@neat.is/core 0.4.0 → 0.4.2

package/dist/neatd.cjs

@@ -57,9 +57,9 @@ function mountBearerAuth(app, opts) {
   const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req2, reply, done) => {
-    const path39 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    const path40 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
     for (const suffix of suffixes) {
-      if (path39 === suffix || path39.endsWith(suffix)) {
+      if (path40 === suffix || path40.endsWith(suffix)) {
         done();
         return;
       }
@@ -512,14 +512,14 @@ var init_otel = __esm({
 
 // src/neatd.ts
 init_cjs_shims();
-var import_node_fs22 = require("fs");
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_fs23 = require("fs");
+var import_node_path39 = __toESM(require("path"), 1);
 var import_node_module = require("module");
 
 // src/daemon.ts
 init_cjs_shims();
-var import_node_fs21 = require("fs");
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_fs22 = require("fs");
+var import_node_path37 = __toESM(require("path"), 1);
 
 // src/graph.ts
 init_cjs_shims();
@@ -979,19 +979,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path39, edges) {
-    if (path39.length > best.path.length) {
-      best = { path: [...path39], edges: [...edges] };
+  function step(node, path40, edges) {
+    if (path40.length > best.path.length) {
+      best = { path: [...path40], edges: [...edges] };
     }
-    if (path39.length - 1 >= maxDepth) return;
+    if (path40.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path39.push(srcId);
+      path40.push(srcId);
       edges.push(edge);
-      step(srcId, path39, edges);
-      path39.pop();
+      step(srcId, path40, edges);
+      path40.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1980,8 +1980,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   ".turbo",
   "dist",
   "build",
-  ".next"
+  ".next",
+  // Python virtualenv shapes (issue #344). Walking into a venv pulls in the
+  // entire CPython stdlib + every installed package as if it were first-party
+  // service code — 20k+ files, none of which the user wrote. The shape names
+  // cover the three common venv tools (`venv` / `python -m venv`,
+  // `virtualenv`) and the tox + PEP 582 conventions.
+  ".venv",
+  "venv",
+  "__pypackages__",
+  ".tox",
+  // `site-packages` shows up nested inside venvs that don't carry one of the
+  // outer names (system Python on macOS, in-place pyenv layouts). Listing it
+  // here means we stop the walk at the boundary even when the wrapper dir
+  // wasn't recognisable.
+  "site-packages"
 ]);
+var PYVENV_MARKER_CACHE = /* @__PURE__ */ new Map();
+async function isPythonVenvDir(dir) {
+  const cached = PYVENV_MARKER_CACHE.get(dir);
+  if (cached !== void 0) return cached;
+  try {
+    const stat = await import_node_fs4.promises.stat(import_node_path4.default.join(dir, "pyvenv.cfg"));
+    const ok = stat.isFile();
+    PYVENV_MARKER_CACHE.set(dir, ok);
+    return ok;
+  } catch {
+    PYVENV_MARKER_CACHE.set(dir, false);
+    return false;
+  }
+}
 function isConfigFile(name) {
   const ext = import_node_path4.default.extname(name);
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
@@ -2318,6 +2346,7 @@ async function walkDirs(start, scanPath, options, visit) {
         const rel = import_node_path8.default.relative(scanPath, child).split(import_node_path8.default.sep).join("/");
         if (rel && options.ig.ignores(rel + "/")) continue;
       }
+      if (await isPythonVenvDir(child)) continue;
       await visit(child);
       await recurse(child, depth + 1);
     }
@@ -2596,7 +2625,9 @@ async function walkYamlFiles(start, depth = 0, max = 5) {
   for (const entry2 of entries) {
     if (entry2.isDirectory()) {
       if (IGNORED_DIRS.has(entry2.name)) continue;
-      out.push(...await walkYamlFiles(import_node_path9.default.join(start, entry2.name), depth + 1, max));
+      const child = import_node_path9.default.join(start, entry2.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkYamlFiles(child, depth + 1, max));
     } else if (entry2.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path9.default.extname(entry2.name))) {
       out.push(import_node_path9.default.join(start, entry2.name));
     }
@@ -3278,7 +3309,9 @@ async function walkConfigFiles(dir) {
     for (const entry2 of entries) {
       const full = import_node_path18.default.join(current, entry2.name);
       if (entry2.isDirectory()) {
-        if (!IGNORED_DIRS.has(entry2.name)) await walk(full);
+        if (IGNORED_DIRS.has(entry2.name)) continue;
+        if (await isPythonVenvDir(full)) continue;
+        await walk(full);
       } else if (entry2.isFile() && isConfigFile(entry2.name).match) {
         out.push(full);
       }
@@ -3346,7 +3379,9 @@ async function walkSourceFiles(dir) {
     for (const entry2 of entries) {
       const full = import_node_path19.default.join(current, entry2.name);
       if (entry2.isDirectory()) {
-        if (!IGNORED_DIRS.has(entry2.name)) await walk(full);
+        if (IGNORED_DIRS.has(entry2.name)) continue;
+        if (await isPythonVenvDir(full)) continue;
+        await walk(full);
       } else if (entry2.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path19.default.extname(entry2.name))) {
         out.push(full);
       }
@@ -3982,7 +4017,9 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   for (const entry2 of entries) {
     if (entry2.isDirectory()) {
       if (IGNORED_DIRS.has(entry2.name) || entry2.name === ".terraform") continue;
-      out.push(...await walkTfFiles(import_node_path27.default.join(start, entry2.name), depth + 1, max));
+      const child = import_node_path27.default.join(start, entry2.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry2.isFile() && entry2.name.endsWith(".tf")) {
       out.push(import_node_path27.default.join(start, entry2.name));
     }
@@ -4030,7 +4067,9 @@ async function walkYamlFiles2(start, depth = 0, max = 5) {
   for (const entry2 of entries) {
     if (entry2.isDirectory()) {
       if (IGNORED_DIRS.has(entry2.name)) continue;
-      out.push(...await walkYamlFiles2(import_node_path28.default.join(start, entry2.name), depth + 1, max));
+      const child = import_node_path28.default.join(start, entry2.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkYamlFiles2(child, depth + 1, max));
     } else if (entry2.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path28.default.extname(entry2.name))) {
       out.push(import_node_path28.default.join(start, entry2.name));
     }
@@ -4831,10 +4870,19 @@ function projectFromReq(req2) {
   const params = req2.params;
   return params.project ?? DEFAULT_PROJECT;
 }
-function resolveProject(registry, req2, reply) {
+function resolveProject(registry, req2, reply, bootstrap) {
   const name = projectFromReq(req2);
   const ctx = registry.get(name);
   if (!ctx) {
+    const phase = bootstrap?.status(name);
+    if (phase === "bootstrapping") {
+      void reply.code(503).send({ ready: false, project: name, status: "bootstrapping" });
+      return null;
+    }
+    if (phase === "broken") {
+      void reply.code(503).send({ ready: false, project: name, status: "broken" });
+      return null;
+    }
     void reply.code(404).send({ error: "project not found", project: name });
     return null;
   }
@@ -4864,36 +4912,38 @@ function buildLegacyRegistry(opts) {
 function registerRoutes(scope, ctx) {
   const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
   scope.get("/events", (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     handleSse(req2, reply, { project: proj.name });
   });
-  scope.get("/health", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
-    if (!proj) return;
-    const uptimeMs = Date.now() - startedAt;
-    return {
-      ok: true,
-      project: proj.name,
-      uptimeMs,
-      // Legacy fields kept additively. The web shell's StatusBar reads
-      // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
-      // the canonical triple and lets the extras pass through.
-      uptime: Math.floor(uptimeMs / 1e3),
-      nodeCount: proj.graph.order,
-      edgeCount: proj.graph.size,
-      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  });
+  if (ctx.scope === "project") {
+    scope.get("/health", async (req2, reply) => {
+      const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
+      if (!proj) return;
+      const uptimeMs = Date.now() - startedAt;
+      return {
+        ok: true,
+        project: proj.name,
+        uptimeMs,
+        // Legacy fields kept additively. The web shell's StatusBar reads
+        // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
+        // the canonical triple and lets the extras pass through.
+        uptime: Math.floor(uptimeMs / 1e3),
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size,
+        lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    });
+  }
   scope.get("/graph", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     return serializeGraph(proj.graph);
   });
   scope.get(
     "/graph/node/:id",
     async (req2, reply) => {
-      const proj = resolveProject(registry, req2, reply);
+      const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
       if (!proj) return;
       const { id } = req2.params;
       if (!proj.graph.hasNode(id)) {
@@ -4905,7 +4955,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/graph/edges/:id",
     async (req2, reply) => {
-      const proj = resolveProject(registry, req2, reply);
+      const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
       if (!proj) return;
       const { id } = req2.params;
       if (!proj.graph.hasNode(id)) {
@@ -4917,7 +4967,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.get("/graph/dependencies/:nodeId", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req2.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -4932,7 +4982,7 @@ function registerRoutes(scope, ctx) {
     return getTransitiveDependencies(proj.graph, nodeId, depth);
   });
   scope.get("/graph/divergences", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     let typeFilter;
     if (req2.query.type) {
@@ -4967,7 +5017,7 @@ function registerRoutes(scope, ctx) {
     });
   });
   scope.get("/incidents", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const epath = errorsPathFor(proj);
     if (!epath) return { count: 0, total: 0, events: [] };
@@ -4979,7 +5029,7 @@ function registerRoutes(scope, ctx) {
     return { count: sliced.length, total, events: sliced };
   });
   scope.get("/stale-events", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const spath = staleEventsPathFor(proj);
     if (!spath) return { count: 0, total: 0, events: [] };
@@ -4994,7 +5044,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/incidents/:nodeId",
     async (req2, reply) => {
-      const proj = resolveProject(registry, req2, reply);
+      const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
       if (!proj) return;
       const { nodeId } = req2.params;
       if (!proj.graph.hasNode(nodeId)) {
@@ -5010,7 +5060,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.get("/graph/root-cause/:nodeId", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req2.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -5030,7 +5080,7 @@ function registerRoutes(scope, ctx) {
     return result;
   });
   scope.get("/graph/blast-radius/:nodeId", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req2.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -5043,7 +5093,7 @@ function registerRoutes(scope, ctx) {
     return getBlastRadius(proj.graph, nodeId, depth);
   });
   scope.get("/search", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const raw = (req2.query.q ?? "").trim();
     if (!raw) return reply.code(400).send({ error: "query parameter `q` is required" });
@@ -5074,7 +5124,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/graph/diff",
     async (req2, reply) => {
-      const proj = resolveProject(registry, req2, reply);
+      const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
       if (!proj) return;
       const against = req2.query.against;
       if (!against) {
@@ -5089,7 +5139,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.post("/snapshot", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const body = req2.body;
     if (!body || typeof body !== "object" || !body.snapshot) {
@@ -5118,7 +5168,7 @@ function registerRoutes(scope, ctx) {
     }
   });
   scope.post("/graph/scan", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     if (!proj.scanPath) {
       return reply.code(409).send({ error: "scan path not configured for this project", project: proj.name });
@@ -5134,7 +5184,7 @@ function registerRoutes(scope, ctx) {
     };
   });
   scope.get("/policies", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const policyPath = ctx.policyFilePathFor(proj);
     if (!policyPath) {
@@ -5151,7 +5201,7 @@ function registerRoutes(scope, ctx) {
     }
   });
   scope.get("/policies/violations", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
@@ -5171,7 +5221,7 @@ function registerRoutes(scope, ctx) {
     return { violations };
   });
   scope.post("/policies/check", async (req2, reply) => {
-    const proj = resolveProject(registry, req2, reply);
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap);
     if (!proj) return;
     const parsed = import_types22.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
     if (!parsed.success) {
@@ -5242,10 +5292,36 @@ async function buildApi(opts) {
   const routeCtx = {
     registry,
     startedAt,
+    scope: "root",
     errorsPathFor,
     staleEventsPathFor,
-    policyFilePathFor
+    policyFilePathFor,
+    bootstrap: opts.bootstrap
   };
+  app.get("/health", async () => {
+    const uptimeMs = Date.now() - startedAt;
+    const bootstrapList = opts.bootstrap?.list() ?? [];
+    const byName = new Map(bootstrapList.map((p) => [p.name, p]));
+    const names = /* @__PURE__ */ new Set([
+      ...registry.list(),
+      ...bootstrapList.map((p) => p.name)
+    ]);
+    const projects = [...names].sort().map((name) => {
+      const proj = registry.get(name);
+      const tracked = byName.get(name);
+      return {
+        name,
+        nodeCount: proj?.graph.order ?? 0,
+        edgeCount: proj?.graph.size ?? 0,
+        ...tracked ? { status: tracked.status, elapsedMs: tracked.elapsedMs } : {}
+      };
+    });
+    return {
+      ok: true,
+      uptimeMs,
+      projects
+    };
+  });
   app.get("/projects", async (_req, reply) => {
     try {
       return await listProjects();
@@ -5273,7 +5349,7 @@ async function buildApi(opts) {
   registerRoutes(app, routeCtx);
   await app.register(
     async (scope) => {
-      registerRoutes(scope, routeCtx);
+      registerRoutes(scope, { ...routeCtx, scope: "project" });
     },
     { prefix: "/projects/:project" }
   );
@@ -5283,12 +5359,35 @@ async function buildApi(opts) {
 // src/daemon.ts
 init_otel();
 init_auth();
+
+// src/unrouted.ts
+init_cjs_shims();
+var import_node_fs21 = require("fs");
+var import_node_path36 = __toESM(require("path"), 1);
+function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
+  return {
+    timestamp: now.toISOString(),
+    reason: "no-project-match",
+    service_name: serviceName ?? null,
+    traceId: traceId ?? null
+  };
+}
+async function appendUnroutedSpan(neatHome3, record) {
+  const target = import_node_path36.default.join(neatHome3, "errors.ndjson");
+  await import_node_fs21.promises.mkdir(neatHome3, { recursive: true });
+  await import_node_fs21.promises.appendFile(target, JSON.stringify(record) + "\n", "utf8");
+}
+function unroutedErrorsPath(neatHome3) {
+  return import_node_path36.default.join(neatHome3, "errors.ndjson");
+}
+
+// src/daemon.ts
 function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path36.default.resolve(opts.neatHome);
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path37.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path36.default.resolve(env);
+  if (env && env.length > 0) return import_node_path37.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path36.default.join(home, ".neat");
+  return import_node_path37.default.join(home, ".neat");
 }
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
@@ -5323,9 +5422,9 @@ function isTokenContained(needle, haystack) {
   return tokens.includes(needle);
 }
 async function bootstrapProject(entry2) {
-  const paths = pathsForProject(entry2.name, import_node_path36.default.join(entry2.path, "neat-out"));
+  const paths = pathsForProject(entry2.name, import_node_path37.default.join(entry2.path, "neat-out"));
   try {
-    const stat = await import_node_fs21.promises.stat(entry2.path);
+    const stat = await import_node_fs22.promises.stat(entry2.path);
     if (!stat.isDirectory()) {
       throw new Error(`registered path ${entry2.path} is not a directory`);
     }
@@ -5380,27 +5479,30 @@ function resolveOtlpPort(opts) {
   }
   return 4318;
 }
-function resolveHost(opts) {
+function resolveHost(opts, authTokenSet) {
   if (opts.host && opts.host.length > 0) return opts.host;
   const env = process.env.HOST;
   if (env && env.length > 0) return env;
+  if (!authTokenSet) return "127.0.0.1";
   return "0.0.0.0";
 }
 async function startDaemon(opts = {}) {
   const home = neatHomeFor(opts);
   const regPath = registryPath();
   try {
-    await import_node_fs21.promises.access(regPath);
+    await import_node_fs22.promises.access(regPath);
   } catch {
     throw new Error(
       `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
     );
   }
-  const pidPath = import_node_path36.default.join(home, "neatd.pid");
+  const pidPath = import_node_path37.default.join(home, "neatd.pid");
   await writeAtomically(pidPath, `${process.pid}
 `);
   const slots = /* @__PURE__ */ new Map();
   const registry = new Projects();
+  const bootstrapStatus = /* @__PURE__ */ new Map();
+  const bootstrapStartedAt = /* @__PURE__ */ new Map();
   const DROP_WARN_INTERVAL_MS = 6e4;
   const lastDropWarnAt = /* @__PURE__ */ new Map();
   function warnDroppedSpan(project, reason) {
@@ -5412,6 +5514,22 @@ async function startDaemon(opts = {}) {
       `[neatd] dropping span for project "${project}" \u2014 project status: broken (${reason}). Run \`neatd reload\` to retry bootstrap.`
     );
   }
+  const unroutedPath = unroutedErrorsPath(home);
+  const lastUnroutedWarnAt = /* @__PURE__ */ new Map();
+  async function recordUnroutedSpan(serviceName, traceId) {
+    const key = serviceName ?? "<missing>";
+    const now = Date.now();
+    try {
+      await appendUnroutedSpan(home, buildUnroutedSpanRecord(serviceName, traceId, new Date(now)));
+    } catch {
+    }
+    const prev = lastUnroutedWarnAt.get(key) ?? 0;
+    if (now - prev < DROP_WARN_INTERVAL_MS) return;
+    lastUnroutedWarnAt.set(key, now);
+    console.warn(
+      `[neatd] dropping span \u2014 service.name "${key}" matches no registered project and no \`default\` project exists. See ${unroutedPath}.`
+    );
+  }
   function upsertRegistryFromSlot(slot) {
     if (slot.status !== "active") return;
     registry.set(slot.entry.name, {
@@ -5440,34 +5558,43 @@ async function startDaemon(opts = {}) {
       return slots.get(entry2.name);
     }
   }
+  async function bootstrapOne(entry2) {
+    bootstrapStatus.set(entry2.name, "bootstrapping");
+    bootstrapStartedAt.set(entry2.name, Date.now());
+    try {
+      const slot = await bootstrapProject(entry2);
+      slots.set(entry2.name, slot);
+      upsertRegistryFromSlot(slot);
+      bootstrapStatus.set(entry2.name, slot.status === "broken" ? "broken" : "active");
+      if (slot.status === "broken") {
+        console.warn(`neatd: project "${entry2.name}" broken \u2014 ${slot.errorReason}`);
+      } else {
+        console.log(`neatd: project "${entry2.name}" active (${entry2.path})`);
+      }
+    } catch (err) {
+      bootstrapStatus.set(entry2.name, "broken");
+      console.warn(
+        `neatd: project "${entry2.name}" failed to bootstrap \u2014 ${err.message}`
+      );
+      await setStatus(entry2.name, "broken").catch(() => {
+      });
+    }
+  }
   async function loadAll() {
     const projects = await listProjects();
     const seen = /* @__PURE__ */ new Set();
+    const pending = [];
     for (const entry2 of projects) {
       seen.add(entry2.name);
       const existing = slots.get(entry2.name);
       if (existing) {
         if (existing.status === "broken") {
-          await tryRecoverSlot(entry2);
+          pending.push(tryRecoverSlot(entry2).then(() => {
+          }));
         }
         continue;
       }
-      try {
-        const slot = await bootstrapProject(entry2);
-        slots.set(entry2.name, slot);
-        upsertRegistryFromSlot(slot);
-        if (slot.status === "broken") {
-          console.warn(`neatd: project "${entry2.name}" broken \u2014 ${slot.errorReason}`);
-        } else {
-          console.log(`neatd: project "${entry2.name}" active (${entry2.path})`);
-        }
-      } catch (err) {
-        console.warn(
-          `neatd: project "${entry2.name}" failed to bootstrap \u2014 ${err.message}`
-        );
-        await setStatus(entry2.name, "broken").catch(() => {
-        });
-      }
+      pending.push(bootstrapOne(entry2));
     }
     for (const [name, slot] of [...slots.entries()]) {
       if (seen.has(name)) continue;
@@ -5476,27 +5603,45 @@ async function startDaemon(opts = {}) {
       } catch {
       }
       slots.delete(name);
+      bootstrapStatus.delete(name);
+      bootstrapStartedAt.delete(name);
       console.log(`neatd: project "${name}" removed from registry \u2014 stopped`);
     }
+    await Promise.allSettled(pending);
+  }
+  const initialEntries = await listProjects().catch(() => []);
+  for (const entry2 of initialEntries) {
+    bootstrapStatus.set(entry2.name, "bootstrapping");
+    bootstrapStartedAt.set(entry2.name, Date.now());
   }
-  await loadAll();
   const bind = opts.bindListeners !== false;
   let restApp = null;
   let otlpApp = null;
   let restAddress = "";
   let otlpAddress = "";
   if (bind) {
-    const host = resolveHost(opts);
+    const auth = readAuthEnv();
+    const host = resolveHost(opts, Boolean(auth.authToken));
     const restPort = resolveRestPort(opts);
     const otlpPort = resolveOtlpPort(opts);
-    const auth = readAuthEnv();
     assertBindAuthority(host, auth.authToken);
     try {
       restApp = await buildApi({
         projects: registry,
         authToken: auth.authToken,
         trustProxy: auth.trustProxy,
-        publicRead: auth.publicRead
+        publicRead: auth.publicRead,
+        bootstrap: {
+          status: (name) => bootstrapStatus.get(name),
+          list: () => {
+            const now = Date.now();
+            return [...bootstrapStatus.entries()].map(([name, status2]) => ({
+              name,
+              status: status2,
+              elapsedMs: now - (bootstrapStartedAt.get(name) ?? now)
+            }));
+          }
+        }
       });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);
@@ -5509,17 +5654,20 @@ async function startDaemon(opts = {}) {
       }
       if (restApp) await restApp.close().catch(() => {
       });
-      await import_node_fs21.promises.unlink(pidPath).catch(() => {
+      await import_node_fs22.promises.unlink(pidPath).catch(() => {
       });
       throw new Error(
         `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
       );
     }
-    async function resolveTargetSlot(serviceName) {
+    async function resolveTargetSlot(serviceName, traceId) {
       const liveEntries = await listProjects().catch(() => []);
       const target = routeSpanToProject(serviceName, liveEntries);
       let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
-      if (!slot) return null;
+      if (!slot) {
+        await recordUnroutedSpan(serviceName, traceId);
+        return null;
+      }
       if (slot.status === "broken") {
         const entry2 = liveEntries.find((e) => e.name === slot.entry.name);
         if (entry2) {
@@ -5537,7 +5685,7 @@ async function startDaemon(opts = {}) {
         authToken: auth.otelToken,
         trustProxy: auth.trustProxy,
         onSpan: async (span) => {
-          const slot = await resolveTargetSlot(span.service);
+          const slot = await resolveTargetSlot(span.service, span.traceId);
           if (!slot) return;
           await handleSpan(
             {
@@ -5551,7 +5699,7 @@ async function startDaemon(opts = {}) {
           );
         },
         onErrorSpanSync: async (span) => {
-          const slot = await resolveTargetSlot(span.service);
+          const slot = await resolveTargetSlot(span.service, span.traceId);
           if (!slot) return;
           await makeErrorSpanWriter(slot.paths.errorsPath)(span);
         }
@@ -5569,14 +5717,17 @@ async function startDaemon(opts = {}) {
       });
       if (otlpApp) await otlpApp.close().catch(() => {
       });
-      await import_node_fs21.promises.unlink(pidPath).catch(() => {
+      await import_node_fs22.promises.unlink(pidPath).catch(() => {
       });
       throw new Error(
         `neatd: failed to bind OTLP on port ${otlpPort} \u2014 ${err.message}`
       );
     }
   }
-  let reloading = null;
+  const initialBootstrap = loadAll().catch((err) => {
+    console.warn(`neatd: initial bootstrap pass failed \u2014 ${err.message}`);
+  });
+  let reloading = initialBootstrap;
   const reload = async () => {
     if (reloading) return reloading;
     reloading = (async () => {
@@ -5588,6 +5739,20 @@ async function startDaemon(opts = {}) {
     })();
     return reloading;
   };
+  void initialBootstrap.finally(() => {
+    if (reloading === initialBootstrap) reloading = null;
+  });
+  const tracker = {
+    status: (name) => bootstrapStatus.get(name),
+    list: () => {
+      const now = Date.now();
+      return [...bootstrapStatus.entries()].map(([name, status2]) => ({
+        name,
+        status: status2,
+        elapsedMs: now - (bootstrapStartedAt.get(name) ?? now)
+      }));
+    }
+  };
   const sighupHandler = () => {
     void reload().catch((err) => {
       console.warn(`neatd: SIGHUP reload failed \u2014 ${err.message}`);
@@ -5609,10 +5774,19 @@ async function startDaemon(opts = {}) {
       } catch {
       }
     }
-    await import_node_fs21.promises.unlink(pidPath).catch(() => {
+    await import_node_fs22.promises.unlink(pidPath).catch(() => {
     });
   };
-  return { slots, reload, stop, pidPath, restAddress, otlpAddress };
+  return {
+    slots,
+    reload,
+    stop,
+    pidPath,
+    restAddress,
+    otlpAddress,
+    bootstrap: tracker,
+    initialBootstrap
+  };
 }
 
 // src/neatd.ts
@@ -5622,7 +5796,7 @@ init_auth();
 init_cjs_shims();
 var import_node_child_process = require("child_process");
 var import_node_net = __toESM(require("net"), 1);
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_path38 = __toESM(require("path"), 1);
 var DEFAULT_WEB_PORT = 6328;
 async function assertPortFree(port) {
   await new Promise((resolve, reject) => {
@@ -5650,10 +5824,10 @@ function resolveWebPackageDir() {
     eval("require")
   );
   const pkgJsonPath = req.resolve("@neat.is/web/package.json");
-  return import_node_path37.default.dirname(pkgJsonPath);
+  return import_node_path38.default.dirname(pkgJsonPath);
 }
 function resolveStandaloneServerEntry(webDir) {
-  return import_node_path37.default.join(webDir, ".next/standalone/packages/web/server.js");
+  return import_node_path38.default.join(webDir, ".next/standalone/packages/web/server.js");
 }
 async function spawnWebUI(restPort) {
   const portRaw = process.env.NEAT_WEB_PORT;
@@ -5678,7 +5852,7 @@ async function spawnWebUI(restPort) {
     NEAT_API_URL: process.env.NEAT_API_URL ?? `http://localhost:${restPort}`
   };
   const child = (0, import_node_child_process.spawn)(process.execPath, [serverEntry], {
-    cwd: import_node_path37.default.dirname(serverEntry),
+    cwd: import_node_path38.default.dirname(serverEntry),
     env,
     stdio: ["ignore", "inherit", "inherit"],
     detached: false
@@ -5791,14 +5965,14 @@ function localVersion() {
 }
 function neatHome2() {
   if (process.env.NEAT_HOME && process.env.NEAT_HOME.length > 0) {
-    return import_node_path38.default.resolve(process.env.NEAT_HOME);
+    return import_node_path39.default.resolve(process.env.NEAT_HOME);
   }
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path38.default.join(home, ".neat");
+  return import_node_path39.default.join(home, ".neat");
 }
 async function readPid() {
   try {
-    const raw = await import_node_fs22.promises.readFile(import_node_path38.default.join(neatHome2(), "neatd.pid"), "utf8");
+    const raw = await import_node_fs23.promises.readFile(import_node_path39.default.join(neatHome2(), "neatd.pid"), "utf8");
     const n = Number.parseInt(raw.trim(), 10);
     return Number.isFinite(n) ? n : null;
   } catch {