@neat.is/core 0.9.2 → 0.9.3

package/dist/{chunk-TMHCS4ZY.js → chunk-2D4Y5QHE.js}

@@ -20,7 +20,7 @@ import {
   startStalenessLoop,
   touchLastSeen,
   writeAtomically
-} from "./chunk-HD5X5TWY.js";
+} from "./chunk-EDE4XP2M.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
@@ -891,4 +891,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-TMHCS4ZY.js.map
+//# sourceMappingURL=chunk-2D4Y5QHE.js.map

package/dist/{chunk-HD5X5TWY.js → chunk-EDE4XP2M.js}

@@ -5125,15 +5125,36 @@ function startStalenessLoop(graph, options = {}) {
     clearInterval(interval);
   };
 }
-async function readErrorEvents(errorsPath) {
+var INCIDENT_READ_MAX_BYTES = 32 * 1024 * 1024;
+var INCIDENT_READ_MAX_EVENTS = 5e3;
+async function readErrorFileTail(errorsPath, maxBytes) {
+  const handle = await fs7.open(errorsPath, "r");
   try {
-    const raw = await fs7.readFile(errorsPath, "utf8");
-    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
-    return dedupeIncidents(events);
+    const { size } = await handle.stat();
+    if (size <= maxBytes) {
+      return (await handle.readFile()).toString("utf8");
+    }
+    const buf = Buffer.alloc(maxBytes);
+    await handle.read(buf, 0, maxBytes, size - maxBytes);
+    const raw = buf.toString("utf8");
+    const firstNewline = raw.indexOf("\n");
+    return firstNewline === -1 ? "" : raw.slice(firstNewline + 1);
+  } finally {
+    await handle.close();
+  }
+}
+async function readErrorEvents(errorsPath, opts) {
+  let raw;
+  try {
+    raw = await readErrorFileTail(errorsPath, INCIDENT_READ_MAX_BYTES);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
+  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  const deduped = dedupeIncidents(events);
+  const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
+  return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
 }
 function isSynthesizedHttpIncident(ev) {
   if (ev.exceptionType || ev.exceptionStacktrace) return false;
@@ -5906,6 +5927,47 @@ function classifyNode(ctx) {
 function isVictimSeed(ctx) {
   return ctx.errorsFromCallers > 0 && (ctx.stale || isSaturated(ctx)) && ctx.errorsEmittedHere <= ctx.errorsFromCallers;
 }
+var OUTBOUND_CONNECTION_FAILURE_PATTERNS = [
+  "name resolution",
+  "resolve host",
+  "getaddrinfo",
+  "enotfound",
+  "connection refused",
+  "econnrefused",
+  "connection reset",
+  "econnreset",
+  "able to connect",
+  "failed to connect",
+  "cannot connect",
+  "could not connect",
+  "unable to connect",
+  "connection timed out",
+  "etimedout",
+  "no route to host",
+  "host unreachable",
+  "network is unreachable",
+  "connection closed"
+];
+function incidentTextIndicatesOutboundFailure(ev) {
+  const haystack = [ev.errorMessage, ev.errorType, ev.exceptionType, ev.exceptionStacktrace].filter((s) => typeof s === "string").join(" ").toLowerCase();
+  return OUTBOUND_CONNECTION_FAILURE_PATTERNS.some((p) => haystack.includes(p));
+}
+function hasFailingOutbound(graph, nodeId, seedSource, incidents) {
+  for (const n of nodeScope(graph, nodeId)) {
+    if (!graph.hasNode(n)) continue;
+    for (const edgeId of graph.outboundEdges(n)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === EdgeType6.CONTAINS) continue;
+      if ((e.signal?.errorCount ?? 0) > 0) return true;
+    }
+  }
+  if (seedSource === "incident" && incidents) {
+    for (const ev of incidents) {
+      if (incidentMatchesNode(ev, nodeId) && incidentTextIndicatesOutboundFailure(ev)) return true;
+    }
+  }
+  return false;
+}
 function grainOf(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return "unknown";
   const t = graph.getNodeAttributes(nodeId).type;
@@ -6069,7 +6131,8 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
   const candidates = [];
   const deadEndOnSymptom = tagged.source === "incident" && seedNode === errorNodeId && legacy.traversalPath.length === 1;
   const staleChain = deadEndOnSymptom && !(seedCtx && isVictimSeed(seedCtx)) ? followStaleCallChain(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH) : null;
-  if (seedCtx && isVictimSeed(seedCtx)) {
+  const seedFailsOutbound = seedCtx !== null && hasFailingOutbound(graph, seedNode, tagged.source, incidents);
+  if (seedCtx && isVictimSeed(seedCtx) && !seedFailsOutbound) {
     const origin = findLoadOrigin(graph, errorNodeId, incidents, now);
     const staleNote = seedCtx.stale ? "; it has gone STALE under load" : "";
     const satNote = isSaturated(seedCtx) ? `; its inbound p95 ${Math.round(seedCtx.latencyP95Ms)}ms is saturated` : "";
@@ -9112,12 +9175,12 @@ async function resolveConfigs(literals, keys, serviceDir, looksLike, parse11) {
     const value = await interpolateEnvRefs(raw, serviceDir);
     if (!looksLike(value)) continue;
     const parsed = parse11(value);
-    if (parsed) out.push(parsed);
+    if (parsed) out.push({ ...parsed, hostSource: "config" });
   }
   for (const lit of literals) {
     if (!looksLike(lit)) continue;
     const parsed = parse11(lit);
-    if (parsed) out.push(parsed);
+    if (parsed) out.push({ ...parsed, hostSource: "literal" });
   }
   return out;
 }
@@ -9385,7 +9448,10 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         type: EdgeType10.CONNECTS_TO,
         provenance: Provenance10.EXTRACTED,
         confidence: confidenceForExtracted7("structural"),
-        evidence: { file: evidenceFile }
+        // Carry how the host was recovered (ADR-213) so the divergence ranker
+        // can tell a real declared store from a hardcoded fault-injection /
+        // flag-gated probe. Only set when the parser distinguished the two.
+        evidence: config.hostSource ? { file: evidenceFile, hostSource: config.hostSource } : { file: evidenceFile }
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -14936,6 +15002,7 @@ import {
   NodeType as NodeType30,
   parseEdgeId,
   parseFileId,
+  parseSymbolId as parseSymbolId2,
   Provenance as Provenance24,
   serviceId as serviceId13
 } from "@neat.is/types";
@@ -15192,9 +15259,170 @@ function detectColumnDrift(node) {
   }
   return out;
 }
+var SYMBOL_MISMATCH_PATTERNS = [
+  {
+    // "'ListProductsResponse' object has no attribute 'products_list'" and kin.
+    kind: "missing-attribute",
+    patterns: [/\bhas no attribute\b[\s:=]*['"`]?([A-Za-z_$][\w$]*)['"`]?/i]
+  },
+  {
+    // "object has no field 'X'", "no such field X", "unknown field X".
+    kind: "missing-field",
+    patterns: [
+      /\b(?:has no field|no such field|unknown field)\b(?:\s+named)?[\s:=]*['"`]?([A-Za-z_$][\w$.]*)['"`]?/i
+    ]
+  },
+  {
+    // "has no property X", "no property named X".
+    kind: "missing-property",
+    patterns: [
+      /\b(?:has no property|no property named)\b[\s:=]*['"`]?([A-Za-z_$][\w$]*)['"`]?/i
+    ]
+  },
+  {
+    // "no such column: X", "unknown column 'X'", "column X does not exist".
+    kind: "missing-column",
+    patterns: [
+      /\bno such column\b[\s:=]*['"`]?([\w$.]+)['"`]?/i,
+      /\bunknown column\b[\s:=]*['"`]?([\w$.]+)['"`]?/i,
+      /\bcolumn\b[\s:=]*['"`]?([\w$.]+)['"`]?\s+does not exist/i
+    ]
+  },
+  {
+    // "undefined method `foo' for X" — kept to the unambiguous form so a generic
+    // "method not found" (an unimplemented RPC — an edge/route gap, not a symbol
+    // mismatch) does not get miscategorised here.
+    kind: "undefined-method",
+    patterns: [/\bundefined method\b\s*[`'"]?([\w$?!]+)/i]
+  }
+];
+function classifySymbolMismatch(message) {
+  for (const entry of SYMBOL_MISMATCH_PATTERNS) {
+    for (const re of entry.patterns) {
+      const m = re.exec(message);
+      if (m) {
+        const captured = m[1];
+        return captured ? { kind: entry.kind, symbol: captured } : { kind: entry.kind };
+      }
+    }
+  }
+  return null;
+}
+function symbolLocus(graph, ev) {
+  const attrs = ev.attributes ?? {};
+  const filepath = codeFilepathOf(attrs);
+  const lineno = codeLinenoOf(attrs);
+  const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
+  const affected = ev.affectedNode;
+  const affectedInGraph = affected.length > 0 && graph.hasNode(affected);
+  const affectedIsCode = affectedInGraph && (parseSymbolId2(affected) !== null || parseFileId(affected) !== null);
+  if (affectedIsCode) return { node: affected, ...location ? { location } : {} };
+  if (!location) return null;
+  if (affectedInGraph) return { node: affected, location };
+  const svc = serviceId13(ev.service);
+  if (graph.hasNode(svc)) return { node: svc, location };
+  return null;
+}
+var SYMBOL_MISMATCH_CONFIDENCE = 0.6;
+function detectSymbolMismatches(graph, incidents) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const ev of incidents) {
+    const classified = classifySymbolMismatch(ev.errorMessage);
+    if (!classified) continue;
+    const locus = symbolLocus(graph, ev);
+    if (!locus) continue;
+    const key = `${locus.node}|${classified.kind}|${classified.symbol ?? ""}`;
+    const existing = groups.get(key);
+    if (!existing) {
+      groups.set(key, {
+        node: locus.node,
+        kind: classified.kind,
+        ...classified.symbol ? { symbol: classified.symbol } : {},
+        ...locus.location ? { location: locus.location } : {},
+        latest: ev,
+        count: 1
+      });
+    } else {
+      existing.count += 1;
+      if (ev.timestamp.localeCompare(existing.latest.timestamp) > 0) {
+        existing.latest = ev;
+        if (locus.location) existing.location = locus.location;
+      }
+    }
+  }
+  const out = [];
+  for (const g of groups.values()) {
+    const member = g.symbol ? `\`${g.symbol}\`` : "a member";
+    const where = g.location ? ` at ${g.location}` : "";
+    const times = g.count > 1 ? ` (${g.count} recorded incidents)` : " (1 recorded incident)";
+    out.push({
+      type: "observed-symbol-mismatch",
+      source: g.node,
+      target: g.node,
+      mismatchKind: g.kind,
+      ...g.symbol ? { symbol: g.symbol } : {},
+      ...g.location ? { location: g.location } : {},
+      provenance: Provenance24.INFERRED,
+      incidentId: g.latest.id,
+      errorMessage: g.latest.errorMessage,
+      incidentCount: g.count,
+      confidence: SYMBOL_MISMATCH_CONFIDENCE,
+      reason: `Code${where} declares access to ${member} the runtime object does not have \u2014 ${g.latest.service} raised "${g.latest.errorMessage}"${times}. The declared access (EXTRACTED) and the runtime shape (OBSERVED) disagree at symbol grain.`,
+      recommendation: "Reconcile the declared access with the runtime shape: a field, attribute, method, or column was renamed, removed, or never existed on the object this code reaches. Update the code to the current shape, or restore the member."
+    });
+  }
+  return out;
+}
 function involvesNode(d, nodeId) {
   return d.source === nodeId || d.target === nodeId;
 }
+function datastoreEverObserved(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const n = graph.getNodeAttributes(nodeId);
+  if (n.type === NodeType30.DatabaseNode) {
+    const via = n.discoveredVia;
+    if (via === "otel" || via === "merged") return true;
+  }
+  for (const edgeId of graph.inboundEdges(nodeId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.provenance === Provenance24.OBSERVED || e.provenance === Provenance24.STALE) return true;
+  }
+  return false;
+}
+function serviceHasObservedSameEngineStore(graph, buckets2, serviceId16, engine, excludeTarget) {
+  for (const bucket of buckets2.values()) {
+    if (bucket.type !== EdgeType25.CONNECTS_TO) continue;
+    if (bucket.source !== serviceId16) continue;
+    if (bucket.target === excludeTarget) continue;
+    if (!graph.hasNode(bucket.target)) continue;
+    const target = graph.getNodeAttributes(bucket.target);
+    if (target.type !== NodeType30.DatabaseNode) continue;
+    if (target.engine !== engine) continue;
+    if (bucket.observed || datastoreEverObserved(graph, bucket.target)) return true;
+  }
+  return false;
+}
+var DEAD_CODE_PROBE_CONFIDENCE = 0.1;
+function dampenDeadCodeProbes(graph, buckets2, all) {
+  return all.map((d) => {
+    if (d.type !== "missing-observed") return d;
+    if (!d.extracted || d.edgeType !== EdgeType25.CONNECTS_TO) return d;
+    if (!graph.hasNode(d.target)) return d;
+    const target = graph.getNodeAttributes(d.target);
+    if (target.type !== NodeType30.DatabaseNode) return d;
+    if (d.extracted.evidence?.hostSource !== "literal") return d;
+    if (datastoreEverObserved(graph, d.target)) return d;
+    const engine = target.engine;
+    if (!serviceHasObservedSameEngineStore(graph, buckets2, d.source, engine, d.target)) return d;
+    const host = target.host ?? target.name;
+    return {
+      ...d,
+      confidence: Math.min(d.confidence, DEAD_CODE_PROBE_CONFIDENCE),
+      reason: `${d.source} declares a ${engine} connection to a hardcoded-literal host (${host}) that production has never observed, while it does observe another ${engine} store \u2014 this reads as a flag-gated or dead-code declaration (e.g. a fault-injection probe), not a real declared-vs-observed gap.`,
+      recommendation: "Confirm this is an intentional dead alternate \u2014 a fault-injection probe or a flag-gated branch. If it is meant to run in production, check the feature flag or conditional that gates it; if not, it can be ignored or removed."
+    };
+  });
+}
 function suppressHostMismatchHalves(all) {
   const observedHalf = /* @__PURE__ */ new Set();
   const declaredHalf = /* @__PURE__ */ new Set();
@@ -15230,8 +15458,12 @@ function computeDivergences(graph, opts = {}) {
       for (const d of detectColumnDrift(n)) all.push(d);
     }
   });
+  if (opts.incidents && opts.incidents.length > 0) {
+    for (const d of detectSymbolMismatches(graph, opts.incidents)) all.push(d);
+  }
   const reconciled = suppressHostMismatchHalves(all);
-  let filtered = reconciled;
+  const dampened = dampenDeadCodeProbes(graph, buckets2, reconciled);
+  let filtered = dampened;
   if (opts.type) {
     const allowed = opts.type;
     filtered = filtered.filter((d) => allowed.has(d.type));
@@ -15249,7 +15481,12 @@ function computeDivergences(graph, opts = {}) {
     "missing-observed": 1,
     "version-mismatch": 2,
     "host-mismatch": 3,
-    "compat-violation": 4
+    "compat-violation": 4,
+    // Symbol/field-grain (ADR-215) rides the confidence sort like every other
+    // type; this only breaks a confidence tie, and it orders last so a same-
+    // confidence edge finding leads. In practice it carries the INFERRED grade
+    // (0.6), so it sits below the high-confidence edge divergences already.
+    "observed-symbol-mismatch": 5
   };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
@@ -15260,7 +15497,10 @@ function computeDivergences(graph, opts = {}) {
     if (a.target !== b.target) return a.target.localeCompare(b.target);
     const ac = "column" in a && a.column ? a.column : "";
     const bc = "column" in b && b.column ? b.column : "";
-    return ac.localeCompare(bc);
+    if (ac !== bc) return ac.localeCompare(bc);
+    const asym = "symbol" in a && a.symbol ? a.symbol : "";
+    const bsym = "symbol" in b && b.symbol ? b.symbol : "";
+    return asym.localeCompare(bsym);
   });
   return DivergenceResultSchema.parse({
     divergences: filtered,
@@ -16703,10 +16943,15 @@ function divergenceLine(d) {
   if ((d.type === "missing-observed" || d.type === "missing-extracted") && d.column) {
     return `[${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 ${d.reason}`;
   }
+  if (d.type === "observed-symbol-mismatch") {
+    const at = d.location ? ` at ${d.location}` : "";
+    const member = d.symbol ? ` ${d.symbol}` : "";
+    return `[${d.type}] ${d.source}${member}${at} \u2014 ${d.reason}`;
+  }
   return `[${d.type}] ${d.source} \u2192 ${d.target} \u2014 ${d.reason}`;
 }
-function buildDivergenceSection(graph, node) {
-  const result = computeDivergences(graph, { node });
+function buildDivergenceSection(graph, node, incidents) {
+  const result = computeDivergences(graph, { node, ...incidents ? { incidents } : {} });
   if (result.totalAffected === 0) return null;
   const facts = result.divergences.slice(0, MAX_FACTS_PER_SECTION).map((d) => ({
     text: divergenceLine(d),
@@ -16719,8 +16964,8 @@ function buildDivergenceSection(graph, node) {
     facts
   };
 }
-function buildGlobalDivergenceSection(graph) {
-  const result = computeDivergences(graph);
+function buildGlobalDivergenceSection(graph, incidents) {
+  const result = computeDivergences(graph, incidents ? { incidents } : {});
   if (result.totalAffected === 0) {
     return {
       heading: "Divergences (EXTRACTED vs OBSERVED)",
@@ -16818,7 +17063,7 @@ function buildOverviewSections(graph, incidents) {
       }))
     });
   }
-  const div = computeDivergences(graph);
+  const div = computeDivergences(graph, incidents ? { incidents } : {});
   sections.push({
     heading: "Divergences",
     facts: [
@@ -16832,7 +17077,7 @@ function buildOverviewSections(graph, incidents) {
 function buildGlobalSections(intent, graph, incidents) {
   switch (intent) {
     case "divergence":
-      return [buildGlobalDivergenceSection(graph)];
+      return [buildGlobalDivergenceSection(graph, incidents)];
     case "incidents":
       return [buildGlobalIncidentsSection(incidents)];
     case "overview":
@@ -16863,7 +17108,7 @@ function buildSection(kind, graph, node, incidents, now) {
     case "incidents":
       return buildIncidentsSection(node, incidents);
     case "divergence":
-      return buildDivergenceSection(graph, node);
+      return buildDivergenceSection(graph, node, incidents);
   }
 }
 function summarizeGlobal(intent, sections) {
@@ -20485,6 +20730,8 @@ async function deprovisionConnector(entry, env = process.env, fetchImpl) {
 }
 
 // src/api.ts
+var INCIDENT_LIST_DEFAULT_LIMIT = 50;
+var INCIDENT_LIST_MAX_LIMIT = 200;
 function serializeGraph(graph) {
   const nodes = [];
   graph.forEachNode((_id, attrs) => {
@@ -20664,10 +20911,13 @@ function registerRoutes(scope, ctx) {
       }
       minConfidence = n;
     }
+    const epath = errorsPathFor(proj);
+    const incidents = epath ? await readErrorEvents(epath) : [];
     return computeDivergences(proj.graph, {
       ...typeFilter ? { type: typeFilter } : {},
       ...minConfidence !== void 0 ? { minConfidence } : {},
-      ...req.query.node ? { node: req.query.node } : {}
+      ...req.query.node ? { node: req.query.node } : {},
+      incidents
     });
   });
   scope.get("/incidents", async (req, reply) => {
@@ -20677,10 +20927,11 @@ function registerRoutes(scope, ctx) {
     if (!epath) return { count: 0, total: 0, events: [] };
     const events = await readErrorEvents(epath);
     const total = events.length;
-    const limit = req.query.limit ? Number(req.query.limit) : 50;
-    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, 200) : 50;
+    const limit = req.query.limit ? Number(req.query.limit) : INCIDENT_LIST_DEFAULT_LIMIT;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, INCIDENT_LIST_MAX_LIMIT) : INCIDENT_LIST_DEFAULT_LIMIT;
     const sliced = events.slice(0, safeLimit);
-    return { count: sliced.length, total, events: sliced };
+    const omitted = total - sliced.length;
+    return { count: sliced.length, total, events: sliced, ...omitted > 0 ? { omitted } : {} };
   });
   scope.get("/stale-events", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
@@ -20789,16 +21040,20 @@ function registerRoutes(scope, ctx) {
     const filtered = events.filter(
       (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
     );
-    return { count: filtered.length, total: filtered.length, events: filtered };
+    const total = filtered.length;
+    const limit = req.query.limit ? Number(req.query.limit) : INCIDENT_LIST_DEFAULT_LIMIT;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, INCIDENT_LIST_MAX_LIMIT) : INCIDENT_LIST_DEFAULT_LIMIT;
+    const recent = [...filtered].sort((a, b) => (b.timestamp ?? "").localeCompare(a.timestamp ?? "")).slice(0, safeLimit);
+    const omitted = total - recent.length;
+    return {
+      count: recent.length,
+      total,
+      events: recent,
+      ...omitted > 0 ? { omitted } : {}
+    };
   };
-  scope.get(
-    "/incidents/:nodeId",
-    incidentHistoryHandler
-  );
-  scope.get(
-    "/graph/incident-history/:nodeId",
-    incidentHistoryHandler
-  );
+  scope.get("/incidents/:nodeId", incidentHistoryHandler);
+  scope.get("/graph/incident-history/:nodeId", incidentHistoryHandler);
   scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -21440,4 +21695,4 @@ export {
   deprovisionConnector,
   buildApi
 };
-//# sourceMappingURL=chunk-HD5X5TWY.js.map
+//# sourceMappingURL=chunk-EDE4XP2M.js.map