@neat.is/core 0.4.31-dev.20260718 → 0.5.1-dev.20260719

package/dist/neatd.js

@@ -2,11 +2,11 @@
 import {
   reconcileDaemonRecordSync,
   startDaemon
-} from "./chunk-2AJHEZIB.js";
+} from "./chunk-O4PCNQFG.js";
 import {
   listProjects,
   registryPath
-} from "./chunk-4M2YMGUM.js";
+} from "./chunk-BI3XKGVG.js";
 import {
   BindAuthorityError,
   __require

package/dist/server.cjs

@@ -1445,7 +1445,7 @@ function databaseRootCauseShape(graph, origin, walk3) {
   for (const id of walk3.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId4, svc } = owner;
+    const { id: serviceId5, svc } = owner;
     const deps = svc.dependencies ?? {};
     for (const pair of candidatePairs) {
       const declared = deps[pair.driver];
@@ -1458,7 +1458,7 @@ function databaseRootCauseShape(graph, origin, walk3) {
       );
       if (!result.compatible) {
         return {
-          rootCauseNode: serviceId4,
+          rootCauseNode: serviceId5,
           rootCauseReason: result.reason ?? "incompatible driver",
           ...result.minDriverVersion ? {
             fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
@@ -1473,7 +1473,7 @@ function serviceRootCauseShape(graph, _origin, walk3) {
   for (const id of walk3.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId4, svc } = owner;
+    const { id: serviceId5, svc } = owner;
     const deps = svc.dependencies ?? {};
     const serviceNodeEngine = svc.nodeEngine;
     for (const constraint of nodeEngineConstraints()) {
@@ -1482,7 +1482,7 @@ function serviceRootCauseShape(graph, _origin, walk3) {
       const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId4,
+          rootCauseNode: serviceId5,
           rootCauseReason: result.reason,
           ...result.requiredNodeVersion ? {
             fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
@@ -1497,7 +1497,7 @@ function serviceRootCauseShape(graph, _origin, walk3) {
       const result = checkPackageConflict(conflict, declared, requiredDeclared);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId4,
+          rootCauseNode: serviceId5,
           rootCauseReason: result.reason,
           fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
         };
@@ -1588,9 +1588,9 @@ function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
 function isFailingCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
 }
-function callSourcesForService(graph, serviceId4) {
-  const ids = [serviceId4];
-  for (const edgeId of graph.outboundEdges(serviceId4)) {
+function callSourcesForService(graph, serviceId5) {
+  const ids = [serviceId5];
+  for (const edgeId of graph.outboundEdges(serviceId5)) {
     const e = graph.getEdgeAttributes(edgeId);
     if (e.type !== import_types.EdgeType.CONTAINS) continue;
     const tgt = graph.getNodeAttributes(e.target);
@@ -1607,9 +1607,9 @@ function failingCallDominates(e, id, curEdge, curId) {
   }
   return id < curId;
 }
-function dominantFailingCall(graph, serviceId4, visited) {
+function dominantFailingCall(graph, serviceId5, visited) {
   let best = null;
-  for (const src of callSourcesForService(graph, serviceId4)) {
+  for (const src of callSourcesForService(graph, serviceId5)) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (!isFailingCallEdge(e)) continue;
@@ -1820,14 +1820,23 @@ function getObservedDependencies(graph, nodeId) {
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
+function bucketSourceFor(graph, edge) {
+  if (edge.type !== import_types2.EdgeType.CONNECTS_TO) return edge.source;
+  const parsed = (0, import_types2.parseFileId)(edge.source);
+  if (!parsed || !graph.hasNode(edge.target)) return edge.source;
+  const target = graph.getNodeAttributes(edge.target);
+  if (target.type !== import_types2.NodeType.DatabaseNode) return edge.source;
+  return (0, import_types2.serviceId)(parsed.service);
+}
 function bucketEdges(graph) {
   const buckets = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
     const parsed = (0, import_types2.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
-    const key = bucketKey(e.source, e.target, e.type);
-    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    const source = bucketSourceFor(graph, e);
+    const key = bucketKey(source, e.target, e.type);
+    const cur = buckets.get(key) ?? { source, target: e.target, type: e.type };
     switch (provenance) {
       case import_types2.Provenance.EXTRACTED:
         cur.extracted = e;
@@ -3116,6 +3125,27 @@ function ensureLocalDatabaseNode(graph, serviceName, name, engine) {
   graph.addNode(id, node);
   return id;
 }
+function findDeclaredDatabaseForService(graph, serviceNodeId, engine) {
+  if (!graph.hasNode(serviceNodeId)) return null;
+  const sources = [serviceNodeId];
+  for (const edgeId of graph.outboundEdges(serviceNodeId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type === import_types4.EdgeType.CONTAINS) sources.push(e.target);
+  }
+  const matches = /* @__PURE__ */ new Set();
+  for (const src of sources) {
+    if (!graph.hasNode(src)) continue;
+    for (const edgeId of graph.outboundEdges(src)) {
+      const edge = graph.getEdgeAttributes(edgeId);
+      if (edge.type !== import_types4.EdgeType.CONNECTS_TO || edge.provenance !== import_types4.Provenance.EXTRACTED) continue;
+      if (!graph.hasNode(edge.target)) continue;
+      const target = graph.getNodeAttributes(edge.target);
+      if (target.type !== import_types4.NodeType.DatabaseNode || target.engine !== engine) continue;
+      matches.add(edge.target);
+    }
+  }
+  return matches.size === 1 ? [...matches][0] : null;
+}
 function ensureFrontierNode(graph, host, ts) {
   const id = frontierIdFor(host);
   if (graph.hasNode(id)) {
@@ -3136,6 +3166,7 @@ function ensureFrontierNode(graph, host, ts) {
 }
 function upsertObservedEdge(graph, type, source, target, ts, isError = false, evidence) {
   if (!graph.hasNode(source) || !graph.hasNode(target)) return null;
+  const grain = source.startsWith("file:") ? "file" : "service";
   const id = makeObservedEdgeId(type, source, target);
   if (graph.hasEdge(id)) {
     const existing = graph.getEdgeAttributes(id);
@@ -3152,7 +3183,9 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
       lastObserved: ts,
       callCount: newSpanCount,
       signal: newSignal,
-      confidence: (0, import_types4.confidenceForObservedSignal)(newSignal)
+      confidence: (0, import_types4.confidenceForObservedSignal)(newSignal),
+      grain
+      // backfills legacy edges that predate ADR-142
     };
     graph.replaceEdgeAttributes(id, updated);
     return { edge: updated, created: false };
@@ -3172,6 +3205,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     lastObserved: ts,
     callCount: 1,
     signal,
+    grain,
     // Call-site evidence from span code.* semconv (file-awareness.md §4 + §6).
     // Only set when code.filepath was present on the span — never fabricated.
     ...evidence ? { evidence } : {}
@@ -3349,13 +3383,18 @@ async function handleSpan(ctx, span) {
         ensureDatabaseNode(ctx.graph, host, span.dbSystem);
         targetId = (0, import_types4.databaseId)(host);
       } else {
-        const localName = span.dbName ?? span.dbSystem;
-        targetId = ensureLocalDatabaseNode(
-          ctx.graph,
-          span.service,
-          localName,
-          span.dbSystem
-        );
+        const declared = findDeclaredDatabaseForService(ctx.graph, sourceId, span.dbSystem);
+        if (declared) {
+          targetId = declared;
+        } else {
+          const localName = span.dbName ?? span.dbSystem;
+          targetId = ensureLocalDatabaseNode(
+            ctx.graph,
+            span.service,
+            localName,
+            span.dbSystem
+          );
+        }
       }
       const result = upsertObservedEdge(
         ctx.graph,
@@ -3539,29 +3578,29 @@ function promoteFrontierNodes(graph, opts = {}) {
     toPromote.push({ frontierId: id, serviceId: target });
   });
   let promoted = 0;
-  for (const { frontierId: frontierId2, serviceId: serviceId4 } of toPromote) {
+  for (const { frontierId: frontierId2, serviceId: serviceId5 } of toPromote) {
     if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
       const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
       if (!gate.allowed) {
         continue;
       }
     }
-    rewireFrontierEdges(graph, frontierId2, serviceId4);
+    rewireFrontierEdges(graph, frontierId2, serviceId5);
     graph.dropNode(frontierId2);
     promoted++;
   }
   return promoted;
 }
-function rewireFrontierEdges(graph, frontierId2, serviceId4) {
+function rewireFrontierEdges(graph, frontierId2, serviceId5) {
   const inbound = [...graph.inboundEdges(frontierId2)];
   const outbound = [...graph.outboundEdges(frontierId2)];
   for (const edgeId of inbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, edge.source, serviceId4, edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId5, edgeId);
   }
   for (const edgeId of outbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, serviceId4, edge.target, edgeId);
+    rebuildEdge(graph, edge, serviceId5, edge.target, edgeId);
   }
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
@@ -4357,9 +4396,9 @@ var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
   "StatefulSet",
   "DaemonSet"
 ]);
-function addAliases(graph, serviceId4, candidates) {
-  if (!graph.hasNode(serviceId4)) return;
-  const node = graph.getNodeAttributes(serviceId4);
+function addAliases(graph, serviceId5, candidates) {
+  if (!graph.hasNode(serviceId5)) return;
+  const node = graph.getNodeAttributes(serviceId5);
   if (node.type !== import_types7.NodeType.ServiceNode) return;
   const set = new Set(node.aliases ?? []);
   for (const c of candidates) {
@@ -4369,7 +4408,7 @@ function addAliases(graph, serviceId4, candidates) {
   }
   if (set.size === 0) return;
   const updated = { ...node, aliases: [...set].sort() };
-  graph.replaceNodeAttributes(serviceId4, updated);
+  graph.replaceNodeAttributes(serviceId5, updated);
 }
 function indexServicesByName(services) {
   const map = /* @__PURE__ */ new Map();
@@ -4402,12 +4441,12 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
   }
   if (!compose?.services) return;
   for (const [composeName, svc] of Object.entries(compose.services)) {
-    const serviceId4 = serviceIndex.get(composeName);
-    if (!serviceId4) continue;
+    const serviceId5 = serviceIndex.get(composeName);
+    if (!serviceId5) continue;
     const aliases = /* @__PURE__ */ new Set([composeName]);
     if (svc.container_name) aliases.add(svc.container_name);
     if (svc.hostname) aliases.add(svc.hostname);
-    addAliases(graph, serviceId4, aliases);
+    addAliases(graph, serviceId5, aliases);
   }
 }
 var LABEL_KEYS = /* @__PURE__ */ new Set([
@@ -5057,6 +5096,29 @@ async function readIfExists(filePath) {
     return null;
   }
 }
+async function resolveEnvVar(serviceDir, name) {
+  const entries = await import_node_fs14.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const envNames = entries.filter((e) => e.isFile() && (e.name === ".env" || e.name.startsWith(".env."))).map((e) => e.name);
+  const rank = (n) => n === ".env.local" ? 0 : n === ".env" ? 1 : 2;
+  envNames.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+  for (const fileName of envNames) {
+    const content = await readIfExists(import_node_path16.default.join(serviceDir, fileName));
+    if (!content) continue;
+    for (const line of content.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq < 0) continue;
+      if (trimmed.slice(0, eq).trim() !== name) continue;
+      let value = trimmed.slice(eq + 1).trim();
+      if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+        value = value.slice(1, -1);
+      }
+      return value || null;
+    }
+  }
+  return null;
+}
 async function findFirst(serviceDir, candidates) {
   for (const rel of candidates) {
     const abs = import_node_path16.default.join(serviceDir, rel);
@@ -5154,6 +5216,14 @@ async function parse3(serviceDir) {
     const config = parseConnectionString(urlMatch[1]);
     if (config) return [{ ...config, sourceFile: schemaPath }];
   }
+  const envMatch = body.match(/url\s*=\s*env\(\s*"([^"]+)"\s*\)/);
+  if (envMatch) {
+    const resolved = await resolveEnvVar(serviceDir, envMatch[1]);
+    if (resolved) {
+      const config = parseConnectionString(resolved);
+      if (config) return [{ ...config, sourceFile: schemaPath }];
+    }
+  }
   return [
     {
       host: `${engine}-prisma`,
@@ -5197,6 +5267,15 @@ async function parse4(serviceDir) {
     const config = parseConnectionString(urlMatch[1]);
     if (config) return [{ ...config, sourceFile: filePath }];
   }
+  const urlEnvMatch = content.match(
+    /(?:url|connectionString)\s*:\s*process\.env(?:\.([A-Za-z_$][\w$]*)|\[\s*['"]([^'"]+)['"]\s*\])/
+  );
+  if (urlEnvMatch) {
+    const varName = urlEnvMatch[1] ?? urlEnvMatch[2];
+    const resolved = varName ? await resolveEnvVar(serviceDir, varName) : null;
+    const config = resolved ? parseConnectionString(resolved) : null;
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
   const hostMatch = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/);
   if (hostMatch) {
     const portMatch = content.match(/port\s*:\s*(\d+)/);
@@ -5250,6 +5329,15 @@ async function parse5(serviceDir) {
     const config = parseConnectionString(urlMatch[1]);
     if (config) return [{ ...config, sourceFile: filePath }];
   }
+  const urlEnvMatch = content.match(
+    /connection\s*:\s*process\.env(?:\.([A-Za-z_$][\w$]*)|\[\s*['"]([^'"]+)['"]\s*\])/
+  );
+  if (urlEnvMatch) {
+    const varName = urlEnvMatch[1] ?? urlEnvMatch[2];
+    const resolved = varName ? await resolveEnvVar(serviceDir, varName) : null;
+    const config = resolved ? parseConnectionString(resolved) : null;
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
   const host = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
   if (host) {
     const port = content.match(/port\s*:\s*(\d+)/)?.[1];
@@ -6798,6 +6886,16 @@ function constructorMatchesImport(name, ctx) {
   if (name === "createClient") return ctx.hasSupabaseJs;
   return ctx.hasSupabaseSsr;
 }
+var SUPABASE_CLIENT_ASSIGN_RE = /(?:const|let|var)\s+(\w+)\s*=\s*(?:await\s+)?(createClient|createServerClient|createBrowserClient)\s*\(/g;
+function supabaseClientVars(content, ctx) {
+  const vars = /* @__PURE__ */ new Set();
+  SUPABASE_CLIENT_ASSIGN_RE.lastIndex = 0;
+  let m;
+  while ((m = SUPABASE_CLIENT_ASSIGN_RE.exec(content)) !== null) {
+    if (constructorMatchesImport(m[2], ctx)) vars.add(m[1]);
+  }
+  return vars;
+}
 function supabaseEndpointsFromFile(file, serviceDir) {
   const ctx = readImports2(file.content);
   if (!ctx.hasSupabaseJs && !ctx.hasSupabaseSsr) return [];
@@ -6830,6 +6928,34 @@ function supabaseEndpointsFromFile(file, serviceDir) {
       }
     });
   }
+  const clientVars = supabaseClientVars(file.content, ctx);
+  for (const clientVar of clientVars) {
+    const accessRe = new RegExp(
+      `\\b${clientVar}\\s*\\.\\s*(from|rpc)\\s*\\(\\s*['"\`]([\\w.-]+)['"\`]`,
+      "g"
+    );
+    let am;
+    while ((am = accessRe.exec(file.content)) !== null) {
+      const kind = am[1] === "rpc" ? "supabase-rpc" : "supabase-table";
+      const resource = am[2];
+      const key = `${kind}/${resource}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const line = lineOf(file.content, am[0]);
+      out.push({
+        infraId: (0, import_types20.infraId)(kind, resource),
+        name: resource,
+        kind,
+        edgeType: "CALLS",
+        confidenceKind: "verified-call-site",
+        evidence: {
+          file: import_node_path32.default.relative(serviceDir, file.path),
+          line,
+          snippet: snippet(file.content, line)
+        }
+      });
+    }
+  }
   return out;
 }