORED_DIRS.has(entry.name)) continue;
+        if (await isPythonVenvDir(full)) continue;
+        await walk(full);
       } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path19.extname(entry.name))) {
         out.push(full);
       }
@@ -3571,7 +3655,9 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
-      out.push(...await walkTfFiles(path27.join(start, entry.name), depth + 1, max));
+      const child = path27.join(start, entry.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry.isFile() && entry.name.endsWith(".tf")) {
       out.push(path27.join(start, entry.name));
     }
@@ -3618,7 +3704,9 @@ async function walkYamlFiles2(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      out.push(...await walkYamlFiles2(path28.join(start, entry.name), depth + 1, max));
+      const child = path28.join(start, entry.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkYamlFiles2(child, depth + 1, max));
     } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path28.extname(entry.name))) {
       out.push(path28.join(start, entry.name));
     }
@@ -4009,7 +4097,7 @@ function computeDivergences(graph, opts = {}) {
 import { promises as fs17 } from "fs";
 import path31 from "path";
 import { Provenance as Provenance10, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -4021,6 +4109,9 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV3ToV4(payload) {
+  return { ...payload, schemaVersion: 4 };
+}
 function migrateV2ToV3(payload) {
   const edges = payload.graph.edges;
   if (Array.isArray(edges)) {
@@ -4069,6 +4160,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 2) {
     payload = migrateV2ToV3(payload);
   }
+  if (payload.schemaVersion === 3) {
+    payload = migrateV3ToV4(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -4486,10 +4580,19 @@ function projectFromReq(req) {
   const params = req.params;
   return params.project ?? DEFAULT_PROJECT;
 }
-function resolveProject(registry, req, reply) {
+function resolveProject(registry, req, reply, bootstrap) {
   const name = projectFromReq(req);
   const ctx = registry.get(name);
   if (!ctx) {
+    const phase = bootstrap?.status(name);
+    if (phase === "bootstrapping") {
+      void reply.code(503).send({ ready: false, project: name, status: "bootstrapping" });
+      return null;
+    }
+    if (phase === "broken") {
+      void reply.code(503).send({ ready: false, project: name, status: "broken" });
+      return null;
+    }
     void reply.code(404).send({ error: "project not found", project: name });
     return null;
   }
@@ -4519,36 +4622,38 @@ function buildLegacyRegistry(opts) {
 function registerRoutes(scope, ctx) {
   const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
   scope.get("/events", (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     handleSse(req, reply, { project: proj.name });
   });
-  scope.get("/health", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
-    if (!proj) return;
-    const uptimeMs = Date.now() - startedAt;
-    return {
-      ok: true,
-      project: proj.name,
-      uptimeMs,
-      // Legacy fields kept additively. The web shell's StatusBar reads
-      // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
-      // the canonical triple and lets the extras pass through.
-      uptime: Math.floor(uptimeMs / 1e3),
-      nodeCount: proj.graph.order,
-      edgeCount: proj.graph.size,
-      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  });
+  if (ctx.scope === "project") {
+    scope.get("/health", async (req, reply) => {
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
+      if (!proj) return;
+      const uptimeMs = Date.now() - startedAt;
+      return {
+        ok: true,
+        project: proj.name,
+        uptimeMs,
+        // Legacy fields kept additively. The web shell's StatusBar reads
+        // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
+        // the canonical triple and lets the extras pass through.
+        uptime: Math.floor(uptimeMs / 1e3),
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size,
+        lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    });
+  }
   scope.get("/graph", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     return serializeGraph(proj.graph);
   });
   scope.get(
     "/graph/node/:id",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const { id } = req.params;
       if (!proj.graph.hasNode(id)) {
@@ -4560,7 +4665,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/graph/edges/:id",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const { id } = req.params;
       if (!proj.graph.hasNode(id)) {
@@ -4572,7 +4677,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.get("/graph/dependencies/:nodeId", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -4587,7 +4692,7 @@ function registerRoutes(scope, ctx) {
     return getTransitiveDependencies(proj.graph, nodeId, depth);
   });
   scope.get("/graph/divergences", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     let typeFilter;
     if (req.query.type) {
@@ -4622,7 +4727,7 @@ function registerRoutes(scope, ctx) {
     });
   });
   scope.get("/incidents", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const epath = errorsPathFor(proj);
     if (!epath) return { count: 0, total: 0, events: [] };
@@ -4634,7 +4739,7 @@ function registerRoutes(scope, ctx) {
     return { count: sliced.length, total, events: sliced };
   });
   scope.get("/stale-events", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const spath = staleEventsPathFor(proj);
     if (!spath) return { count: 0, total: 0, events: [] };
@@ -4649,7 +4754,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/incidents/:nodeId",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const { nodeId } = req.params;
       if (!proj.graph.hasNode(nodeId)) {
@@ -4665,7 +4770,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -4685,7 +4790,7 @@ function registerRoutes(scope, ctx) {
     return result;
   });
   scope.get("/graph/blast-radius/:nodeId", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -4698,7 +4803,7 @@ function registerRoutes(scope, ctx) {
     return getBlastRadius(proj.graph, nodeId, depth);
   });
   scope.get("/search", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const raw = (req.query.q ?? "").trim();
     if (!raw) return reply.code(400).send({ error: "query parameter `q` is required" });
@@ -4729,7 +4834,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/graph/diff",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const against = req.query.against;
       if (!against) {
@@ -4743,8 +4848,37 @@ function registerRoutes(scope, ctx) {
       }
     }
   );
+  scope.post("/snapshot", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
+    if (!proj) return;
+    const body = req.body;
+    if (!body || typeof body !== "object" || !body.snapshot) {
+      return reply.code(400).send({ error: "request body must be { snapshot: <persisted-graph> }" });
+    }
+    const snap = body.snapshot;
+    if (typeof snap.schemaVersion !== "number" || snap.schemaVersion !== SCHEMA_VERSION) {
+      return reply.code(400).send({
+        error: `unsupported snapshot schemaVersion ${snap.schemaVersion} (expected ${SCHEMA_VERSION})`
+      });
+    }
+    try {
+      const result = mergeSnapshot(proj.graph, snap);
+      return {
+        project: proj.name,
+        nodesAdded: result.nodesAdded,
+        edgesAdded: result.edgesAdded,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size
+      };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "snapshot merge failed",
+        details: err.message
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     if (!proj.scanPath) {
       return reply.code(409).send({ error: "scan path not configured for this project", project: proj.name });
@@ -4760,7 +4894,7 @@ function registerRoutes(scope, ctx) {
     };
   });
   scope.get("/policies", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const policyPath = ctx.policyFilePathFor(proj);
     if (!policyPath) {
@@ -4777,7 +4911,7 @@ function registerRoutes(scope, ctx) {
     }
   });
   scope.get("/policies/violations", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
@@ -4797,7 +4931,7 @@ function registerRoutes(scope, ctx) {
     return { violations };
   });
   scope.post("/policies/check", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const parsed = PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
@@ -4836,7 +4970,15 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = Fastify({ logger: false });
   await app.register(cors, { origin: true });
-  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
+  mountBearerAuth(app, {
+    token: opts.authToken,
+    trustProxy: opts.trustProxy,
+    publicRead: opts.publicRead
+  });
+  app.get("/api/config", async () => ({
+    publicRead: opts.publicRead === true,
+    authProxy: opts.trustProxy === true
+  }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -4860,10 +5002,36 @@ async function buildApi(opts) {
   const routeCtx = {
     registry,
     startedAt,
+    scope: "root",
     errorsPathFor,
     staleEventsPathFor,
-    policyFilePathFor
+    policyFilePathFor,
+    bootstrap: opts.bootstrap
   };
+  app.get("/health", async () => {
+    const uptimeMs = Date.now() - startedAt;
+    const bootstrapList = opts.bootstrap?.list() ?? [];
+    const byName = new Map(bootstrapList.map((p) => [p.name, p]));
+    const names = /* @__PURE__ */ new Set([
+      ...registry.list(),
+      ...bootstrapList.map((p) => p.name)
+    ]);
+    const projects = [...names].sort().map((name) => {
+      const proj = registry.get(name);
+      const tracked = byName.get(name);
+      return {
+        name,
+        nodeCount: proj?.graph.order ?? 0,
+        edgeCount: proj?.graph.size ?? 0,
+        ...tracked ? { status: tracked.status, elapsedMs: tracked.elapsedMs } : {}
+      };
+    });
+    return {
+      ok: true,
+      uptimeMs,
+      projects
+    };
+  });
   app.get("/projects", async (_req, reply) => {
     try {
       return await listProjects();
@@ -4891,7 +5059,7 @@ async function buildApi(opts) {
   registerRoutes(app, routeCtx);
   await app.register(
     async (scope) => {
-      registerRoutes(scope, routeCtx);
+      registerRoutes(scope, { ...routeCtx, scope: "project" });
     },
     { prefix: "/projects/:project" }
   );
@@ -4958,4 +5126,4 @@ export {
   removeProject,
   buildApi
 };
-//# sourceMappingURL=chunk-CZ3T6TE2.js.map
+//# sourceMappingURL=chunk-NTQHMXWE.js.map