@neat.is/core 0.10.5 → 0.10.6-dev.20261007

package/dist/{chunk-DVCGDMTZ.js → chunk-KTJK2PAH.js}

@@ -343,13 +343,35 @@ function deprecatedApis() {
 }
 
 // src/ingest.ts
-import { promises as fs8, existsSync, readFileSync } from "fs";
-import path9 from "path";
-import * as sourceMapJs from "source-map-js";
+import { promises as fs9, existsSync, readFileSync } from "fs";
+import path10 from "path";
 
-// src/policy.ts
+// src/durable-incident.ts
 import { promises as fs2 } from "fs";
 import path2 from "path";
+async function appendRuntimeIncident(errorsPath, project, event, options = {}) {
+  const token = options.token ?? process.env.NEAT_INCIDENT_DURABLE_TOKEN;
+  if (token !== void 0) {
+    if (Buffer.byteLength(token, "utf8") < 32) throw new Error("durable incident sink unavailable");
+    const response = await (options.fetchImpl ?? fetch)("http://127.0.0.1:8081/incident-append", {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ project, event }),
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (response.status !== 204) throw new Error("durable incident sink unavailable");
+    return;
+  }
+  await fs2.mkdir(path2.dirname(errorsPath), { recursive: true });
+  await fs2.appendFile(errorsPath, JSON.stringify(event) + "\n", "utf8");
+}
+
+// src/ingest.ts
+import * as sourceMapJs from "source-map-js";
+
+// src/policy.ts
+import { promises as fs3 } from "fs";
+import path3 from "path";
 import {
   EdgeType,
   NodeType,
@@ -871,7 +893,7 @@ function matchPolicyToNode(graph, policy, nodeId, node) {
 async function loadPolicyFile(policyPath) {
   let raw;
   try {
-    raw = await fs2.readFile(policyPath, "utf8");
+    raw = await fs3.readFile(policyPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -892,8 +914,8 @@ var PolicyViolationsLog = class {
     if (!this.seen) await this.hydrate();
     if (this.seen.has(v.id)) return false;
     this.seen.add(v.id);
-    await fs2.mkdir(path2.dirname(this.path), { recursive: true });
-    await fs2.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
+    await fs3.mkdir(path3.dirname(this.path), { recursive: true });
+    await fs3.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
     emitNeatEvent({
       type: "policy-violation",
       project: this.project,
@@ -903,7 +925,7 @@ var PolicyViolationsLog = class {
   }
   async readAll() {
     try {
-      const raw = await fs2.readFile(this.path, "utf8");
+      const raw = await fs3.readFile(this.path, "utf8");
       return raw.split("\n").filter(Boolean).map((line) => JSON.parse(line));
     } catch (err) {
       if (err.code === "ENOENT") return [];
@@ -943,7 +965,7 @@ import {
 } from "@neat.is/types";
 
 // src/extract/routes.ts
-import path8 from "path";
+import path9 from "path";
 import Parser2 from "tree-sitter";
 import JavaScript2 from "tree-sitter-javascript";
 import Python2 from "tree-sitter-python";
@@ -961,8 +983,8 @@ import {
 } from "@neat.is/types";
 
 // src/extract/shared.ts
-import { promises as fs3 } from "fs";
-import path3 from "path";
+import { promises as fs4 } from "fs";
+import path4 from "path";
 import { parse as parseYaml } from "yaml";
 import { extractedEdgeId } from "@neat.is/types";
 var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".go", ".rb", ".php", ".cs", ".java", ".kt", ".rs", ".cpp", ".cc", ".cxx", ".c++", ".hpp", ".hh", ".hxx", ".h++"]);
@@ -1006,7 +1028,7 @@ async function isPythonVenvDir(dir) {
   const cached = PYVENV_MARKER_CACHE.get(dir);
   if (cached !== void 0) return cached;
   try {
-    const stat = await fs3.stat(path3.join(dir, "pyvenv.cfg"));
+    const stat = await fs4.stat(path4.join(dir, "pyvenv.cfg"));
     const ok = stat.isFile();
     PYVENV_MARKER_CACHE.set(dir, ok);
     return ok;
@@ -1016,7 +1038,7 @@ async function isPythonVenvDir(dir) {
   }
 }
 function isConfigFile(name) {
-  const ext = path3.extname(name);
+  const ext = path4.extname(name);
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
   if (JSON_CONFIG_FILENAMES.has(name)) return { match: true, fileType: "json" };
   if (name === ".env" || name.startsWith(".env.")) {
@@ -1133,16 +1155,16 @@ function cleanVersion(raw) {
   return raw.replace(/^[\^~><=v\s]+/, "").trim() || void 0;
 }
 async function readJson(filePath) {
-  const raw = await fs3.readFile(filePath, "utf8");
+  const raw = await fs4.readFile(filePath, "utf8");
   return JSON.parse(raw);
 }
 async function readYaml(filePath) {
-  const raw = await fs3.readFile(filePath, "utf8");
+  const raw = await fs4.readFile(filePath, "utf8");
   return parseYaml(raw);
 }
 async function exists(p) {
   try {
-    await fs3.access(p);
+    await fs4.access(p);
     return true;
   } catch {
     return false;
@@ -1150,8 +1172,8 @@ async function exists(p) {
 }
 
 // src/extract/errors.ts
-import { promises as fs4 } from "fs";
-import path4 from "path";
+import { promises as fs5 } from "fs";
+import path5 from "path";
 var sink = [];
 function recordExtractionError(producer, file, err) {
   const e = err instanceof Error ? err : new Error(String(err));
@@ -1170,14 +1192,14 @@ function drainExtractionErrors() {
 }
 async function writeExtractionErrors(errors, errorsPath) {
   if (errors.length === 0) return;
-  await fs4.mkdir(path4.dirname(errorsPath), { recursive: true });
+  await fs5.mkdir(path5.dirname(errorsPath), { recursive: true });
   const lines = errors.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await fs4.appendFile(errorsPath, lines, "utf8");
+  await fs5.appendFile(errorsPath, lines, "utf8");
 }
 function extractionHealthPathFor(errorsPath) {
-  const dir = path4.dirname(errorsPath);
-  const suffix = path4.basename(errorsPath).replace(/^errors/, "").replace(/\.ndjson$/, "");
-  return path4.join(dir, `extraction-health${suffix}.json`);
+  const dir = path5.dirname(errorsPath);
+  const suffix = path5.basename(errorsPath).replace(/^errors/, "").replace(/\.ndjson$/, "");
+  return path5.join(dir, `extraction-health${suffix}.json`);
 }
 var HEALTH_FILE_SAMPLE = 100;
 async function writeExtractionHealth(errors, healthPath, now = (/* @__PURE__ */ new Date()).toISOString()) {
@@ -1189,13 +1211,13 @@ async function writeExtractionHealth(errors, healthPath, now = (/* @__PURE__ */
     files: errors.slice(0, HEALTH_FILE_SAMPLE).map((e) => e.file),
     updatedAt: now
   };
-  await fs4.mkdir(path4.dirname(healthPath), { recursive: true });
-  await fs4.writeFile(healthPath, JSON.stringify(coverage), "utf8");
+  await fs5.mkdir(path5.dirname(healthPath), { recursive: true });
+  await fs5.writeFile(healthPath, JSON.stringify(coverage), "utf8");
 }
 async function readExtractionHealth(healthPath) {
   let raw;
   try {
-    raw = await fs4.readFile(healthPath, "utf8");
+    raw = await fs5.readFile(healthPath, "utf8");
   } catch {
     return void 0;
   }
@@ -1244,9 +1266,9 @@ function isRejectedLogEnabled() {
 }
 async function writeRejectedExtracted(drops, rejectedPath) {
   if (drops.length === 0) return;
-  await fs4.mkdir(path4.dirname(rejectedPath), { recursive: true });
+  await fs5.mkdir(path5.dirname(rejectedPath), { recursive: true });
   const lines = drops.map((d) => JSON.stringify({ ...d, ts: (/* @__PURE__ */ new Date()).toISOString() })).join("\n") + "\n";
-  await fs4.appendFile(rejectedPath, lines, "utf8");
+  await fs5.appendFile(rejectedPath, lines, "utf8");
 }
 function formatPrecisionFloorBanner(count) {
   if (count === 1) return `[neat] 1 extracted edge dropped below precision floor`;
@@ -1254,8 +1276,8 @@ function formatPrecisionFloorBanner(count) {
 }
 
 // src/extract/calls/shared.ts
-import { promises as fs6 } from "fs";
-import path6 from "path";
+import { promises as fs7 } from "fs";
+import path7 from "path";
 import {
   EdgeType as EdgeType2,
   NodeType as NodeType2,
@@ -1266,8 +1288,8 @@ import {
 } from "@neat.is/types";
 
 // src/extract/gitignore.ts
-import { promises as fs5 } from "fs";
-import path5 from "path";
+import { promises as fs6 } from "fs";
+import path6 from "path";
 import ignore from "ignore";
 var LAYER_CACHE = /* @__PURE__ */ new Map();
 async function layerFor(dir) {
@@ -1275,7 +1297,7 @@ async function layerFor(dir) {
   if (cached !== void 0) return cached;
   let layer = null;
   try {
-    const raw = await fs5.readFile(path5.join(dir, ".gitignore"), "utf8");
+    const raw = await fs6.readFile(path6.join(dir, ".gitignore"), "utf8");
     layer = { dir, ig: ignore().add(raw) };
   } catch {
     layer = null;
@@ -1285,7 +1307,7 @@ async function layerFor(dir) {
 }
 async function isRepoRoot(dir) {
   try {
-    await fs5.stat(path5.join(dir, ".git"));
+    await fs6.stat(path6.join(dir, ".git"));
     return true;
   } catch {
     return false;
@@ -1293,11 +1315,11 @@ async function isRepoRoot(dir) {
 }
 async function loadIgnoreChain(startDir) {
   const dirs = [];
-  let current = path5.resolve(startDir);
+  let current = path6.resolve(startDir);
   for (; ; ) {
     dirs.push(current);
     if (await isRepoRoot(current)) break;
-    const parent = path5.dirname(current);
+    const parent = path6.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -1310,7 +1332,7 @@ async function loadIgnoreChain(startDir) {
   return layers;
 }
 async function extendIgnoreChain(chain, dir) {
-  const layer = await layerFor(path5.resolve(dir));
+  const layer = await layerFor(path6.resolve(dir));
   return layer ? [...chain, layer] : chain;
 }
 function isIgnored(chain, fullPath, isDir) {
@@ -1318,14 +1340,14 @@ function isIgnored(chain, fullPath, isDir) {
 }
 function decide(chain, fullPath, isDir) {
   if (chain.length === 0) return { ignored: false, subtree: chain };
-  const abs = path5.resolve(fullPath);
+  const abs = path6.resolve(fullPath);
   let ignored = false;
   let unignoredAt = -1;
   for (let i = 0; i < chain.length; i++) {
     const layer = chain[i];
-    const rel = path5.relative(layer.dir, abs);
-    if (!rel || rel.startsWith("..") || path5.isAbsolute(rel)) continue;
-    const candidate = rel.split(path5.sep).join("/") + (isDir ? "/" : "");
+    const rel = path6.relative(layer.dir, abs);
+    if (!rel || rel.startsWith("..") || path6.isAbsolute(rel)) continue;
+    const candidate = rel.split(path6.sep).join("/") + (isDir ? "/" : "");
     const result = layer.ig.test(candidate);
     if (result.ignored) ignored = true;
     else if (result.unignored) {
@@ -1344,7 +1366,7 @@ function buildServiceHostIndex(services) {
   const knownHosts = /* @__PURE__ */ new Set();
   const hostToNodeId = /* @__PURE__ */ new Map();
   for (const service of services) {
-    const base = path6.basename(service.dir);
+    const base = path7.basename(service.dir);
     knownHosts.add(base);
     knownHosts.add(service.pkg.name);
     hostToNodeId.set(base, service.node.id);
@@ -1353,29 +1375,29 @@ function buildServiceHostIndex(services) {
   return { knownHosts, hostToNodeId };
 }
 async function walkSourceFiles(dir, excludeDirs = []) {
-  const excluded = new Set(excludeDirs.map((d) => path6.resolve(d)));
+  const excluded = new Set(excludeDirs.map((d) => path7.resolve(d)));
   const out = [];
   const rootChain = await loadIgnoreChain(dir);
   async function walk11(current, inherited) {
-    const entries = await fs6.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await fs7.readdir(current, { withFileTypes: true }).catch(() => []);
     const chain = entries.some((e) => e.isFile() && e.name === ".gitignore") ? await extendIgnoreChain(inherited, current) : inherited;
     for (const entry of entries) {
-      const full = path6.join(current, entry.name);
+      const full = path7.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        if (excluded.has(path6.resolve(full))) continue;
+        if (excluded.has(path7.resolve(full))) continue;
         const verdict = decide(chain, full, true);
         if (verdict.ignored) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk11(full, verdict.subtree);
-      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path6.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
+      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path7.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
       // would attribute our instrumentation imports to the user's service.
       !isNeatAuthoredSourceFile(entry.name) && !isIgnored(chain, full, false)) {
         out.push(full);
       }
     }
   }
-  await walk11(dir, rootChain.filter((l) => path6.resolve(l.dir) !== path6.resolve(dir)));
+  await walk11(dir, rootChain.filter((l) => path7.resolve(l.dir) !== path7.resolve(dir)));
   return out;
 }
 var MINIFIED_LINE_CHARS = 5e3;
@@ -1403,7 +1425,7 @@ async function loadSourceFiles(dir, excludeDirs = []) {
   const out = [];
   for (const p of paths) {
     try {
-      const content = await fs6.readFile(p, "utf8");
+      const content = await fs7.readFile(p, "utf8");
       const verdict = isMinifiedSource(p, content);
       if (verdict.minified) {
         noteSkippedFile({ path: p, reason: "minified", detail: verdict.detail });
@@ -1431,7 +1453,7 @@ function toPosix(p) {
   return p.split("\\").join("/");
 }
 function languageForPath(relPath) {
-  switch (path6.extname(relPath).toLowerCase()) {
+  switch (path7.extname(relPath).toLowerCase()) {
     case ".py":
       return "python";
     case ".go":
@@ -1514,8 +1536,8 @@ function ensureFileNode(graph, serviceName, serviceNodeId, relPath) {
 }
 
 // src/extract/imports.ts
-import path7 from "path";
-import { promises as fs7 } from "fs";
+import path8 from "path";
+import { promises as fs8 } from "fs";
 import Parser from "tree-sitter";
 import JavaScript from "tree-sitter-javascript";
 import Python from "tree-sitter-python";
@@ -1666,15 +1688,15 @@ function collectPyImports(node, out) {
 }
 async function fileExists(p) {
   try {
-    await fs7.access(p);
+    await fs8.access(p);
     return true;
   } catch {
     return false;
   }
 }
 function isWithinServiceDir(candidate, serviceDir) {
-  const rel = path7.relative(serviceDir, candidate);
-  return rel !== "" && !rel.startsWith("..") && !path7.isAbsolute(rel);
+  const rel = path8.relative(serviceDir, candidate);
+  return rel !== "" && !rel.startsWith("..") && !path8.isAbsolute(rel);
 }
 var JS_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var JS_INDEX_FILES = JS_EXTENSIONS.map((ext) => `index${ext}`);
@@ -1682,22 +1704,22 @@ async function firstExistingCandidate(base, serviceDir) {
   for (const ext of JS_EXTENSIONS) {
     const candidate = base + ext;
     if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
-      return toPosix(path7.relative(serviceDir, candidate));
+      return toPosix(path8.relative(serviceDir, candidate));
     }
   }
   for (const indexFile of JS_INDEX_FILES) {
-    const candidate = path7.join(base, indexFile);
+    const candidate = path8.join(base, indexFile);
     if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
-      return toPosix(path7.relative(serviceDir, candidate));
+      return toPosix(path8.relative(serviceDir, candidate));
     }
   }
   return null;
 }
 async function loadTsPathConfig(serviceDir) {
-  const tsconfigPath = path7.join(serviceDir, "tsconfig.json");
+  const tsconfigPath = path8.join(serviceDir, "tsconfig.json");
   let raw;
   try {
-    raw = await fs7.readFile(tsconfigPath, "utf8");
+    raw = await fs8.readFile(tsconfigPath, "utf8");
   } catch {
     return null;
   }
@@ -1706,7 +1728,7 @@ async function loadTsPathConfig(serviceDir) {
     const paths = parsed.compilerOptions?.paths;
     if (!paths || Object.keys(paths).length === 0) return null;
     const baseUrl = parsed.compilerOptions?.baseUrl;
-    return { paths, baseDir: baseUrl ? path7.resolve(serviceDir, baseUrl) : serviceDir };
+    return { paths, baseDir: baseUrl ? path8.resolve(serviceDir, baseUrl) : serviceDir };
   } catch (err) {
     recordExtractionError("import alias resolution", tsconfigPath, err);
     return null;
@@ -1724,11 +1746,11 @@ async function resolveTsAlias(specifier, config, serviceDir) {
     if (suffix === null) continue;
     for (const target of targets) {
       const targetBase = target.endsWith("/*") ? target.slice(0, -2) : target.replace(/\*$/, "");
-      const resolvedBase = path7.resolve(config.baseDir, targetBase, suffix);
+      const resolvedBase = path8.resolve(config.baseDir, targetBase, suffix);
       const hit = await firstExistingCandidate(resolvedBase, serviceDir);
       if (hit) return hit;
       if (isWithinServiceDir(resolvedBase, serviceDir) && await fileExists(resolvedBase)) {
-        return toPosix(path7.relative(serviceDir, resolvedBase));
+        return toPosix(path8.relative(serviceDir, resolvedBase));
       }
     }
   }
@@ -1737,18 +1759,18 @@ async function resolveTsAlias(specifier, config, serviceDir) {
 async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
   if (!specifier) return null;
   if (specifier.startsWith("./") || specifier.startsWith("../")) {
-    const base = path7.resolve(importerDir, specifier);
-    const ext = path7.extname(specifier);
+    const base = path8.resolve(importerDir, specifier);
+    const ext = path8.extname(specifier);
     if (ext) {
       if (ext === ".js" || ext === ".jsx") {
         const tsExt = ext === ".jsx" ? ".tsx" : ".ts";
         const tsSibling = base.slice(0, -ext.length) + tsExt;
         if (isWithinServiceDir(tsSibling, serviceDir) && await fileExists(tsSibling)) {
-          return toPosix(path7.relative(serviceDir, tsSibling));
+          return toPosix(path8.relative(serviceDir, tsSibling));
         }
       }
       if (isWithinServiceDir(base, serviceDir) && await fileExists(base)) {
-        return toPosix(path7.relative(serviceDir, base));
+        return toPosix(path8.relative(serviceDir, base));
       }
       if (!JS_EXTENSIONS.includes(ext)) {
         return firstExistingCandidate(base, serviceDir);
@@ -1763,30 +1785,30 @@ async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
 async function resolvePyImport(imp, importerPath, serviceDir) {
   let baseDir;
   if (imp.level > 0) {
-    baseDir = path7.dirname(importerPath);
-    for (let i = 1; i < imp.level; i++) baseDir = path7.dirname(baseDir);
+    baseDir = path8.dirname(importerPath);
+    for (let i = 1; i < imp.level; i++) baseDir = path8.dirname(baseDir);
   } else {
     baseDir = serviceDir;
   }
-  const moduleBase = imp.modulePath ? path7.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
+  const moduleBase = imp.modulePath ? path8.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
   const resolved = /* @__PURE__ */ new Set();
   let needModuleFile = imp.names.length === 0;
   for (const name of imp.names) {
-    const submoduleFile = path7.join(moduleBase, `${name}.py`);
-    const subpackageInit = path7.join(moduleBase, name, "__init__.py");
+    const submoduleFile = path8.join(moduleBase, `${name}.py`);
+    const subpackageInit = path8.join(moduleBase, name, "__init__.py");
     if (isWithinServiceDir(submoduleFile, serviceDir) && await fileExists(submoduleFile)) {
-      resolved.add(toPosix(path7.relative(serviceDir, submoduleFile)));
+      resolved.add(toPosix(path8.relative(serviceDir, submoduleFile)));
     } else if (isWithinServiceDir(subpackageInit, serviceDir) && await fileExists(subpackageInit)) {
-      resolved.add(toPosix(path7.relative(serviceDir, subpackageInit)));
+      resolved.add(toPosix(path8.relative(serviceDir, subpackageInit)));
     } else {
       needModuleFile = true;
     }
   }
   if (needModuleFile) {
-    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, path7.join(moduleBase, "__init__.py")] : [path7.join(moduleBase, "__init__.py")];
+    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, path8.join(moduleBase, "__init__.py")] : [path8.join(moduleBase, "__init__.py")];
     for (const candidate of moduleFileCandidates) {
       if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
-        resolved.add(toPosix(path7.relative(serviceDir, candidate)));
+        resolved.add(toPosix(path8.relative(serviceDir, candidate)));
         break;
       }
     }
@@ -1796,11 +1818,11 @@ async function resolvePyImport(imp, importerPath, serviceDir) {
 async function resolveGoImport(specifier, modulePath, serviceDir) {
   if (specifier !== modulePath && !specifier.startsWith(`${modulePath}/`)) return null;
   const suffix = specifier === modulePath ? "" : specifier.slice(modulePath.length + 1);
-  const dir = path7.join(serviceDir, suffix);
-  const entries = await fs7.readdir(dir, { withFileTypes: true }).catch(() => []);
-  const candidates = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".go") && !entry.name.endsWith("_test.go")).map((entry) => path7.join(dir, entry.name));
+  const dir = path8.join(serviceDir, suffix);
+  const entries = await fs8.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const candidates = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".go") && !entry.name.endsWith("_test.go")).map((entry) => path8.join(dir, entry.name));
   if (candidates.length !== 1) return null;
-  return toPosix(path7.relative(serviceDir, candidates[0]));
+  return toPosix(path8.relative(serviceDir, candidates[0]));
 }
 function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, importeeRelPath, line, snippet2) {
   const importeeFileId = fileId2(serviceName, importeeRelPath);
@@ -1830,12 +1852,12 @@ async function addImports(graph, services) {
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const relFile = toPosix(path7.relative(service.dir, file.path));
+      const relFile = toPosix(path8.relative(service.dir, file.path));
       const importerFileId = fileId2(service.pkg.name, relFile);
-      const isPython = path7.extname(file.path) === ".py";
-      const isGo = path7.extname(file.path) === ".go";
-      if (path7.extname(file.path) === ".rb") continue;
-      if (path7.extname(file.path) === ".php") continue;
+      const isPython = path8.extname(file.path) === ".py";
+      const isGo = path8.extname(file.path) === ".go";
+      if (path8.extname(file.path) === ".rb") continue;
+      if (path8.extname(file.path) === ".php") continue;
       if (isGo) {
         let goImports = [];
         try {
@@ -1845,7 +1867,7 @@ async function addImports(graph, services) {
           recordExtractionError("import extraction", file.path, err);
           continue;
         }
-        const goMod = await fs7.readFile(path7.join(service.dir, "go.mod"), "utf8").catch(() => "");
+        const goMod = await fs8.readFile(path8.join(service.dir, "go.mod"), "utf8").catch(() => "");
         const modulePath = goMod.match(/^\s*module\s+(\S+)\s*$/m)?.[1];
         if (!modulePath) continue;
         for (const imp of goImports) {
@@ -1889,7 +1911,7 @@ async function addImports(graph, services) {
         continue;
       }
       for (const imp of jsImports) {
-        const resolved = await resolveJsImport(imp.specifier, path7.dirname(file.path), service.dir, tsPaths);
+        const resolved = await resolveJsImport(imp.specifier, path8.dirname(file.path), service.dir, tsPaths);
         if (!resolved) continue;
         edgesAdded += emitImportEdge(
           graph,
@@ -2014,8 +2036,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path74) {
-  return path74.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path77) {
+  return path77.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -2355,7 +2377,7 @@ function isNextPagesApiFile(relFile) {
   if (pagesIdx === -1 || segs[pagesIdx + 1] !== "api") return false;
   const base = segs[segs.length - 1] ?? "";
   if (/^_(app|document|middleware)\./.test(base)) return false;
-  return JS_ROUTE_EXTENSIONS.has(path8.extname(base));
+  return JS_ROUTE_EXTENSIONS.has(path9.extname(base));
 }
 function nextSegment(seg) {
   if (seg.startsWith("(") && seg.endsWith(")")) return null;
@@ -2687,9 +2709,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path74 = rubyLiteral(k);
-    if (path74 === null) continue;
-    return { path: path74, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path77 = rubyLiteral(k);
+    if (path77 === null) continue;
+    return { path: path77, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -2779,23 +2801,23 @@ function railsInferHandler(rawPath) {
   if (segs.length === 1) return `${segs[0]}#index`;
   return `${segs.slice(0, -1).join("/")}#${segs[segs.length - 1]}`;
 }
-function railsResource(call, ctx, out, plural) {
+function railsResource(call, ctx, out, plural2) {
   if (ctx.depth >= 2) return;
   const args = rubyArgs(call);
   const name = rubyLiteral(rubyPositional(args)[0]);
   if (!name) return;
   const base = `${ctx.path}/${name}`;
-  const controller = ctx.module + (plural ? name : railsPluralize(name));
+  const controller = ctx.module + (plural2 ? name : railsPluralize(name));
   const allow = railsActionFilter(args);
   const line = call.startPosition.row + 1;
-  for (const row of plural ? RAILS_PLURAL_ROWS : RAILS_SINGULAR_ROWS) {
+  for (const row of plural2 ? RAILS_PLURAL_ROWS : RAILS_SINGULAR_ROWS) {
     if (!allow(row.action)) continue;
     for (const m of row.methods) railsEmit(out, m, base + row.suffix, `${controller}#${row.action}`, line);
   }
   const block = call.childForFieldName("block");
   if (!block) return;
-  const memberBase = plural ? `${base}/:id` : base;
-  const nestedPath = plural ? `${base}/:${railsSingularize(name)}_id` : base;
+  const memberBase = plural2 ? `${base}/:id` : base;
+  const nestedPath = plural2 ? `${base}/:${railsSingularize(name)}_id` : base;
   for (const child of rubyBlockCalls(block)) {
     const cm = child.childForFieldName("method")?.text;
     if (cm === "member") railsBlockVerbs(child, memberBase, controller, out);
@@ -3537,12 +3559,12 @@ async function expressMountPrefixes(files, serviceDir, tsPaths) {
   const jsParser = makeJsParser2();
   const fileInfo = /* @__PURE__ */ new Map();
   for (const f of files) {
-    if (!JS_ROUTE_EXTENSIONS.has(path8.extname(f.path))) continue;
+    if (!JS_ROUTE_EXTENSIONS.has(path9.extname(f.path))) continue;
     if (isTestPath(f.path)) continue;
-    const rel = toPosix(path8.relative(serviceDir, f.path));
+    const rel = toPosix(path9.relative(serviceDir, f.path));
     try {
       const tree = parseSource2(jsParser, f.content);
-      fileInfo.set(rel, analyzeExpressFile(tree.rootNode, path8.dirname(f.path)));
+      fileInfo.set(rel, analyzeExpressFile(tree.rootNode, path9.dirname(f.path)));
     } catch {
     }
   }
@@ -3641,14 +3663,14 @@ async function addRoutes(graph, services) {
     const mountPrefixes = hasExpress ? await expressMountPrefixes(files, service.dir, await loadTsPathConfig(service.dir)) : /* @__PURE__ */ new Map();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const ext = path8.extname(file.path);
+      const ext = path9.extname(file.path);
       const isPy = ext === ".py";
       const isGo = ext === ".go";
       const isRb = ext === ".rb";
       const isPhp = ext === ".php";
       const isRs = ext === ".rs";
       if (!JS_ROUTE_EXTENSIONS.has(ext) && !isPy && !isGo && !isRb && !isPhp && !isRs) continue;
-      const relFile = toPosix(path8.relative(service.dir, file.path));
+      const relFile = toPosix(path9.relative(service.dir, file.path));
       let routes;
       try {
         if (isPhp) {
@@ -4110,20 +4132,20 @@ var CODE_LINENO_ATTR = "code.lineno";
 var CODE_FUNCTION_NAME_ATTR = "code.function.name";
 var CODE_FUNCTION_ATTR = "code.function";
 function codeFilepathOf(attrs) {
-  const stable = attrs[CODE_FILE_PATH_ATTR];
-  if (typeof stable === "string" && stable.length > 0) return stable;
+  const stable2 = attrs[CODE_FILE_PATH_ATTR];
+  if (typeof stable2 === "string" && stable2.length > 0) return stable2;
   const prior = attrs[CODE_FILEPATH_ATTR];
   return typeof prior === "string" && prior.length > 0 ? prior : void 0;
 }
 function codeLinenoOf(attrs) {
-  const stable = attrs[CODE_LINE_NUMBER_ATTR];
-  if (typeof stable === "number" && Number.isFinite(stable)) return stable;
+  const stable2 = attrs[CODE_LINE_NUMBER_ATTR];
+  if (typeof stable2 === "number" && Number.isFinite(stable2)) return stable2;
   const prior = attrs[CODE_LINENO_ATTR];
   return typeof prior === "number" && Number.isFinite(prior) ? prior : void 0;
 }
 function codeFunctionOf(attrs) {
-  const stable = attrs[CODE_FUNCTION_NAME_ATTR];
-  if (typeof stable === "string" && stable.length > 0) return stable;
+  const stable2 = attrs[CODE_FUNCTION_NAME_ATTR];
+  if (typeof stable2 === "string" && stable2.length > 0) return stable2;
   const prior = attrs[CODE_FUNCTION_ATTR];
   return typeof prior === "string" && prior.length > 0 ? prior : void 0;
 }
@@ -4153,7 +4175,7 @@ function languageForExt(relPath) {
 function relPathForRuntimeFile(filepath, serviceNode, scanPath) {
   let p = toPosix2(filepath).replace(/^file:\/\//, "");
   if (scanPath && scanPath.length > 0) {
-    const absRoot = toPosix2(path9.resolve(scanPath, serviceNode?.repoPath ?? ""));
+    const absRoot = toPosix2(path10.resolve(scanPath, serviceNode?.repoPath ?? ""));
     const anchor = absRoot.endsWith("/") ? absRoot : `${absRoot}/`;
     if (p.startsWith(anchor)) return p.slice(anchor.length);
   }
@@ -4184,7 +4206,7 @@ function resolveDistToSrc(absFilepath, line) {
       if (existsSync(mapPath)) {
         const raw = JSON.parse(readFileSync(mapPath, "utf8"));
         const consumer = new sourceMapJs.SourceMapConsumer(raw);
-        entry = { consumer, dir: path9.dirname(mapPath) };
+        entry = { consumer, dir: path10.dirname(mapPath) };
       }
     } catch {
       entry = null;
@@ -4204,7 +4226,7 @@ function resolveDistToSrc(absFilepath, line) {
     }
     if (!pos || !pos.source) return null;
     const root = entry.consumer.sourceRoot ?? "";
-    const resolved = path9.resolve(entry.dir, root, pos.source);
+    const resolved = path10.resolve(entry.dir, root, pos.source);
     return { filepath: resolved, ...pos.line ? { line: pos.line } : {} };
   } catch {
     return null;
@@ -4748,8 +4770,7 @@ function emitIncidentEvent(project, ev) {
   });
 }
 async function appendErrorEvent(ctx, ev) {
-  await fs8.mkdir(path9.dirname(ctx.errorsPath), { recursive: true });
-  await fs8.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
+  await appendRuntimeIncident(ctx.errorsPath, ctx.project ?? DEFAULT_PROJECT, ev);
   emitIncidentEvent(ctx.project ?? DEFAULT_PROJECT, ev);
 }
 async function appendConnectorIncident(errorsPath, input, project) {
@@ -4764,8 +4785,7 @@ async function appendConnectorIncident(errorsPath, input, project) {
     ...input.attributes && Object.keys(input.attributes).length > 0 ? { attributes: input.attributes } : {},
     affectedNode: input.affectedNode
   };
-  await fs8.mkdir(path9.dirname(errorsPath), { recursive: true });
-  await fs8.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
+  await appendRuntimeIncident(errorsPath, project ?? DEFAULT_PROJECT, ev);
   if (project) emitIncidentEvent(project, ev);
 }
 function landIncidentCallSite(span, callSite, trusted, graph) {
@@ -4887,8 +4907,7 @@ function makeErrorSpanWriter(errorsPath, graph, scanPath, project = DEFAULT_PROJ
   return async (span) => {
     const ev = buildErrorEventForReceiver(span, graph, scanPath);
     if (!ev) return;
-    await fs8.mkdir(path9.dirname(errorsPath), { recursive: true });
-    await fs8.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
+    await appendRuntimeIncident(errorsPath, project, ev);
     emitIncidentEvent(project, ev);
   };
 }
@@ -5391,13 +5410,13 @@ async function markStaleEdges(graph, options = {}) {
   return { count: events.length, events };
 }
 async function appendStaleEvents(staleEventsPath, events) {
-  await fs8.mkdir(path9.dirname(staleEventsPath), { recursive: true });
+  await fs9.mkdir(path10.dirname(staleEventsPath), { recursive: true });
   const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await fs8.appendFile(staleEventsPath, lines, "utf8");
+  await fs9.appendFile(staleEventsPath, lines, "utf8");
 }
 async function readStaleEvents(staleEventsPath) {
   try {
-    const raw = await fs8.readFile(staleEventsPath, "utf8");
+    const raw = await fs9.readFile(staleEventsPath, "utf8");
     return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
   } catch (err) {
     if (err.code === "ENOENT") return [];
@@ -5433,7 +5452,7 @@ function startStalenessLoop(graph, options = {}) {
 var INCIDENT_READ_MAX_BYTES = 32 * 1024 * 1024;
 var INCIDENT_READ_MAX_EVENTS = 5e3;
 async function readErrorFileTail(errorsPath, maxBytes) {
-  const handle = await fs8.open(errorsPath, "r");
+  const handle = await fs9.open(errorsPath, "r");
   try {
     const { size } = await handle.stat();
     if (size <= maxBytes) {
@@ -5469,6 +5488,23 @@ async function readErrorEvents(errorsPath, opts) {
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
 }
+async function readErrorEventById(errorsPath, id) {
+  let raw;
+  try {
+    raw = await readErrorFileTail(errorsPath, INCIDENT_READ_MAX_BYTES);
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  const lines = raw.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line) continue;
+    const event = JSON.parse(line);
+    if (event.id === id) return redactPersistedAttributes(event);
+  }
+  return void 0;
+}
 function isSynthesizedHttpIncident(ev) {
   if (ev.exceptionType || ev.exceptionStacktrace) return false;
   if (ev.errorType) return false;
@@ -5690,19 +5726,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path74, edges) {
-    if (path74.length > best.path.length) {
-      best = { path: [...path74], edges: [...edges] };
+  function step(node, path77, edges) {
+    if (path77.length > best.path.length) {
+      best = { path: [...path77], edges: [...edges] };
     }
-    if (path74.length - 1 >= maxDepth) return;
+    if (path77.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path74.push(srcId);
+      path77.push(srcId);
       edges.push(edge);
-      step(srcId, path74, edges);
-      path74.pop();
+      step(srcId, path77, edges);
+      path77.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -5917,20 +5953,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path74 = [originServiceId];
+  const path77 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path74.push(hop.nextService);
+    path77.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path74, edges, culprit: current };
+  return { path: path77, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === EdgeType6.CALLS && e.provenance === Provenance6.STALE;
@@ -5966,26 +6002,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path74 = [originServiceId];
+  const path77 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path74.push(hop.nextService);
+    path77.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path74, edges, culprit: current };
+  return { path: path77, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path74 = [...chain.path];
+  const path77 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -5993,14 +6029,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path74.push(loc.fileNode);
+      path77.push(loc.fileNode);
       edgeProvenances.push(Provenance6.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path74,
+      traversalPath: path77,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -6012,7 +6048,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path74,
+    traversalPath: path77,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -6665,10 +6701,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path74 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path74) {
-      traversalPath = path74.nodes;
-      edgeProvenances = path74.edges.map((e) => e.provenance);
+    const path77 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path77) {
+      traversalPath = path77.nodes;
+      edgeProvenances = path77.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? Provenance6.OBSERVED];
@@ -6703,15 +6739,15 @@ function fixRecommendationForTop(top, seedNode, legacy) {
 }
 
 // src/extract/services.ts
-import { promises as fs19 } from "fs";
-import path21 from "path";
+import { promises as fs20 } from "fs";
+import path22 from "path";
 import ignore2 from "ignore";
 import { minimatch as minimatch2 } from "minimatch";
 import { NodeType as NodeType15, serviceId as serviceId11 } from "@neat.is/types";
 
 // src/extract/python.ts
-import { promises as fs9 } from "fs";
-import path10 from "path";
+import { promises as fs10 } from "fs";
+import path11 from "path";
 import { parse as parseToml } from "smol-toml";
 var REQUIREMENT_LINE = /^\s*([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?\s*(?:(==)\s*([A-Za-z0-9_.+-]+))?/;
 function parseRequirementsTxt(content) {
@@ -6744,25 +6780,25 @@ function depsFromPyProject(pyproject) {
   return out;
 }
 async function discoverPythonService(serviceDir) {
-  const pyprojectPath = path10.join(serviceDir, "pyproject.toml");
-  const requirementsPath = path10.join(serviceDir, "requirements.txt");
-  const setupPath = path10.join(serviceDir, "setup.py");
+  const pyprojectPath = path11.join(serviceDir, "pyproject.toml");
+  const requirementsPath = path11.join(serviceDir, "requirements.txt");
+  const setupPath = path11.join(serviceDir, "setup.py");
   const hasPyproject = await exists(pyprojectPath);
   const hasRequirements = await exists(requirementsPath);
   const hasSetup = await exists(setupPath);
   if (!hasPyproject && !hasRequirements && !hasSetup) return null;
-  let name = path10.basename(serviceDir);
+  let name = path11.basename(serviceDir);
   let version;
   const dependencies = {};
   if (hasPyproject) {
-    const raw = await fs9.readFile(pyprojectPath, "utf8");
+    const raw = await fs10.readFile(pyprojectPath, "utf8");
     const pyproject = parseToml(raw);
     name = pyproject.project?.name ?? pyproject.tool?.poetry?.name ?? name;
     version = pyproject.project?.version ?? pyproject.tool?.poetry?.version ?? void 0;
     Object.assign(dependencies, depsFromPyProject(pyproject));
   }
   if (hasRequirements) {
-    const raw = await fs9.readFile(requirementsPath, "utf8");
+    const raw = await fs10.readFile(requirementsPath, "utf8");
     Object.assign(dependencies, parseRequirementsTxt(raw));
   }
   return { name, version, dependencies };
@@ -6776,8 +6812,8 @@ function pythonToPackage(service) {
 }
 
 // src/extract/go.ts
-import { promises as fs10 } from "fs";
-import path11 from "path";
+import { promises as fs11 } from "fs";
+import path12 from "path";
 import { NodeType as NodeType6, serviceId as serviceId2 } from "@neat.is/types";
 function parseGoMod(source) {
   const module = source.match(/^\s*module\s+(\S+)\s*$/m)?.[1];
@@ -6804,7 +6840,7 @@ function goFramework(deps) {
 async function discoverGoService(scanPath, dir) {
   let raw;
   try {
-    raw = await fs10.readFile(path11.join(dir, "go.mod"), "utf8");
+    raw = await fs11.readFile(path12.join(dir, "go.mod"), "utf8");
   } catch {
     return null;
   }
@@ -6819,15 +6855,15 @@ async function discoverGoService(scanPath, dir) {
     name,
     language: "go",
     dependencies: mod.dependencies,
-    repoPath: path11.relative(scanPath, dir),
+    repoPath: path12.relative(scanPath, dir),
     ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
 
 // src/extract/ruby.ts
-import { promises as fs11 } from "fs";
-import path12 from "path";
+import { promises as fs12 } from "fs";
+import path13 from "path";
 import { NodeType as NodeType7, serviceId as serviceId3 } from "@neat.is/types";
 function parseGemfile(source) {
   const dependencies = {};
@@ -6844,12 +6880,12 @@ function parseGemfile(source) {
 async function discoverRubyService(scanPath, dir) {
   let raw;
   try {
-    raw = await fs11.readFile(path12.join(dir, "Gemfile"), "utf8");
+    raw = await fs12.readFile(path13.join(dir, "Gemfile"), "utf8");
   } catch {
     return null;
   }
   const gemfile = parseGemfile(raw);
-  const name = path12.basename(dir);
+  const name = path13.basename(dir);
   const pkg = { name, dependencies: gemfile.dependencies };
   const node = {
     id: serviceId3(name),
@@ -6857,14 +6893,14 @@ async function discoverRubyService(scanPath, dir) {
     name,
     language: "ruby",
     dependencies: gemfile.dependencies,
-    repoPath: path12.relative(scanPath, dir),
+    repoPath: path13.relative(scanPath, dir),
     ...gemfile.dependencies["rails"] !== void 0 ? { framework: "rails" } : {}
   };
   return { pkg, dir, node };
 }
 
 // src/extract/php.ts
-import path13 from "path";
+import path14 from "path";
 import { NodeType as NodeType8, serviceId as serviceId4 } from "@neat.is/types";
 function parseComposerJson(composer) {
   return {
@@ -6877,12 +6913,12 @@ function parseComposerJson(composer) {
 async function discoverPhpService(scanPath, dir) {
   let composer;
   try {
-    composer = await readJson(path13.join(dir, "composer.json"));
+    composer = await readJson(path14.join(dir, "composer.json"));
   } catch {
     return null;
   }
   const { dependencies } = parseComposerJson(composer);
-  const name = path13.basename(dir);
+  const name = path14.basename(dir);
   const pkg = { name, dependencies };
   const node = {
     id: serviceId4(name),
@@ -6890,30 +6926,30 @@ async function discoverPhpService(scanPath, dir) {
     name,
     language: "php",
     dependencies,
-    repoPath: path13.relative(scanPath, dir),
+    repoPath: path14.relative(scanPath, dir),
     ...dependencies["laravel/framework"] !== void 0 ? { framework: "laravel" } : {}
   };
   return { pkg, dir, node };
 }
 
 // src/extract/csharp.ts
-import { promises as fs12 } from "fs";
-import path14 from "path";
+import { promises as fs13 } from "fs";
+import path15 from "path";
 import { NodeType as NodeType9, serviceId as serviceId5 } from "@neat.is/types";
 var CSHARP_PROJECT_EXTS = /* @__PURE__ */ new Set([".csproj", ".sln"]);
 async function projectFiles(dir) {
-  const entries = await fs12.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs13.readdir(dir, { withFileTypes: true }).catch(() => []);
   const out = [];
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    if (CSHARP_PROJECT_EXTS.has(path14.extname(entry.name).toLowerCase())) out.push(entry.name);
+    if (CSHARP_PROJECT_EXTS.has(path15.extname(entry.name).toLowerCase())) out.push(entry.name);
   }
   return out.sort();
 }
 var NESTED_PROJECT_DIR = "src";
 async function resolveProjectDir(dir) {
   if ((await projectFiles(dir)).length > 0) return dir;
-  const nested = path14.join(dir, NESTED_PROJECT_DIR);
+  const nested = path15.join(dir, NESTED_PROJECT_DIR);
   if ((await projectFiles(nested)).length > 0) return nested;
   return null;
 }
@@ -6938,10 +6974,10 @@ async function discoverCsharpService(scanPath, dir) {
   if (projectDir === null) return null;
   const projects = await projectFiles(projectDir);
   const csproj = projects.find((p) => p.toLowerCase().endsWith(".csproj"));
-  const name = csproj ? path14.basename(csproj, path14.extname(csproj)) : path14.basename(dir);
+  const name = csproj ? path15.basename(csproj, path15.extname(csproj)) : path15.basename(dir);
   let dependencies = {};
   if (csproj) {
-    const raw = await fs12.readFile(path14.join(projectDir, csproj), "utf8").catch(() => "");
+    const raw = await fs13.readFile(path15.join(projectDir, csproj), "utf8").catch(() => "");
     dependencies = parseCsproj(raw).dependencies;
   }
   const pkg = { name, dependencies };
@@ -6953,19 +6989,19 @@ async function discoverCsharpService(scanPath, dir) {
     dependencies,
     // Anchor on the directory that holds the project and its `.cs` files, so file
     // attribution reaches the source whether it sits at the root or under `src/`.
-    repoPath: path14.relative(scanPath, projectDir)
+    repoPath: path15.relative(scanPath, projectDir)
   };
   return { pkg, dir: projectDir, node };
 }
 
 // src/extract/java.ts
-import { promises as fs13 } from "fs";
-import path15 from "path";
+import { promises as fs14 } from "fs";
+import path16 from "path";
 import { NodeType as NodeType10, serviceId as serviceId6 } from "@neat.is/types";
 var JAVA_MANIFESTS = ["pom.xml", "build.gradle", "build.gradle.kts"];
 async function hasJavaManifest(dir) {
   for (const manifest of JAVA_MANIFESTS) {
-    if (await exists(path15.join(dir, manifest))) return true;
+    if (await exists(path16.join(dir, manifest))) return true;
   }
   return false;
 }
@@ -7000,19 +7036,19 @@ function parseGradle(source) {
   return { dependencies };
 }
 async function discoverJavaService(scanPath, dir) {
-  const pomPath = path15.join(dir, "pom.xml");
-  const gradlePath = path15.join(dir, "build.gradle");
-  const gradleKtsPath = path15.join(dir, "build.gradle.kts");
+  const pomPath = path16.join(dir, "pom.xml");
+  const gradlePath = path16.join(dir, "build.gradle");
+  const gradleKtsPath = path16.join(dir, "build.gradle.kts");
   let manifest = null;
   if (await exists(pomPath)) {
-    manifest = parsePomXml(await fs13.readFile(pomPath, "utf8").catch(() => ""));
+    manifest = parsePomXml(await fs14.readFile(pomPath, "utf8").catch(() => ""));
   } else if (await exists(gradlePath)) {
-    manifest = parseGradle(await fs13.readFile(gradlePath, "utf8").catch(() => ""));
+    manifest = parseGradle(await fs14.readFile(gradlePath, "utf8").catch(() => ""));
   } else if (await exists(gradleKtsPath)) {
-    manifest = parseGradle(await fs13.readFile(gradleKtsPath, "utf8").catch(() => ""));
+    manifest = parseGradle(await fs14.readFile(gradleKtsPath, "utf8").catch(() => ""));
   }
   if (!manifest) return null;
-  const name = manifest.name?.trim() || path15.basename(dir);
+  const name = manifest.name?.trim() || path16.basename(dir);
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
@@ -7021,14 +7057,14 @@ async function discoverJavaService(scanPath, dir) {
     name,
     language: "java",
     dependencies,
-    repoPath: path15.relative(scanPath, dir)
+    repoPath: path16.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/kotlin.ts
-import { promises as fs14 } from "fs";
-import path16 from "path";
+import { promises as fs15 } from "fs";
+import path17 from "path";
 import { NodeType as NodeType11, serviceId as serviceId7 } from "@neat.is/types";
 var KOTLIN_SOURCE_EXT = ".kt";
 var JAVA_SOURCE_EXT = ".java";
@@ -7038,15 +7074,15 @@ async function dominantJvmSourceLanguage(dir) {
   let java = 0;
   async function recurse(current, depth) {
     if (depth > SOURCE_PROBE_MAX_DEPTH) return;
-    const entries = await fs14.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await fs15.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        await recurse(path16.join(current, entry.name), depth + 1);
+        await recurse(path17.join(current, entry.name), depth + 1);
         continue;
       }
       if (!entry.isFile()) continue;
-      const ext = path16.extname(entry.name).toLowerCase();
+      const ext = path17.extname(entry.name).toLowerCase();
       if (ext === KOTLIN_SOURCE_EXT) kt++;
       else if (ext === JAVA_SOURCE_EXT) java++;
     }
@@ -7057,17 +7093,17 @@ async function dominantJvmSourceLanguage(dir) {
   return void 0;
 }
 async function readJvmManifest(dir) {
-  const pomPath = path16.join(dir, JAVA_MANIFESTS[0]);
-  const gradlePath = path16.join(dir, JAVA_MANIFESTS[1]);
-  const gradleKtsPath = path16.join(dir, JAVA_MANIFESTS[2]);
+  const pomPath = path17.join(dir, JAVA_MANIFESTS[0]);
+  const gradlePath = path17.join(dir, JAVA_MANIFESTS[1]);
+  const gradleKtsPath = path17.join(dir, JAVA_MANIFESTS[2]);
   if (await exists(pomPath)) {
-    return parsePomXml(await fs14.readFile(pomPath, "utf8").catch(() => ""));
+    return parsePomXml(await fs15.readFile(pomPath, "utf8").catch(() => ""));
   }
   if (await exists(gradlePath)) {
-    return parseGradle(await fs14.readFile(gradlePath, "utf8").catch(() => ""));
+    return parseGradle(await fs15.readFile(gradlePath, "utf8").catch(() => ""));
   }
   if (await exists(gradleKtsPath)) {
-    return parseGradle(await fs14.readFile(gradleKtsPath, "utf8").catch(() => ""));
+    return parseGradle(await fs15.readFile(gradleKtsPath, "utf8").catch(() => ""));
   }
   return null;
 }
@@ -7076,7 +7112,7 @@ async function discoverKotlinService(scanPath, dir) {
   if (await dominantJvmSourceLanguage(dir) !== "kotlin") return null;
   const manifest = await readJvmManifest(dir);
   if (!manifest) return null;
-  const name = manifest.name?.trim() || path16.basename(dir);
+  const name = manifest.name?.trim() || path17.basename(dir);
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
@@ -7085,19 +7121,19 @@ async function discoverKotlinService(scanPath, dir) {
     name,
     language: "kotlin",
     dependencies,
-    repoPath: path16.relative(scanPath, dir)
+    repoPath: path17.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/rust.ts
-import { promises as fs15 } from "fs";
-import path17 from "path";
+import { promises as fs16 } from "fs";
+import path18 from "path";
 import { parse as parseToml2 } from "smol-toml";
 import { NodeType as NodeType12, serviceId as serviceId8 } from "@neat.is/types";
 var CARGO_MANIFEST = "Cargo.toml";
 async function hasRustManifest(dir) {
-  return exists(path17.join(dir, CARGO_MANIFEST));
+  return exists(path18.join(dir, CARGO_MANIFEST));
 }
 function parseCargoToml(source) {
   const dependencies = {};
@@ -7122,10 +7158,10 @@ function parseCargoToml(source) {
   return { name, dependencies };
 }
 async function discoverRustService(scanPath, dir) {
-  const cargoPath = path17.join(dir, CARGO_MANIFEST);
+  const cargoPath = path18.join(dir, CARGO_MANIFEST);
   if (!await exists(cargoPath)) return null;
-  const manifest = parseCargoToml(await fs15.readFile(cargoPath, "utf8").catch(() => ""));
-  const name = manifest.name?.trim() || path17.basename(dir);
+  const manifest = parseCargoToml(await fs16.readFile(cargoPath, "utf8").catch(() => ""));
+  const name = manifest.name?.trim() || path18.basename(dir);
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
@@ -7134,18 +7170,18 @@ async function discoverRustService(scanPath, dir) {
     name,
     language: "rust",
     dependencies,
-    repoPath: path17.relative(scanPath, dir)
+    repoPath: path18.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/cpp.ts
-import { promises as fs16 } from "fs";
-import path18 from "path";
+import { promises as fs17 } from "fs";
+import path19 from "path";
 import { NodeType as NodeType13, serviceId as serviceId9 } from "@neat.is/types";
 var CMAKE_MANIFEST = "CMakeLists.txt";
 async function hasCppManifest(dir) {
-  return exists(path18.join(dir, CMAKE_MANIFEST));
+  return exists(path19.join(dir, CMAKE_MANIFEST));
 }
 function parseCMakeProjectName(source) {
   const withoutComments = source.replace(/#.*$/gm, "");
@@ -7153,10 +7189,10 @@ function parseCMakeProjectName(source) {
   return m?.[1];
 }
 async function discoverCppService(scanPath, dir) {
-  const cmakePath = path18.join(dir, CMAKE_MANIFEST);
+  const cmakePath = path19.join(dir, CMAKE_MANIFEST);
   if (!await exists(cmakePath)) return null;
-  const source = await fs16.readFile(cmakePath, "utf8").catch(() => "");
-  const name = parseCMakeProjectName(source)?.trim() || path18.basename(dir);
+  const source = await fs17.readFile(cmakePath, "utf8").catch(() => "");
+  const name = parseCMakeProjectName(source)?.trim() || path19.basename(dir);
   const dependencies = {};
   const pkg = { name, dependencies };
   const node = {
@@ -7165,14 +7201,14 @@ async function discoverCppService(scanPath, dir) {
     name,
     language: "cpp",
     dependencies,
-    repoPath: path18.relative(scanPath, dir)
+    repoPath: path19.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/dockerfile-service.ts
-import { promises as fs17 } from "fs";
-import path19 from "path";
+import { promises as fs18 } from "fs";
+import path20 from "path";
 import { NodeType as NodeType14, serviceId as serviceId10 } from "@neat.is/types";
 function languageForSourceExt(ext) {
   switch (ext) {
@@ -7214,12 +7250,12 @@ function languageForSourceExt(ext) {
 }
 var LANGUAGE_PRECEDENCE = ["typescript", "javascript", "python", "go", "ruby", "php", "csharp", "java", "kotlin", "rust", "cpp"];
 async function inferServiceLanguage(dir) {
-  const entries = await fs17.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs18.readdir(dir, { withFileTypes: true }).catch(() => []);
   const counts = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (isNeatAuthoredSourceFile(entry.name)) continue;
-    const ext = path19.extname(entry.name).toLowerCase();
+    const ext = path20.extname(entry.name).toLowerCase();
     if (!SERVICE_FILE_EXTENSIONS.has(ext)) continue;
     const lang = languageForSourceExt(ext);
     if (!lang) continue;
@@ -7238,7 +7274,7 @@ async function inferServiceLanguage(dir) {
   return best;
 }
 async function hasLanguageManifest(dir) {
-  return await exists(path19.join(dir, "package.json")) || await exists(path19.join(dir, "pyproject.toml")) || await exists(path19.join(dir, "requirements.txt")) || await exists(path19.join(dir, "setup.py")) || await exists(path19.join(dir, "go.mod")) || await exists(path19.join(dir, "Gemfile")) || await exists(path19.join(dir, "composer.json")) || // C#'s marker is a glob (`*.csproj` / `*.sln`), so it reads the directory
+  return await exists(path20.join(dir, "package.json")) || await exists(path20.join(dir, "pyproject.toml")) || await exists(path20.join(dir, "requirements.txt")) || await exists(path20.join(dir, "setup.py")) || await exists(path20.join(dir, "go.mod")) || await exists(path20.join(dir, "Gemfile")) || await exists(path20.join(dir, "composer.json")) || // C#'s marker is a glob (`*.csproj` / `*.sln`), so it reads the directory
   // rather than probing a fixed filename (ADR-196).
   await hasCsharpProject(dir) || // Java (and its JVM sibling Kotlin, ADR-199) key on the same Maven / Gradle
   // build manifest (ADR-197), so this one check stands the Dockerfile fallback
@@ -7248,15 +7284,15 @@ async function hasLanguageManifest(dir) {
   await hasCppManifest(dir);
 }
 async function hasDockerfileDeclaredService(dir) {
-  if (!await exists(path19.join(dir, "Dockerfile"))) return false;
+  if (!await exists(path20.join(dir, "Dockerfile"))) return false;
   return await inferServiceLanguage(dir) !== null;
 }
 async function discoverDockerfileService(scanPath, dir) {
-  if (!await exists(path19.join(dir, "Dockerfile"))) return null;
+  if (!await exists(path20.join(dir, "Dockerfile"))) return null;
   if (await hasLanguageManifest(dir)) return null;
   const language = await inferServiceLanguage(dir);
   if (!language) return null;
-  const name = path19.basename(dir);
+  const name = path20.basename(dir);
   const pkg = { name, dependencies: {} };
   const node = {
     id: serviceId10(name),
@@ -7264,23 +7300,23 @@ async function discoverDockerfileService(scanPath, dir) {
     name,
     language,
     dependencies: {},
-    repoPath: path19.relative(scanPath, dir)
+    repoPath: path20.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/owners.ts
-import { promises as fs18 } from "fs";
-import path20 from "path";
+import { promises as fs19 } from "fs";
+import path21 from "path";
 import { minimatch } from "minimatch";
 async function loadCodeowners(scanPath) {
   const candidates = [
-    path20.join(scanPath, "CODEOWNERS"),
-    path20.join(scanPath, ".github", "CODEOWNERS")
+    path21.join(scanPath, "CODEOWNERS"),
+    path21.join(scanPath, ".github", "CODEOWNERS")
   ];
   for (const file of candidates) {
     if (await exists(file)) {
-      const raw = await fs18.readFile(file, "utf8");
+      const raw = await fs19.readFile(file, "utf8");
       return parseCodeowners(raw);
     }
   }
@@ -7298,7 +7334,7 @@ function parseCodeowners(raw) {
   return { rules };
 }
 function matchOwner(file, repoPath) {
-  const normalized = repoPath.split(path20.sep).join("/");
+  const normalized = repoPath.split(path21.sep).join("/");
   for (const rule of file.rules) {
     if (matchesPattern(rule.pattern, normalized)) return rule.owners;
   }
@@ -7314,7 +7350,7 @@ function matchesPattern(rawPattern, repoPath) {
   return false;
 }
 async function readPackageJsonAuthor(serviceDir) {
-  const pkgPath = path20.join(serviceDir, "package.json");
+  const pkgPath = path21.join(serviceDir, "package.json");
   if (!await exists(pkgPath)) return null;
   try {
     const pkg = await readJson(pkgPath);
@@ -7351,36 +7387,36 @@ function workspaceGlobs(pkg) {
   return null;
 }
 async function hasPythonManifest(dir) {
-  return await exists(path21.join(dir, "pyproject.toml")) || await exists(path21.join(dir, "requirements.txt")) || await exists(path21.join(dir, "setup.py"));
+  return await exists(path22.join(dir, "pyproject.toml")) || await exists(path22.join(dir, "requirements.txt")) || await exists(path22.join(dir, "setup.py"));
 }
 async function hasGoManifest(dir) {
-  return exists(path21.join(dir, "go.mod"));
+  return exists(path22.join(dir, "go.mod"));
 }
 async function hasRubyManifest(dir) {
-  return exists(path21.join(dir, "Gemfile"));
+  return exists(path22.join(dir, "Gemfile"));
 }
 async function hasPhpManifest(dir) {
-  return exists(path21.join(dir, "composer.json"));
+  return exists(path22.join(dir, "composer.json"));
 }
 async function hasCsharpManifest(dir) {
   return hasCsharpProject(dir);
 }
 async function loadGitignore(scanPath) {
-  const gitignorePath = path21.join(scanPath, ".gitignore");
+  const gitignorePath = path22.join(scanPath, ".gitignore");
   if (!await exists(gitignorePath)) return null;
-  const raw = await fs19.readFile(gitignorePath, "utf8");
+  const raw = await fs20.readFile(gitignorePath, "utf8");
   return ignore2().add(raw);
 }
 async function walkDirs(start, scanPath, options, visit) {
   async function recurse(current, depth) {
     if (depth > options.maxDepth) return;
-    const entries = await fs19.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await fs20.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path21.join(current, entry.name);
+      const child = path22.join(current, entry.name);
       if (options.ig) {
-        const rel = path21.relative(scanPath, child).split(path21.sep).join("/");
+        const rel = path22.relative(scanPath, child).split(path22.sep).join("/");
         if (rel && options.ig.ignores(rel + "/")) continue;
       }
       if (await isPythonVenvDir(child)) continue;
@@ -7396,8 +7432,8 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   for (const raw of globs) {
     const pattern = raw.replace(/^\.\//, "");
     if (!pattern.includes("*")) {
-      const candidate = path21.join(scanPath, pattern);
-      if (await exists(path21.join(candidate, "package.json"))) found.add(candidate);
+      const candidate = path22.join(scanPath, pattern);
+      if (await exists(path22.join(candidate, "package.json"))) found.add(candidate);
       continue;
     }
     const segments = pattern.split("/");
@@ -7406,13 +7442,13 @@ async function expandWorkspaceGlobs(scanPath, globs) {
       if (seg.includes("*")) break;
       staticSegments.push(seg);
     }
-    const start = path21.join(scanPath, ...staticSegments);
+    const start = path22.join(scanPath, ...staticSegments);
     if (!await exists(start)) continue;
     const hasDoubleStar = pattern.includes("**");
     const walkDepth = hasDoubleStar ? scanDepth : Math.max(0, segments.length - staticSegments.length - 1);
     await walkDirs(start, scanPath, { maxDepth: walkDepth, ig: null }, async (dir) => {
-      const rel = path21.relative(scanPath, dir).split(path21.sep).join("/");
-      if (minimatch2(rel, pattern) && await exists(path21.join(dir, "package.json"))) {
+      const rel = path22.relative(scanPath, dir).split(path22.sep).join("/");
+      if (minimatch2(rel, pattern) && await exists(path22.join(dir, "package.json"))) {
         found.add(dir);
       }
     });
@@ -7435,18 +7471,18 @@ function detectJsFramework(pkg) {
 async function detectJsServiceLanguage(dir, pkg) {
   const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   if (deps["typescript"] !== void 0) return "typescript";
-  const entries = await fs19.readdir(dir).catch(() => []);
+  const entries = await fs20.readdir(dir).catch(() => []);
   if (entries.some((name) => /^tsconfig(\..+)?\.json$/.test(name))) return "typescript";
   return "javascript";
 }
 async function discoverNodeService(scanPath, dir) {
-  const pkgPath = path21.join(dir, "package.json");
+  const pkgPath = path22.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
   let pkg;
   try {
     pkg = await readJson(pkgPath);
   } catch (err) {
-    recordExtractionError("services", path21.relative(scanPath, pkgPath), err);
+    recordExtractionError("services", path22.relative(scanPath, pkgPath), err);
     return null;
   }
   if (!pkg.name) return null;
@@ -7459,7 +7495,7 @@ async function discoverNodeService(scanPath, dir) {
     language,
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
-    repoPath: path21.relative(scanPath, dir),
+    repoPath: path22.relative(scanPath, dir),
     ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
     ...framework ? { framework } : {}
   };
@@ -7476,12 +7512,12 @@ async function discoverPyService(scanPath, dir) {
     language: "python",
     version: py.version,
     dependencies: py.dependencies,
-    repoPath: path21.relative(scanPath, dir)
+    repoPath: path22.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 async function discoverServices(scanPath) {
-  const rootPkgPath = path21.join(scanPath, "package.json");
+  const rootPkgPath = path22.join(scanPath, "package.json");
   let rootPkg = null;
   if (await exists(rootPkgPath)) {
     try {
@@ -7489,7 +7525,7 @@ async function discoverServices(scanPath) {
     } catch (err) {
       recordExtractionError(
         "services workspaces",
-        path21.relative(scanPath, rootPkgPath),
+        path22.relative(scanPath, rootPkgPath),
         err
       );
     }
@@ -7510,7 +7546,7 @@ async function discoverServices(scanPath) {
       scanPath,
       { maxDepth: parseScanDepth(), ig },
       async (dir) => {
-        if (await exists(path21.join(dir, "package.json"))) {
+        if (await exists(path22.join(dir, "package.json"))) {
           candidateDirs.push(dir);
         } else if (await hasPythonManifest(dir) || await hasGoManifest(dir) || await hasRubyManifest(dir) || await hasPhpManifest(dir) || await hasCsharpManifest(dir) || await hasJavaManifest(dir) || await hasRustManifest(dir) || await hasCppManifest(dir)) {
           candidateDirs.push(dir);
@@ -7538,8 +7574,8 @@ async function discoverServices(scanPath) {
     seenDirs.add(service.dir);
     const existingDir = seen.get(service.node.name);
     if (existingDir !== void 0) {
-      const a = path21.relative(scanPath, existingDir) || ".";
-      const b = path21.relative(scanPath, dir) || ".";
+      const a = path22.relative(scanPath, existingDir) || ".";
+      const b = path22.relative(scanPath, dir) || ".";
       console.warn(
         `[neat] duplicate package name "${service.node.name}" \u2014 keeping ${a}, ignoring ${b}`
       );
@@ -7553,14 +7589,14 @@ async function discoverServices(scanPath) {
     const owner = await computeServiceOwner(codeowners, service.node.repoPath, service.dir);
     if (owner !== void 0) service.node.owner = owner;
   }
-  const resolvedDirs = out.map((s) => path21.resolve(s.dir));
+  const resolvedDirs = out.map((s) => path22.resolve(s.dir));
   for (let i = 0; i < out.length; i++) {
     const self = resolvedDirs[i];
     const nested = [];
     for (let j = 0; j < out.length; j++) {
       if (i === j) continue;
       const other = resolvedDirs[j];
-      if (other.startsWith(self + path21.sep)) nested.push(other);
+      if (other.startsWith(self + path22.sep)) nested.push(other);
     }
     out[i].excludeDirs = nested;
   }
@@ -7586,8 +7622,8 @@ function addServiceNodes(graph, services) {
 }
 
 // src/extract/aliases.ts
-import path22 from "path";
-import { promises as fs20 } from "fs";
+import path23 from "path";
+import { promises as fs21 } from "fs";
 import { parseAllDocuments } from "yaml";
 import { NodeType as NodeType16 } from "@neat.is/types";
 var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
@@ -7614,14 +7650,14 @@ function indexServicesByName(services) {
   const map = /* @__PURE__ */ new Map();
   for (const s of services) {
     map.set(s.node.name, s.node.id);
-    map.set(path22.basename(s.dir), s.node.id);
+    map.set(path23.basename(s.dir), s.node.id);
   }
   return map;
 }
 async function collectComposeAliases(graph, scanPath, serviceIndex) {
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path22.join(scanPath, name);
+    const abs = path23.join(scanPath, name);
     if (await exists(abs)) {
       composePath = abs;
       break;
@@ -7634,7 +7670,7 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
   } catch (err) {
     recordExtractionError(
       "aliases compose",
-      path22.relative(scanPath, composePath),
+      path23.relative(scanPath, composePath),
       err
     );
     return;
@@ -7677,11 +7713,11 @@ function parseDockerfileLabels(content) {
 }
 async function collectDockerfileAliases(graph, services) {
   for (const service of services) {
-    const dockerfilePath = path22.join(service.dir, "Dockerfile");
+    const dockerfilePath = path23.join(service.dir, "Dockerfile");
     if (!await exists(dockerfilePath)) continue;
     let content;
     try {
-      content = await fs20.readFile(dockerfilePath, "utf8");
+      content = await fs21.readFile(dockerfilePath, "utf8");
     } catch (err) {
       recordExtractionError("aliases dockerfile", dockerfilePath, err);
       continue;
@@ -7693,15 +7729,15 @@ async function collectDockerfileAliases(graph, services) {
 async function walkYamlFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await fs20.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await fs21.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path22.join(start, entry.name);
+      const child = path23.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path22.extname(entry.name))) {
-      out.push(path22.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path23.extname(entry.name))) {
+      out.push(path23.join(start, entry.name));
     }
   }
   return out;
@@ -7728,7 +7764,7 @@ function k8sServiceTarget(doc, byName) {
 async function collectK8sAliases(graph, scanPath, serviceIndex) {
   const files = await walkYamlFiles(scanPath);
   for (const file of files) {
-    const content = await fs20.readFile(file, "utf8");
+    const content = await fs21.readFile(file, "utf8");
     let docs;
     try {
       docs = parseAllDocuments(content).map((d) => d.toJSON());
@@ -7752,14 +7788,14 @@ async function addServiceAliases(graph, scanPath, services) {
 }
 
 // src/extract/files.ts
-import path23 from "path";
+import path24 from "path";
 async function addFiles(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
     const filePaths = await walkSourceFiles(service.dir, service.excludeDirs);
     for (const filePath of filePaths) {
-      const relPath = toPosix(path23.relative(service.dir, filePath));
+      const relPath = toPosix(path24.relative(service.dir, filePath));
       const { nodesAdded: n, edgesAdded: e } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -7774,7 +7810,7 @@ async function addFiles(graph, services) {
 }
 
 // src/extract/symbols.ts
-import path24 from "path";
+import path25 from "path";
 import Parser3 from "tree-sitter";
 import JavaScript3 from "tree-sitter-javascript";
 import TypeScript from "tree-sitter-typescript";
@@ -8533,10 +8569,10 @@ async function addSymbols(graph, services) {
   for (const service of services) {
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
-      const ext = path24.extname(file.path);
+      const ext = path25.extname(file.path);
       const parser = parserForExt5(ext);
       if (!parser) continue;
-      const relPath = toPosix(path24.relative(service.dir, file.path));
+      const relPath = toPosix(path25.relative(service.dir, file.path));
       let defs;
       try {
         const tree = parseSource3(parser, file.content);
@@ -8595,7 +8631,7 @@ async function addSymbols(graph, services) {
 }
 
 // src/extract/symbol-edges.ts
-import path25 from "path";
+import path26 from "path";
 import Parser4 from "tree-sitter";
 import {
   EdgeType as EdgeType8,
@@ -8709,10 +8745,10 @@ async function addSymbolEdges(graph, services) {
     const tsPaths = await loadTsPathConfig(service.dir);
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
-      const parser = parserForExt5(path25.extname(file.path));
+      const parser = parserForExt5(path26.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(path25.relative(service.dir, file.path));
-      const fileDir = path25.dirname(file.path);
+      const relPath = toPosix(path26.relative(service.dir, file.path));
+      const fileDir = path26.dirname(file.path);
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -8846,7 +8882,7 @@ async function addSymbolEdges(graph, services) {
 }
 
 // src/extract/actions.ts
-import path26 from "path";
+import path27 from "path";
 import Parser5 from "tree-sitter";
 import {
   EdgeType as EdgeType9,
@@ -9000,9 +9036,9 @@ async function addServerActions(graph, services) {
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt5(path26.extname(file.path));
+      const parser = parserForExt5(path27.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(path26.relative(service.dir, file.path));
+      const relPath = toPosix(path27.relative(service.dir, file.path));
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -9063,10 +9099,10 @@ async function addServerActions(graph, services) {
     }
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt5(path26.extname(file.path));
+      const parser = parserForExt5(path27.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(path26.relative(service.dir, file.path));
-      const fileDir = path26.dirname(file.path);
+      const relPath = toPosix(path27.relative(service.dir, file.path));
+      const fileDir = path27.dirname(file.path);
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -9118,7 +9154,7 @@ async function addServerActions(graph, services) {
 }
 
 // src/extract/databases/index.ts
-import path35 from "path";
+import path36 from "path";
 import {
   EdgeType as EdgeType10,
   NodeType as NodeType20,
@@ -9129,9 +9165,9 @@ import {
 } from "@neat.is/types";
 
 // src/extract/databases/db-config-yaml.ts
-import path27 from "path";
+import path28 from "path";
 async function parse(serviceDir) {
-  const yamlPath = path27.join(serviceDir, "db-config.yaml");
+  const yamlPath = path28.join(serviceDir, "db-config.yaml");
   if (!await exists(yamlPath)) return [];
   const raw = await readYaml(yamlPath);
   return [
@@ -9148,12 +9184,12 @@ async function parse(serviceDir) {
 var dbConfigYamlParser = { name: "db-config.yaml", parse };
 
 // src/extract/databases/dotenv.ts
-import { promises as fs22 } from "fs";
-import path29 from "path";
+import { promises as fs23 } from "fs";
+import path30 from "path";
 
 // src/extract/databases/shared.ts
-import { promises as fs21 } from "fs";
-import path28 from "path";
+import { promises as fs22 } from "fs";
+import path29 from "path";
 function schemeToEngine(scheme) {
   const s = scheme.toLowerCase().split("+")[0];
   switch (s) {
@@ -9192,18 +9228,18 @@ function parseConnectionString(url) {
 }
 async function readIfExists(filePath) {
   try {
-    return await fs21.readFile(filePath, "utf8");
+    return await fs22.readFile(filePath, "utf8");
   } catch {
     return null;
   }
 }
 async function resolveEnvVar(serviceDir, name) {
-  const entries = await fs21.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs22.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
   const envNames = entries.filter((e) => e.isFile() && (e.name === ".env" || e.name.startsWith(".env."))).map((e) => e.name);
   const rank = (n) => n === ".env.local" ? 0 : n === ".env" ? 1 : 2;
   envNames.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
   for (const fileName of envNames) {
-    const content = await readIfExists(path28.join(serviceDir, fileName));
+    const content = await readIfExists(path29.join(serviceDir, fileName));
     if (!content) continue;
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -9222,7 +9258,7 @@ async function resolveEnvVar(serviceDir, name) {
 }
 async function findFirst(serviceDir, candidates) {
   for (const rel of candidates) {
-    const abs = path28.join(serviceDir, rel);
+    const abs = path29.join(serviceDir, rel);
     const content = await readIfExists(abs);
     if (content !== null) return abs;
   }
@@ -9280,15 +9316,15 @@ function parseDotenvLine(line) {
   return { key, value };
 }
 async function parse2(serviceDir) {
-  const entries = await fs22.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs23.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
   const configs = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     const match = isConfigFile(entry.name);
     if (!match.match || match.fileType !== "env") continue;
-    const filePath = path29.join(serviceDir, entry.name);
-    const content = await fs22.readFile(filePath, "utf8");
+    const filePath = path30.join(serviceDir, entry.name);
+    const content = await fs23.readFile(filePath, "utf8");
     for (const line of content.split("\n")) {
       const parsed = parseDotenvLine(line);
       if (!parsed) continue;
@@ -9306,9 +9342,9 @@ async function parse2(serviceDir) {
 var dotenvParser = { name: ".env", parse: parse2 };
 
 // src/extract/databases/prisma.ts
-import path30 from "path";
+import path31 from "path";
 async function parse3(serviceDir) {
-  const schemaPath = path30.join(serviceDir, "prisma", "schema.prisma");
+  const schemaPath = path31.join(serviceDir, "prisma", "schema.prisma");
   const content = await readIfExists(schemaPath);
   if (!content) return [];
   const block = content.match(/datasource\s+\w+\s*\{([^}]*)\}/s);
@@ -9463,10 +9499,10 @@ async function parse5(serviceDir) {
 var knexParser = { name: "knex", parse: parse5 };
 
 // src/extract/databases/ormconfig.ts
-import path31 from "path";
+import path32 from "path";
 async function parse6(serviceDir) {
   for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
-    const abs = path31.join(serviceDir, candidate);
+    const abs = path32.join(serviceDir, candidate);
     if (!await exists(abs)) continue;
     const raw = candidate.endsWith(".json") ? await readJson(abs) : await readYaml(abs);
     const entries = Array.isArray(raw) ? raw : [raw];
@@ -9524,9 +9560,9 @@ async function parse7(serviceDir) {
 var typeormParser = { name: "typeorm", parse: parse7 };
 
 // src/extract/databases/sequelize.ts
-import path32 from "path";
+import path33 from "path";
 async function parse8(serviceDir) {
-  const configPath = path32.join(serviceDir, "config", "config.json");
+  const configPath = path33.join(serviceDir, "config", "config.json");
   if (!await exists(configPath)) return [];
   const raw = await readJson(configPath);
   const out = [];
@@ -9552,8 +9588,8 @@ async function parse8(serviceDir) {
 var sequelizeParser = { name: "sequelize", parse: parse8 };
 
 // src/extract/databases/csharp.ts
-import { promises as fs23 } from "fs";
-import path33 from "path";
+import { promises as fs24 } from "fs";
+import path34 from "path";
 var CS_EXT = ".cs";
 var NPGSQL_GATE = /\bUseNpgsql\b|\bNpgsql\b/;
 var REDIS_GATE = /\bConnectionMultiplexer\b|\bStackExchange\.Redis\b|\bConfigurationOptions\.Parse\b|\bAddStackExchangeRedisCache\b/;
@@ -9600,12 +9636,12 @@ function parseRedisEndpoint(raw) {
   return { host, port, database: "", engine: "redis", engineVersion: "unknown" };
 }
 async function resolveEnvUpTree(startDir, name) {
-  let dir = path33.resolve(startDir);
+  let dir = path34.resolve(startDir);
   for (let depth = 0; depth < 12; depth++) {
     const value = await resolveEnvVar(dir, name);
     if (value !== null) return value;
-    const atRepoRoot = await fs23.access(path33.join(dir, ".git")).then(() => true).catch(() => false);
-    const parent = path33.dirname(dir);
+    const atRepoRoot = await fs24.access(path34.join(dir, ".git")).then(() => true).catch(() => false);
+    const parent = path34.dirname(dir);
     if (atRepoRoot || parent === dir) break;
     dir = parent;
   }
@@ -9660,12 +9696,12 @@ async function resolveConfigs(literals, keys, serviceDir, looksLike, parse11) {
 }
 async function parse9(serviceDir) {
   const files = (await walkSourceFiles(serviceDir).catch(() => [])).filter(
-    (f) => path33.extname(f) === CS_EXT
+    (f) => path34.extname(f) === CS_EXT
   );
   if (files.length === 0) return [];
   const sources = [];
   for (const file of files) {
-    const content = await fs23.readFile(file, "utf8").catch(() => null);
+    const content = await fs24.readFile(file, "utf8").catch(() => null);
     if (content !== null) sources.push({ file, content });
   }
   let pgGateFile = null;
@@ -9705,7 +9741,7 @@ async function parse9(serviceDir) {
 var csharpParser = { name: "csharp", parse: parse9 };
 
 // src/extract/databases/docker-compose.ts
-import path34 from "path";
+import path35 from "path";
 function portFromService(svc) {
   for (const raw of svc.ports ?? []) {
     const str = String(raw);
@@ -9732,7 +9768,7 @@ function databaseFromEnv(svc) {
 }
 async function parse10(serviceDir) {
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path34.join(serviceDir, name);
+    const abs = path35.join(serviceDir, name);
     if (!await exists(abs)) continue;
     const raw = await readYaml(abs);
     if (!raw?.services) return [];
@@ -9905,7 +9941,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
           discoveredVia: mergedDiscoveredVia
         });
       }
-      const relConfigFile = toPosix(path35.relative(service.dir, config.sourceFile));
+      const relConfigFile = toPosix(path36.relative(service.dir, config.sourceFile));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -9914,7 +9950,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       );
       nodesAdded += fn;
       edgesAdded += fe;
-      const evidenceFile = toPosix(path35.relative(scanPath, config.sourceFile));
+      const evidenceFile = toPosix(path36.relative(scanPath, config.sourceFile));
       const edge = {
         id: extractedEdgeId(fileNodeId, dbNode.id, EdgeType10.CONNECTS_TO),
         source: fileNodeId,
@@ -9935,15 +9971,15 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
     if (allConfigs.length === 1) {
       const primary = allConfigs[0];
       service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
-      const relPath = path35.relative(scanPath, primary.sourceFile);
+      const relPath = path36.relative(scanPath, primary.sourceFile);
       const cfgId = configId(relPath);
       if (!graph.hasNode(cfgId)) {
         const cfgNode = {
           id: cfgId,
           type: NodeType20.ConfigNode,
-          name: path35.basename(primary.sourceFile),
+          name: path36.basename(primary.sourceFile),
           path: relPath,
-          fileType: isConfigFile(path35.basename(primary.sourceFile)).fileType || "config"
+          fileType: isConfigFile(path36.basename(primary.sourceFile)).fileType || "config"
         };
         graph.addNode(cfgId, cfgNode);
         nodesAdded++;
@@ -9983,8 +10019,8 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 }
 
 // src/extract/configs.ts
-import { promises as fs24 } from "fs";
-import path36 from "path";
+import { promises as fs25 } from "fs";
+import path37 from "path";
 import {
   EdgeType as EdgeType11,
   NodeType as NodeType21,
@@ -9993,15 +10029,15 @@ import {
   confidenceForExtracted as confidenceForExtracted8
 } from "@neat.is/types";
 async function walkConfigFiles(dir, excludeDirs = []) {
-  const excluded = new Set(excludeDirs.map((d) => path36.resolve(d)));
+  const excluded = new Set(excludeDirs.map((d) => path37.resolve(d)));
   const out = [];
   async function walk11(current) {
-    const entries = await fs24.readdir(current, { withFileTypes: true });
+    const entries = await fs25.readdir(current, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path36.join(current, entry.name);
+      const full = path37.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        if (excluded.has(path36.resolve(full))) continue;
+        if (excluded.has(path37.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk11(full);
       } else if (entry.isFile() && isConfigFile(entry.name).match) {
@@ -10018,19 +10054,19 @@ async function addConfigNodes(graph, services, scanPath) {
   for (const service of services) {
     const configFiles = await walkConfigFiles(service.dir, service.excludeDirs);
     for (const file of configFiles) {
-      const relPath = path36.relative(scanPath, file);
+      const relPath = path37.relative(scanPath, file);
       const node = {
         id: configId2(relPath),
         type: NodeType21.ConfigNode,
-        name: path36.basename(file),
+        name: path37.basename(file),
         path: relPath,
-        fileType: isConfigFile(path36.basename(file)).fileType
+        fileType: isConfigFile(path37.basename(file)).fileType
       };
       if (!graph.hasNode(node.id)) {
         graph.addNode(node.id, node);
         nodesAdded++;
       }
-      const relToService = toPosix(path36.relative(service.dir, file));
+      const relToService = toPosix(path37.relative(service.dir, file));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -10046,7 +10082,7 @@ async function addConfigNodes(graph, services, scanPath) {
         type: EdgeType11.CONFIGURED_BY,
         provenance: Provenance11.EXTRACTED,
         confidence: confidenceForExtracted8("structural"),
-        evidence: { file: relPath.split(path36.sep).join("/") }
+        evidence: { file: relPath.split(path37.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -10058,8 +10094,8 @@ async function addConfigNodes(graph, services, scanPath) {
 }
 
 // src/extract/proto.ts
-import { promises as fs25 } from "fs";
-import path37 from "path";
+import { promises as fs26 } from "fs";
+import path38 from "path";
 import {
   EdgeType as EdgeType12,
   NodeType as NodeType22,
@@ -10093,10 +10129,10 @@ function grpcMethodsFromProto(content, fqPackage) {
     }
     const body = content.slice(bodyStart, i - 1);
     const rpcRe = /\brpc\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/g;
-    let rm;
-    while ((rm = rpcRe.exec(body)) !== null) {
-      const rpcMethod = rm[1];
-      const line = lineAt(content, bodyStart + rm.index);
+    let rm2;
+    while ((rm2 = rpcRe.exec(body)) !== null) {
+      const rpcMethod = rm2[1];
+      const line = lineAt(content, bodyStart + rm2.index);
       out.push({ rpcService, rpcMethod, line });
     }
     serviceRe.lastIndex = i;
@@ -10104,18 +10140,18 @@ function grpcMethodsFromProto(content, fqPackage) {
   return out;
 }
 async function walkProtoFiles(dir, excludeDirs = []) {
-  const excluded = new Set(excludeDirs.map((d) => path37.resolve(d)));
+  const excluded = new Set(excludeDirs.map((d) => path38.resolve(d)));
   const out = [];
   async function walk11(current) {
-    const entries = await fs25.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await fs26.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      const full = path37.join(current, entry.name);
+      const full = path38.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        if (excluded.has(path37.resolve(full))) continue;
+        if (excluded.has(path38.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk11(full);
-      } else if (entry.isFile() && path37.extname(entry.name) === PROTO_EXTENSION) {
+      } else if (entry.isFile() && path38.extname(entry.name) === PROTO_EXTENSION) {
         out.push(full);
       }
     }
@@ -10130,10 +10166,10 @@ async function addGrpcMethods(graph, services) {
     const protoPaths = await walkProtoFiles(service.dir, service.excludeDirs);
     for (const protoPath of protoPaths) {
       if (isTestPath(protoPath)) continue;
-      const relFile = toPosix(path37.relative(service.dir, protoPath));
+      const relFile = toPosix(path38.relative(service.dir, protoPath));
       let content;
       try {
-        content = await fs25.readFile(protoPath, "utf8");
+        content = await fs26.readFile(protoPath, "utf8");
       } catch (err) {
         recordExtractionError("proto extraction", protoPath, err);
         continue;
@@ -10196,7 +10232,7 @@ import {
 } from "@neat.is/types";
 
 // src/extract/calls/http.ts
-import path38 from "path";
+import path39 from "path";
 import Parser6 from "tree-sitter";
 import JavaScript4 from "tree-sitter-javascript";
 import TypeScript2 from "tree-sitter-typescript";
@@ -10284,7 +10320,7 @@ async function addHttpCallEdges(graph, services) {
     const seen = /* @__PURE__ */ new Set();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt(path38.extname(file.path), parserCache);
+      const parser = parserForExt(path39.extname(file.path), parserCache);
       let sites;
       try {
         sites = callsFromSource(file.content, parser, knownHosts);
@@ -10293,7 +10329,7 @@ async function addHttpCallEdges(graph, services) {
         continue;
       }
       if (sites.length === 0) continue;
-      const relFile = toPosix(path38.relative(service.dir, file.path));
+      const relFile = toPosix(path39.relative(service.dir, file.path));
       for (const site of sites) {
         const targetId = hostToNodeId.get(site.host);
         if (!targetId || targetId === service.node.id) continue;
@@ -10346,7 +10382,7 @@ async function addHttpCallEdges(graph, services) {
 }
 
 // src/extract/calls/route-match.ts
-import path39 from "path";
+import path40 from "path";
 import Parser7 from "tree-sitter";
 import JavaScript5 from "tree-sitter-javascript";
 import {
@@ -10631,7 +10667,7 @@ async function addRouteCallEdges(graph, services) {
     const seen = /* @__PURE__ */ new Set();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      if (!JS_CLIENT_EXTENSIONS.has(path39.extname(file.path))) continue;
+      if (!JS_CLIENT_EXTENSIONS.has(path40.extname(file.path))) continue;
       let sites;
       try {
         sites = clientCallSitesFromSource(file.content, jsParser, knownHosts);
@@ -10640,7 +10676,7 @@ async function addRouteCallEdges(graph, services) {
         continue;
       }
       if (sites.length === 0) continue;
-      const relFile = toPosix(path39.relative(service.dir, file.path));
+      const relFile = toPosix(path40.relative(service.dir, file.path));
       for (const site of sites) {
         if (site.host === null) {
           const dedupKey2 = `${relFile}|unresolved-host`;
@@ -10732,7 +10768,7 @@ async function addRouteCallEdges(graph, services) {
 }
 
 // src/extract/calls/kafka.ts
-import path40 from "path";
+import path41 from "path";
 import { infraId as infraId2 } from "@neat.is/types";
 var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
 var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
@@ -10820,13 +10856,13 @@ function kafkaEndpointsFromFile(file, serviceDir) {
       // call sites — verified-call-site tier (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path40.relative(serviceDir, file.path),
+        file: path41.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
     });
   };
-  if (path40.extname(file.path) === ".go") {
+  if (path41.extname(file.path) === ".go") {
     goSaramaEndpoints(file.content, make);
   } else {
     for (const { topic } of findAll(PRODUCER_TOPIC_RE, file.content)) make(topic, "PUBLISHES_TO");
@@ -10836,7 +10872,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/redis.ts
-import path41 from "path";
+import path42 from "path";
 import { infraId as infraId3 } from "@neat.is/types";
 var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
 function redisEndpointsFromFile(file, serviceDir) {
@@ -10859,7 +10895,7 @@ function redisEndpointsFromFile(file, serviceDir) {
       // support tier (ADR-066).
       confidenceKind: "url-with-structural-support",
       evidence: {
-        file: path41.relative(serviceDir, file.path),
+        file: path42.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -10869,7 +10905,7 @@ function redisEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/aws.ts
-import path42 from "path";
+import path43 from "path";
 import { infraId as infraId4 } from "@neat.is/types";
 var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
 var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
@@ -10903,7 +10939,7 @@ function awsEndpointsFromFile(file, serviceDir) {
       // (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path42.relative(serviceDir, file.path),
+        file: path43.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -10927,7 +10963,7 @@ function awsEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/grpc.ts
-import path43 from "path";
+import path44 from "path";
 import { infraId as infraId5 } from "@neat.is/types";
 var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
 var AWS_SDK_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@aws-sdk\/client-([a-z0-9-]+)['"`]/g;
@@ -10986,7 +11022,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path43.relative(serviceDir, file.path),
+        file: path44.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -10996,7 +11032,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/supabase.ts
-import path44 from "path";
+import path45 from "path";
 import { infraId as infraId6 } from "@neat.is/types";
 var SUPABASE_JS_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/supabase-js['"`]/;
 var SUPABASE_SSR_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/ssr['"`]/;
@@ -11055,7 +11091,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066), the same grade aws.ts / grpc.ts emit at.
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path44.relative(serviceDir, file.path),
+        file: path45.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11082,7 +11118,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
         edgeType: "CALLS",
         confidenceKind: "verified-call-site",
         evidence: {
-          file: path44.relative(serviceDir, file.path),
+          file: path45.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -11093,7 +11129,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/firestore.ts
-import path45 from "path";
+import path46 from "path";
 import Parser8 from "tree-sitter";
 import JavaScript6 from "tree-sitter-javascript";
 import { infraId as infraId7 } from "@neat.is/types";
@@ -11266,7 +11302,7 @@ function firestoreEndpointsFromFile(file, serviceDir, imported) {
   if (!hasClient && !hasAdmin && importedNames.size === 0) return [];
   const ownSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
   const fileSdk = !hasClient && !hasAdmin ? imported?.sdk ?? null : ownSdk;
-  const tree = parseSource3(parserForExt2(path45.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt2(path46.extname(file.path)), file.content);
   const clientVars = firestoreClientVars(tree.rootNode);
   for (const n of importedNames) clientVars.add(n);
   const collLine = /* @__PURE__ */ new Map();
@@ -11371,7 +11407,7 @@ function firestoreEndpointsFromFile(file, serviceDir, imported) {
       ...columnSet.size > 0 ? { columns: [...columnSet] } : {},
       ...sdkWrites ? { sdkWrites } : {},
       evidence: {
-        file: path45.relative(serviceDir, file.path),
+        file: path46.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11431,7 +11467,7 @@ function sdkOf(content) {
   return hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
 }
 function parseOrNull(file) {
-  const ext = path45.extname(file.path);
+  const ext = path46.extname(file.path);
   if (!(ext in GRAMMAR_BY_EXT)) return null;
   try {
     return parseSource3(parserForExt2(ext), file.content).rootNode;
@@ -11447,7 +11483,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
     if (!root) continue;
     const names = exportedFirestoreClients(root);
     if (names.size === 0) continue;
-    registry.set(toPosix(path45.relative(serviceDir, f.path)), { names, sdk: sdkOf(f.content) });
+    registry.set(toPosix(path46.relative(serviceDir, f.path)), { names, sdk: sdkOf(f.content) });
   }
   if (registry.size === 0) return [];
   const out = [];
@@ -11460,7 +11496,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
     const names = /* @__PURE__ */ new Set();
     let sdk = null;
     for (const b of bindings) {
-      const rel = await resolveJsImport(b.specifier, path45.dirname(f.path), serviceDir, null);
+      const rel = await resolveJsImport(b.specifier, path46.dirname(f.path), serviceDir, null);
       if (!rel) continue;
       const entry = registry.get(rel);
       if (!entry || !entry.names.has(b.imported)) continue;
@@ -11474,7 +11510,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
 }
 
 // src/extract/calls/mongoose.ts
-import path46 from "path";
+import path47 from "path";
 import { infraId as infraId8 } from "@neat.is/types";
 var MONGOOSE_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongoose['"`]/;
 var MONGODB_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongodb['"`]/;
@@ -11625,7 +11661,7 @@ function endpoint(r, file, serviceDir, matchText) {
     kind: r.kind,
     edgeType: "CALLS",
     confidenceKind: "verified-call-site",
-    evidence: { file: path46.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
+    evidence: { file: path47.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
   };
 }
 function mongooseEndpointsFromFile(file, serviceDir) {
@@ -11715,7 +11751,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
   const registry = /* @__PURE__ */ new Map();
   for (const f of mongooseFiles) {
     const fx = fileExportsOf(f.content, pluralizeOn);
-    if (fx) registry.set(toPosix(path46.relative(serviceDir, f.path)), fx);
+    if (fx) registry.set(toPosix(path47.relative(serviceDir, f.path)), fx);
   }
   if (registry.size === 0) return [];
   const out = [];
@@ -11726,7 +11762,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
     const directColl = /* @__PURE__ */ new Map();
     const nsExports = /* @__PURE__ */ new Map();
     for (const b of bindings) {
-      const resolvedRel = await resolveJsImport(b.specifier, path46.dirname(f.path), serviceDir, null);
+      const resolvedRel = await resolveJsImport(b.specifier, path47.dirname(f.path), serviceDir, null);
       if (!resolvedRel) continue;
       const fx = registry.get(resolvedRel);
       if (!fx) continue;
@@ -11769,7 +11805,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
 }
 
 // src/extract/calls/sqlalchemy.ts
-import path47 from "path";
+import path48 from "path";
 import Parser9 from "tree-sitter";
 import Python5 from "tree-sitter-python";
 import { infraId as infraId9 } from "@neat.is/types";
@@ -11908,7 +11944,7 @@ function sqlalchemyForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: path47.relative(serviceDir, file.path),
+          file: path48.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -11933,7 +11969,7 @@ function sqlalchemyEndpointsFromFile(file, serviceDir) {
       confidenceKind: "verified-call-site",
       ...columns && columns.length > 0 ? { columns } : {},
       evidence: {
-        file: path47.relative(serviceDir, file.path),
+        file: path48.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12040,7 +12076,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
         edgeType: "CALLS",
         confidenceKind: "verified-call-site",
         evidence: {
-          file: path47.relative(serviceDir, file.path),
+          file: path48.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -12051,7 +12087,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
 }
 
 // src/extract/calls/socket.ts
-import path48 from "path";
+import path49 from "path";
 import Parser10 from "tree-sitter";
 import Python6 from "tree-sitter-python";
 import { infraId as infraId10 } from "@neat.is/types";
@@ -12127,7 +12163,7 @@ function socketEndpointsFromFile(file, serviceDir) {
       // A verified `socket.socket(...)` + `.connect((host, port))` call site.
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path48.relative(serviceDir, file.path),
+        file: path49.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12137,7 +12173,7 @@ function socketEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/django-orm.ts
-import path49 from "path";
+import path50 from "path";
 import Parser11 from "tree-sitter";
 import Python7 from "tree-sitter-python";
 import { infraId as infraId11 } from "@neat.is/types";
@@ -12207,7 +12243,7 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
   const tree = parseSource8(makePyParser5(), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const defaultAppLabel = path49.basename(path49.dirname(file.path));
+  const defaultAppLabel = path50.basename(path50.dirname(file.path));
   walk5(tree.rootNode, (node) => {
     if (node.type !== "class_definition") return;
     if (!extendsDjangoModel(node)) return;
@@ -12225,14 +12261,14 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
       kind: "sql-table",
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
-      evidence: { file: path49.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
+      evidence: { file: path50.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
     });
   });
   return out;
 }
 
 // src/extract/calls/drizzle.ts
-import path50 from "path";
+import path51 from "path";
 import Parser12 from "tree-sitter";
 import JavaScript7 from "tree-sitter-javascript";
 import { infraId as infraId12 } from "@neat.is/types";
@@ -12310,7 +12346,7 @@ function columnsFromObject(obj) {
 }
 function drizzleEndpointsFromFile(file, serviceDir) {
   if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt3(path50.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt3(path51.extname(file.path)), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const walk11 = (node) => {
@@ -12333,7 +12369,7 @@ function drizzleEndpointsFromFile(file, serviceDir) {
             confidenceKind: "structural",
             columns,
             evidence: {
-              file: path50.relative(serviceDir, file.path),
+              file: path51.relative(serviceDir, file.path),
               line,
               snippet: snippet(file.content, line)
             }
@@ -12399,7 +12435,7 @@ function referencesTargetVar(call) {
 }
 function drizzleForeignKeys(file, serviceDir) {
   if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt3(path50.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt3(path51.extname(file.path)), file.content);
   const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -12418,7 +12454,7 @@ function drizzleForeignKeys(file, serviceDir) {
               childTable: table.tableName,
               parentTable,
               evidence: {
-                file: path50.relative(serviceDir, file.path),
+                file: path51.relative(serviceDir, file.path),
                 line,
                 snippet: snippet(file.content, line)
               }
@@ -12434,7 +12470,7 @@ function drizzleForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/prisma.ts
-import path51 from "path";
+import path52 from "path";
 import { infraId as infraId13 } from "@neat.is/types";
 var SCALAR_TYPES = /* @__PURE__ */ new Set([
   "Int",
@@ -12490,7 +12526,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
       confidenceKind: "structural",
       columns: b.columns,
       evidence: {
-        file: path51.relative(serviceDir, file.path),
+        file: path52.relative(serviceDir, file.path),
         line: b.startLine,
         snippet: snippet(content, b.startLine)
       }
@@ -12551,7 +12587,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
 }
 async function prismaColumnEndpoints(serviceDir) {
   const schemaPath = await findFirst(serviceDir, [
-    path51.join("prisma", "schema.prisma"),
+    path52.join("prisma", "schema.prisma"),
     "schema.prisma"
   ]);
   if (!schemaPath) return [];
@@ -12626,7 +12662,7 @@ function prismaForeignKeysFromSchema(file, serviceDir) {
               childTable: current.table,
               parentTable,
               evidence: {
-                file: path51.relative(serviceDir, file.path),
+                file: path52.relative(serviceDir, file.path),
                 line: lineNo,
                 snippet: snippet(content, lineNo)
               }
@@ -12641,7 +12677,7 @@ function prismaForeignKeysFromSchema(file, serviceDir) {
 }
 async function prismaForeignKeys(serviceDir) {
   const schemaPath = await findFirst(serviceDir, [
-    path51.join("prisma", "schema.prisma"),
+    path52.join("prisma", "schema.prisma"),
     "schema.prisma"
   ]);
   if (!schemaPath) return [];
@@ -12651,7 +12687,7 @@ async function prismaForeignKeys(serviceDir) {
 }
 
 // src/extract/calls/activerecord.ts
-import path52 from "path";
+import path53 from "path";
 import Parser13 from "tree-sitter";
 import Ruby3 from "tree-sitter-ruby";
 import { infraId as infraId14 } from "@neat.is/types";
@@ -12859,7 +12895,7 @@ function railsSchemaEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...table.columns.length > 0 ? { columns: table.columns } : {},
       evidence: {
-        file: path52.relative(serviceDir, file.path),
+        file: path53.relative(serviceDir, file.path),
         line: table.line,
         snippet: snippet(file.content, table.line)
       }
@@ -12881,7 +12917,7 @@ function railsSchemaForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: path52.relative(serviceDir, file.path),
+        file: path53.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12964,7 +13000,7 @@ function railsModelEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path52.relative(serviceDir, file.path),
+        file: path53.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13001,7 +13037,7 @@ function railsModelForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: path52.relative(serviceDir, file.path),
+          file: path53.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -13012,7 +13048,7 @@ function railsModelForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/eloquent.ts
-import path53 from "path";
+import path54 from "path";
 import Parser14 from "tree-sitter";
 import Php3 from "tree-sitter-php";
 import { infraId as infraId15 } from "@neat.is/types";
@@ -13269,7 +13305,7 @@ function laravelMigrationEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: path53.relative(serviceDir, file.path),
+        file: path54.relative(serviceDir, file.path),
         line: bp.line,
         snippet: snippet(file.content, bp.line)
       }
@@ -13291,7 +13327,7 @@ function laravelMigrationForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: path53.relative(serviceDir, file.path),
+        file: path54.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13411,7 +13447,7 @@ function laravelModelEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path53.relative(serviceDir, file.path),
+        file: path54.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13447,7 +13483,7 @@ function laravelModelForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: path53.relative(serviceDir, file.path),
+          file: path54.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -13458,7 +13494,7 @@ function laravelModelForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/go.ts
-import path54 from "path";
+import path55 from "path";
 import Parser15 from "tree-sitter";
 import Go4 from "tree-sitter-go";
 import { infraId as infraId16 } from "@neat.is/types";
@@ -13532,7 +13568,7 @@ function firstStringLiteralArg(argsNode) {
   return null;
 }
 function goSqlEndpointsFromFile(file, serviceDir) {
-  if (path54.extname(file.path) !== ".go") return [];
+  if (path55.extname(file.path) !== ".go") return [];
   if (!file.content.includes(DATABASE_SQL_IMPORT) && !file.content.includes(SQLX_IMPORT)) return [];
   const tree = parseSource11(makeGoParser3(), file.content);
   const importsDatabaseSql = goImportsAny(tree.rootNode, /* @__PURE__ */ new Set([DATABASE_SQL_IMPORT]));
@@ -13561,7 +13597,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
       confidenceKind: "verified-call-site",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: toPosix(path54.relative(serviceDir, file.path)),
+        file: toPosix(path55.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13571,7 +13607,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/gorm.ts
-import path55 from "path";
+import path56 from "path";
 import Parser16 from "tree-sitter";
 import Go5 from "tree-sitter-go";
 import { infraId as infraId17 } from "@neat.is/types";
@@ -14004,7 +14040,7 @@ function collectColumns(struct, structs, seen, prefix, out, emitted) {
   seen.delete(struct.name);
 }
 function gormEndpointsFromFile(file, serviceDir) {
-  if (path55.extname(file.path) !== ".go") return [];
+  if (path56.extname(file.path) !== ".go") return [];
   if (!GORM_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource12(makeGoParser4(), file.content);
   const { structs, models, tableFor } = analyze(tree);
@@ -14026,7 +14062,7 @@ function gormEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: toPosix(path55.relative(serviceDir, file.path)),
+        file: toPosix(path56.relative(serviceDir, file.path)),
         line: struct.line,
         snippet: snippet(file.content, struct.line)
       }
@@ -14035,7 +14071,7 @@ function gormEndpointsFromFile(file, serviceDir) {
   return out;
 }
 function gormForeignKeys(file, serviceDir) {
-  if (path55.extname(file.path) !== ".go") return [];
+  if (path56.extname(file.path) !== ".go") return [];
   if (!GORM_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource12(makeGoParser4(), file.content);
   const { structs, models, tableFor } = analyze(tree);
@@ -14050,7 +14086,7 @@ function gormForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: toPosix(path55.relative(serviceDir, file.path)),
+        file: toPosix(path56.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -14086,7 +14122,7 @@ function gormForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/efcore.ts
-import path56 from "path";
+import path57 from "path";
 import Parser17 from "tree-sitter";
 import CSharp2 from "tree-sitter-c-sharp";
 import { infraId as infraId18 } from "@neat.is/types";
@@ -14165,7 +14201,7 @@ function tableFromToTable(call) {
   return value ? csStringLiteral(value) : null;
 }
 function efcoreEndpointsFromFile(file, serviceDir) {
-  if (path56.extname(file.path) !== ".cs") return [];
+  if (path57.extname(file.path) !== ".cs") return [];
   if (!EFCORE_GATE.test(file.content)) return [];
   const tree = parseSource13(makeCsParser(), file.content);
   const out = [];
@@ -14180,7 +14216,7 @@ function efcoreEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "structural",
       evidence: {
-        file: toPosix(path56.relative(serviceDir, file.path)),
+        file: toPosix(path57.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -14437,7 +14473,7 @@ function ensureTableNode(graph, id, name) {
 }
 
 // src/extract/infra/docker-compose.ts
-import path57 from "path";
+import path58 from "path";
 import { EdgeType as EdgeType17, Provenance as Provenance18, confidenceForExtracted as confidenceForExtracted15 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
@@ -14507,7 +14543,7 @@ function dependsOnList(value) {
 }
 function serviceNameToServiceNode(name, services) {
   for (const s of services) {
-    if (s.node.name === name || path57.basename(s.dir) === name) return s.node.id;
+    if (s.node.name === name || path58.basename(s.dir) === name) return s.node.id;
   }
   return null;
 }
@@ -14516,7 +14552,7 @@ async function addComposeInfra(graph, scanPath, services) {
   let edgesAdded = 0;
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path57.join(scanPath, name);
+    const abs = path58.join(scanPath, name);
     if (await exists(abs)) {
       composePath = abs;
       break;
@@ -14529,13 +14565,13 @@ async function addComposeInfra(graph, scanPath, services) {
   } catch (err) {
     recordExtractionError(
       "infra docker-compose",
-      path57.relative(scanPath, composePath),
+      path58.relative(scanPath, composePath),
       err
     );
     return { nodesAdded, edgesAdded };
   }
   if (!compose?.services) return { nodesAdded, edgesAdded };
-  const evidenceFile = path57.relative(scanPath, composePath).split(path57.sep).join("/");
+  const evidenceFile = path58.relative(scanPath, composePath).split(path58.sep).join("/");
   const composeNameToNodeId = /* @__PURE__ */ new Map();
   for (const [composeName, svc] of Object.entries(compose.services)) {
     const matchedServiceId = serviceNameToServiceNode(composeName, services);
@@ -14576,8 +14612,8 @@ async function addComposeInfra(graph, scanPath, services) {
 }
 
 // src/extract/infra/dockerfile.ts
-import path58 from "path";
-import { promises as fs26 } from "fs";
+import path59 from "path";
+import { promises as fs27 } from "fs";
 import { EdgeType as EdgeType18, Provenance as Provenance19, confidenceForExtracted as confidenceForExtracted16 } from "@neat.is/types";
 function readDockerfile(content) {
   let image = null;
@@ -14607,15 +14643,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const dockerfilePath = path58.join(service.dir, "Dockerfile");
+    const dockerfilePath = path59.join(service.dir, "Dockerfile");
     if (!await exists(dockerfilePath)) continue;
     let content;
     try {
-      content = await fs26.readFile(dockerfilePath, "utf8");
+      content = await fs27.readFile(dockerfilePath, "utf8");
     } catch (err) {
       recordExtractionError(
         "infra dockerfile",
-        path58.relative(scanPath, dockerfilePath),
+        path59.relative(scanPath, dockerfilePath),
         err
       );
       continue;
@@ -14627,8 +14663,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
-    const relDockerfile = toPosix(path58.relative(service.dir, dockerfilePath));
-    const evidenceFile = toPosix(path58.relative(scanPath, dockerfilePath));
+    const relDockerfile = toPosix(path59.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix(path59.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -14679,23 +14715,23 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 }
 
 // src/extract/infra/terraform.ts
-import { promises as fs27 } from "fs";
-import path59 from "path";
+import { promises as fs28 } from "fs";
+import path60 from "path";
 import { EdgeType as EdgeType19, Provenance as Provenance20, confidenceForExtracted as confidenceForExtracted17 } from "@neat.is/types";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await fs27.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await fs28.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
-      const child = path59.join(start, entry.name);
+      const child = path60.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry.isFile() && entry.name.endsWith(".tf")) {
-      out.push(path59.join(start, entry.name));
+      out.push(path60.join(start, entry.name));
     }
   }
   return out;
@@ -14726,8 +14762,8 @@ async function addTerraformResources(graph, scanPath) {
   let edgesAdded = 0;
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
-    const content = await fs27.readFile(file, "utf8");
-    const evidenceFile = toPosix(path59.relative(scanPath, file));
+    const content = await fs28.readFile(file, "utf8");
+    const evidenceFile = toPosix(path60.relative(scanPath, file));
     const resources = [];
     const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
@@ -14783,8 +14819,8 @@ async function addTerraformResources(graph, scanPath) {
 }
 
 // src/extract/infra/k8s.ts
-import { promises as fs28 } from "fs";
-import path60 from "path";
+import { promises as fs29 } from "fs";
+import path61 from "path";
 import { parseAllDocuments as parseAllDocuments2 } from "yaml";
 import { EdgeType as EdgeType20, serviceId as serviceId13 } from "@neat.is/types";
 var K8S_KIND_TO_INFRA_KIND = {
@@ -14800,15 +14836,15 @@ var WORKLOAD_KINDS = /* @__PURE__ */ new Set(["Deployment", "StatefulSet", "Daem
 async function walkYamlFiles2(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await fs28.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await fs29.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path60.join(start, entry.name);
+      const child = path61.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles2(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path60.extname(entry.name))) {
-      out.push(path60.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path61.extname(entry.name))) {
+      out.push(path61.join(start, entry.name));
     }
   }
   return out;
@@ -14818,14 +14854,14 @@ async function addK8sResources(graph, scanPath) {
   let edgesAdded = 0;
   const files = await walkYamlFiles2(scanPath);
   for (const file of files) {
-    const content = await fs28.readFile(file, "utf8");
+    const content = await fs29.readFile(file, "utf8");
     let docs;
     try {
       docs = parseAllDocuments2(content).map((d) => d.toJSON());
     } catch {
       continue;
     }
-    const relFile = toPosix(path60.relative(scanPath, file));
+    const relFile = toPosix(path61.relative(scanPath, file));
     for (const doc of docs) {
       if (!doc?.kind || !doc.metadata?.name) continue;
       const infraKind = K8S_KIND_TO_INFRA_KIND[doc.kind];
@@ -14873,16 +14909,16 @@ async function addK8sResources(graph, scanPath) {
 }
 
 // src/extract/infra/cloudflare.ts
-import { promises as fs29 } from "fs";
-import path61 from "path";
+import { promises as fs30 } from "fs";
+import path62 from "path";
 import { parse as parseToml3 } from "smol-toml";
 import { EdgeType as EdgeType21, Provenance as Provenance21, confidenceForExtracted as confidenceForExtracted18 } from "@neat.is/types";
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
-    const abs = path61.join(dir, filename);
+    const abs = path62.join(dir, filename);
     if (!await exists(abs)) continue;
-    const raw = await fs29.readFile(abs, "utf8");
+    const raw = await fs30.readFile(abs, "utf8");
     const config = filename === "wrangler.toml" ? parseToml3(raw) : JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
@@ -14943,11 +14979,11 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     try {
       read = await readWranglerConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra cloudflare", path61.relative(scanPath, service.dir), err);
+      recordExtractionError("infra cloudflare", path62.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read || !read.config.name) continue;
-    const evidenceFile = toPosix(path61.relative(scanPath, path61.join(service.dir, read.relFile)));
+    const evidenceFile = toPosix(path62.relative(scanPath, path62.join(service.dir, read.relFile)));
     discovered.push({ service, config: read.config, relFile: read.relFile, raw: read.raw, evidenceFile });
   }
   for (const worker of discovered) {
@@ -14959,7 +14995,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     }
     let anchorId = service.node.id;
     if (config.main) {
-      const entryRelPath = toPosix(path61.normalize(config.main));
+      const entryRelPath = toPosix(path62.normalize(config.main));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -15105,24 +15141,24 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 }
 
 // src/extract/infra/vercel.ts
-import { promises as fs30 } from "fs";
-import path62 from "path";
+import { promises as fs31 } from "fs";
+import path63 from "path";
 import { EdgeType as EdgeType22 } from "@neat.is/types";
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
-    const abs = path62.join(dir, filename);
+    const abs = path63.join(dir, filename);
     if (!await exists(abs)) continue;
-    const raw = await fs30.readFile(abs, "utf8");
+    const raw = await fs31.readFile(abs, "utf8");
     const config = JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
   return null;
 }
 async function readLinkedProjectName(dir) {
-  const abs = path62.join(dir, ".vercel", "project.json");
+  const abs = path63.join(dir, ".vercel", "project.json");
   if (!await exists(abs)) return void 0;
-  const parsed = JSON.parse(await fs30.readFile(abs, "utf8"));
+  const parsed = JSON.parse(await fs31.readFile(abs, "utf8"));
   return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
 }
 function routeSource(route) {
@@ -15138,7 +15174,7 @@ async function addVercelServices(graph, services, scanPath) {
       read = await readVercelConfig(service.dir);
       projectName = await readLinkedProjectName(service.dir);
     } catch (err) {
-      recordExtractionError("infra vercel", path62.relative(scanPath, service.dir), err);
+      recordExtractionError("infra vercel", path63.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read && !projectName) continue;
@@ -15154,7 +15190,7 @@ async function addVercelServices(graph, services, scanPath) {
     const anchorId = service.node.id;
     if (!read) continue;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix(path62.relative(scanPath, path62.join(service.dir, relFile)));
+    const evidenceFile = toPosix(path63.relative(scanPath, path63.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -15182,16 +15218,16 @@ async function addVercelServices(graph, services, scanPath) {
 }
 
 // src/extract/infra/railway.ts
-import { promises as fs31 } from "fs";
-import path63 from "path";
+import { promises as fs32 } from "fs";
+import path64 from "path";
 import { parse as parseToml4 } from "smol-toml";
 import { EdgeType as EdgeType23 } from "@neat.is/types";
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
-    const abs = path63.join(dir, filename);
+    const abs = path64.join(dir, filename);
     if (!await exists(abs)) continue;
-    const raw = await fs31.readFile(abs, "utf8");
+    const raw = await fs32.readFile(abs, "utf8");
     const config = filename === "railway.toml" ? parseToml4(raw) : JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
@@ -15205,7 +15241,7 @@ async function addRailwayServices(graph, services, scanPath) {
     try {
       read = await readRailwayConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra railway", path63.relative(scanPath, service.dir), err);
+      recordExtractionError("infra railway", path64.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -15215,7 +15251,7 @@ async function addRailwayServices(graph, services, scanPath) {
     }
     const anchorId = service.node.id;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix(path63.relative(scanPath, path63.join(service.dir, relFile)));
+    const evidenceFile = toPosix(path64.relative(scanPath, path64.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -15239,15 +15275,15 @@ async function addRailwayServices(graph, services, scanPath) {
 }
 
 // src/extract/infra/supabase.ts
-import { promises as fs32 } from "fs";
-import path64 from "path";
+import { promises as fs33 } from "fs";
+import path65 from "path";
 import { parse as parseToml5 } from "smol-toml";
 import { EdgeType as EdgeType24 } from "@neat.is/types";
 async function readSupabaseConfig(dir) {
-  const relFile = path64.join("supabase", "config.toml");
-  const abs = path64.join(dir, relFile);
+  const relFile = path65.join("supabase", "config.toml");
+  const abs = path65.join(dir, relFile);
   if (!await exists(abs)) return null;
-  const raw = await fs32.readFile(abs, "utf8");
+  const raw = await fs33.readFile(abs, "utf8");
   const config = parseToml5(raw);
   return { config, relFile, raw };
 }
@@ -15259,7 +15295,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
     try {
       read = await readSupabaseConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra supabase", path64.relative(scanPath, service.dir), err);
+      recordExtractionError("infra supabase", path65.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -15274,7 +15310,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
       });
     }
     const anchorId = service.node.id;
-    const evidenceFile = toPosix(path64.relative(scanPath, path64.join(service.dir, relFile)));
+    const evidenceFile = toPosix(path65.relative(scanPath, path65.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -15315,7 +15351,7 @@ async function addInfra(graph, scanPath, services) {
 }
 
 // src/extract/zod-shapes.ts
-import path65 from "path";
+import path66 from "path";
 import Parser18 from "tree-sitter";
 import JavaScript8 from "tree-sitter-javascript";
 import {
@@ -15417,7 +15453,7 @@ function topLevelSchemas(root) {
 }
 function zodShapesFromFile(file, serviceDir) {
   if (!ZOD_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt4(path65.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt4(path66.extname(file.path)), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   for (const { name, call } of topLevelSchemas(tree.rootNode)) {
@@ -15435,7 +15471,7 @@ function zodShapesFromFile(file, serviceDir) {
       name,
       fields,
       evidence: {
-        file: path65.relative(serviceDir, file.path),
+        file: path66.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -15702,11 +15738,11 @@ async function addFirestoreRules(graph, services) {
 }
 
 // src/extract/index.ts
-import path67 from "path";
+import path68 from "path";
 
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
-import path66 from "path";
+import path67 from "path";
 import { NodeType as NodeType29, Provenance as Provenance23 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph, source) {
   const orphans = [];
@@ -15753,11 +15789,11 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], so
     if (outOfScope(graph, edge, source)) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (path66.isAbsolute(evidenceFile)) {
+    if (path67.isAbsolute(evidenceFile)) {
       if (!existsSync2(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => existsSync2(path66.join(base, evidenceFile)));
+    const found = bases.some((base) => existsSync2(path67.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -15766,7 +15802,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], so
 }
 
 // src/extract/index.ts
-async function extractFromDirectory(graph, scanPath, opts = {}) {
+var passQueue = Promise.resolve();
+function extractFromDirectory(graph, scanPath, opts = {}) {
+  const pass = passQueue.then(() => runExtractionPass(graph, scanPath, opts));
+  passQueue = pass.catch(() => {
+  });
+  return pass;
+}
+async function runExtractionPass(graph, scanPath, opts) {
   await ensureCompatLoaded();
   drainExtractionErrors();
   drainSkippedFiles();
@@ -15818,7 +15861,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const droppedEntries = drainDroppedExtracted();
   const skippedEntries = drainSkippedFiles();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = path67.join(path67.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = path68.join(path68.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -15840,7 +15883,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
     skippedFiles: skippedEntries.length,
     skippedEntries
   };
-  emitNeatEvent({
+  if (opts.announce !== false) emitNeatEvent({
     type: "extraction-complete",
     project: opts.project ?? DEFAULT_PROJECT,
     payload: {
@@ -16540,8 +16583,8 @@ function computeDivergences(graph, opts = {}) {
 }
 
 // src/persist.ts
-import { promises as fs33 } from "fs";
-import path68 from "path";
+import { promises as fs34 } from "fs";
+import path69 from "path";
 import { NodeType as NodeType31, Provenance as Provenance25, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 7;
 function migrateV1ToV2(payload) {
@@ -16596,7 +16639,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await fs33.mkdir(path68.dirname(filePath), { recursive: true });
+  await fs34.mkdir(path69.dirname(filePath), { recursive: true });
 }
 var WRITE_FLUSH_CHARS = 4 * 1024 * 1024;
 function jsonOrUndefined(value) {
@@ -16642,7 +16685,7 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  const handle = await fs33.open(tmp, "w");
+  const handle = await fs34.open(tmp, "w");
   try {
     let buffered = "";
     for (const chunk of serializeGraphChunks(payload)) {
@@ -16656,7 +16699,7 @@ async function saveGraphToDisk(graph, outPath) {
   } finally {
     await handle.close();
   }
-  await fs33.rename(tmp, outPath);
+  await fs34.rename(tmp, outPath);
 }
 function migrateSnapshot(input) {
   let payload = input;
@@ -16688,7 +16731,7 @@ function migrateSnapshot(input) {
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await fs33.readFile(outPath, "utf8");
+    raw = await fs34.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -16738,7 +16781,7 @@ function startPersistLoop(graph, outPath, opts = {}) {
 }
 
 // src/diff.ts
-import { promises as fs34 } from "fs";
+import { promises as fs35 } from "fs";
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -16747,7 +16790,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await fs34.readFile(target, "utf8");
+  const raw = await fs35.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -16814,23 +16857,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path69 from "path";
+import path70 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path69.join(baseDir, "graph.json"),
-      errorsPath: path69.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path69.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path69.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path69.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path70.join(baseDir, "graph.json"),
+      errorsPath: path70.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path70.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path70.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path70.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path69.join(baseDir, `${project}.json`),
-    errorsPath: path69.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path69.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path69.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path69.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path70.join(baseDir, `${project}.json`),
+    errorsPath: path70.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path70.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path70.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path70.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -16869,9 +16912,9 @@ function parseExtraProjects(raw) {
 }
 
 // src/registry.ts
-import { promises as fs35 } from "fs";
+import { promises as fs36 } from "fs";
 import os2 from "os";
-import path70 from "path";
+import path71 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -16879,20 +16922,20 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path70.resolve(override);
-  return path70.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path71.resolve(override);
+  return path71.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path70.join(neatHome(), "projects.json");
+  return path71.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path70.join(neatHome(), "projects.json.lock");
+  return path71.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return path70.join(neatHome(), "neatd.pid");
+  return path71.join(neatHome(), "neatd.pid");
 }
 function daemonsDir() {
-  return path70.join(neatHome(), "daemons");
+  return path71.join(neatHome(), "daemons");
 }
 function isFiniteInt(v) {
   return typeof v === "number" && Number.isFinite(v);
@@ -16925,7 +16968,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const dir = daemonsDir();
   let names;
   try {
-    names = await fs35.readdir(dir);
+    names = await fs36.readdir(dir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -16933,10 +16976,10 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const out = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const file = path70.join(dir, name);
+    const file = path71.join(dir, name);
     let raw;
     try {
-      raw = await fs35.readFile(file, "utf8");
+      raw = await fs36.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -16949,7 +16992,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   return out;
 }
 async function removeDaemonRecord(source) {
-  await fs35.unlink(source).catch(() => {
+  await fs36.unlink(source).catch(() => {
   });
 }
 async function listMachineProjects(probe = defaultDiscoveryProbe) {
@@ -17006,7 +17049,7 @@ function isPidAliveDefault(pid) {
 }
 async function readPidFile(file) {
   try {
-    const raw = await fs35.readFile(file, "utf8");
+    const raw = await fs36.readFile(file, "utf8");
     const pid = Number.parseInt(raw.trim(), 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
   } catch {
@@ -17052,32 +17095,32 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function normalizeProjectPath(input) {
-  const resolved = path70.resolve(input);
+  const resolved = path71.resolve(input);
   try {
-    return await fs35.realpath(resolved);
+    return await fs36.realpath(resolved);
   } catch {
     return resolved;
   }
 }
 async function writeAtomically(target, contents) {
-  await fs35.mkdir(path70.dirname(target), { recursive: true });
+  await fs36.mkdir(path71.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs35.open(tmp, "w");
+  const fd = await fs36.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await fs35.rename(tmp, target);
+  await fs36.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await fs35.mkdir(path70.dirname(lockPath), { recursive: true });
+  await fs36.mkdir(path71.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
-      const fd = await fs35.open(lockPath, "wx");
+      const fd = await fs36.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -17095,7 +17138,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaul
           throw new RegistryLockError(lockHolderMessage(holder, lockPath, timeoutMs));
         }
         if (holder.kind === "stale" && await isReclaimableLock(lockPath)) {
-          await fs35.unlink(lockPath).catch(() => {
+          await fs36.unlink(lockPath).catch(() => {
           });
           continue;
         }
@@ -17113,14 +17156,14 @@ async function isReclaimableLock(lockPath) {
   const pid = await readLockPid(lockPath);
   if (pid !== void 0) return true;
   try {
-    const stat = await fs35.stat(lockPath);
+    const stat = await fs36.stat(lockPath);
     return Date.now() - stat.mtimeMs > LOCK_UNSTAMPED_GRACE_MS;
   } catch {
     return false;
   }
 }
 async function releaseLock(lockPath) {
-  await fs35.unlink(lockPath).catch(() => {
+  await fs36.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -17136,7 +17179,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await fs35.readFile(file, "utf8");
+    raw = await fs36.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -17211,7 +17254,7 @@ async function findProjectByPath(dir) {
   const { projects } = await readRegistry();
   let best;
   for (const entry of projects) {
-    const inside = here === entry.path || here.startsWith(entry.path + path70.sep);
+    const inside = here === entry.path || here.startsWith(entry.path + path71.sep);
     if (inside && (!best || entry.path.length > best.path.length)) best = entry;
   }
   return best;
@@ -17263,7 +17306,7 @@ function pruneTtlMs() {
 }
 async function statPathStatus(p) {
   try {
-    const stat = await fs35.stat(p);
+    const stat = await fs36.stat(p);
     return stat.isDirectory() ? "present" : "unknown";
   } catch (err) {
     return err.code === "ENOENT" ? "gone" : "unknown";
@@ -17304,18 +17347,19 @@ async function pruneRegistry(opts = {}) {
 
 // src/api.ts
 import Fastify from "fastify";
+import { timingSafeEqual } from "crypto";
 import cors from "@fastify/cors";
 import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
 
 // src/extend/index.ts
-import { promises as fs37 } from "fs";
-import path72 from "path";
+import { promises as fs38 } from "fs";
+import path73 from "path";
 import os3 from "os";
 import { resolve as registryResolve, list as registryList } from "@neat.is/instrumentation-registry";
 
 // src/installers/package-manager.ts
-import { promises as fs36 } from "fs";
-import path71 from "path";
+import { promises as fs37 } from "fs";
+import path72 from "path";
 import { spawn } from "child_process";
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -17330,29 +17374,29 @@ var LOCKFILE_PRIORITY = [
 var NPM_FALLBACK_ARGS = ["install", "--no-audit", "--no-fund", "--prefer-offline"];
 async function exists2(p) {
   try {
-    await fs36.access(p);
+    await fs37.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = path71.resolve(serviceDir);
+  let dir = path72.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path71.join(dir, candidate.lockfile);
+      const lockPath = path72.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = path71.dirname(dir);
+    const parent = path72.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: path71.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: path72.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -17394,15 +17438,15 @@ ${err.message}`
 // src/extend/index.ts
 async function fileExists2(p) {
   try {
-    await fs37.access(p);
+    await fs38.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = path72.join(scanPath, "package.json");
-  const raw = await fs37.readFile(pkgPath, "utf8");
+  const pkgPath = path73.join(scanPath, "package.json");
+  const raw = await fs38.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
 var HOOK_WALK_SKIP_DIRS = /* @__PURE__ */ new Set([
@@ -17416,15 +17460,15 @@ var HOOK_WALK_SKIP_DIRS = /* @__PURE__ */ new Set([
 async function findHookFiles(scanPath) {
   const found = [];
   const walk11 = async (dir) => {
-    const entries = await fs37.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fs38.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (entry.name.startsWith(".") || HOOK_WALK_SKIP_DIRS.has(entry.name)) continue;
-        await walk11(path72.join(dir, entry.name));
+        await walk11(path73.join(dir, entry.name));
       } else if (entry.isFile()) {
         if ((entry.name.startsWith("instrumentation") || entry.name.startsWith("otel-init")) && /\.(ts|js|cjs|mjs)$/.test(entry.name)) {
-          const rel = path72.relative(scanPath, path72.join(dir, entry.name));
-          found.push(rel.split(path72.sep).join("/"));
+          const rel = path73.relative(scanPath, path73.join(dir, entry.name));
+          found.push(rel.split(path73.sep).join("/"));
         }
       }
     }
@@ -17435,7 +17479,7 @@ async function findHookFiles(scanPath) {
 async function pickPrimaryHookFile(scanPath, hookFiles, snippet2) {
   let fallback = null;
   for (const file of hookFiles) {
-    const content = await fs37.readFile(path72.join(scanPath, file), "utf8");
+    const content = await fs38.readFile(path73.join(scanPath, file), "utf8");
     const patched = splicedContent(content, snippet2);
     if (patched !== null) return { file, content, patched };
     if (fallback === null) fallback = { file, content };
@@ -17443,12 +17487,12 @@ async function pickPrimaryHookFile(scanPath, hookFiles, snippet2) {
   return { file: fallback.file, content: fallback.content, patched: null };
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? path72.join(os3.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? path73.join(os3.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry) {
   const logPath = extendLogPath();
-  await fs37.mkdir(path72.dirname(logPath), { recursive: true });
-  await fs37.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
+  await fs38.mkdir(path73.dirname(logPath), { recursive: true });
+  await fs38.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
   if (fileContent.includes("__INSTRUMENTATION_BLOCK__")) {
@@ -17506,7 +17550,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(path72.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(path73.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     registryList().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -17528,7 +17572,7 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await fs37.readFile(path72.join(ctx.scanPath, file), "utf8");
+    const content = await fs38.readFile(path73.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
@@ -17540,18 +17584,18 @@ async function applyExtension(ctx, args, options) {
     );
   }
   const primaryFile = primary.file;
-  const primaryPath = path72.join(ctx.scanPath, primaryFile);
+  const primaryPath = path73.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = path72.join(ctx.scanPath, "package.json");
+  const pkgPath = path73.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
-    await fs37.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    await fs38.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     filesTouched.push("package.json");
     depsAdded.push(`${args.instrumentation_package}@${args.version}`);
   }
-  await fs37.writeFile(primaryPath, primary.patched, "utf8");
+  await fs38.writeFile(primaryPath, primary.patched, "utf8");
   filesTouched.push(primaryFile);
   const cmd = await detectPackageManager(ctx.scanPath);
   const installer = options?.runInstall ?? runPackageManagerInstall;
@@ -17582,7 +17626,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await fs37.readFile(path72.join(ctx.scanPath, file), "utf8");
+    const content = await fs38.readFile(path73.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -17617,28 +17661,28 @@ async function rollbackExtension(ctx, args) {
   if (!await fileExists2(logPath)) {
     return { undone: false, message: "no apply found for library" };
   }
-  const raw = await fs37.readFile(logPath, "utf8");
+  const raw = await fs38.readFile(logPath, "utf8");
   const entries = raw.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line));
   const match = [...entries].reverse().find((e) => e.project === ctx.project && e.library === args.library);
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = path72.join(ctx.scanPath, "package.json");
+  const pkgPath = path73.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
       const { [match.instrumentation_package]: _removed, ...rest } = pkg.dependencies;
       pkg.dependencies = rest;
-      await fs37.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+      await fs38.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     }
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = path72.join(ctx.scanPath, file);
-    const content = await fs37.readFile(filePath, "utf8");
+    const filePath = path73.join(ctx.scanPath, file);
+    const content = await fs38.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
-      await fs37.writeFile(filePath, filtered, "utf8");
+      await fs38.writeFile(filePath, filtered, "utf8");
       break;
     }
   }
@@ -18598,8 +18642,64 @@ async function askGraph(graph, question, opts = {}) {
 }
 
 // src/streaming.ts
+import { readFileSync as readFileSync2, statSync } from "fs";
+import { z } from "zod";
+import { ErrorEventSchema, IncidentEventPayloadSchema, incidentKindOf as incidentKindOf3 } from "@neat.is/types";
 var SSE_HEARTBEAT_MS = 3e4;
 var SSE_BACKPRESSURE_CAP = 1e3;
+var INCIDENT_TRIGGER_STREAM_SCOPE = "incident-only-v1";
+var IncidentTriggerSchema = IncidentEventPayloadSchema.extend({
+  incidentId: z.string().regex(/^[A-Za-z0-9:_-]{1,100}$/),
+  affectedNode: z.string().min(1).max(512),
+  service: z.string().min(1).max(256),
+  at: z.string().datetime()
+});
+var MAX_REPLAY_BYTES = 16 * 1024 * 1024;
+var MAX_REPLAY_EVENTS = 1e4;
+function isExtractionFailure(row) {
+  const keys = Object.keys(row);
+  return keys.every((key) => ["source", "producer", "file", "error", "stack", "ts"].includes(key)) && typeof row.producer === "string" && typeof row.file === "string" && typeof row.error === "string" && typeof row.ts === "string" && (row.stack === void 0 || typeof row.stack === "string") && !Number.isNaN(Date.parse(row.ts));
+}
+function loadIncidentReplay(errorsPath, cursor) {
+  if (cursor !== void 0 && !/^[A-Za-z0-9:_-]{1,100}$/.test(cursor)) throw new Error("incident replay unavailable");
+  try {
+    if (statSync(errorsPath).size > MAX_REPLAY_BYTES) throw new Error("incident replay unavailable");
+    const raw = readFileSync2(errorsPath, "utf8");
+    if (raw && !raw.endsWith("\n")) throw new Error("incident replay unavailable");
+    const seen = /* @__PURE__ */ new Map();
+    const events = [];
+    for (const line of raw.split("\n")) {
+      if (!line) continue;
+      if (events.length >= MAX_REPLAY_EVENTS) throw new Error("incident replay unavailable");
+      const row = JSON.parse(line);
+      if (row !== null && typeof row === "object" && !Array.isArray(row) && "source" in row && row.source === "extract") {
+        if (!isExtractionFailure(row)) throw new Error("incident replay unavailable");
+        continue;
+      }
+      const event = ErrorEventSchema.parse(row);
+      const trigger = IncidentTriggerSchema.parse({
+        incidentId: event.id,
+        affectedNode: event.affectedNode,
+        service: event.service,
+        incidentKind: incidentKindOf3(event),
+        at: event.timestamp
+      });
+      const prior = seen.get(trigger.incidentId), encoded = JSON.stringify(trigger);
+      if (prior !== void 0) {
+        if (prior !== encoded) throw new Error("incident replay unavailable");
+        continue;
+      }
+      seen.set(trigger.incidentId, encoded);
+      events.push(trigger);
+    }
+    if (cursor === void 0) return events;
+    const at = events.findIndex((event) => event.incidentId === cursor);
+    if (at < 0) throw new Error("incident replay unavailable");
+    return events.slice(at + 1);
+  } catch {
+    throw new Error("incident replay unavailable");
+  }
+}
 function handleSse(req, reply, opts) {
   const heartbeatMs = opts.heartbeatMs ?? SSE_HEARTBEAT_MS;
   const backpressureCap = opts.backpressureCap ?? SSE_BACKPRESSURE_CAP;
@@ -18607,8 +18707,20 @@ function handleSse(req, reply, opts) {
   reply.raw.setHeader("Cache-Control", "no-cache, no-transform");
   reply.raw.setHeader("Connection", "keep-alive");
   reply.raw.setHeader("X-Accel-Buffering", "no");
+  if (opts.incidentOnly) {
+    reply.raw.setHeader("X-NEAT-Event-Scope", INCIDENT_TRIGGER_STREAM_SCOPE);
+    reply.raw.setHeader("X-NEAT-Project", opts.project);
+    if (opts.incidentReplay) reply.raw.setHeader("X-NEAT-Replay-Complete", "1");
+  }
   reply.raw.flushHeaders?.();
   reply.raw.write(":open\n\n");
+  for (const trigger of opts.incidentReplay ?? []) {
+    reply.raw.write(`id: ${trigger.incidentId}
+event: incident
+data: ${JSON.stringify(trigger)}
+
+`);
+  }
   let pending = 0;
   let dropped = false;
   const closeConnection = () => {
@@ -18636,6 +18748,17 @@ data: ${JSON.stringify({ reason: "backpressure" })}
   };
   const listener = (envelope) => {
     if (envelope.project !== opts.project) return;
+    if (opts.incidentOnly) {
+      if (envelope.type !== "incident") return;
+      const trigger = IncidentTriggerSchema.safeParse(envelope.payload);
+      if (!trigger.success) return;
+      writeFrame(`id: ${trigger.data.incidentId}
+event: incident
+data: ${JSON.stringify(trigger.data)}
+
+`);
+      return;
+    }
     writeFrame(`event: ${envelope.type}
 data: ${JSON.stringify(envelope.payload)}
 
@@ -18652,10 +18775,671 @@ data: ${JSON.stringify(envelope.payload)}
   reply.raw.on("error", closeConnection);
 }
 
-// src/connectors-config.ts
+// src/pr-verdict.ts
+import { createHash } from "crypto";
+import { promises as fs39 } from "fs";
+import os5 from "os";
+import path75 from "path";
+
+// ../action/src/graph.mjs
+import { readFileSync as readFileSync3 } from "fs";
+var MARKER = "<!-- neat-action:graph-impact -->";
+var shortId = (id) => String(id).split(":").slice(-1)[0];
+var fence = (s) => "`" + s + "`";
+function graphFromExport(raw) {
+  const g = raw.graph ?? raw;
+  const nodes = new Map((g.nodes ?? []).map((n) => [n.key, n.attributes ?? {}]));
+  const edges = (g.edges ?? []).map((e) => ({
+    key: e.key,
+    source: e.source,
+    target: e.target,
+    ...e.attributes ?? {}
+  }));
+  return { nodes, edges };
+}
+var namesByType = (entries, type) => entries.filter(([, a]) => a.type === type).map(([k, a]) => a.name ?? shortId(k));
+function diffGraphs(base, head) {
+  const added = [...head.nodes].filter(([k]) => !base.nodes.has(k));
+  const removed = [...base.nodes].filter(([k]) => !head.nodes.has(k));
+  return {
+    routesAdded: namesByType(added, "RouteNode"),
+    routesRemoved: namesByType(removed, "RouteNode"),
+    tablesAdded: namesByType(added, "InfraNode"),
+    tablesRemoved: namesByType(removed, "InfraNode")
+  };
+}
+function changedFileNodeIds(graph, changedPaths) {
+  const ids = [];
+  for (const [key, attrs] of graph.nodes) {
+    if (attrs.type !== "FileNode" || !attrs.path) continue;
+    if (changedPaths.some((c) => c === attrs.path || c.endsWith("/" + attrs.path))) ids.push(key);
+  }
+  return ids;
+}
+function changedNodeIds(base, head) {
+  if (!base) return [...head.nodes.keys()];
+  return [
+    ...[...head.nodes.keys()].filter((k) => !base.nodes.has(k)),
+    ...[...base.nodes.keys()].filter((k) => !head.nodes.has(k))
+  ];
+}
+function formatDivergences(data, changedIds) {
+  const findings = Array.isArray(data) ? data : data?.divergences ?? data?.findings ?? data?.items ?? [];
+  const changed = new Set(changedIds);
+  return findings.filter((f) => changed.has(f.source) || changed.has(f.target) || changed.has(f.nodeId)).slice(0, 10).map((f) => {
+    const kind = f.kind || f.type || "divergence";
+    const s = shortId(f.source ?? f.nodeId ?? "");
+    const t = f.target ? " \u2192 `" + shortId(f.target) + "`" : "";
+    const why = f.reason || f.message || "";
+    return `${kind}: \`${s}\`${t}${why ? " \u2014 " + why : ""}`;
+  });
+}
+function observedBreakFrom(node, data) {
+  const observed = Boolean(data?.observed);
+  const dependentCount = Number(data?.inboundObservedCount ?? 0);
+  const callCount = Array.isArray(data?.dependencies) ? data.dependencies.length : 0;
+  if (!observed && dependentCount === 0 && callCount === 0) return null;
+  const inboundVolume = typeof data.inboundVolume === "number" ? data.inboundVolume : void 0;
+  const window = typeof data.window === "string" ? data.window : void 0;
+  const inboundLastObserved = typeof data.inboundLastObserved === "string" ? data.inboundLastObserved : void 0;
+  return {
+    id: node.id,
+    type: node.type,
+    label: node.label,
+    change: node.change,
+    dependentCount,
+    callCount,
+    ...inboundVolume !== void 0 ? { inboundVolume } : {},
+    ...window !== void 0 ? { window } : {},
+    ...inboundLastObserved !== void 0 ? { inboundLastObserved } : {}
+  };
+}
+function blastRadius(graph, nodeId, maxDepth = 10) {
+  const inbound = /* @__PURE__ */ new Map();
+  for (const e of graph.edges) {
+    if (!inbound.has(e.target)) inbound.set(e.target, []);
+    inbound.get(e.target).push({ source: e.source, type: e.type });
+  }
+  const seen = /* @__PURE__ */ new Set([nodeId]);
+  const dependents = [];
+  let frontier = [nodeId];
+  for (let d = 0; d < maxDepth && frontier.length; d++) {
+    const next = [];
+    for (const n of frontier) {
+      for (const { source } of inbound.get(n) ?? []) {
+        if (seen.has(source)) continue;
+        seen.add(source);
+        dependents.push(source);
+        next.push(source);
+      }
+    }
+    frontier = next;
+  }
+  return dependents;
+}
+var stable = (obj) => JSON.stringify(obj, Object.keys(obj ?? {}).sort());
+function changedNodesForObservedScan(base, head, { limit = 25 } = {}) {
+  const out = [];
+  for (const [key, attrs] of base.nodes) {
+    if (!head.nodes.has(key)) {
+      out.push({ id: key, type: attrs.type, label: attrs.name ?? shortId(key), change: "removed" });
+    }
+  }
+  for (const [key, attrs] of head.nodes) {
+    const b = base.nodes.get(key);
+    if (b && stable(b) !== stable(attrs)) {
+      out.push({ id: key, type: attrs.type, label: attrs.name ?? shortId(key), change: "changed" });
+    }
+  }
+  return out.slice(0, limit);
+}
+var plural = (n) => n === 1 ? "" : "s";
+function formatAge(iso) {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return null;
+  const ms = Date.now() - t;
+  if (ms < 0) return "just now";
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s ago`;
+  const m = Math.round(s / 60);
+  if (m < 60) return `${m}m ago`;
+  const h = Math.round(m / 60);
+  if (h < 48) return `${h}h ago`;
+  return `${Math.round(h / 24)}d ago`;
+}
+function windowPhrase(window) {
+  if (window === "7d") return "in 7d";
+  if (window === "lifetime") return "(lifetime)";
+  return "";
+}
+function observedTraffic(b) {
+  if (typeof b.inboundVolume !== "number") return null;
+  const win = windowPhrase(b.window);
+  const served = `served ${b.inboundVolume.toLocaleString("en-US")}\xD7${win ? " " + win : ""}`;
+  const age = b.inboundLastObserved ? formatAge(b.inboundLastObserved) : null;
+  return age ? `${served}, last seen ${age}` : served;
+}
+var FUSION_NOTE = "<sub>Fused view \u2014 the static graph (EXTRACTED) weighted against production traffic (OBSERVED) from the connected NEAT host. Observed-break checks ran live against that host.</sub>";
+var TONE_COPY = {
+  loud: {
+    green: "## \u2705 NEAT \u2014 all clear",
+    yellow: "## \u26A0\uFE0F NEAT \u2014 a few minor problems",
+    red: "## \u{1F6D1} NEAT \u2014 FUCK NO. Here are the problems:"
+  },
+  professional: {
+    green: "## \u2705 NEAT \u2014 all clear",
+    yellow: "## \u26A0\uFE0F NEAT \u2014 Minor issues to review",
+    red: "## \u{1F6D1} NEAT \u2014 Critical: production will break"
+  }
+};
+function breakHeadline(b) {
+  const verb = b.change === "removed" ? "deletes" : "changes";
+  const what = fence(b.label) + (b.type === "InfraNode" ? " (data store)" : "");
+  const consequence = b.type === "RouteNode" ? "Live callers 404." : b.type === "InfraNode" ? "Live readers and writers fail." : "Live callers break.";
+  const traffic = observedTraffic(b);
+  if (traffic) {
+    return `**\u{1F534} Production will break** \u2014 this PR ${verb} ${what}, ${traffic} (OBSERVED). ${consequence}`;
+  }
+  if (b.dependentCount > 0) {
+    return `**\u{1F534} Production will break** \u2014 this PR ${verb} ${what}, ${b.dependentCount} observed dependent${plural(b.dependentCount)} (OBSERVED). ${consequence}`;
+  }
+  return `**\u{1F534} Production will break** \u2014 this PR ${verb} ${what}, seen live in production making ${b.callCount} observed call${plural(b.callCount)} (OBSERVED). Runtime behavior changes.`;
+}
+function breakDetail(b) {
+  return "- " + fence(b.label) + ` \u2014 ${b.change} ${b.type ?? "node"}; ${b.dependentCount} observed inbound dependent${plural(b.dependentCount)}, ${b.callCount} observed outbound call${plural(b.callCount)}. Provenance: OBSERVED (live traffic on the connected host).`;
+}
+function renderVerdict({
+  graph,
+  delta,
+  changedFiles = [],
+  divergences = [],
+  observedBreaks = [],
+  tone = "loud",
+  sniperDispatchUrl = "",
+  graphDiffUrl = ""
+}) {
+  const copy = TONE_COPY[tone] ?? TONE_COPY.loud;
+  const brokenRoutes = new Set(
+    observedBreaks.filter((b) => b.type === "RouteNode").map((b) => b.label)
+  );
+  const brokenTables = new Set(
+    observedBreaks.filter((b) => b.type === "InfraNode").map((b) => b.label)
+  );
+  const staticConcerns = [];
+  for (const r of delta.routesRemoved ?? []) {
+    if (brokenRoutes.has(r)) continue;
+    staticConcerns.push({
+      headline: `**\u{1F7E0} Removed route** \u2014 ${fence(r)} no longer exists; confirm nothing in-repo still calls it.`,
+      detail: `- Route ${fence(r)} removed. The connected host observed no production traffic on it \u2014 static-only concern.`
+    });
+  }
+  for (const t of delta.tablesRemoved ?? []) {
+    if (brokenTables.has(t)) continue;
+    staticConcerns.push({
+      headline: `**\u{1F7E0} Removed reference** \u2014 ${fence(t)} no longer exists; confirm nothing in-repo still reads it.`,
+      detail: `- Table/infra ${fence(t)} removed. The connected host observed no production traffic on it \u2014 static-only concern.`
+    });
+  }
+  const findings = [
+    ...observedBreaks.map((b) => ({ headline: breakHeadline(b), detail: breakDetail(b) })),
+    ...divergences.map((d) => ({
+      headline: `**\u{1F7E0} Divergence** \u2014 ${d}`,
+      detail: `- ${d}`
+    })),
+    ...staticConcerns
+  ];
+  const tier = observedBreaks.length > 0 ? "red" : findings.length > 0 ? "yellow" : "green";
+  const actionLinks = [];
+  if (sniperDispatchUrl)
+    actionLinks.push(`**[\u26A1 Dispatch Sniper to fix these \u2192](${sniperDispatchUrl})**`);
+  if (graphDiffUrl) actionLinks.push(`[Full graph diff \u2192](${graphDiffUrl})`);
+  const L = [MARKER, ""];
+  if (tier === "green") {
+    L.push(
+      copy.green,
+      "",
+      "Nothing this PR touches is observed in production, and it introduces no new divergences.",
+      "",
+      FUSION_NOTE
+    );
+    return { marker: MARKER, body: L.join("\n"), tier };
+  }
+  if (tier === "yellow") {
+    L.push(
+      copy.yellow,
+      "",
+      `${findings.length} minor problem${plural(findings.length)} \u2014 read ${findings.length === 1 ? "it" : "them"} below.`,
+      "",
+      "<details><summary>Read them \u2192</summary>",
+      ""
+    );
+    findings.forEach((f, i) => L.push(`${i + 1}. ${f.headline}`));
+    L.push("", ...findings.map((f) => f.detail));
+    L.push("", "</details>");
+    if (actionLinks.length) L.push("", ...actionLinks);
+    L.push("", FUSION_NOTE);
+    return { marker: MARKER, body: L.join("\n"), tier };
+  }
+  L.push(copy.red, "");
+  findings.forEach((f, i) => L.push(`${i + 1}. ${f.headline}`));
+  L.push("", "<details><summary>Full detail \u2192</summary>", "");
+  L.push(...findings.map((f) => f.detail));
+  const anyDelta = (delta.routesAdded?.length ?? 0) + (delta.routesRemoved?.length ?? 0) + (delta.tablesAdded?.length ?? 0) + (delta.tablesRemoved?.length ?? 0);
+  if (anyDelta) {
+    L.push("", "**Graph delta**");
+    if (delta.routesAdded?.length) L.push("- \u2795 routes: " + delta.routesAdded.map(fence).join(", "));
+    if (delta.routesRemoved?.length)
+      L.push("- \u2796 routes: " + delta.routesRemoved.map(fence).join(", "));
+    if (delta.tablesAdded?.length) L.push("- \u2795 tables: " + delta.tablesAdded.map(fence).join(", "));
+    if (delta.tablesRemoved?.length)
+      L.push("- \u2796 tables: " + delta.tablesRemoved.map(fence).join(", "));
+  }
+  const filesInGraph = (changedFiles ?? []).filter((f) => graph?.nodes?.has(f));
+  if (filesInGraph.length) {
+    L.push("", "**Blast radius (in-repo)**");
+    for (const f of filesInGraph) {
+      const deps = blastRadius(graph, f).filter((d) => d.startsWith("file:")).map(shortId);
+      L.push(
+        "- " + fence(shortId(f)) + " \u2192 depended on by " + (deps.length ? deps.map(fence).join(", ") : "_nothing else in-repo_")
+      );
+    }
+  }
+  L.push("", "</details>");
+  if (actionLinks.length) L.push("", ...actionLinks);
+  L.push("", FUSION_NOTE);
+  return { marker: MARKER, body: L.join("\n"), tier };
+}
+
+// src/pr-verdict.ts
+import { PrVerdictBodySchema } from "@neat.is/types";
+
+// src/connectors/hosted-repos.ts
 import os4 from "os";
-import path73 from "path";
-import { promises as fs38 } from "fs";
+import path74 from "path";
+import { mkdtemp, rm } from "fs/promises";
+var CP_REQUEST_TIMEOUT_MS = 1e4;
+var DEFAULT_SYNC_INTERVAL_MS = 5 * 6e4;
+var CLONE_TIMEOUT_MS = 5 * 6e4;
+function scrubToken(s) {
+  return s.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@");
+}
+async function cpGet(pathname, deps) {
+  const f = deps.fetchImpl ?? fetch;
+  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${pathname}`, {
+    headers: { authorization: `Bearer ${deps.daemonToken}`, accept: "application/json" },
+    signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS)
+  });
+  if (!res.ok) throw new Error(`control plane ${pathname} \u2192 HTTP ${res.status}`);
+  return await res.json();
+}
+async function cpPostStatus(deps, owner, name, body) {
+  const f = deps.fetchImpl ?? fetch;
+  const url = `${deps.cpUrl.replace(/\/+$/, "")}/internal/projects/${deps.projectId}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/status`;
+  const res = await f(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${deps.daemonToken}`, "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS)
+  });
+  if (!res.ok && res.status !== 404) throw new Error(`control plane status POST \u2192 HTTP ${res.status}`);
+}
+var defaultCloneRepo = async (cloneUrl, ref, destDir) => {
+  const [{ default: git }, httpMod, fs41] = await Promise.all([
+    import("isomorphic-git"),
+    import("isomorphic-git/http/node"),
+    import("fs")
+  ]);
+  const http = httpMod.default ?? httpMod;
+  const parsed = new URL(cloneUrl);
+  const password = parsed.password || parsed.username;
+  const username = parsed.password ? parsed.username : "x-access-token";
+  const cleanUrl = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  const clone = git.clone({
+    fs: fs41,
+    http,
+    dir: destDir,
+    url: cleanUrl,
+    // Absent ref → isomorphic-git clones the remote's default branch.
+    ...ref ? { ref } : {},
+    singleBranch: true,
+    depth: 1,
+    onAuth: () => ({ username, password })
+  });
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`clone timed out after ${CLONE_TIMEOUT_MS}ms`)), CLONE_TIMEOUT_MS);
+  });
+  try {
+    await Promise.race([clone, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
+var defaultCloneCommit = async (cloneUrl, sha, destDir) => {
+  const [{ default: git }, httpMod, fs41] = await Promise.all([
+    import("isomorphic-git"),
+    import("isomorphic-git/http/node"),
+    import("fs")
+  ]);
+  const http = httpMod.default ?? httpMod;
+  const parsed = new URL(cloneUrl);
+  const password = parsed.password || parsed.username;
+  const username = parsed.password ? parsed.username : "x-access-token";
+  const cleanUrl = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  const clone = (async () => {
+    await git.init({ fs: fs41, dir: destDir });
+    await git.addRemote({ fs: fs41, dir: destDir, remote: "origin", url: cleanUrl });
+    await git.fetch({
+      fs: fs41,
+      http,
+      dir: destDir,
+      remote: "origin",
+      // A full SHA is fetched as itself; the remote doesn't have to advertise a ref that points at it.
+      ref: sha,
+      remoteRef: sha,
+      singleBranch: true,
+      depth: 1,
+      tags: false,
+      ...password ? { onAuth: () => ({ username, password }) } : {}
+    });
+    await git.checkout({ fs: fs41, dir: destDir, ref: sha, force: true });
+  })();
+  clone.catch(() => {
+  });
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`clone timed out after ${CLONE_TIMEOUT_MS}ms`)), CLONE_TIMEOUT_MS);
+  });
+  try {
+    await Promise.race([clone, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
+function scrubCloneToken(s) {
+  return scrubToken(s);
+}
+function needsSync(r) {
+  return r.syncStatus === void 0 || r.syncStatus === "syncing";
+}
+async function syncOneRepo(r, input) {
+  const { deps, graph } = input;
+  const cloneRepo = input.cloneRepo ?? defaultCloneRepo;
+  const extract = input.extract ?? extractFromDirectory;
+  const label = `${r.owner}/${r.name}`;
+  const tmpRoot = input.tmpRoot ?? os4.tmpdir();
+  let dir;
+  try {
+    dir = await mkdtemp(path74.join(tmpRoot, "neat-repo-"));
+    await cpPostStatus(deps, r.owner, r.name, { syncStatus: "syncing", detail: "cloning" }).catch(() => {
+    });
+    await cloneRepo(r.cloneUrl, r.defaultBranch, dir);
+    const extracted = await extract(graph, dir, { source: label });
+    const nodes = extracted?.nodesAdded ?? 0;
+    const edges = extracted?.edgesAdded ?? 0;
+    await cpPostStatus(deps, r.owner, r.name, {
+      syncStatus: "synced",
+      detail: `extracted ${nodes} node${nodes === 1 ? "" : "s"}, ${edges} edge${edges === 1 ? "" : "s"}`,
+      lastSyncAt: new Date(input.now?.() ?? Date.now()).toISOString()
+    });
+    return true;
+  } catch (err) {
+    input.onError?.(label, err);
+    await cpPostStatus(deps, r.owner, r.name, {
+      syncStatus: "failed",
+      detail: scrubToken(err.message).slice(0, 300)
+    }).catch(() => {
+    });
+    return false;
+  } finally {
+    if (dir) await rm(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function runRepoSyncPassCounted(input) {
+  const counts = { listed: false, synced: 0, failed: 0 };
+  let repos;
+  try {
+    repos = await cpGet(`/internal/projects/${input.deps.projectId}/repos`, input.deps);
+  } catch (err) {
+    input.onSkip?.("(all)", `control plane repo list unreadable \u2014 ${err.message}`);
+    return counts;
+  }
+  if (!Array.isArray(repos)) return counts;
+  counts.listed = true;
+  for (const r of repos) {
+    if (!input.forceResync && !needsSync(r)) continue;
+    if (await syncOneRepo(r, input)) counts.synced++;
+    else counts.failed++;
+  }
+  return counts;
+}
+async function startRepoSync(input) {
+  const intervalMs = input.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS;
+  const now = () => input.now?.() ?? Date.now();
+  let stopped = false;
+  let inFlight = null;
+  let again = false;
+  let lastPass;
+  let bootResyncDone = false;
+  const run = async () => {
+    try {
+      do {
+        again = false;
+        const startedAt = new Date(now()).toISOString();
+        const counts = await runRepoSyncPassCounted({ ...input, forceResync: !bootResyncDone });
+        if (counts.listed) bootResyncDone = true;
+        lastPass = { ...counts, startedAt, finishedAt: new Date(now()).toISOString() };
+      } while (again && !stopped);
+    } finally {
+      inFlight = null;
+    }
+  };
+  const tick = () => {
+    if (stopped || inFlight) return;
+    inFlight = run();
+  };
+  tick();
+  const timer = setInterval(tick, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  const stop = () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+  return Object.assign(stop, {
+    syncNow: () => {
+      const summary = lastPass ? { lastPass } : {};
+      if (inFlight) {
+        again = true;
+        return { status: "queued", ...summary };
+      }
+      inFlight = run();
+      return { status: "started", ...summary };
+    },
+    settled: async () => {
+      while (inFlight) await inFlight;
+    }
+  });
+}
+async function maybeStartRepoSync(input) {
+  const env = input.env ?? process.env;
+  const cpUrl = env.NEAT_CP_URL;
+  const projectId = env.NEAT_CP_PROJECT_ID;
+  const daemonToken = env.NEAT_AUTH_TOKEN;
+  if (!cpUrl || !projectId || !daemonToken) return () => {
+  };
+  return startRepoSync({
+    deps: { cpUrl, projectId, daemonToken, ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {} },
+    graph: input.graph,
+    project: input.project,
+    ...input.cloneRepo ? { cloneRepo: input.cloneRepo } : {},
+    ...input.extract ? { extract: input.extract } : {},
+    ...input.intervalMs !== void 0 ? { intervalMs: input.intervalMs } : {},
+    ...input.tmpRoot ? { tmpRoot: input.tmpRoot } : {},
+    ...input.onSkip ? { onSkip: input.onSkip } : {},
+    ...input.onError ? { onError: input.onError } : {}
+  });
+}
+
+// src/pr-verdict.ts
+var DEFAULT_PR_VERDICT_TIMEOUT_MS = 24e4;
+var MAX_CHANGED_FILES = 3e3;
+var PrVerdictError = class extends Error {
+  constructor(message, status, stage, details) {
+    super(message);
+    this.status = status;
+    this.stage = stage;
+    this.details = details;
+    this.name = "PrVerdictError";
+  }
+  status;
+  stage;
+  details;
+};
+function parsePrVerdictRequest(body) {
+  const parsed = PrVerdictBodySchema.safeParse(body);
+  if (!parsed.success) {
+    throw new PrVerdictError("invalid pr-verdict body", 400, void 0, parsed.error.issues);
+  }
+  const { changedFiles, tone, ...rest } = parsed.data;
+  return {
+    ...rest,
+    ...changedFiles ? { changedFiles: changedFiles.slice(0, MAX_CHANGED_FILES) } : {},
+    ...tone ? { tone } : {}
+  };
+}
+function createPrVerdictRunner(deps = {}) {
+  let busy = false;
+  return async (req, ctx) => {
+    if (busy) throw new PrVerdictError("a verdict is already being computed on this daemon", 429);
+    busy = true;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_PR_VERDICT_TIMEOUT_MS;
+    const deadline = (deps.now ?? Date.now)() + timeoutMs;
+    const work = computePrVerdict(req, ctx, deps, deadline).finally(() => {
+      busy = false;
+    });
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(
+        () => reject(new PrVerdictError(`verdict did not finish within ${timeoutMs}ms`, 504)),
+        timeoutMs
+      );
+    });
+    try {
+      return await Promise.race([work, timeout]);
+    } finally {
+      if (timer) clearTimeout(timer);
+      work.catch(() => {
+      });
+    }
+  };
+}
+async function computePrVerdict(req, ctx, deps, deadline) {
+  const now = deps.now ?? Date.now;
+  const startedAt = now();
+  const cloneCommit = deps.cloneCommit ?? defaultCloneCommit;
+  const extract = deps.extract ?? extractFromDirectory;
+  const root = await fs39.mkdtemp(path75.join(deps.tmpRoot ?? os5.tmpdir(), "neat-pr-"));
+  const baseDir = path75.join(root, "base");
+  const headDir = path75.join(root, "head");
+  const stage = async (name, run) => {
+    const left = deadline - now();
+    if (left <= 0) throw new PrVerdictError(`verdict ran out of time before ${name}`, 504, name);
+    const work = run();
+    work.catch(() => {
+    });
+    let timer;
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new PrVerdictError(`verdict ran out of time during ${name}`, 504, name)), left);
+    });
+    try {
+      return await Promise.race([work, expired]);
+    } catch (err) {
+      if (err instanceof PrVerdictError) throw err;
+      const why = scrubCloneToken(err.message ?? String(err)).slice(0, 300);
+      throw new PrVerdictError(`${name} failed \u2014 ${why}`, 422, name);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
+  const extractOpts = { source: `${req.owner}/${req.name}`, announce: false };
+  try {
+    await fs39.mkdir(baseDir);
+    await fs39.mkdir(headDir);
+    await stage("clone-base", () => cloneCommit(req.cloneUrl, req.baseSha, baseDir));
+    await stage("clone-head", () => cloneCommit(req.cloneUrl, req.headSha, headDir));
+    const baseGraph = makeGraph();
+    const headGraph = makeGraph();
+    await stage("extract-base", () => extract(baseGraph, baseDir, extractOpts));
+    await stage("extract-head", () => extract(headGraph, headDir, extractOpts));
+    const base = graphFromExport(baseGraph.export());
+    const head = graphFromExport(headGraph.export());
+    const delta = diffGraphs(base, head);
+    const changedPaths = req.changedFiles ?? await changedPathsBetween(baseDir, headDir);
+    const changedFiles = changedFileNodeIds(head, changedPaths);
+    const divergences = formatDivergences(
+      computeDivergences(ctx.liveGraph, { incidents: ctx.incidents ?? [] }),
+      changedNodeIds(base, head)
+    );
+    const observedBreaks = [];
+    for (const node of changedNodesForObservedScan(base, head)) {
+      if (!ctx.liveGraph.hasNode(node.id)) continue;
+      const found = observedBreakFrom(node, getObservedDependencies(ctx.liveGraph, node.id));
+      if (found) observedBreaks.push(found);
+    }
+    const { marker, body } = renderVerdict({
+      graph: head,
+      delta,
+      changedFiles,
+      divergences,
+      observedBreaks,
+      tone: req.tone ?? "loud"
+    });
+    return {
+      marker,
+      body,
+      base: { sha: req.baseSha, nodes: baseGraph.order, edges: baseGraph.size },
+      head: { sha: req.headSha, nodes: headGraph.order, edges: headGraph.size },
+      changedFiles: changedFiles.length,
+      observedBreaks: observedBreaks.length,
+      divergences: divergences.length,
+      durationMs: now() - startedAt
+    };
+  } finally {
+    await fs39.rm(root, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "neat-out"]);
+async function hashTree(dir) {
+  const out = /* @__PURE__ */ new Map();
+  const walk11 = async (rel) => {
+    const entries = await fs39.readdir(path75.join(dir, rel), { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      const child = rel ? `${rel}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) await walk11(child);
+      } else if (entry.isFile()) {
+        const bytes = await fs39.readFile(path75.join(dir, child)).catch(() => null);
+        if (bytes) out.set(child, createHash("sha1").update(bytes).digest("hex"));
+      }
+    }
+  };
+  await walk11("");
+  return out;
+}
+async function changedPathsBetween(baseDir, headDir) {
+  const [base, head] = await Promise.all([hashTree(baseDir), hashTree(headDir)]);
+  const changed = [];
+  for (const [file, hash] of head) if (base.get(file) !== hash) changed.push(file);
+  for (const file of base.keys()) if (!head.has(file)) changed.push(file);
+  return changed.sort().slice(0, MAX_CHANGED_FILES);
+}
+
+// src/connectors-config.ts
+import os6 from "os";
+import path76 from "path";
+import { promises as fs40 } from "fs";
 var CONNECTORS_CONFIG_VERSION = 1;
 var EnvRefUnsetError = class extends Error {
   ref;
@@ -18669,17 +19453,17 @@ var EnvRefUnsetError = class extends Error {
 };
 function neatHome2() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path73.resolve(override);
-  return path73.join(os4.homedir(), ".neat");
+  if (override && override.length > 0) return path76.resolve(override);
+  return path76.join(os6.homedir(), ".neat");
 }
 function connectorsConfigPath(home = neatHome2()) {
-  return path73.join(home, "connectors.json");
+  return path76.join(home, "connectors.json");
 }
 var MODE_MASK_LOOSER_THAN_0600 = 63;
 async function warnIfModeLooserThan0600(file) {
   if (process.platform === "win32") return;
   try {
-    const stat = await fs38.stat(file);
+    const stat = await fs40.stat(file);
     if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
       const mode = (stat.mode & 511).toString(8).padStart(3, "0");
       console.warn(
@@ -18693,7 +19477,7 @@ async function readConnectorsConfig(home = neatHome2()) {
   const file = connectorsConfigPath(home);
   let raw;
   try {
-    raw = await fs38.readFile(file, "utf8");
+    raw = await fs40.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
@@ -18804,7 +19588,7 @@ function connectorMatchesProject(entry, project) {
 var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
 var CONNECTORS_LOCK_RETRY_MS = 50;
 function connectorsConfigLockPath(home = neatHome2()) {
-  return path73.join(home, "connectors.json.lock");
+  return path76.join(home, "connectors.json.lock");
 }
 function isEnvRef(value) {
   return value.length > 1 && value.startsWith("$");
@@ -18817,9 +19601,9 @@ function redactCredentialRef(ref) {
   return out;
 }
 async function writeConfigAtomically0600(file, contents) {
-  await fs38.mkdir(path73.dirname(file), { recursive: true });
+  await fs40.mkdir(path76.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs38.open(tmp, "w", 384);
+  const fd = await fs40.open(tmp, "w", 384);
   try {
     await fd.writeFile(contents, "utf8");
     await fd.chmod(384);
@@ -18827,14 +19611,14 @@ async function writeConfigAtomically0600(file, contents) {
   } finally {
     await fd.close();
   }
-  await fs38.rename(tmp, file);
+  await fs40.rename(tmp, file);
 }
 async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await fs38.mkdir(path73.dirname(lockPath), { recursive: true });
+  await fs40.mkdir(path76.dirname(lockPath), { recursive: true });
   for (; ; ) {
     try {
-      const fd = await fs38.open(lockPath, "wx");
+      const fd = await fs40.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -18854,7 +19638,7 @@ async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEO
   }
 }
 async function releaseConnectorsLock(lockPath) {
-  await fs38.unlink(lockPath).catch(() => {
+  await fs40.unlink(lockPath).catch(() => {
   });
 }
 async function withConnectorsLock(home, fn) {
@@ -19594,10 +20378,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path74) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path74);
+function targetFromRestPath(path77) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path77);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path74);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path77);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -20192,9 +20976,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path74 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path74) return null;
-  return { resourceName, method, path: path74 };
+  const path77 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path77) return null;
+  return { resourceName, method, path: path77 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -20232,14 +21016,14 @@ function mapLogEntryToSignal(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path74 = pathFromRequestUrl(req.requestUrl);
-  if (path74 === null) return null;
+  const path77 = pathFromRequestUrl(req.requestUrl);
+  if (path77 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path74 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path77 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20262,9 +21046,9 @@ import { NodeType as NodeType35 } from "@neat.is/types";
 function normalizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function inferServiceName(graph, resourceName, method, path74) {
+function inferServiceName(graph, resourceName, method, path77) {
   const wantedMethod = method.toUpperCase();
-  const wantedPath = normalizePathTemplate(path74);
+  const wantedPath = normalizePathTemplate(path77);
   const services = [];
   const owners = /* @__PURE__ */ new Set();
   graph.forEachNode((_id, attrs) => {
@@ -20472,7 +21256,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path74 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path77 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -20480,7 +21264,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path74 ? { path: path74 } : {},
+    ...path77 ? { path: path77 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -20526,8 +21310,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path74) {
-  const normalizedPath = normalizePathTemplate(path74);
+function findMatchingRouteNode(graph, serviceName, method, path77) {
+  const normalizedPath = normalizePathTemplate(path77);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -20544,10 +21328,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path74 } = signal;
+    const { method, path: path77 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path74) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path74) ?? wholeFileId;
+      if (!method || !path77) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path77) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -20877,9 +21661,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path74 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path74) return null;
-  return { serviceName, method, path: path74 };
+  const path77 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path77) return null;
+  return { serviceName, method, path: path77 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -20908,14 +21692,14 @@ function mapLogEntryToSignal2(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path74 = pathFromRequestUrl2(req.requestUrl);
-  if (path74 === null) return null;
+  const path77 = pathFromRequestUrl2(req.requestUrl);
+  if (path77 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path74 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path77 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20953,14 +21737,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path74 } = identity;
-    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path74) ?? void 0 : void 0);
+    const { serviceName: gcpServiceName, method, path: path77 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path77) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path74)
+        normalizePathTemplate(path77)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: EdgeType32.CALLS };
@@ -21088,9 +21872,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path74 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path74) return null;
-  return { backendServiceName, method, path: path74 };
+  const path77 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path77) return null;
+  return { backendServiceName, method, path: path77 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -21119,14 +21903,14 @@ function mapLogEntryToSignal3(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path74 = pathFromRequestUrl3(req.requestUrl);
-  if (path74 === null) return null;
+  const path77 = pathFromRequestUrl3(req.requestUrl);
+  if (path77 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path74 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path77 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21164,14 +21948,14 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path74 } = identity;
-    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path74) ?? void 0 : void 0);
+    const { backendServiceName, method, path: path77 } = identity;
+    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path77) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path74)
+        normalizePathTemplate(path77)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: EdgeType33.CALLS };
@@ -22618,6 +23402,35 @@ function registerRoutes(scope, ctx) {
     if (!proj) return;
     handleSse(req, reply, { project: proj.name });
   });
+  scope.get(
+    "/incident-triggers",
+    { config: BEARER_DELEGATED },
+    (req, reply) => {
+      const token = ctx.incidentStreamToken;
+      if (!token || Buffer.byteLength(token, "utf8") < 32 || token === ctx.generalAuthToken || !ctx.incidentReplayDurable) {
+        return reply.code(503).send({ error: "incident trigger stream unavailable" });
+      }
+      const header = req.headers.authorization;
+      const supplied = typeof header === "string" && header.startsWith("Bearer ") ? Buffer.from(header.slice("Bearer ".length), "utf8") : void 0;
+      const expected = Buffer.from(token, "utf8");
+      if (!supplied || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+        return reply.code(401).send({ error: "unauthorized" });
+      }
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+      if (!proj) return;
+      const errorsPath = errorsPathFor(proj);
+      if (!errorsPath) return reply.code(503).send({ error: "incident replay unavailable" });
+      let replay;
+      try {
+        const cursor = req.headers["last-event-id"];
+        if (Array.isArray(cursor)) throw new Error("invalid cursor");
+        replay = loadIncidentReplay(errorsPath, cursor);
+      } catch {
+        return reply.code(409).send({ error: "incident replay unavailable" });
+      }
+      handleSse(req, reply, { project: proj.name, incidentOnly: true, incidentReplay: replay });
+    }
+  );
   if (ctx.scope === "project") {
     scope.get("/health", async (req, reply) => {
       const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
@@ -22903,7 +23716,7 @@ function registerRoutes(scope, ctx) {
     const incidents = epath ? await readErrorEvents(epath) : [];
     let errorEvent;
     if (req.query.errorId) {
-      errorEvent = incidents.find((e) => e.id === req.query.errorId);
+      errorEvent = incidents.find((e) => e.id === req.query.errorId) ?? (epath ? await readErrorEventById(epath, req.query.errorId) : void 0);
       if (!errorEvent) {
         return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
       }
@@ -23089,6 +23902,26 @@ function registerRoutes(scope, ctx) {
     }
     return reply.code(202).send({ project: proj.name, ...syncNow() });
   });
+  scope.post("/pr-verdict", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    try {
+      const request = parsePrVerdictRequest(req.body);
+      const epath = errorsPathFor(proj);
+      const incidents = epath ? await readErrorEvents(epath) : [];
+      const verdict = await ctx.prVerdict(request, { liveGraph: proj.graph, incidents });
+      return { project: proj.name, ...verdict };
+    } catch (err) {
+      if (!(err instanceof PrVerdictError)) throw err;
+      if (err.status === 429) void reply.header("retry-after", "30");
+      return reply.code(err.status).send({
+        error: err.message,
+        project: proj.name,
+        ...err.stage ? { stage: err.stage } : {},
+        ...err.details !== void 0 ? { details: err.details } : {}
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -23376,6 +24209,8 @@ async function buildApi(opts) {
   const authToken = opts.authToken ?? env.authToken;
   const trustProxy = opts.trustProxy ?? env.trustProxy;
   const publicRead = opts.publicRead ?? env.publicRead;
+  const incidentStreamToken = opts.incidentStreamToken ?? process.env.NEAT_INCIDENT_STREAM_TOKEN;
+  const incidentReplayDurable = opts.incidentReplayDurable ?? (process.env.NEAT_INCIDENT_REPLAY_DURABLE === "1" && Buffer.byteLength(process.env.NEAT_INCIDENT_DURABLE_TOKEN ?? "", "utf8") >= 32);
   mountBearerAuth(app, {
     token: authToken,
     trustProxy,
@@ -23411,6 +24246,9 @@ async function buildApi(opts) {
   const routeCtx = {
     registry,
     startedAt,
+    incidentStreamToken,
+    incidentReplayDurable,
+    generalAuthToken: authToken,
     scope: "root",
     errorsPathFor,
     staleEventsPathFor,
@@ -23419,6 +24257,7 @@ async function buildApi(opts) {
     singleProject: opts.singleProject?.name,
     connectorsHome: opts.connectorsHome,
     repoSync: opts.repoSync,
+    prVerdict: opts.prVerdict ?? createPrVerdictRunner(),
     runPoll: opts.runPoll ?? runConnectorPoll
   };
   app.get("/health", async () => {
@@ -23596,6 +24435,7 @@ export {
   touchLastSeen,
   removeProject,
   pruneRegistry,
+  maybeStartRepoSync,
   readConnectorsConfig,
   resolveCredential,
   isEnvRef,
@@ -23617,4 +24457,4 @@ export {
   deprovisionConnector,
   buildApi
 };
-//# sourceMappingURL=chunk-DVCGDMTZ.js.map
+//# sourceMappingURL=chunk-KTJK2PAH.js.map