@neat.is/core 0.4.28-dev.20260707 → 0.4.28-dev.20260709

package/dist/server.cjs

@@ -53,15 +53,16 @@ function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
   const expected = Buffer.from(opts.token, "utf8");
-  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const exactUnauthPaths = /* @__PURE__ */ new Set([
+    ...DEFAULT_UNAUTH_PATHS,
+    ...opts.extraUnauthenticatedSuffixes ?? []
+  ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path46 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    for (const suffix of suffixes) {
-      if (path46 === suffix || path46.endsWith(suffix)) {
-        done();
-        return;
-      }
+    const path47 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path47) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path47)) {
+      done();
+      return;
     }
     if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
       done();
@@ -96,7 +97,7 @@ function readAuthEnv(env = process.env) {
     publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -117,12 +118,15 @@ var init_auth = __esm({
       }
     };
     PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-    DEFAULT_UNAUTH_SUFFIXES = [
+    DEFAULT_UNAUTH_PATHS = [
       "/health",
       "/healthz",
       "/readyz",
       "/api/config"
     ];
+    PROJECT_SCOPED_UNAUTH_PATTERN = new RegExp(
+      `^/projects/[^/]+/(?:${DEFAULT_UNAUTH_PATHS.map((p) => p.slice(1)).join("|")})$`
+    );
   }
 });
 
@@ -188,8 +192,8 @@ function reshapeGrpcRequest(req) {
   };
 }
 function resolveProtoRoot() {
-  const here = import_node_path42.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
-  return import_node_path42.default.resolve(here, "..", "proto");
+  const here = import_node_path43.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path43.default.resolve(here, "..", "proto");
 }
 function loadTraceService() {
   const protoRoot = resolveProtoRoot();
@@ -257,13 +261,13 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path42, import_node_crypto2, grpc, protoLoader;
+var import_node_url, import_node_path43, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
-    import_node_path42 = __toESM(require("path"), 1);
+    import_node_path43 = __toESM(require("path"), 1);
     import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
@@ -356,8 +360,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path46 = q === -1 ? v : v.slice(0, q);
-      if (path46.length > 0) return path46;
+      const path47 = q === -1 ? v : v.slice(0, q);
+      if (path47.length > 0) return path47;
     }
   }
   return void 0;
@@ -411,10 +415,10 @@ function parseOtlpRequest(body) {
   return out;
 }
 function loadProtoRoot() {
-  const here = import_node_path43.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
-  const protoRoot = import_node_path43.default.resolve(here, "..", "proto");
+  const here = import_node_path44.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path44.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
-  root.resolvePath = (_origin, target) => import_node_path43.default.resolve(protoRoot, target);
+  root.resolvePath = (_origin, target) => import_node_path44.default.resolve(protoRoot, target);
   root.loadSync(
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
@@ -626,12 +630,12 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path43, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+var import_node_path44, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path43 = __toESM(require("path"), 1);
+    import_node_path44 = __toESM(require("path"), 1);
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
@@ -647,7 +651,7 @@ var init_otel = __esm({
 
 // src/server.ts
 init_cjs_shims();
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 
 // src/graph.ts
 init_cjs_shims();
@@ -671,7 +675,7 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types29 = require("@neat.is/types");
+var import_types30 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -1414,19 +1418,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path46, edges) {
-    if (path46.length > best.path.length) {
-      best = { path: [...path46], edges: [...edges] };
+  function step(node, path47, edges) {
+    if (path47.length > best.path.length) {
+      best = { path: [...path47], edges: [...edges] };
     }
-    if (path46.length - 1 >= maxDepth) return;
+    if (path47.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path46.push(srcId);
+      path47.push(srcId);
       edges.push(edge);
-      step(srcId, path46, edges);
-      path46.pop();
+      step(srcId, path47, edges);
+      path47.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1620,26 +1624,26 @@ function dominantFailingCall(graph, serviceId4, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path46 = [originServiceId];
+  const path47 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path46.push(hop.nextService);
+    path47.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path46, edges, culprit: current };
+  return { path: path47, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path46 = [...chain.path];
+  const path47 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1647,14 +1651,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path46.push(loc.fileNode);
+      path47.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path46,
+      traversalPath: path47,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1666,7 +1670,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path46,
+    traversalPath: path47,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2077,6 +2081,51 @@ function computeDivergences(graph, opts = {}) {
   });
 }
 
+// src/logs-store.ts
+init_cjs_shims();
+var LOGS_STORE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LOGS_QUERY_DEFAULT_LIMIT = 100;
+var LOGS_QUERY_MAX_LIMIT = 1e3;
+var buffers = /* @__PURE__ */ new Map();
+var KEY_SEP = "::";
+function bufferKey(projectName, source) {
+  return `${projectName}${KEY_SEP}${source}`;
+}
+function sourcesForProject(projectName) {
+  const prefix = `${projectName}${KEY_SEP}`;
+  const sources = [];
+  for (const key of buffers.keys()) {
+    if (key.startsWith(prefix)) sources.push(key.slice(prefix.length));
+  }
+  return sources;
+}
+function queryLogEntries(opts) {
+  const { projectName, source, service, since, limit } = opts;
+  const sources = source && source.length > 0 ? source : sourcesForProject(projectName);
+  let merged = [];
+  for (const src of sources) {
+    const buf = buffers.get(bufferKey(projectName, src));
+    if (buf) merged = merged.concat(buf);
+  }
+  if (service) {
+    merged = merged.filter((e) => e.serviceName === service);
+  }
+  if (since) {
+    const sinceMs = Date.parse(since);
+    if (!Number.isNaN(sinceMs)) {
+      merged = merged.filter((e) => {
+        const t = Date.parse(e.timestamp);
+        return Number.isNaN(t) || t >= sinceMs;
+      });
+    }
+  }
+  merged.sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp));
+  if (typeof limit === "number" && Number.isFinite(limit) && limit >= 0) {
+    return merged.slice(0, limit);
+  }
+  return merged;
+}
+
 // src/policy.ts
 init_cjs_shims();
 var import_node_fs4 = require("fs");
@@ -3663,24 +3712,58 @@ function dedupeIncidents(events) {
     return !hasRealFailure.has(groupKey(ev));
   });
 }
+var SnapshotValidationError = class extends Error {
+  constructor(issues) {
+    super(`snapshot failed validation (${issues.length} invalid ${issues.length === 1 ? "entry" : "entries"})`);
+    this.issues = issues;
+    this.name = "SnapshotValidationError";
+  }
+  issues;
+};
+function describeZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
+  const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
+  const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
+  const issues = [];
+  const validNodes = [];
+  const validEdges = [];
+  for (const node of incomingNodes) {
+    if (node.attributes === void 0) continue;
+    const parsed = import_types4.GraphNodeSchema.safeParse(node.attributes);
+    if (!parsed.success) {
+      issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    validNodes.push({ key: node.key, attributes: parsed.data });
+  }
+  for (const edge of incomingEdges) {
+    if (edge.attributes === void 0) continue;
+    const parsed = import_types4.GraphEdgeSchema.safeParse(edge.attributes);
+    if (!parsed.success) {
+      const label = edge.key ?? `${edge.source}->${edge.target}`;
+      issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    const id = edge.key ?? parsed.data.id;
+    validEdges.push({ key: id, source: edge.source, target: edge.target, attributes: parsed.data });
+  }
+  if (issues.length > 0) {
+    throw new SnapshotValidationError(issues);
+  }
   let nodesAdded = 0;
   let edgesAdded = 0;
-  for (const node of exported.nodes ?? []) {
+  for (const node of validNodes) {
     if (graph.hasNode(node.key)) continue;
-    if (!node.attributes) continue;
     graph.addNode(node.key, node.attributes);
     nodesAdded++;
   }
-  for (const edge of exported.edges ?? []) {
-    const attrs = edge.attributes;
-    if (!attrs) continue;
-    const id = edge.key ?? attrs.id;
-    if (!id) continue;
-    if (graph.hasEdge(id)) continue;
+  for (const edge of validEdges) {
+    if (graph.hasEdge(edge.key)) continue;
     if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
-    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    graph.addEdgeWithKey(edge.key, edge.source, edge.target, edge.attributes);
     edgesAdded++;
   }
   return { nodesAdded, edgesAdded };
@@ -5735,10 +5818,10 @@ function fastifyRouteMethods(objNode) {
   }
   return [];
 }
-function serverRoutesFromSource(source, parser, hasExpress, hasFastify) {
+function serverRoutesFromSource(source, parser, hasExpress, hasFastify, hasHono = false) {
   const tree = parseSource2(parser, source);
   const out = [];
-  const framework = hasExpress ? "express" : "fastify";
+  const framework = hasExpress ? "express" : hasFastify ? "fastify" : hasHono ? "hono" : "unknown";
   walk(tree.rootNode, (node) => {
     if (node.type !== "call_expression") return;
     const fn = node.childForFieldName("function");
@@ -5888,8 +5971,9 @@ async function addRoutes(graph, services) {
     };
     const hasExpress = deps["express"] !== void 0;
     const hasFastify = deps["fastify"] !== void 0;
+    const hasHono = deps["hono"] !== void 0;
     const hasNext = deps["next"] !== void 0;
-    if (!hasExpress && !hasFastify && !hasNext) continue;
+    if (!hasExpress && !hasFastify && !hasHono && !hasNext) continue;
     const files = await loadSourceFiles(service.dir);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
@@ -5899,8 +5983,8 @@ async function addRoutes(graph, services) {
       try {
         if (hasNext && (isNextAppRouteFile(relFile) || isNextPagesApiFile(relFile))) {
           routes = nextRoutesFromFile(file.content, relFile, jsParser);
-        } else if (hasExpress || hasFastify) {
-          routes = serverRoutesFromSource(file.content, jsParser, hasExpress, hasFastify);
+        } else if (hasExpress || hasFastify || hasHono) {
+          routes = serverRoutesFromSource(file.content, jsParser, hasExpress, hasFastify, hasHono);
         } else {
           routes = [];
         }
@@ -7224,30 +7308,264 @@ async function addK8sResources(graph, scanPath) {
   return { nodesAdded, edgesAdded: 0 };
 }
 
+// src/extract/infra/cloudflare.ts
+init_cjs_shims();
+var import_node_fs21 = require("fs");
+var import_node_path37 = __toESM(require("path"), 1);
+var import_smol_toml2 = require("smol-toml");
+var import_types26 = require("@neat.is/types");
+var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
+async function readWranglerConfig(dir) {
+  for (const filename of WRANGLER_FILENAMES) {
+    const abs = import_node_path37.default.join(dir, filename);
+    if (!await exists2(abs)) continue;
+    const raw = await import_node_fs21.promises.readFile(abs, "utf8");
+    const config = filename === "wrangler.toml" ? (0, import_smol_toml2.parse)(raw) : JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+function lineContaining(raw, needle) {
+  if (!needle) return void 0;
+  const idx = raw.indexOf(needle);
+  if (idx === -1) return void 0;
+  let line = 1;
+  for (let i = 0; i < idx; i++) if (raw[i] === "\n") line++;
+  return line;
+}
+function normalizeRoutes(config) {
+  const out = [];
+  const pushOne = (r) => {
+    if (typeof r === "string") out.push(r);
+    else if (r && typeof r === "object" && typeof r.pattern === "string") {
+      out.push(r.pattern);
+    }
+  };
+  if (Array.isArray(config.routes)) config.routes.forEach(pushOne);
+  else if (config.route) pushOne(config.route);
+  return out;
+}
+function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, line) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const node = makeInfraNode(kind, name, "cloudflare");
+  if (!graph.hasNode(node.id)) {
+    graph.addNode(node.id, node);
+    nodesAdded++;
+  }
+  if (node.id === anchorId) return { nodesAdded, edgesAdded };
+  const edgeId = (0, import_types5.extractedEdgeId)(anchorId, node.id, edgeType);
+  if (!graph.hasEdge(edgeId)) {
+    const edge = {
+      id: edgeId,
+      source: anchorId,
+      target: node.id,
+      type: edgeType,
+      provenance: import_types26.Provenance.EXTRACTED,
+      confidence: (0, import_types26.confidenceForExtracted)("structural"),
+      evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
+    };
+    graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
+async function addCloudflareWorkers(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const discovered = [];
+  const workerIndex = /* @__PURE__ */ new Map();
+  for (const service of services) {
+    let read;
+    try {
+      read = await readWranglerConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra cloudflare", import_node_path37.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read || !read.config.name) continue;
+    const evidenceFile = toPosix2(import_node_path37.default.relative(scanPath, import_node_path37.default.join(service.dir, read.relFile)));
+    discovered.push({ service, config: read.config, relFile: read.relFile, raw: read.raw, evidenceFile });
+  }
+  for (const worker of discovered) {
+    const { service, config } = worker;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "cloudflare") {
+      const updated = { ...serviceNode, platform: "cloudflare" };
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+    let anchorId = service.node.id;
+    if (config.main) {
+      const entryRelPath = toPosix2(import_node_path37.default.normalize(config.main));
+      const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
+        graph,
+        service.pkg.name,
+        service.node.id,
+        entryRelPath
+      );
+      nodesAdded += fn;
+      edgesAdded += fe;
+      const fileNode = graph.getNodeAttributes(fileNodeId);
+      if (fileNode.platform !== "cloudflare" || fileNode.platformName !== config.name) {
+        const updated = { ...fileNode, platform: "cloudflare", platformName: config.name };
+        graph.replaceNodeAttributes(fileNodeId, updated);
+      }
+      anchorId = fileNodeId;
+    }
+    workerIndex.set(config.name, { anchorId });
+  }
+  for (const worker of discovered) {
+    const { config, evidenceFile, raw } = worker;
+    const anchorId = workerIndex.get(config.name).anchorId;
+    const runtimeNode = makeInfraNode("workerd", "cloudflare", "cloudflare");
+    if (!graph.hasNode(runtimeNode.id)) {
+      graph.addNode(runtimeNode.id, runtimeNode);
+      nodesAdded++;
+    }
+    if (runtimeNode.id !== anchorId) {
+      const runsOnId = (0, import_types5.extractedEdgeId)(anchorId, runtimeNode.id, import_types26.EdgeType.RUNS_ON);
+      if (!graph.hasEdge(runsOnId)) {
+        const edge = {
+          id: runsOnId,
+          source: anchorId,
+          target: runtimeNode.id,
+          type: import_types26.EdgeType.RUNS_ON,
+          provenance: import_types26.Provenance.EXTRACTED,
+          confidence: (0, import_types26.confidenceForExtracted)("structural"),
+          evidence: {
+            file: evidenceFile,
+            ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
+          }
+        };
+        graph.addEdgeWithKey(runsOnId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+    for (const route of normalizeRoutes(config)) {
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        import_types26.EdgeType.CONNECTS_TO,
+        "cloudflare-route",
+        route,
+        evidenceFile,
+        lineContaining(raw, route)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+    const bindingGroups = [
+      { kind: "cloudflare-kv", entries: config.kv_namespaces ?? [], nameOf: (b) => b.binding },
+      { kind: "cloudflare-d1", entries: config.d1_databases ?? [], nameOf: (b) => b.binding },
+      { kind: "cloudflare-r2", entries: config.r2_buckets ?? [], nameOf: (b) => b.binding },
+      { kind: "cloudflare-durable-object", entries: config.durable_objects?.bindings ?? [], nameOf: (b) => b.name },
+      { kind: "cloudflare-queue", entries: config.queues?.producers ?? [], nameOf: (b) => b.queue },
+      { kind: "cloudflare-queue", entries: config.queues?.consumers ?? [], nameOf: (b) => b.queue }
+    ];
+    for (const group of bindingGroups) {
+      for (const entry of group.entries) {
+        const name = group.nameOf(entry);
+        if (!name) continue;
+        const result = addResourceEdge(
+          graph,
+          anchorId,
+          import_types26.EdgeType.DEPENDS_ON,
+          group.kind,
+          name,
+          evidenceFile,
+          lineContaining(raw, name)
+        );
+        nodesAdded += result.nodesAdded;
+        edgesAdded += result.edgesAdded;
+      }
+    }
+    for (const cron of config.triggers?.crons ?? []) {
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        import_types26.EdgeType.DEPENDS_ON,
+        "cloudflare-cron",
+        cron,
+        evidenceFile,
+        lineContaining(raw, cron)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+    for (const varName of Object.keys(config.vars ?? {})) {
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        import_types26.EdgeType.DEPENDS_ON,
+        "cloudflare-env-var",
+        varName,
+        evidenceFile,
+        lineContaining(raw, varName)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+    for (const svc of config.services ?? []) {
+      if (!svc.service) continue;
+      const target = workerIndex.get(svc.service);
+      if (target && target.anchorId !== anchorId) {
+        const edgeId = (0, import_types5.extractedEdgeId)(anchorId, target.anchorId, import_types26.EdgeType.CALLS);
+        if (!graph.hasEdge(edgeId)) {
+          const edge = {
+            id: edgeId,
+            source: anchorId,
+            target: target.anchorId,
+            type: import_types26.EdgeType.CALLS,
+            provenance: import_types26.Provenance.EXTRACTED,
+            confidence: (0, import_types26.confidenceForExtracted)("structural"),
+            evidence: { file: evidenceFile, line: lineContaining(raw, svc.service) }
+          };
+          graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+          edgesAdded++;
+        }
+        continue;
+      }
+      const result = addResourceEdge(
+        graph,
+        anchorId,
+        import_types26.EdgeType.DEPENDS_ON,
+        "cloudflare-service-binding",
+        svc.service,
+        evidenceFile,
+        lineContaining(raw, svc.service)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
 // src/extract/infra/index.ts
 async function addInfra(graph, scanPath, services) {
   const compose = await addComposeInfra(graph, scanPath, services);
   const dockerfile = await addDockerfileRuntimes(graph, services, scanPath);
   const terraform = await addTerraformResources(graph, scanPath);
   const k8s = await addK8sResources(graph, scanPath);
+  const cloudflare = await addCloudflareWorkers(graph, services, scanPath);
   return {
-    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded,
-    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded
   };
 }
 
 // src/extract/index.ts
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_path39 = __toESM(require("path"), 1);
 
 // src/extract/retire.ts
 init_cjs_shims();
-var import_node_fs21 = require("fs");
-var import_node_path37 = __toESM(require("path"), 1);
-var import_types26 = require("@neat.is/types");
+var import_node_fs22 = require("fs");
+var import_node_path38 = __toESM(require("path"), 1);
+var import_types27 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types26.NodeType.FileNode) return;
+    if (attrs.type !== import_types27.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -7260,14 +7578,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types26.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types27.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (import_node_path37.default.isAbsolute(evidenceFile)) {
-      if (!(0, import_node_fs21.existsSync)(evidenceFile)) toDrop.push(id);
+    if (import_node_path38.default.isAbsolute(evidenceFile)) {
+      if (!(0, import_node_fs22.existsSync)(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => (0, import_node_fs21.existsSync)(import_node_path37.default.join(base, evidenceFile)));
+    const found = bases.some((base) => (0, import_node_fs22.existsSync)(import_node_path38.default.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -7309,7 +7627,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = import_node_path38.default.join(import_node_path38.default.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = import_node_path39.default.join(import_node_path39.default.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -7343,7 +7661,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/diff.ts
 init_cjs_shims();
-var import_node_fs22 = require("fs");
+var import_node_fs23 = require("fs");
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -7352,7 +7670,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await import_node_fs22.promises.readFile(target, "utf8");
+  const raw = await import_node_fs23.promises.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -7420,9 +7738,9 @@ function canonicalJson(value) {
 
 // src/persist.ts
 init_cjs_shims();
-var import_node_fs23 = require("fs");
-var import_node_path39 = __toESM(require("path"), 1);
-var import_types27 = require("@neat.is/types");
+var import_node_fs24 = require("fs");
+var import_node_path40 = __toESM(require("path"), 1);
+var import_types28 = require("@neat.is/types");
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -7444,12 +7762,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types27.Provenance.OBSERVED;
+      attrs.provenance = import_types28.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types27.observedEdgeId)(source, target, type);
+        const newId = (0, import_types28.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -7458,7 +7776,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await import_node_fs23.promises.mkdir(import_node_path39.default.dirname(filePath), { recursive: true });
+  await import_node_fs24.promises.mkdir(import_node_path40.default.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -7468,13 +7786,13 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  await import_node_fs23.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await import_node_fs23.promises.rename(tmp, outPath);
+  await import_node_fs24.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await import_node_fs24.promises.rename(tmp, outPath);
 }
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await import_node_fs23.promises.readFile(outPath, "utf8");
+    raw = await import_node_fs24.promises.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -7539,23 +7857,23 @@ function startPersistLoop(graph, outPath, opts = {}) {
 
 // src/projects.ts
 init_cjs_shims();
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: import_node_path40.default.join(baseDir, "graph.json"),
-      errorsPath: import_node_path40.default.join(baseDir, "errors.ndjson"),
-      staleEventsPath: import_node_path40.default.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: import_node_path40.default.join(baseDir, "embeddings.json"),
-      policyViolationsPath: import_node_path40.default.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: import_node_path41.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path41.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path41.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path41.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path41.default.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: import_node_path40.default.join(baseDir, `${project}.json`),
-    errorsPath: import_node_path40.default.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: import_node_path40.default.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: import_node_path40.default.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: import_node_path40.default.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: import_node_path41.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path41.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path41.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path41.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path41.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -7595,23 +7913,23 @@ function parseExtraProjects(raw) {
 
 // src/registry.ts
 init_cjs_shims();
-var import_node_fs24 = require("fs");
+var import_node_fs25 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
-var import_node_path41 = __toESM(require("path"), 1);
-var import_types28 = require("@neat.is/types");
+var import_node_path42 = __toESM(require("path"), 1);
+var import_types29 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path41.default.resolve(override);
-  return import_node_path41.default.join(import_node_os3.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path42.default.resolve(override);
+  return import_node_path42.default.join(import_node_os3.default.homedir(), ".neat");
 }
 function registryPath() {
-  return import_node_path41.default.join(neatHome(), "projects.json");
+  return import_node_path42.default.join(neatHome(), "projects.json");
 }
 async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await import_node_fs24.promises.readFile(file, "utf8");
+    raw = await import_node_fs25.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -7619,7 +7937,7 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types28.RegistryFileSchema.parse(parsed);
+  return import_types29.RegistryFileSchema.parse(parsed);
 }
 async function getProject(name) {
   const reg = await readRegistry();
@@ -7840,11 +8158,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types29.DivergenceTypeSchema.safeParse(c);
+        const r = import_types30.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types29.DivergenceTypeSchema.options
+            allowed: import_types30.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -7892,6 +8210,23 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  scope.get("/logs", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const rawSource = req.query.source;
+    const sources = rawSource === void 0 ? void 0 : Array.isArray(rawSource) ? rawSource : [rawSource];
+    const filtered = queryLogEntries({
+      projectName: proj.name,
+      ...sources && sources.length > 0 ? { source: sources } : {},
+      ...req.query.service ? { service: req.query.service } : {},
+      ...req.query.since ? { since: req.query.since } : {}
+    });
+    const total = filtered.length;
+    const limit = req.query.limit ? Number(req.query.limit) : LOGS_QUERY_DEFAULT_LIMIT;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, LOGS_QUERY_MAX_LIMIT) : LOGS_QUERY_DEFAULT_LIMIT;
+    const sliced = filtered.slice(0, safeLimit);
+    return { count: sliced.length, total, logs: sliced };
+  });
   const incidentHistoryHandler = async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -7987,8 +8322,16 @@ function registerRoutes(scope, ctx) {
       if (!against) {
         return reply.code(400).send({ error: "query parameter `against` is required" });
       }
+      const targetProjectName = against === "self" ? proj.name : against;
+      const targetProject = registry.get(targetProjectName);
+      if (!targetProject) {
+        return reply.code(400).send({
+          error: "unknown snapshot id \u2014 `against` must be `self` or the name of a project this server has a snapshot for",
+          against
+        });
+      }
       try {
-        const snapshot = await loadSnapshotForDiff(against);
+        const snapshot = await loadSnapshotForDiff(targetProject.paths.snapshotPath);
         return computeGraphDiff(proj.graph, snapshot);
       } catch (err) {
         return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
@@ -8018,6 +8361,13 @@ function registerRoutes(scope, ctx) {
         edgeCount: proj.graph.size
       };
     } catch (err) {
+      if (err instanceof SnapshotValidationError) {
+        return reply.code(400).send({
+          error: "snapshot merge failed",
+          details: err.message,
+          issues: err.issues
+        });
+      }
       return reply.code(400).send({
         error: "snapshot merge failed",
         details: err.message
@@ -8063,7 +8413,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types29.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types30.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -8102,7 +8452,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types29.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types30.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -8364,8 +8714,8 @@ init_otel_grpc();
 
 // src/search.ts
 init_cjs_shims();
-var import_node_fs25 = require("fs");
-var import_node_path44 = __toESM(require("path"), 1);
+var import_node_fs26 = require("fs");
+var import_node_path45 = __toESM(require("path"), 1);
 var import_node_crypto3 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
@@ -8519,7 +8869,7 @@ async function pickEmbedder() {
 }
 async function readCache(cachePath) {
   try {
-    const raw = await import_node_fs25.promises.readFile(cachePath, "utf8");
+    const raw = await import_node_fs26.promises.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     return parsed;
@@ -8528,8 +8878,8 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  await import_node_fs25.promises.mkdir(import_node_path44.default.dirname(cachePath), { recursive: true });
-  await import_node_fs25.promises.writeFile(cachePath, JSON.stringify(cache));
+  await import_node_fs26.promises.mkdir(import_node_path45.default.dirname(cachePath), { recursive: true });
+  await import_node_fs26.promises.writeFile(cachePath, JSON.stringify(cache));
 }
 var VectorIndex = class {
   constructor(embedder, cachePath) {
@@ -8709,14 +9059,14 @@ async function bootProject(registry, name, scanPath, baseDir) {
 async function main() {
   const baseDirEnv = process.env.NEAT_OUT_DIR;
   const legacyOutPath = process.env.NEAT_OUT_PATH;
-  const baseDir = baseDirEnv ? import_node_path45.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path45.default.resolve(import_node_path45.default.dirname(legacyOutPath)) : import_node_path45.default.resolve("./neat-out");
-  const defaultScanPath = import_node_path45.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
+  const baseDir = baseDirEnv ? import_node_path46.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path46.default.resolve(import_node_path46.default.dirname(legacyOutPath)) : import_node_path46.default.resolve("./neat-out");
+  const defaultScanPath = import_node_path46.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
   const registry = new Projects();
   await bootProject(registry, DEFAULT_PROJECT, defaultScanPath, baseDir);
   for (const name of parseExtraProjects(process.env.NEAT_PROJECTS)) {
     const envKey = `NEAT_PROJECT_SCAN_PATH_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
     const projectScan = process.env[envKey];
-    await bootProject(registry, name, projectScan ? import_node_path45.default.resolve(projectScan) : void 0, baseDir);
+    await bootProject(registry, name, projectScan ? import_node_path46.default.resolve(projectScan) : void 0, baseDir);
   }
   const host = process.env.HOST ?? "0.0.0.0";
   const port = Number(process.env.PORT ?? 8080);