@neat.is/core 0.4.20-dev.20260630 → 0.4.23

package/dist/{chunk-GNAX2CBF.js → chunk-O25KZNZK.js}

@@ -1,7 +1,7 @@
 import {
   mountBearerAuth,
   readAuthEnv
-} from "./chunk-BGPWBRLU.js";
+} from "./chunk-ZX7PCMGZ.js";
 
 // src/graph.ts
 import GraphDefault from "graphology";
@@ -344,7 +344,9 @@ import {
   BlastRadiusResultSchema,
   EdgeType,
   NodeType,
+  ObservedDependenciesResultSchema,
   PROV_RANK,
+  Provenance,
   RootCauseResultSchema,
   TransitiveDependenciesResultSchema
 } from "@neat.is/types";
@@ -552,22 +554,164 @@ var rootCauseShapes = {
   [NodeType.ServiceNode]: serviceRootCauseShape,
   [NodeType.FileNode]: fileRootCauseShape
 };
-function getRootCause(graph, errorNodeId, errorEvent) {
+function getRootCause(graph, errorNodeId, errorEvent, incidents) {
   if (!graph.hasNode(errorNodeId)) return null;
   const origin = graph.getNodeAttributes(errorNodeId);
   const shape = rootCauseShapes[origin.type];
-  if (!shape) return null;
-  const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
-  const match = shape(graph, origin, walk);
-  if (!match) return null;
-  const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+  if (shape) {
+    const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+    const match = shape(graph, origin, walk);
+    if (match) {
+      const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+      return RootCauseResultSchema.parse({
+        rootCauseNode: match.rootCauseNode,
+        rootCauseReason: reason,
+        traversalPath: walk.path,
+        edgeProvenances: walk.edges.map((e) => e.provenance),
+        confidence: confidenceFromMix(walk.edges),
+        fixRecommendation: match.fixRecommendation
+      });
+    }
+  }
+  if (origin.type === NodeType.ServiceNode) {
+    const crossService = crossServiceRootCause(graph, errorNodeId, incidents, errorEvent);
+    if (crossService) return crossService;
+  }
+  return rootCauseFromIncidents(errorNodeId, incidents, errorEvent);
+}
+var INCIDENT_ROOT_CAUSE_CONFIDENCE = 0.6;
+function incidentMatchesNode(ev, nodeId) {
+  return ev.affectedNode === nodeId || ev.service === nodeId.replace(/^service:/, "");
+}
+function localizeFromIncidents(nodeId, incidents, errorEvent) {
+  const pool = incidents && incidents.length > 0 ? incidents : errorEvent ? [errorEvent] : [];
+  const relevant = pool.filter((ev) => incidentMatchesNode(ev, nodeId));
+  if (relevant.length === 0) return null;
+  const latest = [...relevant].sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
+  const attrs = latest.attributes ?? {};
+  const filepath = typeof attrs["code.filepath"] === "string" ? attrs["code.filepath"] : void 0;
+  const lineno = typeof attrs["code.lineno"] === "number" ? attrs["code.lineno"] : void 0;
+  const route = typeof attrs["http.route"] === "string" ? attrs["http.route"] : void 0;
+  const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
+  const sameMode = relevant.filter((ev) => ev.errorMessage === latest.errorMessage);
+  const count = sameMode.length;
+  const tail = count > 1 ? ` (${count} recorded incidents)` : " (1 recorded incident)";
+  const reasonParts = [`${latest.service}: ${latest.errorMessage}`];
+  if (location) reasonParts.push(`surfaced at ${location}`);
+  const rootCauseReason = `${reasonParts.join(" \u2014 ")}${tail}`;
+  const localizesToFile = latest.affectedNode !== nodeId && latest.affectedNode.startsWith("file:");
+  const fileNode = localizesToFile ? latest.affectedNode : void 0;
+  const fixRecommendation = location ? `Inspect ${location}${route ? ` handling ${route}` : ""}` : route ? `Inspect ${latest.service}'s handler for ${route}` : void 0;
+  return {
+    rootCauseNode: fileNode ?? nodeId,
+    rootCauseReason,
+    ...fileNode ? { fileNode } : {},
+    ...fixRecommendation ? { fixRecommendation } : {}
+  };
+}
+function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
+  const loc = localizeFromIncidents(nodeId, incidents, errorEvent);
+  if (!loc) return null;
+  const traversalPath = loc.fileNode ? [nodeId, loc.fileNode] : [nodeId];
+  const edgeProvenances = loc.fileNode ? [Provenance.OBSERVED] : [];
   return RootCauseResultSchema.parse({
-    rootCauseNode: match.rootCauseNode,
-    rootCauseReason: reason,
-    traversalPath: walk.path,
-    edgeProvenances: walk.edges.map((e) => e.provenance),
-    confidence: confidenceFromMix(walk.edges),
-    fixRecommendation: match.fixRecommendation
+    rootCauseNode: loc.rootCauseNode,
+    rootCauseReason: loc.rootCauseReason,
+    traversalPath,
+    edgeProvenances,
+    confidence: INCIDENT_ROOT_CAUSE_CONFIDENCE,
+    ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+  });
+}
+function isFailingCallEdge(e) {
+  return e.type === EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
+}
+function callSourcesForService(graph, serviceId3) {
+  const ids = [serviceId3];
+  for (const edgeId of graph.outboundEdges(serviceId3)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== EdgeType.CONTAINS) continue;
+    const tgt = graph.getNodeAttributes(e.target);
+    if (tgt.type === NodeType.FileNode) ids.push(e.target);
+  }
+  return ids;
+}
+function failingCallDominates(e, id, curEdge, curId) {
+  const ec = e.signal?.errorCount ?? 0;
+  const cc = curEdge.signal?.errorCount ?? 0;
+  if (ec !== cc) return ec > cc;
+  if (PROV_RANK[e.provenance] !== PROV_RANK[curEdge.provenance]) {
+    return PROV_RANK[e.provenance] > PROV_RANK[curEdge.provenance];
+  }
+  return id < curId;
+}
+function dominantFailingCall(graph, serviceId3, visited) {
+  let best = null;
+  for (const src of callSourcesForService(graph, serviceId3)) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (!isFailingCallEdge(e)) continue;
+      if (isFrontierNode(graph, e.target)) continue;
+      const owner = resolveOwningService(graph, e.target);
+      if (!owner || visited.has(owner.id)) continue;
+      if (!best || failingCallDominates(e, owner.id, best.edge, best.nextService)) {
+        best = { nextService: owner.id, edge: e };
+      }
+    }
+  }
+  return best;
+}
+function followFailingCallChain(graph, originServiceId, maxDepth) {
+  const path39 = [originServiceId];
+  const edges = [];
+  const visited = /* @__PURE__ */ new Set([originServiceId]);
+  let current = originServiceId;
+  for (let depth = 0; depth < maxDepth; depth++) {
+    const hop = dominantFailingCall(graph, current, visited);
+    if (!hop) break;
+    path39.push(hop.nextService);
+    edges.push(hop.edge);
+    visited.add(hop.nextService);
+    current = hop.nextService;
+  }
+  if (edges.length === 0) return null;
+  return { path: path39, edges, culprit: current };
+}
+function crossServiceRootCause(graph, originId, incidents, errorEvent) {
+  const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
+  if (!chain) return null;
+  const culprit = chain.culprit;
+  const path39 = [...chain.path];
+  const edgeProvenances = chain.edges.map((e) => e.provenance);
+  const baseConfidence = confidenceFromMix(chain.edges);
+  const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
+  const loc = localizeFromIncidents(culprit, incidents, errorEvent);
+  if (loc) {
+    let rootCauseNode = culprit;
+    if (loc.fileNode) {
+      path39.push(loc.fileNode);
+      edgeProvenances.push(Provenance.OBSERVED);
+      rootCauseNode = loc.fileNode;
+    }
+    return RootCauseResultSchema.parse({
+      rootCauseNode,
+      rootCauseReason: loc.rootCauseReason,
+      traversalPath: path39,
+      edgeProvenances,
+      confidence,
+      ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+    });
+  }
+  const lastEdge = chain.edges[chain.edges.length - 1];
+  const errs = lastEdge.signal?.errorCount ?? 0;
+  const culpritName = culprit.replace(/^service:/, "");
+  return RootCauseResultSchema.parse({
+    rootCauseNode: culprit,
+    rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
+    traversalPath: path39,
+    edgeProvenances,
+    confidence,
+    fixRecommendation: `Inspect ${culpritName}'s failing handler`
   });
 }
 function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
@@ -590,14 +734,14 @@ function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
       });
     }
     if (frame.distance >= maxDepth) continue;
-    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
-    for (const [tgtId, edge] of outgoing) {
-      if (enqueued.has(tgtId)) continue;
-      enqueued.add(tgtId);
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(frame.nodeId));
+    for (const [srcId, edge] of incoming) {
+      if (enqueued.has(srcId)) continue;
+      enqueued.add(srcId);
       queue.push({
-        nodeId: tgtId,
+        nodeId: srcId,
         distance: frame.distance + 1,
-        path: [...frame.path, tgtId],
+        path: [...frame.path, srcId],
         pathEdges: [...frame.pathEdges, edge]
       });
     }
@@ -653,6 +797,62 @@ function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIE
     total: dependencies.length
   });
 }
+function getObservedDependencies(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) {
+    return ObservedDependenciesResultSchema.parse({
+      origin: nodeId,
+      dependencies: [],
+      observed: false,
+      inboundObservedCount: 0,
+      hasExtractedOutbound: false
+    });
+  }
+  const attrs = graph.getNodeAttributes(nodeId);
+  const scope = [nodeId];
+  if (attrs.type === NodeType.ServiceNode) {
+    for (const edgeId of graph.outboundEdges(nodeId)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== EdgeType.CONTAINS) continue;
+      const owned = graph.getNodeAttributes(e.target);
+      if (owned.type === NodeType.FileNode) scope.push(e.target);
+    }
+  }
+  const dependencies = [];
+  const seenEdge = /* @__PURE__ */ new Set();
+  let hasExtractedOutbound = false;
+  for (const src of scope) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === EdgeType.CONTAINS) continue;
+      if (e.provenance === Provenance.OBSERVED) {
+        if (!seenEdge.has(e.id)) {
+          seenEdge.add(e.id);
+          dependencies.push(e);
+        }
+      } else if (e.provenance === Provenance.EXTRACTED) {
+        hasExtractedOutbound = true;
+      }
+    }
+  }
+  let inboundObservedCount = 0;
+  for (const tgt of scope) {
+    for (const edgeId of graph.inboundEdges(tgt)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === EdgeType.CONTAINS) continue;
+      if (e.provenance === Provenance.OBSERVED) inboundObservedCount += 1;
+    }
+  }
+  dependencies.sort(
+    (a, b) => a.target.localeCompare(b.target) || a.source.localeCompare(b.source) || a.id.localeCompare(b.id)
+  );
+  return ObservedDependenciesResultSchema.parse({
+    origin: nodeId,
+    dependencies,
+    observed: dependencies.length > 0 || inboundObservedCount > 0,
+    inboundObservedCount,
+    hasExtractedOutbound
+  });
+}
 
 // src/ingest.ts
 import { promises as fs3, existsSync, readFileSync } from "fs";
@@ -997,6 +1197,130 @@ function evaluateAllPolicies(graph, policies, ctx) {
   }
   return out;
 }
+function selectApplicablePolicies(graph, policies, nodeId) {
+  if (!graph.hasNode(nodeId)) return [];
+  const node = graph.getNodeAttributes(nodeId);
+  const out = [];
+  for (const policy of policies) {
+    const m = matchPolicyToNode(graph, policy, nodeId, node);
+    if (!m) continue;
+    out.push({
+      policyId: policy.id,
+      policyName: policy.name,
+      ...policy.description !== void 0 ? { description: policy.description } : {},
+      severity: policy.severity,
+      onViolation: resolveOnViolation(policy),
+      ruleType: policy.rule.type,
+      match: m.match,
+      reason: m.reason
+    });
+  }
+  return out;
+}
+function requiredProvenanceList(required) {
+  if (Array.isArray(required)) return required.join(" | ");
+  return String(required);
+}
+function nodeTouchesEdgeType(graph, nodeId, edgeType, requiredOtherEnd) {
+  const incident = [...graph.outboundEdges(nodeId), ...graph.inboundEdges(nodeId)];
+  for (const edgeId of incident) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== edgeType) continue;
+    if (requiredOtherEnd === void 0) return true;
+    if (e.source === requiredOtherEnd || e.target === requiredOtherEnd) return true;
+  }
+  return false;
+}
+function blastRadiusSubjectReaching(graph, rule, nodeId) {
+  let found = null;
+  graph.forEachNode((subjId, attrs) => {
+    if (found !== null) return;
+    if (subjId === nodeId) return;
+    if (attrs.type !== rule.nodeType) return;
+    const radius = rule.depth !== void 0 ? getBlastRadius(graph, subjId, rule.depth) : getBlastRadius(graph, subjId);
+    if (radius.affectedNodes.some((n) => n.nodeId === nodeId)) found = subjId;
+  });
+  return found;
+}
+function matchPolicyToNode(graph, policy, nodeId, node) {
+  const rule = policy.rule;
+  switch (rule.type) {
+    case "structural": {
+      if (node.type === rule.fromNodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.fromNodeType} must have a ${rule.edgeType} edge to a ${rule.toNodeType}`
+        };
+      }
+      if (node.type === rule.toNodeType) {
+        return {
+          match: "region",
+          reason: `${rule.fromNodeType} nodes must reach a ${rule.toNodeType} like this one via a ${rule.edgeType} edge`
+        };
+      }
+      return null;
+    }
+    case "ownership": {
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.nodeType} must declare a non-empty "${rule.field}" field`
+        };
+      }
+      return null;
+    }
+    case "blast-radius": {
+      const depthLabel = rule.depth !== void 0 ? ` at depth ${rule.depth}` : "";
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `no ${rule.nodeType} may exceed a blast radius of ${rule.maxAffected}${depthLabel}`
+        };
+      }
+      const subject = blastRadiusSubjectReaching(graph, rule, nodeId);
+      if (subject) {
+        return {
+          match: "region",
+          reason: `this node is in the blast radius of ${subject} (a ${rule.nodeType} held to a blast radius of ${rule.maxAffected}${depthLabel}) \u2014 it breaks if that ${rule.nodeType} changes`
+        };
+      }
+      return null;
+    }
+    case "compatibility": {
+      const kindLabel = rule.kind ?? "all compat shapes";
+      if (node.type === NodeType2.ServiceNode) {
+        return {
+          match: "subject",
+          reason: `this service's dependencies are compatibility-checked (${kindLabel})`
+        };
+      }
+      const reachesDriverEngine = rule.kind === void 0 || rule.kind === "driver-engine";
+      if (reachesDriverEngine && node.type === NodeType2.DatabaseNode && nodeTouchesEdgeType(graph, nodeId, EdgeType2.CONNECTS_TO)) {
+        return {
+          match: "region",
+          reason: "services connecting to this database have their driver/engine compatibility checked against it"
+        };
+      }
+      return null;
+    }
+    case "provenance": {
+      const requiredList = requiredProvenanceList(rule.required);
+      if (rule.targetNodeId !== void 0 && nodeId === rule.targetNodeId) {
+        return {
+          match: "subject",
+          reason: `every ${rule.edgeType} edge into ${rule.targetNodeId} must carry ${requiredList} provenance`
+        };
+      }
+      if (nodeTouchesEdgeType(graph, nodeId, rule.edgeType, rule.targetNodeId)) {
+        return {
+          match: "region",
+          reason: rule.targetNodeId !== void 0 ? `this node sits on a ${rule.edgeType} edge to ${rule.targetNodeId}, which must carry ${requiredList} provenance` : `this node sits on a ${rule.edgeType} edge, which must carry ${requiredList} provenance`
+        };
+      }
+      return null;
+    }
+  }
+}
 async function loadPolicyFile(policyPath) {
   let raw;
   try {
@@ -1050,7 +1374,7 @@ var PolicyViolationsLog = class {
 import {
   EdgeType as EdgeType3,
   NodeType as NodeType3,
-  Provenance,
+  Provenance as Provenance2,
   confidenceForObservedSignal,
   databaseId,
   extractedEdgeId,
@@ -1117,9 +1441,9 @@ function loadIncidentThresholdsFromEnv() {
     return DEFAULT_INCIDENT_THRESHOLDS;
   }
 }
-function httpResponseStatus(span) {
+function httpResponseStatusFromAttrs(attrs) {
   for (const key of ["http.response.status_code", "http.status_code"]) {
-    const v = span.attributes[key];
+    const v = attrs[key];
     if (typeof v === "number" && Number.isFinite(v)) return v;
     if (typeof v === "string") {
       const n = Number(v);
@@ -1128,6 +1452,63 @@ function httpResponseStatus(span) {
   }
   return void 0;
 }
+function httpResponseStatus(span) {
+  return httpResponseStatusFromAttrs(span.attributes);
+}
+function httpFailureMessageFromAttrs(attrs) {
+  const status = httpResponseStatusFromAttrs(attrs);
+  const route = pickAttrFrom(attrs, "http.route", "http.target", "url.path");
+  const method = pickAttrFrom(attrs, "http.request.method", "http.method");
+  const where = route ? `${method ? `${method} ` : ""}${route}` : void 0;
+  if (status !== void 0 && where) return `${status} on ${where}`;
+  if (status !== void 0) return `HTTP ${status}`;
+  if (where) return `error on ${where}`;
+  return void 0;
+}
+var GRPC_STATUS_NAMES = {
+  1: "CANCELLED",
+  2: "UNKNOWN",
+  3: "INVALID_ARGUMENT",
+  4: "DEADLINE_EXCEEDED",
+  5: "NOT_FOUND",
+  6: "ALREADY_EXISTS",
+  7: "PERMISSION_DENIED",
+  8: "RESOURCE_EXHAUSTED",
+  9: "FAILED_PRECONDITION",
+  10: "ABORTED",
+  11: "OUT_OF_RANGE",
+  12: "UNIMPLEMENTED",
+  13: "INTERNAL",
+  14: "UNAVAILABLE",
+  15: "DATA_LOSS",
+  16: "UNAUTHENTICATED"
+};
+function grpcStatusCodeFromAttrs(attrs) {
+  const v = attrs["rpc.grpc.status_code"];
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string") {
+    const n = Number(v);
+    if (Number.isFinite(n)) return n;
+  }
+  return void 0;
+}
+function nonHttpFailureMessageFromAttrs(attrs) {
+  const grpc = grpcStatusCodeFromAttrs(attrs);
+  if (grpc !== void 0 && grpc !== 0) {
+    const name = GRPC_STATUS_NAMES[grpc] ?? `status ${grpc}`;
+    const detail = pickAttrFrom(attrs, "rpc.grpc.status_message");
+    return detail ? `gRPC ${name}: ${detail}` : `gRPC ${name}`;
+  }
+  const errType = pickAttrFrom(attrs, "error.type");
+  if (errType && errType !== "_OTHER" && !/^\d+$/.test(errType)) {
+    const peer = pickAttrFrom(attrs, "server.address", "net.peer.name", "net.host.name");
+    return peer ? `${errType} connecting to ${peer}` : errType;
+  }
+  return void 0;
+}
+function incidentMessage(span) {
+  return span.exception?.message ?? httpFailureMessageFromAttrs(span.attributes) ?? nonHttpFailureMessageFromAttrs(span.attributes) ?? "unknown error";
+}
 function nowIso(ctx) {
   return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
 }
@@ -1147,13 +1528,16 @@ function warnNoSourceMaps(serviceName) {
     `[neat] ${serviceName}: no .map files found under dist/; observed file edges will land on dist paths, not src. Set sourceMap: true in tsconfig to enable file-level reconciliation.`
   );
 }
-function pickAttr(span, ...keys) {
+function pickAttrFrom(attrs, ...keys) {
   for (const k of keys) {
-    const v = span.attributes[k];
+    const v = attrs[k];
     if (typeof v === "string" && v.length > 0) return v;
   }
   return void 0;
 }
+function pickAttr(span, ...keys) {
+  return pickAttrFrom(span.attributes, ...keys);
+}
 function hostFromUrl(u) {
   if (!u) return void 0;
   try {
@@ -1165,6 +1549,10 @@ function hostFromUrl(u) {
 function pickAddress(span) {
   return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
 }
+function isLoopbackHost(host) {
+  const h = host.toLowerCase();
+  return h === "localhost" || h === "ip6-localhost" || h === "::1" || h === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(h);
+}
 var CODE_FILEPATH_ATTR = "code.filepath";
 var CODE_LINENO_ATTR = "code.lineno";
 var CODE_FUNCTION_ATTR = "code.function";
@@ -1272,15 +1660,31 @@ function callSiteFromSpan(span, serviceNode, scanPath) {
     ...originalRelPath && originalRelPath !== relPath ? { originalRelPath } : {}
   };
 }
+function reconcileObservedRelPath(graph, serviceName, relPath) {
+  if (graph.hasNode(fileId(serviceName, relPath))) return relPath;
+  let best = null;
+  graph.forEachNode((_id, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType3.FileNode || a.service !== serviceName) return;
+    if (a.discoveredVia === "otel") return;
+    const p = a.path;
+    if (!p) return;
+    if ((relPath === p || relPath.endsWith(`/${p}`)) && (!best || p.length > best.length)) {
+      best = p;
+    }
+  });
+  return best ?? relPath;
+}
 function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
-  const fileNodeId = fileId(serviceName, callSite.relPath);
+  const relPath = reconcileObservedRelPath(graph, serviceName, callSite.relPath);
+  const fileNodeId = fileId(serviceName, relPath);
   if (!graph.hasNode(fileNodeId)) {
-    const language = languageForExt(callSite.relPath);
+    const language = languageForExt(relPath);
     const node = {
       id: fileNodeId,
       type: NodeType3.FileNode,
       service: serviceName,
-      path: callSite.relPath,
+      path: relPath,
       ...language ? { language } : {},
       ...callSite.originalRelPath ? { originalPath: callSite.originalRelPath } : {},
       discoveredVia: "otel"
@@ -1294,7 +1698,7 @@ function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
       source: serviceNodeId,
       target: fileNodeId,
       type: EdgeType3.CONTAINS,
-      provenance: Provenance.OBSERVED
+      provenance: Provenance2.OBSERVED
     };
     graph.addEdgeWithKey(containsId, serviceNodeId, fileNodeId, edge);
   }
@@ -1308,6 +1712,11 @@ function makeInferredEdgeId(type, source, target) {
 }
 var INFERRED_CONFIDENCE = 0.6;
 var STITCH_MAX_DEPTH = 2;
+var STITCH_EDGE_TYPES = /* @__PURE__ */ new Set([
+  EdgeType3.CALLS,
+  EdgeType3.CONNECTS_TO,
+  EdgeType3.DEPENDS_ON
+]);
 var WIRE_SPAN_KIND_CLIENT = 3;
 var WIRE_SPAN_KIND_PRODUCER = 4;
 function spanMintsObservedEdge(kind) {
@@ -1439,7 +1848,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     };
     const updated = {
       ...existing,
-      provenance: Provenance.OBSERVED,
+      provenance: Provenance2.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
       signal: newSignal,
@@ -1458,7 +1867,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     source,
     target,
     type,
-    provenance: Provenance.OBSERVED,
+    provenance: Provenance2.OBSERVED,
     confidence: confidenceForObservedSignal(signal),
     lastObserved: ts,
     callCount: 1,
@@ -1480,7 +1889,8 @@ function stitchTrace(graph, sourceServiceId, ts) {
     const outbound = graph.outboundEdges(nodeId);
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.provenance !== Provenance.EXTRACTED) continue;
+      if (edge.provenance !== Provenance2.EXTRACTED) continue;
+      if (!STITCH_EDGE_TYPES.has(edge.type)) continue;
       if (graph.hasEdge(observedEdgeId(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
       if (!visited.has(edge.target)) {
@@ -1503,7 +1913,7 @@ function upsertInferredEdge(graph, type, source, target, ts) {
     source,
     target,
     type,
-    provenance: Provenance.INFERRED,
+    provenance: Provenance2.INFERRED,
     confidence: INFERRED_CONFIDENCE,
     lastObserved: ts
   };
@@ -1513,6 +1923,16 @@ async function appendErrorEvent(ctx, ev) {
   await fs3.mkdir(path3.dirname(ctx.errorsPath), { recursive: true });
   await fs3.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
 }
+function incidentAffectedNode(span, graph, scanPath) {
+  const sid = serviceId(span.service, span.env);
+  const serviceNode = graph && graph.hasNode(sid) ? graph.getNodeAttributes(sid) : void 0;
+  const callSite = callSiteFromSpan(span, serviceNode, scanPath);
+  if (callSite) {
+    const relPath = graph ? reconcileObservedRelPath(graph, span.service, callSite.relPath) : callSite.relPath;
+    return fileId(span.service, relPath);
+  }
+  return sid;
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
@@ -1521,7 +1941,7 @@ function sanitizeAttributes(attrs) {
   }
   return out;
 }
-function buildErrorEventForReceiver(span) {
+function buildErrorEventForReceiver(span, graph, scanPath) {
   if (span.statusCode !== 2) return null;
   const ts = span.startTimeIso ?? (/* @__PURE__ */ new Date()).toISOString();
   const attrs = sanitizeAttributes(span.attributes);
@@ -1531,16 +1951,16 @@ function buildErrorEventForReceiver(span) {
     service: span.service,
     traceId: span.traceId,
     spanId: span.spanId,
-    errorMessage: span.exception?.message ?? "unknown error",
+    errorMessage: incidentMessage(span),
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: serviceId(span.service, span.env)
+    affectedNode: incidentAffectedNode(span, graph, scanPath)
   };
 }
-function makeErrorSpanWriter(errorsPath) {
+function makeErrorSpanWriter(errorsPath, graph, scanPath) {
   return async (span) => {
-    const ev = buildErrorEventForReceiver(span);
+    const ev = buildErrorEventForReceiver(span, graph, scanPath);
     if (!ev) return;
     await fs3.mkdir(path3.dirname(errorsPath), { recursive: true });
     await fs3.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
@@ -1568,6 +1988,22 @@ async function recordFailingResponseIncident(ctx, span, affectedNode, timestamp,
   };
   await appendErrorEvent(ctx, ev);
 }
+async function recordExceptionIncident(ctx, span, ts) {
+  const attrs = sanitizeAttributes(span.attributes);
+  const ev = {
+    id: `${span.traceId}:${span.spanId}`,
+    timestamp: ts,
+    service: span.service,
+    traceId: span.traceId,
+    spanId: span.spanId,
+    errorMessage: incidentMessage(span),
+    ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+    ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+    ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
+    affectedNode: incidentAffectedNode(span, ctx.graph, ctx.scanPath)
+  };
+  await appendErrorEvent(ctx, ev);
+}
 async function advance4xxBurst(ctx, span, affectedNode, ts, nowMs, status) {
   const { threshold, windowMs } = loadIncidentThresholdsFromEnv();
   if (!ctx.burstState) ctx.burstState = /* @__PURE__ */ new Map();
@@ -1624,7 +2060,10 @@ async function handleSpan(ctx, span) {
   const callSite = callSiteFromSpan(span, sourceServiceNode, ctx.scanPath);
   cacheSpanService(span, nowMs, callSite);
   const observedSource = () => callSite ? ensureObservedFileNode(ctx.graph, span.service, sourceId, callSite) : sourceId;
-  const callSiteEvidence = callSite ? { file: callSite.relPath, ...callSite.line !== void 0 ? { line: callSite.line } : {} } : void 0;
+  const callSiteEvidence = callSite ? {
+    file: reconcileObservedRelPath(ctx.graph, span.service, callSite.relPath),
+    ...callSite.line !== void 0 ? { line: callSite.line } : {}
+  } : void 0;
   let affectedNode = sourceId;
   const mintsFromCallerSide = spanMintsObservedEdge(span.kind);
   if (span.dbSystem) {
@@ -1646,7 +2085,7 @@ async function handleSpan(ctx, span) {
   } else {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
-    if (mintsFromCallerSide && host && host !== span.service) {
+    if (mintsFromCallerSide && host && host !== span.service && !isLoopbackHost(host)) {
       const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
@@ -1681,7 +2120,11 @@ async function handleSpan(ctx, span) {
         const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         const fallbackSource = parent.callSite ? ensureObservedFileNode(ctx.graph, parent.service, parentId, parent.callSite) : parentId;
         const fallbackEvidence = parent.callSite ? {
-          file: parent.callSite.relPath,
+          file: reconcileObservedRelPath(
+            ctx.graph,
+            parent.service,
+            parent.callSite.relPath
+          ),
           ...parent.callSite.line !== void 0 ? { line: parent.callSite.line } : {}
         } : void 0;
         upsertObservedEdge(
@@ -1706,7 +2149,7 @@ async function handleSpan(ctx, span) {
         service: span.service,
         traceId: span.traceId,
         spanId: span.spanId,
-        errorMessage: span.exception?.message ?? "unknown error",
+        errorMessage: incidentMessage(span),
         ...span.exception?.type ? { exceptionType: span.exception.type } : {},
         ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
         ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
@@ -1717,7 +2160,9 @@ async function handleSpan(ctx, span) {
   }
   if (span.statusCode !== 2) {
     const status = httpResponseStatus(span);
-    if (status !== void 0 && status >= 500) {
+    if (span.exception) {
+      await recordExceptionIncident(ctx, span, ts);
+    } else if (status !== void 0 && status >= 500) {
       await recordFailingResponseIncident(ctx, span, sourceId, ts, status, 1);
     } else if (status !== void 0 && status >= 400 && spanMintsObservedEdge(span.kind)) {
       await advance4xxBurst(ctx, span, sourceId, ts, nowMs, status);
@@ -1773,7 +2218,7 @@ function rewireFrontierEdges(graph, frontierId2, serviceId3) {
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
   graph.dropEdge(oldEdgeId);
-  const newId = edge.provenance === Provenance.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : edge.provenance === Provenance.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : extractedEdgeId(newSource, newTarget, edge.type);
+  const newId = edge.provenance === Provenance2.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : edge.provenance === Provenance2.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : extractedEdgeId(newSource, newTarget, edge.type);
   if (graph.hasEdge(newId)) {
     const existing = graph.getEdgeAttributes(newId);
     const merged = {
@@ -1807,12 +2252,12 @@ async function markStaleEdges(graph, options = {}) {
   const project = options.project ?? DEFAULT_PROJECT;
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    if (e.provenance !== Provenance.OBSERVED) return;
+    if (e.provenance !== Provenance2.OBSERVED) return;
     if (!e.lastObserved) return;
     const threshold = thresholdForEdgeType(e.type, thresholds);
     const age = now - new Date(e.lastObserved).getTime();
     if (age > threshold) {
-      const updated = { ...e, provenance: Provenance.STALE, confidence: 0.3 };
+      const updated = { ...e, provenance: Provenance2.STALE, confidence: 0.3 };
       graph.replaceEdgeAttributes(id, updated);
       events.push({
         edgeId: id,
@@ -1829,8 +2274,8 @@ async function markStaleEdges(graph, options = {}) {
         project,
         payload: {
           edgeId: id,
-          from: Provenance.OBSERVED,
-          to: Provenance.STALE
+          from: Provenance2.OBSERVED,
+          to: Provenance2.STALE
         }
       });
     }
@@ -1882,12 +2327,43 @@ function startStalenessLoop(graph, options = {}) {
 async function readErrorEvents(errorsPath) {
   try {
     const raw = await fs3.readFile(errorsPath, "utf8");
-    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    return dedupeIncidents(events);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
 }
+function isSynthesizedHttpIncident(ev) {
+  if (ev.exceptionType || ev.exceptionStacktrace) return false;
+  if (ev.errorType) return false;
+  if (!ev.attributes) return false;
+  const synth = httpFailureMessageFromAttrs(ev.attributes);
+  return synth !== void 0 && synth === ev.errorMessage;
+}
+function dedupeIncidents(events) {
+  const seen = /* @__PURE__ */ new Set();
+  const once = [];
+  for (const ev of events) {
+    const key = ev.id ?? (ev.traceId && ev.spanId ? `${ev.traceId}:${ev.spanId}` : void 0);
+    if (key === void 0) {
+      once.push(ev);
+      continue;
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    once.push(ev);
+  }
+  const groupKey = (ev) => `${ev.traceId}\0${ev.affectedNode}`;
+  const hasRealFailure = /* @__PURE__ */ new Set();
+  for (const ev of once) {
+    if (ev.traceId && !isSynthesizedHttpIncident(ev)) hasRealFailure.add(groupKey(ev));
+  }
+  return once.filter((ev) => {
+    if (!ev.traceId || !isSynthesizedHttpIncident(ev)) return true;
+    return !hasRealFailure.has(groupKey(ev));
+  });
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
   let nodesAdded = 0;
@@ -2021,10 +2497,17 @@ function isConfigFile(name) {
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
   if (name === ".env" || name.startsWith(".env.")) {
     if (isEnvTemplateFile(name)) return { match: false, fileType: "" };
+    if (isNeatAuthoredEnvFile(name)) return { match: false, fileType: "" };
     return { match: true, fileType: "env" };
   }
   return { match: false, fileType: "" };
 }
+function isNeatAuthoredEnvFile(name) {
+  return name === ".env.neat";
+}
+function isNeatAuthoredSourceFile(name) {
+  return /^otel-init\.(?:js|cjs|mjs|ts|tsx)$/i.test(name);
+}
 function isTestPath(filePath) {
   const normalised = filePath.replace(/\\/g, "/");
   const segments = normalised.split("/");
@@ -2659,7 +3142,7 @@ import path10 from "path";
 import {
   EdgeType as EdgeType4,
   NodeType as NodeType6,
-  Provenance as Provenance2,
+  Provenance as Provenance3,
   confidenceForExtracted,
   extractedEdgeId as extractedEdgeId3,
   fileId as fileId2
@@ -2674,7 +3157,9 @@ async function walkSourceFiles(dir) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk(full);
-      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path10.extname(entry.name))) {
+      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path10.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
+      // would attribute our instrumentation imports to the user's service.
+      !isNeatAuthoredSourceFile(entry.name)) {
         out.push(full);
       }
     }
@@ -2746,7 +3231,7 @@ function ensureFileNode(graph, serviceName, serviceNodeId, relPath) {
       source: serviceNodeId,
       target: fileNodeId,
       type: EdgeType4.CONTAINS,
-      provenance: Provenance2.EXTRACTED,
+      provenance: Provenance3.EXTRACTED,
       confidence: confidenceForExtracted("structural"),
       evidence: { file: relPath }
     };
@@ -2786,7 +3271,7 @@ import JavaScript from "tree-sitter-javascript";
 import Python from "tree-sitter-python";
 import {
   EdgeType as EdgeType5,
-  Provenance as Provenance3,
+  Provenance as Provenance4,
   confidenceForExtracted as confidenceForExtracted2,
   extractedEdgeId as extractedEdgeId4,
   fileId as fileId3
@@ -2849,11 +3334,28 @@ function collectJsImports(node, out) {
     if (child) collectJsImports(child, out);
   }
 }
+function collectImportedNames(node, out) {
+  if (node.type === "aliased_import") {
+    const nameNode = node.childForFieldName("name");
+    if (nameNode) out.push(nameNode.text);
+    return;
+  }
+  if (node.type === "dotted_name") {
+    out.push(node.text);
+    return;
+  }
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child) collectImportedNames(child, out);
+  }
+}
 function collectPyImports(node, out) {
   if (node.type === "import_from_statement") {
     let level = 0;
     let modulePath = "";
+    const names = [];
     let pastFrom = false;
+    let pastImport = false;
     for (let i = 0; i < node.childCount; i++) {
       const child = node.child(i);
       if (!child) continue;
@@ -2861,26 +3363,30 @@ function collectPyImports(node, out) {
         if (child.type === "from") pastFrom = true;
         continue;
       }
-      if (child.type === "import") break;
-      if (child.type === "relative_import") {
-        for (let j = 0; j < child.childCount; j++) {
-          const rc = child.child(j);
-          if (!rc) continue;
-          if (rc.type === "import_prefix") {
-            for (let k = 0; k < rc.childCount; k++) {
-              if (rc.child(k)?.type === ".") level++;
-            }
-          } else if (rc.type === "dotted_name") modulePath = rc.text;
+      if (!pastImport) {
+        if (child.type === "import") {
+          pastImport = true;
+          continue;
         }
-        break;
-      }
-      if (child.type === "dotted_name") {
-        modulePath = child.text;
-        break;
+        if (child.type === "relative_import") {
+          for (let j = 0; j < child.childCount; j++) {
+            const rc = child.child(j);
+            if (!rc) continue;
+            if (rc.type === "import_prefix") {
+              for (let k = 0; k < rc.childCount; k++) {
+                if (rc.child(k)?.type === ".") level++;
+              }
+            } else if (rc.type === "dotted_name") modulePath = rc.text;
+          }
+        } else if (child.type === "dotted_name") {
+          modulePath = child.text;
+        }
+        continue;
       }
+      collectImportedNames(child, names);
     }
     if (level > 0 || modulePath) {
-      out.push({ modulePath, level, line: node.startPosition.row + 1, snippet: clipSnippet(node.text) });
+      out.push({ modulePath, level, names, line: node.startPosition.row + 1, snippet: clipSnippet(node.text) });
     }
   }
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -2982,8 +3488,6 @@ async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
   return null;
 }
 async function resolvePyImport(imp, importerPath, serviceDir) {
-  if (!imp.modulePath) return null;
-  const relPath = imp.modulePath.split(".").join("/");
   let baseDir;
   if (imp.level > 0) {
     baseDir = path12.dirname(importerPath);
@@ -2991,13 +3495,30 @@ async function resolvePyImport(imp, importerPath, serviceDir) {
   } else {
     baseDir = serviceDir;
   }
-  const candidates = [path12.join(baseDir, `${relPath}.py`), path12.join(baseDir, relPath, "__init__.py")];
-  for (const candidate of candidates) {
-    if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
-      return toPosix2(path12.relative(serviceDir, candidate));
+  const moduleBase = imp.modulePath ? path12.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
+  const resolved = /* @__PURE__ */ new Set();
+  let needModuleFile = imp.names.length === 0;
+  for (const name of imp.names) {
+    const submoduleFile = path12.join(moduleBase, `${name}.py`);
+    const subpackageInit = path12.join(moduleBase, name, "__init__.py");
+    if (isWithinServiceDir(submoduleFile, serviceDir) && await fileExists(submoduleFile)) {
+      resolved.add(toPosix2(path12.relative(serviceDir, submoduleFile)));
+    } else if (isWithinServiceDir(subpackageInit, serviceDir) && await fileExists(subpackageInit)) {
+      resolved.add(toPosix2(path12.relative(serviceDir, subpackageInit)));
+    } else {
+      needModuleFile = true;
+    }
+  }
+  if (needModuleFile) {
+    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, path12.join(moduleBase, "__init__.py")] : [path12.join(moduleBase, "__init__.py")];
+    for (const candidate of moduleFileCandidates) {
+      if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
+        resolved.add(toPosix2(path12.relative(serviceDir, candidate)));
+        break;
+      }
     }
   }
-  return null;
+  return [...resolved];
 }
 function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, importeeRelPath, line, snippet2) {
   const importeeFileId = fileId3(serviceName, importeeRelPath);
@@ -3009,7 +3530,7 @@ function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, imp
     source: importerFileId,
     target: importeeFileId,
     type: EdgeType5.IMPORTS,
-    provenance: Provenance3.EXTRACTED,
+    provenance: Provenance4.EXTRACTED,
     confidence: confidenceForExtracted2("structural"),
     evidence: { file: importerRelPath, line, snippet: snippet2 }
   };
@@ -3038,17 +3559,18 @@ async function addImports(graph, services) {
           continue;
         }
         for (const imp of pyImports) {
-          const resolved = await resolvePyImport(imp, file.path, service.dir);
-          if (!resolved) continue;
-          edgesAdded += emitImportEdge(
-            graph,
-            service.pkg.name,
-            importerFileId,
-            relFile,
-            resolved,
-            imp.line,
-            imp.snippet
-          );
+          const resolvedPaths = await resolvePyImport(imp, file.path, service.dir);
+          for (const resolved of resolvedPaths) {
+            edgesAdded += emitImportEdge(
+              graph,
+              service.pkg.name,
+              importerFileId,
+              relFile,
+              resolved,
+              imp.line,
+              imp.snippet
+            );
+          }
         }
         continue;
       }
@@ -3083,7 +3605,8 @@ import path20 from "path";
 import {
   EdgeType as EdgeType6,
   NodeType as NodeType7,
-  Provenance as Provenance4,
+  Provenance as Provenance5,
+  configId,
   databaseId as databaseId2,
   confidenceForExtracted as confidenceForExtracted3
 } from "@neat.is/types";
@@ -3670,7 +4193,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         source: fileNodeId,
         target: dbNode.id,
         type: EdgeType6.CONNECTS_TO,
-        provenance: Provenance4.EXTRACTED,
+        provenance: Provenance5.EXTRACTED,
         confidence: confidenceForExtracted3("structural"),
         evidence: { file: evidenceFile }
       };
@@ -3679,6 +4202,36 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         edgesAdded++;
       }
     }
+    if (allConfigs.length === 1) {
+      const primary = allConfigs[0];
+      service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
+      const relPath = path20.relative(scanPath, primary.sourceFile);
+      const cfgId = configId(relPath);
+      if (!graph.hasNode(cfgId)) {
+        const cfgNode = {
+          id: cfgId,
+          type: NodeType7.ConfigNode,
+          name: path20.basename(primary.sourceFile),
+          path: relPath,
+          fileType: isConfigFile(path20.basename(primary.sourceFile)).fileType || "config"
+        };
+        graph.addNode(cfgId, cfgNode);
+        nodesAdded++;
+      }
+      const cfgEdge = {
+        id: extractedEdgeId2(service.node.id, cfgId, EdgeType6.CONFIGURED_BY),
+        source: service.node.id,
+        target: cfgId,
+        type: EdgeType6.CONFIGURED_BY,
+        provenance: Provenance5.EXTRACTED,
+        confidence: confidenceForExtracted3("structural"),
+        evidence: { file: toPosix2(relPath) }
+      };
+      if (!graph.hasEdge(cfgEdge.id)) {
+        graph.addEdgeWithKey(cfgEdge.id, cfgEdge.source, cfgEdge.target, cfgEdge);
+        edgesAdded++;
+      }
+    }
     attachIncompatibilities(service, allConfigs);
     if (graph.hasNode(service.node.id)) {
       const current = graph.getNodeAttributes(service.node.id);
@@ -3690,6 +4243,9 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       if (!service.node.incompatibilities || service.node.incompatibilities.length === 0) {
         delete updated.incompatibilities;
       }
+      if (!service.node.dbConnectionTarget) {
+        delete updated.dbConnectionTarget;
+      }
       graph.replaceNodeAttributes(service.node.id, updated);
     }
   }
@@ -3702,8 +4258,8 @@ import path21 from "path";
 import {
   EdgeType as EdgeType7,
   NodeType as NodeType8,
-  Provenance as Provenance5,
-  configId,
+  Provenance as Provenance6,
+  configId as configId2,
   confidenceForExtracted as confidenceForExtracted4
 } from "@neat.is/types";
 async function walkConfigFiles(dir) {
@@ -3732,7 +4288,7 @@ async function addConfigNodes(graph, services, scanPath) {
     for (const file of configFiles) {
       const relPath = path21.relative(scanPath, file);
       const node = {
-        id: configId(relPath),
+        id: configId2(relPath),
         type: NodeType8.ConfigNode,
         name: path21.basename(file),
         path: relPath,
@@ -3756,7 +4312,7 @@ async function addConfigNodes(graph, services, scanPath) {
         source: fileNodeId,
         target: node.id,
         type: EdgeType7.CONFIGURED_BY,
-        provenance: Provenance5.EXTRACTED,
+        provenance: Provenance6.EXTRACTED,
         confidence: confidenceForExtracted4("structural"),
         evidence: { file: relPath.split(path21.sep).join("/") }
       };
@@ -3773,7 +4329,7 @@ async function addConfigNodes(graph, services, scanPath) {
 import {
   EdgeType as EdgeType9,
   NodeType as NodeType9,
-  Provenance as Provenance7,
+  Provenance as Provenance8,
   confidenceForExtracted as confidenceForExtracted6,
   passesExtractedFloor as passesExtractedFloor2
 } from "@neat.is/types";
@@ -3785,7 +4341,7 @@ import JavaScript2 from "tree-sitter-javascript";
 import Python2 from "tree-sitter-python";
 import {
   EdgeType as EdgeType8,
-  Provenance as Provenance6,
+  Provenance as Provenance7,
   confidenceForExtracted as confidenceForExtracted5,
   passesExtractedFloor
 } from "@neat.is/types";
@@ -3881,7 +4437,7 @@ async function addHttpCallEdges(graph, services) {
         const dedupKey = `${relFile}|${targetId}`;
         if (seen.has(dedupKey)) continue;
         seen.add(dedupKey);
-        const confidence = confidenceForExtracted5("hostname-shape-match");
+        const confidence = confidenceForExtracted5("url-literal-service-target");
         const ev = {
           file: relFile,
           line: site.line,
@@ -3901,7 +4457,7 @@ async function addHttpCallEdges(graph, services) {
             target: targetId,
             type: EdgeType8.CALLS,
             confidence,
-            confidenceKind: "hostname-shape-match",
+            confidenceKind: "url-literal-service-target",
             evidence: ev
           });
           continue;
@@ -3913,7 +4469,7 @@ async function addHttpCallEdges(graph, services) {
             source: fileNodeId,
             target: targetId,
             type: EdgeType8.CALLS,
-            provenance: Provenance6.EXTRACTED,
+            provenance: Provenance7.EXTRACTED,
             confidence,
             evidence: ev
           };
@@ -4266,7 +4822,7 @@ async function addExternalEndpointEdges(graph, services) {
           source: fileNodeId,
           target: ep.infraId,
           type: edgeType,
-          provenance: Provenance7.EXTRACTED,
+          provenance: Provenance8.EXTRACTED,
           confidence,
           evidence: ep.evidence
         };
@@ -4288,7 +4844,7 @@ async function addCallEdges(graph, services) {
 
 // src/extract/infra/docker-compose.ts
 import path28 from "path";
-import { EdgeType as EdgeType10, Provenance as Provenance8, confidenceForExtracted as confidenceForExtracted7 } from "@neat.is/types";
+import { EdgeType as EdgeType10, Provenance as Provenance9, confidenceForExtracted as confidenceForExtracted7 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
 import { NodeType as NodeType10, infraId as infraId6 } from "@neat.is/types";
@@ -4381,7 +4937,7 @@ async function addComposeInfra(graph, scanPath, services) {
         source: sourceId,
         target: targetId,
         type: EdgeType10.DEPENDS_ON,
-        provenance: Provenance8.EXTRACTED,
+        provenance: Provenance9.EXTRACTED,
         confidence: confidenceForExtracted7("structural"),
         evidence: { file: evidenceFile }
       };
@@ -4395,20 +4951,30 @@ async function addComposeInfra(graph, scanPath, services) {
 // src/extract/infra/dockerfile.ts
 import path29 from "path";
 import { promises as fs15 } from "fs";
-import { EdgeType as EdgeType11, Provenance as Provenance9, confidenceForExtracted as confidenceForExtracted8 } from "@neat.is/types";
-function runtimeImage(content) {
-  const lines = content.split("\n");
-  let last = null;
-  for (const raw of lines) {
+import { EdgeType as EdgeType11, Provenance as Provenance10, confidenceForExtracted as confidenceForExtracted8 } from "@neat.is/types";
+function readDockerfile(content) {
+  let image = null;
+  const ports = [];
+  let cmd = null;
+  let entrypoint = null;
+  for (const raw of content.split("\n")) {
     const line = raw.trim();
     if (!line || line.startsWith("#")) continue;
-    if (!/^from\s+/i.test(line)) continue;
-    const tokens = line.split(/\s+/);
-    const image = tokens[1];
-    if (!image || image.toLowerCase() === "scratch") continue;
-    last = image;
+    if (/^from\s+/i.test(line)) {
+      const candidate = line.split(/\s+/)[1];
+      if (candidate && candidate.toLowerCase() !== "scratch") image = candidate;
+    } else if (/^expose\s+/i.test(line)) {
+      for (const token of line.split(/\s+/).slice(1)) {
+        const port = Number.parseInt(token.split("/")[0], 10);
+        if (Number.isInteger(port) && !ports.includes(port)) ports.push(port);
+      }
+    } else if (/^entrypoint\s+/i.test(line)) {
+      entrypoint = line;
+    } else if (/^cmd\s+/i.test(line)) {
+      cmd = line;
+    }
   }
-  return last;
+  return { image, ports, entrypoint: entrypoint ?? cmd };
 }
 async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
@@ -4427,14 +4993,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       );
       continue;
     }
-    const image = runtimeImage(content);
-    if (!image) continue;
-    const node = makeInfraNode("container-image", image);
+    const facts = readDockerfile(content);
+    if (!facts.image) continue;
+    const node = makeInfraNode("container-image", facts.image);
     if (!graph.hasNode(node.id)) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
     const relDockerfile = toPosix2(path29.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix2(path29.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -4450,15 +5017,36 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         source: fileNodeId,
         target: node.id,
         type: EdgeType11.RUNS_ON,
-        provenance: Provenance9.EXTRACTED,
+        provenance: Provenance10.EXTRACTED,
         confidence: confidenceForExtracted8("structural"),
         evidence: {
-          file: toPosix2(path29.relative(scanPath, dockerfilePath))
+          file: evidenceFile,
+          ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
         }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
       edgesAdded++;
     }
+    for (const port of facts.ports) {
+      const portNode = makeInfraNode("port", String(port));
+      if (!graph.hasNode(portNode.id)) {
+        graph.addNode(portNode.id, portNode);
+        nodesAdded++;
+      }
+      const portEdgeId = extractedEdgeId2(fileNodeId, portNode.id, EdgeType11.CONNECTS_TO);
+      if (graph.hasEdge(portEdgeId)) continue;
+      const portEdge = {
+        id: portEdgeId,
+        source: fileNodeId,
+        target: portNode.id,
+        type: EdgeType11.CONNECTS_TO,
+        provenance: Provenance10.EXTRACTED,
+        confidence: confidenceForExtracted8("structural"),
+        evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
+      };
+      graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
+      edgesAdded++;
+    }
   }
   return { nodesAdded, edgesAdded };
 }
@@ -4466,7 +5054,9 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 // src/extract/infra/terraform.ts
 import { promises as fs16 } from "fs";
 import path30 from "path";
+import { EdgeType as EdgeType12, Provenance as Provenance11, confidenceForExtracted as confidenceForExtracted9 } from "@neat.is/types";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
@@ -4483,24 +5073,86 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   }
   return out;
 }
+function blockBody(content, from) {
+  const open = content.indexOf("{", from);
+  if (open === -1) return null;
+  let depth = 0;
+  for (let i = open; i < content.length; i++) {
+    const ch = content[i];
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) return { body: content.slice(open + 1, i), offset: open + 1 };
+    }
+  }
+  return null;
+}
+function lineAt(content, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < content.length; i++) {
+    if (content[i] === "\n") line++;
+  }
+  return line;
+}
 async function addTerraformResources(graph, scanPath) {
   let nodesAdded = 0;
+  let edgesAdded = 0;
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
     const content = await fs16.readFile(file, "utf8");
+    const evidenceFile = toPosix2(path30.relative(scanPath, file));
+    const resources = [];
+    const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
     let m;
     while ((m = RESOURCE_RE.exec(content)) !== null) {
-      const kind = m[1];
+      const type = m[1];
       const name = m[2];
-      const node = makeInfraNode(kind, name, "aws");
+      const node = makeInfraNode(type, name, "aws");
       if (!graph.hasNode(node.id)) {
         graph.addNode(node.id, node);
         nodesAdded++;
       }
+      const span = blockBody(content, RESOURCE_RE.lastIndex);
+      const resource = {
+        type,
+        name,
+        nodeId: node.id,
+        body: span?.body ?? "",
+        bodyOffset: span?.offset ?? RESOURCE_RE.lastIndex
+      };
+      resources.push(resource);
+      byKey.set(`${type}.${name}`, resource);
+    }
+    for (const resource of resources) {
+      const seen = /* @__PURE__ */ new Set();
+      REFERENCE_RE.lastIndex = 0;
+      let ref;
+      while ((ref = REFERENCE_RE.exec(resource.body)) !== null) {
+        const key = `${ref[1]}.${ref[2]}`;
+        if (key === `${resource.type}.${resource.name}`) continue;
+        const target = byKey.get(key);
+        if (!target) continue;
+        if (seen.has(target.nodeId)) continue;
+        seen.add(target.nodeId);
+        const edgeId = extractedEdgeId2(resource.nodeId, target.nodeId, EdgeType12.DEPENDS_ON);
+        if (graph.hasEdge(edgeId)) continue;
+        const line = lineAt(content, resource.bodyOffset + ref.index);
+        const edge = {
+          id: edgeId,
+          source: resource.nodeId,
+          target: target.nodeId,
+          type: EdgeType12.DEPENDS_ON,
+          provenance: Provenance11.EXTRACTED,
+          confidence: confidenceForExtracted9("structural"),
+          evidence: { file: evidenceFile, line, snippet: key }
+        };
+        graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
     }
   }
-  return { nodesAdded, edgesAdded: 0 };
+  return { nodesAdded, edgesAdded };
 }
 
 // src/extract/infra/k8s.ts
@@ -4576,7 +5228,7 @@ import path33 from "path";
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
 import path32 from "path";
-import { NodeType as NodeType11, Provenance as Provenance10 } from "@neat.is/types";
+import { NodeType as NodeType11, Provenance as Provenance12 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
@@ -4593,7 +5245,7 @@ function retireEdgesByFile(graph, file) {
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance10.EXTRACTED) return;
+    if (edge.provenance !== Provenance12.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -4606,7 +5258,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance10.EXTRACTED) return;
+    if (edge.provenance !== Provenance12.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (path32.isAbsolute(evidenceFile)) {
@@ -4687,11 +5339,12 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/divergences.ts
 import {
+  databaseId as databaseId3,
   DivergenceResultSchema,
-  EdgeType as EdgeType12,
+  EdgeType as EdgeType13,
   NodeType as NodeType12,
   parseEdgeId,
-  Provenance as Provenance11
+  Provenance as Provenance13
 } from "@neat.is/types";
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
@@ -4705,17 +5358,17 @@ function bucketEdges(graph) {
     const key = bucketKey(e.source, e.target, e.type);
     const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
-      case Provenance11.EXTRACTED:
+      case Provenance13.EXTRACTED:
         cur.extracted = e;
         break;
-      case Provenance11.OBSERVED:
+      case Provenance13.OBSERVED:
         cur.observed = e;
         break;
-      case Provenance11.INFERRED:
+      case Provenance13.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === Provenance11.STALE) cur.stale = e;
+        if (e.provenance === Provenance13.STALE) cur.stale = e;
     }
     buckets.set(key, cur);
   });
@@ -4743,10 +5396,16 @@ function gradedConfidence(edge) {
   if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
   return clampConfidence(confidenceForEdge(edge));
 }
+var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
+  EdgeType13.CALLS,
+  EdgeType13.CONNECTS_TO,
+  EdgeType13.PUBLISHES_TO,
+  EdgeType13.CONSUMES_FROM
+]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === EdgeType12.CONTAINS) return out;
-  if (bucket.extracted && !bucket.observed) {
+  if (bucket.type === EdgeType13.CONTAINS) return out;
+  if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
       out.push({
         type: "missing-observed",
@@ -4786,7 +5445,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType12.CONFIGURED_BY && e.provenance === Provenance11.EXTRACTED) {
+    if (e.type === EdgeType13.CONFIGURED_BY && e.provenance === Provenance13.EXTRACTED) {
       return true;
     }
   }
@@ -4799,8 +5458,8 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType12.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance11.OBSERVED) continue;
+    if (edge.type !== EdgeType13.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance13.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType12.DatabaseNode) continue;
     const observedHost = target.host?.trim();
@@ -4824,8 +5483,8 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType12.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance11.OBSERVED) continue;
+    if (edge.type !== EdgeType13.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance13.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType12.DatabaseNode) continue;
     for (const pair of compatPairs()) {
@@ -4880,6 +5539,23 @@ function detectCompatDivergences(graph, svcId, svc) {
 function involvesNode(d, nodeId) {
   return d.source === nodeId || d.target === nodeId;
 }
+function suppressHostMismatchHalves(all) {
+  const observedHalf = /* @__PURE__ */ new Set();
+  const declaredHalf = /* @__PURE__ */ new Set();
+  for (const d of all) {
+    if (d.type !== "host-mismatch") continue;
+    observedHalf.add(`${d.source}->${d.target}`);
+    declaredHalf.add(databaseId3(d.extractedHost));
+  }
+  if (observedHalf.size === 0) return all;
+  return all.filter((d) => {
+    if (d.type === "missing-extracted" && observedHalf.has(`${d.source}->${d.target}`)) {
+      return false;
+    }
+    if (d.type === "missing-observed" && declaredHalf.has(d.target)) return false;
+    return true;
+  });
+}
 function computeDivergences(graph, opts = {}) {
   const all = [];
   const buckets = bucketEdges(graph);
@@ -4893,7 +5569,8 @@ function computeDivergences(graph, opts = {}) {
     for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
     for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
   });
-  let filtered = all;
+  const reconciled = suppressHostMismatchHalves(all);
+  let filtered = reconciled;
   if (opts.type) {
     const allowed = opts.type;
     filtered = filtered.filter((d) => allowed.has(d.type));
@@ -4931,7 +5608,7 @@ function computeDivergences(graph, opts = {}) {
 // src/persist.ts
 import { promises as fs18 } from "fs";
 import path34 from "path";
-import { Provenance as Provenance12, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+import { Provenance as Provenance14, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -4953,7 +5630,7 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = Provenance12.OBSERVED;
+      attrs.provenance = Provenance14.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
@@ -6077,6 +6754,18 @@ function registerRoutes(scope, ctx) {
     }
     return getTransitiveDependencies(proj.graph, nodeId, depth);
   });
+  scope.get(
+    "/graph/observed-dependencies/:nodeId",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+      if (!proj) return;
+      const { nodeId } = req.params;
+      if (!proj.graph.hasNode(nodeId)) {
+        return reply.code(404).send({ error: "node not found", id: nodeId });
+      }
+      return getObservedDependencies(proj.graph, nodeId);
+    }
+  );
   scope.get("/graph/divergences", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -6137,23 +6826,29 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  const incidentHistoryHandler = async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      reply.code(404).send({ error: "node not found", id: nodeId });
+      return;
+    }
+    const epath = errorsPathFor(proj);
+    if (!epath) return { count: 0, total: 0, events: [] };
+    const events = await readErrorEvents(epath);
+    const filtered = events.filter(
+      (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
+    );
+    return { count: filtered.length, total: filtered.length, events: filtered };
+  };
   scope.get(
     "/incidents/:nodeId",
-    async (req, reply) => {
-      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
-      if (!proj) return;
-      const { nodeId } = req.params;
-      if (!proj.graph.hasNode(nodeId)) {
-        return reply.code(404).send({ error: "node not found", id: nodeId });
-      }
-      const epath = errorsPathFor(proj);
-      if (!epath) return { count: 0, total: 0, events: [] };
-      const events = await readErrorEvents(epath);
-      const filtered = events.filter(
-        (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
-      );
-      return { count: filtered.length, total: filtered.length, events: filtered };
-    }
+    incidentHistoryHandler
+  );
+  scope.get(
+    "/graph/incident-history/:nodeId",
+    incidentHistoryHandler
   );
   scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
@@ -6162,16 +6857,16 @@ function registerRoutes(scope, ctx) {
     if (!proj.graph.hasNode(nodeId)) {
       return reply.code(404).send({ error: "node not found", id: nodeId });
     }
-    let errorEvent;
     const epath = errorsPathFor(proj);
-    if (req.query.errorId && epath) {
-      const events = await readErrorEvents(epath);
-      errorEvent = events.find((e) => e.id === req.query.errorId);
+    const incidents = epath ? await readErrorEvents(epath) : [];
+    let errorEvent;
+    if (req.query.errorId) {
+      errorEvent = incidents.find((e) => e.id === req.query.errorId);
       if (!errorEvent) {
         return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
       }
     }
-    const result = getRootCause(proj.graph, nodeId, errorEvent);
+    const result = getRootCause(proj.graph, nodeId, errorEvent, incidents);
     if (!result) return reply.code(404).send({ error: "no root cause found", id: nodeId });
     return result;
   });
@@ -6316,6 +7011,28 @@ function registerRoutes(scope, ctx) {
     }
     return { violations };
   });
+  scope.get("/policies/applicable", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const nodeId = req.query.node;
+    if (!nodeId) {
+      return reply.code(400).send({ error: 'missing required query param "node"' });
+    }
+    const policyPath = ctx.policyFilePathFor(proj);
+    let policies = [];
+    if (policyPath) {
+      try {
+        policies = await loadPolicyFile(policyPath);
+      } catch (err) {
+        return reply.code(400).send({
+          error: "policy.json failed to parse",
+          details: err.message
+        });
+      }
+    }
+    const applicable = selectApplicablePolicies(proj.graph, policies, nodeId);
+    return { node: nodeId, applicable };
+  });
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -6606,6 +7323,7 @@ export {
   discoverServices,
   addServiceNodes,
   addServiceAliases,
+  addFiles,
   addImports,
   addDatabasesAndCompat,
   addConfigNodes,
@@ -6644,4 +7362,4 @@ export {
   pruneRegistry,
   buildApi
 };
-//# sourceMappingURL=chunk-GNAX2CBF.js.map
+//# sourceMappingURL=chunk-O25KZNZK.js.map