@neat.is/core 0.4.20-dev.20260630 → 0.4.23

package/dist/server.cjs

@@ -40,13 +40,13 @@ var init_cjs_shims = __esm({
 });
 
 // src/auth.ts
-function isLoopbackHost(host) {
+function isLoopbackHost2(host) {
   if (!host) return false;
   return LOOPBACK_HOSTS.has(host);
 }
 function assertBindAuthority(host, token) {
   if (token && token.length > 0) return;
-  if (isLoopbackHost(host)) return;
+  if (isLoopbackHost2(host)) return;
   throw new BindAuthorityError(host);
 }
 function mountBearerAuth(app, opts) {
@@ -617,7 +617,7 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types25 = require("@neat.is/types");
+var import_types26 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -1458,22 +1458,164 @@ var rootCauseShapes = {
   [import_types.NodeType.ServiceNode]: serviceRootCauseShape,
   [import_types.NodeType.FileNode]: fileRootCauseShape
 };
-function getRootCause(graph, errorNodeId, errorEvent) {
+function getRootCause(graph, errorNodeId, errorEvent, incidents) {
   if (!graph.hasNode(errorNodeId)) return null;
   const origin = graph.getNodeAttributes(errorNodeId);
   const shape = rootCauseShapes[origin.type];
-  if (!shape) return null;
-  const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
-  const match = shape(graph, origin, walk);
-  if (!match) return null;
-  const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+  if (shape) {
+    const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+    const match = shape(graph, origin, walk);
+    if (match) {
+      const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+      return import_types.RootCauseResultSchema.parse({
+        rootCauseNode: match.rootCauseNode,
+        rootCauseReason: reason,
+        traversalPath: walk.path,
+        edgeProvenances: walk.edges.map((e) => e.provenance),
+        confidence: confidenceFromMix(walk.edges),
+        fixRecommendation: match.fixRecommendation
+      });
+    }
+  }
+  if (origin.type === import_types.NodeType.ServiceNode) {
+    const crossService = crossServiceRootCause(graph, errorNodeId, incidents, errorEvent);
+    if (crossService) return crossService;
+  }
+  return rootCauseFromIncidents(errorNodeId, incidents, errorEvent);
+}
+var INCIDENT_ROOT_CAUSE_CONFIDENCE = 0.6;
+function incidentMatchesNode(ev, nodeId) {
+  return ev.affectedNode === nodeId || ev.service === nodeId.replace(/^service:/, "");
+}
+function localizeFromIncidents(nodeId, incidents, errorEvent) {
+  const pool = incidents && incidents.length > 0 ? incidents : errorEvent ? [errorEvent] : [];
+  const relevant = pool.filter((ev) => incidentMatchesNode(ev, nodeId));
+  if (relevant.length === 0) return null;
+  const latest = [...relevant].sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
+  const attrs = latest.attributes ?? {};
+  const filepath = typeof attrs["code.filepath"] === "string" ? attrs["code.filepath"] : void 0;
+  const lineno = typeof attrs["code.lineno"] === "number" ? attrs["code.lineno"] : void 0;
+  const route = typeof attrs["http.route"] === "string" ? attrs["http.route"] : void 0;
+  const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
+  const sameMode = relevant.filter((ev) => ev.errorMessage === latest.errorMessage);
+  const count = sameMode.length;
+  const tail = count > 1 ? ` (${count} recorded incidents)` : " (1 recorded incident)";
+  const reasonParts = [`${latest.service}: ${latest.errorMessage}`];
+  if (location) reasonParts.push(`surfaced at ${location}`);
+  const rootCauseReason = `${reasonParts.join(" \u2014 ")}${tail}`;
+  const localizesToFile = latest.affectedNode !== nodeId && latest.affectedNode.startsWith("file:");
+  const fileNode = localizesToFile ? latest.affectedNode : void 0;
+  const fixRecommendation = location ? `Inspect ${location}${route ? ` handling ${route}` : ""}` : route ? `Inspect ${latest.service}'s handler for ${route}` : void 0;
+  return {
+    rootCauseNode: fileNode ?? nodeId,
+    rootCauseReason,
+    ...fileNode ? { fileNode } : {},
+    ...fixRecommendation ? { fixRecommendation } : {}
+  };
+}
+function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
+  const loc = localizeFromIncidents(nodeId, incidents, errorEvent);
+  if (!loc) return null;
+  const traversalPath = loc.fileNode ? [nodeId, loc.fileNode] : [nodeId];
+  const edgeProvenances = loc.fileNode ? [import_types.Provenance.OBSERVED] : [];
+  return import_types.RootCauseResultSchema.parse({
+    rootCauseNode: loc.rootCauseNode,
+    rootCauseReason: loc.rootCauseReason,
+    traversalPath,
+    edgeProvenances,
+    confidence: INCIDENT_ROOT_CAUSE_CONFIDENCE,
+    ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+  });
+}
+function isFailingCallEdge(e) {
+  return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
+}
+function callSourcesForService(graph, serviceId3) {
+  const ids = [serviceId3];
+  for (const edgeId of graph.outboundEdges(serviceId3)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== import_types.EdgeType.CONTAINS) continue;
+    const tgt = graph.getNodeAttributes(e.target);
+    if (tgt.type === import_types.NodeType.FileNode) ids.push(e.target);
+  }
+  return ids;
+}
+function failingCallDominates(e, id, curEdge, curId) {
+  const ec = e.signal?.errorCount ?? 0;
+  const cc = curEdge.signal?.errorCount ?? 0;
+  if (ec !== cc) return ec > cc;
+  if (import_types.PROV_RANK[e.provenance] !== import_types.PROV_RANK[curEdge.provenance]) {
+    return import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[curEdge.provenance];
+  }
+  return id < curId;
+}
+function dominantFailingCall(graph, serviceId3, visited) {
+  let best = null;
+  for (const src of callSourcesForService(graph, serviceId3)) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (!isFailingCallEdge(e)) continue;
+      if (isFrontierNode(graph, e.target)) continue;
+      const owner = resolveOwningService(graph, e.target);
+      if (!owner || visited.has(owner.id)) continue;
+      if (!best || failingCallDominates(e, owner.id, best.edge, best.nextService)) {
+        best = { nextService: owner.id, edge: e };
+      }
+    }
+  }
+  return best;
+}
+function followFailingCallChain(graph, originServiceId, maxDepth) {
+  const path43 = [originServiceId];
+  const edges = [];
+  const visited = /* @__PURE__ */ new Set([originServiceId]);
+  let current = originServiceId;
+  for (let depth = 0; depth < maxDepth; depth++) {
+    const hop = dominantFailingCall(graph, current, visited);
+    if (!hop) break;
+    path43.push(hop.nextService);
+    edges.push(hop.edge);
+    visited.add(hop.nextService);
+    current = hop.nextService;
+  }
+  if (edges.length === 0) return null;
+  return { path: path43, edges, culprit: current };
+}
+function crossServiceRootCause(graph, originId, incidents, errorEvent) {
+  const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
+  if (!chain) return null;
+  const culprit = chain.culprit;
+  const path43 = [...chain.path];
+  const edgeProvenances = chain.edges.map((e) => e.provenance);
+  const baseConfidence = confidenceFromMix(chain.edges);
+  const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
+  const loc = localizeFromIncidents(culprit, incidents, errorEvent);
+  if (loc) {
+    let rootCauseNode = culprit;
+    if (loc.fileNode) {
+      path43.push(loc.fileNode);
+      edgeProvenances.push(import_types.Provenance.OBSERVED);
+      rootCauseNode = loc.fileNode;
+    }
+    return import_types.RootCauseResultSchema.parse({
+      rootCauseNode,
+      rootCauseReason: loc.rootCauseReason,
+      traversalPath: path43,
+      edgeProvenances,
+      confidence,
+      ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+    });
+  }
+  const lastEdge = chain.edges[chain.edges.length - 1];
+  const errs = lastEdge.signal?.errorCount ?? 0;
+  const culpritName = culprit.replace(/^service:/, "");
   return import_types.RootCauseResultSchema.parse({
-    rootCauseNode: match.rootCauseNode,
-    rootCauseReason: reason,
-    traversalPath: walk.path,
-    edgeProvenances: walk.edges.map((e) => e.provenance),
-    confidence: confidenceFromMix(walk.edges),
-    fixRecommendation: match.fixRecommendation
+    rootCauseNode: culprit,
+    rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
+    traversalPath: path43,
+    edgeProvenances,
+    confidence,
+    fixRecommendation: `Inspect ${culpritName}'s failing handler`
   });
 }
 function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
@@ -1496,14 +1638,14 @@ function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
       });
     }
     if (frame.distance >= maxDepth) continue;
-    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
-    for (const [tgtId, edge] of outgoing) {
-      if (enqueued.has(tgtId)) continue;
-      enqueued.add(tgtId);
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(frame.nodeId));
+    for (const [srcId, edge] of incoming) {
+      if (enqueued.has(srcId)) continue;
+      enqueued.add(srcId);
       queue.push({
-        nodeId: tgtId,
+        nodeId: srcId,
         distance: frame.distance + 1,
-        path: [...frame.path, tgtId],
+        path: [...frame.path, srcId],
         pathEdges: [...frame.pathEdges, edge]
       });
     }
@@ -1559,6 +1701,62 @@ function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIE
     total: dependencies.length
   });
 }
+function getObservedDependencies(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) {
+    return import_types.ObservedDependenciesResultSchema.parse({
+      origin: nodeId,
+      dependencies: [],
+      observed: false,
+      inboundObservedCount: 0,
+      hasExtractedOutbound: false
+    });
+  }
+  const attrs = graph.getNodeAttributes(nodeId);
+  const scope = [nodeId];
+  if (attrs.type === import_types.NodeType.ServiceNode) {
+    for (const edgeId of graph.outboundEdges(nodeId)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== import_types.EdgeType.CONTAINS) continue;
+      const owned = graph.getNodeAttributes(e.target);
+      if (owned.type === import_types.NodeType.FileNode) scope.push(e.target);
+    }
+  }
+  const dependencies = [];
+  const seenEdge = /* @__PURE__ */ new Set();
+  let hasExtractedOutbound = false;
+  for (const src of scope) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (e.provenance === import_types.Provenance.OBSERVED) {
+        if (!seenEdge.has(e.id)) {
+          seenEdge.add(e.id);
+          dependencies.push(e);
+        }
+      } else if (e.provenance === import_types.Provenance.EXTRACTED) {
+        hasExtractedOutbound = true;
+      }
+    }
+  }
+  let inboundObservedCount = 0;
+  for (const tgt of scope) {
+    for (const edgeId of graph.inboundEdges(tgt)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (e.provenance === import_types.Provenance.OBSERVED) inboundObservedCount += 1;
+    }
+  }
+  dependencies.sort(
+    (a, b) => a.target.localeCompare(b.target) || a.source.localeCompare(b.source) || a.id.localeCompare(b.id)
+  );
+  return import_types.ObservedDependenciesResultSchema.parse({
+    origin: nodeId,
+    dependencies,
+    observed: dependencies.length > 0 || inboundObservedCount > 0,
+    inboundObservedCount,
+    hasExtractedOutbound
+  });
+}
 
 // src/divergences.ts
 function bucketKey(source, target, type) {
@@ -1611,10 +1809,16 @@ function gradedConfidence(edge) {
   if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
   return clampConfidence(confidenceForEdge(edge));
 }
+var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
+  import_types2.EdgeType.CALLS,
+  import_types2.EdgeType.CONNECTS_TO,
+  import_types2.EdgeType.PUBLISHES_TO,
+  import_types2.EdgeType.CONSUMES_FROM
+]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
   if (bucket.type === import_types2.EdgeType.CONTAINS) return out;
-  if (bucket.extracted && !bucket.observed) {
+  if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
       out.push({
         type: "missing-observed",
@@ -1748,6 +1952,23 @@ function detectCompatDivergences(graph, svcId, svc) {
 function involvesNode(d, nodeId) {
   return d.source === nodeId || d.target === nodeId;
 }
+function suppressHostMismatchHalves(all) {
+  const observedHalf = /* @__PURE__ */ new Set();
+  const declaredHalf = /* @__PURE__ */ new Set();
+  for (const d of all) {
+    if (d.type !== "host-mismatch") continue;
+    observedHalf.add(`${d.source}->${d.target}`);
+    declaredHalf.add((0, import_types2.databaseId)(d.extractedHost));
+  }
+  if (observedHalf.size === 0) return all;
+  return all.filter((d) => {
+    if (d.type === "missing-extracted" && observedHalf.has(`${d.source}->${d.target}`)) {
+      return false;
+    }
+    if (d.type === "missing-observed" && declaredHalf.has(d.target)) return false;
+    return true;
+  });
+}
 function computeDivergences(graph, opts = {}) {
   const all = [];
   const buckets = bucketEdges(graph);
@@ -1761,7 +1982,8 @@ function computeDivergences(graph, opts = {}) {
     for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
     for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
   });
-  let filtered = all;
+  const reconciled = suppressHostMismatchHalves(all);
+  let filtered = reconciled;
   if (opts.type) {
     const allowed = opts.type;
     filtered = filtered.filter((d) => allowed.has(d.type));
@@ -2082,6 +2304,130 @@ function evaluateAllPolicies(graph, policies, ctx) {
   }
   return out;
 }
+function selectApplicablePolicies(graph, policies, nodeId) {
+  if (!graph.hasNode(nodeId)) return [];
+  const node = graph.getNodeAttributes(nodeId);
+  const out = [];
+  for (const policy of policies) {
+    const m = matchPolicyToNode(graph, policy, nodeId, node);
+    if (!m) continue;
+    out.push({
+      policyId: policy.id,
+      policyName: policy.name,
+      ...policy.description !== void 0 ? { description: policy.description } : {},
+      severity: policy.severity,
+      onViolation: resolveOnViolation(policy),
+      ruleType: policy.rule.type,
+      match: m.match,
+      reason: m.reason
+    });
+  }
+  return out;
+}
+function requiredProvenanceList(required) {
+  if (Array.isArray(required)) return required.join(" | ");
+  return String(required);
+}
+function nodeTouchesEdgeType(graph, nodeId, edgeType, requiredOtherEnd) {
+  const incident = [...graph.outboundEdges(nodeId), ...graph.inboundEdges(nodeId)];
+  for (const edgeId of incident) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== edgeType) continue;
+    if (requiredOtherEnd === void 0) return true;
+    if (e.source === requiredOtherEnd || e.target === requiredOtherEnd) return true;
+  }
+  return false;
+}
+function blastRadiusSubjectReaching(graph, rule, nodeId) {
+  let found = null;
+  graph.forEachNode((subjId, attrs) => {
+    if (found !== null) return;
+    if (subjId === nodeId) return;
+    if (attrs.type !== rule.nodeType) return;
+    const radius = rule.depth !== void 0 ? getBlastRadius(graph, subjId, rule.depth) : getBlastRadius(graph, subjId);
+    if (radius.affectedNodes.some((n) => n.nodeId === nodeId)) found = subjId;
+  });
+  return found;
+}
+function matchPolicyToNode(graph, policy, nodeId, node) {
+  const rule = policy.rule;
+  switch (rule.type) {
+    case "structural": {
+      if (node.type === rule.fromNodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.fromNodeType} must have a ${rule.edgeType} edge to a ${rule.toNodeType}`
+        };
+      }
+      if (node.type === rule.toNodeType) {
+        return {
+          match: "region",
+          reason: `${rule.fromNodeType} nodes must reach a ${rule.toNodeType} like this one via a ${rule.edgeType} edge`
+        };
+      }
+      return null;
+    }
+    case "ownership": {
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.nodeType} must declare a non-empty "${rule.field}" field`
+        };
+      }
+      return null;
+    }
+    case "blast-radius": {
+      const depthLabel = rule.depth !== void 0 ? ` at depth ${rule.depth}` : "";
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `no ${rule.nodeType} may exceed a blast radius of ${rule.maxAffected}${depthLabel}`
+        };
+      }
+      const subject = blastRadiusSubjectReaching(graph, rule, nodeId);
+      if (subject) {
+        return {
+          match: "region",
+          reason: `this node is in the blast radius of ${subject} (a ${rule.nodeType} held to a blast radius of ${rule.maxAffected}${depthLabel}) \u2014 it breaks if that ${rule.nodeType} changes`
+        };
+      }
+      return null;
+    }
+    case "compatibility": {
+      const kindLabel = rule.kind ?? "all compat shapes";
+      if (node.type === import_types3.NodeType.ServiceNode) {
+        return {
+          match: "subject",
+          reason: `this service's dependencies are compatibility-checked (${kindLabel})`
+        };
+      }
+      const reachesDriverEngine = rule.kind === void 0 || rule.kind === "driver-engine";
+      if (reachesDriverEngine && node.type === import_types3.NodeType.DatabaseNode && nodeTouchesEdgeType(graph, nodeId, import_types3.EdgeType.CONNECTS_TO)) {
+        return {
+          match: "region",
+          reason: "services connecting to this database have their driver/engine compatibility checked against it"
+        };
+      }
+      return null;
+    }
+    case "provenance": {
+      const requiredList = requiredProvenanceList(rule.required);
+      if (rule.targetNodeId !== void 0 && nodeId === rule.targetNodeId) {
+        return {
+          match: "subject",
+          reason: `every ${rule.edgeType} edge into ${rule.targetNodeId} must carry ${requiredList} provenance`
+        };
+      }
+      if (nodeTouchesEdgeType(graph, nodeId, rule.edgeType, rule.targetNodeId)) {
+        return {
+          match: "region",
+          reason: rule.targetNodeId !== void 0 ? `this node sits on a ${rule.edgeType} edge to ${rule.targetNodeId}, which must carry ${requiredList} provenance` : `this node sits on a ${rule.edgeType} edge, which must carry ${requiredList} provenance`
+        };
+      }
+      return null;
+    }
+  }
+}
 async function loadPolicyFile(policyPath) {
   let raw;
   try {
@@ -2200,9 +2546,9 @@ function loadIncidentThresholdsFromEnv() {
     return DEFAULT_INCIDENT_THRESHOLDS;
   }
 }
-function httpResponseStatus(span) {
+function httpResponseStatusFromAttrs(attrs) {
   for (const key of ["http.response.status_code", "http.status_code"]) {
-    const v = span.attributes[key];
+    const v = attrs[key];
     if (typeof v === "number" && Number.isFinite(v)) return v;
     if (typeof v === "string") {
       const n = Number(v);
@@ -2211,6 +2557,63 @@ function httpResponseStatus(span) {
   }
   return void 0;
 }
+function httpResponseStatus(span) {
+  return httpResponseStatusFromAttrs(span.attributes);
+}
+function httpFailureMessageFromAttrs(attrs) {
+  const status2 = httpResponseStatusFromAttrs(attrs);
+  const route = pickAttrFrom(attrs, "http.route", "http.target", "url.path");
+  const method = pickAttrFrom(attrs, "http.request.method", "http.method");
+  const where = route ? `${method ? `${method} ` : ""}${route}` : void 0;
+  if (status2 !== void 0 && where) return `${status2} on ${where}`;
+  if (status2 !== void 0) return `HTTP ${status2}`;
+  if (where) return `error on ${where}`;
+  return void 0;
+}
+var GRPC_STATUS_NAMES = {
+  1: "CANCELLED",
+  2: "UNKNOWN",
+  3: "INVALID_ARGUMENT",
+  4: "DEADLINE_EXCEEDED",
+  5: "NOT_FOUND",
+  6: "ALREADY_EXISTS",
+  7: "PERMISSION_DENIED",
+  8: "RESOURCE_EXHAUSTED",
+  9: "FAILED_PRECONDITION",
+  10: "ABORTED",
+  11: "OUT_OF_RANGE",
+  12: "UNIMPLEMENTED",
+  13: "INTERNAL",
+  14: "UNAVAILABLE",
+  15: "DATA_LOSS",
+  16: "UNAUTHENTICATED"
+};
+function grpcStatusCodeFromAttrs(attrs) {
+  const v = attrs["rpc.grpc.status_code"];
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string") {
+    const n = Number(v);
+    if (Number.isFinite(n)) return n;
+  }
+  return void 0;
+}
+function nonHttpFailureMessageFromAttrs(attrs) {
+  const grpc2 = grpcStatusCodeFromAttrs(attrs);
+  if (grpc2 !== void 0 && grpc2 !== 0) {
+    const name = GRPC_STATUS_NAMES[grpc2] ?? `status ${grpc2}`;
+    const detail = pickAttrFrom(attrs, "rpc.grpc.status_message");
+    return detail ? `gRPC ${name}: ${detail}` : `gRPC ${name}`;
+  }
+  const errType = pickAttrFrom(attrs, "error.type");
+  if (errType && errType !== "_OTHER" && !/^\d+$/.test(errType)) {
+    const peer = pickAttrFrom(attrs, "server.address", "net.peer.name", "net.host.name");
+    return peer ? `${errType} connecting to ${peer}` : errType;
+  }
+  return void 0;
+}
+function incidentMessage(span) {
+  return span.exception?.message ?? httpFailureMessageFromAttrs(span.attributes) ?? nonHttpFailureMessageFromAttrs(span.attributes) ?? "unknown error";
+}
 function nowIso(ctx) {
   return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
 }
@@ -2230,13 +2633,16 @@ function warnNoSourceMaps(serviceName) {
     `[neat] ${serviceName}: no .map files found under dist/; observed file edges will land on dist paths, not src. Set sourceMap: true in tsconfig to enable file-level reconciliation.`
   );
 }
-function pickAttr(span, ...keys) {
+function pickAttrFrom(attrs, ...keys) {
   for (const k of keys) {
-    const v = span.attributes[k];
+    const v = attrs[k];
     if (typeof v === "string" && v.length > 0) return v;
   }
   return void 0;
 }
+function pickAttr(span, ...keys) {
+  return pickAttrFrom(span.attributes, ...keys);
+}
 function hostFromUrl(u) {
   if (!u) return void 0;
   try {
@@ -2248,6 +2654,10 @@ function hostFromUrl(u) {
 function pickAddress(span) {
   return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
 }
+function isLoopbackHost(host) {
+  const h = host.toLowerCase();
+  return h === "localhost" || h === "ip6-localhost" || h === "::1" || h === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(h);
+}
 var CODE_FILEPATH_ATTR = "code.filepath";
 var CODE_LINENO_ATTR = "code.lineno";
 var CODE_FUNCTION_ATTR = "code.function";
@@ -2355,15 +2765,31 @@ function callSiteFromSpan(span, serviceNode, scanPath) {
     ...originalRelPath && originalRelPath !== relPath ? { originalRelPath } : {}
   };
 }
+function reconcileObservedRelPath(graph, serviceName, relPath) {
+  if (graph.hasNode((0, import_types4.fileId)(serviceName, relPath))) return relPath;
+  let best = null;
+  graph.forEachNode((_id, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types4.NodeType.FileNode || a.service !== serviceName) return;
+    if (a.discoveredVia === "otel") return;
+    const p = a.path;
+    if (!p) return;
+    if ((relPath === p || relPath.endsWith(`/${p}`)) && (!best || p.length > best.length)) {
+      best = p;
+    }
+  });
+  return best ?? relPath;
+}
 function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
-  const fileNodeId = (0, import_types4.fileId)(serviceName, callSite.relPath);
+  const relPath = reconcileObservedRelPath(graph, serviceName, callSite.relPath);
+  const fileNodeId = (0, import_types4.fileId)(serviceName, relPath);
   if (!graph.hasNode(fileNodeId)) {
-    const language = languageForExt(callSite.relPath);
+    const language = languageForExt(relPath);
     const node = {
       id: fileNodeId,
       type: import_types4.NodeType.FileNode,
       service: serviceName,
-      path: callSite.relPath,
+      path: relPath,
       ...language ? { language } : {},
       ...callSite.originalRelPath ? { originalPath: callSite.originalRelPath } : {},
       discoveredVia: "otel"
@@ -2391,6 +2817,11 @@ function makeInferredEdgeId(type, source, target) {
 }
 var INFERRED_CONFIDENCE = 0.6;
 var STITCH_MAX_DEPTH = 2;
+var STITCH_EDGE_TYPES = /* @__PURE__ */ new Set([
+  import_types4.EdgeType.CALLS,
+  import_types4.EdgeType.CONNECTS_TO,
+  import_types4.EdgeType.DEPENDS_ON
+]);
 var WIRE_SPAN_KIND_CLIENT = 3;
 var WIRE_SPAN_KIND_PRODUCER = 4;
 function spanMintsObservedEdge(kind) {
@@ -2564,6 +2995,7 @@ function stitchTrace(graph, sourceServiceId, ts) {
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
       if (edge.provenance !== import_types4.Provenance.EXTRACTED) continue;
+      if (!STITCH_EDGE_TYPES.has(edge.type)) continue;
       if (graph.hasEdge((0, import_types4.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
       if (!visited.has(edge.target)) {
@@ -2596,6 +3028,16 @@ async function appendErrorEvent(ctx, ev) {
   await import_node_fs5.promises.mkdir(import_node_path5.default.dirname(ctx.errorsPath), { recursive: true });
   await import_node_fs5.promises.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
 }
+function incidentAffectedNode(span, graph, scanPath) {
+  const sid = (0, import_types4.serviceId)(span.service, span.env);
+  const serviceNode = graph && graph.hasNode(sid) ? graph.getNodeAttributes(sid) : void 0;
+  const callSite = callSiteFromSpan(span, serviceNode, scanPath);
+  if (callSite) {
+    const relPath = graph ? reconcileObservedRelPath(graph, span.service, callSite.relPath) : callSite.relPath;
+    return (0, import_types4.fileId)(span.service, relPath);
+  }
+  return sid;
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
@@ -2626,6 +3068,22 @@ async function recordFailingResponseIncident(ctx, span, affectedNode, timestamp,
   };
   await appendErrorEvent(ctx, ev);
 }
+async function recordExceptionIncident(ctx, span, ts) {
+  const attrs = sanitizeAttributes(span.attributes);
+  const ev = {
+    id: `${span.traceId}:${span.spanId}`,
+    timestamp: ts,
+    service: span.service,
+    traceId: span.traceId,
+    spanId: span.spanId,
+    errorMessage: incidentMessage(span),
+    ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+    ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+    ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
+    affectedNode: incidentAffectedNode(span, ctx.graph, ctx.scanPath)
+  };
+  await appendErrorEvent(ctx, ev);
+}
 async function advance4xxBurst(ctx, span, affectedNode, ts, nowMs, status2) {
   const { threshold, windowMs } = loadIncidentThresholdsFromEnv();
   if (!ctx.burstState) ctx.burstState = /* @__PURE__ */ new Map();
@@ -2682,7 +3140,10 @@ async function handleSpan(ctx, span) {
   const callSite = callSiteFromSpan(span, sourceServiceNode, ctx.scanPath);
   cacheSpanService(span, nowMs, callSite);
   const observedSource = () => callSite ? ensureObservedFileNode(ctx.graph, span.service, sourceId, callSite) : sourceId;
-  const callSiteEvidence = callSite ? { file: callSite.relPath, ...callSite.line !== void 0 ? { line: callSite.line } : {} } : void 0;
+  const callSiteEvidence = callSite ? {
+    file: reconcileObservedRelPath(ctx.graph, span.service, callSite.relPath),
+    ...callSite.line !== void 0 ? { line: callSite.line } : {}
+  } : void 0;
   let affectedNode = sourceId;
   const mintsFromCallerSide = spanMintsObservedEdge(span.kind);
   if (span.dbSystem) {
@@ -2704,7 +3165,7 @@ async function handleSpan(ctx, span) {
   } else {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
-    if (mintsFromCallerSide && host && host !== span.service) {
+    if (mintsFromCallerSide && host && host !== span.service && !isLoopbackHost(host)) {
       const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
@@ -2739,7 +3200,11 @@ async function handleSpan(ctx, span) {
         const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         const fallbackSource = parent.callSite ? ensureObservedFileNode(ctx.graph, parent.service, parentId, parent.callSite) : parentId;
         const fallbackEvidence = parent.callSite ? {
-          file: parent.callSite.relPath,
+          file: reconcileObservedRelPath(
+            ctx.graph,
+            parent.service,
+            parent.callSite.relPath
+          ),
           ...parent.callSite.line !== void 0 ? { line: parent.callSite.line } : {}
         } : void 0;
         upsertObservedEdge(
@@ -2764,7 +3229,7 @@ async function handleSpan(ctx, span) {
         service: span.service,
         traceId: span.traceId,
         spanId: span.spanId,
-        errorMessage: span.exception?.message ?? "unknown error",
+        errorMessage: incidentMessage(span),
         ...span.exception?.type ? { exceptionType: span.exception.type } : {},
         ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
         ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
@@ -2775,7 +3240,9 @@ async function handleSpan(ctx, span) {
   }
   if (span.statusCode !== 2) {
     const status2 = httpResponseStatus(span);
-    if (status2 !== void 0 && status2 >= 500) {
+    if (span.exception) {
+      await recordExceptionIncident(ctx, span, ts);
+    } else if (status2 !== void 0 && status2 >= 500) {
       await recordFailingResponseIncident(ctx, span, sourceId, ts, status2, 1);
     } else if (status2 !== void 0 && status2 >= 400 && spanMintsObservedEdge(span.kind)) {
       await advance4xxBurst(ctx, span, sourceId, ts, nowMs, status2);
@@ -2940,12 +3407,43 @@ function startStalenessLoop(graph, options = {}) {
 async function readErrorEvents(errorsPath) {
   try {
     const raw = await import_node_fs5.promises.readFile(errorsPath, "utf8");
-    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    return dedupeIncidents(events);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
 }
+function isSynthesizedHttpIncident(ev) {
+  if (ev.exceptionType || ev.exceptionStacktrace) return false;
+  if (ev.errorType) return false;
+  if (!ev.attributes) return false;
+  const synth = httpFailureMessageFromAttrs(ev.attributes);
+  return synth !== void 0 && synth === ev.errorMessage;
+}
+function dedupeIncidents(events) {
+  const seen = /* @__PURE__ */ new Set();
+  const once = [];
+  for (const ev of events) {
+    const key = ev.id ?? (ev.traceId && ev.spanId ? `${ev.traceId}:${ev.spanId}` : void 0);
+    if (key === void 0) {
+      once.push(ev);
+      continue;
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    once.push(ev);
+  }
+  const groupKey = (ev) => `${ev.traceId}\0${ev.affectedNode}`;
+  const hasRealFailure = /* @__PURE__ */ new Set();
+  for (const ev of once) {
+    if (ev.traceId && !isSynthesizedHttpIncident(ev)) hasRealFailure.add(groupKey(ev));
+  }
+  return once.filter((ev) => {
+    if (!ev.traceId || !isSynthesizedHttpIncident(ev)) return true;
+    return !hasRealFailure.has(groupKey(ev));
+  });
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
   let nodesAdded = 0;
@@ -3026,10 +3524,17 @@ function isConfigFile(name) {
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
   if (name === ".env" || name.startsWith(".env.")) {
     if (isEnvTemplateFile(name)) return { match: false, fileType: "" };
+    if (isNeatAuthoredEnvFile(name)) return { match: false, fileType: "" };
     return { match: true, fileType: "env" };
   }
   return { match: false, fileType: "" };
 }
+function isNeatAuthoredEnvFile(name) {
+  return name === ".env.neat";
+}
+function isNeatAuthoredSourceFile(name) {
+  return /^otel-init\.(?:js|cjs|mjs|ts|tsx)$/i.test(name);
+}
 function isTestPath(filePath) {
   const normalised = filePath.replace(/\\/g, "/");
   const segments = normalised.split("/");
@@ -3723,7 +4228,9 @@ async function walkSourceFiles(dir) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk(full);
-      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path12.default.extname(entry.name))) {
+      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path12.default.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
+      // would attribute our instrumentation imports to the user's service.
+      !isNeatAuthoredSourceFile(entry.name)) {
         out.push(full);
       }
     }
@@ -3893,11 +4400,28 @@ function collectJsImports(node, out) {
     if (child) collectJsImports(child, out);
   }
 }
+function collectImportedNames(node, out) {
+  if (node.type === "aliased_import") {
+    const nameNode = node.childForFieldName("name");
+    if (nameNode) out.push(nameNode.text);
+    return;
+  }
+  if (node.type === "dotted_name") {
+    out.push(node.text);
+    return;
+  }
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child) collectImportedNames(child, out);
+  }
+}
 function collectPyImports(node, out) {
   if (node.type === "import_from_statement") {
     let level = 0;
     let modulePath = "";
+    const names = [];
     let pastFrom = false;
+    let pastImport = false;
     for (let i = 0; i < node.childCount; i++) {
       const child = node.child(i);
       if (!child) continue;
@@ -3905,26 +4429,30 @@ function collectPyImports(node, out) {
         if (child.type === "from") pastFrom = true;
         continue;
       }
-      if (child.type === "import") break;
-      if (child.type === "relative_import") {
-        for (let j = 0; j < child.childCount; j++) {
-          const rc = child.child(j);
-          if (!rc) continue;
-          if (rc.type === "import_prefix") {
-            for (let k = 0; k < rc.childCount; k++) {
-              if (rc.child(k)?.type === ".") level++;
-            }
-          } else if (rc.type === "dotted_name") modulePath = rc.text;
+      if (!pastImport) {
+        if (child.type === "import") {
+          pastImport = true;
+          continue;
         }
-        break;
-      }
-      if (child.type === "dotted_name") {
-        modulePath = child.text;
-        break;
+        if (child.type === "relative_import") {
+          for (let j = 0; j < child.childCount; j++) {
+            const rc = child.child(j);
+            if (!rc) continue;
+            if (rc.type === "import_prefix") {
+              for (let k = 0; k < rc.childCount; k++) {
+                if (rc.child(k)?.type === ".") level++;
+              }
+            } else if (rc.type === "dotted_name") modulePath = rc.text;
+          }
+        } else if (child.type === "dotted_name") {
+          modulePath = child.text;
+        }
+        continue;
       }
+      collectImportedNames(child, names);
     }
     if (level > 0 || modulePath) {
-      out.push({ modulePath, level, line: node.startPosition.row + 1, snippet: clipSnippet(node.text) });
+      out.push({ modulePath, level, names, line: node.startPosition.row + 1, snippet: clipSnippet(node.text) });
     }
   }
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4026,8 +4554,6 @@ async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
   return null;
 }
 async function resolvePyImport(imp, importerPath, serviceDir) {
-  if (!imp.modulePath) return null;
-  const relPath = imp.modulePath.split(".").join("/");
   let baseDir;
   if (imp.level > 0) {
     baseDir = import_node_path14.default.dirname(importerPath);
@@ -4035,13 +4561,30 @@ async function resolvePyImport(imp, importerPath, serviceDir) {
   } else {
     baseDir = serviceDir;
   }
-  const candidates = [import_node_path14.default.join(baseDir, `${relPath}.py`), import_node_path14.default.join(baseDir, relPath, "__init__.py")];
-  for (const candidate of candidates) {
-    if (isWithinServiceDir(candidate, serviceDir) && await fileExists2(candidate)) {
-      return toPosix2(import_node_path14.default.relative(serviceDir, candidate));
+  const moduleBase = imp.modulePath ? import_node_path14.default.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
+  const resolved = /* @__PURE__ */ new Set();
+  let needModuleFile = imp.names.length === 0;
+  for (const name of imp.names) {
+    const submoduleFile = import_node_path14.default.join(moduleBase, `${name}.py`);
+    const subpackageInit = import_node_path14.default.join(moduleBase, name, "__init__.py");
+    if (isWithinServiceDir(submoduleFile, serviceDir) && await fileExists2(submoduleFile)) {
+      resolved.add(toPosix2(import_node_path14.default.relative(serviceDir, submoduleFile)));
+    } else if (isWithinServiceDir(subpackageInit, serviceDir) && await fileExists2(subpackageInit)) {
+      resolved.add(toPosix2(import_node_path14.default.relative(serviceDir, subpackageInit)));
+    } else {
+      needModuleFile = true;
+    }
+  }
+  if (needModuleFile) {
+    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, import_node_path14.default.join(moduleBase, "__init__.py")] : [import_node_path14.default.join(moduleBase, "__init__.py")];
+    for (const candidate of moduleFileCandidates) {
+      if (isWithinServiceDir(candidate, serviceDir) && await fileExists2(candidate)) {
+        resolved.add(toPosix2(import_node_path14.default.relative(serviceDir, candidate)));
+        break;
+      }
     }
   }
-  return null;
+  return [...resolved];
 }
 function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, importeeRelPath, line, snippet2) {
   const importeeFileId = (0, import_types9.fileId)(serviceName, importeeRelPath);
@@ -4082,17 +4625,18 @@ async function addImports(graph, services) {
           continue;
         }
         for (const imp of pyImports) {
-          const resolved = await resolvePyImport(imp, file.path, service.dir);
-          if (!resolved) continue;
-          edgesAdded += emitImportEdge(
-            graph,
-            service.pkg.name,
-            importerFileId,
-            relFile,
-            resolved,
-            imp.line,
-            imp.snippet
-          );
+          const resolvedPaths = await resolvePyImport(imp, file.path, service.dir);
+          for (const resolved of resolvedPaths) {
+            edgesAdded += emitImportEdge(
+              graph,
+              service.pkg.name,
+              importerFileId,
+              relFile,
+              resolved,
+              imp.line,
+              imp.snippet
+            );
+          }
         }
         continue;
       }
@@ -4728,6 +5272,36 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         edgesAdded++;
       }
     }
+    if (allConfigs.length === 1) {
+      const primary = allConfigs[0];
+      service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
+      const relPath = import_node_path22.default.relative(scanPath, primary.sourceFile);
+      const cfgId = (0, import_types10.configId)(relPath);
+      if (!graph.hasNode(cfgId)) {
+        const cfgNode = {
+          id: cfgId,
+          type: import_types10.NodeType.ConfigNode,
+          name: import_node_path22.default.basename(primary.sourceFile),
+          path: relPath,
+          fileType: isConfigFile(import_node_path22.default.basename(primary.sourceFile)).fileType || "config"
+        };
+        graph.addNode(cfgId, cfgNode);
+        nodesAdded++;
+      }
+      const cfgEdge = {
+        id: (0, import_types5.extractedEdgeId)(service.node.id, cfgId, import_types10.EdgeType.CONFIGURED_BY),
+        source: service.node.id,
+        target: cfgId,
+        type: import_types10.EdgeType.CONFIGURED_BY,
+        provenance: import_types10.Provenance.EXTRACTED,
+        confidence: (0, import_types10.confidenceForExtracted)("structural"),
+        evidence: { file: toPosix2(relPath) }
+      };
+      if (!graph.hasEdge(cfgEdge.id)) {
+        graph.addEdgeWithKey(cfgEdge.id, cfgEdge.source, cfgEdge.target, cfgEdge);
+        edgesAdded++;
+      }
+    }
     attachIncompatibilities(service, allConfigs);
     if (graph.hasNode(service.node.id)) {
       const current = graph.getNodeAttributes(service.node.id);
@@ -4739,6 +5313,9 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       if (!service.node.incompatibilities || service.node.incompatibilities.length === 0) {
         delete updated.incompatibilities;
       }
+      if (!service.node.dbConnectionTarget) {
+        delete updated.dbConnectionTarget;
+      }
       graph.replaceNodeAttributes(service.node.id, updated);
     }
   }
@@ -4916,7 +5493,7 @@ async function addHttpCallEdges(graph, services) {
         const dedupKey = `${relFile}|${targetId}`;
         if (seen.has(dedupKey)) continue;
         seen.add(dedupKey);
-        const confidence = (0, import_types12.confidenceForExtracted)("hostname-shape-match");
+        const confidence = (0, import_types12.confidenceForExtracted)("url-literal-service-target");
         const ev = {
           file: relFile,
           line: site.line,
@@ -4936,7 +5513,7 @@ async function addHttpCallEdges(graph, services) {
             target: targetId,
             type: import_types12.EdgeType.CALLS,
             confidence,
-            confidenceKind: "hostname-shape-match",
+            confidenceKind: "url-literal-service-target",
             evidence: ev
           });
           continue;
@@ -5442,19 +6019,29 @@ init_cjs_shims();
 var import_node_path31 = __toESM(require("path"), 1);
 var import_node_fs17 = require("fs");
 var import_types21 = require("@neat.is/types");
-function runtimeImage(content) {
-  const lines = content.split("\n");
-  let last = null;
-  for (const raw of lines) {
+function readDockerfile(content) {
+  let image = null;
+  const ports = [];
+  let cmd = null;
+  let entrypoint = null;
+  for (const raw of content.split("\n")) {
     const line = raw.trim();
     if (!line || line.startsWith("#")) continue;
-    if (!/^from\s+/i.test(line)) continue;
-    const tokens = line.split(/\s+/);
-    const image = tokens[1];
-    if (!image || image.toLowerCase() === "scratch") continue;
-    last = image;
+    if (/^from\s+/i.test(line)) {
+      const candidate = line.split(/\s+/)[1];
+      if (candidate && candidate.toLowerCase() !== "scratch") image = candidate;
+    } else if (/^expose\s+/i.test(line)) {
+      for (const token of line.split(/\s+/).slice(1)) {
+        const port = Number.parseInt(token.split("/")[0], 10);
+        if (Number.isInteger(port) && !ports.includes(port)) ports.push(port);
+      }
+    } else if (/^entrypoint\s+/i.test(line)) {
+      entrypoint = line;
+    } else if (/^cmd\s+/i.test(line)) {
+      cmd = line;
+    }
   }
-  return last;
+  return { image, ports, entrypoint: entrypoint ?? cmd };
 }
 async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
@@ -5473,14 +6060,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       );
       continue;
     }
-    const image = runtimeImage(content);
-    if (!image) continue;
-    const node = makeInfraNode("container-image", image);
+    const facts = readDockerfile(content);
+    if (!facts.image) continue;
+    const node = makeInfraNode("container-image", facts.image);
     if (!graph.hasNode(node.id)) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
     const relDockerfile = toPosix2(import_node_path31.default.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix2(import_node_path31.default.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -5499,12 +6087,33 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         provenance: import_types21.Provenance.EXTRACTED,
         confidence: (0, import_types21.confidenceForExtracted)("structural"),
         evidence: {
-          file: toPosix2(import_node_path31.default.relative(scanPath, dockerfilePath))
+          file: evidenceFile,
+          ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
         }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
       edgesAdded++;
     }
+    for (const port of facts.ports) {
+      const portNode = makeInfraNode("port", String(port));
+      if (!graph.hasNode(portNode.id)) {
+        graph.addNode(portNode.id, portNode);
+        nodesAdded++;
+      }
+      const portEdgeId = (0, import_types5.extractedEdgeId)(fileNodeId, portNode.id, import_types21.EdgeType.CONNECTS_TO);
+      if (graph.hasEdge(portEdgeId)) continue;
+      const portEdge = {
+        id: portEdgeId,
+        source: fileNodeId,
+        target: portNode.id,
+        type: import_types21.EdgeType.CONNECTS_TO,
+        provenance: import_types21.Provenance.EXTRACTED,
+        confidence: (0, import_types21.confidenceForExtracted)("structural"),
+        evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
+      };
+      graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
+      edgesAdded++;
+    }
   }
   return { nodesAdded, edgesAdded };
 }
@@ -5513,7 +6122,9 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs18 = require("fs");
 var import_node_path32 = __toESM(require("path"), 1);
+var import_types22 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
@@ -5530,24 +6141,86 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   }
   return out;
 }
+function blockBody(content, from) {
+  const open = content.indexOf("{", from);
+  if (open === -1) return null;
+  let depth = 0;
+  for (let i = open; i < content.length; i++) {
+    const ch = content[i];
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) return { body: content.slice(open + 1, i), offset: open + 1 };
+    }
+  }
+  return null;
+}
+function lineAt(content, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < content.length; i++) {
+    if (content[i] === "\n") line++;
+  }
+  return line;
+}
 async function addTerraformResources(graph, scanPath) {
   let nodesAdded = 0;
+  let edgesAdded = 0;
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
     const content = await import_node_fs18.promises.readFile(file, "utf8");
+    const evidenceFile = toPosix2(import_node_path32.default.relative(scanPath, file));
+    const resources = [];
+    const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
     let m;
     while ((m = RESOURCE_RE.exec(content)) !== null) {
-      const kind = m[1];
+      const type = m[1];
       const name = m[2];
-      const node = makeInfraNode(kind, name, "aws");
+      const node = makeInfraNode(type, name, "aws");
       if (!graph.hasNode(node.id)) {
         graph.addNode(node.id, node);
         nodesAdded++;
       }
+      const span = blockBody(content, RESOURCE_RE.lastIndex);
+      const resource = {
+        type,
+        name,
+        nodeId: node.id,
+        body: span?.body ?? "",
+        bodyOffset: span?.offset ?? RESOURCE_RE.lastIndex
+      };
+      resources.push(resource);
+      byKey.set(`${type}.${name}`, resource);
+    }
+    for (const resource of resources) {
+      const seen = /* @__PURE__ */ new Set();
+      REFERENCE_RE.lastIndex = 0;
+      let ref;
+      while ((ref = REFERENCE_RE.exec(resource.body)) !== null) {
+        const key = `${ref[1]}.${ref[2]}`;
+        if (key === `${resource.type}.${resource.name}`) continue;
+        const target = byKey.get(key);
+        if (!target) continue;
+        if (seen.has(target.nodeId)) continue;
+        seen.add(target.nodeId);
+        const edgeId = (0, import_types5.extractedEdgeId)(resource.nodeId, target.nodeId, import_types22.EdgeType.DEPENDS_ON);
+        if (graph.hasEdge(edgeId)) continue;
+        const line = lineAt(content, resource.bodyOffset + ref.index);
+        const edge = {
+          id: edgeId,
+          source: resource.nodeId,
+          target: target.nodeId,
+          type: import_types22.EdgeType.DEPENDS_ON,
+          provenance: import_types22.Provenance.EXTRACTED,
+          confidence: (0, import_types22.confidenceForExtracted)("structural"),
+          evidence: { file: evidenceFile, line, snippet: key }
+        };
+        graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
     }
   }
-  return { nodesAdded, edgesAdded: 0 };
+  return { nodesAdded, edgesAdded };
 }
 
 // src/extract/infra/k8s.ts
@@ -5625,11 +6298,11 @@ var import_node_path35 = __toESM(require("path"), 1);
 init_cjs_shims();
 var import_node_fs20 = require("fs");
 var import_node_path34 = __toESM(require("path"), 1);
-var import_types22 = require("@neat.is/types");
+var import_types23 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types22.NodeType.FileNode) return;
+    if (attrs.type !== import_types23.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -5642,7 +6315,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types22.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types23.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (import_node_path34.default.isAbsolute(evidenceFile)) {
@@ -5802,7 +6475,7 @@ function canonicalJson(value) {
 init_cjs_shims();
 var import_node_fs22 = require("fs");
 var import_node_path36 = __toESM(require("path"), 1);
-var import_types23 = require("@neat.is/types");
+var import_types24 = require("@neat.is/types");
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -5824,12 +6497,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types23.Provenance.OBSERVED;
+      attrs.provenance = import_types24.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types23.observedEdgeId)(source, target, type);
+        const newId = (0, import_types24.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -5978,7 +6651,7 @@ init_cjs_shims();
 var import_node_fs23 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path38 = __toESM(require("path"), 1);
-var import_types24 = require("@neat.is/types");
+var import_types25 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
   if (override && override.length > 0) return import_node_path38.default.resolve(override);
@@ -5999,7 +6672,7 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types24.RegistryFileSchema.parse(parsed);
+  return import_types25.RegistryFileSchema.parse(parsed);
 }
 async function getProject(name) {
   const reg = await readRegistry();
@@ -6200,6 +6873,18 @@ function registerRoutes(scope, ctx) {
     }
     return getTransitiveDependencies(proj.graph, nodeId, depth);
   });
+  scope.get(
+    "/graph/observed-dependencies/:nodeId",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+      if (!proj) return;
+      const { nodeId } = req.params;
+      if (!proj.graph.hasNode(nodeId)) {
+        return reply.code(404).send({ error: "node not found", id: nodeId });
+      }
+      return getObservedDependencies(proj.graph, nodeId);
+    }
+  );
   scope.get("/graph/divergences", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -6208,11 +6893,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types25.DivergenceTypeSchema.safeParse(c);
+        const r = import_types26.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types25.DivergenceTypeSchema.options
+            allowed: import_types26.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -6260,23 +6945,29 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  const incidentHistoryHandler = async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      reply.code(404).send({ error: "node not found", id: nodeId });
+      return;
+    }
+    const epath = errorsPathFor(proj);
+    if (!epath) return { count: 0, total: 0, events: [] };
+    const events = await readErrorEvents(epath);
+    const filtered = events.filter(
+      (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
+    );
+    return { count: filtered.length, total: filtered.length, events: filtered };
+  };
   scope.get(
     "/incidents/:nodeId",
-    async (req, reply) => {
-      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
-      if (!proj) return;
-      const { nodeId } = req.params;
-      if (!proj.graph.hasNode(nodeId)) {
-        return reply.code(404).send({ error: "node not found", id: nodeId });
-      }
-      const epath = errorsPathFor(proj);
-      if (!epath) return { count: 0, total: 0, events: [] };
-      const events = await readErrorEvents(epath);
-      const filtered = events.filter(
-        (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
-      );
-      return { count: filtered.length, total: filtered.length, events: filtered };
-    }
+    incidentHistoryHandler
+  );
+  scope.get(
+    "/graph/incident-history/:nodeId",
+    incidentHistoryHandler
   );
   scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
@@ -6285,16 +6976,16 @@ function registerRoutes(scope, ctx) {
     if (!proj.graph.hasNode(nodeId)) {
       return reply.code(404).send({ error: "node not found", id: nodeId });
     }
-    let errorEvent;
     const epath = errorsPathFor(proj);
-    if (req.query.errorId && epath) {
-      const events = await readErrorEvents(epath);
-      errorEvent = events.find((e) => e.id === req.query.errorId);
+    const incidents = epath ? await readErrorEvents(epath) : [];
+    let errorEvent;
+    if (req.query.errorId) {
+      errorEvent = incidents.find((e) => e.id === req.query.errorId);
       if (!errorEvent) {
         return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
       }
     }
-    const result = getRootCause(proj.graph, nodeId, errorEvent);
+    const result = getRootCause(proj.graph, nodeId, errorEvent, incidents);
     if (!result) return reply.code(404).send({ error: "no root cause found", id: nodeId });
     return result;
   });
@@ -6425,7 +7116,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types25.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types26.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -6439,10 +7130,32 @@ function registerRoutes(scope, ctx) {
     }
     return { violations };
   });
+  scope.get("/policies/applicable", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const nodeId = req.query.node;
+    if (!nodeId) {
+      return reply.code(400).send({ error: 'missing required query param "node"' });
+    }
+    const policyPath = ctx.policyFilePathFor(proj);
+    let policies = [];
+    if (policyPath) {
+      try {
+        policies = await loadPolicyFile(policyPath);
+      } catch (err) {
+        return reply.code(400).send({
+          error: "policy.json failed to parse",
+          details: err.message
+        });
+      }
+    }
+    const applicable = selectApplicablePolicies(proj.graph, policies, nodeId);
+    return { node: nodeId, applicable };
+  });
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types25.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types26.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",