@neat.is/core 0.4.28-dev.20260707 → 0.4.28-dev.20260709

package/dist/{chunk-QM6BMPVJ.js → chunk-5T6J3WKC.js}

@@ -1,7 +1,7 @@
 import {
   mountBearerAuth,
   readAuthEnv
-} from "./chunk-A3322JYS.js";
+} from "./chunk-CFDPIMRP.js";
 
 // src/graph.ts
 import GraphDefault from "graphology";
@@ -456,19 +456,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path42, edges) {
-    if (path42.length > best.path.length) {
-      best = { path: [...path42], edges: [...edges] };
+  function step(node, path43, edges) {
+    if (path43.length > best.path.length) {
+      best = { path: [...path43], edges: [...edges] };
     }
-    if (path42.length - 1 >= maxDepth) return;
+    if (path43.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path42.push(srcId);
+      path43.push(srcId);
       edges.push(edge);
-      step(srcId, path42, edges);
-      path42.pop();
+      step(srcId, path43, edges);
+      path43.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -662,26 +662,26 @@ function dominantFailingCall(graph, serviceId4, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path42 = [originServiceId];
+  const path43 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path42.push(hop.nextService);
+    path43.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path42, edges, culprit: current };
+  return { path: path43, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path42 = [...chain.path];
+  const path43 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -689,14 +689,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path42.push(loc.fileNode);
+      path43.push(loc.fileNode);
       edgeProvenances.push(Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path42,
+      traversalPath: path43,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -708,7 +708,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path42,
+    traversalPath: path43,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -1373,6 +1373,8 @@ var PolicyViolationsLog = class {
 // src/ingest.ts
 import {
   EdgeType as EdgeType3,
+  GraphEdgeSchema,
+  GraphNodeSchema,
   NodeType as NodeType3,
   Provenance as Provenance2,
   confidenceForObservedSignal,
@@ -1877,6 +1879,19 @@ function ensureServiceNode(graph, serviceName, env) {
   graph.addNode(id, node);
   return id;
 }
+function ensureInfraNode(graph, kind, name, provider) {
+  const id = infraId(kind, name);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: NodeType3.InfraNode,
+    name,
+    provider,
+    kind
+  };
+  graph.addNode(id, node);
+  return id;
+}
 function ensureDatabaseNode(graph, host, engine) {
   const id = databaseId(host);
   if (graph.hasNode(id)) return id;
@@ -2529,24 +2544,58 @@ function dedupeIncidents(events) {
     return !hasRealFailure.has(groupKey(ev));
   });
 }
+var SnapshotValidationError = class extends Error {
+  constructor(issues) {
+    super(`snapshot failed validation (${issues.length} invalid ${issues.length === 1 ? "entry" : "entries"})`);
+    this.issues = issues;
+    this.name = "SnapshotValidationError";
+  }
+  issues;
+};
+function describeZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
+  const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
+  const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
+  const issues = [];
+  const validNodes = [];
+  const validEdges = [];
+  for (const node of incomingNodes) {
+    if (node.attributes === void 0) continue;
+    const parsed = GraphNodeSchema.safeParse(node.attributes);
+    if (!parsed.success) {
+      issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    validNodes.push({ key: node.key, attributes: parsed.data });
+  }
+  for (const edge of incomingEdges) {
+    if (edge.attributes === void 0) continue;
+    const parsed = GraphEdgeSchema.safeParse(edge.attributes);
+    if (!parsed.success) {
+      const label = edge.key ?? `${edge.source}->${edge.target}`;
+      issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    const id = edge.key ?? parsed.data.id;
+    validEdges.push({ key: id, source: edge.source, target: edge.target, attributes: parsed.data });
+  }
+  if (issues.length > 0) {
+    throw new SnapshotValidationError(issues);
+  }
   let nodesAdded = 0;
   let edgesAdded = 0;
-  for (const node of exported.nodes ?? []) {
+  for (const node of validNodes) {
     if (graph.hasNode(node.key)) continue;
-    if (!node.attributes) continue;
     graph.addNode(node.key, node.attributes);
     nodesAdded++;
   }
-  for (const edge of exported.edges ?? []) {
-    const attrs = edge.attributes;
-    if (!attrs) continue;
-    const id = edge.key ?? attrs.id;
-    if (!id) continue;
-    if (graph.hasEdge(id)) continue;
+  for (const edge of validEdges) {
+    if (graph.hasEdge(edge.key)) continue;
     if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
-    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    graph.addEdgeWithKey(edge.key, edge.source, edge.target, edge.attributes);
     edgesAdded++;
   }
   return { nodesAdded, edgesAdded };
@@ -4622,10 +4671,10 @@ function fastifyRouteMethods(objNode) {
   }
   return [];
 }
-function serverRoutesFromSource(source, parser, hasExpress, hasFastify) {
+function serverRoutesFromSource(source, parser, hasExpress, hasFastify, hasHono = false) {
   const tree = parseSource2(parser, source);
   const out = [];
-  const framework = hasExpress ? "express" : "fastify";
+  const framework = hasExpress ? "express" : hasFastify ? "fastify" : hasHono ? "hono" : "unknown";
   walk(tree.rootNode, (node) => {
     if (node.type !== "call_expression") return;
     const fn = node.childForFieldName("function");
@@ -4775,8 +4824,9 @@ async function addRoutes(graph, services) {
     };
     const hasExpress = deps["express"] !== void 0;
     const hasFastify = deps["fastify"] !== void 0;
+    const hasHono = deps["hono"] !== void 0;
     const hasNext = deps["next"] !== void 0;
-    if (!hasExpress && !hasFastify && !hasNext) continue;
+    if (!hasExpress && !hasFastify && !hasHono && !hasNext) continue;
     const files = await loadSourceFiles(service.dir);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
@@ -4786,8 +4836,8 @@ async function addRoutes(graph, services) {
       try {
         if (hasNext && (isNextAppRouteFile(relFile) || isNextPagesApiFile(relFile))) {
           routes = nextRoutesFromFile(file.content, relFile, jsParser);
-        } else if (hasExpress || hasFastify) {
-          routes = serverRoutesFromSource(file.content, jsParser, hasExpress, hasFastify);
+        } else if (hasExpress || hasFastify || hasHono) {
+          routes = serverRoutesFromSource(file.content, jsParser, hasExpress, hasFastify, hasHono);
         } else {
           routes = [];
         }
@@ -6119,25 +6169,258 @@ async function addK8sResources(graph, scanPath) {
   return { nodesAdded, edgesAdded: 0 };
 }
 
+// src/extract/infra/cloudflare.ts
+import { promises as fs19 } from "fs";
+import path35 from "path";
+import { parse as parseToml2 } from "smol-toml";
+import { EdgeType as EdgeType16, Provenance as Provenance15, confidenceForExtracted as confidenceForExtracted13 } from "@neat.is/types";
+var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
+async function readWranglerConfig(dir) {
+  for (const filename of WRANGLER_FILENAMES) {
+    const abs = path35.join(dir, filename);
+    if (!await exists(abs)) continue;
+    const raw = await fs19.readFile(abs, "utf8");
+    const config = filename === "wrangler.toml" ? parseToml2(raw) : JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+function lineContaining(raw, needle) {
+  if (!needle) return void 0;
+  const idx = raw.indexOf(needle);
+  if (idx === -1) return void 0;
+  let line = 1;
+  for (let i = 0; i < idx; i++) if (raw[i] === "\n") line++;
+  return line;
+}
+function normalizeRoutes(config) {
+  const out = [];
+  const pushOne = (r) => {
+    if (typeof r === "string") out.push(r);
+    else if (r && typeof r === "object" && typeof r.pattern === "string") {
+      out.push(r.pattern);
+    }
+  };
+  if (Array.isArray(config.routes)) config.routes.forEach(pushOne);
+  else if (config.route) pushOne(config.route);
+  return out;
+}
+function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, line) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const node = makeInfraNode(kind, name, "cloudflare");
+  if (!graph.hasNode(node.id)) {
+    graph.addNode(node.id, node);
+    nodesAdded++;
+  }
+  if (node.id === anchorId) return { nodesAdded, edgesAdded };
+  const edgeId = extractedEdgeId2(anchorId, node.id, edgeType);
+  if (!graph.hasEdge(edgeId)) {
+    const edge = {
+      id: edgeId,
+      source: anchorId,
+      target: node.id,
+      type: edgeType,
+      provenance: Provenance15.EXTRACTED,
+      confidence: confidenceForExtracted13("structural"),
+      evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
+    };
+    graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
+async function addCloudflareWorkers(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const discovered = [];
+  const workerIndex = /* @__PURE__ */ new Map();
+  for (const service of services) {
+    let read;
+    try {
+      read = await readWranglerConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra cloudflare", path35.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read || !read.config.name) continue;
+    const evidenceFile = toPosix2(path35.relative(scanPath, path35.join(service.dir, read.relFile)));
+    discovered.push({ service, config: read.config, relFile: read.relFile, raw: read.raw, evidenceFile });
+  }
+  for (const worker of discovered) {
+    const { service, config } = worker;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "cloudflare") {
+      const updated = { ...serviceNode, platform: "cloudflare" };
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+    let anchorId = service.node.id;
+    if (config.main) {
+      const entryRelPath = toPosix2(path35.normalize(config.main));
+      const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
+        graph,
+        service.pkg.name,
+        service.node.id,
+        entryRelPath
+      );
+      nodesAdded += fn;
+      edgesAdded += fe;
+      const fileNode = graph.getNodeAttributes(fileNodeId);
+      if (fileNode.platform !== "cloudflare" || fileNode.platformName !== config.name) {
+        const updated = { ...fileNode, platform: "cloudflare", platformName: config.name };
+        graph.replaceNodeAttributes(fileNodeId, updated);
+      }
+      anchorId = fileNodeId;
+    }
+    workerIndex.set(config.name, { anchorId });
+  }
+  for (const worker of discovered) {
+    const { config, evidenceFile, raw } = worker;
+    const anchorId = workerIndex.get(config.name).anchorId;
+    const runtimeNode = makeInfraNode("workerd", "cloudflare", "cloudflare");
+    if (!graph.hasNode(runtimeNode.id)) {
+      graph.addNode(runtimeNode.id, runtimeNode);
+      nodesAdded++;
+    }
+    if (runtimeNode.id !== anchorId) {
+      const runsOnId = extractedEdgeId2(anchorId, runtimeNode.id, EdgeType16.RUNS_ON);
+      if (!graph.hasEdge(runsOnId)) {
+        const edge = {
+          id: runsOnId,
+          source: anchorId,
+          target: runtimeNode.id,
+          type: EdgeType16.RUNS_ON,
+          provenance: Provenance15.EXTRACTED,
+          confidence: confidenceForExtracted13("structural"),
+          evidence: {
+            file: evidenceFile,
+            ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
+          }
+        };
+        graph.addEdgeWithKey(runsOnId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+    for (const route of normalizeRoutes(config)) {
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        EdgeType16.CONNECTS_TO,
+        "cloudflare-route",
+        route,
+        evidenceFile,
+        lineContaining(raw, route)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+    const bindingGroups = [
+      { kind: "cloudflare-kv", entries: config.kv_namespaces ?? [], nameOf: (b) => b.binding },
+      { kind: "cloudflare-d1", entries: config.d1_databases ?? [], nameOf: (b) => b.binding },
+      { kind: "cloudflare-r2", entries: config.r2_buckets ?? [], nameOf: (b) => b.binding },
+      { kind: "cloudflare-durable-object", entries: config.durable_objects?.bindings ?? [], nameOf: (b) => b.name },
+      { kind: "cloudflare-queue", entries: config.queues?.producers ?? [], nameOf: (b) => b.queue },
+      { kind: "cloudflare-queue", entries: config.queues?.consumers ?? [], nameOf: (b) => b.queue }
+    ];
+    for (const group of bindingGroups) {
+      for (const entry of group.entries) {
+        const name = group.nameOf(entry);
+        if (!name) continue;
+        const result = addResourceEdge(
+          graph,
+          anchorId,
+          EdgeType16.DEPENDS_ON,
+          group.kind,
+          name,
+          evidenceFile,
+          lineContaining(raw, name)
+        );
+        nodesAdded += result.nodesAdded;
+        edgesAdded += result.edgesAdded;
+      }
+    }
+    for (const cron of config.triggers?.crons ?? []) {
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        EdgeType16.DEPENDS_ON,
+        "cloudflare-cron",
+        cron,
+        evidenceFile,
+        lineContaining(raw, cron)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+    for (const varName of Object.keys(config.vars ?? {})) {
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        EdgeType16.DEPENDS_ON,
+        "cloudflare-env-var",
+        varName,
+        evidenceFile,
+        lineContaining(raw, varName)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+    for (const svc of config.services ?? []) {
+      if (!svc.service) continue;
+      const target = workerIndex.get(svc.service);
+      if (target && target.anchorId !== anchorId) {
+        const edgeId = extractedEdgeId2(anchorId, target.anchorId, EdgeType16.CALLS);
+        if (!graph.hasEdge(edgeId)) {
+          const edge = {
+            id: edgeId,
+            source: anchorId,
+            target: target.anchorId,
+            type: EdgeType16.CALLS,
+            provenance: Provenance15.EXTRACTED,
+            confidence: confidenceForExtracted13("structural"),
+            evidence: { file: evidenceFile, line: lineContaining(raw, svc.service) }
+          };
+          graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+          edgesAdded++;
+        }
+        continue;
+      }
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        EdgeType16.DEPENDS_ON,
+        "cloudflare-service-binding",
+        svc.service,
+        evidenceFile,
+        lineContaining(raw, svc.service)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
 // src/extract/infra/index.ts
 async function addInfra(graph, scanPath, services) {
   const compose = await addComposeInfra(graph, scanPath, services);
   const dockerfile = await addDockerfileRuntimes(graph, services, scanPath);
   const terraform = await addTerraformResources(graph, scanPath);
   const k8s = await addK8sResources(graph, scanPath);
+  const cloudflare = await addCloudflareWorkers(graph, services, scanPath);
   return {
-    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded,
-    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded
   };
 }
 
 // src/extract/index.ts
-import path36 from "path";
+import path37 from "path";
 
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
-import path35 from "path";
-import { NodeType as NodeType14, Provenance as Provenance15 } from "@neat.is/types";
+import path36 from "path";
+import { NodeType as NodeType14, Provenance as Provenance16 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
@@ -6154,7 +6437,7 @@ function retireEdgesByFile(graph, file) {
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance15.EXTRACTED) return;
+    if (edge.provenance !== Provenance16.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -6167,14 +6450,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance15.EXTRACTED) return;
+    if (edge.provenance !== Provenance16.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (path35.isAbsolute(evidenceFile)) {
+    if (path36.isAbsolute(evidenceFile)) {
       if (!existsSync2(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => existsSync2(path35.join(base, evidenceFile)));
+    const found = bases.some((base) => existsSync2(path36.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -6216,7 +6499,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = path36.join(path36.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = path37.join(path37.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -6252,10 +6535,10 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 import {
   databaseId as databaseId3,
   DivergenceResultSchema,
-  EdgeType as EdgeType16,
+  EdgeType as EdgeType17,
   NodeType as NodeType15,
   parseEdgeId,
-  Provenance as Provenance16
+  Provenance as Provenance17
 } from "@neat.is/types";
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
@@ -6269,17 +6552,17 @@ function bucketEdges(graph) {
     const key = bucketKey(e.source, e.target, e.type);
     const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
-      case Provenance16.EXTRACTED:
+      case Provenance17.EXTRACTED:
         cur.extracted = e;
         break;
-      case Provenance16.OBSERVED:
+      case Provenance17.OBSERVED:
         cur.observed = e;
         break;
-      case Provenance16.INFERRED:
+      case Provenance17.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === Provenance16.STALE) cur.stale = e;
+        if (e.provenance === Provenance17.STALE) cur.stale = e;
     }
     buckets.set(key, cur);
   });
@@ -6313,14 +6596,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  EdgeType16.CALLS,
-  EdgeType16.CONNECTS_TO,
-  EdgeType16.PUBLISHES_TO,
-  EdgeType16.CONSUMES_FROM
+  EdgeType17.CALLS,
+  EdgeType17.CONNECTS_TO,
+  EdgeType17.PUBLISHES_TO,
+  EdgeType17.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === EdgeType16.CONTAINS) return out;
+  if (bucket.type === EdgeType17.CONTAINS) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
       out.push({
@@ -6361,7 +6644,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType16.CONFIGURED_BY && e.provenance === Provenance16.EXTRACTED) {
+    if (e.type === EdgeType17.CONFIGURED_BY && e.provenance === Provenance17.EXTRACTED) {
       return true;
     }
   }
@@ -6374,8 +6657,8 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType16.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance16.OBSERVED) continue;
+    if (edge.type !== EdgeType17.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance17.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType15.DatabaseNode) continue;
     const observedHost = target.host?.trim();
@@ -6399,8 +6682,8 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType16.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance16.OBSERVED) continue;
+    if (edge.type !== EdgeType17.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance17.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType15.DatabaseNode) continue;
     for (const pair of compatPairs()) {
@@ -6522,9 +6805,9 @@ function computeDivergences(graph, opts = {}) {
 }
 
 // src/persist.ts
-import { promises as fs19 } from "fs";
-import path37 from "path";
-import { Provenance as Provenance17, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+import { promises as fs20 } from "fs";
+import path38 from "path";
+import { Provenance as Provenance18, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -6546,7 +6829,7 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = Provenance17.OBSERVED;
+      attrs.provenance = Provenance18.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
@@ -6560,7 +6843,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await fs19.mkdir(path37.dirname(filePath), { recursive: true });
+  await fs20.mkdir(path38.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -6570,13 +6853,13 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  await fs19.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await fs19.rename(tmp, outPath);
+  await fs20.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await fs20.rename(tmp, outPath);
 }
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await fs19.readFile(outPath, "utf8");
+    raw = await fs20.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -6640,7 +6923,7 @@ function startPersistLoop(graph, outPath, opts = {}) {
 }
 
 // src/diff.ts
-import { promises as fs20 } from "fs";
+import { promises as fs21 } from "fs";
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -6649,7 +6932,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await fs20.readFile(target, "utf8");
+  const raw = await fs21.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -6716,23 +6999,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path38 from "path";
+import path39 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path38.join(baseDir, "graph.json"),
-      errorsPath: path38.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path38.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path38.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path38.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path39.join(baseDir, "graph.json"),
+      errorsPath: path39.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path39.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path39.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path39.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path38.join(baseDir, `${project}.json`),
-    errorsPath: path38.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path38.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path38.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path38.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path39.join(baseDir, `${project}.json`),
+    errorsPath: path39.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path39.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path39.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path39.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -6771,9 +7054,9 @@ function parseExtraProjects(raw) {
 }
 
 // src/registry.ts
-import { promises as fs21 } from "fs";
+import { promises as fs22 } from "fs";
 import os2 from "os";
-import path39 from "path";
+import path40 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -6781,20 +7064,20 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path39.resolve(override);
-  return path39.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path40.resolve(override);
+  return path40.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path39.join(neatHome(), "projects.json");
+  return path40.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path39.join(neatHome(), "projects.json.lock");
+  return path40.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return path39.join(neatHome(), "neatd.pid");
+  return path40.join(neatHome(), "neatd.pid");
 }
 function daemonsDir() {
-  return path39.join(neatHome(), "daemons");
+  return path40.join(neatHome(), "daemons");
 }
 function isFiniteInt(v) {
   return typeof v === "number" && Number.isFinite(v);
@@ -6827,7 +7110,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const dir = daemonsDir();
   let names;
   try {
-    names = await fs21.readdir(dir);
+    names = await fs22.readdir(dir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -6835,10 +7118,10 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const out = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const file = path39.join(dir, name);
+    const file = path40.join(dir, name);
     let raw;
     try {
-      raw = await fs21.readFile(file, "utf8");
+      raw = await fs22.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -6851,7 +7134,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   return out;
 }
 async function removeDaemonRecord(source) {
-  await fs21.unlink(source).catch(() => {
+  await fs22.unlink(source).catch(() => {
   });
 }
 async function listMachineProjects(probe = defaultDiscoveryProbe) {
@@ -6908,7 +7191,7 @@ function isPidAliveDefault(pid) {
 }
 async function readPidFile(file) {
   try {
-    const raw = await fs21.readFile(file, "utf8");
+    const raw = await fs22.readFile(file, "utf8");
     const pid = Number.parseInt(raw.trim(), 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
   } catch {
@@ -6956,32 +7239,32 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function normalizeProjectPath(input) {
-  const resolved = path39.resolve(input);
+  const resolved = path40.resolve(input);
   try {
-    return await fs21.realpath(resolved);
+    return await fs22.realpath(resolved);
   } catch {
     return resolved;
   }
 }
 async function writeAtomically(target, contents) {
-  await fs21.mkdir(path39.dirname(target), { recursive: true });
+  await fs22.mkdir(path40.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs21.open(tmp, "w");
+  const fd = await fs22.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await fs21.rename(tmp, target);
+  await fs22.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await fs21.mkdir(path39.dirname(lockPath), { recursive: true });
+  await fs22.mkdir(path40.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
-      const fd = await fs21.open(lockPath, "wx");
+      const fd = await fs22.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -7006,7 +7289,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaul
   }
 }
 async function releaseLock(lockPath) {
-  await fs21.unlink(lockPath).catch(() => {
+  await fs22.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -7022,7 +7305,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await fs21.readFile(file, "utf8");
+    raw = await fs22.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -7127,7 +7410,7 @@ function pruneTtlMs() {
 }
 async function statPathStatus(p) {
   try {
-    const stat = await fs21.stat(p);
+    const stat = await fs22.stat(p);
     return stat.isDirectory() ? "present" : "unknown";
   } catch (err) {
     return err.code === "ENOENT" ? "gone" : "unknown";
@@ -7172,14 +7455,14 @@ import cors from "@fastify/cors";
 import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
 
 // src/extend/index.ts
-import { promises as fs23 } from "fs";
-import path41 from "path";
+import { promises as fs24 } from "fs";
+import path42 from "path";
 import os3 from "os";
 import { resolve as registryResolve, list as registryList } from "@neat.is/instrumentation-registry";
 
 // src/installers/package-manager.ts
-import { promises as fs22 } from "fs";
-import path40 from "path";
+import { promises as fs23 } from "fs";
+import path41 from "path";
 import { spawn } from "child_process";
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -7194,29 +7477,29 @@ var LOCKFILE_PRIORITY = [
 var NPM_FALLBACK_ARGS = ["install", "--no-audit", "--no-fund", "--prefer-offline"];
 async function exists2(p) {
   try {
-    await fs22.access(p);
+    await fs23.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = path40.resolve(serviceDir);
+  let dir = path41.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path40.join(dir, candidate.lockfile);
+      const lockPath = path41.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = path40.dirname(dir);
+    const parent = path41.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: path40.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: path41.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -7258,30 +7541,30 @@ ${err.message}`
 // src/extend/index.ts
 async function fileExists2(p) {
   try {
-    await fs23.access(p);
+    await fs24.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = path41.join(scanPath, "package.json");
-  const raw = await fs23.readFile(pkgPath, "utf8");
+  const pkgPath = path42.join(scanPath, "package.json");
+  const raw = await fs24.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
 async function findHookFiles(scanPath) {
-  const entries = await fs23.readdir(scanPath);
+  const entries = await fs24.readdir(scanPath);
   return entries.filter(
     (e) => (e.startsWith("instrumentation") || e.startsWith("otel-init")) && /\.(ts|js)$/.test(e)
   ).sort();
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? path41.join(os3.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? path42.join(os3.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry) {
   const logPath = extendLogPath();
-  await fs23.mkdir(path41.dirname(logPath), { recursive: true });
-  await fs23.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
+  await fs24.mkdir(path42.dirname(logPath), { recursive: true });
+  await fs24.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
   if (fileContent.includes("__INSTRUMENTATION_BLOCK__")) {
@@ -7339,7 +7622,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(path41.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(path42.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     registryList().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -7361,31 +7644,31 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await fs23.readFile(path41.join(ctx.scanPath, file), "utf8");
+    const content = await fs24.readFile(path42.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
   }
   const primaryFile = hookFiles[0];
-  const primaryPath = path41.join(ctx.scanPath, primaryFile);
+  const primaryPath = path42.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = path41.join(ctx.scanPath, "package.json");
+  const pkgPath = path42.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
-    await fs23.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    await fs24.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     filesTouched.push("package.json");
     depsAdded.push(`${args.instrumentation_package}@${args.version}`);
   }
-  const hookContent = await fs23.readFile(primaryPath, "utf8");
+  const hookContent = await fs24.readFile(primaryPath, "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (!patched) {
     throw new Error(
       `Could not find instrumentation insertion point in ${primaryFile}. Expected __INSTRUMENTATION_BLOCK__, instrumentations.push(, or new NodeSDK(.`
     );
   }
-  await fs23.writeFile(primaryPath, patched, "utf8");
+  await fs24.writeFile(primaryPath, patched, "utf8");
   filesTouched.push(primaryFile);
   const cmd = await detectPackageManager(ctx.scanPath);
   const installer = options?.runInstall ?? runPackageManagerInstall;
@@ -7416,7 +7699,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await fs23.readFile(path41.join(ctx.scanPath, file), "utf8");
+    const content = await fs24.readFile(path42.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -7438,7 +7721,7 @@ async function dryRunExtension(ctx, args) {
     depsToAdd.push(`${args.instrumentation_package}@${args.version}`);
     filesTouched.push("package.json");
   }
-  const hookContent = await fs23.readFile(path41.join(ctx.scanPath, primaryFile), "utf8");
+  const hookContent = await fs24.readFile(path42.join(ctx.scanPath, primaryFile), "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (patched) {
     filesTouched.push(primaryFile);
@@ -7453,28 +7736,28 @@ async function rollbackExtension(ctx, args) {
   if (!await fileExists2(logPath)) {
     return { undone: false, message: "no apply found for library" };
   }
-  const raw = await fs23.readFile(logPath, "utf8");
+  const raw = await fs24.readFile(logPath, "utf8");
   const entries = raw.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line));
   const match = [...entries].reverse().find((e) => e.project === ctx.project && e.library === args.library);
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = path41.join(ctx.scanPath, "package.json");
+  const pkgPath = path42.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
       const { [match.instrumentation_package]: _removed, ...rest } = pkg.dependencies;
       pkg.dependencies = rest;
-      await fs23.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+      await fs24.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     }
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = path41.join(ctx.scanPath, file);
-    const content = await fs23.readFile(filePath, "utf8");
+    const filePath = path42.join(ctx.scanPath, file);
+    const content = await fs24.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
-      await fs23.writeFile(filePath, filtered, "utf8");
+      await fs24.writeFile(filePath, filtered, "utf8");
       break;
     }
   }
@@ -7484,6 +7767,50 @@ async function rollbackExtension(ctx, args) {
   };
 }
 
+// src/logs-store.ts
+var LOGS_STORE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LOGS_QUERY_DEFAULT_LIMIT = 100;
+var LOGS_QUERY_MAX_LIMIT = 1e3;
+var buffers = /* @__PURE__ */ new Map();
+var KEY_SEP = "::";
+function bufferKey(projectName, source) {
+  return `${projectName}${KEY_SEP}${source}`;
+}
+function sourcesForProject(projectName) {
+  const prefix = `${projectName}${KEY_SEP}`;
+  const sources = [];
+  for (const key of buffers.keys()) {
+    if (key.startsWith(prefix)) sources.push(key.slice(prefix.length));
+  }
+  return sources;
+}
+function queryLogEntries(opts) {
+  const { projectName, source, service, since, limit } = opts;
+  const sources = source && source.length > 0 ? source : sourcesForProject(projectName);
+  let merged = [];
+  for (const src of sources) {
+    const buf = buffers.get(bufferKey(projectName, src));
+    if (buf) merged = merged.concat(buf);
+  }
+  if (service) {
+    merged = merged.filter((e) => e.serviceName === service);
+  }
+  if (since) {
+    const sinceMs = Date.parse(since);
+    if (!Number.isNaN(sinceMs)) {
+      merged = merged.filter((e) => {
+        const t = Date.parse(e.timestamp);
+        return Number.isNaN(t) || t >= sinceMs;
+      });
+    }
+  }
+  merged.sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp));
+  if (typeof limit === "number" && Number.isFinite(limit) && limit >= 0) {
+    return merged.slice(0, limit);
+  }
+  return merged;
+}
+
 // src/streaming.ts
 var SSE_HEARTBEAT_MS = 3e4;
 var SSE_BACKPRESSURE_CAP = 1e3;
@@ -7742,6 +8069,23 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  scope.get("/logs", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const rawSource = req.query.source;
+    const sources = rawSource === void 0 ? void 0 : Array.isArray(rawSource) ? rawSource : [rawSource];
+    const filtered = queryLogEntries({
+      projectName: proj.name,
+      ...sources && sources.length > 0 ? { source: sources } : {},
+      ...req.query.service ? { service: req.query.service } : {},
+      ...req.query.since ? { since: req.query.since } : {}
+    });
+    const total = filtered.length;
+    const limit = req.query.limit ? Number(req.query.limit) : LOGS_QUERY_DEFAULT_LIMIT;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, LOGS_QUERY_MAX_LIMIT) : LOGS_QUERY_DEFAULT_LIMIT;
+    const sliced = filtered.slice(0, safeLimit);
+    return { count: sliced.length, total, logs: sliced };
+  });
   const incidentHistoryHandler = async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -7837,8 +8181,16 @@ function registerRoutes(scope, ctx) {
       if (!against) {
         return reply.code(400).send({ error: "query parameter `against` is required" });
       }
+      const targetProjectName = against === "self" ? proj.name : against;
+      const targetProject = registry.get(targetProjectName);
+      if (!targetProject) {
+        return reply.code(400).send({
+          error: "unknown snapshot id \u2014 `against` must be `self` or the name of a project this server has a snapshot for",
+          against
+        });
+      }
       try {
-        const snapshot = await loadSnapshotForDiff(against);
+        const snapshot = await loadSnapshotForDiff(targetProject.paths.snapshotPath);
         return computeGraphDiff(proj.graph, snapshot);
       } catch (err) {
         return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
@@ -7868,6 +8220,13 @@ function registerRoutes(scope, ctx) {
         edgeCount: proj.graph.size
       };
     } catch (err) {
+      if (err instanceof SnapshotValidationError) {
+        return reply.code(400).send({
+          error: "snapshot merge failed",
+          details: err.message,
+          issues: err.issues
+        });
+      }
       return reply.code(400).send({
         error: "snapshot merge failed",
         details: err.message
@@ -8227,6 +8586,7 @@ export {
   reconcileObservedRelPath,
   ensureObservedFileNode,
   ensureServiceNode,
+  ensureInfraNode,
   upsertObservedEdge,
   stitchTrace,
   makeErrorSpanWriter,
@@ -8247,6 +8607,7 @@ export {
   addImports,
   addDatabasesAndCompat,
   addConfigNodes,
+  normalizePathTemplate,
   addCallEdges,
   addInfra,
   retireEdgesByFile,
@@ -8282,4 +8643,4 @@ export {
   pruneRegistry,
   buildApi
 };
-//# sourceMappingURL=chunk-QM6BMPVJ.js.map
+//# sourceMappingURL=chunk-5T6J3WKC.js.map