@neat.is/core 0.9.2 → 0.9.3-dev.20260823

package/dist/{chunk-TMHCS4ZY.js → chunk-WJGZYEUG.js}

@@ -20,7 +20,7 @@ import {
   startStalenessLoop,
   touchLastSeen,
   writeAtomically
-} from "./chunk-HD5X5TWY.js";
+} from "./chunk-LRYPKC3B.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
@@ -891,4 +891,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-TMHCS4ZY.js.map
+//# sourceMappingURL=chunk-WJGZYEUG.js.map

package/dist/cli.cjs

@@ -9912,12 +9912,12 @@ async function resolveConfigs(literals, keys, serviceDir, looksLike, parse12) {
     const value = await interpolateEnvRefs(raw, serviceDir);
     if (!looksLike(value)) continue;
     const parsed = parse12(value);
-    if (parsed) out.push(parsed);
+    if (parsed) out.push({ ...parsed, hostSource: "config" });
   }
   for (const lit of literals) {
     if (!looksLike(lit)) continue;
     const parsed = parse12(lit);
-    if (parsed) out.push(parsed);
+    if (parsed) out.push({ ...parsed, hostSource: "literal" });
   }
   return out;
 }
@@ -10186,7 +10186,10 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         type: import_types23.EdgeType.CONNECTS_TO,
         provenance: import_types23.Provenance.EXTRACTED,
         confidence: (0, import_types23.confidenceForExtracted)("structural"),
-        evidence: { file: evidenceFile }
+        // Carry how the host was recovered (ADR-213) so the divergence ranker
+        // can tell a real declared store from a hardcoded fault-injection /
+        // flag-gated probe. Only set when the parser distinguished the two.
+        evidence: config.hostSource ? { file: evidenceFile, hostSource: config.hostSource } : { file: evidenceFile }
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -15981,6 +15984,53 @@ function detectColumnDrift(node) {
 function involvesNode(d, nodeId) {
   return d.source === nodeId || d.target === nodeId;
 }
+function datastoreEverObserved(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const n = graph.getNodeAttributes(nodeId);
+  if (n.type === import_types57.NodeType.DatabaseNode) {
+    const via = n.discoveredVia;
+    if (via === "otel" || via === "merged") return true;
+  }
+  for (const edgeId of graph.inboundEdges(nodeId)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.provenance === import_types57.Provenance.OBSERVED || e.provenance === import_types57.Provenance.STALE) return true;
+  }
+  return false;
+}
+function serviceHasObservedSameEngineStore(graph, buckets2, serviceId16, engine, excludeTarget) {
+  for (const bucket of buckets2.values()) {
+    if (bucket.type !== import_types57.EdgeType.CONNECTS_TO) continue;
+    if (bucket.source !== serviceId16) continue;
+    if (bucket.target === excludeTarget) continue;
+    if (!graph.hasNode(bucket.target)) continue;
+    const target = graph.getNodeAttributes(bucket.target);
+    if (target.type !== import_types57.NodeType.DatabaseNode) continue;
+    if (target.engine !== engine) continue;
+    if (bucket.observed || datastoreEverObserved(graph, bucket.target)) return true;
+  }
+  return false;
+}
+var DEAD_CODE_PROBE_CONFIDENCE = 0.1;
+function dampenDeadCodeProbes(graph, buckets2, all) {
+  return all.map((d) => {
+    if (d.type !== "missing-observed") return d;
+    if (!d.extracted || d.edgeType !== import_types57.EdgeType.CONNECTS_TO) return d;
+    if (!graph.hasNode(d.target)) return d;
+    const target = graph.getNodeAttributes(d.target);
+    if (target.type !== import_types57.NodeType.DatabaseNode) return d;
+    if (d.extracted.evidence?.hostSource !== "literal") return d;
+    if (datastoreEverObserved(graph, d.target)) return d;
+    const engine = target.engine;
+    if (!serviceHasObservedSameEngineStore(graph, buckets2, d.source, engine, d.target)) return d;
+    const host = target.host ?? target.name;
+    return {
+      ...d,
+      confidence: Math.min(d.confidence, DEAD_CODE_PROBE_CONFIDENCE),
+      reason: `${d.source} declares a ${engine} connection to a hardcoded-literal host (${host}) that production has never observed, while it does observe another ${engine} store \u2014 this reads as a flag-gated or dead-code declaration (e.g. a fault-injection probe), not a real declared-vs-observed gap.`,
+      recommendation: "Confirm this is an intentional dead alternate \u2014 a fault-injection probe or a flag-gated branch. If it is meant to run in production, check the feature flag or conditional that gates it; if not, it can be ignored or removed."
+    };
+  });
+}
 function suppressHostMismatchHalves(all) {
   const observedHalf = /* @__PURE__ */ new Set();
   const declaredHalf = /* @__PURE__ */ new Set();
@@ -16017,7 +16067,8 @@ function computeDivergences(graph, opts = {}) {
     }
   });
   const reconciled = suppressHostMismatchHalves(all);
-  let filtered = reconciled;
+  const dampened = dampenDeadCodeProbes(graph, buckets2, reconciled);
+  let filtered = dampened;
   if (opts.type) {
     const allowed = opts.type;
     filtered = filtered.filter((d) => allowed.has(d.type));