@neat.is/core 0.10.5 → 0.10.6-dev.20261007

package/dist/server.cjs

@@ -63,8 +63,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path78 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path78) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path78)) {
+    const path81 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path81) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path81)) {
       done();
       return;
     }
@@ -201,8 +201,8 @@ function reshapeGrpcRequest(req) {
   };
 }
 function resolveProtoRoot() {
-  const here = import_node_path56.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
-  return import_node_path56.default.resolve(here, "..", "proto");
+  const here = import_node_path57.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path57.default.resolve(here, "..", "proto");
 }
 function loadTraceService() {
   const protoRoot = resolveProtoRoot();
@@ -270,13 +270,13 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path56, import_node_crypto2, grpc, protoLoader;
+var import_node_url, import_node_path57, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
-    import_node_path56 = __toESM(require("path"), 1);
+    import_node_path57 = __toESM(require("path"), 1);
     import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
@@ -422,8 +422,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path78 = q === -1 ? v : v.slice(0, q);
-      if (path78.length > 0) return path78;
+      const path81 = q === -1 ? v : v.slice(0, q);
+      if (path81.length > 0) return path81;
     }
   }
   return void 0;
@@ -485,10 +485,10 @@ function parseOtlpRequest(body) {
   return out;
 }
 function loadProtoRoot() {
-  const here = import_node_path57.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
-  const protoRoot = import_node_path57.default.resolve(here, "..", "proto");
+  const here = import_node_path58.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path58.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
-  root.resolvePath = (_origin, target) => import_node_path57.default.resolve(protoRoot, target);
+  root.resolvePath = (_origin, target) => import_node_path58.default.resolve(protoRoot, target);
   root.loadSync(
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
@@ -750,12 +750,12 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path57, import_node_url2, import_node_zlib, import_fastify, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+var import_node_path58, import_node_url2, import_node_zlib, import_fastify, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path57 = __toESM(require("path"), 1);
+    import_node_path58 = __toESM(require("path"), 1);
     import_node_url2 = require("url");
     import_node_zlib = __toESM(require("zlib"), 1);
     import_fastify = __toESM(require("fastify"), 1);
@@ -772,7 +772,7 @@ var init_otel = __esm({
 
 // src/server.ts
 init_cjs_shims();
-var import_node_path77 = __toESM(require("path"), 1);
+var import_node_path80 = __toESM(require("path"), 1);
 
 // src/graph.ts
 init_cjs_shims();
@@ -795,8 +795,9 @@ function getGraph(project = DEFAULT_PROJECT) {
 // src/api.ts
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
+var import_node_crypto6 = require("crypto");
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types101 = require("@neat.is/types");
+var import_types103 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -1514,14 +1515,37 @@ init_cjs_shims();
 
 // src/ingest.ts
 init_cjs_shims();
-var import_node_fs10 = require("fs");
-var import_node_path11 = __toESM(require("path"), 1);
-var sourceMapJs = __toESM(require("source-map-js"), 1);
+var import_node_fs11 = require("fs");
+var import_node_path12 = __toESM(require("path"), 1);
 
-// src/policy.ts
+// src/durable-incident.ts
 init_cjs_shims();
 var import_node_fs4 = require("fs");
 var import_node_path4 = __toESM(require("path"), 1);
+async function appendRuntimeIncident(errorsPath, project, event, options = {}) {
+  const token = options.token ?? process.env.NEAT_INCIDENT_DURABLE_TOKEN;
+  if (token !== void 0) {
+    if (Buffer.byteLength(token, "utf8") < 32) throw new Error("durable incident sink unavailable");
+    const response = await (options.fetchImpl ?? fetch)("http://127.0.0.1:8081/incident-append", {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ project, event }),
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (response.status !== 204) throw new Error("durable incident sink unavailable");
+    return;
+  }
+  await import_node_fs4.promises.mkdir(import_node_path4.default.dirname(errorsPath), { recursive: true });
+  await import_node_fs4.promises.appendFile(errorsPath, JSON.stringify(event) + "\n", "utf8");
+}
+
+// src/ingest.ts
+var sourceMapJs = __toESM(require("source-map-js"), 1);
+
+// src/policy.ts
+init_cjs_shims();
+var import_node_fs5 = require("fs");
+var import_node_path5 = __toESM(require("path"), 1);
 var import_types2 = require("@neat.is/types");
 
 // src/events.ts
@@ -1990,7 +2014,7 @@ function matchPolicyToNode(graph, policy, nodeId, node) {
 async function loadPolicyFile(policyPath) {
   let raw;
   try {
-    raw = await import_node_fs4.promises.readFile(policyPath, "utf8");
+    raw = await import_node_fs5.promises.readFile(policyPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -2011,8 +2035,8 @@ var PolicyViolationsLog = class {
     if (!this.seen) await this.hydrate();
     if (this.seen.has(v.id)) return false;
     this.seen.add(v.id);
-    await import_node_fs4.promises.mkdir(import_node_path4.default.dirname(this.path), { recursive: true });
-    await import_node_fs4.promises.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
+    await import_node_fs5.promises.mkdir(import_node_path5.default.dirname(this.path), { recursive: true });
+    await import_node_fs5.promises.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
     emitNeatEvent({
       type: "policy-violation",
       project: this.project,
@@ -2022,7 +2046,7 @@ var PolicyViolationsLog = class {
   }
   async readAll() {
     try {
-      const raw = await import_node_fs4.promises.readFile(this.path, "utf8");
+      const raw = await import_node_fs5.promises.readFile(this.path, "utf8");
       return raw.split("\n").filter(Boolean).map((line) => JSON.parse(line));
     } catch (err) {
       if (err.code === "ENOENT") return [];
@@ -2041,7 +2065,7 @@ var import_types7 = require("@neat.is/types");
 
 // src/extract/routes.ts
 init_cjs_shims();
-var import_node_path10 = __toESM(require("path"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
 var import_tree_sitter2 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript2 = __toESM(require("tree-sitter-javascript"), 1);
 var import_tree_sitter_python2 = __toESM(require("tree-sitter-python"), 1);
@@ -2053,8 +2077,8 @@ var import_types6 = require("@neat.is/types");
 
 // src/extract/shared.ts
 init_cjs_shims();
-var import_node_fs5 = require("fs");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_node_fs6 = require("fs");
+var import_node_path6 = __toESM(require("path"), 1);
 var import_yaml = require("yaml");
 var import_types3 = require("@neat.is/types");
 var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".go", ".rb", ".php", ".cs", ".java", ".kt", ".rs", ".cpp", ".cc", ".cxx", ".c++", ".hpp", ".hh", ".hxx", ".h++"]);
@@ -2098,7 +2122,7 @@ async function isPythonVenvDir(dir) {
   const cached = PYVENV_MARKER_CACHE.get(dir);
   if (cached !== void 0) return cached;
   try {
-    const stat = await import_node_fs5.promises.stat(import_node_path5.default.join(dir, "pyvenv.cfg"));
+    const stat = await import_node_fs6.promises.stat(import_node_path6.default.join(dir, "pyvenv.cfg"));
     const ok = stat.isFile();
     PYVENV_MARKER_CACHE.set(dir, ok);
     return ok;
@@ -2108,7 +2132,7 @@ async function isPythonVenvDir(dir) {
   }
 }
 function isConfigFile(name) {
-  const ext = import_node_path5.default.extname(name);
+  const ext = import_node_path6.default.extname(name);
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
   if (JSON_CONFIG_FILENAMES.has(name)) return { match: true, fileType: "json" };
   if (name === ".env" || name.startsWith(".env.")) {
@@ -2225,16 +2249,16 @@ function cleanVersion(raw) {
   return raw.replace(/^[\^~><=v\s]+/, "").trim() || void 0;
 }
 async function readJson(filePath) {
-  const raw = await import_node_fs5.promises.readFile(filePath, "utf8");
+  const raw = await import_node_fs6.promises.readFile(filePath, "utf8");
   return JSON.parse(raw);
 }
 async function readYaml(filePath) {
-  const raw = await import_node_fs5.promises.readFile(filePath, "utf8");
+  const raw = await import_node_fs6.promises.readFile(filePath, "utf8");
   return (0, import_yaml.parse)(raw);
 }
 async function exists2(p) {
   try {
-    await import_node_fs5.promises.access(p);
+    await import_node_fs6.promises.access(p);
     return true;
   } catch {
     return false;
@@ -2243,8 +2267,8 @@ async function exists2(p) {
 
 // src/extract/errors.ts
 init_cjs_shims();
-var import_node_fs6 = require("fs");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_node_fs7 = require("fs");
+var import_node_path7 = __toESM(require("path"), 1);
 var sink = [];
 function recordExtractionError(producer, file, err) {
   const e = err instanceof Error ? err : new Error(String(err));
@@ -2263,14 +2287,14 @@ function drainExtractionErrors() {
 }
 async function writeExtractionErrors(errors, errorsPath) {
   if (errors.length === 0) return;
-  await import_node_fs6.promises.mkdir(import_node_path6.default.dirname(errorsPath), { recursive: true });
+  await import_node_fs7.promises.mkdir(import_node_path7.default.dirname(errorsPath), { recursive: true });
   const lines = errors.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await import_node_fs6.promises.appendFile(errorsPath, lines, "utf8");
+  await import_node_fs7.promises.appendFile(errorsPath, lines, "utf8");
 }
 function extractionHealthPathFor(errorsPath) {
-  const dir = import_node_path6.default.dirname(errorsPath);
-  const suffix = import_node_path6.default.basename(errorsPath).replace(/^errors/, "").replace(/\.ndjson$/, "");
-  return import_node_path6.default.join(dir, `extraction-health${suffix}.json`);
+  const dir = import_node_path7.default.dirname(errorsPath);
+  const suffix = import_node_path7.default.basename(errorsPath).replace(/^errors/, "").replace(/\.ndjson$/, "");
+  return import_node_path7.default.join(dir, `extraction-health${suffix}.json`);
 }
 var HEALTH_FILE_SAMPLE = 100;
 async function writeExtractionHealth(errors, healthPath, now = (/* @__PURE__ */ new Date()).toISOString()) {
@@ -2282,13 +2306,13 @@ async function writeExtractionHealth(errors, healthPath, now = (/* @__PURE__ */
     files: errors.slice(0, HEALTH_FILE_SAMPLE).map((e) => e.file),
     updatedAt: now
   };
-  await import_node_fs6.promises.mkdir(import_node_path6.default.dirname(healthPath), { recursive: true });
-  await import_node_fs6.promises.writeFile(healthPath, JSON.stringify(coverage), "utf8");
+  await import_node_fs7.promises.mkdir(import_node_path7.default.dirname(healthPath), { recursive: true });
+  await import_node_fs7.promises.writeFile(healthPath, JSON.stringify(coverage), "utf8");
 }
 async function readExtractionHealth(healthPath) {
   let raw;
   try {
-    raw = await import_node_fs6.promises.readFile(healthPath, "utf8");
+    raw = await import_node_fs7.promises.readFile(healthPath, "utf8");
   } catch {
     return void 0;
   }
@@ -2324,21 +2348,21 @@ function isRejectedLogEnabled() {
 }
 async function writeRejectedExtracted(drops, rejectedPath) {
   if (drops.length === 0) return;
-  await import_node_fs6.promises.mkdir(import_node_path6.default.dirname(rejectedPath), { recursive: true });
+  await import_node_fs7.promises.mkdir(import_node_path7.default.dirname(rejectedPath), { recursive: true });
   const lines = drops.map((d) => JSON.stringify({ ...d, ts: (/* @__PURE__ */ new Date()).toISOString() })).join("\n") + "\n";
-  await import_node_fs6.promises.appendFile(rejectedPath, lines, "utf8");
+  await import_node_fs7.promises.appendFile(rejectedPath, lines, "utf8");
 }
 
 // src/extract/calls/shared.ts
 init_cjs_shims();
-var import_node_fs8 = require("fs");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_fs9 = require("fs");
+var import_node_path9 = __toESM(require("path"), 1);
 var import_types4 = require("@neat.is/types");
 
 // src/extract/gitignore.ts
 init_cjs_shims();
-var import_node_fs7 = require("fs");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_fs8 = require("fs");
+var import_node_path8 = __toESM(require("path"), 1);
 var import_ignore = __toESM(require("ignore"), 1);
 var LAYER_CACHE = /* @__PURE__ */ new Map();
 async function layerFor(dir) {
@@ -2346,7 +2370,7 @@ async function layerFor(dir) {
   if (cached !== void 0) return cached;
   let layer = null;
   try {
-    const raw = await import_node_fs7.promises.readFile(import_node_path7.default.join(dir, ".gitignore"), "utf8");
+    const raw = await import_node_fs8.promises.readFile(import_node_path8.default.join(dir, ".gitignore"), "utf8");
     layer = { dir, ig: (0, import_ignore.default)().add(raw) };
   } catch {
     layer = null;
@@ -2356,7 +2380,7 @@ async function layerFor(dir) {
 }
 async function isRepoRoot(dir) {
   try {
-    await import_node_fs7.promises.stat(import_node_path7.default.join(dir, ".git"));
+    await import_node_fs8.promises.stat(import_node_path8.default.join(dir, ".git"));
     return true;
   } catch {
     return false;
@@ -2364,11 +2388,11 @@ async function isRepoRoot(dir) {
 }
 async function loadIgnoreChain(startDir) {
   const dirs = [];
-  let current = import_node_path7.default.resolve(startDir);
+  let current = import_node_path8.default.resolve(startDir);
   for (; ; ) {
     dirs.push(current);
     if (await isRepoRoot(current)) break;
-    const parent = import_node_path7.default.dirname(current);
+    const parent = import_node_path8.default.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -2381,7 +2405,7 @@ async function loadIgnoreChain(startDir) {
   return layers;
 }
 async function extendIgnoreChain(chain, dir) {
-  const layer = await layerFor(import_node_path7.default.resolve(dir));
+  const layer = await layerFor(import_node_path8.default.resolve(dir));
   return layer ? [...chain, layer] : chain;
 }
 function isIgnored(chain, fullPath, isDir) {
@@ -2389,14 +2413,14 @@ function isIgnored(chain, fullPath, isDir) {
 }
 function decide(chain, fullPath, isDir) {
   if (chain.length === 0) return { ignored: false, subtree: chain };
-  const abs = import_node_path7.default.resolve(fullPath);
+  const abs = import_node_path8.default.resolve(fullPath);
   let ignored = false;
   let unignoredAt = -1;
   for (let i = 0; i < chain.length; i++) {
     const layer = chain[i];
-    const rel = import_node_path7.default.relative(layer.dir, abs);
-    if (!rel || rel.startsWith("..") || import_node_path7.default.isAbsolute(rel)) continue;
-    const candidate = rel.split(import_node_path7.default.sep).join("/") + (isDir ? "/" : "");
+    const rel = import_node_path8.default.relative(layer.dir, abs);
+    if (!rel || rel.startsWith("..") || import_node_path8.default.isAbsolute(rel)) continue;
+    const candidate = rel.split(import_node_path8.default.sep).join("/") + (isDir ? "/" : "");
     const result = layer.ig.test(candidate);
     if (result.ignored) ignored = true;
     else if (result.unignored) {
@@ -2415,7 +2439,7 @@ function buildServiceHostIndex(services) {
   const knownHosts = /* @__PURE__ */ new Set();
   const hostToNodeId = /* @__PURE__ */ new Map();
   for (const service of services) {
-    const base = import_node_path8.default.basename(service.dir);
+    const base = import_node_path9.default.basename(service.dir);
     knownHosts.add(base);
     knownHosts.add(service.pkg.name);
     hostToNodeId.set(base, service.node.id);
@@ -2424,29 +2448,29 @@ function buildServiceHostIndex(services) {
   return { knownHosts, hostToNodeId };
 }
 async function walkSourceFiles(dir, excludeDirs = []) {
-  const excluded = new Set(excludeDirs.map((d) => import_node_path8.default.resolve(d)));
+  const excluded = new Set(excludeDirs.map((d) => import_node_path9.default.resolve(d)));
   const out = [];
   const rootChain = await loadIgnoreChain(dir);
   async function walk11(current, inherited) {
-    const entries = await import_node_fs8.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await import_node_fs9.promises.readdir(current, { withFileTypes: true }).catch(() => []);
     const chain = entries.some((e) => e.isFile() && e.name === ".gitignore") ? await extendIgnoreChain(inherited, current) : inherited;
     for (const entry of entries) {
-      const full = import_node_path8.default.join(current, entry.name);
+      const full = import_node_path9.default.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        if (excluded.has(import_node_path8.default.resolve(full))) continue;
+        if (excluded.has(import_node_path9.default.resolve(full))) continue;
         const verdict = decide(chain, full, true);
         if (verdict.ignored) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk11(full, verdict.subtree);
-      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path8.default.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
+      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path9.default.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
       // would attribute our instrumentation imports to the user's service.
       !isNeatAuthoredSourceFile(entry.name) && !isIgnored(chain, full, false)) {
         out.push(full);
       }
     }
   }
-  await walk11(dir, rootChain.filter((l) => import_node_path8.default.resolve(l.dir) !== import_node_path8.default.resolve(dir)));
+  await walk11(dir, rootChain.filter((l) => import_node_path9.default.resolve(l.dir) !== import_node_path9.default.resolve(dir)));
   return out;
 }
 var MINIFIED_LINE_CHARS = 5e3;
@@ -2474,7 +2498,7 @@ async function loadSourceFiles(dir, excludeDirs = []) {
   const out = [];
   for (const p of paths) {
     try {
-      const content = await import_node_fs8.promises.readFile(p, "utf8");
+      const content = await import_node_fs9.promises.readFile(p, "utf8");
       const verdict = isMinifiedSource(p, content);
       if (verdict.minified) {
         noteSkippedFile({ path: p, reason: "minified", detail: verdict.detail });
@@ -2502,7 +2526,7 @@ function toPosix(p) {
   return p.split("\\").join("/");
 }
 function languageForPath(relPath) {
-  switch (import_node_path8.default.extname(relPath).toLowerCase()) {
+  switch (import_node_path9.default.extname(relPath).toLowerCase()) {
     case ".py":
       return "python";
     case ".go":
@@ -2586,8 +2610,8 @@ function ensureFileNode(graph, serviceName, serviceNodeId, relPath) {
 
 // src/extract/imports.ts
 init_cjs_shims();
-var import_node_path9 = __toESM(require("path"), 1);
-var import_node_fs9 = require("fs");
+var import_node_path10 = __toESM(require("path"), 1);
+var import_node_fs10 = require("fs");
 var import_tree_sitter = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript = __toESM(require("tree-sitter-javascript"), 1);
 var import_tree_sitter_python = __toESM(require("tree-sitter-python"), 1);
@@ -2732,15 +2756,15 @@ function collectPyImports(node, out) {
 }
 async function fileExists2(p) {
   try {
-    await import_node_fs9.promises.access(p);
+    await import_node_fs10.promises.access(p);
     return true;
   } catch {
     return false;
   }
 }
 function isWithinServiceDir(candidate, serviceDir) {
-  const rel = import_node_path9.default.relative(serviceDir, candidate);
-  return rel !== "" && !rel.startsWith("..") && !import_node_path9.default.isAbsolute(rel);
+  const rel = import_node_path10.default.relative(serviceDir, candidate);
+  return rel !== "" && !rel.startsWith("..") && !import_node_path10.default.isAbsolute(rel);
 }
 var JS_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
 var JS_INDEX_FILES = JS_EXTENSIONS.map((ext) => `index${ext}`);
@@ -2748,22 +2772,22 @@ async function firstExistingCandidate(base, serviceDir) {
   for (const ext of JS_EXTENSIONS) {
     const candidate = base + ext;
     if (isWithinServiceDir(candidate, serviceDir) && await fileExists2(candidate)) {
-      return toPosix(import_node_path9.default.relative(serviceDir, candidate));
+      return toPosix(import_node_path10.default.relative(serviceDir, candidate));
     }
   }
   for (const indexFile of JS_INDEX_FILES) {
-    const candidate = import_node_path9.default.join(base, indexFile);
+    const candidate = import_node_path10.default.join(base, indexFile);
     if (isWithinServiceDir(candidate, serviceDir) && await fileExists2(candidate)) {
-      return toPosix(import_node_path9.default.relative(serviceDir, candidate));
+      return toPosix(import_node_path10.default.relative(serviceDir, candidate));
     }
   }
   return null;
 }
 async function loadTsPathConfig(serviceDir) {
-  const tsconfigPath = import_node_path9.default.join(serviceDir, "tsconfig.json");
+  const tsconfigPath = import_node_path10.default.join(serviceDir, "tsconfig.json");
   let raw;
   try {
-    raw = await import_node_fs9.promises.readFile(tsconfigPath, "utf8");
+    raw = await import_node_fs10.promises.readFile(tsconfigPath, "utf8");
   } catch {
     return null;
   }
@@ -2772,7 +2796,7 @@ async function loadTsPathConfig(serviceDir) {
     const paths = parsed.compilerOptions?.paths;
     if (!paths || Object.keys(paths).length === 0) return null;
     const baseUrl = parsed.compilerOptions?.baseUrl;
-    return { paths, baseDir: baseUrl ? import_node_path9.default.resolve(serviceDir, baseUrl) : serviceDir };
+    return { paths, baseDir: baseUrl ? import_node_path10.default.resolve(serviceDir, baseUrl) : serviceDir };
   } catch (err) {
     recordExtractionError("import alias resolution", tsconfigPath, err);
     return null;
@@ -2790,11 +2814,11 @@ async function resolveTsAlias(specifier, config, serviceDir) {
     if (suffix === null) continue;
     for (const target of targets) {
       const targetBase = target.endsWith("/*") ? target.slice(0, -2) : target.replace(/\*$/, "");
-      const resolvedBase = import_node_path9.default.resolve(config.baseDir, targetBase, suffix);
+      const resolvedBase = import_node_path10.default.resolve(config.baseDir, targetBase, suffix);
       const hit = await firstExistingCandidate(resolvedBase, serviceDir);
       if (hit) return hit;
       if (isWithinServiceDir(resolvedBase, serviceDir) && await fileExists2(resolvedBase)) {
-        return toPosix(import_node_path9.default.relative(serviceDir, resolvedBase));
+        return toPosix(import_node_path10.default.relative(serviceDir, resolvedBase));
       }
     }
   }
@@ -2803,18 +2827,18 @@ async function resolveTsAlias(specifier, config, serviceDir) {
 async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
   if (!specifier) return null;
   if (specifier.startsWith("./") || specifier.startsWith("../")) {
-    const base = import_node_path9.default.resolve(importerDir, specifier);
-    const ext = import_node_path9.default.extname(specifier);
+    const base = import_node_path10.default.resolve(importerDir, specifier);
+    const ext = import_node_path10.default.extname(specifier);
     if (ext) {
       if (ext === ".js" || ext === ".jsx") {
         const tsExt = ext === ".jsx" ? ".tsx" : ".ts";
         const tsSibling = base.slice(0, -ext.length) + tsExt;
         if (isWithinServiceDir(tsSibling, serviceDir) && await fileExists2(tsSibling)) {
-          return toPosix(import_node_path9.default.relative(serviceDir, tsSibling));
+          return toPosix(import_node_path10.default.relative(serviceDir, tsSibling));
         }
       }
       if (isWithinServiceDir(base, serviceDir) && await fileExists2(base)) {
-        return toPosix(import_node_path9.default.relative(serviceDir, base));
+        return toPosix(import_node_path10.default.relative(serviceDir, base));
       }
       if (!JS_EXTENSIONS.includes(ext)) {
         return firstExistingCandidate(base, serviceDir);
@@ -2829,30 +2853,30 @@ async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
 async function resolvePyImport(imp, importerPath, serviceDir) {
   let baseDir;
   if (imp.level > 0) {
-    baseDir = import_node_path9.default.dirname(importerPath);
-    for (let i = 1; i < imp.level; i++) baseDir = import_node_path9.default.dirname(baseDir);
+    baseDir = import_node_path10.default.dirname(importerPath);
+    for (let i = 1; i < imp.level; i++) baseDir = import_node_path10.default.dirname(baseDir);
   } else {
     baseDir = serviceDir;
   }
-  const moduleBase = imp.modulePath ? import_node_path9.default.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
+  const moduleBase = imp.modulePath ? import_node_path10.default.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
   const resolved = /* @__PURE__ */ new Set();
   let needModuleFile = imp.names.length === 0;
   for (const name of imp.names) {
-    const submoduleFile = import_node_path9.default.join(moduleBase, `${name}.py`);
-    const subpackageInit = import_node_path9.default.join(moduleBase, name, "__init__.py");
+    const submoduleFile = import_node_path10.default.join(moduleBase, `${name}.py`);
+    const subpackageInit = import_node_path10.default.join(moduleBase, name, "__init__.py");
     if (isWithinServiceDir(submoduleFile, serviceDir) && await fileExists2(submoduleFile)) {
-      resolved.add(toPosix(import_node_path9.default.relative(serviceDir, submoduleFile)));
+      resolved.add(toPosix(import_node_path10.default.relative(serviceDir, submoduleFile)));
     } else if (isWithinServiceDir(subpackageInit, serviceDir) && await fileExists2(subpackageInit)) {
-      resolved.add(toPosix(import_node_path9.default.relative(serviceDir, subpackageInit)));
+      resolved.add(toPosix(import_node_path10.default.relative(serviceDir, subpackageInit)));
     } else {
       needModuleFile = true;
     }
   }
   if (needModuleFile) {
-    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, import_node_path9.default.join(moduleBase, "__init__.py")] : [import_node_path9.default.join(moduleBase, "__init__.py")];
+    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, import_node_path10.default.join(moduleBase, "__init__.py")] : [import_node_path10.default.join(moduleBase, "__init__.py")];
     for (const candidate of moduleFileCandidates) {
       if (isWithinServiceDir(candidate, serviceDir) && await fileExists2(candidate)) {
-        resolved.add(toPosix(import_node_path9.default.relative(serviceDir, candidate)));
+        resolved.add(toPosix(import_node_path10.default.relative(serviceDir, candidate)));
         break;
       }
     }
@@ -2862,11 +2886,11 @@ async function resolvePyImport(imp, importerPath, serviceDir) {
 async function resolveGoImport(specifier, modulePath, serviceDir) {
   if (specifier !== modulePath && !specifier.startsWith(`${modulePath}/`)) return null;
   const suffix = specifier === modulePath ? "" : specifier.slice(modulePath.length + 1);
-  const dir = import_node_path9.default.join(serviceDir, suffix);
-  const entries = await import_node_fs9.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
-  const candidates = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".go") && !entry.name.endsWith("_test.go")).map((entry) => import_node_path9.default.join(dir, entry.name));
+  const dir = import_node_path10.default.join(serviceDir, suffix);
+  const entries = await import_node_fs10.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const candidates = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".go") && !entry.name.endsWith("_test.go")).map((entry) => import_node_path10.default.join(dir, entry.name));
   if (candidates.length !== 1) return null;
-  return toPosix(import_node_path9.default.relative(serviceDir, candidates[0]));
+  return toPosix(import_node_path10.default.relative(serviceDir, candidates[0]));
 }
 function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, importeeRelPath, line, snippet2) {
   const importeeFileId = (0, import_types5.fileId)(serviceName, importeeRelPath);
@@ -2896,12 +2920,12 @@ async function addImports(graph, services) {
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const relFile = toPosix(import_node_path9.default.relative(service.dir, file.path));
+      const relFile = toPosix(import_node_path10.default.relative(service.dir, file.path));
       const importerFileId = (0, import_types5.fileId)(service.pkg.name, relFile);
-      const isPython = import_node_path9.default.extname(file.path) === ".py";
-      const isGo = import_node_path9.default.extname(file.path) === ".go";
-      if (import_node_path9.default.extname(file.path) === ".rb") continue;
-      if (import_node_path9.default.extname(file.path) === ".php") continue;
+      const isPython = import_node_path10.default.extname(file.path) === ".py";
+      const isGo = import_node_path10.default.extname(file.path) === ".go";
+      if (import_node_path10.default.extname(file.path) === ".rb") continue;
+      if (import_node_path10.default.extname(file.path) === ".php") continue;
       if (isGo) {
         let goImports = [];
         try {
@@ -2911,7 +2935,7 @@ async function addImports(graph, services) {
           recordExtractionError("import extraction", file.path, err);
           continue;
         }
-        const goMod = await import_node_fs9.promises.readFile(import_node_path9.default.join(service.dir, "go.mod"), "utf8").catch(() => "");
+        const goMod = await import_node_fs10.promises.readFile(import_node_path10.default.join(service.dir, "go.mod"), "utf8").catch(() => "");
         const modulePath = goMod.match(/^\s*module\s+(\S+)\s*$/m)?.[1];
         if (!modulePath) continue;
         for (const imp of goImports) {
@@ -2955,7 +2979,7 @@ async function addImports(graph, services) {
         continue;
       }
       for (const imp of jsImports) {
-        const resolved = await resolveJsImport(imp.specifier, import_node_path9.default.dirname(file.path), service.dir, tsPaths);
+        const resolved = await resolveJsImport(imp.specifier, import_node_path10.default.dirname(file.path), service.dir, tsPaths);
         if (!resolved) continue;
         edgesAdded += emitImportEdge(
           graph,
@@ -3080,8 +3104,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path78) {
-  return path78.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path81) {
+  return path81.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -3421,7 +3445,7 @@ function isNextPagesApiFile(relFile) {
   if (pagesIdx === -1 || segs[pagesIdx + 1] !== "api") return false;
   const base = segs[segs.length - 1] ?? "";
   if (/^_(app|document|middleware)\./.test(base)) return false;
-  return JS_ROUTE_EXTENSIONS.has(import_node_path10.default.extname(base));
+  return JS_ROUTE_EXTENSIONS.has(import_node_path11.default.extname(base));
 }
 function nextSegment(seg) {
   if (seg.startsWith("(") && seg.endsWith(")")) return null;
@@ -3753,9 +3777,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path78 = rubyLiteral(k);
-    if (path78 === null) continue;
-    return { path: path78, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path81 = rubyLiteral(k);
+    if (path81 === null) continue;
+    return { path: path81, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -3845,23 +3869,23 @@ function railsInferHandler(rawPath) {
   if (segs.length === 1) return `${segs[0]}#index`;
   return `${segs.slice(0, -1).join("/")}#${segs[segs.length - 1]}`;
 }
-function railsResource(call, ctx, out, plural) {
+function railsResource(call, ctx, out, plural2) {
   if (ctx.depth >= 2) return;
   const args = rubyArgs(call);
   const name = rubyLiteral(rubyPositional(args)[0]);
   if (!name) return;
   const base = `${ctx.path}/${name}`;
-  const controller = ctx.module + (plural ? name : railsPluralize(name));
+  const controller = ctx.module + (plural2 ? name : railsPluralize(name));
   const allow = railsActionFilter(args);
   const line = call.startPosition.row + 1;
-  for (const row of plural ? RAILS_PLURAL_ROWS : RAILS_SINGULAR_ROWS) {
+  for (const row of plural2 ? RAILS_PLURAL_ROWS : RAILS_SINGULAR_ROWS) {
     if (!allow(row.action)) continue;
     for (const m of row.methods) railsEmit(out, m, base + row.suffix, `${controller}#${row.action}`, line);
   }
   const block = call.childForFieldName("block");
   if (!block) return;
-  const memberBase = plural ? `${base}/:id` : base;
-  const nestedPath = plural ? `${base}/:${railsSingularize(name)}_id` : base;
+  const memberBase = plural2 ? `${base}/:id` : base;
+  const nestedPath = plural2 ? `${base}/:${railsSingularize(name)}_id` : base;
   for (const child of rubyBlockCalls(block)) {
     const cm = child.childForFieldName("method")?.text;
     if (cm === "member") railsBlockVerbs(child, memberBase, controller, out);
@@ -4603,12 +4627,12 @@ async function expressMountPrefixes(files, serviceDir, tsPaths) {
   const jsParser = makeJsParser2();
   const fileInfo = /* @__PURE__ */ new Map();
   for (const f of files) {
-    if (!JS_ROUTE_EXTENSIONS.has(import_node_path10.default.extname(f.path))) continue;
+    if (!JS_ROUTE_EXTENSIONS.has(import_node_path11.default.extname(f.path))) continue;
     if (isTestPath(f.path)) continue;
-    const rel = toPosix(import_node_path10.default.relative(serviceDir, f.path));
+    const rel = toPosix(import_node_path11.default.relative(serviceDir, f.path));
     try {
       const tree = parseSource2(jsParser, f.content);
-      fileInfo.set(rel, analyzeExpressFile(tree.rootNode, import_node_path10.default.dirname(f.path)));
+      fileInfo.set(rel, analyzeExpressFile(tree.rootNode, import_node_path11.default.dirname(f.path)));
     } catch {
     }
   }
@@ -4707,14 +4731,14 @@ async function addRoutes(graph, services) {
     const mountPrefixes = hasExpress ? await expressMountPrefixes(files, service.dir, await loadTsPathConfig(service.dir)) : /* @__PURE__ */ new Map();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const ext = import_node_path10.default.extname(file.path);
+      const ext = import_node_path11.default.extname(file.path);
       const isPy = ext === ".py";
       const isGo = ext === ".go";
       const isRb = ext === ".rb";
       const isPhp = ext === ".php";
       const isRs = ext === ".rs";
       if (!JS_ROUTE_EXTENSIONS.has(ext) && !isPy && !isGo && !isRb && !isPhp && !isRs) continue;
-      const relFile = toPosix(import_node_path10.default.relative(service.dir, file.path));
+      const relFile = toPosix(import_node_path11.default.relative(service.dir, file.path));
       let routes;
       try {
         if (isPhp) {
@@ -5128,20 +5152,20 @@ var CODE_LINENO_ATTR = "code.lineno";
 var CODE_FUNCTION_NAME_ATTR = "code.function.name";
 var CODE_FUNCTION_ATTR = "code.function";
 function codeFilepathOf(attrs) {
-  const stable = attrs[CODE_FILE_PATH_ATTR];
-  if (typeof stable === "string" && stable.length > 0) return stable;
+  const stable2 = attrs[CODE_FILE_PATH_ATTR];
+  if (typeof stable2 === "string" && stable2.length > 0) return stable2;
   const prior = attrs[CODE_FILEPATH_ATTR];
   return typeof prior === "string" && prior.length > 0 ? prior : void 0;
 }
 function codeLinenoOf(attrs) {
-  const stable = attrs[CODE_LINE_NUMBER_ATTR];
-  if (typeof stable === "number" && Number.isFinite(stable)) return stable;
+  const stable2 = attrs[CODE_LINE_NUMBER_ATTR];
+  if (typeof stable2 === "number" && Number.isFinite(stable2)) return stable2;
   const prior = attrs[CODE_LINENO_ATTR];
   return typeof prior === "number" && Number.isFinite(prior) ? prior : void 0;
 }
 function codeFunctionOf(attrs) {
-  const stable = attrs[CODE_FUNCTION_NAME_ATTR];
-  if (typeof stable === "string" && stable.length > 0) return stable;
+  const stable2 = attrs[CODE_FUNCTION_NAME_ATTR];
+  if (typeof stable2 === "string" && stable2.length > 0) return stable2;
   const prior = attrs[CODE_FUNCTION_ATTR];
   return typeof prior === "string" && prior.length > 0 ? prior : void 0;
 }
@@ -5171,7 +5195,7 @@ function languageForExt(relPath) {
 function relPathForRuntimeFile(filepath, serviceNode, scanPath) {
   let p = toPosix2(filepath).replace(/^file:\/\//, "");
   if (scanPath && scanPath.length > 0) {
-    const absRoot = toPosix2(import_node_path11.default.resolve(scanPath, serviceNode?.repoPath ?? ""));
+    const absRoot = toPosix2(import_node_path12.default.resolve(scanPath, serviceNode?.repoPath ?? ""));
     const anchor = absRoot.endsWith("/") ? absRoot : `${absRoot}/`;
     if (p.startsWith(anchor)) return p.slice(anchor.length);
   }
@@ -5199,10 +5223,10 @@ function resolveDistToSrc(absFilepath, line) {
     entry = null;
     const mapPath = `${absFilepath}.map`;
     try {
-      if ((0, import_node_fs10.existsSync)(mapPath)) {
-        const raw = JSON.parse((0, import_node_fs10.readFileSync)(mapPath, "utf8"));
+      if ((0, import_node_fs11.existsSync)(mapPath)) {
+        const raw = JSON.parse((0, import_node_fs11.readFileSync)(mapPath, "utf8"));
         const consumer = new sourceMapJs.SourceMapConsumer(raw);
-        entry = { consumer, dir: import_node_path11.default.dirname(mapPath) };
+        entry = { consumer, dir: import_node_path12.default.dirname(mapPath) };
       }
     } catch {
       entry = null;
@@ -5222,7 +5246,7 @@ function resolveDistToSrc(absFilepath, line) {
     }
     if (!pos || !pos.source) return null;
     const root = entry.consumer.sourceRoot ?? "";
-    const resolved = import_node_path11.default.resolve(entry.dir, root, pos.source);
+    const resolved = import_node_path12.default.resolve(entry.dir, root, pos.source);
     return { filepath: resolved, ...pos.line ? { line: pos.line } : {} };
   } catch {
     return null;
@@ -5766,8 +5790,7 @@ function emitIncidentEvent(project, ev) {
   });
 }
 async function appendErrorEvent(ctx, ev) {
-  await import_node_fs10.promises.mkdir(import_node_path11.default.dirname(ctx.errorsPath), { recursive: true });
-  await import_node_fs10.promises.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
+  await appendRuntimeIncident(ctx.errorsPath, ctx.project ?? DEFAULT_PROJECT, ev);
   emitIncidentEvent(ctx.project ?? DEFAULT_PROJECT, ev);
 }
 async function appendConnectorIncident(errorsPath, input, project) {
@@ -5782,8 +5805,7 @@ async function appendConnectorIncident(errorsPath, input, project) {
     ...input.attributes && Object.keys(input.attributes).length > 0 ? { attributes: input.attributes } : {},
     affectedNode: input.affectedNode
   };
-  await import_node_fs10.promises.mkdir(import_node_path11.default.dirname(errorsPath), { recursive: true });
-  await import_node_fs10.promises.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
+  await appendRuntimeIncident(errorsPath, project ?? DEFAULT_PROJECT, ev);
   if (project) emitIncidentEvent(project, ev);
 }
 function landIncidentCallSite(span, callSite, trusted, graph) {
@@ -6374,13 +6396,13 @@ async function markStaleEdges(graph, options = {}) {
   return { count: events.length, events };
 }
 async function appendStaleEvents(staleEventsPath, events) {
-  await import_node_fs10.promises.mkdir(import_node_path11.default.dirname(staleEventsPath), { recursive: true });
+  await import_node_fs11.promises.mkdir(import_node_path12.default.dirname(staleEventsPath), { recursive: true });
   const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await import_node_fs10.promises.appendFile(staleEventsPath, lines, "utf8");
+  await import_node_fs11.promises.appendFile(staleEventsPath, lines, "utf8");
 }
 async function readStaleEvents(staleEventsPath) {
   try {
-    const raw = await import_node_fs10.promises.readFile(staleEventsPath, "utf8");
+    const raw = await import_node_fs11.promises.readFile(staleEventsPath, "utf8");
     return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
   } catch (err) {
     if (err.code === "ENOENT") return [];
@@ -6416,7 +6438,7 @@ function startStalenessLoop(graph, options = {}) {
 var INCIDENT_READ_MAX_BYTES = 32 * 1024 * 1024;
 var INCIDENT_READ_MAX_EVENTS = 5e3;
 async function readErrorFileTail(errorsPath, maxBytes) {
-  const handle = await import_node_fs10.promises.open(errorsPath, "r");
+  const handle = await import_node_fs11.promises.open(errorsPath, "r");
   try {
     const { size } = await handle.stat();
     if (size <= maxBytes) {
@@ -6452,6 +6474,23 @@ async function readErrorEvents(errorsPath, opts) {
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
 }
+async function readErrorEventById(errorsPath, id) {
+  let raw;
+  try {
+    raw = await readErrorFileTail(errorsPath, INCIDENT_READ_MAX_BYTES);
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  const lines = raw.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line) continue;
+    const event = JSON.parse(line);
+    if (event.id === id) return redactPersistedAttributes(event);
+  }
+  return void 0;
+}
 function isSynthesizedHttpIncident(ev) {
   if (ev.exceptionType || ev.exceptionStacktrace) return false;
   if (ev.errorType) return false;
@@ -6659,19 +6698,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path78, edges) {
-    if (path78.length > best.path.length) {
-      best = { path: [...path78], edges: [...edges] };
+  function step(node, path81, edges) {
+    if (path81.length > best.path.length) {
+      best = { path: [...path81], edges: [...edges] };
     }
-    if (path78.length - 1 >= maxDepth) return;
+    if (path81.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path78.push(srcId);
+      path81.push(srcId);
       edges.push(edge);
-      step(srcId, path78, edges);
-      path78.pop();
+      step(srcId, path81, edges);
+      path81.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -6886,20 +6925,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path78 = [originServiceId];
+  const path81 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path78.push(hop.nextService);
+    path81.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path78, edges, culprit: current };
+  return { path: path81, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types8.EdgeType.CALLS && e.provenance === import_types8.Provenance.STALE;
@@ -6935,26 +6974,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path78 = [originServiceId];
+  const path81 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path78.push(hop.nextService);
+    path81.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path78, edges, culprit: current };
+  return { path: path81, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path78 = [...chain.path];
+  const path81 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -6962,14 +7001,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path78.push(loc.fileNode);
+      path81.push(loc.fileNode);
       edgeProvenances.push(import_types8.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types8.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path78,
+      traversalPath: path81,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -6981,7 +7020,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types8.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path78,
+    traversalPath: path81,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -7634,10 +7673,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path78 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path78) {
-      traversalPath = path78.nodes;
-      edgeProvenances = path78.edges.map((e) => e.provenance);
+    const path81 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path81) {
+      traversalPath = path81.nodes;
+      edgeProvenances = path81.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types8.Provenance.OBSERVED];
@@ -8399,16 +8438,16 @@ init_cjs_shims();
 
 // src/extract/services.ts
 init_cjs_shims();
-var import_node_fs21 = require("fs");
-var import_node_path23 = __toESM(require("path"), 1);
+var import_node_fs22 = require("fs");
+var import_node_path24 = __toESM(require("path"), 1);
 var import_ignore2 = __toESM(require("ignore"), 1);
 var import_minimatch2 = require("minimatch");
 var import_types19 = require("@neat.is/types");
 
 // src/extract/python.ts
 init_cjs_shims();
-var import_node_fs11 = require("fs");
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_fs12 = require("fs");
+var import_node_path13 = __toESM(require("path"), 1);
 var import_smol_toml = require("smol-toml");
 var REQUIREMENT_LINE = /^\s*([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?\s*(?:(==)\s*([A-Za-z0-9_.+-]+))?/;
 function parseRequirementsTxt(content) {
@@ -8441,25 +8480,25 @@ function depsFromPyProject(pyproject) {
   return out;
 }
 async function discoverPythonService(serviceDir) {
-  const pyprojectPath = import_node_path12.default.join(serviceDir, "pyproject.toml");
-  const requirementsPath = import_node_path12.default.join(serviceDir, "requirements.txt");
-  const setupPath = import_node_path12.default.join(serviceDir, "setup.py");
+  const pyprojectPath = import_node_path13.default.join(serviceDir, "pyproject.toml");
+  const requirementsPath = import_node_path13.default.join(serviceDir, "requirements.txt");
+  const setupPath = import_node_path13.default.join(serviceDir, "setup.py");
   const hasPyproject = await exists2(pyprojectPath);
   const hasRequirements = await exists2(requirementsPath);
   const hasSetup = await exists2(setupPath);
   if (!hasPyproject && !hasRequirements && !hasSetup) return null;
-  let name = import_node_path12.default.basename(serviceDir);
+  let name = import_node_path13.default.basename(serviceDir);
   let version;
   const dependencies = {};
   if (hasPyproject) {
-    const raw = await import_node_fs11.promises.readFile(pyprojectPath, "utf8");
+    const raw = await import_node_fs12.promises.readFile(pyprojectPath, "utf8");
     const pyproject = (0, import_smol_toml.parse)(raw);
     name = pyproject.project?.name ?? pyproject.tool?.poetry?.name ?? name;
     version = pyproject.project?.version ?? pyproject.tool?.poetry?.version ?? void 0;
     Object.assign(dependencies, depsFromPyProject(pyproject));
   }
   if (hasRequirements) {
-    const raw = await import_node_fs11.promises.readFile(requirementsPath, "utf8");
+    const raw = await import_node_fs12.promises.readFile(requirementsPath, "utf8");
     Object.assign(dependencies, parseRequirementsTxt(raw));
   }
   return { name, version, dependencies };
@@ -8474,8 +8513,8 @@ function pythonToPackage(service) {
 
 // src/extract/go.ts
 init_cjs_shims();
-var import_node_fs12 = require("fs");
-var import_node_path13 = __toESM(require("path"), 1);
+var import_node_fs13 = require("fs");
+var import_node_path14 = __toESM(require("path"), 1);
 var import_types10 = require("@neat.is/types");
 function parseGoMod(source) {
   const module2 = source.match(/^\s*module\s+(\S+)\s*$/m)?.[1];
@@ -8502,7 +8541,7 @@ function goFramework(deps) {
 async function discoverGoService(scanPath, dir) {
   let raw;
   try {
-    raw = await import_node_fs12.promises.readFile(import_node_path13.default.join(dir, "go.mod"), "utf8");
+    raw = await import_node_fs13.promises.readFile(import_node_path14.default.join(dir, "go.mod"), "utf8");
   } catch {
     return null;
   }
@@ -8517,7 +8556,7 @@ async function discoverGoService(scanPath, dir) {
     name,
     language: "go",
     dependencies: mod.dependencies,
-    repoPath: import_node_path13.default.relative(scanPath, dir),
+    repoPath: import_node_path14.default.relative(scanPath, dir),
     ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
@@ -8525,8 +8564,8 @@ async function discoverGoService(scanPath, dir) {
 
 // src/extract/ruby.ts
 init_cjs_shims();
-var import_node_fs13 = require("fs");
-var import_node_path14 = __toESM(require("path"), 1);
+var import_node_fs14 = require("fs");
+var import_node_path15 = __toESM(require("path"), 1);
 var import_types11 = require("@neat.is/types");
 function parseGemfile(source) {
   const dependencies = {};
@@ -8543,12 +8582,12 @@ function parseGemfile(source) {
 async function discoverRubyService(scanPath, dir) {
   let raw;
   try {
-    raw = await import_node_fs13.promises.readFile(import_node_path14.default.join(dir, "Gemfile"), "utf8");
+    raw = await import_node_fs14.promises.readFile(import_node_path15.default.join(dir, "Gemfile"), "utf8");
   } catch {
     return null;
   }
   const gemfile = parseGemfile(raw);
-  const name = import_node_path14.default.basename(dir);
+  const name = import_node_path15.default.basename(dir);
   const pkg = { name, dependencies: gemfile.dependencies };
   const node = {
     id: (0, import_types11.serviceId)(name),
@@ -8556,7 +8595,7 @@ async function discoverRubyService(scanPath, dir) {
     name,
     language: "ruby",
     dependencies: gemfile.dependencies,
-    repoPath: import_node_path14.default.relative(scanPath, dir),
+    repoPath: import_node_path15.default.relative(scanPath, dir),
     ...gemfile.dependencies["rails"] !== void 0 ? { framework: "rails" } : {}
   };
   return { pkg, dir, node };
@@ -8564,7 +8603,7 @@ async function discoverRubyService(scanPath, dir) {
 
 // src/extract/php.ts
 init_cjs_shims();
-var import_node_path15 = __toESM(require("path"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
 var import_types12 = require("@neat.is/types");
 function parseComposerJson(composer) {
   return {
@@ -8577,12 +8616,12 @@ function parseComposerJson(composer) {
 async function discoverPhpService(scanPath, dir) {
   let composer;
   try {
-    composer = await readJson(import_node_path15.default.join(dir, "composer.json"));
+    composer = await readJson(import_node_path16.default.join(dir, "composer.json"));
   } catch {
     return null;
   }
   const { dependencies } = parseComposerJson(composer);
-  const name = import_node_path15.default.basename(dir);
+  const name = import_node_path16.default.basename(dir);
   const pkg = { name, dependencies };
   const node = {
     id: (0, import_types12.serviceId)(name),
@@ -8590,7 +8629,7 @@ async function discoverPhpService(scanPath, dir) {
     name,
     language: "php",
     dependencies,
-    repoPath: import_node_path15.default.relative(scanPath, dir),
+    repoPath: import_node_path16.default.relative(scanPath, dir),
     ...dependencies["laravel/framework"] !== void 0 ? { framework: "laravel" } : {}
   };
   return { pkg, dir, node };
@@ -8598,23 +8637,23 @@ async function discoverPhpService(scanPath, dir) {
 
 // src/extract/csharp.ts
 init_cjs_shims();
-var import_node_fs14 = require("fs");
-var import_node_path16 = __toESM(require("path"), 1);
+var import_node_fs15 = require("fs");
+var import_node_path17 = __toESM(require("path"), 1);
 var import_types13 = require("@neat.is/types");
 var CSHARP_PROJECT_EXTS = /* @__PURE__ */ new Set([".csproj", ".sln"]);
 async function projectFiles(dir) {
-  const entries = await import_node_fs14.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs15.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
   const out = [];
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    if (CSHARP_PROJECT_EXTS.has(import_node_path16.default.extname(entry.name).toLowerCase())) out.push(entry.name);
+    if (CSHARP_PROJECT_EXTS.has(import_node_path17.default.extname(entry.name).toLowerCase())) out.push(entry.name);
   }
   return out.sort();
 }
 var NESTED_PROJECT_DIR = "src";
 async function resolveProjectDir(dir) {
   if ((await projectFiles(dir)).length > 0) return dir;
-  const nested = import_node_path16.default.join(dir, NESTED_PROJECT_DIR);
+  const nested = import_node_path17.default.join(dir, NESTED_PROJECT_DIR);
   if ((await projectFiles(nested)).length > 0) return nested;
   return null;
 }
@@ -8639,10 +8678,10 @@ async function discoverCsharpService(scanPath, dir) {
   if (projectDir === null) return null;
   const projects = await projectFiles(projectDir);
   const csproj = projects.find((p) => p.toLowerCase().endsWith(".csproj"));
-  const name = csproj ? import_node_path16.default.basename(csproj, import_node_path16.default.extname(csproj)) : import_node_path16.default.basename(dir);
+  const name = csproj ? import_node_path17.default.basename(csproj, import_node_path17.default.extname(csproj)) : import_node_path17.default.basename(dir);
   let dependencies = {};
   if (csproj) {
-    const raw = await import_node_fs14.promises.readFile(import_node_path16.default.join(projectDir, csproj), "utf8").catch(() => "");
+    const raw = await import_node_fs15.promises.readFile(import_node_path17.default.join(projectDir, csproj), "utf8").catch(() => "");
     dependencies = parseCsproj(raw).dependencies;
   }
   const pkg = { name, dependencies };
@@ -8654,20 +8693,20 @@ async function discoverCsharpService(scanPath, dir) {
     dependencies,
     // Anchor on the directory that holds the project and its `.cs` files, so file
     // attribution reaches the source whether it sits at the root or under `src/`.
-    repoPath: import_node_path16.default.relative(scanPath, projectDir)
+    repoPath: import_node_path17.default.relative(scanPath, projectDir)
   };
   return { pkg, dir: projectDir, node };
 }
 
 // src/extract/java.ts
 init_cjs_shims();
-var import_node_fs15 = require("fs");
-var import_node_path17 = __toESM(require("path"), 1);
+var import_node_fs16 = require("fs");
+var import_node_path18 = __toESM(require("path"), 1);
 var import_types14 = require("@neat.is/types");
 var JAVA_MANIFESTS = ["pom.xml", "build.gradle", "build.gradle.kts"];
 async function hasJavaManifest(dir) {
   for (const manifest of JAVA_MANIFESTS) {
-    if (await exists2(import_node_path17.default.join(dir, manifest))) return true;
+    if (await exists2(import_node_path18.default.join(dir, manifest))) return true;
   }
   return false;
 }
@@ -8702,19 +8741,19 @@ function parseGradle(source) {
   return { dependencies };
 }
 async function discoverJavaService(scanPath, dir) {
-  const pomPath = import_node_path17.default.join(dir, "pom.xml");
-  const gradlePath = import_node_path17.default.join(dir, "build.gradle");
-  const gradleKtsPath = import_node_path17.default.join(dir, "build.gradle.kts");
+  const pomPath = import_node_path18.default.join(dir, "pom.xml");
+  const gradlePath = import_node_path18.default.join(dir, "build.gradle");
+  const gradleKtsPath = import_node_path18.default.join(dir, "build.gradle.kts");
   let manifest = null;
   if (await exists2(pomPath)) {
-    manifest = parsePomXml(await import_node_fs15.promises.readFile(pomPath, "utf8").catch(() => ""));
+    manifest = parsePomXml(await import_node_fs16.promises.readFile(pomPath, "utf8").catch(() => ""));
   } else if (await exists2(gradlePath)) {
-    manifest = parseGradle(await import_node_fs15.promises.readFile(gradlePath, "utf8").catch(() => ""));
+    manifest = parseGradle(await import_node_fs16.promises.readFile(gradlePath, "utf8").catch(() => ""));
   } else if (await exists2(gradleKtsPath)) {
-    manifest = parseGradle(await import_node_fs15.promises.readFile(gradleKtsPath, "utf8").catch(() => ""));
+    manifest = parseGradle(await import_node_fs16.promises.readFile(gradleKtsPath, "utf8").catch(() => ""));
   }
   if (!manifest) return null;
-  const name = manifest.name?.trim() || import_node_path17.default.basename(dir);
+  const name = manifest.name?.trim() || import_node_path18.default.basename(dir);
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
@@ -8723,15 +8762,15 @@ async function discoverJavaService(scanPath, dir) {
     name,
     language: "java",
     dependencies,
-    repoPath: import_node_path17.default.relative(scanPath, dir)
+    repoPath: import_node_path18.default.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/kotlin.ts
 init_cjs_shims();
-var import_node_fs16 = require("fs");
-var import_node_path18 = __toESM(require("path"), 1);
+var import_node_fs17 = require("fs");
+var import_node_path19 = __toESM(require("path"), 1);
 var import_types15 = require("@neat.is/types");
 var KOTLIN_SOURCE_EXT = ".kt";
 var JAVA_SOURCE_EXT = ".java";
@@ -8741,15 +8780,15 @@ async function dominantJvmSourceLanguage(dir) {
   let java = 0;
   async function recurse(current, depth) {
     if (depth > SOURCE_PROBE_MAX_DEPTH) return;
-    const entries = await import_node_fs16.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await import_node_fs17.promises.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        await recurse(import_node_path18.default.join(current, entry.name), depth + 1);
+        await recurse(import_node_path19.default.join(current, entry.name), depth + 1);
         continue;
       }
       if (!entry.isFile()) continue;
-      const ext = import_node_path18.default.extname(entry.name).toLowerCase();
+      const ext = import_node_path19.default.extname(entry.name).toLowerCase();
       if (ext === KOTLIN_SOURCE_EXT) kt++;
       else if (ext === JAVA_SOURCE_EXT) java++;
     }
@@ -8760,17 +8799,17 @@ async function dominantJvmSourceLanguage(dir) {
   return void 0;
 }
 async function readJvmManifest(dir) {
-  const pomPath = import_node_path18.default.join(dir, JAVA_MANIFESTS[0]);
-  const gradlePath = import_node_path18.default.join(dir, JAVA_MANIFESTS[1]);
-  const gradleKtsPath = import_node_path18.default.join(dir, JAVA_MANIFESTS[2]);
+  const pomPath = import_node_path19.default.join(dir, JAVA_MANIFESTS[0]);
+  const gradlePath = import_node_path19.default.join(dir, JAVA_MANIFESTS[1]);
+  const gradleKtsPath = import_node_path19.default.join(dir, JAVA_MANIFESTS[2]);
   if (await exists2(pomPath)) {
-    return parsePomXml(await import_node_fs16.promises.readFile(pomPath, "utf8").catch(() => ""));
+    return parsePomXml(await import_node_fs17.promises.readFile(pomPath, "utf8").catch(() => ""));
   }
   if (await exists2(gradlePath)) {
-    return parseGradle(await import_node_fs16.promises.readFile(gradlePath, "utf8").catch(() => ""));
+    return parseGradle(await import_node_fs17.promises.readFile(gradlePath, "utf8").catch(() => ""));
   }
   if (await exists2(gradleKtsPath)) {
-    return parseGradle(await import_node_fs16.promises.readFile(gradleKtsPath, "utf8").catch(() => ""));
+    return parseGradle(await import_node_fs17.promises.readFile(gradleKtsPath, "utf8").catch(() => ""));
   }
   return null;
 }
@@ -8779,7 +8818,7 @@ async function discoverKotlinService(scanPath, dir) {
   if (await dominantJvmSourceLanguage(dir) !== "kotlin") return null;
   const manifest = await readJvmManifest(dir);
   if (!manifest) return null;
-  const name = manifest.name?.trim() || import_node_path18.default.basename(dir);
+  const name = manifest.name?.trim() || import_node_path19.default.basename(dir);
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
@@ -8788,20 +8827,20 @@ async function discoverKotlinService(scanPath, dir) {
     name,
     language: "kotlin",
     dependencies,
-    repoPath: import_node_path18.default.relative(scanPath, dir)
+    repoPath: import_node_path19.default.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/rust.ts
 init_cjs_shims();
-var import_node_fs17 = require("fs");
-var import_node_path19 = __toESM(require("path"), 1);
+var import_node_fs18 = require("fs");
+var import_node_path20 = __toESM(require("path"), 1);
 var import_smol_toml2 = require("smol-toml");
 var import_types16 = require("@neat.is/types");
 var CARGO_MANIFEST = "Cargo.toml";
 async function hasRustManifest(dir) {
-  return exists2(import_node_path19.default.join(dir, CARGO_MANIFEST));
+  return exists2(import_node_path20.default.join(dir, CARGO_MANIFEST));
 }
 function parseCargoToml(source) {
   const dependencies = {};
@@ -8826,10 +8865,10 @@ function parseCargoToml(source) {
   return { name, dependencies };
 }
 async function discoverRustService(scanPath, dir) {
-  const cargoPath = import_node_path19.default.join(dir, CARGO_MANIFEST);
+  const cargoPath = import_node_path20.default.join(dir, CARGO_MANIFEST);
   if (!await exists2(cargoPath)) return null;
-  const manifest = parseCargoToml(await import_node_fs17.promises.readFile(cargoPath, "utf8").catch(() => ""));
-  const name = manifest.name?.trim() || import_node_path19.default.basename(dir);
+  const manifest = parseCargoToml(await import_node_fs18.promises.readFile(cargoPath, "utf8").catch(() => ""));
+  const name = manifest.name?.trim() || import_node_path20.default.basename(dir);
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
@@ -8838,19 +8877,19 @@ async function discoverRustService(scanPath, dir) {
     name,
     language: "rust",
     dependencies,
-    repoPath: import_node_path19.default.relative(scanPath, dir)
+    repoPath: import_node_path20.default.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/cpp.ts
 init_cjs_shims();
-var import_node_fs18 = require("fs");
-var import_node_path20 = __toESM(require("path"), 1);
+var import_node_fs19 = require("fs");
+var import_node_path21 = __toESM(require("path"), 1);
 var import_types17 = require("@neat.is/types");
 var CMAKE_MANIFEST = "CMakeLists.txt";
 async function hasCppManifest(dir) {
-  return exists2(import_node_path20.default.join(dir, CMAKE_MANIFEST));
+  return exists2(import_node_path21.default.join(dir, CMAKE_MANIFEST));
 }
 function parseCMakeProjectName(source) {
   const withoutComments = source.replace(/#.*$/gm, "");
@@ -8858,10 +8897,10 @@ function parseCMakeProjectName(source) {
   return m?.[1];
 }
 async function discoverCppService(scanPath, dir) {
-  const cmakePath = import_node_path20.default.join(dir, CMAKE_MANIFEST);
+  const cmakePath = import_node_path21.default.join(dir, CMAKE_MANIFEST);
   if (!await exists2(cmakePath)) return null;
-  const source = await import_node_fs18.promises.readFile(cmakePath, "utf8").catch(() => "");
-  const name = parseCMakeProjectName(source)?.trim() || import_node_path20.default.basename(dir);
+  const source = await import_node_fs19.promises.readFile(cmakePath, "utf8").catch(() => "");
+  const name = parseCMakeProjectName(source)?.trim() || import_node_path21.default.basename(dir);
   const dependencies = {};
   const pkg = { name, dependencies };
   const node = {
@@ -8870,15 +8909,15 @@ async function discoverCppService(scanPath, dir) {
     name,
     language: "cpp",
     dependencies,
-    repoPath: import_node_path20.default.relative(scanPath, dir)
+    repoPath: import_node_path21.default.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/dockerfile-service.ts
 init_cjs_shims();
-var import_node_fs19 = require("fs");
-var import_node_path21 = __toESM(require("path"), 1);
+var import_node_fs20 = require("fs");
+var import_node_path22 = __toESM(require("path"), 1);
 var import_types18 = require("@neat.is/types");
 function languageForSourceExt(ext) {
   switch (ext) {
@@ -8920,12 +8959,12 @@ function languageForSourceExt(ext) {
 }
 var LANGUAGE_PRECEDENCE = ["typescript", "javascript", "python", "go", "ruby", "php", "csharp", "java", "kotlin", "rust", "cpp"];
 async function inferServiceLanguage(dir) {
-  const entries = await import_node_fs19.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs20.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
   const counts = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (isNeatAuthoredSourceFile(entry.name)) continue;
-    const ext = import_node_path21.default.extname(entry.name).toLowerCase();
+    const ext = import_node_path22.default.extname(entry.name).toLowerCase();
     if (!SERVICE_FILE_EXTENSIONS.has(ext)) continue;
     const lang = languageForSourceExt(ext);
     if (!lang) continue;
@@ -8944,7 +8983,7 @@ async function inferServiceLanguage(dir) {
   return best;
 }
 async function hasLanguageManifest(dir) {
-  return await exists2(import_node_path21.default.join(dir, "package.json")) || await exists2(import_node_path21.default.join(dir, "pyproject.toml")) || await exists2(import_node_path21.default.join(dir, "requirements.txt")) || await exists2(import_node_path21.default.join(dir, "setup.py")) || await exists2(import_node_path21.default.join(dir, "go.mod")) || await exists2(import_node_path21.default.join(dir, "Gemfile")) || await exists2(import_node_path21.default.join(dir, "composer.json")) || // C#'s marker is a glob (`*.csproj` / `*.sln`), so it reads the directory
+  return await exists2(import_node_path22.default.join(dir, "package.json")) || await exists2(import_node_path22.default.join(dir, "pyproject.toml")) || await exists2(import_node_path22.default.join(dir, "requirements.txt")) || await exists2(import_node_path22.default.join(dir, "setup.py")) || await exists2(import_node_path22.default.join(dir, "go.mod")) || await exists2(import_node_path22.default.join(dir, "Gemfile")) || await exists2(import_node_path22.default.join(dir, "composer.json")) || // C#'s marker is a glob (`*.csproj` / `*.sln`), so it reads the directory
   // rather than probing a fixed filename (ADR-196).
   await hasCsharpProject(dir) || // Java (and its JVM sibling Kotlin, ADR-199) key on the same Maven / Gradle
   // build manifest (ADR-197), so this one check stands the Dockerfile fallback
@@ -8954,15 +8993,15 @@ async function hasLanguageManifest(dir) {
   await hasCppManifest(dir);
 }
 async function hasDockerfileDeclaredService(dir) {
-  if (!await exists2(import_node_path21.default.join(dir, "Dockerfile"))) return false;
+  if (!await exists2(import_node_path22.default.join(dir, "Dockerfile"))) return false;
   return await inferServiceLanguage(dir) !== null;
 }
 async function discoverDockerfileService(scanPath, dir) {
-  if (!await exists2(import_node_path21.default.join(dir, "Dockerfile"))) return null;
+  if (!await exists2(import_node_path22.default.join(dir, "Dockerfile"))) return null;
   if (await hasLanguageManifest(dir)) return null;
   const language = await inferServiceLanguage(dir);
   if (!language) return null;
-  const name = import_node_path21.default.basename(dir);
+  const name = import_node_path22.default.basename(dir);
   const pkg = { name, dependencies: {} };
   const node = {
     id: (0, import_types18.serviceId)(name),
@@ -8970,24 +9009,24 @@ async function discoverDockerfileService(scanPath, dir) {
     name,
     language,
     dependencies: {},
-    repoPath: import_node_path21.default.relative(scanPath, dir)
+    repoPath: import_node_path22.default.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/owners.ts
 init_cjs_shims();
-var import_node_fs20 = require("fs");
-var import_node_path22 = __toESM(require("path"), 1);
+var import_node_fs21 = require("fs");
+var import_node_path23 = __toESM(require("path"), 1);
 var import_minimatch = require("minimatch");
 async function loadCodeowners(scanPath) {
   const candidates = [
-    import_node_path22.default.join(scanPath, "CODEOWNERS"),
-    import_node_path22.default.join(scanPath, ".github", "CODEOWNERS")
+    import_node_path23.default.join(scanPath, "CODEOWNERS"),
+    import_node_path23.default.join(scanPath, ".github", "CODEOWNERS")
   ];
   for (const file of candidates) {
     if (await exists2(file)) {
-      const raw = await import_node_fs20.promises.readFile(file, "utf8");
+      const raw = await import_node_fs21.promises.readFile(file, "utf8");
       return parseCodeowners(raw);
     }
   }
@@ -9005,7 +9044,7 @@ function parseCodeowners(raw) {
   return { rules };
 }
 function matchOwner(file, repoPath) {
-  const normalized = repoPath.split(import_node_path22.default.sep).join("/");
+  const normalized = repoPath.split(import_node_path23.default.sep).join("/");
   for (const rule of file.rules) {
     if (matchesPattern(rule.pattern, normalized)) return rule.owners;
   }
@@ -9021,7 +9060,7 @@ function matchesPattern(rawPattern, repoPath) {
   return false;
 }
 async function readPackageJsonAuthor(serviceDir) {
-  const pkgPath = import_node_path22.default.join(serviceDir, "package.json");
+  const pkgPath = import_node_path23.default.join(serviceDir, "package.json");
   if (!await exists2(pkgPath)) return null;
   try {
     const pkg = await readJson(pkgPath);
@@ -9058,36 +9097,36 @@ function workspaceGlobs(pkg) {
   return null;
 }
 async function hasPythonManifest(dir) {
-  return await exists2(import_node_path23.default.join(dir, "pyproject.toml")) || await exists2(import_node_path23.default.join(dir, "requirements.txt")) || await exists2(import_node_path23.default.join(dir, "setup.py"));
+  return await exists2(import_node_path24.default.join(dir, "pyproject.toml")) || await exists2(import_node_path24.default.join(dir, "requirements.txt")) || await exists2(import_node_path24.default.join(dir, "setup.py"));
 }
 async function hasGoManifest(dir) {
-  return exists2(import_node_path23.default.join(dir, "go.mod"));
+  return exists2(import_node_path24.default.join(dir, "go.mod"));
 }
 async function hasRubyManifest(dir) {
-  return exists2(import_node_path23.default.join(dir, "Gemfile"));
+  return exists2(import_node_path24.default.join(dir, "Gemfile"));
 }
 async function hasPhpManifest(dir) {
-  return exists2(import_node_path23.default.join(dir, "composer.json"));
+  return exists2(import_node_path24.default.join(dir, "composer.json"));
 }
 async function hasCsharpManifest(dir) {
   return hasCsharpProject(dir);
 }
 async function loadGitignore(scanPath) {
-  const gitignorePath = import_node_path23.default.join(scanPath, ".gitignore");
+  const gitignorePath = import_node_path24.default.join(scanPath, ".gitignore");
   if (!await exists2(gitignorePath)) return null;
-  const raw = await import_node_fs21.promises.readFile(gitignorePath, "utf8");
+  const raw = await import_node_fs22.promises.readFile(gitignorePath, "utf8");
   return (0, import_ignore2.default)().add(raw);
 }
 async function walkDirs(start, scanPath, options, visit) {
   async function recurse(current, depth) {
     if (depth > options.maxDepth) return;
-    const entries = await import_node_fs21.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await import_node_fs22.promises.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = import_node_path23.default.join(current, entry.name);
+      const child = import_node_path24.default.join(current, entry.name);
       if (options.ig) {
-        const rel = import_node_path23.default.relative(scanPath, child).split(import_node_path23.default.sep).join("/");
+        const rel = import_node_path24.default.relative(scanPath, child).split(import_node_path24.default.sep).join("/");
         if (rel && options.ig.ignores(rel + "/")) continue;
       }
       if (await isPythonVenvDir(child)) continue;
@@ -9103,8 +9142,8 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   for (const raw of globs) {
     const pattern = raw.replace(/^\.\//, "");
     if (!pattern.includes("*")) {
-      const candidate = import_node_path23.default.join(scanPath, pattern);
-      if (await exists2(import_node_path23.default.join(candidate, "package.json"))) found.add(candidate);
+      const candidate = import_node_path24.default.join(scanPath, pattern);
+      if (await exists2(import_node_path24.default.join(candidate, "package.json"))) found.add(candidate);
       continue;
     }
     const segments = pattern.split("/");
@@ -9113,13 +9152,13 @@ async function expandWorkspaceGlobs(scanPath, globs) {
       if (seg.includes("*")) break;
       staticSegments.push(seg);
     }
-    const start = import_node_path23.default.join(scanPath, ...staticSegments);
+    const start = import_node_path24.default.join(scanPath, ...staticSegments);
     if (!await exists2(start)) continue;
     const hasDoubleStar = pattern.includes("**");
     const walkDepth = hasDoubleStar ? scanDepth : Math.max(0, segments.length - staticSegments.length - 1);
     await walkDirs(start, scanPath, { maxDepth: walkDepth, ig: null }, async (dir) => {
-      const rel = import_node_path23.default.relative(scanPath, dir).split(import_node_path23.default.sep).join("/");
-      if ((0, import_minimatch2.minimatch)(rel, pattern) && await exists2(import_node_path23.default.join(dir, "package.json"))) {
+      const rel = import_node_path24.default.relative(scanPath, dir).split(import_node_path24.default.sep).join("/");
+      if ((0, import_minimatch2.minimatch)(rel, pattern) && await exists2(import_node_path24.default.join(dir, "package.json"))) {
         found.add(dir);
       }
     });
@@ -9142,18 +9181,18 @@ function detectJsFramework(pkg) {
 async function detectJsServiceLanguage(dir, pkg) {
   const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   if (deps["typescript"] !== void 0) return "typescript";
-  const entries = await import_node_fs21.promises.readdir(dir).catch(() => []);
+  const entries = await import_node_fs22.promises.readdir(dir).catch(() => []);
   if (entries.some((name) => /^tsconfig(\..+)?\.json$/.test(name))) return "typescript";
   return "javascript";
 }
 async function discoverNodeService(scanPath, dir) {
-  const pkgPath = import_node_path23.default.join(dir, "package.json");
+  const pkgPath = import_node_path24.default.join(dir, "package.json");
   if (!await exists2(pkgPath)) return null;
   let pkg;
   try {
     pkg = await readJson(pkgPath);
   } catch (err) {
-    recordExtractionError("services", import_node_path23.default.relative(scanPath, pkgPath), err);
+    recordExtractionError("services", import_node_path24.default.relative(scanPath, pkgPath), err);
     return null;
   }
   if (!pkg.name) return null;
@@ -9166,7 +9205,7 @@ async function discoverNodeService(scanPath, dir) {
     language,
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
-    repoPath: import_node_path23.default.relative(scanPath, dir),
+    repoPath: import_node_path24.default.relative(scanPath, dir),
     ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
     ...framework ? { framework } : {}
   };
@@ -9183,12 +9222,12 @@ async function discoverPyService(scanPath, dir) {
     language: "python",
     version: py.version,
     dependencies: py.dependencies,
-    repoPath: import_node_path23.default.relative(scanPath, dir)
+    repoPath: import_node_path24.default.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 async function discoverServices(scanPath) {
-  const rootPkgPath = import_node_path23.default.join(scanPath, "package.json");
+  const rootPkgPath = import_node_path24.default.join(scanPath, "package.json");
   let rootPkg = null;
   if (await exists2(rootPkgPath)) {
     try {
@@ -9196,7 +9235,7 @@ async function discoverServices(scanPath) {
     } catch (err) {
       recordExtractionError(
         "services workspaces",
-        import_node_path23.default.relative(scanPath, rootPkgPath),
+        import_node_path24.default.relative(scanPath, rootPkgPath),
         err
       );
     }
@@ -9217,7 +9256,7 @@ async function discoverServices(scanPath) {
       scanPath,
       { maxDepth: parseScanDepth(), ig },
       async (dir) => {
-        if (await exists2(import_node_path23.default.join(dir, "package.json"))) {
+        if (await exists2(import_node_path24.default.join(dir, "package.json"))) {
           candidateDirs.push(dir);
         } else if (await hasPythonManifest(dir) || await hasGoManifest(dir) || await hasRubyManifest(dir) || await hasPhpManifest(dir) || await hasCsharpManifest(dir) || await hasJavaManifest(dir) || await hasRustManifest(dir) || await hasCppManifest(dir)) {
           candidateDirs.push(dir);
@@ -9245,8 +9284,8 @@ async function discoverServices(scanPath) {
     seenDirs.add(service.dir);
     const existingDir = seen.get(service.node.name);
     if (existingDir !== void 0) {
-      const a = import_node_path23.default.relative(scanPath, existingDir) || ".";
-      const b = import_node_path23.default.relative(scanPath, dir) || ".";
+      const a = import_node_path24.default.relative(scanPath, existingDir) || ".";
+      const b = import_node_path24.default.relative(scanPath, dir) || ".";
       console.warn(
         `[neat] duplicate package name "${service.node.name}" \u2014 keeping ${a}, ignoring ${b}`
       );
@@ -9260,14 +9299,14 @@ async function discoverServices(scanPath) {
     const owner = await computeServiceOwner(codeowners, service.node.repoPath, service.dir);
     if (owner !== void 0) service.node.owner = owner;
   }
-  const resolvedDirs = out.map((s) => import_node_path23.default.resolve(s.dir));
+  const resolvedDirs = out.map((s) => import_node_path24.default.resolve(s.dir));
   for (let i = 0; i < out.length; i++) {
     const self = resolvedDirs[i];
     const nested = [];
     for (let j = 0; j < out.length; j++) {
       if (i === j) continue;
       const other = resolvedDirs[j];
-      if (other.startsWith(self + import_node_path23.default.sep)) nested.push(other);
+      if (other.startsWith(self + import_node_path24.default.sep)) nested.push(other);
     }
     out[i].excludeDirs = nested;
   }
@@ -9294,8 +9333,8 @@ function addServiceNodes(graph, services) {
 
 // src/extract/aliases.ts
 init_cjs_shims();
-var import_node_path24 = __toESM(require("path"), 1);
-var import_node_fs22 = require("fs");
+var import_node_path25 = __toESM(require("path"), 1);
+var import_node_fs23 = require("fs");
 var import_yaml2 = require("yaml");
 var import_types20 = require("@neat.is/types");
 var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
@@ -9322,14 +9361,14 @@ function indexServicesByName(services) {
   const map = /* @__PURE__ */ new Map();
   for (const s of services) {
     map.set(s.node.name, s.node.id);
-    map.set(import_node_path24.default.basename(s.dir), s.node.id);
+    map.set(import_node_path25.default.basename(s.dir), s.node.id);
   }
   return map;
 }
 async function collectComposeAliases(graph, scanPath, serviceIndex) {
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = import_node_path24.default.join(scanPath, name);
+    const abs = import_node_path25.default.join(scanPath, name);
     if (await exists2(abs)) {
       composePath = abs;
       break;
@@ -9342,7 +9381,7 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
   } catch (err) {
     recordExtractionError(
       "aliases compose",
-      import_node_path24.default.relative(scanPath, composePath),
+      import_node_path25.default.relative(scanPath, composePath),
       err
     );
     return;
@@ -9385,11 +9424,11 @@ function parseDockerfileLabels(content) {
 }
 async function collectDockerfileAliases(graph, services) {
   for (const service of services) {
-    const dockerfilePath = import_node_path24.default.join(service.dir, "Dockerfile");
+    const dockerfilePath = import_node_path25.default.join(service.dir, "Dockerfile");
     if (!await exists2(dockerfilePath)) continue;
     let content;
     try {
-      content = await import_node_fs22.promises.readFile(dockerfilePath, "utf8");
+      content = await import_node_fs23.promises.readFile(dockerfilePath, "utf8");
     } catch (err) {
       recordExtractionError("aliases dockerfile", dockerfilePath, err);
       continue;
@@ -9401,15 +9440,15 @@ async function collectDockerfileAliases(graph, services) {
 async function walkYamlFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await import_node_fs22.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs23.promises.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = import_node_path24.default.join(start, entry.name);
+      const child = import_node_path25.default.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path24.default.extname(entry.name))) {
-      out.push(import_node_path24.default.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path25.default.extname(entry.name))) {
+      out.push(import_node_path25.default.join(start, entry.name));
     }
   }
   return out;
@@ -9436,7 +9475,7 @@ function k8sServiceTarget(doc, byName) {
 async function collectK8sAliases(graph, scanPath, serviceIndex) {
   const files = await walkYamlFiles(scanPath);
   for (const file of files) {
-    const content = await import_node_fs22.promises.readFile(file, "utf8");
+    const content = await import_node_fs23.promises.readFile(file, "utf8");
     let docs;
     try {
       docs = (0, import_yaml2.parseAllDocuments)(content).map((d) => d.toJSON());
@@ -9461,14 +9500,14 @@ async function addServiceAliases(graph, scanPath, services) {
 
 // src/extract/files.ts
 init_cjs_shims();
-var import_node_path25 = __toESM(require("path"), 1);
+var import_node_path26 = __toESM(require("path"), 1);
 async function addFiles(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
     const filePaths = await walkSourceFiles(service.dir, service.excludeDirs);
     for (const filePath of filePaths) {
-      const relPath = toPosix(import_node_path25.default.relative(service.dir, filePath));
+      const relPath = toPosix(import_node_path26.default.relative(service.dir, filePath));
       const { nodesAdded: n, edgesAdded: e } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -9484,7 +9523,7 @@ async function addFiles(graph, services) {
 
 // src/extract/symbols.ts
 init_cjs_shims();
-var import_node_path26 = __toESM(require("path"), 1);
+var import_node_path27 = __toESM(require("path"), 1);
 var import_tree_sitter3 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript3 = __toESM(require("tree-sitter-javascript"), 1);
 var import_tree_sitter_typescript = __toESM(require("tree-sitter-typescript"), 1);
@@ -10236,10 +10275,10 @@ async function addSymbols(graph, services) {
   for (const service of services) {
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
-      const ext = import_node_path26.default.extname(file.path);
+      const ext = import_node_path27.default.extname(file.path);
       const parser = parserForExt5(ext);
       if (!parser) continue;
-      const relPath = toPosix(import_node_path26.default.relative(service.dir, file.path));
+      const relPath = toPosix(import_node_path27.default.relative(service.dir, file.path));
       let defs;
       try {
         const tree = parseSource3(parser, file.content);
@@ -10299,7 +10338,7 @@ async function addSymbols(graph, services) {
 
 // src/extract/symbol-edges.ts
 init_cjs_shims();
-var import_node_path27 = __toESM(require("path"), 1);
+var import_node_path28 = __toESM(require("path"), 1);
 var import_tree_sitter4 = __toESM(require("tree-sitter"), 1);
 var import_types22 = require("@neat.is/types");
 function extendsInfo(classHeritage) {
@@ -10406,10 +10445,10 @@ async function addSymbolEdges(graph, services) {
     const tsPaths = await loadTsPathConfig(service.dir);
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
-      const parser = parserForExt5(import_node_path27.default.extname(file.path));
+      const parser = parserForExt5(import_node_path28.default.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(import_node_path27.default.relative(service.dir, file.path));
-      const fileDir = import_node_path27.default.dirname(file.path);
+      const relPath = toPosix(import_node_path28.default.relative(service.dir, file.path));
+      const fileDir = import_node_path28.default.dirname(file.path);
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -10544,7 +10583,7 @@ async function addSymbolEdges(graph, services) {
 
 // src/extract/actions.ts
 init_cjs_shims();
-var import_node_path28 = __toESM(require("path"), 1);
+var import_node_path29 = __toESM(require("path"), 1);
 var import_tree_sitter5 = __toESM(require("tree-sitter"), 1);
 var import_types23 = require("@neat.is/types");
 function stringLiteralText2(node) {
@@ -10691,9 +10730,9 @@ async function addServerActions(graph, services) {
     const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt5(import_node_path28.default.extname(file.path));
+      const parser = parserForExt5(import_node_path29.default.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(import_node_path28.default.relative(service.dir, file.path));
+      const relPath = toPosix(import_node_path29.default.relative(service.dir, file.path));
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -10754,10 +10793,10 @@ async function addServerActions(graph, services) {
     }
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt5(import_node_path28.default.extname(file.path));
+      const parser = parserForExt5(import_node_path29.default.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(import_node_path28.default.relative(service.dir, file.path));
-      const fileDir = import_node_path28.default.dirname(file.path);
+      const relPath = toPosix(import_node_path29.default.relative(service.dir, file.path));
+      const fileDir = import_node_path29.default.dirname(file.path);
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -10810,14 +10849,14 @@ async function addServerActions(graph, services) {
 
 // src/extract/databases/index.ts
 init_cjs_shims();
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_path38 = __toESM(require("path"), 1);
 var import_types24 = require("@neat.is/types");
 
 // src/extract/databases/db-config-yaml.ts
 init_cjs_shims();
-var import_node_path29 = __toESM(require("path"), 1);
+var import_node_path30 = __toESM(require("path"), 1);
 async function parse(serviceDir) {
-  const yamlPath = import_node_path29.default.join(serviceDir, "db-config.yaml");
+  const yamlPath = import_node_path30.default.join(serviceDir, "db-config.yaml");
   if (!await exists2(yamlPath)) return [];
   const raw = await readYaml(yamlPath);
   return [
@@ -10835,13 +10874,13 @@ var dbConfigYamlParser = { name: "db-config.yaml", parse };
 
 // src/extract/databases/dotenv.ts
 init_cjs_shims();
-var import_node_fs24 = require("fs");
-var import_node_path31 = __toESM(require("path"), 1);
+var import_node_fs25 = require("fs");
+var import_node_path32 = __toESM(require("path"), 1);
 
 // src/extract/databases/shared.ts
 init_cjs_shims();
-var import_node_fs23 = require("fs");
-var import_node_path30 = __toESM(require("path"), 1);
+var import_node_fs24 = require("fs");
+var import_node_path31 = __toESM(require("path"), 1);
 function schemeToEngine(scheme) {
   const s = scheme.toLowerCase().split("+")[0];
   switch (s) {
@@ -10880,18 +10919,18 @@ function parseConnectionString(url) {
 }
 async function readIfExists(filePath) {
   try {
-    return await import_node_fs23.promises.readFile(filePath, "utf8");
+    return await import_node_fs24.promises.readFile(filePath, "utf8");
   } catch {
     return null;
   }
 }
 async function resolveEnvVar(serviceDir, name) {
-  const entries = await import_node_fs23.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs24.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
   const envNames = entries.filter((e) => e.isFile() && (e.name === ".env" || e.name.startsWith(".env."))).map((e) => e.name);
   const rank = (n) => n === ".env.local" ? 0 : n === ".env" ? 1 : 2;
   envNames.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
   for (const fileName of envNames) {
-    const content = await readIfExists(import_node_path30.default.join(serviceDir, fileName));
+    const content = await readIfExists(import_node_path31.default.join(serviceDir, fileName));
     if (!content) continue;
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -10910,7 +10949,7 @@ async function resolveEnvVar(serviceDir, name) {
 }
 async function findFirst(serviceDir, candidates) {
   for (const rel of candidates) {
-    const abs = import_node_path30.default.join(serviceDir, rel);
+    const abs = import_node_path31.default.join(serviceDir, rel);
     const content = await readIfExists(abs);
     if (content !== null) return abs;
   }
@@ -10968,15 +11007,15 @@ function parseDotenvLine(line) {
   return { key, value };
 }
 async function parse2(serviceDir) {
-  const entries = await import_node_fs24.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs25.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
   const configs = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     const match = isConfigFile(entry.name);
     if (!match.match || match.fileType !== "env") continue;
-    const filePath = import_node_path31.default.join(serviceDir, entry.name);
-    const content = await import_node_fs24.promises.readFile(filePath, "utf8");
+    const filePath = import_node_path32.default.join(serviceDir, entry.name);
+    const content = await import_node_fs25.promises.readFile(filePath, "utf8");
     for (const line of content.split("\n")) {
       const parsed = parseDotenvLine(line);
       if (!parsed) continue;
@@ -10995,9 +11034,9 @@ var dotenvParser = { name: ".env", parse: parse2 };
 
 // src/extract/databases/prisma.ts
 init_cjs_shims();
-var import_node_path32 = __toESM(require("path"), 1);
+var import_node_path33 = __toESM(require("path"), 1);
 async function parse3(serviceDir) {
-  const schemaPath = import_node_path32.default.join(serviceDir, "prisma", "schema.prisma");
+  const schemaPath = import_node_path33.default.join(serviceDir, "prisma", "schema.prisma");
   const content = await readIfExists(schemaPath);
   if (!content) return [];
   const block = content.match(/datasource\s+\w+\s*\{([^}]*)\}/s);
@@ -11155,10 +11194,10 @@ var knexParser = { name: "knex", parse: parse5 };
 
 // src/extract/databases/ormconfig.ts
 init_cjs_shims();
-var import_node_path33 = __toESM(require("path"), 1);
+var import_node_path34 = __toESM(require("path"), 1);
 async function parse6(serviceDir) {
   for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
-    const abs = import_node_path33.default.join(serviceDir, candidate);
+    const abs = import_node_path34.default.join(serviceDir, candidate);
     if (!await exists2(abs)) continue;
     const raw = candidate.endsWith(".json") ? await readJson(abs) : await readYaml(abs);
     const entries = Array.isArray(raw) ? raw : [raw];
@@ -11218,9 +11257,9 @@ var typeormParser = { name: "typeorm", parse: parse7 };
 
 // src/extract/databases/sequelize.ts
 init_cjs_shims();
-var import_node_path34 = __toESM(require("path"), 1);
+var import_node_path35 = __toESM(require("path"), 1);
 async function parse8(serviceDir) {
-  const configPath = import_node_path34.default.join(serviceDir, "config", "config.json");
+  const configPath = import_node_path35.default.join(serviceDir, "config", "config.json");
   if (!await exists2(configPath)) return [];
   const raw = await readJson(configPath);
   const out = [];
@@ -11247,8 +11286,8 @@ var sequelizeParser = { name: "sequelize", parse: parse8 };
 
 // src/extract/databases/csharp.ts
 init_cjs_shims();
-var import_node_fs25 = require("fs");
-var import_node_path35 = __toESM(require("path"), 1);
+var import_node_fs26 = require("fs");
+var import_node_path36 = __toESM(require("path"), 1);
 var CS_EXT = ".cs";
 var NPGSQL_GATE = /\bUseNpgsql\b|\bNpgsql\b/;
 var REDIS_GATE = /\bConnectionMultiplexer\b|\bStackExchange\.Redis\b|\bConfigurationOptions\.Parse\b|\bAddStackExchangeRedisCache\b/;
@@ -11295,12 +11334,12 @@ function parseRedisEndpoint(raw) {
   return { host, port, database: "", engine: "redis", engineVersion: "unknown" };
 }
 async function resolveEnvUpTree(startDir, name) {
-  let dir = import_node_path35.default.resolve(startDir);
+  let dir = import_node_path36.default.resolve(startDir);
   for (let depth = 0; depth < 12; depth++) {
     const value = await resolveEnvVar(dir, name);
     if (value !== null) return value;
-    const atRepoRoot = await import_node_fs25.promises.access(import_node_path35.default.join(dir, ".git")).then(() => true).catch(() => false);
-    const parent = import_node_path35.default.dirname(dir);
+    const atRepoRoot = await import_node_fs26.promises.access(import_node_path36.default.join(dir, ".git")).then(() => true).catch(() => false);
+    const parent = import_node_path36.default.dirname(dir);
     if (atRepoRoot || parent === dir) break;
     dir = parent;
   }
@@ -11355,12 +11394,12 @@ async function resolveConfigs(literals, keys, serviceDir, looksLike, parse11) {
 }
 async function parse9(serviceDir) {
   const files = (await walkSourceFiles(serviceDir).catch(() => [])).filter(
-    (f) => import_node_path35.default.extname(f) === CS_EXT
+    (f) => import_node_path36.default.extname(f) === CS_EXT
   );
   if (files.length === 0) return [];
   const sources = [];
   for (const file of files) {
-    const content = await import_node_fs25.promises.readFile(file, "utf8").catch(() => null);
+    const content = await import_node_fs26.promises.readFile(file, "utf8").catch(() => null);
     if (content !== null) sources.push({ file, content });
   }
   let pgGateFile = null;
@@ -11401,7 +11440,7 @@ var csharpParser = { name: "csharp", parse: parse9 };
 
 // src/extract/databases/docker-compose.ts
 init_cjs_shims();
-var import_node_path36 = __toESM(require("path"), 1);
+var import_node_path37 = __toESM(require("path"), 1);
 function portFromService(svc) {
   for (const raw of svc.ports ?? []) {
     const str = String(raw);
@@ -11428,7 +11467,7 @@ function databaseFromEnv(svc) {
 }
 async function parse10(serviceDir) {
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = import_node_path36.default.join(serviceDir, name);
+    const abs = import_node_path37.default.join(serviceDir, name);
     if (!await exists2(abs)) continue;
     const raw = await readYaml(abs);
     if (!raw?.services) return [];
@@ -11601,7 +11640,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
           discoveredVia: mergedDiscoveredVia
         });
       }
-      const relConfigFile = toPosix(import_node_path37.default.relative(service.dir, config.sourceFile));
+      const relConfigFile = toPosix(import_node_path38.default.relative(service.dir, config.sourceFile));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -11610,7 +11649,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       );
       nodesAdded += fn;
       edgesAdded += fe;
-      const evidenceFile = toPosix(import_node_path37.default.relative(scanPath, config.sourceFile));
+      const evidenceFile = toPosix(import_node_path38.default.relative(scanPath, config.sourceFile));
       const edge = {
         id: (0, import_types3.extractedEdgeId)(fileNodeId, dbNode.id, import_types24.EdgeType.CONNECTS_TO),
         source: fileNodeId,
@@ -11631,15 +11670,15 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
     if (allConfigs.length === 1) {
       const primary = allConfigs[0];
       service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
-      const relPath = import_node_path37.default.relative(scanPath, primary.sourceFile);
+      const relPath = import_node_path38.default.relative(scanPath, primary.sourceFile);
       const cfgId = (0, import_types24.configId)(relPath);
       if (!graph.hasNode(cfgId)) {
         const cfgNode = {
           id: cfgId,
           type: import_types24.NodeType.ConfigNode,
-          name: import_node_path37.default.basename(primary.sourceFile),
+          name: import_node_path38.default.basename(primary.sourceFile),
           path: relPath,
-          fileType: isConfigFile(import_node_path37.default.basename(primary.sourceFile)).fileType || "config"
+          fileType: isConfigFile(import_node_path38.default.basename(primary.sourceFile)).fileType || "config"
         };
         graph.addNode(cfgId, cfgNode);
         nodesAdded++;
@@ -11680,19 +11719,19 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 
 // src/extract/configs.ts
 init_cjs_shims();
-var import_node_fs26 = require("fs");
-var import_node_path38 = __toESM(require("path"), 1);
+var import_node_fs27 = require("fs");
+var import_node_path39 = __toESM(require("path"), 1);
 var import_types25 = require("@neat.is/types");
 async function walkConfigFiles(dir, excludeDirs = []) {
-  const excluded = new Set(excludeDirs.map((d) => import_node_path38.default.resolve(d)));
+  const excluded = new Set(excludeDirs.map((d) => import_node_path39.default.resolve(d)));
   const out = [];
   async function walk11(current) {
-    const entries = await import_node_fs26.promises.readdir(current, { withFileTypes: true });
+    const entries = await import_node_fs27.promises.readdir(current, { withFileTypes: true });
     for (const entry of entries) {
-      const full = import_node_path38.default.join(current, entry.name);
+      const full = import_node_path39.default.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        if (excluded.has(import_node_path38.default.resolve(full))) continue;
+        if (excluded.has(import_node_path39.default.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk11(full);
       } else if (entry.isFile() && isConfigFile(entry.name).match) {
@@ -11709,19 +11748,19 @@ async function addConfigNodes(graph, services, scanPath) {
   for (const service of services) {
     const configFiles = await walkConfigFiles(service.dir, service.excludeDirs);
     for (const file of configFiles) {
-      const relPath = import_node_path38.default.relative(scanPath, file);
+      const relPath = import_node_path39.default.relative(scanPath, file);
       const node = {
         id: (0, import_types25.configId)(relPath),
         type: import_types25.NodeType.ConfigNode,
-        name: import_node_path38.default.basename(file),
+        name: import_node_path39.default.basename(file),
         path: relPath,
-        fileType: isConfigFile(import_node_path38.default.basename(file)).fileType
+        fileType: isConfigFile(import_node_path39.default.basename(file)).fileType
       };
       if (!graph.hasNode(node.id)) {
         graph.addNode(node.id, node);
         nodesAdded++;
       }
-      const relToService = toPosix(import_node_path38.default.relative(service.dir, file));
+      const relToService = toPosix(import_node_path39.default.relative(service.dir, file));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -11737,7 +11776,7 @@ async function addConfigNodes(graph, services, scanPath) {
         type: import_types25.EdgeType.CONFIGURED_BY,
         provenance: import_types25.Provenance.EXTRACTED,
         confidence: (0, import_types25.confidenceForExtracted)("structural"),
-        evidence: { file: relPath.split(import_node_path38.default.sep).join("/") }
+        evidence: { file: relPath.split(import_node_path39.default.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -11750,8 +11789,8 @@ async function addConfigNodes(graph, services, scanPath) {
 
 // src/extract/proto.ts
 init_cjs_shims();
-var import_node_fs27 = require("fs");
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_fs28 = require("fs");
+var import_node_path40 = __toESM(require("path"), 1);
 var import_types26 = require("@neat.is/types");
 var PROTO_EXTENSION = ".proto";
 function packageOf(content) {
@@ -11778,10 +11817,10 @@ function grpcMethodsFromProto(content, fqPackage) {
     }
     const body = content.slice(bodyStart, i - 1);
     const rpcRe = /\brpc\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/g;
-    let rm;
-    while ((rm = rpcRe.exec(body)) !== null) {
-      const rpcMethod = rm[1];
-      const line = lineAt(content, bodyStart + rm.index);
+    let rm2;
+    while ((rm2 = rpcRe.exec(body)) !== null) {
+      const rpcMethod = rm2[1];
+      const line = lineAt(content, bodyStart + rm2.index);
       out.push({ rpcService, rpcMethod, line });
     }
     serviceRe.lastIndex = i;
@@ -11789,18 +11828,18 @@ function grpcMethodsFromProto(content, fqPackage) {
   return out;
 }
 async function walkProtoFiles(dir, excludeDirs = []) {
-  const excluded = new Set(excludeDirs.map((d) => import_node_path39.default.resolve(d)));
+  const excluded = new Set(excludeDirs.map((d) => import_node_path40.default.resolve(d)));
   const out = [];
   async function walk11(current) {
-    const entries = await import_node_fs27.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await import_node_fs28.promises.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      const full = import_node_path39.default.join(current, entry.name);
+      const full = import_node_path40.default.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
-        if (excluded.has(import_node_path39.default.resolve(full))) continue;
+        if (excluded.has(import_node_path40.default.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk11(full);
-      } else if (entry.isFile() && import_node_path39.default.extname(entry.name) === PROTO_EXTENSION) {
+      } else if (entry.isFile() && import_node_path40.default.extname(entry.name) === PROTO_EXTENSION) {
         out.push(full);
       }
     }
@@ -11815,10 +11854,10 @@ async function addGrpcMethods(graph, services) {
     const protoPaths = await walkProtoFiles(service.dir, service.excludeDirs);
     for (const protoPath of protoPaths) {
       if (isTestPath(protoPath)) continue;
-      const relFile = toPosix(import_node_path39.default.relative(service.dir, protoPath));
+      const relFile = toPosix(import_node_path40.default.relative(service.dir, protoPath));
       let content;
       try {
-        content = await import_node_fs27.promises.readFile(protoPath, "utf8");
+        content = await import_node_fs28.promises.readFile(protoPath, "utf8");
       } catch (err) {
         recordExtractionError("proto extraction", protoPath, err);
         continue;
@@ -11877,7 +11916,7 @@ var import_types46 = require("@neat.is/types");
 
 // src/extract/calls/http.ts
 init_cjs_shims();
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_path41 = __toESM(require("path"), 1);
 var import_tree_sitter6 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript4 = __toESM(require("tree-sitter-javascript"), 1);
 var import_tree_sitter_typescript2 = __toESM(require("tree-sitter-typescript"), 1);
@@ -11960,7 +11999,7 @@ async function addHttpCallEdges(graph, services) {
     const seen = /* @__PURE__ */ new Set();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt(import_node_path40.default.extname(file.path), parserCache);
+      const parser = parserForExt(import_node_path41.default.extname(file.path), parserCache);
       let sites;
       try {
         sites = callsFromSource(file.content, parser, knownHosts);
@@ -11969,7 +12008,7 @@ async function addHttpCallEdges(graph, services) {
         continue;
       }
       if (sites.length === 0) continue;
-      const relFile = toPosix(import_node_path40.default.relative(service.dir, file.path));
+      const relFile = toPosix(import_node_path41.default.relative(service.dir, file.path));
       for (const site of sites) {
         const targetId = hostToNodeId.get(site.host);
         if (!targetId || targetId === service.node.id) continue;
@@ -12023,7 +12062,7 @@ async function addHttpCallEdges(graph, services) {
 
 // src/extract/calls/route-match.ts
 init_cjs_shims();
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
 var import_tree_sitter7 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript5 = __toESM(require("tree-sitter-javascript"), 1);
 var import_types28 = require("@neat.is/types");
@@ -12301,7 +12340,7 @@ async function addRouteCallEdges(graph, services) {
     const seen = /* @__PURE__ */ new Set();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      if (!JS_CLIENT_EXTENSIONS.has(import_node_path41.default.extname(file.path))) continue;
+      if (!JS_CLIENT_EXTENSIONS.has(import_node_path42.default.extname(file.path))) continue;
       let sites;
       try {
         sites = clientCallSitesFromSource(file.content, jsParser, knownHosts);
@@ -12310,7 +12349,7 @@ async function addRouteCallEdges(graph, services) {
         continue;
       }
       if (sites.length === 0) continue;
-      const relFile = toPosix(import_node_path41.default.relative(service.dir, file.path));
+      const relFile = toPosix(import_node_path42.default.relative(service.dir, file.path));
       for (const site of sites) {
         if (site.host === null) {
           const dedupKey2 = `${relFile}|unresolved-host`;
@@ -12403,7 +12442,7 @@ async function addRouteCallEdges(graph, services) {
 
 // src/extract/calls/kafka.ts
 init_cjs_shims();
-var import_node_path42 = __toESM(require("path"), 1);
+var import_node_path43 = __toESM(require("path"), 1);
 var import_types29 = require("@neat.is/types");
 var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
 var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
@@ -12491,13 +12530,13 @@ function kafkaEndpointsFromFile(file, serviceDir) {
       // call sites — verified-call-site tier (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path42.default.relative(serviceDir, file.path),
+        file: import_node_path43.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
     });
   };
-  if (import_node_path42.default.extname(file.path) === ".go") {
+  if (import_node_path43.default.extname(file.path) === ".go") {
     goSaramaEndpoints(file.content, make);
   } else {
     for (const { topic } of findAll(PRODUCER_TOPIC_RE, file.content)) make(topic, "PUBLISHES_TO");
@@ -12508,7 +12547,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/redis.ts
 init_cjs_shims();
-var import_node_path43 = __toESM(require("path"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 var import_types30 = require("@neat.is/types");
 var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
 function redisEndpointsFromFile(file, serviceDir) {
@@ -12531,7 +12570,7 @@ function redisEndpointsFromFile(file, serviceDir) {
       // support tier (ADR-066).
       confidenceKind: "url-with-structural-support",
       evidence: {
-        file: import_node_path43.default.relative(serviceDir, file.path),
+        file: import_node_path44.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12542,7 +12581,7 @@ function redisEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/aws.ts
 init_cjs_shims();
-var import_node_path44 = __toESM(require("path"), 1);
+var import_node_path45 = __toESM(require("path"), 1);
 var import_types31 = require("@neat.is/types");
 var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
 var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
@@ -12576,7 +12615,7 @@ function awsEndpointsFromFile(file, serviceDir) {
       // (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path44.default.relative(serviceDir, file.path),
+        file: import_node_path45.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12601,7 +12640,7 @@ function awsEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/grpc.ts
 init_cjs_shims();
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 var import_types32 = require("@neat.is/types");
 var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
 var AWS_SDK_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@aws-sdk\/client-([a-z0-9-]+)['"`]/g;
@@ -12660,7 +12699,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path45.default.relative(serviceDir, file.path),
+        file: import_node_path46.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12671,7 +12710,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/supabase.ts
 init_cjs_shims();
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_path47 = __toESM(require("path"), 1);
 var import_types33 = require("@neat.is/types");
 var SUPABASE_JS_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/supabase-js['"`]/;
 var SUPABASE_SSR_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/ssr['"`]/;
@@ -12730,7 +12769,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066), the same grade aws.ts / grpc.ts emit at.
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path46.default.relative(serviceDir, file.path),
+        file: import_node_path47.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12757,7 +12796,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
         edgeType: "CALLS",
         confidenceKind: "verified-call-site",
         evidence: {
-          file: import_node_path46.default.relative(serviceDir, file.path),
+          file: import_node_path47.default.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -12769,7 +12808,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/firestore.ts
 init_cjs_shims();
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_path48 = __toESM(require("path"), 1);
 var import_tree_sitter8 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript6 = __toESM(require("tree-sitter-javascript"), 1);
 var import_types34 = require("@neat.is/types");
@@ -12942,7 +12981,7 @@ function firestoreEndpointsFromFile(file, serviceDir, imported) {
   if (!hasClient && !hasAdmin && importedNames.size === 0) return [];
   const ownSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
   const fileSdk = !hasClient && !hasAdmin ? imported?.sdk ?? null : ownSdk;
-  const tree = parseSource3(parserForExt2(import_node_path47.default.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt2(import_node_path48.default.extname(file.path)), file.content);
   const clientVars = firestoreClientVars(tree.rootNode);
   for (const n of importedNames) clientVars.add(n);
   const collLine = /* @__PURE__ */ new Map();
@@ -13047,7 +13086,7 @@ function firestoreEndpointsFromFile(file, serviceDir, imported) {
       ...columnSet.size > 0 ? { columns: [...columnSet] } : {},
       ...sdkWrites ? { sdkWrites } : {},
       evidence: {
-        file: import_node_path47.default.relative(serviceDir, file.path),
+        file: import_node_path48.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13107,7 +13146,7 @@ function sdkOf(content) {
   return hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
 }
 function parseOrNull(file) {
-  const ext = import_node_path47.default.extname(file.path);
+  const ext = import_node_path48.default.extname(file.path);
   if (!(ext in GRAMMAR_BY_EXT)) return null;
   try {
     return parseSource3(parserForExt2(ext), file.content).rootNode;
@@ -13123,7 +13162,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
     if (!root) continue;
     const names = exportedFirestoreClients(root);
     if (names.size === 0) continue;
-    registry.set(toPosix(import_node_path47.default.relative(serviceDir, f.path)), { names, sdk: sdkOf(f.content) });
+    registry.set(toPosix(import_node_path48.default.relative(serviceDir, f.path)), { names, sdk: sdkOf(f.content) });
   }
   if (registry.size === 0) return [];
   const out = [];
@@ -13136,7 +13175,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
     const names = /* @__PURE__ */ new Set();
     let sdk = null;
     for (const b of bindings) {
-      const rel = await resolveJsImport(b.specifier, import_node_path47.default.dirname(f.path), serviceDir, null);
+      const rel = await resolveJsImport(b.specifier, import_node_path48.default.dirname(f.path), serviceDir, null);
       if (!rel) continue;
       const entry = registry.get(rel);
       if (!entry || !entry.names.has(b.imported)) continue;
@@ -13151,7 +13190,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
 
 // src/extract/calls/mongoose.ts
 init_cjs_shims();
-var import_node_path48 = __toESM(require("path"), 1);
+var import_node_path49 = __toESM(require("path"), 1);
 var import_types35 = require("@neat.is/types");
 var MONGOOSE_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongoose['"`]/;
 var MONGODB_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongodb['"`]/;
@@ -13302,7 +13341,7 @@ function endpoint(r, file, serviceDir, matchText) {
     kind: r.kind,
     edgeType: "CALLS",
     confidenceKind: "verified-call-site",
-    evidence: { file: import_node_path48.default.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
+    evidence: { file: import_node_path49.default.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
   };
 }
 function mongooseEndpointsFromFile(file, serviceDir) {
@@ -13392,7 +13431,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
   const registry = /* @__PURE__ */ new Map();
   for (const f of mongooseFiles) {
     const fx = fileExportsOf(f.content, pluralizeOn);
-    if (fx) registry.set(toPosix(import_node_path48.default.relative(serviceDir, f.path)), fx);
+    if (fx) registry.set(toPosix(import_node_path49.default.relative(serviceDir, f.path)), fx);
   }
   if (registry.size === 0) return [];
   const out = [];
@@ -13403,7 +13442,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
     const directColl = /* @__PURE__ */ new Map();
     const nsExports = /* @__PURE__ */ new Map();
     for (const b of bindings) {
-      const resolvedRel = await resolveJsImport(b.specifier, import_node_path48.default.dirname(f.path), serviceDir, null);
+      const resolvedRel = await resolveJsImport(b.specifier, import_node_path49.default.dirname(f.path), serviceDir, null);
       if (!resolvedRel) continue;
       const fx = registry.get(resolvedRel);
       if (!fx) continue;
@@ -13447,7 +13486,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
 
 // src/extract/calls/sqlalchemy.ts
 init_cjs_shims();
-var import_node_path49 = __toESM(require("path"), 1);
+var import_node_path50 = __toESM(require("path"), 1);
 var import_tree_sitter9 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_python5 = __toESM(require("tree-sitter-python"), 1);
 var import_types36 = require("@neat.is/types");
@@ -13586,7 +13625,7 @@ function sqlalchemyForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: import_node_path49.default.relative(serviceDir, file.path),
+          file: import_node_path50.default.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -13611,7 +13650,7 @@ function sqlalchemyEndpointsFromFile(file, serviceDir) {
       confidenceKind: "verified-call-site",
       ...columns && columns.length > 0 ? { columns } : {},
       evidence: {
-        file: import_node_path49.default.relative(serviceDir, file.path),
+        file: import_node_path50.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13718,7 +13757,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
         edgeType: "CALLS",
         confidenceKind: "verified-call-site",
         evidence: {
-          file: import_node_path49.default.relative(serviceDir, file.path),
+          file: import_node_path50.default.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -13730,7 +13769,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
 
 // src/extract/calls/socket.ts
 init_cjs_shims();
-var import_node_path50 = __toESM(require("path"), 1);
+var import_node_path51 = __toESM(require("path"), 1);
 var import_tree_sitter10 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_python6 = __toESM(require("tree-sitter-python"), 1);
 var import_types37 = require("@neat.is/types");
@@ -13806,7 +13845,7 @@ function socketEndpointsFromFile(file, serviceDir) {
       // A verified `socket.socket(...)` + `.connect((host, port))` call site.
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path50.default.relative(serviceDir, file.path),
+        file: import_node_path51.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13817,7 +13856,7 @@ function socketEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/django-orm.ts
 init_cjs_shims();
-var import_node_path51 = __toESM(require("path"), 1);
+var import_node_path52 = __toESM(require("path"), 1);
 var import_tree_sitter11 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_python7 = __toESM(require("tree-sitter-python"), 1);
 var import_types38 = require("@neat.is/types");
@@ -13887,7 +13926,7 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
   const tree = parseSource8(makePyParser5(), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const defaultAppLabel = import_node_path51.default.basename(import_node_path51.default.dirname(file.path));
+  const defaultAppLabel = import_node_path52.default.basename(import_node_path52.default.dirname(file.path));
   walk5(tree.rootNode, (node) => {
     if (node.type !== "class_definition") return;
     if (!extendsDjangoModel(node)) return;
@@ -13905,7 +13944,7 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
       kind: "sql-table",
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
-      evidence: { file: import_node_path51.default.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
+      evidence: { file: import_node_path52.default.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
     });
   });
   return out;
@@ -13913,7 +13952,7 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/drizzle.ts
 init_cjs_shims();
-var import_node_path52 = __toESM(require("path"), 1);
+var import_node_path53 = __toESM(require("path"), 1);
 var import_tree_sitter12 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript7 = __toESM(require("tree-sitter-javascript"), 1);
 var import_types39 = require("@neat.is/types");
@@ -13991,7 +14030,7 @@ function columnsFromObject(obj) {
 }
 function drizzleEndpointsFromFile(file, serviceDir) {
   if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt3(import_node_path52.default.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt3(import_node_path53.default.extname(file.path)), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const walk11 = (node) => {
@@ -14014,7 +14053,7 @@ function drizzleEndpointsFromFile(file, serviceDir) {
             confidenceKind: "structural",
             columns,
             evidence: {
-              file: import_node_path52.default.relative(serviceDir, file.path),
+              file: import_node_path53.default.relative(serviceDir, file.path),
               line,
               snippet: snippet(file.content, line)
             }
@@ -14080,7 +14119,7 @@ function referencesTargetVar(call) {
 }
 function drizzleForeignKeys(file, serviceDir) {
   if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt3(import_node_path52.default.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt3(import_node_path53.default.extname(file.path)), file.content);
   const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -14099,7 +14138,7 @@ function drizzleForeignKeys(file, serviceDir) {
               childTable: table.tableName,
               parentTable,
               evidence: {
-                file: import_node_path52.default.relative(serviceDir, file.path),
+                file: import_node_path53.default.relative(serviceDir, file.path),
                 line,
                 snippet: snippet(file.content, line)
               }
@@ -14116,7 +14155,7 @@ function drizzleForeignKeys(file, serviceDir) {
 
 // src/extract/calls/prisma.ts
 init_cjs_shims();
-var import_node_path53 = __toESM(require("path"), 1);
+var import_node_path54 = __toESM(require("path"), 1);
 var import_types40 = require("@neat.is/types");
 var SCALAR_TYPES = /* @__PURE__ */ new Set([
   "Int",
@@ -14172,7 +14211,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
       confidenceKind: "structural",
       columns: b.columns,
       evidence: {
-        file: import_node_path53.default.relative(serviceDir, file.path),
+        file: import_node_path54.default.relative(serviceDir, file.path),
         line: b.startLine,
         snippet: snippet(content, b.startLine)
       }
@@ -14233,7 +14272,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
 }
 async function prismaColumnEndpoints(serviceDir) {
   const schemaPath = await findFirst(serviceDir, [
-    import_node_path53.default.join("prisma", "schema.prisma"),
+    import_node_path54.default.join("prisma", "schema.prisma"),
     "schema.prisma"
   ]);
   if (!schemaPath) return [];
@@ -14308,7 +14347,7 @@ function prismaForeignKeysFromSchema(file, serviceDir) {
               childTable: current.table,
               parentTable,
               evidence: {
-                file: import_node_path53.default.relative(serviceDir, file.path),
+                file: import_node_path54.default.relative(serviceDir, file.path),
                 line: lineNo,
                 snippet: snippet(content, lineNo)
               }
@@ -14323,7 +14362,7 @@ function prismaForeignKeysFromSchema(file, serviceDir) {
 }
 async function prismaForeignKeys(serviceDir) {
   const schemaPath = await findFirst(serviceDir, [
-    import_node_path53.default.join("prisma", "schema.prisma"),
+    import_node_path54.default.join("prisma", "schema.prisma"),
     "schema.prisma"
   ]);
   if (!schemaPath) return [];
@@ -14334,7 +14373,7 @@ async function prismaForeignKeys(serviceDir) {
 
 // src/extract/calls/activerecord.ts
 init_cjs_shims();
-var import_node_path54 = __toESM(require("path"), 1);
+var import_node_path55 = __toESM(require("path"), 1);
 var import_tree_sitter13 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_ruby3 = __toESM(require("tree-sitter-ruby"), 1);
 var import_types41 = require("@neat.is/types");
@@ -14542,7 +14581,7 @@ function railsSchemaEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...table.columns.length > 0 ? { columns: table.columns } : {},
       evidence: {
-        file: import_node_path54.default.relative(serviceDir, file.path),
+        file: import_node_path55.default.relative(serviceDir, file.path),
         line: table.line,
         snippet: snippet(file.content, table.line)
       }
@@ -14564,7 +14603,7 @@ function railsSchemaForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: import_node_path54.default.relative(serviceDir, file.path),
+        file: import_node_path55.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -14647,7 +14686,7 @@ function railsModelEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path54.default.relative(serviceDir, file.path),
+        file: import_node_path55.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -14684,7 +14723,7 @@ function railsModelForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: import_node_path54.default.relative(serviceDir, file.path),
+          file: import_node_path55.default.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -14696,7 +14735,7 @@ function railsModelForeignKeys(file, serviceDir) {
 
 // src/extract/calls/eloquent.ts
 init_cjs_shims();
-var import_node_path55 = __toESM(require("path"), 1);
+var import_node_path56 = __toESM(require("path"), 1);
 var import_tree_sitter14 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_php3 = __toESM(require("tree-sitter-php"), 1);
 var import_types42 = require("@neat.is/types");
@@ -14953,7 +14992,7 @@ function laravelMigrationEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: import_node_path55.default.relative(serviceDir, file.path),
+        file: import_node_path56.default.relative(serviceDir, file.path),
         line: bp.line,
         snippet: snippet(file.content, bp.line)
       }
@@ -14975,7 +15014,7 @@ function laravelMigrationForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: import_node_path55.default.relative(serviceDir, file.path),
+        file: import_node_path56.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -15095,7 +15134,7 @@ function laravelModelEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
       evidence: {
-        file: import_node_path55.default.relative(serviceDir, file.path),
+        file: import_node_path56.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -15131,7 +15170,7 @@ function laravelModelForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: import_node_path55.default.relative(serviceDir, file.path),
+          file: import_node_path56.default.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -15143,7 +15182,7 @@ function laravelModelForeignKeys(file, serviceDir) {
 
 // src/extract/calls/go.ts
 init_cjs_shims();
-var import_node_path58 = __toESM(require("path"), 1);
+var import_node_path59 = __toESM(require("path"), 1);
 var import_tree_sitter15 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_go4 = __toESM(require("tree-sitter-go"), 1);
 var import_types43 = require("@neat.is/types");
@@ -15218,7 +15257,7 @@ function firstStringLiteralArg(argsNode) {
   return null;
 }
 function goSqlEndpointsFromFile(file, serviceDir) {
-  if (import_node_path58.default.extname(file.path) !== ".go") return [];
+  if (import_node_path59.default.extname(file.path) !== ".go") return [];
   if (!file.content.includes(DATABASE_SQL_IMPORT) && !file.content.includes(SQLX_IMPORT)) return [];
   const tree = parseSource11(makeGoParser3(), file.content);
   const importsDatabaseSql = goImportsAny(tree.rootNode, /* @__PURE__ */ new Set([DATABASE_SQL_IMPORT]));
@@ -15247,7 +15286,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
       confidenceKind: "verified-call-site",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: toPosix(import_node_path58.default.relative(serviceDir, file.path)),
+        file: toPosix(import_node_path59.default.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -15258,7 +15297,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
 
 // src/extract/calls/gorm.ts
 init_cjs_shims();
-var import_node_path59 = __toESM(require("path"), 1);
+var import_node_path60 = __toESM(require("path"), 1);
 var import_tree_sitter16 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_go5 = __toESM(require("tree-sitter-go"), 1);
 var import_types44 = require("@neat.is/types");
@@ -15691,7 +15730,7 @@ function collectColumns(struct, structs, seen, prefix, out, emitted) {
   seen.delete(struct.name);
 }
 function gormEndpointsFromFile(file, serviceDir) {
-  if (import_node_path59.default.extname(file.path) !== ".go") return [];
+  if (import_node_path60.default.extname(file.path) !== ".go") return [];
   if (!GORM_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource12(makeGoParser4(), file.content);
   const { structs, models, tableFor } = analyze(tree);
@@ -15713,7 +15752,7 @@ function gormEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: toPosix(import_node_path59.default.relative(serviceDir, file.path)),
+        file: toPosix(import_node_path60.default.relative(serviceDir, file.path)),
         line: struct.line,
         snippet: snippet(file.content, struct.line)
       }
@@ -15722,7 +15761,7 @@ function gormEndpointsFromFile(file, serviceDir) {
   return out;
 }
 function gormForeignKeys(file, serviceDir) {
-  if (import_node_path59.default.extname(file.path) !== ".go") return [];
+  if (import_node_path60.default.extname(file.path) !== ".go") return [];
   if (!GORM_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource12(makeGoParser4(), file.content);
   const { structs, models, tableFor } = analyze(tree);
@@ -15737,7 +15776,7 @@ function gormForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: toPosix(import_node_path59.default.relative(serviceDir, file.path)),
+        file: toPosix(import_node_path60.default.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -15774,7 +15813,7 @@ function gormForeignKeys(file, serviceDir) {
 
 // src/extract/calls/efcore.ts
 init_cjs_shims();
-var import_node_path60 = __toESM(require("path"), 1);
+var import_node_path61 = __toESM(require("path"), 1);
 var import_tree_sitter17 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_c_sharp2 = __toESM(require("tree-sitter-c-sharp"), 1);
 var import_types45 = require("@neat.is/types");
@@ -15853,7 +15892,7 @@ function tableFromToTable(call) {
   return value ? csStringLiteral(value) : null;
 }
 function efcoreEndpointsFromFile(file, serviceDir) {
-  if (import_node_path60.default.extname(file.path) !== ".cs") return [];
+  if (import_node_path61.default.extname(file.path) !== ".cs") return [];
   if (!EFCORE_GATE.test(file.content)) return [];
   const tree = parseSource13(makeCsParser(), file.content);
   const out = [];
@@ -15868,7 +15907,7 @@ function efcoreEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "structural",
       evidence: {
-        file: toPosix(import_node_path60.default.relative(serviceDir, file.path)),
+        file: toPosix(import_node_path61.default.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -16123,7 +16162,7 @@ init_cjs_shims();
 
 // src/extract/infra/docker-compose.ts
 init_cjs_shims();
-var import_node_path61 = __toESM(require("path"), 1);
+var import_node_path62 = __toESM(require("path"), 1);
 var import_types49 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
@@ -16194,7 +16233,7 @@ function dependsOnList(value) {
 }
 function serviceNameToServiceNode(name, services) {
   for (const s of services) {
-    if (s.node.name === name || import_node_path61.default.basename(s.dir) === name) return s.node.id;
+    if (s.node.name === name || import_node_path62.default.basename(s.dir) === name) return s.node.id;
   }
   return null;
 }
@@ -16203,7 +16242,7 @@ async function addComposeInfra(graph, scanPath, services) {
   let edgesAdded = 0;
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = import_node_path61.default.join(scanPath, name);
+    const abs = import_node_path62.default.join(scanPath, name);
     if (await exists2(abs)) {
       composePath = abs;
       break;
@@ -16216,13 +16255,13 @@ async function addComposeInfra(graph, scanPath, services) {
   } catch (err) {
     recordExtractionError(
       "infra docker-compose",
-      import_node_path61.default.relative(scanPath, composePath),
+      import_node_path62.default.relative(scanPath, composePath),
       err
     );
     return { nodesAdded, edgesAdded };
   }
   if (!compose?.services) return { nodesAdded, edgesAdded };
-  const evidenceFile = import_node_path61.default.relative(scanPath, composePath).split(import_node_path61.default.sep).join("/");
+  const evidenceFile = import_node_path62.default.relative(scanPath, composePath).split(import_node_path62.default.sep).join("/");
   const composeNameToNodeId = /* @__PURE__ */ new Map();
   for (const [composeName, svc] of Object.entries(compose.services)) {
     const matchedServiceId = serviceNameToServiceNode(composeName, services);
@@ -16264,8 +16303,8 @@ async function addComposeInfra(graph, scanPath, services) {
 
 // src/extract/infra/dockerfile.ts
 init_cjs_shims();
-var import_node_path62 = __toESM(require("path"), 1);
-var import_node_fs28 = require("fs");
+var import_node_path63 = __toESM(require("path"), 1);
+var import_node_fs29 = require("fs");
 var import_types50 = require("@neat.is/types");
 function readDockerfile(content) {
   let image = null;
@@ -16295,15 +16334,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const dockerfilePath = import_node_path62.default.join(service.dir, "Dockerfile");
+    const dockerfilePath = import_node_path63.default.join(service.dir, "Dockerfile");
     if (!await exists2(dockerfilePath)) continue;
     let content;
     try {
-      content = await import_node_fs28.promises.readFile(dockerfilePath, "utf8");
+      content = await import_node_fs29.promises.readFile(dockerfilePath, "utf8");
     } catch (err) {
       recordExtractionError(
         "infra dockerfile",
-        import_node_path62.default.relative(scanPath, dockerfilePath),
+        import_node_path63.default.relative(scanPath, dockerfilePath),
         err
       );
       continue;
@@ -16315,8 +16354,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
-    const relDockerfile = toPosix(import_node_path62.default.relative(service.dir, dockerfilePath));
-    const evidenceFile = toPosix(import_node_path62.default.relative(scanPath, dockerfilePath));
+    const relDockerfile = toPosix(import_node_path63.default.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix(import_node_path63.default.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -16368,23 +16407,23 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 
 // src/extract/infra/terraform.ts
 init_cjs_shims();
-var import_node_fs29 = require("fs");
-var import_node_path63 = __toESM(require("path"), 1);
+var import_node_fs30 = require("fs");
+var import_node_path64 = __toESM(require("path"), 1);
 var import_types51 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await import_node_fs29.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs30.promises.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
-      const child = import_node_path63.default.join(start, entry.name);
+      const child = import_node_path64.default.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry.isFile() && entry.name.endsWith(".tf")) {
-      out.push(import_node_path63.default.join(start, entry.name));
+      out.push(import_node_path64.default.join(start, entry.name));
     }
   }
   return out;
@@ -16415,8 +16454,8 @@ async function addTerraformResources(graph, scanPath) {
   let edgesAdded = 0;
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
-    const content = await import_node_fs29.promises.readFile(file, "utf8");
-    const evidenceFile = toPosix(import_node_path63.default.relative(scanPath, file));
+    const content = await import_node_fs30.promises.readFile(file, "utf8");
+    const evidenceFile = toPosix(import_node_path64.default.relative(scanPath, file));
     const resources = [];
     const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
@@ -16473,8 +16512,8 @@ async function addTerraformResources(graph, scanPath) {
 
 // src/extract/infra/k8s.ts
 init_cjs_shims();
-var import_node_fs30 = require("fs");
-var import_node_path64 = __toESM(require("path"), 1);
+var import_node_fs31 = require("fs");
+var import_node_path65 = __toESM(require("path"), 1);
 var import_yaml3 = require("yaml");
 var import_types52 = require("@neat.is/types");
 var K8S_KIND_TO_INFRA_KIND = {
@@ -16490,15 +16529,15 @@ var WORKLOAD_KINDS = /* @__PURE__ */ new Set(["Deployment", "StatefulSet", "Daem
 async function walkYamlFiles2(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await import_node_fs30.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await import_node_fs31.promises.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = import_node_path64.default.join(start, entry.name);
+      const child = import_node_path65.default.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles2(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path64.default.extname(entry.name))) {
-      out.push(import_node_path64.default.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path65.default.extname(entry.name))) {
+      out.push(import_node_path65.default.join(start, entry.name));
     }
   }
   return out;
@@ -16508,14 +16547,14 @@ async function addK8sResources(graph, scanPath) {
   let edgesAdded = 0;
   const files = await walkYamlFiles2(scanPath);
   for (const file of files) {
-    const content = await import_node_fs30.promises.readFile(file, "utf8");
+    const content = await import_node_fs31.promises.readFile(file, "utf8");
     let docs;
     try {
       docs = (0, import_yaml3.parseAllDocuments)(content).map((d) => d.toJSON());
     } catch {
       continue;
     }
-    const relFile = toPosix(import_node_path64.default.relative(scanPath, file));
+    const relFile = toPosix(import_node_path65.default.relative(scanPath, file));
     for (const doc of docs) {
       if (!doc?.kind || !doc.metadata?.name) continue;
       const infraKind = K8S_KIND_TO_INFRA_KIND[doc.kind];
@@ -16564,16 +16603,16 @@ async function addK8sResources(graph, scanPath) {
 
 // src/extract/infra/cloudflare.ts
 init_cjs_shims();
-var import_node_fs31 = require("fs");
-var import_node_path65 = __toESM(require("path"), 1);
+var import_node_fs32 = require("fs");
+var import_node_path66 = __toESM(require("path"), 1);
 var import_smol_toml3 = require("smol-toml");
 var import_types53 = require("@neat.is/types");
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
-    const abs = import_node_path65.default.join(dir, filename);
+    const abs = import_node_path66.default.join(dir, filename);
     if (!await exists2(abs)) continue;
-    const raw = await import_node_fs31.promises.readFile(abs, "utf8");
+    const raw = await import_node_fs32.promises.readFile(abs, "utf8");
     const config = filename === "wrangler.toml" ? (0, import_smol_toml3.parse)(raw) : JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
@@ -16634,11 +16673,11 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     try {
       read = await readWranglerConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra cloudflare", import_node_path65.default.relative(scanPath, service.dir), err);
+      recordExtractionError("infra cloudflare", import_node_path66.default.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read || !read.config.name) continue;
-    const evidenceFile = toPosix(import_node_path65.default.relative(scanPath, import_node_path65.default.join(service.dir, read.relFile)));
+    const evidenceFile = toPosix(import_node_path66.default.relative(scanPath, import_node_path66.default.join(service.dir, read.relFile)));
     discovered.push({ service, config: read.config, relFile: read.relFile, raw: read.raw, evidenceFile });
   }
   for (const worker of discovered) {
@@ -16650,7 +16689,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     }
     let anchorId = service.node.id;
     if (config.main) {
-      const entryRelPath = toPosix(import_node_path65.default.normalize(config.main));
+      const entryRelPath = toPosix(import_node_path66.default.normalize(config.main));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -16797,24 +16836,24 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 
 // src/extract/infra/vercel.ts
 init_cjs_shims();
-var import_node_fs32 = require("fs");
-var import_node_path66 = __toESM(require("path"), 1);
+var import_node_fs33 = require("fs");
+var import_node_path67 = __toESM(require("path"), 1);
 var import_types54 = require("@neat.is/types");
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
-    const abs = import_node_path66.default.join(dir, filename);
+    const abs = import_node_path67.default.join(dir, filename);
     if (!await exists2(abs)) continue;
-    const raw = await import_node_fs32.promises.readFile(abs, "utf8");
+    const raw = await import_node_fs33.promises.readFile(abs, "utf8");
     const config = JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
   return null;
 }
 async function readLinkedProjectName(dir) {
-  const abs = import_node_path66.default.join(dir, ".vercel", "project.json");
+  const abs = import_node_path67.default.join(dir, ".vercel", "project.json");
   if (!await exists2(abs)) return void 0;
-  const parsed = JSON.parse(await import_node_fs32.promises.readFile(abs, "utf8"));
+  const parsed = JSON.parse(await import_node_fs33.promises.readFile(abs, "utf8"));
   return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
 }
 function routeSource(route) {
@@ -16830,7 +16869,7 @@ async function addVercelServices(graph, services, scanPath) {
       read = await readVercelConfig(service.dir);
       projectName = await readLinkedProjectName(service.dir);
     } catch (err) {
-      recordExtractionError("infra vercel", import_node_path66.default.relative(scanPath, service.dir), err);
+      recordExtractionError("infra vercel", import_node_path67.default.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read && !projectName) continue;
@@ -16846,7 +16885,7 @@ async function addVercelServices(graph, services, scanPath) {
     const anchorId = service.node.id;
     if (!read) continue;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix(import_node_path66.default.relative(scanPath, import_node_path66.default.join(service.dir, relFile)));
+    const evidenceFile = toPosix(import_node_path67.default.relative(scanPath, import_node_path67.default.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -16875,16 +16914,16 @@ async function addVercelServices(graph, services, scanPath) {
 
 // src/extract/infra/railway.ts
 init_cjs_shims();
-var import_node_fs33 = require("fs");
-var import_node_path67 = __toESM(require("path"), 1);
+var import_node_fs34 = require("fs");
+var import_node_path68 = __toESM(require("path"), 1);
 var import_smol_toml4 = require("smol-toml");
 var import_types55 = require("@neat.is/types");
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
-    const abs = import_node_path67.default.join(dir, filename);
+    const abs = import_node_path68.default.join(dir, filename);
     if (!await exists2(abs)) continue;
-    const raw = await import_node_fs33.promises.readFile(abs, "utf8");
+    const raw = await import_node_fs34.promises.readFile(abs, "utf8");
     const config = filename === "railway.toml" ? (0, import_smol_toml4.parse)(raw) : JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
@@ -16898,7 +16937,7 @@ async function addRailwayServices(graph, services, scanPath) {
     try {
       read = await readRailwayConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra railway", import_node_path67.default.relative(scanPath, service.dir), err);
+      recordExtractionError("infra railway", import_node_path68.default.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -16908,7 +16947,7 @@ async function addRailwayServices(graph, services, scanPath) {
     }
     const anchorId = service.node.id;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix(import_node_path67.default.relative(scanPath, import_node_path67.default.join(service.dir, relFile)));
+    const evidenceFile = toPosix(import_node_path68.default.relative(scanPath, import_node_path68.default.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -16933,15 +16972,15 @@ async function addRailwayServices(graph, services, scanPath) {
 
 // src/extract/infra/supabase.ts
 init_cjs_shims();
-var import_node_fs34 = require("fs");
-var import_node_path68 = __toESM(require("path"), 1);
+var import_node_fs35 = require("fs");
+var import_node_path69 = __toESM(require("path"), 1);
 var import_smol_toml5 = require("smol-toml");
 var import_types56 = require("@neat.is/types");
 async function readSupabaseConfig(dir) {
-  const relFile = import_node_path68.default.join("supabase", "config.toml");
-  const abs = import_node_path68.default.join(dir, relFile);
+  const relFile = import_node_path69.default.join("supabase", "config.toml");
+  const abs = import_node_path69.default.join(dir, relFile);
   if (!await exists2(abs)) return null;
-  const raw = await import_node_fs34.promises.readFile(abs, "utf8");
+  const raw = await import_node_fs35.promises.readFile(abs, "utf8");
   const config = (0, import_smol_toml5.parse)(raw);
   return { config, relFile, raw };
 }
@@ -16953,7 +16992,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
     try {
       read = await readSupabaseConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra supabase", import_node_path68.default.relative(scanPath, service.dir), err);
+      recordExtractionError("infra supabase", import_node_path69.default.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -16968,7 +17007,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
       });
     }
     const anchorId = service.node.id;
-    const evidenceFile = toPosix(import_node_path68.default.relative(scanPath, import_node_path68.default.join(service.dir, relFile)));
+    const evidenceFile = toPosix(import_node_path69.default.relative(scanPath, import_node_path69.default.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -17010,7 +17049,7 @@ async function addInfra(graph, scanPath, services) {
 
 // src/extract/zod-shapes.ts
 init_cjs_shims();
-var import_node_path69 = __toESM(require("path"), 1);
+var import_node_path70 = __toESM(require("path"), 1);
 var import_tree_sitter18 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript8 = __toESM(require("tree-sitter-javascript"), 1);
 var import_types57 = require("@neat.is/types");
@@ -17105,7 +17144,7 @@ function topLevelSchemas(root) {
 }
 function zodShapesFromFile(file, serviceDir) {
   if (!ZOD_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt4(import_node_path69.default.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt4(import_node_path70.default.extname(file.path)), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   for (const { name, call } of topLevelSchemas(tree.rootNode)) {
@@ -17123,7 +17162,7 @@ function zodShapesFromFile(file, serviceDir) {
       name,
       fields,
       evidence: {
-        file: import_node_path69.default.relative(serviceDir, file.path),
+        file: import_node_path70.default.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -17391,12 +17430,12 @@ async function addFirestoreRules(graph, services) {
 }
 
 // src/extract/index.ts
-var import_node_path71 = __toESM(require("path"), 1);
+var import_node_path72 = __toESM(require("path"), 1);
 
 // src/extract/retire.ts
 init_cjs_shims();
-var import_node_fs35 = require("fs");
-var import_node_path70 = __toESM(require("path"), 1);
+var import_node_fs36 = require("fs");
+var import_node_path71 = __toESM(require("path"), 1);
 var import_types59 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph, source) {
   const orphans = [];
@@ -17430,11 +17469,11 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], so
     if (outOfScope(graph, edge, source)) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (import_node_path70.default.isAbsolute(evidenceFile)) {
-      if (!(0, import_node_fs35.existsSync)(evidenceFile)) toDrop.push(id);
+    if (import_node_path71.default.isAbsolute(evidenceFile)) {
+      if (!(0, import_node_fs36.existsSync)(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => (0, import_node_fs35.existsSync)(import_node_path70.default.join(base, evidenceFile)));
+    const found = bases.some((base) => (0, import_node_fs36.existsSync)(import_node_path71.default.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -17443,7 +17482,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], so
 }
 
 // src/extract/index.ts
-async function extractFromDirectory(graph, scanPath, opts = {}) {
+var passQueue = Promise.resolve();
+function extractFromDirectory(graph, scanPath, opts = {}) {
+  const pass = passQueue.then(() => runExtractionPass(graph, scanPath, opts));
+  passQueue = pass.catch(() => {
+  });
+  return pass;
+}
+async function runExtractionPass(graph, scanPath, opts) {
   await ensureCompatLoaded();
   drainExtractionErrors();
   drainSkippedFiles();
@@ -17495,7 +17541,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const droppedEntries = drainDroppedExtracted();
   const skippedEntries = drainSkippedFiles();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = import_node_path71.default.join(import_node_path71.default.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = import_node_path72.default.join(import_node_path72.default.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -17517,7 +17563,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
     skippedFiles: skippedEntries.length,
     skippedEntries
   };
-  emitNeatEvent({
+  if (opts.announce !== false) emitNeatEvent({
     type: "extraction-complete",
     project: opts.project ?? DEFAULT_PROJECT,
     payload: {
@@ -18435,7 +18481,7 @@ async function askGraph(graph, question, opts = {}) {
 
 // src/diff.ts
 init_cjs_shims();
-var import_node_fs36 = require("fs");
+var import_node_fs37 = require("fs");
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -18444,7 +18490,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await import_node_fs36.promises.readFile(target, "utf8");
+  const raw = await import_node_fs37.promises.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -18512,8 +18558,8 @@ function canonicalJson(value) {
 
 // src/persist.ts
 init_cjs_shims();
-var import_node_fs37 = require("fs");
-var import_node_path72 = __toESM(require("path"), 1);
+var import_node_fs38 = require("fs");
+var import_node_path73 = __toESM(require("path"), 1);
 var import_types62 = require("@neat.is/types");
 var SCHEMA_VERSION = 7;
 function migrateV1ToV2(payload) {
@@ -18568,7 +18614,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await import_node_fs37.promises.mkdir(import_node_path72.default.dirname(filePath), { recursive: true });
+  await import_node_fs38.promises.mkdir(import_node_path73.default.dirname(filePath), { recursive: true });
 }
 var WRITE_FLUSH_CHARS = 4 * 1024 * 1024;
 function jsonOrUndefined(value) {
@@ -18614,7 +18660,7 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  const handle = await import_node_fs37.promises.open(tmp, "w");
+  const handle = await import_node_fs38.promises.open(tmp, "w");
   try {
     let buffered = "";
     for (const chunk of serializeGraphChunks(payload)) {
@@ -18628,7 +18674,7 @@ async function saveGraphToDisk(graph, outPath) {
   } finally {
     await handle.close();
   }
-  await import_node_fs37.promises.rename(tmp, outPath);
+  await import_node_fs38.promises.rename(tmp, outPath);
 }
 function migrateSnapshot(input) {
   let payload = input;
@@ -18660,7 +18706,7 @@ function migrateSnapshot(input) {
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await import_node_fs37.promises.readFile(outPath, "utf8");
+    raw = await import_node_fs38.promises.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -18711,23 +18757,23 @@ function startPersistLoop(graph, outPath, opts = {}) {
 
 // src/projects.ts
 init_cjs_shims();
-var import_node_path73 = __toESM(require("path"), 1);
+var import_node_path74 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: import_node_path73.default.join(baseDir, "graph.json"),
-      errorsPath: import_node_path73.default.join(baseDir, "errors.ndjson"),
-      staleEventsPath: import_node_path73.default.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: import_node_path73.default.join(baseDir, "embeddings.json"),
-      policyViolationsPath: import_node_path73.default.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: import_node_path74.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path74.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path74.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path74.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path74.default.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: import_node_path73.default.join(baseDir, `${project}.json`),
-    errorsPath: import_node_path73.default.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: import_node_path73.default.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: import_node_path73.default.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: import_node_path73.default.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: import_node_path74.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path74.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path74.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path74.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path74.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -18767,20 +18813,20 @@ function parseExtraProjects(raw) {
 
 // src/registry.ts
 init_cjs_shims();
-var import_node_fs38 = require("fs");
+var import_node_fs39 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
-var import_node_path74 = __toESM(require("path"), 1);
+var import_node_path75 = __toESM(require("path"), 1);
 var import_types63 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path74.default.resolve(override);
-  return import_node_path74.default.join(import_node_os3.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path75.default.resolve(override);
+  return import_node_path75.default.join(import_node_os3.default.homedir(), ".neat");
 }
 function registryPath() {
-  return import_node_path74.default.join(neatHome(), "projects.json");
+  return import_node_path75.default.join(neatHome(), "projects.json");
 }
 function daemonsDir() {
-  return import_node_path74.default.join(neatHome(), "daemons");
+  return import_node_path75.default.join(neatHome(), "daemons");
 }
 function isFiniteInt(v) {
   return typeof v === "number" && Number.isFinite(v);
@@ -18813,7 +18859,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const dir = daemonsDir();
   let names;
   try {
-    names = await import_node_fs38.promises.readdir(dir);
+    names = await import_node_fs39.promises.readdir(dir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -18821,10 +18867,10 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const out = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const file = import_node_path74.default.join(dir, name);
+    const file = import_node_path75.default.join(dir, name);
     let raw;
     try {
-      raw = await import_node_fs38.promises.readFile(file, "utf8");
+      raw = await import_node_fs39.promises.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -18852,7 +18898,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await import_node_fs38.promises.readFile(file, "utf8");
+    raw = await import_node_fs39.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -18875,8 +18921,64 @@ var DEFAULT_PRUNE_TTL_MS = 7 * DAY_MS2;
 
 // src/streaming.ts
 init_cjs_shims();
+var import_node_fs40 = require("fs");
+var import_zod = require("zod");
+var import_types64 = require("@neat.is/types");
 var SSE_HEARTBEAT_MS = 3e4;
 var SSE_BACKPRESSURE_CAP = 1e3;
+var INCIDENT_TRIGGER_STREAM_SCOPE = "incident-only-v1";
+var IncidentTriggerSchema = import_types64.IncidentEventPayloadSchema.extend({
+  incidentId: import_zod.z.string().regex(/^[A-Za-z0-9:_-]{1,100}$/),
+  affectedNode: import_zod.z.string().min(1).max(512),
+  service: import_zod.z.string().min(1).max(256),
+  at: import_zod.z.string().datetime()
+});
+var MAX_REPLAY_BYTES = 16 * 1024 * 1024;
+var MAX_REPLAY_EVENTS = 1e4;
+function isExtractionFailure(row) {
+  const keys = Object.keys(row);
+  return keys.every((key) => ["source", "producer", "file", "error", "stack", "ts"].includes(key)) && typeof row.producer === "string" && typeof row.file === "string" && typeof row.error === "string" && typeof row.ts === "string" && (row.stack === void 0 || typeof row.stack === "string") && !Number.isNaN(Date.parse(row.ts));
+}
+function loadIncidentReplay(errorsPath, cursor) {
+  if (cursor !== void 0 && !/^[A-Za-z0-9:_-]{1,100}$/.test(cursor)) throw new Error("incident replay unavailable");
+  try {
+    if ((0, import_node_fs40.statSync)(errorsPath).size > MAX_REPLAY_BYTES) throw new Error("incident replay unavailable");
+    const raw = (0, import_node_fs40.readFileSync)(errorsPath, "utf8");
+    if (raw && !raw.endsWith("\n")) throw new Error("incident replay unavailable");
+    const seen = /* @__PURE__ */ new Map();
+    const events = [];
+    for (const line of raw.split("\n")) {
+      if (!line) continue;
+      if (events.length >= MAX_REPLAY_EVENTS) throw new Error("incident replay unavailable");
+      const row = JSON.parse(line);
+      if (row !== null && typeof row === "object" && !Array.isArray(row) && "source" in row && row.source === "extract") {
+        if (!isExtractionFailure(row)) throw new Error("incident replay unavailable");
+        continue;
+      }
+      const event = import_types64.ErrorEventSchema.parse(row);
+      const trigger = IncidentTriggerSchema.parse({
+        incidentId: event.id,
+        affectedNode: event.affectedNode,
+        service: event.service,
+        incidentKind: (0, import_types64.incidentKindOf)(event),
+        at: event.timestamp
+      });
+      const prior = seen.get(trigger.incidentId), encoded = JSON.stringify(trigger);
+      if (prior !== void 0) {
+        if (prior !== encoded) throw new Error("incident replay unavailable");
+        continue;
+      }
+      seen.set(trigger.incidentId, encoded);
+      events.push(trigger);
+    }
+    if (cursor === void 0) return events;
+    const at = events.findIndex((event) => event.incidentId === cursor);
+    if (at < 0) throw new Error("incident replay unavailable");
+    return events.slice(at + 1);
+  } catch {
+    throw new Error("incident replay unavailable");
+  }
+}
 function handleSse(req, reply, opts) {
   const heartbeatMs = opts.heartbeatMs ?? SSE_HEARTBEAT_MS;
   const backpressureCap = opts.backpressureCap ?? SSE_BACKPRESSURE_CAP;
@@ -18884,8 +18986,20 @@ function handleSse(req, reply, opts) {
   reply.raw.setHeader("Cache-Control", "no-cache, no-transform");
   reply.raw.setHeader("Connection", "keep-alive");
   reply.raw.setHeader("X-Accel-Buffering", "no");
+  if (opts.incidentOnly) {
+    reply.raw.setHeader("X-NEAT-Event-Scope", INCIDENT_TRIGGER_STREAM_SCOPE);
+    reply.raw.setHeader("X-NEAT-Project", opts.project);
+    if (opts.incidentReplay) reply.raw.setHeader("X-NEAT-Replay-Complete", "1");
+  }
   reply.raw.flushHeaders?.();
   reply.raw.write(":open\n\n");
+  for (const trigger of opts.incidentReplay ?? []) {
+    reply.raw.write(`id: ${trigger.incidentId}
+event: incident
+data: ${JSON.stringify(trigger)}
+
+`);
+  }
   let pending = 0;
   let dropped = false;
   const closeConnection = () => {
@@ -18913,6 +19027,17 @@ data: ${JSON.stringify({ reason: "backpressure" })}
   };
   const listener = (envelope) => {
     if (envelope.project !== opts.project) return;
+    if (opts.incidentOnly) {
+      if (envelope.type !== "incident") return;
+      const trigger = IncidentTriggerSchema.safeParse(envelope.payload);
+      if (!trigger.success) return;
+      writeFrame(`id: ${trigger.data.incidentId}
+event: incident
+data: ${JSON.stringify(trigger.data)}
+
+`);
+      return;
+    }
     writeFrame(`event: ${envelope.type}
 data: ${JSON.stringify(envelope.payload)}
 
@@ -18932,11 +19057,501 @@ data: ${JSON.stringify(envelope.payload)}
 // src/api.ts
 init_auth();
 
-// src/connectors-config.ts
+// src/pr-verdict.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+var import_node_fs42 = require("fs");
+var import_node_os5 = __toESM(require("os"), 1);
+var import_node_path77 = __toESM(require("path"), 1);
+
+// ../action/src/graph.mjs
+init_cjs_shims();
+var import_node_fs41 = require("fs");
+var MARKER = "<!-- neat-action:graph-impact -->";
+var shortId = (id) => String(id).split(":").slice(-1)[0];
+var fence = (s) => "`" + s + "`";
+function graphFromExport(raw) {
+  const g = raw.graph ?? raw;
+  const nodes = new Map((g.nodes ?? []).map((n) => [n.key, n.attributes ?? {}]));
+  const edges = (g.edges ?? []).map((e) => ({
+    key: e.key,
+    source: e.source,
+    target: e.target,
+    ...e.attributes ?? {}
+  }));
+  return { nodes, edges };
+}
+var namesByType = (entries, type) => entries.filter(([, a]) => a.type === type).map(([k, a]) => a.name ?? shortId(k));
+function diffGraphs(base, head) {
+  const added = [...head.nodes].filter(([k]) => !base.nodes.has(k));
+  const removed = [...base.nodes].filter(([k]) => !head.nodes.has(k));
+  return {
+    routesAdded: namesByType(added, "RouteNode"),
+    routesRemoved: namesByType(removed, "RouteNode"),
+    tablesAdded: namesByType(added, "InfraNode"),
+    tablesRemoved: namesByType(removed, "InfraNode")
+  };
+}
+function changedFileNodeIds(graph, changedPaths) {
+  const ids = [];
+  for (const [key, attrs] of graph.nodes) {
+    if (attrs.type !== "FileNode" || !attrs.path) continue;
+    if (changedPaths.some((c) => c === attrs.path || c.endsWith("/" + attrs.path))) ids.push(key);
+  }
+  return ids;
+}
+function changedNodeIds(base, head) {
+  if (!base) return [...head.nodes.keys()];
+  return [
+    ...[...head.nodes.keys()].filter((k) => !base.nodes.has(k)),
+    ...[...base.nodes.keys()].filter((k) => !head.nodes.has(k))
+  ];
+}
+function formatDivergences(data, changedIds) {
+  const findings = Array.isArray(data) ? data : data?.divergences ?? data?.findings ?? data?.items ?? [];
+  const changed = new Set(changedIds);
+  return findings.filter((f) => changed.has(f.source) || changed.has(f.target) || changed.has(f.nodeId)).slice(0, 10).map((f) => {
+    const kind = f.kind || f.type || "divergence";
+    const s = shortId(f.source ?? f.nodeId ?? "");
+    const t = f.target ? " \u2192 `" + shortId(f.target) + "`" : "";
+    const why = f.reason || f.message || "";
+    return `${kind}: \`${s}\`${t}${why ? " \u2014 " + why : ""}`;
+  });
+}
+function observedBreakFrom(node, data) {
+  const observed = Boolean(data?.observed);
+  const dependentCount = Number(data?.inboundObservedCount ?? 0);
+  const callCount = Array.isArray(data?.dependencies) ? data.dependencies.length : 0;
+  if (!observed && dependentCount === 0 && callCount === 0) return null;
+  const inboundVolume = typeof data.inboundVolume === "number" ? data.inboundVolume : void 0;
+  const window = typeof data.window === "string" ? data.window : void 0;
+  const inboundLastObserved = typeof data.inboundLastObserved === "string" ? data.inboundLastObserved : void 0;
+  return {
+    id: node.id,
+    type: node.type,
+    label: node.label,
+    change: node.change,
+    dependentCount,
+    callCount,
+    ...inboundVolume !== void 0 ? { inboundVolume } : {},
+    ...window !== void 0 ? { window } : {},
+    ...inboundLastObserved !== void 0 ? { inboundLastObserved } : {}
+  };
+}
+function blastRadius(graph, nodeId, maxDepth = 10) {
+  const inbound = /* @__PURE__ */ new Map();
+  for (const e of graph.edges) {
+    if (!inbound.has(e.target)) inbound.set(e.target, []);
+    inbound.get(e.target).push({ source: e.source, type: e.type });
+  }
+  const seen = /* @__PURE__ */ new Set([nodeId]);
+  const dependents = [];
+  let frontier = [nodeId];
+  for (let d = 0; d < maxDepth && frontier.length; d++) {
+    const next = [];
+    for (const n of frontier) {
+      for (const { source } of inbound.get(n) ?? []) {
+        if (seen.has(source)) continue;
+        seen.add(source);
+        dependents.push(source);
+        next.push(source);
+      }
+    }
+    frontier = next;
+  }
+  return dependents;
+}
+var stable = (obj) => JSON.stringify(obj, Object.keys(obj ?? {}).sort());
+function changedNodesForObservedScan(base, head, { limit = 25 } = {}) {
+  const out = [];
+  for (const [key, attrs] of base.nodes) {
+    if (!head.nodes.has(key)) {
+      out.push({ id: key, type: attrs.type, label: attrs.name ?? shortId(key), change: "removed" });
+    }
+  }
+  for (const [key, attrs] of head.nodes) {
+    const b = base.nodes.get(key);
+    if (b && stable(b) !== stable(attrs)) {
+      out.push({ id: key, type: attrs.type, label: attrs.name ?? shortId(key), change: "changed" });
+    }
+  }
+  return out.slice(0, limit);
+}
+var plural = (n) => n === 1 ? "" : "s";
+function formatAge(iso) {
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return null;
+  const ms = Date.now() - t;
+  if (ms < 0) return "just now";
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s ago`;
+  const m = Math.round(s / 60);
+  if (m < 60) return `${m}m ago`;
+  const h = Math.round(m / 60);
+  if (h < 48) return `${h}h ago`;
+  return `${Math.round(h / 24)}d ago`;
+}
+function windowPhrase(window) {
+  if (window === "7d") return "in 7d";
+  if (window === "lifetime") return "(lifetime)";
+  return "";
+}
+function observedTraffic(b) {
+  if (typeof b.inboundVolume !== "number") return null;
+  const win = windowPhrase(b.window);
+  const served = `served ${b.inboundVolume.toLocaleString("en-US")}\xD7${win ? " " + win : ""}`;
+  const age = b.inboundLastObserved ? formatAge(b.inboundLastObserved) : null;
+  return age ? `${served}, last seen ${age}` : served;
+}
+var FUSION_NOTE = "<sub>Fused view \u2014 the static graph (EXTRACTED) weighted against production traffic (OBSERVED) from the connected NEAT host. Observed-break checks ran live against that host.</sub>";
+var TONE_COPY = {
+  loud: {
+    green: "## \u2705 NEAT \u2014 all clear",
+    yellow: "## \u26A0\uFE0F NEAT \u2014 a few minor problems",
+    red: "## \u{1F6D1} NEAT \u2014 FUCK NO. Here are the problems:"
+  },
+  professional: {
+    green: "## \u2705 NEAT \u2014 all clear",
+    yellow: "## \u26A0\uFE0F NEAT \u2014 Minor issues to review",
+    red: "## \u{1F6D1} NEAT \u2014 Critical: production will break"
+  }
+};
+function breakHeadline(b) {
+  const verb = b.change === "removed" ? "deletes" : "changes";
+  const what = fence(b.label) + (b.type === "InfraNode" ? " (data store)" : "");
+  const consequence = b.type === "RouteNode" ? "Live callers 404." : b.type === "InfraNode" ? "Live readers and writers fail." : "Live callers break.";
+  const traffic = observedTraffic(b);
+  if (traffic) {
+    return `**\u{1F534} Production will break** \u2014 this PR ${verb} ${what}, ${traffic} (OBSERVED). ${consequence}`;
+  }
+  if (b.dependentCount > 0) {
+    return `**\u{1F534} Production will break** \u2014 this PR ${verb} ${what}, ${b.dependentCount} observed dependent${plural(b.dependentCount)} (OBSERVED). ${consequence}`;
+  }
+  return `**\u{1F534} Production will break** \u2014 this PR ${verb} ${what}, seen live in production making ${b.callCount} observed call${plural(b.callCount)} (OBSERVED). Runtime behavior changes.`;
+}
+function breakDetail(b) {
+  return "- " + fence(b.label) + ` \u2014 ${b.change} ${b.type ?? "node"}; ${b.dependentCount} observed inbound dependent${plural(b.dependentCount)}, ${b.callCount} observed outbound call${plural(b.callCount)}. Provenance: OBSERVED (live traffic on the connected host).`;
+}
+function renderVerdict({
+  graph,
+  delta,
+  changedFiles = [],
+  divergences = [],
+  observedBreaks = [],
+  tone = "loud",
+  sniperDispatchUrl = "",
+  graphDiffUrl = ""
+}) {
+  const copy = TONE_COPY[tone] ?? TONE_COPY.loud;
+  const brokenRoutes = new Set(
+    observedBreaks.filter((b) => b.type === "RouteNode").map((b) => b.label)
+  );
+  const brokenTables = new Set(
+    observedBreaks.filter((b) => b.type === "InfraNode").map((b) => b.label)
+  );
+  const staticConcerns = [];
+  for (const r of delta.routesRemoved ?? []) {
+    if (brokenRoutes.has(r)) continue;
+    staticConcerns.push({
+      headline: `**\u{1F7E0} Removed route** \u2014 ${fence(r)} no longer exists; confirm nothing in-repo still calls it.`,
+      detail: `- Route ${fence(r)} removed. The connected host observed no production traffic on it \u2014 static-only concern.`
+    });
+  }
+  for (const t of delta.tablesRemoved ?? []) {
+    if (brokenTables.has(t)) continue;
+    staticConcerns.push({
+      headline: `**\u{1F7E0} Removed reference** \u2014 ${fence(t)} no longer exists; confirm nothing in-repo still reads it.`,
+      detail: `- Table/infra ${fence(t)} removed. The connected host observed no production traffic on it \u2014 static-only concern.`
+    });
+  }
+  const findings = [
+    ...observedBreaks.map((b) => ({ headline: breakHeadline(b), detail: breakDetail(b) })),
+    ...divergences.map((d) => ({
+      headline: `**\u{1F7E0} Divergence** \u2014 ${d}`,
+      detail: `- ${d}`
+    })),
+    ...staticConcerns
+  ];
+  const tier = observedBreaks.length > 0 ? "red" : findings.length > 0 ? "yellow" : "green";
+  const actionLinks = [];
+  if (sniperDispatchUrl)
+    actionLinks.push(`**[\u26A1 Dispatch Sniper to fix these \u2192](${sniperDispatchUrl})**`);
+  if (graphDiffUrl) actionLinks.push(`[Full graph diff \u2192](${graphDiffUrl})`);
+  const L = [MARKER, ""];
+  if (tier === "green") {
+    L.push(
+      copy.green,
+      "",
+      "Nothing this PR touches is observed in production, and it introduces no new divergences.",
+      "",
+      FUSION_NOTE
+    );
+    return { marker: MARKER, body: L.join("\n"), tier };
+  }
+  if (tier === "yellow") {
+    L.push(
+      copy.yellow,
+      "",
+      `${findings.length} minor problem${plural(findings.length)} \u2014 read ${findings.length === 1 ? "it" : "them"} below.`,
+      "",
+      "<details><summary>Read them \u2192</summary>",
+      ""
+    );
+    findings.forEach((f, i) => L.push(`${i + 1}. ${f.headline}`));
+    L.push("", ...findings.map((f) => f.detail));
+    L.push("", "</details>");
+    if (actionLinks.length) L.push("", ...actionLinks);
+    L.push("", FUSION_NOTE);
+    return { marker: MARKER, body: L.join("\n"), tier };
+  }
+  L.push(copy.red, "");
+  findings.forEach((f, i) => L.push(`${i + 1}. ${f.headline}`));
+  L.push("", "<details><summary>Full detail \u2192</summary>", "");
+  L.push(...findings.map((f) => f.detail));
+  const anyDelta = (delta.routesAdded?.length ?? 0) + (delta.routesRemoved?.length ?? 0) + (delta.tablesAdded?.length ?? 0) + (delta.tablesRemoved?.length ?? 0);
+  if (anyDelta) {
+    L.push("", "**Graph delta**");
+    if (delta.routesAdded?.length) L.push("- \u2795 routes: " + delta.routesAdded.map(fence).join(", "));
+    if (delta.routesRemoved?.length)
+      L.push("- \u2796 routes: " + delta.routesRemoved.map(fence).join(", "));
+    if (delta.tablesAdded?.length) L.push("- \u2795 tables: " + delta.tablesAdded.map(fence).join(", "));
+    if (delta.tablesRemoved?.length)
+      L.push("- \u2796 tables: " + delta.tablesRemoved.map(fence).join(", "));
+  }
+  const filesInGraph = (changedFiles ?? []).filter((f) => graph?.nodes?.has(f));
+  if (filesInGraph.length) {
+    L.push("", "**Blast radius (in-repo)**");
+    for (const f of filesInGraph) {
+      const deps = blastRadius(graph, f).filter((d) => d.startsWith("file:")).map(shortId);
+      L.push(
+        "- " + fence(shortId(f)) + " \u2192 depended on by " + (deps.length ? deps.map(fence).join(", ") : "_nothing else in-repo_")
+      );
+    }
+  }
+  L.push("", "</details>");
+  if (actionLinks.length) L.push("", ...actionLinks);
+  L.push("", FUSION_NOTE);
+  return { marker: MARKER, body: L.join("\n"), tier };
+}
+
+// src/pr-verdict.ts
+var import_types65 = require("@neat.is/types");
+
+// src/connectors/hosted-repos.ts
 init_cjs_shims();
 var import_node_os4 = __toESM(require("os"), 1);
-var import_node_path75 = __toESM(require("path"), 1);
-var import_node_fs39 = require("fs");
+var import_node_path76 = __toESM(require("path"), 1);
+var import_promises = require("fs/promises");
+var DEFAULT_SYNC_INTERVAL_MS = 5 * 6e4;
+var CLONE_TIMEOUT_MS = 5 * 6e4;
+function scrubToken(s) {
+  return s.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@");
+}
+var defaultCloneCommit = async (cloneUrl, sha, destDir) => {
+  const [{ default: git }, httpMod, fs42] = await Promise.all([
+    import("isomorphic-git"),
+    import("isomorphic-git/http/node"),
+    import("fs")
+  ]);
+  const http = httpMod.default ?? httpMod;
+  const parsed = new URL(cloneUrl);
+  const password = parsed.password || parsed.username;
+  const username = parsed.password ? parsed.username : "x-access-token";
+  const cleanUrl = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  const clone = (async () => {
+    await git.init({ fs: fs42, dir: destDir });
+    await git.addRemote({ fs: fs42, dir: destDir, remote: "origin", url: cleanUrl });
+    await git.fetch({
+      fs: fs42,
+      http,
+      dir: destDir,
+      remote: "origin",
+      // A full SHA is fetched as itself; the remote doesn't have to advertise a ref that points at it.
+      ref: sha,
+      remoteRef: sha,
+      singleBranch: true,
+      depth: 1,
+      tags: false,
+      ...password ? { onAuth: () => ({ username, password }) } : {}
+    });
+    await git.checkout({ fs: fs42, dir: destDir, ref: sha, force: true });
+  })();
+  clone.catch(() => {
+  });
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`clone timed out after ${CLONE_TIMEOUT_MS}ms`)), CLONE_TIMEOUT_MS);
+  });
+  try {
+    await Promise.race([clone, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
+function scrubCloneToken(s) {
+  return scrubToken(s);
+}
+
+// src/pr-verdict.ts
+var DEFAULT_PR_VERDICT_TIMEOUT_MS = 24e4;
+var MAX_CHANGED_FILES = 3e3;
+var PrVerdictError = class extends Error {
+  constructor(message, status2, stage, details) {
+    super(message);
+    this.status = status2;
+    this.stage = stage;
+    this.details = details;
+    this.name = "PrVerdictError";
+  }
+  status;
+  stage;
+  details;
+};
+function parsePrVerdictRequest(body) {
+  const parsed = import_types65.PrVerdictBodySchema.safeParse(body);
+  if (!parsed.success) {
+    throw new PrVerdictError("invalid pr-verdict body", 400, void 0, parsed.error.issues);
+  }
+  const { changedFiles, tone, ...rest } = parsed.data;
+  return {
+    ...rest,
+    ...changedFiles ? { changedFiles: changedFiles.slice(0, MAX_CHANGED_FILES) } : {},
+    ...tone ? { tone } : {}
+  };
+}
+function createPrVerdictRunner(deps = {}) {
+  let busy = false;
+  return async (req, ctx) => {
+    if (busy) throw new PrVerdictError("a verdict is already being computed on this daemon", 429);
+    busy = true;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_PR_VERDICT_TIMEOUT_MS;
+    const deadline = (deps.now ?? Date.now)() + timeoutMs;
+    const work = computePrVerdict(req, ctx, deps, deadline).finally(() => {
+      busy = false;
+    });
+    let timer;
+    const timeout = new Promise((_, reject) => {
+      timer = setTimeout(
+        () => reject(new PrVerdictError(`verdict did not finish within ${timeoutMs}ms`, 504)),
+        timeoutMs
+      );
+    });
+    try {
+      return await Promise.race([work, timeout]);
+    } finally {
+      if (timer) clearTimeout(timer);
+      work.catch(() => {
+      });
+    }
+  };
+}
+async function computePrVerdict(req, ctx, deps, deadline) {
+  const now = deps.now ?? Date.now;
+  const startedAt = now();
+  const cloneCommit = deps.cloneCommit ?? defaultCloneCommit;
+  const extract = deps.extract ?? extractFromDirectory;
+  const root = await import_node_fs42.promises.mkdtemp(import_node_path77.default.join(deps.tmpRoot ?? import_node_os5.default.tmpdir(), "neat-pr-"));
+  const baseDir = import_node_path77.default.join(root, "base");
+  const headDir = import_node_path77.default.join(root, "head");
+  const stage = async (name, run) => {
+    const left = deadline - now();
+    if (left <= 0) throw new PrVerdictError(`verdict ran out of time before ${name}`, 504, name);
+    const work = run();
+    work.catch(() => {
+    });
+    let timer;
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new PrVerdictError(`verdict ran out of time during ${name}`, 504, name)), left);
+    });
+    try {
+      return await Promise.race([work, expired]);
+    } catch (err) {
+      if (err instanceof PrVerdictError) throw err;
+      const why = scrubCloneToken(err.message ?? String(err)).slice(0, 300);
+      throw new PrVerdictError(`${name} failed \u2014 ${why}`, 422, name);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  };
+  const extractOpts = { source: `${req.owner}/${req.name}`, announce: false };
+  try {
+    await import_node_fs42.promises.mkdir(baseDir);
+    await import_node_fs42.promises.mkdir(headDir);
+    await stage("clone-base", () => cloneCommit(req.cloneUrl, req.baseSha, baseDir));
+    await stage("clone-head", () => cloneCommit(req.cloneUrl, req.headSha, headDir));
+    const baseGraph = makeGraph();
+    const headGraph = makeGraph();
+    await stage("extract-base", () => extract(baseGraph, baseDir, extractOpts));
+    await stage("extract-head", () => extract(headGraph, headDir, extractOpts));
+    const base = graphFromExport(baseGraph.export());
+    const head = graphFromExport(headGraph.export());
+    const delta = diffGraphs(base, head);
+    const changedPaths = req.changedFiles ?? await changedPathsBetween(baseDir, headDir);
+    const changedFiles = changedFileNodeIds(head, changedPaths);
+    const divergences = formatDivergences(
+      computeDivergences(ctx.liveGraph, { incidents: ctx.incidents ?? [] }),
+      changedNodeIds(base, head)
+    );
+    const observedBreaks = [];
+    for (const node of changedNodesForObservedScan(base, head)) {
+      if (!ctx.liveGraph.hasNode(node.id)) continue;
+      const found = observedBreakFrom(node, getObservedDependencies(ctx.liveGraph, node.id));
+      if (found) observedBreaks.push(found);
+    }
+    const { marker, body } = renderVerdict({
+      graph: head,
+      delta,
+      changedFiles,
+      divergences,
+      observedBreaks,
+      tone: req.tone ?? "loud"
+    });
+    return {
+      marker,
+      body,
+      base: { sha: req.baseSha, nodes: baseGraph.order, edges: baseGraph.size },
+      head: { sha: req.headSha, nodes: headGraph.order, edges: headGraph.size },
+      changedFiles: changedFiles.length,
+      observedBreaks: observedBreaks.length,
+      divergences: divergences.length,
+      durationMs: now() - startedAt
+    };
+  } finally {
+    await import_node_fs42.promises.rm(root, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "neat-out"]);
+async function hashTree(dir) {
+  const out = /* @__PURE__ */ new Map();
+  const walk11 = async (rel) => {
+    const entries = await import_node_fs42.promises.readdir(import_node_path77.default.join(dir, rel), { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      const child = rel ? `${rel}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) await walk11(child);
+      } else if (entry.isFile()) {
+        const bytes = await import_node_fs42.promises.readFile(import_node_path77.default.join(dir, child)).catch(() => null);
+        if (bytes) out.set(child, (0, import_node_crypto3.createHash)("sha1").update(bytes).digest("hex"));
+      }
+    }
+  };
+  await walk11("");
+  return out;
+}
+async function changedPathsBetween(baseDir, headDir) {
+  const [base, head] = await Promise.all([hashTree(baseDir), hashTree(headDir)]);
+  const changed = [];
+  for (const [file, hash] of head) if (base.get(file) !== hash) changed.push(file);
+  for (const file of base.keys()) if (!head.has(file)) changed.push(file);
+  return changed.sort().slice(0, MAX_CHANGED_FILES);
+}
+
+// src/connectors-config.ts
+init_cjs_shims();
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_path78 = __toESM(require("path"), 1);
+var import_node_fs43 = require("fs");
 var CONNECTORS_CONFIG_VERSION = 1;
 var EnvRefUnsetError = class extends Error {
   ref;
@@ -18950,17 +19565,17 @@ var EnvRefUnsetError = class extends Error {
 };
 function neatHome2() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path75.default.resolve(override);
-  return import_node_path75.default.join(import_node_os4.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path78.default.resolve(override);
+  return import_node_path78.default.join(import_node_os6.default.homedir(), ".neat");
 }
 function connectorsConfigPath(home = neatHome2()) {
-  return import_node_path75.default.join(home, "connectors.json");
+  return import_node_path78.default.join(home, "connectors.json");
 }
 var MODE_MASK_LOOSER_THAN_0600 = 63;
 async function warnIfModeLooserThan0600(file) {
   if (process.platform === "win32") return;
   try {
-    const stat = await import_node_fs39.promises.stat(file);
+    const stat = await import_node_fs43.promises.stat(file);
     if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
       const mode = (stat.mode & 511).toString(8).padStart(3, "0");
       console.warn(
@@ -18974,7 +19589,7 @@ async function readConnectorsConfig(home = neatHome2()) {
   const file = connectorsConfigPath(home);
   let raw;
   try {
-    raw = await import_node_fs39.promises.readFile(file, "utf8");
+    raw = await import_node_fs43.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
@@ -19141,15 +19756,15 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 
 // src/connectors/index.ts
 init_cjs_shims();
-var import_types64 = require("@neat.is/types");
+var import_types66 = require("@neat.is/types");
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== import_types64.Provenance.EXTRACTED) continue;
-    const parsed = (0, import_types64.parseFileId)(edge.source);
+    if (edge.provenance !== import_types66.Provenance.EXTRACTED) continue;
+    const parsed = (0, import_types66.parseFileId)(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
     if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
@@ -19160,7 +19775,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== import_types64.NodeType.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== import_types66.NodeType.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -19246,7 +19861,7 @@ init_cjs_shims();
 
 // src/connectors/gcp-auth.ts
 init_cjs_shims();
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 
 // src/connectors/junction.ts
 init_cjs_shims();
@@ -19558,7 +20173,7 @@ function buildServiceAccountAssertion(key, scope, tokenUri, nowMs) {
     exp: iat + ASSERTION_LIFETIME_S
   };
   const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
-  const signature = (0, import_node_crypto3.createSign)("RSA-SHA256").update(signingInput).end().sign(key.private_key);
+  const signature = (0, import_node_crypto4.createSign)("RSA-SHA256").update(signingInput).end().sign(key.private_key);
   return `${signingInput}.${base64url(signature)}`;
 }
 async function mintGcpAccessToken(key, scope, opts = {}) {
@@ -19728,10 +20343,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path78) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path78);
+function targetFromRestPath(path81) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path81);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path78);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path81);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -19842,23 +20457,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types66 = require("@neat.is/types");
+var import_types68 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types66.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types68.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types66.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types68.EdgeType.CALLS };
     }
-    const bareResourceId = (0, import_types66.infraId)(signal.targetKind, signal.targetName);
+    const bareResourceId = (0, import_types68.infraId)(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types66.EdgeType.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types68.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types66.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types68.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types66.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types68.EdgeType.CALLS };
     }
     return null;
   };
@@ -19951,7 +20566,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types70 = require("@neat.is/types");
+var import_types72 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -20102,7 +20717,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types70.NodeType.RouteNode) return;
+    if (node.type !== import_types72.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -20206,12 +20821,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types70.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types72.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types70.serviceId)(peerName), serviceName, edgeType: import_types70.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types72.serviceId)(peerName), serviceName, edgeType: import_types72.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -20335,9 +20950,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path78 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path78) return null;
-  return { resourceName, method, path: path78 };
+  const path81 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path81) return null;
+  return { resourceName, method, path: path81 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -20375,14 +20990,14 @@ function mapLogEntryToSignal(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path78 = pathFromRequestUrl(req.requestUrl);
-  if (path78 === null) return null;
+  const path81 = pathFromRequestUrl(req.requestUrl);
+  if (path81 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path78 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path81 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20399,26 +21014,26 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types72 = require("@neat.is/types");
+var import_types74 = require("@neat.is/types");
 
 // src/connectors/infer-service.ts
 init_cjs_shims();
-var import_types71 = require("@neat.is/types");
+var import_types73 = require("@neat.is/types");
 function normalizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function inferServiceName(graph, resourceName, method, path78) {
+function inferServiceName(graph, resourceName, method, path81) {
   const wantedMethod = method.toUpperCase();
-  const wantedPath = normalizePathTemplate(path78);
+  const wantedPath = normalizePathTemplate(path81);
   const services = [];
   const owners = /* @__PURE__ */ new Set();
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type === import_types71.NodeType.ServiceNode && typeof node.name === "string") {
+    if (node.type === import_types73.NodeType.ServiceNode && typeof node.name === "string") {
       services.push(node.name);
       return;
     }
-    if (node.type !== import_types71.NodeType.RouteNode) return;
+    if (node.type !== import_types73.NodeType.RouteNode) return;
     const route = attrs;
     if (!route.pathTemplate || normalizePathTemplate(route.pathTemplate) !== wantedPath) return;
     const routeMethod = route.method.toUpperCase();
@@ -20445,7 +21060,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types72.NodeType.RouteNode) return;
+    if (node.type !== import_types74.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -20477,7 +21092,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types72.EdgeType.CALLS
+      edgeType: import_types74.EdgeType.CALLS
     };
   };
 }
@@ -20510,11 +21125,11 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types74 = require("@neat.is/types");
+var import_types76 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
 var DEFAULT_EVENT_LIMIT = 1e3;
 async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
@@ -20527,7 +21142,7 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
   const body = {
     // Cloudflare's schema requires an identifier per query even for an
     // ad-hoc, unsaved one — a fresh id per tick, never reused.
-    queryId: `neat-connector-${(0, import_node_crypto4.randomUUID)()}`,
+    queryId: `neat-connector-${(0, import_node_crypto5.randomUUID)()}`,
     timeframe: { from: window.fromMs, to: window.toMs },
     view: "events",
     limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
@@ -20626,7 +21241,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path78 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path81 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -20634,7 +21249,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path78 ? { path: path78 } : {},
+    ...path81 ? { path: path81 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -20674,19 +21289,19 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types74.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types76.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path78) {
-  const normalizedPath = normalizePathTemplate(path78);
+function findMatchingRouteNode(graph, serviceName, method, path81) {
+  const normalizedPath = normalizePathTemplate(path81);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types74.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types76.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -20698,18 +21313,18 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path78 } = signal;
+    const { method, path: path81 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path78) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path78) ?? wholeFileId;
+      if (!method || !path81) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path81) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types74.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types76.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types74.EdgeType.CALLS
+        edgeType: import_types76.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -20718,13 +21333,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types74.EdgeType.CALLS
+        edgeType: import_types76.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types74.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types76.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types74.EdgeType.CALLS,
+      edgeType: import_types76.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -20920,14 +21535,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 
 // src/connectors/neon/resolve.ts
 init_cjs_shims();
-var import_types78 = require("@neat.is/types");
+var import_types80 = require("@neat.is/types");
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: (0, import_types78.infraId)("sql-table", signal.targetName),
+      targetNodeId: (0, import_types80.infraId)("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: import_types78.EdgeType.CALLS,
+      edgeType: import_types80.EdgeType.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -21053,9 +21668,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path78 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path78) return null;
-  return { serviceName, method, path: path78 };
+  const path81 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path81) return null;
+  return { serviceName, method, path: path81 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -21084,14 +21699,14 @@ function mapLogEntryToSignal2(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path78 = pathFromRequestUrl2(req.requestUrl);
-  if (path78 === null) return null;
+  const path81 = pathFromRequestUrl2(req.requestUrl);
+  if (path81 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path78 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path81 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21108,14 +21723,14 @@ function mapLogEntriesToSignals2(entries) {
 
 // src/connectors/cloud-run/resolve.ts
 init_cjs_shims();
-var import_types82 = require("@neat.is/types");
+var import_types84 = require("@neat.is/types");
 var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
 function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
   let found = null;
   graph.forEachNode((_id, attrs) => {
     if (found) return;
     const node = attrs;
-    if (node.type !== import_types82.NodeType.RouteNode) return;
+    if (node.type !== import_types84.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName || !route.pathTemplate) return;
     if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
@@ -21130,23 +21745,23 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path78 } = identity;
-    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path78) ?? void 0 : void 0);
+    const { serviceName: gcpServiceName, method, path: path81 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path81) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path78)
+        normalizePathTemplate(path81)
       );
       if (routeNodeId) {
-        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types82.EdgeType.CALLS };
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types84.EdgeType.CALLS };
       }
     }
     return {
-      targetNodeId: (0, import_types82.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      targetNodeId: (0, import_types84.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
       serviceName: mappedService ?? gcpServiceName,
-      edgeType: import_types82.EdgeType.CALLS,
+      edgeType: import_types84.EdgeType.CALLS,
       ensureInfraNode: {
         kind: CLOUD_RUN_SERVICE_INFRA_KIND,
         name: gcpServiceName,
@@ -21273,9 +21888,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path78 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path78) return null;
-  return { backendServiceName, method, path: path78 };
+  const path81 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path81) return null;
+  return { backendServiceName, method, path: path81 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -21304,14 +21919,14 @@ function mapLogEntryToSignal3(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path78 = pathFromRequestUrl3(req.requestUrl);
-  if (path78 === null) return null;
+  const path81 = pathFromRequestUrl3(req.requestUrl);
+  if (path81 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path78 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path81 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21328,14 +21943,14 @@ function mapLogEntriesToSignals3(entries) {
 
 // src/connectors/gcp-lb/resolve.ts
 init_cjs_shims();
-var import_types86 = require("@neat.is/types");
+var import_types88 = require("@neat.is/types");
 var GCP_LB_BACKEND_INFRA_KIND = "gcp-lb-backend";
 function findMatchingRouteNode3(graph, serviceName, method, normalizedPath) {
   let found = null;
   graph.forEachNode((_id, attrs) => {
     if (found) return;
     const node = attrs;
-    if (node.type !== import_types86.NodeType.RouteNode) return;
+    if (node.type !== import_types88.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName || !route.pathTemplate) return;
     if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
@@ -21350,23 +21965,23 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path78 } = identity;
-    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path78) ?? void 0 : void 0);
+    const { backendServiceName, method, path: path81 } = identity;
+    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path81) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path78)
+        normalizePathTemplate(path81)
       );
       if (routeNodeId) {
-        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types86.EdgeType.CALLS };
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types88.EdgeType.CALLS };
       }
     }
     return {
-      targetNodeId: (0, import_types86.infraId)(GCP_LB_BACKEND_INFRA_KIND, backendServiceName),
+      targetNodeId: (0, import_types88.infraId)(GCP_LB_BACKEND_INFRA_KIND, backendServiceName),
       serviceName: mappedService ?? backendServiceName,
-      edgeType: import_types86.EdgeType.CALLS,
+      edgeType: import_types88.EdgeType.CALLS,
       ensureInfraNode: {
         kind: GCP_LB_BACKEND_INFRA_KIND,
         name: backendServiceName,
@@ -21407,7 +22022,7 @@ function createGcpLbConnector(graph, config = {}) {
 
 // src/connectors/render/index.ts
 init_cjs_shims();
-var import_types89 = require("@neat.is/types");
+var import_types91 = require("@neat.is/types");
 
 // src/connectors/render/types.ts
 init_cjs_shims();
@@ -21485,7 +22100,7 @@ function buildRenderRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types89.NodeType.RouteNode) return;
+    if (node.type !== import_types91.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -21570,7 +22185,7 @@ function mapRenderRequestLogsToSignals(entries, routeIndex) {
 function createRenderResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind === ROUTE_TARGET_KIND2) {
-      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types89.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types91.EdgeType.CALLS };
     }
     return null;
   };
@@ -21708,21 +22323,21 @@ function mapInsightsToSignals(rows, observedAtIso) {
 
 // src/connectors/planetscale/resolve.ts
 init_cjs_shims();
-var import_types93 = require("@neat.is/types");
+var import_types95 = require("@neat.is/types");
 var PLANETSCALE_DATABASE_KIND = "planetscale-database";
 function createPlanetscaleResolveTarget(graph, config) {
   const databaseName = `${config.organization}/${config.database}`;
   return (signal, _ctx) => {
     if (signal.targetKind !== PLANETSCALE_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
-    const tableId = (0, import_types93.infraId)("sql-table", signal.targetName);
+    const tableId = (0, import_types95.infraId)("sql-table", signal.targetName);
     if (graph.hasNode(tableId)) {
-      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types93.EdgeType.CALLS };
+      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types95.EdgeType.CALLS };
     }
-    const providerId = (0, import_types93.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
+    const providerId = (0, import_types95.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
     return {
       targetNodeId: providerId,
       serviceName: config.serviceName,
-      edgeType: import_types93.EdgeType.CALLS,
+      edgeType: import_types95.EdgeType.CALLS,
       ensureInfraNode: { kind: PLANETSCALE_DATABASE_KIND, name: databaseName, provider: "planetscale" }
     };
   };
@@ -21987,7 +22602,7 @@ function mapBuildsToSignals(builds, serviceName) {
 
 // src/connectors/eas/resolve.ts
 init_cjs_shims();
-var import_types98 = require("@neat.is/types");
+var import_types100 = require("@neat.is/types");
 var NO_ENV2 = "unknown";
 var EAS_JSON_PHASES = /* @__PURE__ */ new Set(["READ_EAS_JSON"]);
 var APP_CONFIG_PHASES = /* @__PURE__ */ new Set([
@@ -22003,8 +22618,8 @@ function configBasenamesForPhase(phase) {
 function configNodeService(graph, configNodeId) {
   for (const edgeId of graph.inboundEdges(configNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types98.EdgeType.CONFIGURED_BY) continue;
-    const parsed = (0, import_types98.parseFileId)(edge.source);
+    if (edge.type !== import_types100.EdgeType.CONFIGURED_BY) continue;
+    const parsed = (0, import_types100.parseFileId)(edge.source);
     if (parsed) return parsed.service;
   }
   return null;
@@ -22015,7 +22630,7 @@ function findConfigNode(graph, basenames, serviceName) {
   graph.forEachNode((id, attrs) => {
     if (scoped) return;
     const node = attrs;
-    if (node.type !== import_types98.NodeType.ConfigNode) return;
+    if (node.type !== import_types100.NodeType.ConfigNode) return;
     if (typeof node.name !== "string" || !basenames.includes(node.name)) return;
     if (anyMatch === null) anyMatch = id;
     if (configNodeService(graph, id) === serviceName) scoped = id;
@@ -22032,13 +22647,13 @@ function createEasResolveTarget(graph) {
     if (basenames.length > 0) {
       const configNodeId = findConfigNode(graph, basenames, serviceName);
       if (configNodeId) {
-        return { targetNodeId: configNodeId, serviceName, edgeType: import_types98.EdgeType.CALLS };
+        return { targetNodeId: configNodeId, serviceName, edgeType: import_types100.EdgeType.CALLS };
       }
     }
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV2),
       serviceName,
-      edgeType: import_types98.EdgeType.CALLS
+      edgeType: import_types100.EdgeType.CALLS
     };
   };
 }
@@ -22682,6 +23297,35 @@ function registerRoutes(scope, ctx) {
     if (!proj) return;
     handleSse(req, reply, { project: proj.name });
   });
+  scope.get(
+    "/incident-triggers",
+    { config: BEARER_DELEGATED },
+    (req, reply) => {
+      const token = ctx.incidentStreamToken;
+      if (!token || Buffer.byteLength(token, "utf8") < 32 || token === ctx.generalAuthToken || !ctx.incidentReplayDurable) {
+        return reply.code(503).send({ error: "incident trigger stream unavailable" });
+      }
+      const header = req.headers.authorization;
+      const supplied = typeof header === "string" && header.startsWith("Bearer ") ? Buffer.from(header.slice("Bearer ".length), "utf8") : void 0;
+      const expected = Buffer.from(token, "utf8");
+      if (!supplied || supplied.length !== expected.length || !(0, import_node_crypto6.timingSafeEqual)(supplied, expected)) {
+        return reply.code(401).send({ error: "unauthorized" });
+      }
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+      if (!proj) return;
+      const errorsPath = errorsPathFor(proj);
+      if (!errorsPath) return reply.code(503).send({ error: "incident replay unavailable" });
+      let replay;
+      try {
+        const cursor = req.headers["last-event-id"];
+        if (Array.isArray(cursor)) throw new Error("invalid cursor");
+        replay = loadIncidentReplay(errorsPath, cursor);
+      } catch {
+        return reply.code(409).send({ error: "incident replay unavailable" });
+      }
+      handleSse(req, reply, { project: proj.name, incidentOnly: true, incidentReplay: replay });
+    }
+  );
   if (ctx.scope === "project") {
     scope.get("/health", async (req, reply) => {
       const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
@@ -22771,11 +23415,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types101.DivergenceTypeSchema.safeParse(c);
+        const r = import_types103.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types101.DivergenceTypeSchema.options
+            allowed: import_types103.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -22967,7 +23611,7 @@ function registerRoutes(scope, ctx) {
     const incidents = epath ? await readErrorEvents(epath) : [];
     let errorEvent;
     if (req.query.errorId) {
-      errorEvent = incidents.find((e) => e.id === req.query.errorId);
+      errorEvent = incidents.find((e) => e.id === req.query.errorId) ?? (epath ? await readErrorEventById(epath, req.query.errorId) : void 0);
       if (!errorEvent) {
         return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
       }
@@ -23153,6 +23797,26 @@ function registerRoutes(scope, ctx) {
     }
     return reply.code(202).send({ project: proj.name, ...syncNow() });
   });
+  scope.post("/pr-verdict", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    try {
+      const request = parsePrVerdictRequest(req.body);
+      const epath = errorsPathFor(proj);
+      const incidents = epath ? await readErrorEvents(epath) : [];
+      const verdict = await ctx.prVerdict(request, { liveGraph: proj.graph, incidents });
+      return { project: proj.name, ...verdict };
+    } catch (err) {
+      if (!(err instanceof PrVerdictError)) throw err;
+      if (err.status === 429) void reply.header("retry-after", "30");
+      return reply.code(err.status).send({
+        error: err.message,
+        project: proj.name,
+        ...err.stage ? { stage: err.stage } : {},
+        ...err.details !== void 0 ? { details: err.details } : {}
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -23192,7 +23856,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types101.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types103.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -23231,7 +23895,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types101.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types103.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -23440,6 +24104,8 @@ async function buildApi(opts) {
   const authToken = opts.authToken ?? env.authToken;
   const trustProxy = opts.trustProxy ?? env.trustProxy;
   const publicRead = opts.publicRead ?? env.publicRead;
+  const incidentStreamToken = opts.incidentStreamToken ?? process.env.NEAT_INCIDENT_STREAM_TOKEN;
+  const incidentReplayDurable = opts.incidentReplayDurable ?? (process.env.NEAT_INCIDENT_REPLAY_DURABLE === "1" && Buffer.byteLength(process.env.NEAT_INCIDENT_DURABLE_TOKEN ?? "", "utf8") >= 32);
   mountBearerAuth(app, {
     token: authToken,
     trustProxy,
@@ -23475,6 +24141,9 @@ async function buildApi(opts) {
   const routeCtx = {
     registry,
     startedAt,
+    incidentStreamToken,
+    incidentReplayDurable,
+    generalAuthToken: authToken,
     scope: "root",
     errorsPathFor,
     staleEventsPathFor,
@@ -23483,6 +24152,7 @@ async function buildApi(opts) {
     singleProject: opts.singleProject?.name,
     connectorsHome: opts.connectorsHome,
     repoSync: opts.repoSync,
+    prVerdict: opts.prVerdict ?? createPrVerdictRunner(),
     runPoll: opts.runPoll ?? runConnectorPoll
   };
   app.get("/health", async () => {
@@ -23587,9 +24257,9 @@ init_otel_grpc();
 
 // src/search.ts
 init_cjs_shims();
-var import_node_fs40 = require("fs");
-var import_node_path76 = __toESM(require("path"), 1);
-var import_node_crypto5 = require("crypto");
+var import_node_fs44 = require("fs");
+var import_node_path79 = __toESM(require("path"), 1);
+var import_node_crypto7 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
 var MINI_LM_DIM = 384;
@@ -23653,7 +24323,7 @@ function embedText(node) {
   return parts.join(" ");
 }
 function attrsHash(node) {
-  return (0, import_node_crypto5.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto7.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
 }
 function cosine(a, b) {
   if (a.length !== b.length) return 0;
@@ -23742,7 +24412,7 @@ async function pickEmbedder() {
 }
 async function readCache(cachePath) {
   try {
-    const raw = await import_node_fs40.promises.readFile(cachePath, "utf8");
+    const raw = await import_node_fs44.promises.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     return parsed;
@@ -23751,8 +24421,8 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  await import_node_fs40.promises.mkdir(import_node_path76.default.dirname(cachePath), { recursive: true });
-  await import_node_fs40.promises.writeFile(cachePath, JSON.stringify(cache));
+  await import_node_fs44.promises.mkdir(import_node_path79.default.dirname(cachePath), { recursive: true });
+  await import_node_fs44.promises.writeFile(cachePath, JSON.stringify(cache));
 }
 var VectorIndex = class {
   constructor(embedder, cachePath) {
@@ -23966,14 +24636,14 @@ async function bootProject(registry, name, scanPath, baseDir) {
 async function main() {
   const baseDirEnv = process.env.NEAT_OUT_DIR;
   const legacyOutPath = process.env.NEAT_OUT_PATH;
-  const baseDir = baseDirEnv ? import_node_path77.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path77.default.resolve(import_node_path77.default.dirname(legacyOutPath)) : import_node_path77.default.resolve("./neat-out");
-  const defaultScanPath = import_node_path77.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
+  const baseDir = baseDirEnv ? import_node_path80.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path80.default.resolve(import_node_path80.default.dirname(legacyOutPath)) : import_node_path80.default.resolve("./neat-out");
+  const defaultScanPath = import_node_path80.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
   const registry = new Projects();
   await bootProject(registry, DEFAULT_PROJECT, defaultScanPath, baseDir);
   for (const name of parseExtraProjects(process.env.NEAT_PROJECTS)) {
     const envKey = `NEAT_PROJECT_SCAN_PATH_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
     const projectScan = process.env[envKey];
-    await bootProject(registry, name, projectScan ? import_node_path77.default.resolve(projectScan) : void 0, baseDir);
+    await bootProject(registry, name, projectScan ? import_node_path80.default.resolve(projectScan) : void 0, baseDir);
   }
   const host = process.env.HOST ?? "0.0.0.0";
   const port = Number(process.env.PORT ?? 8080);