@neat.is/core 0.4.16 → 0.4.17

package/dist/{chunk-XS4CGNRO.js → chunk-LUDSPX5N.js}

@@ -454,19 +454,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path38, edges) {
-    if (path38.length > best.path.length) {
-      best = { path: [...path38], edges: [...edges] };
+  function step(node, path39, edges) {
+    if (path39.length > best.path.length) {
+      best = { path: [...path39], edges: [...edges] };
     }
-    if (path38.length - 1 >= maxDepth) return;
+    if (path39.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path38.push(srcId);
+      path39.push(srcId);
       edges.push(edge);
-      step(srcId, path38, edges);
-      path38.pop();
+      step(srcId, path39, edges);
+      path39.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1093,6 +1093,41 @@ function thresholdForEdgeType(edgeType, overrides) {
   const map = overrides ?? loadStaleThresholdsFromEnv();
   return map[edgeType] ?? FALLBACK_STALE_THRESHOLD_MS;
 }
+var DEFAULT_INCIDENT_THRESHOLDS = {
+  threshold: 5,
+  windowMs: 6e4
+};
+function loadIncidentThresholdsFromEnv() {
+  const raw = process.env.NEAT_INCIDENT_THRESHOLDS;
+  if (!raw) return DEFAULT_INCIDENT_THRESHOLDS;
+  try {
+    const overrides = JSON.parse(raw);
+    const merged = { ...DEFAULT_INCIDENT_THRESHOLDS };
+    if (typeof overrides.threshold === "number" && Number.isFinite(overrides.threshold) && overrides.threshold >= 1) {
+      merged.threshold = Math.floor(overrides.threshold);
+    }
+    if (typeof overrides.windowMs === "number" && Number.isFinite(overrides.windowMs) && overrides.windowMs >= 0) {
+      merged.windowMs = overrides.windowMs;
+    }
+    return merged;
+  } catch (err) {
+    console.warn(
+      `[neat] NEAT_INCIDENT_THRESHOLDS could not be parsed (${err.message}); using defaults`
+    );
+    return DEFAULT_INCIDENT_THRESHOLDS;
+  }
+}
+function httpResponseStatus(span) {
+  for (const key of ["http.response.status_code", "http.status_code"]) {
+    const v = span.attributes[key];
+    if (typeof v === "number" && Number.isFinite(v)) return v;
+    if (typeof v === "string") {
+      const n = Number(v);
+      if (Number.isFinite(n)) return n;
+    }
+  }
+  return void 0;
+}
 function nowIso(ctx) {
   return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
 }
@@ -1506,6 +1541,71 @@ function makeErrorSpanWriter(errorsPath) {
     await fs3.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
   };
 }
+async function recordFailingResponseIncident(ctx, span, affectedNode, timestamp, statusCode, count, firstTimestamp) {
+  const attrs = sanitizeAttributes(span.attributes);
+  const first = firstTimestamp ?? timestamp;
+  const peer = pickAddress(span);
+  const message = count > 1 ? `${count} consecutive HTTP ${statusCode} responses` + (peer ? ` to ${peer}` : "") : `HTTP ${statusCode} response` + (peer ? ` from ${peer}` : "");
+  const ev = {
+    id: `${span.traceId}:${span.spanId}`,
+    timestamp,
+    service: span.service,
+    traceId: span.traceId,
+    spanId: span.spanId,
+    errorType: "http-failure",
+    errorMessage: message,
+    ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
+    affectedNode,
+    httpStatusCode: statusCode,
+    incidentCount: count,
+    firstTimestamp: first,
+    lastTimestamp: timestamp
+  };
+  await appendErrorEvent(ctx, ev);
+}
+async function advance4xxBurst(ctx, span, affectedNode, ts, nowMs, status) {
+  const { threshold, windowMs } = loadIncidentThresholdsFromEnv();
+  if (!ctx.burstState) ctx.burstState = /* @__PURE__ */ new Map();
+  const peer = pickAddress(span) ?? span.spanId;
+  const key = `${span.service}->${peer}`;
+  const existing = ctx.burstState.get(key);
+  let state;
+  if (existing && nowMs - existing.lastMs <= windowMs) {
+    existing.count += 1;
+    existing.lastTs = ts;
+    existing.lastMs = nowMs;
+    existing.codes.set(status, (existing.codes.get(status) ?? 0) + 1);
+    state = existing;
+  } else {
+    state = {
+      count: 1,
+      firstTs: ts,
+      lastTs: ts,
+      lastMs: nowMs,
+      codes: /* @__PURE__ */ new Map([[status, 1]])
+    };
+    ctx.burstState.set(key, state);
+  }
+  if (state.count < threshold) return;
+  let dominant = status;
+  let max = 0;
+  for (const [code, n] of state.codes) {
+    if (n > max) {
+      max = n;
+      dominant = code;
+    }
+  }
+  await recordFailingResponseIncident(
+    ctx,
+    span,
+    affectedNode,
+    state.lastTs,
+    dominant,
+    state.count,
+    state.firstTs
+  );
+  ctx.burstState.delete(key);
+}
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
@@ -1604,6 +1704,14 @@ async function handleSpan(ctx, span) {
       await appendErrorEvent(ctx, ev);
     }
   }
+  if (span.statusCode !== 2) {
+    const status = httpResponseStatus(span);
+    if (status !== void 0 && status >= 500) {
+      await recordFailingResponseIncident(ctx, span, sourceId, ts, status, 1);
+    } else if (status !== void 0 && status >= 400 && spanMintsObservedEdge(span.kind)) {
+      await advance4xxBurst(ctx, span, sourceId, ts, nowMs, status);
+    }
+  }
   void affectedNode;
   if (ctx.onPolicyTrigger) await ctx.onPolicyTrigger(ctx.graph);
 }
@@ -3995,6 +4103,65 @@ function grpcEndpointsFromFile(file, serviceDir) {
   return out;
 }
 
+// src/extract/calls/supabase.ts
+import path27 from "path";
+import { infraId as infraId5 } from "@neat.is/types";
+var SUPABASE_JS_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/supabase-js['"`]/;
+var SUPABASE_SSR_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/ssr['"`]/;
+var SUPABASE_CLIENT_RE = /\b(createClient|createServerClient|createBrowserClient)\s*\(\s*(?:['"`]([^'"`]*)['"`])?/g;
+function hostFromLiteral(literal) {
+  if (!literal) return null;
+  const m = /^https?:\/\/([^/:'"`\s]+)/.exec(literal.trim());
+  if (!m) return null;
+  const host = m[1];
+  if (!/\.supabase\.(co|in)$/i.test(host)) return null;
+  return host;
+}
+function readImports2(content) {
+  return {
+    hasSupabaseJs: SUPABASE_JS_IMPORT_RE.test(content),
+    hasSupabaseSsr: SUPABASE_SSR_IMPORT_RE.test(content)
+  };
+}
+function constructorMatchesImport(name, ctx) {
+  if (name === "createClient") return ctx.hasSupabaseJs;
+  return ctx.hasSupabaseSsr;
+}
+function supabaseEndpointsFromFile(file, serviceDir) {
+  const ctx = readImports2(file.content);
+  if (!ctx.hasSupabaseJs && !ctx.hasSupabaseSsr) return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  SUPABASE_CLIENT_RE.lastIndex = 0;
+  let m;
+  while ((m = SUPABASE_CLIENT_RE.exec(file.content)) !== null) {
+    const ctor = m[1];
+    if (!constructorMatchesImport(ctor, ctx)) continue;
+    const host = hostFromLiteral(m[2]);
+    const name = host ?? "env";
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const line = lineOf(file.content, m[0]);
+    out.push({
+      infraId: infraId5("supabase", name),
+      name,
+      kind: "supabase",
+      edgeType: "CALLS",
+      // `createClient(...)` from @supabase/supabase-js (or createServerClient /
+      // createBrowserClient from @supabase/ssr) with the import in scope — a
+      // framework-aware recognizer matched the SDK shape. Verified-call-site
+      // tier (ADR-066), the same grade aws.ts / grpc.ts emit at.
+      confidenceKind: "verified-call-site",
+      evidence: {
+        file: path27.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
 // src/extract/calls/index.ts
 function edgeTypeFromEndpoint(ep) {
   switch (ep.edgeType) {
@@ -4023,6 +4190,7 @@ async function addExternalEndpointEdges(graph, services) {
       endpoints.push(...redisEndpointsFromFile(maskedFile, service.dir));
       endpoints.push(...awsEndpointsFromFile(maskedFile, service.dir));
       endpoints.push(...grpcEndpointsFromFile(maskedFile, service.dir));
+      endpoints.push(...supabaseEndpointsFromFile(maskedFile, service.dir));
     }
     if (endpoints.length === 0) continue;
     const seenEdges = /* @__PURE__ */ new Set();
@@ -4093,14 +4261,14 @@ async function addCallEdges(graph, services) {
 }
 
 // src/extract/infra/docker-compose.ts
-import path27 from "path";
+import path28 from "path";
 import { EdgeType as EdgeType10, Provenance as Provenance8, confidenceForExtracted as confidenceForExtracted7 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
-import { NodeType as NodeType10, infraId as infraId5 } from "@neat.is/types";
+import { NodeType as NodeType10, infraId as infraId6 } from "@neat.is/types";
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: infraId5(kind, name),
+    id: infraId6(kind, name),
     type: NodeType10.InfraNode,
     name,
     provider,
@@ -4130,7 +4298,7 @@ function dependsOnList(value) {
 }
 function serviceNameToServiceNode(name, services) {
   for (const s of services) {
-    if (s.node.name === name || path27.basename(s.dir) === name) return s.node.id;
+    if (s.node.name === name || path28.basename(s.dir) === name) return s.node.id;
   }
   return null;
 }
@@ -4139,7 +4307,7 @@ async function addComposeInfra(graph, scanPath, services) {
   let edgesAdded = 0;
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path27.join(scanPath, name);
+    const abs = path28.join(scanPath, name);
     if (await exists(abs)) {
       composePath = abs;
       break;
@@ -4152,13 +4320,13 @@ async function addComposeInfra(graph, scanPath, services) {
   } catch (err) {
     recordExtractionError(
       "infra docker-compose",
-      path27.relative(scanPath, composePath),
+      path28.relative(scanPath, composePath),
       err
     );
     return { nodesAdded, edgesAdded };
   }
   if (!compose?.services) return { nodesAdded, edgesAdded };
-  const evidenceFile = path27.relative(scanPath, composePath).split(path27.sep).join("/");
+  const evidenceFile = path28.relative(scanPath, composePath).split(path28.sep).join("/");
   const composeNameToNodeId = /* @__PURE__ */ new Map();
   for (const [composeName, svc] of Object.entries(compose.services)) {
     const matchedServiceId = serviceNameToServiceNode(composeName, services);
@@ -4199,7 +4367,7 @@ async function addComposeInfra(graph, scanPath, services) {
 }
 
 // src/extract/infra/dockerfile.ts
-import path28 from "path";
+import path29 from "path";
 import { promises as fs15 } from "fs";
 import { EdgeType as EdgeType11, Provenance as Provenance9, confidenceForExtracted as confidenceForExtracted8 } from "@neat.is/types";
 function runtimeImage(content) {
@@ -4220,7 +4388,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const dockerfilePath = path28.join(service.dir, "Dockerfile");
+    const dockerfilePath = path29.join(service.dir, "Dockerfile");
     if (!await exists(dockerfilePath)) continue;
     let content;
     try {
@@ -4228,7 +4396,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     } catch (err) {
       recordExtractionError(
         "infra dockerfile",
-        path28.relative(scanPath, dockerfilePath),
+        path29.relative(scanPath, dockerfilePath),
         err
       );
       continue;
@@ -4240,7 +4408,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
-    const relDockerfile = toPosix2(path28.relative(service.dir, dockerfilePath));
+    const relDockerfile = toPosix2(path29.relative(service.dir, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -4259,7 +4427,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         provenance: Provenance9.EXTRACTED,
         confidence: confidenceForExtracted8("structural"),
         evidence: {
-          file: toPosix2(path28.relative(scanPath, dockerfilePath))
+          file: toPosix2(path29.relative(scanPath, dockerfilePath))
         }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -4271,7 +4439,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 
 // src/extract/infra/terraform.ts
 import { promises as fs16 } from "fs";
-import path29 from "path";
+import path30 from "path";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
@@ -4280,11 +4448,11 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
-      const child = path29.join(start, entry.name);
+      const child = path30.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry.isFile() && entry.name.endsWith(".tf")) {
-      out.push(path29.join(start, entry.name));
+      out.push(path30.join(start, entry.name));
     }
   }
   return out;
@@ -4311,7 +4479,7 @@ async function addTerraformResources(graph, scanPath) {
 
 // src/extract/infra/k8s.ts
 import { promises as fs17 } from "fs";
-import path30 from "path";
+import path31 from "path";
 import { parseAllDocuments as parseAllDocuments2 } from "yaml";
 var K8S_KIND_TO_INFRA_KIND = {
   Service: "k8s-service",
@@ -4329,11 +4497,11 @@ async function walkYamlFiles2(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path30.join(start, entry.name);
+      const child = path31.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles2(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path30.extname(entry.name))) {
-      out.push(path30.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path31.extname(entry.name))) {
+      out.push(path31.join(start, entry.name));
     }
   }
   return out;
@@ -4377,11 +4545,11 @@ async function addInfra(graph, scanPath, services) {
 }
 
 // src/extract/index.ts
-import path32 from "path";
+import path33 from "path";
 
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
-import path31 from "path";
+import path32 from "path";
 import { NodeType as NodeType11, Provenance as Provenance10 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
@@ -4415,11 +4583,11 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
     if (edge.provenance !== Provenance10.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (path31.isAbsolute(evidenceFile)) {
+    if (path32.isAbsolute(evidenceFile)) {
       if (!existsSync2(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => existsSync2(path31.join(base, evidenceFile)));
+    const found = bases.some((base) => existsSync2(path32.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -4459,7 +4627,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = path32.join(path32.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = path33.join(path33.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -4736,7 +4904,7 @@ function computeDivergences(graph, opts = {}) {
 
 // src/persist.ts
 import { promises as fs18 } from "fs";
-import path33 from "path";
+import path34 from "path";
 import { Provenance as Provenance12, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
@@ -4773,7 +4941,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await fs18.mkdir(path33.dirname(filePath), { recursive: true });
+  await fs18.mkdir(path34.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -4923,23 +5091,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path34 from "path";
+import path35 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path34.join(baseDir, "graph.json"),
-      errorsPath: path34.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path34.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path34.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path34.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path35.join(baseDir, "graph.json"),
+      errorsPath: path35.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path35.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path35.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path35.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path34.join(baseDir, `${project}.json`),
-    errorsPath: path34.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path34.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path34.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path34.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path35.join(baseDir, `${project}.json`),
+    errorsPath: path35.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path35.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path35.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path35.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -4980,7 +5148,7 @@ function parseExtraProjects(raw) {
 // src/registry.ts
 import { promises as fs20 } from "fs";
 import os2 from "os";
-import path35 from "path";
+import path36 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -4988,17 +5156,17 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path35.resolve(override);
-  return path35.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path36.resolve(override);
+  return path36.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path35.join(neatHome(), "projects.json");
+  return path36.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path35.join(neatHome(), "projects.json.lock");
+  return path36.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return path35.join(neatHome(), "neatd.pid");
+  return path36.join(neatHome(), "neatd.pid");
 }
 function isPidAliveDefault(pid) {
   try {
@@ -5058,7 +5226,7 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function normalizeProjectPath(input) {
-  const resolved = path35.resolve(input);
+  const resolved = path36.resolve(input);
   try {
     return await fs20.realpath(resolved);
   } catch {
@@ -5066,7 +5234,7 @@ async function normalizeProjectPath(input) {
   }
 }
 async function writeAtomically(target, contents) {
-  await fs20.mkdir(path35.dirname(target), { recursive: true });
+  await fs20.mkdir(path36.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
   const fd = await fs20.open(tmp, "w");
   try {
@@ -5079,7 +5247,7 @@ async function writeAtomically(target, contents) {
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await fs20.mkdir(path35.dirname(lockPath), { recursive: true });
+  await fs20.mkdir(path36.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
@@ -5215,6 +5383,58 @@ async function removeProject(name) {
     return removed;
   });
 }
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_PRUNE_TTL_MS = 7 * DAY_MS2;
+function pruneTtlMs() {
+  const raw = process.env.NEAT_REGISTRY_PRUNE_TTL_MS;
+  if (!raw) return DEFAULT_PRUNE_TTL_MS;
+  const n = Number.parseInt(raw, 10);
+  if (Number.isFinite(n) && n >= 0) return n;
+  console.warn(
+    `[neat] NEAT_REGISTRY_PRUNE_TTL_MS could not be parsed (${raw}); using default ${DEFAULT_PRUNE_TTL_MS}ms`
+  );
+  return DEFAULT_PRUNE_TTL_MS;
+}
+async function statPathStatus(p) {
+  try {
+    const stat = await fs20.stat(p);
+    return stat.isDirectory() ? "present" : "unknown";
+  } catch (err) {
+    return err.code === "ENOENT" ? "gone" : "unknown";
+  }
+}
+async function pruneRegistry(opts = {}) {
+  const ttlMs = opts.ttlMs ?? pruneTtlMs();
+  const statPath = opts.statPath ?? statPathStatus;
+  const now = opts.now ?? Date.now;
+  return withLock(async () => {
+    const reg = await readRegistry();
+    const removed = [];
+    const kept = [];
+    for (const entry of reg.projects) {
+      const status = await statPath(entry.path);
+      if (status !== "gone") {
+        kept.push(entry);
+        continue;
+      }
+      if (ttlMs <= 0) {
+        removed.push(entry);
+        continue;
+      }
+      const lastSeen = Date.parse(entry.lastSeenAt ?? entry.registeredAt);
+      const age = now() - (Number.isFinite(lastSeen) ? lastSeen : 0);
+      if (age > ttlMs) {
+        removed.push(entry);
+      } else {
+        kept.push(entry);
+      }
+    }
+    if (removed.length === 0) return [];
+    reg.projects = kept;
+    await writeRegistry(reg);
+    return removed;
+  });
+}
 
 // src/api.ts
 import Fastify from "fastify";
@@ -5223,13 +5443,13 @@ import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } f
 
 // src/extend/index.ts
 import { promises as fs22 } from "fs";
-import path37 from "path";
+import path38 from "path";
 import os3 from "os";
 import { resolve as registryResolve, list as registryList } from "@neat.is/instrumentation-registry";
 
 // src/installers/package-manager.ts
 import { promises as fs21 } from "fs";
-import path36 from "path";
+import path37 from "path";
 import { spawn } from "child_process";
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -5251,22 +5471,22 @@ async function exists2(p) {
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = path36.resolve(serviceDir);
+  let dir = path37.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path36.join(dir, candidate.lockfile);
+      const lockPath = path37.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = path36.dirname(dir);
+    const parent = path37.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: path36.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: path37.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -5315,7 +5535,7 @@ async function fileExists2(p) {
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = path37.join(scanPath, "package.json");
+  const pkgPath = path38.join(scanPath, "package.json");
   const raw = await fs22.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
@@ -5326,11 +5546,11 @@ async function findHookFiles(scanPath) {
   ).sort();
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? path37.join(os3.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? path38.join(os3.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry) {
   const logPath = extendLogPath();
-  await fs22.mkdir(path37.dirname(logPath), { recursive: true });
+  await fs22.mkdir(path38.dirname(logPath), { recursive: true });
   await fs22.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
@@ -5389,7 +5609,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(path37.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(path38.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     registryList().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -5411,16 +5631,16 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await fs22.readFile(path37.join(ctx.scanPath, file), "utf8");
+    const content = await fs22.readFile(path38.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
   }
   const primaryFile = hookFiles[0];
-  const primaryPath = path37.join(ctx.scanPath, primaryFile);
+  const primaryPath = path38.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = path37.join(ctx.scanPath, "package.json");
+  const pkgPath = path38.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
@@ -5466,7 +5686,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await fs22.readFile(path37.join(ctx.scanPath, file), "utf8");
+    const content = await fs22.readFile(path38.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -5488,7 +5708,7 @@ async function dryRunExtension(ctx, args) {
     depsToAdd.push(`${args.instrumentation_package}@${args.version}`);
     filesTouched.push("package.json");
   }
-  const hookContent = await fs22.readFile(path37.join(ctx.scanPath, primaryFile), "utf8");
+  const hookContent = await fs22.readFile(path38.join(ctx.scanPath, primaryFile), "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (patched) {
     filesTouched.push(primaryFile);
@@ -5509,7 +5729,7 @@ async function rollbackExtension(ctx, args) {
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = path37.join(ctx.scanPath, "package.json");
+  const pkgPath = path38.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
@@ -5520,7 +5740,7 @@ async function rollbackExtension(ctx, args) {
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = path37.join(ctx.scanPath, file);
+    const filePath = path38.join(ctx.scanPath, file);
     const content = await fs22.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
@@ -5545,6 +5765,7 @@ function handleSse(req, reply, opts) {
   reply.raw.setHeader("Connection", "keep-alive");
   reply.raw.setHeader("X-Accel-Buffering", "no");
   reply.raw.flushHeaders?.();
+  reply.raw.write(":open\n\n");
   let pending = 0;
   let dropped = false;
   const closeConnection = () => {
@@ -6254,6 +6475,7 @@ export {
   setStatus,
   touchLastSeen,
   removeProject,
+  pruneRegistry,
   buildApi
 };
-//# sourceMappingURL=chunk-XS4CGNRO.js.map
+//# sourceMappingURL=chunk-LUDSPX5N.js.map