@neat.is/core 0.9.2 → 0.9.3-dev.20260823

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -9112,12 +9112,12 @@ async function resolveConfigs(literals, keys, serviceDir, looksLike, parse11) {
9112
9112
  const value = await interpolateEnvRefs(raw, serviceDir);
9113
9113
  if (!looksLike(value)) continue;
9114
9114
  const parsed = parse11(value);
9115
- if (parsed) out.push(parsed);
9115
+ if (parsed) out.push({ ...parsed, hostSource: "config" });
9116
9116
  }
9117
9117
  for (const lit of literals) {
9118
9118
  if (!looksLike(lit)) continue;
9119
9119
  const parsed = parse11(lit);
9120
- if (parsed) out.push(parsed);
9120
+ if (parsed) out.push({ ...parsed, hostSource: "literal" });
9121
9121
  }
9122
9122
  return out;
9123
9123
  }
@@ -9385,7 +9385,10 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
9385
9385
  type: EdgeType10.CONNECTS_TO,
9386
9386
  provenance: Provenance10.EXTRACTED,
9387
9387
  confidence: confidenceForExtracted7("structural"),
9388
- evidence: { file: evidenceFile }
9388
+ // Carry how the host was recovered (ADR-213) so the divergence ranker
9389
+ // can tell a real declared store from a hardcoded fault-injection /
9390
+ // flag-gated probe. Only set when the parser distinguished the two.
9391
+ evidence: config.hostSource ? { file: evidenceFile, hostSource: config.hostSource } : { file: evidenceFile }
9389
9392
  };
9390
9393
  if (!graph.hasEdge(edge.id)) {
9391
9394
  graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -15195,6 +15198,53 @@ function detectColumnDrift(node) {
15195
15198
  function involvesNode(d, nodeId) {
15196
15199
  return d.source === nodeId || d.target === nodeId;
15197
15200
  }
15201
+ function datastoreEverObserved(graph, nodeId) {
15202
+ if (!graph.hasNode(nodeId)) return false;
15203
+ const n = graph.getNodeAttributes(nodeId);
15204
+ if (n.type === NodeType30.DatabaseNode) {
15205
+ const via = n.discoveredVia;
15206
+ if (via === "otel" || via === "merged") return true;
15207
+ }
15208
+ for (const edgeId of graph.inboundEdges(nodeId)) {
15209
+ const e = graph.getEdgeAttributes(edgeId);
15210
+ if (e.provenance === Provenance24.OBSERVED || e.provenance === Provenance24.STALE) return true;
15211
+ }
15212
+ return false;
15213
+ }
15214
+ function serviceHasObservedSameEngineStore(graph, buckets2, serviceId16, engine, excludeTarget) {
15215
+ for (const bucket of buckets2.values()) {
15216
+ if (bucket.type !== EdgeType25.CONNECTS_TO) continue;
15217
+ if (bucket.source !== serviceId16) continue;
15218
+ if (bucket.target === excludeTarget) continue;
15219
+ if (!graph.hasNode(bucket.target)) continue;
15220
+ const target = graph.getNodeAttributes(bucket.target);
15221
+ if (target.type !== NodeType30.DatabaseNode) continue;
15222
+ if (target.engine !== engine) continue;
15223
+ if (bucket.observed || datastoreEverObserved(graph, bucket.target)) return true;
15224
+ }
15225
+ return false;
15226
+ }
15227
+ var DEAD_CODE_PROBE_CONFIDENCE = 0.1;
15228
+ function dampenDeadCodeProbes(graph, buckets2, all) {
15229
+ return all.map((d) => {
15230
+ if (d.type !== "missing-observed") return d;
15231
+ if (!d.extracted || d.edgeType !== EdgeType25.CONNECTS_TO) return d;
15232
+ if (!graph.hasNode(d.target)) return d;
15233
+ const target = graph.getNodeAttributes(d.target);
15234
+ if (target.type !== NodeType30.DatabaseNode) return d;
15235
+ if (d.extracted.evidence?.hostSource !== "literal") return d;
15236
+ if (datastoreEverObserved(graph, d.target)) return d;
15237
+ const engine = target.engine;
15238
+ if (!serviceHasObservedSameEngineStore(graph, buckets2, d.source, engine, d.target)) return d;
15239
+ const host = target.host ?? target.name;
15240
+ return {
15241
+ ...d,
15242
+ confidence: Math.min(d.confidence, DEAD_CODE_PROBE_CONFIDENCE),
15243
+ reason: `${d.source} declares a ${engine} connection to a hardcoded-literal host (${host}) that production has never observed, while it does observe another ${engine} store \u2014 this reads as a flag-gated or dead-code declaration (e.g. a fault-injection probe), not a real declared-vs-observed gap.`,
15244
+ recommendation: "Confirm this is an intentional dead alternate \u2014 a fault-injection probe or a flag-gated branch. If it is meant to run in production, check the feature flag or conditional that gates it; if not, it can be ignored or removed."
15245
+ };
15246
+ });
15247
+ }
15198
15248
  function suppressHostMismatchHalves(all) {
15199
15249
  const observedHalf = /* @__PURE__ */ new Set();
15200
15250
  const declaredHalf = /* @__PURE__ */ new Set();
@@ -15231,7 +15281,8 @@ function computeDivergences(graph, opts = {}) {
15231
15281
  }
15232
15282
  });
15233
15283
  const reconciled = suppressHostMismatchHalves(all);
15234
- let filtered = reconciled;
15284
+ const dampened = dampenDeadCodeProbes(graph, buckets2, reconciled);
15285
+ let filtered = dampened;
15235
15286
  if (opts.type) {
15236
15287
  const allowed = opts.type;
15237
15288
  filtered = filtered.filter((d) => allowed.has(d.type));
@@ -21440,4 +21491,4 @@ export {
21440
21491
  deprovisionConnector,
21441
21492
  buildApi
21442
21493
  };
21443
- //# sourceMappingURL=chunk-HD5X5TWY.js.map
21494
+ //# sourceMappingURL=chunk-LRYPKC3B.js.map