@neat.is/core 0.10.6-dev.20261009 → 0.10.6

package/dist/neatd.cjs

@@ -2882,7 +2882,7 @@ var PolicyViolationsLog = class {
 };
 
 // src/ingest.ts
-var import_types8 = require("@neat.is/types");
+var import_types9 = require("@neat.is/types");
 
 // src/extract/routes.ts
 init_cjs_shims();
@@ -5642,9 +5642,101 @@ async function addRoutes(graph, services) {
   return { nodesAdded, edgesAdded };
 }
 
-// src/columns.ts
+// src/extract/source-baseline.ts
 init_cjs_shims();
 var import_types7 = require("@neat.is/types");
+var states = /* @__PURE__ */ new WeakMap();
+var REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+function validCommit(commit, repository) {
+  return !!commit && commit.repository === repository && /^[0-9a-f]{40}$/.test(commit.sha);
+}
+function stateOf(graph) {
+  let state = states.get(graph);
+  if (!state) {
+    state = { repos: /* @__PURE__ */ new Map(), active: /* @__PURE__ */ new Set(), conflicted: /* @__PURE__ */ new Set() };
+    states.set(graph, state);
+  }
+  return state;
+}
+function setEntry(state, repository, baseline, generation = /* @__PURE__ */ Symbol()) {
+  state.repos.set(repository, {
+    baseline,
+    generation,
+    services: state.repos.get(repository)?.services ?? /* @__PURE__ */ new Set()
+  });
+}
+function readSourceBaselines(graph) {
+  const state = states.get(graph);
+  if (!state) return [];
+  return [...state.repos.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, entry2]) => ({ ...entry2.baseline }));
+}
+function invalidateSourceBaseline(graph, repository, status2 = "unavailable") {
+  if (repository !== void 0) {
+    if (REPOSITORY.test(repository)) setEntry(stateOf(graph), repository, { status: status2, repository });
+    return;
+  }
+  const state = states.get(graph);
+  if (!state) return;
+  for (const generation of state.active) state.conflicted.add(generation);
+  for (const name of state.repos.keys()) {
+    setEntry(state, name, { status: "unavailable", repository: name });
+  }
+}
+function retainSourceBaselines(graph, repositories) {
+  const state = states.get(graph);
+  if (!state) return;
+  const keep = new Set(repositories);
+  for (const name of [...state.repos.keys()]) if (!keep.has(name)) state.repos.delete(name);
+}
+function beginSourceExtraction(graph, source, commit) {
+  const generation = /* @__PURE__ */ Symbol();
+  const state = stateOf(graph);
+  if (source === void 0) {
+    invalidateSourceBaseline(graph);
+    state.active.add(generation);
+    return generation;
+  }
+  state.active.add(generation);
+  if (!REPOSITORY.test(source)) return generation;
+  setEntry(
+    state,
+    source,
+    validCommit(commit, source) ? { status: "syncing", repository: source } : { status: "unavailable", repository: source },
+    generation
+  );
+  return generation;
+}
+function servicesOf(graph, repository) {
+  const services = /* @__PURE__ */ new Set();
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type === import_types7.NodeType.FileNode && node.source === repository && node.service) {
+      services.add(node.service);
+    }
+  });
+  return services;
+}
+function finishSourceExtraction(graph, generation, source, commit, result) {
+  const state = states.get(graph);
+  if (!state) return;
+  state.active.delete(generation);
+  const conflicted = state.conflicted.delete(generation);
+  if (source === void 0 || !REPOSITORY.test(source)) return;
+  const entry2 = state.repos.get(source);
+  if (!entry2 || entry2.generation !== generation) return;
+  entry2.services = servicesOf(graph, source);
+  let shared = false;
+  for (const [name, other] of state.repos) {
+    if (name === source || ![...entry2.services].some((s) => other.services.has(s))) continue;
+    shared = true;
+    setEntry(state, name, { status: "unavailable", repository: name }, other.generation);
+  }
+  entry2.baseline = !conflicted && !shared && validCommit(commit, source) && result.extractionErrors === 0 && result.skippedFiles === 0 ? { status: "ready", repository: source, sha: commit.sha } : { status: "unavailable", repository: source };
+}
+
+// src/columns.ts
+init_cjs_shims();
+var import_types8 = require("@neat.is/types");
 var OBSERVED_COLUMN_CONFIDENCE = 0.9;
 function normalizeProvenances(provenances) {
   return [...new Set(provenances)].sort();
@@ -5687,10 +5779,10 @@ function foldSdkWrites(existing, writes) {
   return out;
 }
 function columnIsDeclared(col) {
-  return col.provenances.includes(import_types7.Provenance.EXTRACTED);
+  return col.provenances.includes(import_types8.Provenance.EXTRACTED);
 }
 function columnIsObserved(col) {
-  return col.provenances.includes(import_types7.Provenance.OBSERVED);
+  return col.provenances.includes(import_types8.Provenance.OBSERVED);
 }
 
 // src/latency-digest.ts
@@ -6154,11 +6246,11 @@ function callSiteFromSpan(span, serviceNode, scanPath) {
   };
 }
 function reconcileObservedRelPath(graph, serviceName, relPath) {
-  if (graph.hasNode((0, import_types8.fileId)(serviceName, relPath))) return relPath;
+  if (graph.hasNode((0, import_types9.fileId)(serviceName, relPath))) return relPath;
   let best = null;
   graph.forEachNode((_id, attrs) => {
     const a = attrs;
-    if (a.type !== import_types8.NodeType.FileNode || a.service !== serviceName) return;
+    if (a.type !== import_types9.NodeType.FileNode || a.service !== serviceName) return;
     if (a.discoveredVia === "otel") return;
     const p = a.path;
     if (!p) return;
@@ -6170,14 +6262,14 @@ function reconcileObservedRelPath(graph, serviceName, relPath) {
 }
 function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
   const svcAttrs = graph.hasNode(serviceNodeId) ? graph.getNodeAttributes(serviceNodeId) : void 0;
-  const canonicalService = svcAttrs && svcAttrs.type === import_types8.NodeType.ServiceNode && typeof svcAttrs.name === "string" ? svcAttrs.name : serviceName;
+  const canonicalService = svcAttrs && svcAttrs.type === import_types9.NodeType.ServiceNode && typeof svcAttrs.name === "string" ? svcAttrs.name : serviceName;
   const relPath = reconcileObservedRelPath(graph, canonicalService, callSite.relPath);
-  const fileNodeId = (0, import_types8.fileId)(canonicalService, relPath);
+  const fileNodeId = (0, import_types9.fileId)(canonicalService, relPath);
   if (!graph.hasNode(fileNodeId)) {
     const language = languageForExt(relPath);
     const node = {
       id: fileNodeId,
-      type: import_types8.NodeType.FileNode,
+      type: import_types9.NodeType.FileNode,
       service: canonicalService,
       path: relPath,
       ...language ? { language } : {},
@@ -6186,14 +6278,14 @@ function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
     };
     graph.addNode(fileNodeId, node);
   }
-  const containsId = makeObservedEdgeId(import_types8.EdgeType.CONTAINS, serviceNodeId, fileNodeId);
+  const containsId = makeObservedEdgeId(import_types9.EdgeType.CONTAINS, serviceNodeId, fileNodeId);
   if (!graph.hasEdge(containsId)) {
     const edge = {
       id: containsId,
       source: serviceNodeId,
       target: fileNodeId,
-      type: import_types8.EdgeType.CONTAINS,
-      provenance: import_types8.Provenance.OBSERVED
+      type: import_types9.EdgeType.CONTAINS,
+      provenance: import_types9.Provenance.OBSERVED
     };
     graph.addEdgeWithKey(containsId, serviceNodeId, fileNodeId, edge);
   }
@@ -6217,11 +6309,11 @@ function pickContainingSymbol(candidates, fn) {
   return [...candidates].sort(bySpan)[0].id;
 }
 function ensureObservedSymbolNode(graph, fileNodeId, service, relPath, fn, line) {
-  const sid = (0, import_types8.symbolId)(service, relPath, fn);
+  const sid = (0, import_types9.symbolId)(service, relPath, fn);
   if (!graph.hasNode(sid)) {
     const node = {
       id: sid,
-      type: import_types8.NodeType.SymbolNode,
+      type: import_types9.NodeType.SymbolNode,
       kind: "function",
       qualname: fn,
       span: { startLine: line, endLine: line },
@@ -6231,14 +6323,14 @@ function ensureObservedSymbolNode(graph, fileNodeId, service, relPath, fn, line)
     };
     graph.addNode(sid, node);
   }
-  const containsId = makeObservedEdgeId(import_types8.EdgeType.CONTAINS, fileNodeId, sid);
+  const containsId = makeObservedEdgeId(import_types9.EdgeType.CONTAINS, fileNodeId, sid);
   if (!graph.hasEdge(containsId)) {
     const edge = {
       id: containsId,
       source: fileNodeId,
       target: sid,
-      type: import_types8.EdgeType.CONTAINS,
-      provenance: import_types8.Provenance.OBSERVED
+      type: import_types9.EdgeType.CONTAINS,
+      provenance: import_types9.Provenance.OBSERVED
     };
     graph.addEdgeWithKey(containsId, fileNodeId, sid, edge);
   }
@@ -6250,9 +6342,9 @@ function landObservedSymbol(graph, fileNodeId, service, relPath, callSite, mint
   let sawSymbol = false;
   const candidates = [];
   graph.forEachOutboundEdge(fileNodeId, (_edge, edgeAttrs, _source, target) => {
-    if (edgeAttrs.type !== import_types8.EdgeType.CONTAINS) return;
+    if (edgeAttrs.type !== import_types9.EdgeType.CONTAINS) return;
     const t = graph.getNodeAttributes(target);
-    if (t.type !== import_types8.NodeType.SymbolNode) return;
+    if (t.type !== import_types9.NodeType.SymbolNode) return;
     sawSymbol = true;
     if (line >= t.span.startLine && line <= t.span.endLine) {
       candidates.push({ id: target, symbol: t });
@@ -6265,17 +6357,17 @@ function landObservedSymbol(graph, fileNodeId, service, relPath, callSite, mint
   return fileNodeId;
 }
 function makeObservedEdgeId(type, source, target) {
-  return (0, import_types8.observedEdgeId)(source, target, type);
+  return (0, import_types9.observedEdgeId)(source, target, type);
 }
 function makeInferredEdgeId(type, source, target) {
-  return (0, import_types8.inferredEdgeId)(source, target, type);
+  return (0, import_types9.inferredEdgeId)(source, target, type);
 }
 var INFERRED_CONFIDENCE = 0.6;
 var STITCH_MAX_DEPTH = 2;
 var STITCH_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types8.EdgeType.CALLS,
-  import_types8.EdgeType.CONNECTS_TO,
-  import_types8.EdgeType.DEPENDS_ON
+  import_types9.EdgeType.CALLS,
+  import_types9.EdgeType.CONNECTS_TO,
+  import_types9.EdgeType.DEPENDS_ON
 ]);
 var WIRE_SPAN_KIND_CLIENT = 3;
 var WIRE_SPAN_KIND_PRODUCER = 4;
@@ -6291,11 +6383,11 @@ function spanServesGraphqlOperation(kind) {
   return kind !== WIRE_SPAN_KIND_CLIENT && kind !== WIRE_SPAN_KIND_PRODUCER && kind !== WIRE_SPAN_KIND_CONSUMER;
 }
 function ensureGraphqlOperationNode(graph, serviceName, operationType, operationName) {
-  const id = (0, import_types8.graphqlOperationId)(serviceName, operationType, operationName);
+  const id = (0, import_types9.graphqlOperationId)(serviceName, operationType, operationName);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.GraphQLOperationNode,
+    type: import_types9.NodeType.GraphQLOperationNode,
     name: operationName,
     service: serviceName,
     operationType: operationType.toLowerCase(),
@@ -6309,11 +6401,11 @@ function spanServesGrpcMethod(kind) {
   return kind !== WIRE_SPAN_KIND_CLIENT && kind !== WIRE_SPAN_KIND_PRODUCER && kind !== WIRE_SPAN_KIND_CONSUMER;
 }
 function ensureGrpcMethodNode(graph, rpcService, rpcMethod) {
-  const id = (0, import_types8.grpcMethodId)(rpcService, rpcMethod);
+  const id = (0, import_types9.grpcMethodId)(rpcService, rpcMethod);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.GrpcMethodNode,
+    type: import_types9.NodeType.GrpcMethodNode,
     name: `${rpcService}/${rpcMethod}`,
     rpcService,
     rpcMethod,
@@ -6326,11 +6418,11 @@ function spanServesWebsocketChannel(kind) {
   return kind !== WIRE_SPAN_KIND_CLIENT && kind !== WIRE_SPAN_KIND_PRODUCER && kind !== WIRE_SPAN_KIND_CONSUMER;
 }
 function ensureWebsocketChannelNode(graph, serviceName, channel) {
-  const id = (0, import_types8.websocketChannelId)(serviceName, channel);
+  const id = (0, import_types9.websocketChannelId)(serviceName, channel);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.WebSocketChannelNode,
+    type: import_types9.NodeType.WebSocketChannelNode,
     name: channel,
     service: serviceName,
     channel,
@@ -6343,11 +6435,11 @@ function messagingDestinationKind(system) {
   return `${system}-topic`;
 }
 function ensureMessagingDestinationNode(graph, system, destination) {
-  const id = (0, import_types8.infraId)(messagingDestinationKind(system), destination);
+  const id = (0, import_types9.infraId)(messagingDestinationKind(system), destination);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.InfraNode,
+    type: import_types9.NodeType.InfraNode,
     name: destination,
     provider: "self",
     kind: messagingDestinationKind(system)
@@ -6391,9 +6483,9 @@ function lookupParentSpan(traceId, parentSpanId, now) {
   };
 }
 function resolveServiceId(graph, host, env) {
-  const envTagged = (0, import_types8.serviceId)(host, env);
+  const envTagged = (0, import_types9.serviceId)(host, env);
   if (graph.hasNode(envTagged)) return envTagged;
-  const envLess = (0, import_types8.serviceId)(host);
+  const envLess = (0, import_types9.serviceId)(host);
   if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
   let sameEnv = null;
   let envLessMatch = null;
@@ -6401,7 +6493,7 @@ function resolveServiceId(graph, host, env) {
   graph.forEachNode((id, attrs) => {
     if (sameEnv) return;
     const a = attrs;
-    if (a.type !== import_types8.NodeType.ServiceNode) return;
+    if (a.type !== import_types9.NodeType.ServiceNode) return;
     const matchesByName = a.name === host;
     const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
     if (!matchesByName && !matchesByAlias) return;
@@ -6416,14 +6508,14 @@ function resolveServiceId(graph, host, env) {
   return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
-  return (0, import_types8.frontierId)(host);
+  return (0, import_types9.frontierId)(host);
 }
 function resolveFusedServiceId(graph, serviceName, env) {
-  const id = (0, import_types8.serviceId)(serviceName, env);
+  const id = (0, import_types9.serviceId)(serviceName, env);
   if (graph.hasNode(id)) return id;
   const wanted = serviceName.toLowerCase();
   const extractedId = graph.findNode((_nid, attrs) => {
-    if (attrs.type !== import_types8.NodeType.ServiceNode) return false;
+    if (attrs.type !== import_types9.NodeType.ServiceNode) return false;
     const svc = attrs;
     if (svc.discoveredVia === "otel") return false;
     return typeof svc.name === "string" && svc.name.toLowerCase() === wanted;
@@ -6435,7 +6527,7 @@ function ensureServiceNode(graph, serviceName, env) {
   if (graph.hasNode(resolved)) return resolved;
   const node = {
     id: resolved,
-    type: import_types8.NodeType.ServiceNode,
+    type: import_types9.NodeType.ServiceNode,
     name: serviceName,
     language: "unknown",
     discoveredVia: "otel",
@@ -6445,11 +6537,11 @@ function ensureServiceNode(graph, serviceName, env) {
   return resolved;
 }
 function ensureInfraNode(graph, kind, name, provider) {
-  const id = (0, import_types8.infraId)(kind, name);
+  const id = (0, import_types9.infraId)(kind, name);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.InfraNode,
+    type: import_types9.NodeType.InfraNode,
     name,
     provider,
     kind
@@ -6461,7 +6553,7 @@ var COLUMN_BEARING_INFRA_KINDS = /* @__PURE__ */ new Set(["sql-table", "supabase
 function mergeColumnsAt(graph, tableNodeId, columns, provenance, confidence) {
   if (!columns || columns.length === 0 || !graph.hasNode(tableNodeId)) return;
   const node = graph.getNodeAttributes(tableNodeId);
-  if (node.type !== import_types8.NodeType.InfraNode || !node.kind || !COLUMN_BEARING_INFRA_KINDS.has(node.kind)) {
+  if (node.type !== import_types9.NodeType.InfraNode || !node.kind || !COLUMN_BEARING_INFRA_KINDS.has(node.kind)) {
     return;
   }
   graph.replaceNodeAttributes(tableNodeId, {
@@ -6470,7 +6562,7 @@ function mergeColumnsAt(graph, tableNodeId, columns, provenance, confidence) {
   });
 }
 function mergeObservedColumns(graph, tableNodeId, columns) {
-  mergeColumnsAt(graph, tableNodeId, columns, import_types8.Provenance.OBSERVED, OBSERVED_COLUMN_CONFIDENCE);
+  mergeColumnsAt(graph, tableNodeId, columns, import_types9.Provenance.OBSERVED, OBSERVED_COLUMN_CONFIDENCE);
 }
 function mergeObservedDeployState(graph, serviceNodeId, state) {
   if (!graph.hasNode(serviceNodeId)) return;
@@ -6481,11 +6573,11 @@ function mergeObservedDeployState(graph, serviceNodeId, state) {
   graph.mergeNodeAttributes(serviceNodeId, attrs);
 }
 function ensureDatabaseNode(graph, host, engine) {
-  const id = (0, import_types8.databaseId)(host);
+  const id = (0, import_types9.databaseId)(host);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.DatabaseNode,
+    type: import_types9.NodeType.DatabaseNode,
     name: host,
     engine,
     engineVersion: "unknown",
@@ -6497,11 +6589,11 @@ function ensureDatabaseNode(graph, host, engine) {
   return id;
 }
 function ensureLocalDatabaseNode(graph, serviceName, name, engine) {
-  const id = (0, import_types8.localDatabaseId)(serviceName, name);
+  const id = (0, import_types9.localDatabaseId)(serviceName, name);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: import_types8.NodeType.DatabaseNode,
+    type: import_types9.NodeType.DatabaseNode,
     name,
     engine,
     engineVersion: "unknown",
@@ -6516,17 +6608,17 @@ function findDeclaredDatabaseForService(graph, serviceNodeId, engine) {
   const sources = [serviceNodeId];
   for (const edgeId of graph.outboundEdges(serviceNodeId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === import_types8.EdgeType.CONTAINS) sources.push(e.target);
+    if (e.type === import_types9.EdgeType.CONTAINS) sources.push(e.target);
   }
   const matches = /* @__PURE__ */ new Set();
   for (const src of sources) {
     if (!graph.hasNode(src)) continue;
     for (const edgeId of graph.outboundEdges(src)) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.type !== import_types8.EdgeType.CONNECTS_TO || edge.provenance !== import_types8.Provenance.EXTRACTED) continue;
+      if (edge.type !== import_types9.EdgeType.CONNECTS_TO || edge.provenance !== import_types9.Provenance.EXTRACTED) continue;
       if (!graph.hasNode(edge.target)) continue;
       const target = graph.getNodeAttributes(edge.target);
-      if (target.type !== import_types8.NodeType.DatabaseNode || target.engine !== engine) continue;
+      if (target.type !== import_types9.NodeType.DatabaseNode || target.engine !== engine) continue;
       matches.add(edge.target);
     }
   }
@@ -6541,7 +6633,7 @@ function ensureFrontierNode(graph, host, ts) {
   }
   const node = {
     id,
-    type: import_types8.NodeType.FrontierNode,
+    type: import_types9.NodeType.FrontierNode,
     name: host,
     host,
     firstObserved: ts,
@@ -6594,11 +6686,11 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     };
     const updated = {
       ...existing,
-      provenance: import_types8.Provenance.OBSERVED,
+      provenance: import_types9.Provenance.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
       signal: newSignal,
-      confidence: (0, import_types8.confidenceForObservedSignal)(newSignal),
+      confidence: (0, import_types9.confidenceForObservedSignal)(newSignal),
       grain
       // backfills legacy edges that predate ADR-142
     };
@@ -6621,8 +6713,8 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     source,
     target,
     type,
-    provenance: import_types8.Provenance.OBSERVED,
-    confidence: (0, import_types8.confidenceForObservedSignal)(signal),
+    provenance: import_types9.Provenance.OBSERVED,
+    confidence: (0, import_types9.confidenceForObservedSignal)(signal),
     lastObserved: ts,
     callCount: 1,
     signal,
@@ -6644,9 +6736,9 @@ function stitchTrace(graph, sourceServiceId, ts) {
     const outbound = graph.outboundEdges(nodeId);
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.provenance !== import_types8.Provenance.EXTRACTED) continue;
+      if (edge.provenance !== import_types9.Provenance.EXTRACTED) continue;
       if (!STITCH_EDGE_TYPES.has(edge.type)) continue;
-      if (graph.hasEdge((0, import_types8.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
+      if (graph.hasEdge((0, import_types9.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
       if (!visited.has(edge.target)) {
         visited.add(edge.target);
@@ -6668,7 +6760,7 @@ function upsertInferredEdge(graph, type, source, target, ts) {
     source,
     target,
     type,
-    provenance: import_types8.Provenance.INFERRED,
+    provenance: import_types9.Provenance.INFERRED,
     confidence: INFERRED_CONFIDENCE,
     lastObserved: ts
   };
@@ -6682,7 +6774,7 @@ function emitIncidentEvent(project, ev) {
       incidentId: ev.id,
       affectedNode: ev.affectedNode,
       service: ev.service,
-      incidentKind: (0, import_types8.incidentKindOf)(ev),
+      incidentKind: (0, import_types9.incidentKindOf)(ev),
       at: ev.timestamp
     }
   });
@@ -6711,7 +6803,7 @@ function landIncidentCallSite(span, callSite, trusted, graph) {
   const canonicalService = serviceNodeName(graph, span) ?? span.service;
   const recovered = !trusted;
   if (graph) {
-    const fusedFileId = (0, import_types8.fileId)(canonicalService, relPath);
+    const fusedFileId = (0, import_types9.fileId)(canonicalService, relPath);
     if (graph.hasNode(fusedFileId)) {
       const node = landObservedSymbol(
         graph,
@@ -6731,7 +6823,7 @@ function landIncidentCallSite(span, callSite, trusted, graph) {
     }
     if (recovered) return null;
   }
-  return { affectedNode: (0, import_types8.fileId)(span.service, relPath) };
+  return { affectedNode: (0, import_types9.fileId)(span.service, relPath) };
 }
 function serviceNodeName(graph, span) {
   if (!graph) return void 0;
@@ -6748,7 +6840,7 @@ function stacktraceCallSite(span, serviceNode, scanPath) {
   return { relPath, line: frame.line, ...frame.fn ? { fn: frame.fn } : {} };
 }
 function incidentLocus(span, graph, scanPath) {
-  const sid = graph ? resolveFusedServiceId(graph, span.service, span.env) : (0, import_types8.serviceId)(span.service, span.env);
+  const sid = graph ? resolveFusedServiceId(graph, span.service, span.env) : (0, import_types9.serviceId)(span.service, span.env);
   const serviceNode = graph && graph.hasNode(sid) ? graph.getNodeAttributes(sid) : void 0;
   const callSite = callSiteFromSpan(span, serviceNode, scanPath);
   if (callSite) {
@@ -6939,7 +7031,7 @@ function findRouteNodeByHttpRoute(graph, serviceName, method, httpRoute) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types8.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types9.NodeType.RouteNode || a.service !== serviceName) return;
     if (m && a.method !== "ALL" && a.method !== m) return;
     if (normalizePathTemplate(a.pathTemplate) === target) found = id;
   });
@@ -6972,7 +7064,7 @@ async function handleSpan(ctx, span) {
       let targetId;
       if (host) {
         ensureDatabaseNode(ctx.graph, host, span.dbSystem);
-        targetId = (0, import_types8.databaseId)(host);
+        targetId = (0, import_types9.databaseId)(host);
       } else {
         const declared = findDeclaredDatabaseForService(ctx.graph, sourceId, span.dbSystem);
         if (declared) {
@@ -6989,7 +7081,7 @@ async function handleSpan(ctx, span) {
       }
       const result = upsertObservedEdge(
         ctx.graph,
-        import_types8.EdgeType.CONNECTS_TO,
+        import_types9.EdgeType.CONNECTS_TO,
         observedSource(),
         targetId,
         ts,
@@ -7003,7 +7095,7 @@ async function handleSpan(ctx, span) {
         const collectionId = ensureInfraNode(ctx.graph, "mongodb-collection", span.dbCollection, "self");
         upsertObservedEdge(
           ctx.graph,
-          import_types8.EdgeType.CALLS,
+          import_types9.EdgeType.CALLS,
           observedSource(),
           collectionId,
           ts,
@@ -7017,7 +7109,7 @@ async function handleSpan(ctx, span) {
         const tableId = ensureInfraNode(ctx.graph, "sql-table", span.dbTable, "self");
         upsertObservedEdge(
           ctx.graph,
-          import_types8.EdgeType.CALLS,
+          import_types9.EdgeType.CALLS,
           observedSource(),
           tableId,
           ts,
@@ -7035,7 +7127,7 @@ async function handleSpan(ctx, span) {
       span.messagingSystem,
       span.messagingDestination
     );
-    const edgeType = span.kind === WIRE_SPAN_KIND_CONSUMER ? import_types8.EdgeType.CONSUMES_FROM : import_types8.EdgeType.PUBLISHES_TO;
+    const edgeType = span.kind === WIRE_SPAN_KIND_CONSUMER ? import_types9.EdgeType.CONSUMES_FROM : import_types9.EdgeType.PUBLISHES_TO;
     const result = upsertObservedEdge(
       ctx.graph,
       edgeType,
@@ -7057,7 +7149,7 @@ async function handleSpan(ctx, span) {
     );
     const result = upsertObservedEdge(
       ctx.graph,
-      import_types8.EdgeType.CONTAINS,
+      import_types9.EdgeType.CONTAINS,
       observedSource(),
       targetId,
       ts,
@@ -7071,7 +7163,7 @@ async function handleSpan(ctx, span) {
     const targetId = ensureGrpcMethodNode(ctx.graph, span.rpcService, span.rpcMethod);
     const result = upsertObservedEdge(
       ctx.graph,
-      import_types8.EdgeType.CONTAINS,
+      import_types9.EdgeType.CONTAINS,
       observedSource(),
       targetId,
       ts,
@@ -7089,7 +7181,7 @@ async function handleSpan(ctx, span) {
     );
     const result = upsertObservedEdge(
       ctx.graph,
-      import_types8.EdgeType.CONNECTS_TO,
+      import_types9.EdgeType.CONNECTS_TO,
       observedSource(),
       targetId,
       ts,
@@ -7107,7 +7199,7 @@ async function handleSpan(ctx, span) {
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
-          import_types8.EdgeType.CALLS,
+          import_types9.EdgeType.CALLS,
           observedSource(),
           targetId,
           ts,
@@ -7122,7 +7214,7 @@ async function handleSpan(ctx, span) {
         const frontierNodeId = ensureFrontierNode(ctx.graph, host, ts);
         upsertObservedEdge(
           ctx.graph,
-          import_types8.EdgeType.CALLS,
+          import_types9.EdgeType.CALLS,
           observedSource(),
           frontierNodeId,
           ts,
@@ -7150,7 +7242,7 @@ async function handleSpan(ctx, span) {
         } : void 0;
         upsertObservedEdge(
           ctx.graph,
-          import_types8.EdgeType.CALLS,
+          import_types9.EdgeType.CALLS,
           fallbackSource,
           sourceId,
           ts,
@@ -7172,7 +7264,7 @@ async function handleSpan(ctx, span) {
     );
     if (routeNodeId) {
       const routeSvc = ctx.graph.getNodeAttributes(routeNodeId).service;
-      upsertObservedEdge(ctx.graph, import_types8.EdgeType.CONTAINS, (0, import_types8.serviceId)(routeSvc), routeNodeId, ts, isError, void 0, durationMs, errorDetail);
+      upsertObservedEdge(ctx.graph, import_types9.EdgeType.CONTAINS, (0, import_types9.serviceId)(routeSvc), routeNodeId, ts, isError, void 0, durationMs, errorDetail);
     }
   }
   if (span.statusCode === 2) {
@@ -7202,7 +7294,7 @@ function promoteFrontierNodes(graph, opts = {}) {
   const aliasIndex = /* @__PURE__ */ new Map();
   graph.forEachNode((id, attrs) => {
     const a = attrs;
-    if (a.type !== import_types8.NodeType.ServiceNode) return;
+    if (a.type !== import_types9.NodeType.ServiceNode) return;
     aliasIndex.set(a.name, id);
     if (a.aliases) {
       for (const alias of a.aliases) aliasIndex.set(alias, id);
@@ -7211,7 +7303,7 @@ function promoteFrontierNodes(graph, opts = {}) {
   const toPromote = [];
   graph.forEachNode((id, attrs) => {
     const a = attrs;
-    if (a.type !== import_types8.NodeType.FrontierNode) return;
+    if (a.type !== import_types9.NodeType.FrontierNode) return;
     const target = aliasIndex.get(a.host);
     if (!target) return;
     if (target === id) return;
@@ -7233,15 +7325,15 @@ function promoteFrontierNodes(graph, opts = {}) {
 }
 function stageFrontierEdge(graph, source, target, type) {
   if (!graph.hasNode(source) || !graph.hasNode(target)) return false;
-  if (graph.hasEdge((0, import_types8.observedEdgeId)(source, target, type))) return false;
-  const key = (0, import_types8.frontierEdgeId)(source, target, type);
+  if (graph.hasEdge((0, import_types9.observedEdgeId)(source, target, type))) return false;
+  const key = (0, import_types9.frontierEdgeId)(source, target, type);
   if (graph.hasEdge(key)) return false;
   graph.addEdgeWithKey(key, source, target, {
     id: key,
     source,
     target,
     type,
-    provenance: import_types8.Provenance.FRONTIER
+    provenance: import_types9.Provenance.FRONTIER
   });
   return true;
 }
@@ -7249,8 +7341,8 @@ function promoteFrontierEdges(graph) {
   const graduated = [];
   graph.forEachEdge((edgeId, attrs) => {
     const e = attrs;
-    if (e.provenance !== import_types8.Provenance.FRONTIER) return;
-    if (graph.hasEdge((0, import_types8.observedEdgeId)(e.source, e.target, e.type))) {
+    if (e.provenance !== import_types9.Provenance.FRONTIER) return;
+    if (graph.hasEdge((0, import_types9.observedEdgeId)(e.source, e.target, e.type))) {
       graduated.push(edgeId);
     }
   });
@@ -7271,7 +7363,7 @@ function rewireFrontierEdges(graph, frontierId2, serviceId17) {
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
   graph.dropEdge(oldEdgeId);
-  const newId = edge.provenance === import_types8.Provenance.OBSERVED ? (0, import_types8.observedEdgeId)(newSource, newTarget, edge.type) : edge.provenance === import_types8.Provenance.INFERRED ? (0, import_types8.inferredEdgeId)(newSource, newTarget, edge.type) : (0, import_types8.extractedEdgeId)(newSource, newTarget, edge.type);
+  const newId = edge.provenance === import_types9.Provenance.OBSERVED ? (0, import_types9.observedEdgeId)(newSource, newTarget, edge.type) : edge.provenance === import_types9.Provenance.INFERRED ? (0, import_types9.inferredEdgeId)(newSource, newTarget, edge.type) : (0, import_types9.extractedEdgeId)(newSource, newTarget, edge.type);
   if (graph.hasEdge(newId)) {
     const existing = graph.getEdgeAttributes(newId);
     const merged = {
@@ -7302,12 +7394,12 @@ async function markStaleEdges(graph, options = {}) {
   const project = options.project ?? DEFAULT_PROJECT;
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    if (e.provenance !== import_types8.Provenance.OBSERVED) return;
+    if (e.provenance !== import_types9.Provenance.OBSERVED) return;
     if (!e.lastObserved) return;
     const threshold = thresholdForEdgeType(e.type, thresholds);
     const age = now - new Date(e.lastObserved).getTime();
     if (age > threshold) {
-      const updated = { ...e, provenance: import_types8.Provenance.STALE, confidence: 0.3 };
+      const updated = { ...e, provenance: import_types9.Provenance.STALE, confidence: 0.3 };
       graph.replaceEdgeAttributes(id, updated);
       events.push({
         edgeId: id,
@@ -7324,8 +7416,8 @@ async function markStaleEdges(graph, options = {}) {
         project,
         payload: {
           edgeId: id,
-          from: import_types8.Provenance.OBSERVED,
-          to: import_types8.Provenance.STALE
+          from: import_types9.Provenance.OBSERVED,
+          to: import_types9.Provenance.STALE
         }
       });
     }
@@ -7473,6 +7565,7 @@ function describeZodIssues(error) {
   return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
 }
 function mergeSnapshot(graph, snapshot) {
+  invalidateSourceBaseline(graph);
   const exported = snapshot.graph;
   const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
   const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
@@ -7481,7 +7574,7 @@ function mergeSnapshot(graph, snapshot) {
   const validEdges = [];
   for (const node of incomingNodes) {
     if (node.attributes === void 0) continue;
-    const parsed = import_types8.GraphNodeSchema.safeParse(node.attributes);
+    const parsed = import_types9.GraphNodeSchema.safeParse(node.attributes);
     if (!parsed.success) {
       issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
       continue;
@@ -7490,7 +7583,7 @@ function mergeSnapshot(graph, snapshot) {
   }
   for (const edge of incomingEdges) {
     if (edge.attributes === void 0) continue;
-    const parsed = import_types8.GraphEdgeSchema.safeParse(edge.attributes);
+    const parsed = import_types9.GraphEdgeSchema.safeParse(edge.attributes);
     if (!parsed.success) {
       const label = edge.key ?? `${edge.source}->${edge.target}`;
       issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
@@ -7524,7 +7617,7 @@ var import_node_fs20 = require("fs");
 var import_node_path22 = __toESM(require("path"), 1);
 var import_ignore2 = __toESM(require("ignore"), 1);
 var import_minimatch2 = require("minimatch");
-var import_types18 = require("@neat.is/types");
+var import_types19 = require("@neat.is/types");
 
 // src/extract/python.ts
 init_cjs_shims();
@@ -7597,7 +7690,7 @@ function pythonToPackage(service) {
 init_cjs_shims();
 var import_node_fs11 = require("fs");
 var import_node_path12 = __toESM(require("path"), 1);
-var import_types9 = require("@neat.is/types");
+var import_types10 = require("@neat.is/types");
 function parseGoMod(source) {
   const module2 = source.match(/^\s*module\s+(\S+)\s*$/m)?.[1];
   if (!module2) return null;
@@ -7633,8 +7726,8 @@ async function discoverGoService(scanPath, dir) {
   const pkg = { name, dependencies: mod.dependencies };
   const framework = goFramework(mod.dependencies);
   const node = {
-    id: (0, import_types9.serviceId)(name),
-    type: import_types9.NodeType.ServiceNode,
+    id: (0, import_types10.serviceId)(name),
+    type: import_types10.NodeType.ServiceNode,
     name,
     language: "go",
     dependencies: mod.dependencies,
@@ -7648,7 +7741,7 @@ async function discoverGoService(scanPath, dir) {
 init_cjs_shims();
 var import_node_fs12 = require("fs");
 var import_node_path13 = __toESM(require("path"), 1);
-var import_types10 = require("@neat.is/types");
+var import_types11 = require("@neat.is/types");
 function parseGemfile(source) {
   const dependencies = {};
   for (const raw of source.split(/\r?\n/)) {
@@ -7672,8 +7765,8 @@ async function discoverRubyService(scanPath, dir) {
   const name = import_node_path13.default.basename(dir);
   const pkg = { name, dependencies: gemfile.dependencies };
   const node = {
-    id: (0, import_types10.serviceId)(name),
-    type: import_types10.NodeType.ServiceNode,
+    id: (0, import_types11.serviceId)(name),
+    type: import_types11.NodeType.ServiceNode,
     name,
     language: "ruby",
     dependencies: gemfile.dependencies,
@@ -7686,7 +7779,7 @@ async function discoverRubyService(scanPath, dir) {
 // src/extract/php.ts
 init_cjs_shims();
 var import_node_path14 = __toESM(require("path"), 1);
-var import_types11 = require("@neat.is/types");
+var import_types12 = require("@neat.is/types");
 function parseComposerJson(composer) {
   return {
     dependencies: {
@@ -7706,8 +7799,8 @@ async function discoverPhpService(scanPath, dir) {
   const name = import_node_path14.default.basename(dir);
   const pkg = { name, dependencies };
   const node = {
-    id: (0, import_types11.serviceId)(name),
-    type: import_types11.NodeType.ServiceNode,
+    id: (0, import_types12.serviceId)(name),
+    type: import_types12.NodeType.ServiceNode,
     name,
     language: "php",
     dependencies,
@@ -7721,7 +7814,7 @@ async function discoverPhpService(scanPath, dir) {
 init_cjs_shims();
 var import_node_fs13 = require("fs");
 var import_node_path15 = __toESM(require("path"), 1);
-var import_types12 = require("@neat.is/types");
+var import_types13 = require("@neat.is/types");
 var CSHARP_PROJECT_EXTS = /* @__PURE__ */ new Set([".csproj", ".sln"]);
 async function projectFiles(dir) {
   const entries = await import_node_fs13.promises.readdir(dir, { withFileTypes: true }).catch(() => []);
@@ -7768,8 +7861,8 @@ async function discoverCsharpService(scanPath, dir) {
   }
   const pkg = { name, dependencies };
   const node = {
-    id: (0, import_types12.serviceId)(name),
-    type: import_types12.NodeType.ServiceNode,
+    id: (0, import_types13.serviceId)(name),
+    type: import_types13.NodeType.ServiceNode,
     name,
     language: "csharp",
     dependencies,
@@ -7784,7 +7877,7 @@ async function discoverCsharpService(scanPath, dir) {
 init_cjs_shims();
 var import_node_fs14 = require("fs");
 var import_node_path16 = __toESM(require("path"), 1);
-var import_types13 = require("@neat.is/types");
+var import_types14 = require("@neat.is/types");
 var JAVA_MANIFESTS = ["pom.xml", "build.gradle", "build.gradle.kts"];
 async function hasJavaManifest(dir) {
   for (const manifest of JAVA_MANIFESTS) {
@@ -7839,8 +7932,8 @@ async function discoverJavaService(scanPath, dir) {
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
-    id: (0, import_types13.serviceId)(name),
-    type: import_types13.NodeType.ServiceNode,
+    id: (0, import_types14.serviceId)(name),
+    type: import_types14.NodeType.ServiceNode,
     name,
     language: "java",
     dependencies,
@@ -7853,7 +7946,7 @@ async function discoverJavaService(scanPath, dir) {
 init_cjs_shims();
 var import_node_fs15 = require("fs");
 var import_node_path17 = __toESM(require("path"), 1);
-var import_types14 = require("@neat.is/types");
+var import_types15 = require("@neat.is/types");
 var KOTLIN_SOURCE_EXT = ".kt";
 var JAVA_SOURCE_EXT = ".java";
 var SOURCE_PROBE_MAX_DEPTH = 8;
@@ -7904,8 +7997,8 @@ async function discoverKotlinService(scanPath, dir) {
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
-    id: (0, import_types14.serviceId)(name),
-    type: import_types14.NodeType.ServiceNode,
+    id: (0, import_types15.serviceId)(name),
+    type: import_types15.NodeType.ServiceNode,
     name,
     language: "kotlin",
     dependencies,
@@ -7919,7 +8012,7 @@ init_cjs_shims();
 var import_node_fs16 = require("fs");
 var import_node_path18 = __toESM(require("path"), 1);
 var import_smol_toml2 = require("smol-toml");
-var import_types15 = require("@neat.is/types");
+var import_types16 = require("@neat.is/types");
 var CARGO_MANIFEST = "Cargo.toml";
 async function hasRustManifest(dir) {
   return exists(import_node_path18.default.join(dir, CARGO_MANIFEST));
@@ -7954,8 +8047,8 @@ async function discoverRustService(scanPath, dir) {
   const dependencies = manifest.dependencies;
   const pkg = { name, dependencies };
   const node = {
-    id: (0, import_types15.serviceId)(name),
-    type: import_types15.NodeType.ServiceNode,
+    id: (0, import_types16.serviceId)(name),
+    type: import_types16.NodeType.ServiceNode,
     name,
     language: "rust",
     dependencies,
@@ -7968,7 +8061,7 @@ async function discoverRustService(scanPath, dir) {
 init_cjs_shims();
 var import_node_fs17 = require("fs");
 var import_node_path19 = __toESM(require("path"), 1);
-var import_types16 = require("@neat.is/types");
+var import_types17 = require("@neat.is/types");
 var CMAKE_MANIFEST = "CMakeLists.txt";
 async function hasCppManifest(dir) {
   return exists(import_node_path19.default.join(dir, CMAKE_MANIFEST));
@@ -7986,8 +8079,8 @@ async function discoverCppService(scanPath, dir) {
   const dependencies = {};
   const pkg = { name, dependencies };
   const node = {
-    id: (0, import_types16.serviceId)(name),
-    type: import_types16.NodeType.ServiceNode,
+    id: (0, import_types17.serviceId)(name),
+    type: import_types17.NodeType.ServiceNode,
     name,
     language: "cpp",
     dependencies,
@@ -8000,7 +8093,7 @@ async function discoverCppService(scanPath, dir) {
 init_cjs_shims();
 var import_node_fs18 = require("fs");
 var import_node_path20 = __toESM(require("path"), 1);
-var import_types17 = require("@neat.is/types");
+var import_types18 = require("@neat.is/types");
 function languageForSourceExt(ext) {
   switch (ext) {
     case ".py":
@@ -8086,8 +8179,8 @@ async function discoverDockerfileService(scanPath, dir) {
   const name = import_node_path20.default.basename(dir);
   const pkg = { name, dependencies: {} };
   const node = {
-    id: (0, import_types17.serviceId)(name),
-    type: import_types17.NodeType.ServiceNode,
+    id: (0, import_types18.serviceId)(name),
+    type: import_types18.NodeType.ServiceNode,
     name,
     language,
     dependencies: {},
@@ -8281,8 +8374,8 @@ async function discoverNodeService(scanPath, dir) {
   const framework = detectJsFramework(pkg);
   const language = await detectJsServiceLanguage(dir, pkg);
   const node = {
-    id: (0, import_types18.serviceId)(pkg.name),
-    type: import_types18.NodeType.ServiceNode,
+    id: (0, import_types19.serviceId)(pkg.name),
+    type: import_types19.NodeType.ServiceNode,
     name: pkg.name,
     language,
     version: pkg.version,
@@ -8298,8 +8391,8 @@ async function discoverPyService(scanPath, dir) {
   if (!py) return null;
   const pkg = pythonToPackage(py);
   const node = {
-    id: (0, import_types18.serviceId)(py.name),
-    type: import_types18.NodeType.ServiceNode,
+    id: (0, import_types19.serviceId)(py.name),
+    type: import_types19.NodeType.ServiceNode,
     name: py.name,
     language: "python",
     version: py.version,
@@ -8418,7 +8511,7 @@ init_cjs_shims();
 var import_node_path23 = __toESM(require("path"), 1);
 var import_node_fs21 = require("fs");
 var import_yaml2 = require("yaml");
-var import_types19 = require("@neat.is/types");
+var import_types20 = require("@neat.is/types");
 var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
   "Service",
   "Deployment",
@@ -8428,7 +8521,7 @@ var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
 function addAliases(graph, serviceId17, candidates) {
   if (!graph.hasNode(serviceId17)) return;
   const node = graph.getNodeAttributes(serviceId17);
-  if (node.type !== import_types19.NodeType.ServiceNode) return;
+  if (node.type !== import_types20.NodeType.ServiceNode) return;
   const set = new Set(node.aliases ?? []);
   for (const c of candidates) {
     if (!c) continue;
@@ -8618,7 +8711,7 @@ var import_tree_sitter_java = __toESM(require("tree-sitter-java"), 1);
 var import_tree_sitter_kotlin = __toESM(require("tree-sitter-kotlin"), 1);
 var import_tree_sitter_rust2 = __toESM(require("tree-sitter-rust"), 1);
 var import_tree_sitter_cpp = __toESM(require("tree-sitter-cpp"), 1);
-var import_types20 = require("@neat.is/types");
+var import_types21 = require("@neat.is/types");
 var PARSE_CHUNK3 = 16384;
 var GRAMMAR_BY_EXT = {
   ".ts": import_tree_sitter_typescript.default.typescript,
@@ -8671,7 +8764,9 @@ function collectSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const visit = (node, classCtx) => {
@@ -8730,7 +8825,9 @@ function collectPythonSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const visit = (node, classCtx) => {
@@ -8803,7 +8900,9 @@ function collectGoSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const visit = (node) => {
@@ -8837,7 +8936,9 @@ function collectRubySymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const nameText = (node) => node.childForFieldName("name")?.text.replace(/::/g, ".");
@@ -8888,7 +8989,9 @@ function collectPhpSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const dot = (s) => s.replace(/\\/g, ".").replace(/::/g, ".").replace(/^\.+/, "");
@@ -8954,7 +9057,9 @@ function collectCsharpSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const join2 = (prefix, name) => prefix ? `${prefix}.${name}` : name;
@@ -9016,7 +9121,9 @@ function collectJavaSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const join2 = (prefix, name) => prefix ? `${prefix}.${name}` : name;
@@ -9073,7 +9180,9 @@ function collectKotlinSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const join2 = (prefix, name) => prefix ? `${prefix}.${name}` : name;
@@ -9143,7 +9252,9 @@ function collectRustSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const join2 = (prefix, name) => prefix ? `${prefix}::${name}` : name;
@@ -9211,7 +9322,9 @@ function collectCppSymbolDefs(root) {
       kind,
       qualname,
       startLine: node.startPosition.row + 1,
-      endLine: node.endPosition.row + 1
+      endLine: node.endPosition.row + 1,
+      startIndex: node.startIndex,
+      endIndex: node.endIndex
     });
   };
   const join2 = (prefix, name) => prefix ? `${prefix}::${name}` : name;
@@ -9339,6 +9452,22 @@ function disambiguate(defs) {
     return { def, disambiguator: ordinal };
   });
 }
+function utf8Offsets(content, defs) {
+  if (content.includes("\uFFFD")) return /* @__PURE__ */ new Map();
+  const indices = [...new Set(defs.flatMap(({ startIndex, endIndex }) => [startIndex, endIndex]))].sort(
+    (a, b) => a - b
+  );
+  const offsets = /* @__PURE__ */ new Map();
+  let cursor = 0;
+  let bytes = 0;
+  for (const index of indices) {
+    if (index < cursor || index > content.length) return /* @__PURE__ */ new Map();
+    bytes += Buffer.byteLength(content.slice(cursor, index), "utf8");
+    offsets.set(index, bytes);
+    cursor = index;
+  }
+  return offsets;
+}
 async function addSymbols(graph, services) {
   const parsers = /* @__PURE__ */ new Map();
   const parserForExt5 = (ext) => {
@@ -9362,47 +9491,59 @@ async function addSymbols(graph, services) {
       if (!parser) continue;
       const relPath = toPosix(import_node_path25.default.relative(service.dir, file.path));
       let defs;
+      let completeParse;
       try {
         const tree = parseSource3(parser, file.content);
         defs = collectSymbolDefsForExt(ext, tree.rootNode);
+        completeParse = !tree.rootNode.hasError;
       } catch (err) {
         recordExtractionError("symbol extraction", file.path, err);
         continue;
       }
       if (defs.length === 0) continue;
-      const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
-        graph,
-        service.pkg.name,
-        service.node.id,
-        relPath
-      );
+      const offsets = completeParse ? utf8Offsets(file.content, defs) : /* @__PURE__ */ new Map();
+      const {
+        fileNodeId,
+        nodesAdded: fn,
+        edgesAdded: fe
+      } = ensureFileNode(graph, service.pkg.name, service.node.id, relPath);
       nodesAdded += fn;
       edgesAdded += fe;
       for (const { def, disambiguator } of disambiguate(defs)) {
-        const sid = (0, import_types20.symbolId)(service.pkg.name, relPath, def.qualname, disambiguator);
+        const sid = (0, import_types21.symbolId)(service.pkg.name, relPath, def.qualname, disambiguator);
+        const startByte = offsets.get(def.startIndex);
+        const endByte = offsets.get(def.endIndex);
+        const precise = startByte !== void 0 && endByte !== void 0 && endByte > startByte ? { startByte, endByte } : {};
+        const node = {
+          id: sid,
+          type: import_types21.NodeType.SymbolNode,
+          kind: def.kind,
+          qualname: def.qualname,
+          span: { startLine: def.startLine, endLine: def.endLine, ...precise },
+          service: service.pkg.name,
+          relPath,
+          discoveredVia: "static"
+        };
         if (!graph.hasNode(sid)) {
-          const node = {
-            id: sid,
-            type: import_types20.NodeType.SymbolNode,
-            kind: def.kind,
-            qualname: def.qualname,
-            span: { startLine: def.startLine, endLine: def.endLine },
-            service: service.pkg.name,
-            relPath,
-            discoveredVia: "static"
-          };
           graph.addNode(sid, node);
           nodesAdded++;
+        } else {
+          const previous = graph.getNodeAttributes(sid);
+          const discoveredVia = previous.discoveredVia === "otel" || previous.discoveredVia === "merged" ? "merged" : "static";
+          const moved = previous.span.startLine !== node.span.startLine || previous.span.endLine !== node.span.endLine || previous.span.startByte !== node.span.startByte || previous.span.endByte !== node.span.endByte;
+          if (moved || previous.kind !== node.kind || previous.qualname !== node.qualname || previous.discoveredVia !== discoveredVia || previous.service !== node.service || previous.relPath !== node.relPath) {
+            graph.replaceNodeAttributes(sid, { ...previous, ...node, discoveredVia });
+          }
         }
-        const containsId = (0, import_types20.extractedEdgeId)(fileNodeId, sid, import_types20.EdgeType.CONTAINS);
+        const containsId = (0, import_types21.extractedEdgeId)(fileNodeId, sid, import_types21.EdgeType.CONTAINS);
         if (!graph.hasEdge(containsId)) {
           const edge = {
             id: containsId,
             source: fileNodeId,
             target: sid,
-            type: import_types20.EdgeType.CONTAINS,
-            provenance: import_types20.Provenance.EXTRACTED,
-            confidence: (0, import_types20.confidenceForExtracted)("structural"),
+            type: import_types21.EdgeType.CONTAINS,
+            provenance: import_types21.Provenance.EXTRACTED,
+            confidence: (0, import_types21.confidenceForExtracted)("structural"),
             evidence: {
               file: relPath,
               line: def.startLine,
@@ -9422,7 +9563,7 @@ async function addSymbols(graph, services) {
 init_cjs_shims();
 var import_node_path26 = __toESM(require("path"), 1);
 var import_tree_sitter4 = __toESM(require("tree-sitter"), 1);
-var import_types21 = require("@neat.is/types");
+var import_types22 = require("@neat.is/types");
 function extendsInfo(classHeritage) {
   for (let i = 0; i < classHeritage.namedChildCount; i++) {
     const child = classHeritage.namedChild(i);
@@ -9540,7 +9681,7 @@ async function addSymbolEdges(graph, services) {
       }
       const disambiguated = disambiguate(collectSymbolDefs(root));
       const locals = disambiguated.map(({ def, disambiguator }) => ({
-        sid: (0, import_types21.symbolId)(serviceName, relPath, def.qualname, disambiguator),
+        sid: (0, import_types22.symbolId)(serviceName, relPath, def.qualname, disambiguator),
         qualname: def.qualname,
         kind: def.kind,
         startLine: def.startLine,
@@ -9569,10 +9710,10 @@ async function addSymbolEdges(graph, services) {
         if (local) return local.kind === wantKind ? local.sid : null;
         const imp = resolvedImports.get(name);
         if (imp) {
-          const candidate = (0, import_types21.symbolId)(serviceName, imp.targetRelPath, imp.importedName);
+          const candidate = (0, import_types22.symbolId)(serviceName, imp.targetRelPath, imp.importedName);
           if (graph.hasNode(candidate)) {
             const node = graph.getNodeAttributes(candidate);
-            if (node.type === import_types21.NodeType.SymbolNode && node.kind === wantKind) return candidate;
+            if (node.type === import_types22.NodeType.SymbolNode && node.kind === wantKind) return candidate;
           }
         }
         return null;
@@ -9599,7 +9740,7 @@ async function addSymbolEdges(graph, services) {
                   sourceSid: self.sid,
                   targetName: ext.name,
                   wantKind: "class",
-                  edgeType: import_types21.EdgeType.INHERITS,
+                  edgeType: import_types22.EdgeType.INHERITS,
                   line: ext.line
                 });
               }
@@ -9608,7 +9749,7 @@ async function addSymbolEdges(graph, services) {
                   sourceSid: self.sid,
                   targetName: impl.name,
                   wantKind: "class",
-                  edgeType: import_types21.EdgeType.IMPLEMENTS,
+                  edgeType: import_types22.EdgeType.IMPLEMENTS,
                   line: impl.line
                 });
               }
@@ -9624,7 +9765,7 @@ async function addSymbolEdges(graph, services) {
                 sourceSid: caller.sid,
                 targetName: fn.text,
                 wantKind: "function",
-                edgeType: import_types21.EdgeType.CALLS,
+                edgeType: import_types22.EdgeType.CALLS,
                 line
               });
             }
@@ -9640,15 +9781,15 @@ async function addSymbolEdges(graph, services) {
         const targetSid = resolveTarget(req2.targetName, req2.wantKind);
         if (!targetSid) continue;
         if (targetSid === req2.sourceSid) continue;
-        const edgeId = (0, import_types21.extractedEdgeId)(req2.sourceSid, targetSid, req2.edgeType);
+        const edgeId = (0, import_types22.extractedEdgeId)(req2.sourceSid, targetSid, req2.edgeType);
         if (graph.hasEdge(edgeId)) continue;
         const edge = {
           id: edgeId,
           source: req2.sourceSid,
           target: targetSid,
           type: req2.edgeType,
-          provenance: import_types21.Provenance.EXTRACTED,
-          confidence: (0, import_types21.confidenceForExtracted)("structural"),
+          provenance: import_types22.Provenance.EXTRACTED,
+          confidence: (0, import_types22.confidenceForExtracted)("structural"),
           evidence: {
             file: relPath,
             line: req2.line,
@@ -9667,7 +9808,7 @@ async function addSymbolEdges(graph, services) {
 init_cjs_shims();
 var import_node_path27 = __toESM(require("path"), 1);
 var import_tree_sitter5 = __toESM(require("tree-sitter"), 1);
-var import_types22 = require("@neat.is/types");
+var import_types23 = require("@neat.is/types");
 function stringLiteralText2(node) {
   for (let i = 0; i < node.childCount; i++) {
     const child = node.child(i);
@@ -9837,11 +9978,11 @@ async function addServerActions(graph, services) {
       nodesAdded += fn;
       edgesAdded += fe;
       for (const action of actions) {
-        const aid = (0, import_types22.serverActionId)(service.pkg.name, relPath, action.exportName);
+        const aid = (0, import_types23.serverActionId)(service.pkg.name, relPath, action.exportName);
         if (!graph.hasNode(aid)) {
           const node = {
             id: aid,
-            type: import_types22.NodeType.ServerActionNode,
+            type: import_types23.NodeType.ServerActionNode,
             name: action.exportName,
             service: service.pkg.name,
             module: relPath,
@@ -9853,15 +9994,15 @@ async function addServerActions(graph, services) {
           graph.addNode(aid, node);
           nodesAdded++;
         }
-        const containsId = (0, import_types22.extractedEdgeId)(fileNodeId, aid, import_types22.EdgeType.CONTAINS);
+        const containsId = (0, import_types23.extractedEdgeId)(fileNodeId, aid, import_types23.EdgeType.CONTAINS);
         if (!graph.hasEdge(containsId)) {
           const edge = {
             id: containsId,
             source: fileNodeId,
             target: aid,
-            type: import_types22.EdgeType.CONTAINS,
-            provenance: import_types22.Provenance.EXTRACTED,
-            confidence: (0, import_types22.confidenceForExtracted)("structural"),
+            type: import_types23.EdgeType.CONTAINS,
+            provenance: import_types23.Provenance.EXTRACTED,
+            confidence: (0, import_types23.confidenceForExtracted)("structural"),
             evidence: {
               file: relPath,
               line: action.line,
@@ -9891,7 +10032,7 @@ async function addServerActions(graph, services) {
       for (const [local, binding] of bindings) {
         const target = await resolveJsImport(binding.specifier, fileDir, service.dir, tsPaths);
         if (!target) continue;
-        const aid = (0, import_types22.serverActionId)(service.pkg.name, target, binding.importedName);
+        const aid = (0, import_types23.serverActionId)(service.pkg.name, target, binding.importedName);
         if (graph.hasNode(aid)) actionBindings.set(local, aid);
       }
       if (actionBindings.size === 0) continue;
@@ -9906,15 +10047,15 @@ async function addServerActions(graph, services) {
           nodesAdded += ensured.nodesAdded;
           edgesAdded += ensured.edgesAdded;
         }
-        const callsId = (0, import_types22.extractedEdgeId)(clientFileId, aid, import_types22.EdgeType.CALLS);
+        const callsId = (0, import_types23.extractedEdgeId)(clientFileId, aid, import_types23.EdgeType.CALLS);
         if (graph.hasEdge(callsId)) continue;
         const edge = {
           id: callsId,
           source: clientFileId,
           target: aid,
-          type: import_types22.EdgeType.CALLS,
-          provenance: import_types22.Provenance.EXTRACTED,
-          confidence: (0, import_types22.confidenceForExtracted)("structural"),
+          type: import_types23.EdgeType.CALLS,
+          provenance: import_types23.Provenance.EXTRACTED,
+          confidence: (0, import_types23.confidenceForExtracted)("structural"),
           evidence: {
             file: relPath,
             line,
@@ -9932,7 +10073,7 @@ async function addServerActions(graph, services) {
 // src/extract/databases/index.ts
 init_cjs_shims();
 var import_node_path36 = __toESM(require("path"), 1);
-var import_types23 = require("@neat.is/types");
+var import_types24 = require("@neat.is/types");
 
 // src/extract/databases/db-config-yaml.ts
 init_cjs_shims();
@@ -10591,8 +10732,8 @@ function compatibleDriversFor(engine) {
 }
 function toDatabaseNode(config) {
   return {
-    id: (0, import_types23.databaseId)(config.host),
-    type: import_types23.NodeType.DatabaseNode,
+    id: (0, import_types24.databaseId)(config.host),
+    type: import_types24.NodeType.DatabaseNode,
     name: config.database || config.host,
     engine: config.engine,
     engineVersion: config.engineVersion,
@@ -10733,12 +10874,12 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       edgesAdded += fe;
       const evidenceFile = toPosix(import_node_path36.default.relative(scanPath, config.sourceFile));
       const edge = {
-        id: (0, import_types3.extractedEdgeId)(fileNodeId, dbNode.id, import_types23.EdgeType.CONNECTS_TO),
+        id: (0, import_types3.extractedEdgeId)(fileNodeId, dbNode.id, import_types24.EdgeType.CONNECTS_TO),
         source: fileNodeId,
         target: dbNode.id,
-        type: import_types23.EdgeType.CONNECTS_TO,
-        provenance: import_types23.Provenance.EXTRACTED,
-        confidence: (0, import_types23.confidenceForExtracted)("structural"),
+        type: import_types24.EdgeType.CONNECTS_TO,
+        provenance: import_types24.Provenance.EXTRACTED,
+        confidence: (0, import_types24.confidenceForExtracted)("structural"),
         // Carry how the host was recovered (ADR-213) so the divergence ranker
         // can tell a real declared store from a hardcoded fault-injection /
         // flag-gated probe. Only set when the parser distinguished the two.
@@ -10753,11 +10894,11 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       const primary = allConfigs[0];
       service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
       const relPath = import_node_path36.default.relative(scanPath, primary.sourceFile);
-      const cfgId = (0, import_types23.configId)(relPath);
+      const cfgId = (0, import_types24.configId)(relPath);
       if (!graph.hasNode(cfgId)) {
         const cfgNode = {
           id: cfgId,
-          type: import_types23.NodeType.ConfigNode,
+          type: import_types24.NodeType.ConfigNode,
           name: import_node_path36.default.basename(primary.sourceFile),
           path: relPath,
           fileType: isConfigFile(import_node_path36.default.basename(primary.sourceFile)).fileType || "config"
@@ -10766,12 +10907,12 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         nodesAdded++;
       }
       const cfgEdge = {
-        id: (0, import_types3.extractedEdgeId)(service.node.id, cfgId, import_types23.EdgeType.CONFIGURED_BY),
+        id: (0, import_types3.extractedEdgeId)(service.node.id, cfgId, import_types24.EdgeType.CONFIGURED_BY),
         source: service.node.id,
         target: cfgId,
-        type: import_types23.EdgeType.CONFIGURED_BY,
-        provenance: import_types23.Provenance.EXTRACTED,
-        confidence: (0, import_types23.confidenceForExtracted)("structural"),
+        type: import_types24.EdgeType.CONFIGURED_BY,
+        provenance: import_types24.Provenance.EXTRACTED,
+        confidence: (0, import_types24.confidenceForExtracted)("structural"),
         evidence: { file: toPosix(relPath) }
       };
       if (!graph.hasEdge(cfgEdge.id)) {
@@ -10803,7 +10944,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs25 = require("fs");
 var import_node_path37 = __toESM(require("path"), 1);
-var import_types24 = require("@neat.is/types");
+var import_types25 = require("@neat.is/types");
 async function walkConfigFiles(dir, excludeDirs = []) {
   const excluded = new Set(excludeDirs.map((d) => import_node_path37.default.resolve(d)));
   const out = [];
@@ -10832,8 +10973,8 @@ async function addConfigNodes(graph, services, scanPath) {
     for (const file of configFiles) {
       const relPath = import_node_path37.default.relative(scanPath, file);
       const node = {
-        id: (0, import_types24.configId)(relPath),
-        type: import_types24.NodeType.ConfigNode,
+        id: (0, import_types25.configId)(relPath),
+        type: import_types25.NodeType.ConfigNode,
         name: import_node_path37.default.basename(file),
         path: relPath,
         fileType: isConfigFile(import_node_path37.default.basename(file)).fileType
@@ -10852,12 +10993,12 @@ async function addConfigNodes(graph, services, scanPath) {
       nodesAdded += fn;
       edgesAdded += fe;
       const edge = {
-        id: (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types24.EdgeType.CONFIGURED_BY),
+        id: (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types25.EdgeType.CONFIGURED_BY),
         source: fileNodeId,
         target: node.id,
-        type: import_types24.EdgeType.CONFIGURED_BY,
-        provenance: import_types24.Provenance.EXTRACTED,
-        confidence: (0, import_types24.confidenceForExtracted)("structural"),
+        type: import_types25.EdgeType.CONFIGURED_BY,
+        provenance: import_types25.Provenance.EXTRACTED,
+        confidence: (0, import_types25.confidenceForExtracted)("structural"),
         evidence: { file: relPath.split(import_node_path37.default.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
@@ -10873,7 +11014,7 @@ async function addConfigNodes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs26 = require("fs");
 var import_node_path38 = __toESM(require("path"), 1);
-var import_types25 = require("@neat.is/types");
+var import_types26 = require("@neat.is/types");
 var PROTO_EXTENSION = ".proto";
 function packageOf(content) {
   const m = content.match(/^\s*package\s+([A-Za-z_][A-Za-z0-9_.]*)\s*;/m);
@@ -10953,11 +11094,11 @@ async function addGrpcMethods(graph, services) {
       }
       if (methods.length === 0) continue;
       for (const method of methods) {
-        const mid = (0, import_types25.grpcMethodId)(method.rpcService, method.rpcMethod);
+        const mid = (0, import_types26.grpcMethodId)(method.rpcService, method.rpcMethod);
         if (!graph.hasNode(mid)) {
           const node = {
             id: mid,
-            type: import_types25.NodeType.GrpcMethodNode,
+            type: import_types26.NodeType.GrpcMethodNode,
             name: `${method.rpcService}/${method.rpcMethod}`,
             rpcService: method.rpcService,
             rpcMethod: method.rpcMethod,
@@ -10968,15 +11109,15 @@ async function addGrpcMethods(graph, services) {
           graph.addNode(mid, node);
           nodesAdded++;
         }
-        const containsId = (0, import_types25.extractedEdgeId)(service.node.id, mid, import_types25.EdgeType.CONTAINS);
+        const containsId = (0, import_types26.extractedEdgeId)(service.node.id, mid, import_types26.EdgeType.CONTAINS);
         if (!graph.hasEdge(containsId)) {
           const edge = {
             id: containsId,
             source: service.node.id,
             target: mid,
-            type: import_types25.EdgeType.CONTAINS,
-            provenance: import_types25.Provenance.EXTRACTED,
-            confidence: (0, import_types25.confidenceForExtracted)("structural"),
+            type: import_types26.EdgeType.CONTAINS,
+            provenance: import_types26.Provenance.EXTRACTED,
+            confidence: (0, import_types26.confidenceForExtracted)("structural"),
             evidence: {
               file: relFile,
               line: method.line,
@@ -10994,7 +11135,7 @@ async function addGrpcMethods(graph, services) {
 
 // src/extract/calls/index.ts
 init_cjs_shims();
-var import_types45 = require("@neat.is/types");
+var import_types46 = require("@neat.is/types");
 
 // src/extract/calls/http.ts
 init_cjs_shims();
@@ -11003,7 +11144,7 @@ var import_tree_sitter6 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript4 = __toESM(require("tree-sitter-javascript"), 1);
 var import_tree_sitter_typescript2 = __toESM(require("tree-sitter-typescript"), 1);
 var import_tree_sitter_python4 = __toESM(require("tree-sitter-python"), 1);
-var import_types26 = require("@neat.is/types");
+var import_types27 = require("@neat.is/types");
 var STRING_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set(["string_fragment", "string_content"]);
 var JSX_EXTERNAL_LINK_TAGS = /* @__PURE__ */ new Set(["a", "Link", "NavLink", "ExternalLink", "Anchor"]);
 function isInsideJsxExternalLink(node) {
@@ -11097,7 +11238,7 @@ async function addHttpCallEdges(graph, services) {
         const dedupKey = `${relFile}|${targetId}`;
         if (seen.has(dedupKey)) continue;
         seen.add(dedupKey);
-        const confidence = (0, import_types26.confidenceForExtracted)("url-literal-service-target");
+        const confidence = (0, import_types27.confidenceForExtracted)("url-literal-service-target");
         const ev = {
           file: relFile,
           line: site.line,
@@ -11111,25 +11252,25 @@ async function addHttpCallEdges(graph, services) {
         );
         nodesAdded += n;
         edgesAdded += e;
-        if (!(0, import_types26.passesExtractedFloor)(confidence)) {
+        if (!(0, import_types27.passesExtractedFloor)(confidence)) {
           noteExtractedDropped({
             source: fileNodeId,
             target: targetId,
-            type: import_types26.EdgeType.CALLS,
+            type: import_types27.EdgeType.CALLS,
             confidence,
             confidenceKind: "url-literal-service-target",
             evidence: ev
           });
           continue;
         }
-        const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, targetId, import_types26.EdgeType.CALLS);
+        const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, targetId, import_types27.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: fileNodeId,
             target: targetId,
-            type: import_types26.EdgeType.CALLS,
-            provenance: import_types26.Provenance.EXTRACTED,
+            type: import_types27.EdgeType.CALLS,
+            provenance: import_types27.Provenance.EXTRACTED,
             confidence,
             evidence: ev
           };
@@ -11147,7 +11288,7 @@ init_cjs_shims();
 var import_node_path40 = __toESM(require("path"), 1);
 var import_tree_sitter7 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript5 = __toESM(require("tree-sitter-javascript"), 1);
-var import_types27 = require("@neat.is/types");
+var import_types28 = require("@neat.is/types");
 var PARSE_CHUNK5 = 16384;
 function parseSource5(parser, source) {
   return parser.parse(
@@ -11391,9 +11532,9 @@ function buildRouteIndex(graph) {
   const index = /* @__PURE__ */ new Map();
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types27.NodeType.RouteNode) return;
+    if (node.type !== import_types28.NodeType.RouteNode) return;
     const route = attrs;
-    const owner = (0, import_types27.serviceId)(route.service);
+    const owner = (0, import_types28.serviceId)(route.service);
     const entry2 = {
       method: route.method.toUpperCase(),
       normalizedPath: normalizePathTemplate(route.pathTemplate),
@@ -11448,8 +11589,8 @@ async function addRouteCallEdges(graph, services) {
           noteExtractedDropped({
             source: fileNodeId2,
             target: "route:unresolved",
-            type: import_types27.EdgeType.CALLS,
-            confidence: (0, import_types27.confidenceForExtracted)("reconstructed-approximate"),
+            type: import_types28.EdgeType.CALLS,
+            confidence: (0, import_types28.confidenceForExtracted)("reconstructed-approximate"),
             confidenceKind: "reconstructed-approximate",
             evidence: {
               file: relFile,
@@ -11482,7 +11623,7 @@ async function addRouteCallEdges(graph, services) {
         edgesAdded += e;
         const anchored = pathHasLiteralAnchor(site.pathTemplate);
         const confidenceKind = site.approximate && !anchored ? "reconstructed-approximate" : "verified-call-site";
-        const confidence = (0, import_types27.confidenceForExtracted)(confidenceKind);
+        const confidence = (0, import_types28.confidenceForExtracted)(confidenceKind);
         const ev = {
           file: relFile,
           line: site.line,
@@ -11491,25 +11632,25 @@ async function addRouteCallEdges(graph, services) {
           pathTemplate: site.pathTemplate,
           ...confidenceKind === "reconstructed-approximate" ? { approximate: true, reason: site.reason } : {}
         };
-        if (!(0, import_types27.passesExtractedFloor)(confidence)) {
+        if (!(0, import_types28.passesExtractedFloor)(confidence)) {
           noteExtractedDropped({
             source: fileNodeId,
             target: match.routeNodeId,
-            type: import_types27.EdgeType.CALLS,
+            type: import_types28.EdgeType.CALLS,
             confidence,
             confidenceKind,
             evidence: ev
           });
           continue;
         }
-        const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, match.routeNodeId, import_types27.EdgeType.CALLS);
+        const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, match.routeNodeId, import_types28.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: fileNodeId,
             target: match.routeNodeId,
-            type: import_types27.EdgeType.CALLS,
-            provenance: import_types27.Provenance.EXTRACTED,
+            type: import_types28.EdgeType.CALLS,
+            provenance: import_types28.Provenance.EXTRACTED,
             confidence,
             evidence: ev
           };
@@ -11525,7 +11666,7 @@ async function addRouteCallEdges(graph, services) {
 // src/extract/calls/kafka.ts
 init_cjs_shims();
 var import_node_path41 = __toESM(require("path"), 1);
-var import_types28 = require("@neat.is/types");
+var import_types29 = require("@neat.is/types");
 var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
 var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
 var SARAMA_IMPORT_RE = /"[^"]*\/sarama"/;
@@ -11602,7 +11743,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
     seen.add(key);
     const line = anchor !== void 0 ? file.content.slice(0, anchor).split("\n").length : lineOf(file.content, topic);
     out.push({
-      infraId: (0, import_types28.infraId)("kafka-topic", topic),
+      infraId: (0, import_types29.infraId)("kafka-topic", topic),
       name: topic,
       kind: "kafka-topic",
       edgeType,
@@ -11630,7 +11771,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/redis.ts
 init_cjs_shims();
 var import_node_path42 = __toESM(require("path"), 1);
-var import_types29 = require("@neat.is/types");
+var import_types30 = require("@neat.is/types");
 var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
 function redisEndpointsFromFile(file, serviceDir) {
   const out = [];
@@ -11643,7 +11784,7 @@ function redisEndpointsFromFile(file, serviceDir) {
     seen.add(host);
     const line = lineOf(file.content, host);
     out.push({
-      infraId: (0, import_types29.infraId)("redis", host),
+      infraId: (0, import_types30.infraId)("redis", host),
       name: host,
       kind: "redis",
       edgeType: "CALLS",
@@ -11664,7 +11805,7 @@ function redisEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/aws.ts
 init_cjs_shims();
 var import_node_path43 = __toESM(require("path"), 1);
-var import_types30 = require("@neat.is/types");
+var import_types31 = require("@neat.is/types");
 var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
 var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
 function hasMarker(text, markers) {
@@ -11688,7 +11829,7 @@ function awsEndpointsFromFile(file, serviceDir) {
     seen.add(key);
     const line = lineOf(file.content, name);
     out.push({
-      infraId: (0, import_types30.infraId)(kind, name),
+      infraId: (0, import_types31.infraId)(kind, name),
       name,
       kind,
       edgeType: "CALLS",
@@ -11723,7 +11864,7 @@ function awsEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/grpc.ts
 init_cjs_shims();
 var import_node_path44 = __toESM(require("path"), 1);
-var import_types31 = require("@neat.is/types");
+var import_types32 = require("@neat.is/types");
 var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
 var AWS_SDK_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@aws-sdk\/client-([a-z0-9-]+)['"`]/g;
 var GRPC_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@grpc\/grpc-js['"`]|_grpc_pb['"`]/;
@@ -11772,7 +11913,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
     const { kind } = classified;
     const line = lineOf(file.content, m[0]);
     out.push({
-      infraId: (0, import_types31.infraId)(kind, name),
+      infraId: (0, import_types32.infraId)(kind, name),
       name,
       kind,
       edgeType: "CALLS",
@@ -11793,7 +11934,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
 // src/extract/calls/supabase.ts
 init_cjs_shims();
 var import_node_path45 = __toESM(require("path"), 1);
-var import_types32 = require("@neat.is/types");
+var import_types33 = require("@neat.is/types");
 var SUPABASE_JS_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/supabase-js['"`]/;
 var SUPABASE_SSR_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/ssr['"`]/;
 var SUPABASE_CLIENT_RE = /\b(createClient|createServerClient|createBrowserClient)\s*\(\s*(?:['"`]([^'"`]*)['"`])?/g;
@@ -11841,7 +11982,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
     seen.add(name);
     const line = lineOf(file.content, m[0]);
     out.push({
-      infraId: (0, import_types32.infraId)("supabase", name),
+      infraId: (0, import_types33.infraId)("supabase", name),
       name,
       kind: "supabase",
       edgeType: "CALLS",
@@ -11872,7 +12013,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
       seen.add(key);
       const line = lineOf(file.content, am[0]);
       out.push({
-        infraId: (0, import_types32.infraId)(kind, resource),
+        infraId: (0, import_types33.infraId)(kind, resource),
         name: resource,
         kind,
         edgeType: "CALLS",
@@ -11893,7 +12034,7 @@ init_cjs_shims();
 var import_node_path46 = __toESM(require("path"), 1);
 var import_tree_sitter8 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript6 = __toESM(require("tree-sitter-javascript"), 1);
-var import_types33 = require("@neat.is/types");
+var import_types34 = require("@neat.is/types");
 var FIRESTORE_CLIENT_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])firebase\/firestore['"`]/;
 var FIRESTORE_ADMIN_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])firebase-admin(?:\/firestore)?['"`]/;
 function parserForExt2(ext) {
@@ -12157,7 +12298,7 @@ function firestoreEndpointsFromFile(file, serviceDir, imported) {
       }
     }
     out.push({
-      infraId: (0, import_types33.infraId)("firestore-collection", collPath),
+      infraId: (0, import_types34.infraId)("firestore-collection", collPath),
       name: collPath,
       kind: "firestore-collection",
       edgeType: "CALLS",
@@ -12273,7 +12414,7 @@ async function firestoreCrossFileEndpoints(files, serviceDir) {
 // src/extract/calls/mongoose.ts
 init_cjs_shims();
 var import_node_path47 = __toESM(require("path"), 1);
-var import_types34 = require("@neat.is/types");
+var import_types35 = require("@neat.is/types");
 var MONGOOSE_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongoose['"`]/;
 var MONGODB_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongodb['"`]/;
 var PLURALIZE_DISABLED_RE = /\bpluralize\s*\(\s*(?:null|false)\s*\)/;
@@ -12418,7 +12559,7 @@ function collectModelDefs(content, pluralizeOn) {
 function endpoint(r, file, serviceDir, matchText) {
   const line = lineOf(file.content, matchText);
   return {
-    infraId: (0, import_types34.infraId)(r.kind, r.name),
+    infraId: (0, import_types35.infraId)(r.kind, r.name),
     name: r.name,
     kind: r.kind,
     edgeType: "CALLS",
@@ -12571,7 +12712,7 @@ init_cjs_shims();
 var import_node_path48 = __toESM(require("path"), 1);
 var import_tree_sitter9 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_python5 = __toESM(require("tree-sitter-python"), 1);
-var import_types35 = require("@neat.is/types");
+var import_types36 = require("@neat.is/types");
 var SQLALCHEMY_IMPORT_RE = /(?:from|import)\s+(?:flask_sqlalchemy|sqlalchemy)\b/;
 var PARSE_CHUNK6 = 16384;
 function makePyParser3() {
@@ -12725,7 +12866,7 @@ function sqlalchemyEndpointsFromFile(file, serviceDir) {
     if (seen.has(name)) return;
     seen.add(name);
     out.push({
-      infraId: (0, import_types35.infraId)("sql-table", name),
+      infraId: (0, import_types36.infraId)("sql-table", name),
       name,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -12833,7 +12974,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
       if (seen.has(key)) continue;
       seen.add(key);
       out.push({
-        infraId: (0, import_types35.infraId)("sql-table", t),
+        infraId: (0, import_types36.infraId)("sql-table", t),
         name: t,
         kind: "sql-table",
         edgeType: "CALLS",
@@ -12854,7 +12995,7 @@ init_cjs_shims();
 var import_node_path49 = __toESM(require("path"), 1);
 var import_tree_sitter10 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_python6 = __toESM(require("tree-sitter-python"), 1);
-var import_types36 = require("@neat.is/types");
+var import_types37 = require("@neat.is/types");
 var SOCKET_IMPORT_RE = /(?:^|\n)\s*(?:import\s+socket\b|from\s+socket\s+import\b)/;
 var PARSE_CHUNK7 = 16384;
 function makePyParser4() {
@@ -12920,7 +13061,7 @@ function socketEndpointsFromFile(file, serviceDir) {
     seen.add(name);
     const line = node.startPosition.row + 1;
     out.push({
-      infraId: (0, import_types36.infraId)("socket", name),
+      infraId: (0, import_types37.infraId)("socket", name),
       name,
       kind: "socket",
       edgeType: "CALLS",
@@ -12941,7 +13082,7 @@ init_cjs_shims();
 var import_node_path50 = __toESM(require("path"), 1);
 var import_tree_sitter11 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_python7 = __toESM(require("tree-sitter-python"), 1);
-var import_types37 = require("@neat.is/types");
+var import_types38 = require("@neat.is/types");
 var DJANGO_IMPORT_RE = /(?:from|import)\s+django\b/;
 var PARSE_CHUNK8 = 16384;
 function makePyParser5() {
@@ -13021,7 +13162,7 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
     seen.add(table);
     const line = node.startPosition.row + 1;
     out.push({
-      infraId: (0, import_types37.infraId)("sql-table", table),
+      infraId: (0, import_types38.infraId)("sql-table", table),
       name: table,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -13037,7 +13178,7 @@ init_cjs_shims();
 var import_node_path51 = __toESM(require("path"), 1);
 var import_tree_sitter12 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript7 = __toESM(require("tree-sitter-javascript"), 1);
-var import_types38 = require("@neat.is/types");
+var import_types39 = require("@neat.is/types");
 var DRIZZLE_IMPORT_RE = /drizzle-orm/;
 var TABLE_BUILDERS = /* @__PURE__ */ new Set(["pgTable", "mysqlTable", "sqliteTable"]);
 function parserForExt3(ext) {
@@ -13128,7 +13269,7 @@ function drizzleEndpointsFromFile(file, serviceDir) {
           const columns = columnsFromObject(obj);
           const line = node.startPosition.row + 1;
           out.push({
-            infraId: (0, import_types38.infraId)("sql-table", tableName),
+            infraId: (0, import_types39.infraId)("sql-table", tableName),
             name: tableName,
             kind: "sql-table",
             edgeType: "CALLS",
@@ -13238,7 +13379,7 @@ function drizzleForeignKeys(file, serviceDir) {
 // src/extract/calls/prisma.ts
 init_cjs_shims();
 var import_node_path52 = __toESM(require("path"), 1);
-var import_types39 = require("@neat.is/types");
+var import_types40 = require("@neat.is/types");
 var SCALAR_TYPES = /* @__PURE__ */ new Set([
   "Int",
   "String",
@@ -13286,7 +13427,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
     if (seenTable.has(b.tableName)) return;
     seenTable.add(b.tableName);
     out.push({
-      infraId: (0, import_types39.infraId)("sql-table", b.tableName),
+      infraId: (0, import_types40.infraId)("sql-table", b.tableName),
       name: b.tableName,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -13458,7 +13599,7 @@ init_cjs_shims();
 var import_node_path53 = __toESM(require("path"), 1);
 var import_tree_sitter13 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_ruby3 = __toESM(require("tree-sitter-ruby"), 1);
-var import_types40 = require("@neat.is/types");
+var import_types41 = require("@neat.is/types");
 var AR_SCHEMA_RE = /ActiveRecord::Schema/;
 var PARSE_CHUNK9 = 16384;
 function makeRubyParser2() {
@@ -13656,7 +13797,7 @@ function railsSchemaEndpointsFromFile(file, serviceDir) {
     if (!table || seen.has(table.name)) return;
     seen.add(table.name);
     out.push({
-      infraId: (0, import_types40.infraId)("sql-table", table.name),
+      infraId: (0, import_types41.infraId)("sql-table", table.name),
       name: table.name,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -13762,7 +13903,7 @@ function railsModelEndpointsFromFile(file, serviceDir) {
     seen.add(table);
     const line = node.startPosition.row + 1;
     out.push({
-      infraId: (0, import_types40.infraId)("sql-table", table),
+      infraId: (0, import_types41.infraId)("sql-table", table),
       name: table,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -13820,7 +13961,7 @@ init_cjs_shims();
 var import_node_path54 = __toESM(require("path"), 1);
 var import_tree_sitter14 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_php3 = __toESM(require("tree-sitter-php"), 1);
-var import_types41 = require("@neat.is/types");
+var import_types42 = require("@neat.is/types");
 var LARAVEL_SCHEMA_RE = /\bSchema::(create|createIfNotExists|table)\b/;
 var PARSE_CHUNK10 = 16384;
 function makePhpParser2() {
@@ -14067,7 +14208,7 @@ function laravelMigrationEndpointsFromFile(file, serviceDir) {
       }
     }
     out.push({
-      infraId: (0, import_types41.infraId)("sql-table", bp.table),
+      infraId: (0, import_types42.infraId)("sql-table", bp.table),
       name: bp.table,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -14210,7 +14351,7 @@ function laravelModelEndpointsFromFile(file, serviceDir) {
     seen.add(table);
     const line = node.startPosition.row + 1;
     out.push({
-      infraId: (0, import_types41.infraId)("sql-table", table),
+      infraId: (0, import_types42.infraId)("sql-table", table),
       name: table,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -14267,7 +14408,7 @@ init_cjs_shims();
 var import_node_path57 = __toESM(require("path"), 1);
 var import_tree_sitter15 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_go4 = __toESM(require("tree-sitter-go"), 1);
-var import_types42 = require("@neat.is/types");
+var import_types43 = require("@neat.is/types");
 init_otel();
 var PARSE_CHUNK11 = 16384;
 var DATABASE_SQL_METHODS = /* @__PURE__ */ new Set([
@@ -14361,7 +14502,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
     const columns = columnsFromSqlStatement(sql);
     const line = node.startPosition.row + 1;
     out.push({
-      infraId: (0, import_types42.infraId)("sql-table", table),
+      infraId: (0, import_types43.infraId)("sql-table", table),
       name: table,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -14382,7 +14523,7 @@ init_cjs_shims();
 var import_node_path58 = __toESM(require("path"), 1);
 var import_tree_sitter16 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_go5 = __toESM(require("tree-sitter-go"), 1);
-var import_types43 = require("@neat.is/types");
+var import_types44 = require("@neat.is/types");
 var GORM_IMPORT_RE = /gorm\.io\/gorm/;
 var PARSE_CHUNK12 = 16384;
 function makeGoParser4() {
@@ -14827,7 +14968,7 @@ function gormEndpointsFromFile(file, serviceDir) {
     const columns = [];
     collectColumns(struct, structs, /* @__PURE__ */ new Set(), "", columns, /* @__PURE__ */ new Set());
     out.push({
-      infraId: (0, import_types43.infraId)("sql-table", table),
+      infraId: (0, import_types44.infraId)("sql-table", table),
       name: table,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -14898,7 +15039,7 @@ init_cjs_shims();
 var import_node_path59 = __toESM(require("path"), 1);
 var import_tree_sitter17 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_c_sharp2 = __toESM(require("tree-sitter-c-sharp"), 1);
-var import_types44 = require("@neat.is/types");
+var import_types45 = require("@neat.is/types");
 var EFCORE_GATE = /Microsoft\.EntityFrameworkCore|DataAnnotations\.Schema|\bDbContext\b|\bDbSet\s*</;
 var PARSE_CHUNK13 = 16384;
 function makeCsParser() {
@@ -14983,7 +15124,7 @@ function efcoreEndpointsFromFile(file, serviceDir) {
     if (!name || seen.has(name)) return;
     seen.add(name);
     out.push({
-      infraId: (0, import_types44.infraId)("sql-table", name),
+      infraId: (0, import_types45.infraId)("sql-table", name),
       name,
       kind: "sql-table",
       edgeType: "CALLS",
@@ -15013,11 +15154,11 @@ function efcoreEndpointsFromFile(file, serviceDir) {
 function edgeTypeFromEndpoint(ep) {
   switch (ep.edgeType) {
     case "PUBLISHES_TO":
-      return import_types45.EdgeType.PUBLISHES_TO;
+      return import_types46.EdgeType.PUBLISHES_TO;
     case "CONSUMES_FROM":
-      return import_types45.EdgeType.CONSUMES_FROM;
+      return import_types46.EdgeType.CONSUMES_FROM;
     default:
-      return import_types45.EdgeType.CALLS;
+      return import_types46.EdgeType.CALLS;
   }
 }
 function isAwsKind(kind) {
@@ -15088,7 +15229,7 @@ async function addExternalEndpointEdges(graph, services) {
       if (!graph.hasNode(ep.infraId)) {
         const node = {
           id: ep.infraId,
-          type: import_types45.NodeType.InfraNode,
+          type: import_types46.NodeType.InfraNode,
           name: ep.name,
           // #238 — `aws-*` covers AWS-SDK client kinds (aws-s3, aws-dynamodb,
           // aws-cognito-identity-provider, …); `s3-` / `dynamodb-` cover the
@@ -15101,21 +15242,21 @@ async function addExternalEndpointEdges(graph, services) {
       }
       if (ep.columns && ep.columns.length > 0) {
         const node = graph.getNodeAttributes(ep.infraId);
-        if (node.type === import_types45.NodeType.InfraNode) {
+        if (node.type === import_types46.NodeType.InfraNode) {
           graph.replaceNodeAttributes(ep.infraId, {
             ...node,
             columns: foldColumns(
               node.columns,
               ep.columns,
-              import_types45.Provenance.EXTRACTED,
-              (0, import_types45.confidenceForExtracted)(ep.confidenceKind)
+              import_types46.Provenance.EXTRACTED,
+              (0, import_types46.confidenceForExtracted)(ep.confidenceKind)
             )
           });
         }
       }
       if (ep.sdkWrites && Object.keys(ep.sdkWrites).length > 0) {
         const node = graph.getNodeAttributes(ep.infraId);
-        if (node.type === import_types45.NodeType.InfraNode) {
+        if (node.type === import_types46.NodeType.InfraNode) {
           graph.replaceNodeAttributes(ep.infraId, {
             ...node,
             columns: foldSdkWrites(node.columns, ep.sdkWrites)
@@ -15123,7 +15264,7 @@ async function addExternalEndpointEdges(graph, services) {
         }
       }
       const edgeType = edgeTypeFromEndpoint(ep);
-      const confidence = (0, import_types45.confidenceForExtracted)(ep.confidenceKind);
+      const confidence = (0, import_types46.confidenceForExtracted)(ep.confidenceKind);
       const relFile = toPosix(ep.evidence.file);
       const { fileNodeId, nodesAdded: n, edgesAdded: e } = ensureFileNode(
         graph,
@@ -15133,7 +15274,7 @@ async function addExternalEndpointEdges(graph, services) {
       );
       nodesAdded += n;
       edgesAdded += e;
-      if (!(0, import_types45.passesExtractedFloor)(confidence)) {
+      if (!(0, import_types46.passesExtractedFloor)(confidence)) {
         noteExtractedDropped({
           source: fileNodeId,
           target: ep.infraId,
@@ -15153,7 +15294,7 @@ async function addExternalEndpointEdges(graph, services) {
           source: fileNodeId,
           target: ep.infraId,
           type: edgeType,
-          provenance: import_types45.Provenance.EXTRACTED,
+          provenance: import_types46.Provenance.EXTRACTED,
           confidence,
           evidence: ep.evidence
         };
@@ -15176,7 +15317,7 @@ async function addCallEdges(graph, services) {
 
 // src/extract/table-edges.ts
 init_cjs_shims();
-var import_types46 = require("@neat.is/types");
+var import_types47 = require("@neat.is/types");
 async function addTableEdges(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
@@ -15204,20 +15345,20 @@ async function addTableEdges(graph, services) {
     }
     refs.push(...modelRefs);
     for (const ref of refs) {
-      const childId = (0, import_types46.infraId)("sql-table", ref.childTable);
-      const parentId = (0, import_types46.infraId)("sql-table", ref.parentTable);
+      const childId = (0, import_types47.infraId)("sql-table", ref.childTable);
+      const parentId = (0, import_types47.infraId)("sql-table", ref.parentTable);
       if (childId === parentId) continue;
       nodesAdded += ensureTableNode(graph, childId, ref.childTable);
       nodesAdded += ensureTableNode(graph, parentId, ref.parentTable);
-      const edgeId = (0, import_types46.extractedEdgeId)(childId, parentId, import_types46.EdgeType.REFERENCES);
+      const edgeId = (0, import_types47.extractedEdgeId)(childId, parentId, import_types47.EdgeType.REFERENCES);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: childId,
         target: parentId,
-        type: import_types46.EdgeType.REFERENCES,
-        provenance: import_types46.Provenance.EXTRACTED,
-        confidence: (0, import_types46.confidenceForExtracted)("structural"),
+        type: import_types47.EdgeType.REFERENCES,
+        provenance: import_types47.Provenance.EXTRACTED,
+        confidence: (0, import_types47.confidenceForExtracted)("structural"),
         evidence: ref.evidence
       };
       graph.addEdgeWithKey(edgeId, childId, parentId, edge);
@@ -15230,7 +15371,7 @@ function ensureTableNode(graph, id, name) {
   if (graph.hasNode(id)) return 0;
   const node = {
     id,
-    type: import_types46.NodeType.InfraNode,
+    type: import_types47.NodeType.InfraNode,
     name,
     provider: "self",
     kind: "sql-table"
@@ -15245,15 +15386,15 @@ init_cjs_shims();
 // src/extract/infra/docker-compose.ts
 init_cjs_shims();
 var import_node_path60 = __toESM(require("path"), 1);
-var import_types48 = require("@neat.is/types");
+var import_types49 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
 init_cjs_shims();
-var import_types47 = require("@neat.is/types");
+var import_types48 = require("@neat.is/types");
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: (0, import_types47.infraId)(kind, name),
-    type: import_types47.NodeType.InfraNode,
+    id: (0, import_types48.infraId)(kind, name),
+    type: import_types48.NodeType.InfraNode,
     name,
     provider,
     kind,
@@ -15297,8 +15438,8 @@ function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provide
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types47.Provenance.EXTRACTED,
-      confidence: (0, import_types47.confidenceForExtracted)("structural"),
+      provenance: import_types48.Provenance.EXTRACTED,
+      confidence: (0, import_types48.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -15365,15 +15506,15 @@ async function addComposeInfra(graph, scanPath, services) {
     for (const dep of dependsOnList(svc.depends_on)) {
       const targetId = composeNameToNodeId.get(dep);
       if (!targetId) continue;
-      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types48.EdgeType.DEPENDS_ON);
+      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types49.EdgeType.DEPENDS_ON);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: sourceId,
         target: targetId,
-        type: import_types48.EdgeType.DEPENDS_ON,
-        provenance: import_types48.Provenance.EXTRACTED,
-        confidence: (0, import_types48.confidenceForExtracted)("structural"),
+        type: import_types49.EdgeType.DEPENDS_ON,
+        provenance: import_types49.Provenance.EXTRACTED,
+        confidence: (0, import_types49.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -15387,7 +15528,7 @@ async function addComposeInfra(graph, scanPath, services) {
 init_cjs_shims();
 var import_node_path61 = __toESM(require("path"), 1);
 var import_node_fs27 = require("fs");
-var import_types49 = require("@neat.is/types");
+var import_types50 = require("@neat.is/types");
 function readDockerfile(content) {
   let image = null;
   const ports = [];
@@ -15446,15 +15587,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     );
     nodesAdded += fn;
     edgesAdded += fe;
-    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types49.EdgeType.RUNS_ON);
+    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types50.EdgeType.RUNS_ON);
     if (!graph.hasEdge(edgeId)) {
       const edge = {
         id: edgeId,
         source: fileNodeId,
         target: node.id,
-        type: import_types49.EdgeType.RUNS_ON,
-        provenance: import_types49.Provenance.EXTRACTED,
-        confidence: (0, import_types49.confidenceForExtracted)("structural"),
+        type: import_types50.EdgeType.RUNS_ON,
+        provenance: import_types50.Provenance.EXTRACTED,
+        confidence: (0, import_types50.confidenceForExtracted)("structural"),
         evidence: {
           file: evidenceFile,
           ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
@@ -15469,15 +15610,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         graph.addNode(portNode.id, portNode);
         nodesAdded++;
       }
-      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types49.EdgeType.CONNECTS_TO);
+      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types50.EdgeType.CONNECTS_TO);
       if (graph.hasEdge(portEdgeId)) continue;
       const portEdge = {
         id: portEdgeId,
         source: fileNodeId,
         target: portNode.id,
-        type: import_types49.EdgeType.CONNECTS_TO,
-        provenance: import_types49.Provenance.EXTRACTED,
-        confidence: (0, import_types49.confidenceForExtracted)("structural"),
+        type: import_types50.EdgeType.CONNECTS_TO,
+        provenance: import_types50.Provenance.EXTRACTED,
+        confidence: (0, import_types50.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
       };
       graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
@@ -15491,7 +15632,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs28 = require("fs");
 var import_node_path62 = __toESM(require("path"), 1);
-var import_types50 = require("@neat.is/types");
+var import_types51 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
@@ -15572,16 +15713,16 @@ async function addTerraformResources(graph, scanPath) {
         if (!target) continue;
         if (seen.has(target.nodeId)) continue;
         seen.add(target.nodeId);
-        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types50.EdgeType.DEPENDS_ON);
+        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types51.EdgeType.DEPENDS_ON);
         if (graph.hasEdge(edgeId)) continue;
         const line = lineAt2(content, resource.bodyOffset + ref.index);
         const edge = {
           id: edgeId,
           source: resource.nodeId,
           target: target.nodeId,
-          type: import_types50.EdgeType.DEPENDS_ON,
-          provenance: import_types50.Provenance.EXTRACTED,
-          confidence: (0, import_types50.confidenceForExtracted)("structural"),
+          type: import_types51.EdgeType.DEPENDS_ON,
+          provenance: import_types51.Provenance.EXTRACTED,
+          confidence: (0, import_types51.confidenceForExtracted)("structural"),
           evidence: { file: evidenceFile, line, snippet: key }
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -15597,7 +15738,7 @@ init_cjs_shims();
 var import_node_fs29 = require("fs");
 var import_node_path63 = __toESM(require("path"), 1);
 var import_yaml3 = require("yaml");
-var import_types51 = require("@neat.is/types");
+var import_types52 = require("@neat.is/types");
 var K8S_KIND_TO_INFRA_KIND = {
   Service: "k8s-service",
   Deployment: "k8s-deployment",
@@ -15657,7 +15798,7 @@ async function addK8sResources(graph, scanPath) {
         nodesAdded++;
       }
       if (isWorkload) {
-        const svcId = (0, import_types51.serviceId)(name);
+        const svcId = (0, import_types52.serviceId)(name);
         if (graph.hasNode(svcId)) {
           const svc = graph.getNodeAttributes(svcId);
           graph.replaceNodeAttributes(svcId, {
@@ -15669,7 +15810,7 @@ async function addK8sResources(graph, scanPath) {
           edgesAdded += emitPlatformResourceEdge(
             graph,
             svcId,
-            import_types51.EdgeType.RUNS_ON,
+            import_types52.EdgeType.RUNS_ON,
             infraKind,
             name,
             "kubernetes",
@@ -15688,7 +15829,7 @@ init_cjs_shims();
 var import_node_fs30 = require("fs");
 var import_node_path64 = __toESM(require("path"), 1);
 var import_smol_toml3 = require("smol-toml");
-var import_types52 = require("@neat.is/types");
+var import_types53 = require("@neat.is/types");
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
@@ -15736,8 +15877,8 @@ function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, li
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types52.Provenance.EXTRACTED,
-      confidence: (0, import_types52.confidenceForExtracted)("structural"),
+      provenance: import_types53.Provenance.EXTRACTED,
+      confidence: (0, import_types53.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -15798,15 +15939,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       nodesAdded++;
     }
     if (runtimeNode.id !== anchorId) {
-      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types52.EdgeType.RUNS_ON);
+      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types53.EdgeType.RUNS_ON);
       if (!graph.hasEdge(runsOnId)) {
         const edge = {
           id: runsOnId,
           source: anchorId,
           target: runtimeNode.id,
-          type: import_types52.EdgeType.RUNS_ON,
-          provenance: import_types52.Provenance.EXTRACTED,
-          confidence: (0, import_types52.confidenceForExtracted)("structural"),
+          type: import_types53.EdgeType.RUNS_ON,
+          provenance: import_types53.Provenance.EXTRACTED,
+          confidence: (0, import_types53.confidenceForExtracted)("structural"),
           evidence: {
             file: evidenceFile,
             ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
@@ -15820,7 +15961,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types52.EdgeType.CONNECTS_TO,
+        import_types53.EdgeType.CONNECTS_TO,
         "cloudflare-route",
         route,
         evidenceFile,
@@ -15844,7 +15985,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         const result = addResourceEdge(
           graph,
           anchorId,
-          import_types52.EdgeType.DEPENDS_ON,
+          import_types53.EdgeType.DEPENDS_ON,
           group.kind,
           name,
           evidenceFile,
@@ -15858,7 +15999,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types52.EdgeType.DEPENDS_ON,
+        import_types53.EdgeType.DEPENDS_ON,
         "cloudflare-cron",
         cron,
         evidenceFile,
@@ -15871,7 +16012,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types52.EdgeType.DEPENDS_ON,
+        import_types53.EdgeType.DEPENDS_ON,
         "cloudflare-env-var",
         varName,
         evidenceFile,
@@ -15884,15 +16025,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       if (!svc.service) continue;
       const target = workerIndex.get(svc.service);
       if (target && target.anchorId !== anchorId) {
-        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types52.EdgeType.CALLS);
+        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types53.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: anchorId,
             target: target.anchorId,
-            type: import_types52.EdgeType.CALLS,
-            provenance: import_types52.Provenance.EXTRACTED,
-            confidence: (0, import_types52.confidenceForExtracted)("structural"),
+            type: import_types53.EdgeType.CALLS,
+            provenance: import_types53.Provenance.EXTRACTED,
+            confidence: (0, import_types53.confidenceForExtracted)("structural"),
             evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -15903,7 +16044,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types52.EdgeType.DEPENDS_ON,
+        import_types53.EdgeType.DEPENDS_ON,
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
@@ -15920,7 +16061,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs31 = require("fs");
 var import_node_path65 = __toESM(require("path"), 1);
-var import_types53 = require("@neat.is/types");
+var import_types54 = require("@neat.is/types");
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
@@ -15983,12 +16124,12 @@ async function addVercelServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types53.EdgeType.RUNS_ON, "vercel", "vercel");
-    for (const cron of config.crons ?? []) add(import_types53.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
-    for (const varName of Object.keys(config.env ?? {})) add(import_types53.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
-    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types53.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    add(import_types54.EdgeType.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(import_types54.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(import_types54.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types54.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
     for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
-      add(import_types53.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
+      add(import_types54.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
     }
   }
   return { nodesAdded, edgesAdded };
@@ -15999,7 +16140,7 @@ init_cjs_shims();
 var import_node_fs32 = require("fs");
 var import_node_path66 = __toESM(require("path"), 1);
 var import_smol_toml4 = require("smol-toml");
-var import_types54 = require("@neat.is/types");
+var import_types55 = require("@neat.is/types");
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
@@ -16045,9 +16186,9 @@ async function addRailwayServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types54.EdgeType.RUNS_ON, "railway", "railway");
-    add(import_types54.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
-    add(import_types54.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+    add(import_types55.EdgeType.RUNS_ON, "railway", "railway");
+    add(import_types55.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(import_types55.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
   }
   return { nodesAdded, edgesAdded };
 }
@@ -16057,7 +16198,7 @@ init_cjs_shims();
 var import_node_fs33 = require("fs");
 var import_node_path67 = __toESM(require("path"), 1);
 var import_smol_toml5 = require("smol-toml");
-var import_types55 = require("@neat.is/types");
+var import_types56 = require("@neat.is/types");
 async function readSupabaseConfig(dir) {
   const relFile = import_node_path67.default.join("supabase", "config.toml");
   const abs = import_node_path67.default.join(dir, relFile);
@@ -16105,10 +16246,10 @@ async function addSupabaseProjects(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types55.EdgeType.RUNS_ON, "supabase", "supabase");
-    for (const fn of Object.keys(config.functions ?? {})) add(import_types55.EdgeType.DEPENDS_ON, "supabase-function", fn);
-    if (config.storage) add(import_types55.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
-    if (config.auth) add(import_types55.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
+    add(import_types56.EdgeType.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(import_types56.EdgeType.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(import_types56.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(import_types56.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
   }
   return { nodesAdded, edgesAdded };
 }
@@ -16134,7 +16275,7 @@ init_cjs_shims();
 var import_node_path68 = __toESM(require("path"), 1);
 var import_tree_sitter18 = __toESM(require("tree-sitter"), 1);
 var import_tree_sitter_javascript8 = __toESM(require("tree-sitter-javascript"), 1);
-var import_types56 = require("@neat.is/types");
+var import_types57 = require("@neat.is/types");
 var ZOD_IMPORT_RE = /\bzod\b/;
 var ZOD_OBJECTS = /* @__PURE__ */ new Set(["z", "zod"]);
 function parserForExt4(ext) {
@@ -16240,7 +16381,7 @@ function zodShapesFromFile(file, serviceDir) {
     seen.add(name);
     const line = call.startPosition.row + 1;
     out.push({
-      infraId: (0, import_types56.infraId)("zod-schema", name),
+      infraId: (0, import_types57.infraId)("zod-schema", name),
       name,
       fields,
       evidence: {
@@ -16275,7 +16416,7 @@ async function addZodShapes(graph, services) {
         if (!graph.hasNode(shape.infraId)) {
           const node = {
             id: shape.infraId,
-            type: import_types56.NodeType.InfraNode,
+            type: import_types57.NodeType.InfraNode,
             name: shape.name,
             provider: "self",
             kind: "zod-schema"
@@ -16285,14 +16426,14 @@ async function addZodShapes(graph, services) {
         }
         if (shape.fields.length > 0) {
           const node = graph.getNodeAttributes(shape.infraId);
-          if (node.type === import_types56.NodeType.InfraNode) {
+          if (node.type === import_types57.NodeType.InfraNode) {
             graph.replaceNodeAttributes(shape.infraId, {
               ...node,
               columns: foldColumns(
                 node.columns,
                 shape.fields,
-                import_types56.Provenance.EXTRACTED,
-                (0, import_types56.confidenceForExtracted)("structural")
+                import_types57.Provenance.EXTRACTED,
+                (0, import_types57.confidenceForExtracted)("structural")
               )
             });
           }
@@ -16306,15 +16447,15 @@ async function addZodShapes(graph, services) {
         );
         nodesAdded += n;
         edgesAdded += e;
-        const edgeId = (0, import_types56.extractedEdgeId)(fileNodeId, shape.infraId, import_types56.EdgeType.CONTAINS);
+        const edgeId = (0, import_types57.extractedEdgeId)(fileNodeId, shape.infraId, import_types57.EdgeType.CONTAINS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: fileNodeId,
             target: shape.infraId,
-            type: import_types56.EdgeType.CONTAINS,
-            provenance: import_types56.Provenance.EXTRACTED,
-            confidence: (0, import_types56.confidenceForExtracted)("structural"),
+            type: import_types57.EdgeType.CONTAINS,
+            provenance: import_types57.Provenance.EXTRACTED,
+            confidence: (0, import_types57.confidenceForExtracted)("structural"),
             evidence: shape.evidence
           };
           graph.addEdgeWithKey(edgeId, fileNodeId, shape.infraId, edge);
@@ -16328,7 +16469,7 @@ async function addZodShapes(graph, services) {
 
 // src/extract/firestore-rules.ts
 init_cjs_shims();
-var import_types57 = require("@neat.is/types");
+var import_types58 = require("@neat.is/types");
 var FIRESTORE_COLLECTION_KIND = "firestore-collection";
 var WRITE_METHODS = /* @__PURE__ */ new Set(["write", "create", "update"]);
 function stripComments(src) {
@@ -16499,7 +16640,7 @@ async function addFirestoreRules(graph, services) {
   if (guards.size === 0) return { nodesAdded: 0, edgesAdded: 0 };
   graph.forEachNode((id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types57.NodeType.InfraNode) return;
+    if (node.type !== import_types58.NodeType.InfraNode) return;
     if (node.kind !== FIRESTORE_COLLECTION_KIND) return;
     const fields = guards.get(collectionKeyFromName(node.name));
     if (!fields || fields.size === 0) return;
@@ -16518,12 +16659,12 @@ var import_node_path70 = __toESM(require("path"), 1);
 init_cjs_shims();
 var import_node_fs34 = require("fs");
 var import_node_path69 = __toESM(require("path"), 1);
-var import_types58 = require("@neat.is/types");
+var import_types59 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph, source) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types58.NodeType.FileNode) return;
+    if (node.type !== import_types59.NodeType.FileNode) return;
     if (source && node.source !== source) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
@@ -16537,7 +16678,7 @@ function outOfScope(graph, edge, source) {
   for (const endpoint2 of [edge.source, edge.target]) {
     if (!graph.hasNode(endpoint2)) continue;
     const node = graph.getNodeAttributes(endpoint2);
-    if (node.type !== import_types58.NodeType.FileNode) continue;
+    if (node.type !== import_types59.NodeType.FileNode) continue;
     return node.source !== source;
   }
   return false;
@@ -16547,7 +16688,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], so
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types58.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types59.Provenance.EXTRACTED) return;
     if (outOfScope(graph, edge, source)) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
@@ -16566,7 +16707,23 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], so
 // src/extract/index.ts
 var passQueue = Promise.resolve();
 function extractFromDirectory(graph, scanPath, opts = {}) {
-  const pass = passQueue.then(() => runExtractionPass(graph, scanPath, opts));
+  invalidateSourceBaseline(graph, opts.source, "syncing");
+  const pass = passQueue.then(async () => {
+    const sourceGeneration = beginSourceExtraction(graph, opts.source, opts.sourceCommit);
+    let result;
+    try {
+      result = await runExtractionPass(graph, scanPath, opts);
+      return result;
+    } finally {
+      finishSourceExtraction(
+        graph,
+        sourceGeneration,
+        opts.source,
+        opts.sourceCommit,
+        result ?? { extractionErrors: 1, skippedFiles: 0 }
+      );
+    }
+  });
   passQueue = pass.catch(() => {
   });
   return pass;
@@ -16662,7 +16819,7 @@ async function runExtractionPass(graph, scanPath, opts) {
 init_cjs_shims();
 var import_node_fs35 = require("fs");
 var import_node_path71 = __toESM(require("path"), 1);
-var import_types59 = require("@neat.is/types");
+var import_types60 = require("@neat.is/types");
 var SCHEMA_VERSION = 7;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -16686,7 +16843,7 @@ function migrateV5ToV6(payload) {
   if (Array.isArray(nodes)) {
     for (const node of nodes) {
       const attrs = node.attributes;
-      if (!attrs || attrs.type !== import_types59.NodeType.InfraNode) continue;
+      if (!attrs || attrs.type !== import_types60.NodeType.InfraNode) continue;
       if (attrs.kind !== "sql-table" && attrs.kind !== "supabase-table") continue;
       if (!Array.isArray(attrs.columns)) attrs.columns = [];
     }
@@ -16702,12 +16859,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types59.Provenance.OBSERVED;
+      attrs.provenance = import_types60.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types59.observedEdgeId)(source, target, type);
+        const newId = (0, import_types60.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -16914,7 +17071,7 @@ init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_node_crypto6 = require("crypto");
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types103 = require("@neat.is/types");
+var import_types104 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -17261,39 +17418,39 @@ async function rollbackExtension(ctx, args) {
 
 // src/divergences.ts
 init_cjs_shims();
-var import_types60 = require("@neat.is/types");
+var import_types61 = require("@neat.is/types");
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
 function bucketSourceFor(graph, edge) {
-  if (edge.type !== import_types60.EdgeType.CONNECTS_TO) return edge.source;
-  const parsed = (0, import_types60.parseFileId)(edge.source);
+  if (edge.type !== import_types61.EdgeType.CONNECTS_TO) return edge.source;
+  const parsed = (0, import_types61.parseFileId)(edge.source);
   if (!parsed || !graph.hasNode(edge.target)) return edge.source;
   const target = graph.getNodeAttributes(edge.target);
-  if (target.type !== import_types60.NodeType.DatabaseNode) return edge.source;
-  return (0, import_types60.serviceId)(parsed.service);
+  if (target.type !== import_types61.NodeType.DatabaseNode) return edge.source;
+  return (0, import_types61.serviceId)(parsed.service);
 }
 function bucketEdges(graph) {
   const buckets2 = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    const parsed = (0, import_types60.parseEdgeId)(id);
+    const parsed = (0, import_types61.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
     const source = bucketSourceFor(graph, e);
     const key = bucketKey(source, e.target, e.type);
     const cur = buckets2.get(key) ?? { source, target: e.target, type: e.type };
     switch (provenance) {
-      case import_types60.Provenance.EXTRACTED:
+      case import_types61.Provenance.EXTRACTED:
         cur.extracted = e;
         break;
-      case import_types60.Provenance.OBSERVED:
+      case import_types61.Provenance.OBSERVED:
         cur.observed = e;
         break;
-      case import_types60.Provenance.INFERRED:
+      case import_types61.Provenance.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === import_types60.Provenance.STALE) cur.stale = e;
+        if (e.provenance === import_types61.Provenance.STALE) cur.stale = e;
     }
     buckets2.set(key, cur);
   });
@@ -17302,22 +17459,22 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types60.NodeType.FrontierNode;
+  return attrs.type === import_types61.NodeType.FrontierNode;
 }
 function nodeIsWebsocketChannel(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types60.NodeType.WebSocketChannelNode;
+  return attrs.type === import_types61.NodeType.WebSocketChannelNode;
 }
 function nodeIsServerAction(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types60.NodeType.ServerActionNode;
+  return attrs.type === import_types61.NodeType.ServerActionNode;
 }
 function nodeIsSymbol(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types60.NodeType.SymbolNode;
+  return attrs.type === import_types61.NodeType.SymbolNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -17337,14 +17494,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types60.EdgeType.CALLS,
-  import_types60.EdgeType.CONNECTS_TO,
-  import_types60.EdgeType.PUBLISHES_TO,
-  import_types60.EdgeType.CONSUMES_FROM
+  import_types61.EdgeType.CALLS,
+  import_types61.EdgeType.CONNECTS_TO,
+  import_types61.EdgeType.PUBLISHES_TO,
+  import_types61.EdgeType.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === import_types60.EdgeType.CONTAINS) return out;
+  if (bucket.type === import_types61.EdgeType.CONTAINS) return out;
   if (nodeIsSymbol(graph, bucket.source) || nodeIsSymbol(graph, bucket.target)) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target) && !nodeIsServerAction(graph, bucket.target)) {
@@ -17386,7 +17543,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === import_types60.EdgeType.CONFIGURED_BY && e.provenance === import_types60.Provenance.EXTRACTED) {
+    if (e.type === import_types61.EdgeType.CONFIGURED_BY && e.provenance === import_types61.Provenance.EXTRACTED) {
       return true;
     }
   }
@@ -17399,10 +17556,10 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types60.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types60.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types61.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types61.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types60.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types61.NodeType.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -17424,10 +17581,10 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types60.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types60.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types61.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types61.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types60.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types61.NodeType.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -17590,11 +17747,11 @@ function symbolLocus(graph, ev) {
   const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
   const affected = ev.affectedNode;
   const affectedInGraph = affected.length > 0 && graph.hasNode(affected);
-  const affectedIsCode = affectedInGraph && ((0, import_types60.parseSymbolId)(affected) !== null || (0, import_types60.parseFileId)(affected) !== null);
+  const affectedIsCode = affectedInGraph && ((0, import_types61.parseSymbolId)(affected) !== null || (0, import_types61.parseFileId)(affected) !== null);
   if (affectedIsCode) return { node: affected, ...location ? { location } : {} };
   if (!location) return null;
   if (affectedInGraph) return { node: affected, location };
-  const svc = (0, import_types60.serviceId)(ev.service);
+  const svc = (0, import_types61.serviceId)(ev.service);
   if (graph.hasNode(svc)) return { node: svc, location };
   return null;
 }
@@ -17637,7 +17794,7 @@ function detectSymbolMismatches(graph, incidents) {
       mismatchKind: g.kind,
       ...g.symbol ? { symbol: g.symbol } : {},
       ...g.location ? { location: g.location } : {},
-      provenance: import_types60.Provenance.INFERRED,
+      provenance: import_types61.Provenance.INFERRED,
       incidentId: g.latest.id,
       errorMessage: g.latest.errorMessage,
       incidentCount: g.count,
@@ -17654,7 +17811,7 @@ var OBSERVED_FAILING_CONFIDENCE = 0.6;
 function detectObservedFailingEdge(graph, bucket) {
   if (!bucket.extracted || !bucket.observed) return [];
   if (!OBSERVABLE_EDGE_TYPES.has(bucket.type)) return [];
-  if (bucket.observed.provenance !== import_types60.Provenance.OBSERVED) return [];
+  if (bucket.observed.provenance !== import_types61.Provenance.OBSERVED) return [];
   const signal = bucket.observed.signal;
   if (!signal) return [];
   const { spanCount, errorCount } = signal;
@@ -17668,7 +17825,7 @@ function detectObservedFailingEdge(graph, bucket) {
       source: bucket.source,
       target: bucket.target,
       failureKind: "error-rate",
-      provenance: import_types60.Provenance.INFERRED,
+      provenance: import_types61.Provenance.INFERRED,
       edgeType: bucket.type,
       observed: bucket.observed,
       spanCount,
@@ -17773,7 +17930,7 @@ function detectObservedFailingIncidents(graph, incidents) {
       source: g.node,
       target: g.node,
       failureKind: g.kind,
-      provenance: import_types60.Provenance.INFERRED,
+      provenance: import_types61.Provenance.INFERRED,
       ...g.location ? { location: g.location } : {},
       incidentId: g.latest.id,
       errorMessage: g.latest.errorMessage,
@@ -17792,24 +17949,24 @@ function involvesNode(d, nodeId) {
 function datastoreEverObserved(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const n = graph.getNodeAttributes(nodeId);
-  if (n.type === import_types60.NodeType.DatabaseNode) {
+  if (n.type === import_types61.NodeType.DatabaseNode) {
     const via = n.discoveredVia;
     if (via === "otel" || via === "merged") return true;
   }
   for (const edgeId of graph.inboundEdges(nodeId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.provenance === import_types60.Provenance.OBSERVED || e.provenance === import_types60.Provenance.STALE) return true;
+    if (e.provenance === import_types61.Provenance.OBSERVED || e.provenance === import_types61.Provenance.STALE) return true;
   }
   return false;
 }
 function serviceHasObservedSameEngineStore(graph, buckets2, serviceId17, engine, excludeTarget) {
   for (const bucket of buckets2.values()) {
-    if (bucket.type !== import_types60.EdgeType.CONNECTS_TO) continue;
+    if (bucket.type !== import_types61.EdgeType.CONNECTS_TO) continue;
     if (bucket.source !== serviceId17) continue;
     if (bucket.target === excludeTarget) continue;
     if (!graph.hasNode(bucket.target)) continue;
     const target = graph.getNodeAttributes(bucket.target);
-    if (target.type !== import_types60.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types61.NodeType.DatabaseNode) continue;
     if (target.engine !== engine) continue;
     if (bucket.observed || datastoreEverObserved(graph, bucket.target)) return true;
   }
@@ -17819,10 +17976,10 @@ var DEAD_CODE_PROBE_CONFIDENCE = 0.1;
 function dampenDeadCodeProbes(graph, buckets2, all) {
   return all.map((d) => {
     if (d.type !== "missing-observed") return d;
-    if (!d.extracted || d.edgeType !== import_types60.EdgeType.CONNECTS_TO) return d;
+    if (!d.extracted || d.edgeType !== import_types61.EdgeType.CONNECTS_TO) return d;
     if (!graph.hasNode(d.target)) return d;
     const target = graph.getNodeAttributes(d.target);
-    if (target.type !== import_types60.NodeType.DatabaseNode) return d;
+    if (target.type !== import_types61.NodeType.DatabaseNode) return d;
     if (d.extracted.evidence?.hostSource !== "literal") return d;
     if (datastoreEverObserved(graph, d.target)) return d;
     const engine = target.engine;
@@ -17842,7 +17999,7 @@ function suppressHostMismatchHalves(all) {
   for (const d of all) {
     if (d.type !== "host-mismatch") continue;
     observedHalf.add(`${d.source}->${d.target}`);
-    declaredHalf.add((0, import_types60.databaseId)(d.extractedHost));
+    declaredHalf.add((0, import_types61.databaseId)(d.extractedHost));
   }
   if (observedHalf.size === 0) return all;
   return all.filter((d) => {
@@ -17862,14 +18019,14 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type === import_types60.NodeType.ServiceNode) {
+    if (n.type === import_types61.NodeType.ServiceNode) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
       for (const d of detectDeployDivergence(svc)) all.push(d);
       return;
     }
-    if (n.type === import_types60.NodeType.InfraNode && n.kind === "sql-table") {
+    if (n.type === import_types61.NodeType.InfraNode && n.kind === "sql-table") {
       for (const d of detectColumnDrift(n)) all.push(d);
     }
   });
@@ -17934,7 +18091,7 @@ function computeDivergences(graph, opts = {}) {
     const bloc = "location" in b && b.location ? b.location : "";
     return aloc.localeCompare(bloc);
   });
-  return import_types60.DivergenceResultSchema.parse({
+  return import_types61.DivergenceResultSchema.parse({
     divergences: filtered,
     totalAffected: filtered.length,
     computedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -17988,7 +18145,7 @@ function queryLogEntries(opts) {
 
 // src/goodybag.ts
 init_cjs_shims();
-var import_types61 = require("@neat.is/types");
+var import_types62 = require("@neat.is/types");
 var CODE_FILEPATH_ATTR2 = "code.filepath";
 var CODE_LINENO_ATTR2 = "code.lineno";
 var BLAST_NEAREST_LIMIT = 5;
@@ -18014,7 +18171,7 @@ function locusOf(graph, ev) {
     ...Number.isFinite(line) ? { lineStart: line, lineEnd: line } : {},
     ...symbol ? { symbol } : {},
     service: node?.service ?? ev.service,
-    provenance: import_types61.Provenance.OBSERVED
+    provenance: import_types62.Provenance.OBSERVED
   };
 }
 function locusFromNode(graph, nodeId) {
@@ -18030,7 +18187,7 @@ function locusFromNode(graph, nodeId) {
     ...typeof end === "number" ? { lineEnd: end } : {},
     ...n.qualname ? { symbol: shortLabel(graph, nodeId) } : {},
     ...n.service ? { service: n.service } : {},
-    provenance: import_types61.Provenance.INFERRED
+    provenance: import_types62.Provenance.INFERRED
   };
 }
 function promoteCauseLocus(graph, causeNode, incidents) {
@@ -18039,7 +18196,7 @@ function promoteCauseLocus(graph, causeNode, incidents) {
   );
   if (native) {
     const l = locusOf(graph, native);
-    if (l) return { ...l, symbol: shortLabel(graph, causeNode), provenance: import_types61.Provenance.INFERRED };
+    if (l) return { ...l, symbol: shortLabel(graph, causeNode), provenance: import_types62.Provenance.INFERRED };
   }
   return locusFromNode(graph, causeNode);
 }
@@ -18088,7 +18245,7 @@ function buildIncidentCard(graph, errorEvent, incidents, policies) {
     const chain = (rc.traversalPath ?? []).map((node, i) => ({
       node,
       grain: grainOf2(graph, node),
-      provenance: provs[i] ?? provs[provs.length - 1] ?? import_types61.Provenance.INFERRED
+      provenance: provs[i] ?? provs[provs.length - 1] ?? import_types62.Provenance.INFERRED
     }));
     rootCause = {
       node: rc.rootCauseNode,
@@ -18119,7 +18276,7 @@ function buildIncidentCard(graph, errorEvent, incidents, policies) {
     kind: "incident",
     id: errorEvent.id,
     at: errorEvent.timestamp,
-    incidentKind: (0, import_types61.incidentKindOf)(errorEvent),
+    incidentKind: (0, import_types62.incidentKindOf)(errorEvent),
     service: errorEvent.service,
     affectedNode: affected,
     message: errorEvent.errorMessage,
@@ -18137,7 +18294,7 @@ function buildIncidentCard(graph, errorEvent, incidents, policies) {
     headline: renderHeadline(graph, errorEvent, locus, rootCause?.node ?? null)
   };
   card.grade = gradeIncidentCard(card);
-  return import_types61.IncidentCardSchema.parse(card);
+  return import_types62.IncidentCardSchema.parse(card);
 }
 var GRADE_PRIORS_VERSION = "sniper-architecture-priors-2026-10-08";
 var GRADE_WEIGHTS = {
@@ -18244,7 +18401,7 @@ function gradeIncidentCard(card) {
 
 // src/ask.ts
 init_cjs_shims();
-var import_types62 = require("@neat.is/types");
+var import_types63 = require("@neat.is/types");
 var DEFAULT_MAX_NODES = 3;
 var MAX_FACTS_PER_SECTION = 6;
 var INTENT_RULES = [
@@ -18480,11 +18637,11 @@ function idBody(id) {
   return colon >= 0 ? id.slice(colon + 1) : id;
 }
 var TYPE_NOUNS = [
-  { nouns: ["database", "db", "table"], type: import_types62.NodeType.DatabaseNode },
-  { nouns: ["service", "api", "backend"], type: import_types62.NodeType.ServiceNode },
-  { nouns: ["route", "endpoint"], type: import_types62.NodeType.RouteNode },
-  { nouns: ["file"], type: import_types62.NodeType.FileNode },
-  { nouns: ["config"], type: import_types62.NodeType.ConfigNode }
+  { nouns: ["database", "db", "table"], type: import_types63.NodeType.DatabaseNode },
+  { nouns: ["service", "api", "backend"], type: import_types63.NodeType.ServiceNode },
+  { nouns: ["route", "endpoint"], type: import_types63.NodeType.RouteNode },
+  { nouns: ["file"], type: import_types63.NodeType.FileNode },
+  { nouns: ["config"], type: import_types63.NodeType.ConfigNode }
 ];
 var EMBED_MIN_SCORE = 0.35;
 async function resolveEntities(graph, question, searchIndex, maxNodes) {
@@ -18498,7 +18655,7 @@ async function resolveEntities(graph, question, searchIndex, maxNodes) {
   };
   graph.forEachNode((id, attrs) => {
     const node = attrs;
-    if (node.type === import_types62.NodeType.FrontierNode) return;
+    if (node.type === import_types63.NodeType.FrontierNode) return;
     const name = nodeName(node);
     const body = idBody(id);
     const labelTokens = /* @__PURE__ */ new Set([...tokens(body), ...tokens(name)]);
@@ -18517,7 +18674,7 @@ async function resolveEntities(graph, question, searchIndex, maxNodes) {
       const res = await searchIndex.search(question, 10);
       if (res.provider !== "substring") {
         for (const m of res.matches) {
-          if (m.node.type === import_types62.NodeType.FrontierNode) continue;
+          if (m.node.type === import_types63.NodeType.FrontierNode) continue;
           if (!graph.hasNode(m.node.id)) continue;
           const already = best.get(m.node.id);
           if (!already && m.score < EMBED_MIN_SCORE) continue;
@@ -18577,7 +18734,7 @@ function edgeSignalNote(e) {
 function buildRootCauseSection(graph, node, incidents, now) {
   const result = getRootCause(graph, node, void 0, incidents, { now });
   if (!result) return null;
-  const lastProv = result.edgeProvenances[result.edgeProvenances.length - 1] ?? import_types62.Provenance.OBSERVED;
+  const lastProv = result.edgeProvenances[result.edgeProvenances.length - 1] ?? import_types63.Provenance.OBSERVED;
   const facts = [
     {
       text: `Root cause: ${result.rootCauseNode} \u2014 ${result.rootCauseReason}`,
@@ -18627,7 +18784,7 @@ function buildObservedSection(graph, node) {
     if (result.observed && result.inboundObservedCount > 0) {
       facts.push({
         text: `no outbound runtime calls, but OTel observed ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 a pure receiver`,
-        provenance: import_types62.Provenance.OBSERVED
+        provenance: import_types63.Provenance.OBSERVED
       });
     } else {
       return null;
@@ -18650,10 +18807,10 @@ function buildBlastSection(graph, node) {
 }
 function buildDatabaseCallersSection(graph, node) {
   const callers = getBlastRadius(graph, node).affectedNodes.filter((item) => {
-    if (graph.getNodeAttributes(item.nodeId).type !== import_types62.NodeType.ServiceNode) return false;
+    if (graph.getNodeAttributes(item.nodeId).type !== import_types63.NodeType.ServiceNode) return false;
     return item.path.slice(1, -1).every((id) => {
       const type = graph.getNodeAttributes(id).type;
-      return type === import_types62.NodeType.FileNode || type === import_types62.NodeType.SymbolNode;
+      return type === import_types63.NodeType.FileNode || type === import_types63.NodeType.SymbolNode;
     });
   });
   return {
@@ -18672,7 +18829,7 @@ function buildIncidentsSection(node, incidents) {
   const facts = ordered.map((ev) => ({
     text: `${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`,
     // ErrorEvents are observation records — OBSERVED by definition.
-    provenance: import_types62.Provenance.OBSERVED
+    provenance: import_types63.Provenance.OBSERVED
   }));
   return { heading: `Recent incidents (OBSERVED) \u2014 ${relevant.length} recorded`, facts };
 }
@@ -18695,8 +18852,8 @@ function runtimeEdgeState(graph) {
   let observed = false;
   let stale = false;
   graph.forEachEdge((_id, attrs) => {
-    if (attrs.provenance === import_types62.Provenance.OBSERVED) observed = true;
-    if (attrs.provenance === import_types62.Provenance.STALE) stale = true;
+    if (attrs.provenance === import_types63.Provenance.OBSERVED) observed = true;
+    if (attrs.provenance === import_types63.Provenance.STALE) stale = true;
   });
   return { observed, stale };
 }
@@ -18764,7 +18921,7 @@ function buildGlobalIncidentsSection(incidents) {
   }
   const byKey = /* @__PURE__ */ new Map();
   for (const ev of incidents) {
-    const key = ev.affectedNode || (0, import_types62.serviceId)(ev.service);
+    const key = ev.affectedNode || (0, import_types63.serviceId)(ev.service);
     const cur = byKey.get(key);
     if (!cur) {
       byKey.set(key, { key, count: 1, latest: ev.timestamp, sampleMsg: ev.errorMessage });
@@ -18779,7 +18936,7 @@ function buildGlobalIncidentsSection(incidents) {
   const rows = [...byKey.values()].sort((a, b) => b.count - a.count || b.latest.localeCompare(a.latest) || a.key.localeCompare(b.key)).slice(0, MAX_FACTS_PER_SECTION);
   const facts = rows.map((r) => ({
     text: `${r.key} \u2014 ${r.count} incident${r.count === 1 ? "" : "s"}, latest ${r.latest}: ${r.sampleMsg}`,
-    provenance: import_types62.Provenance.OBSERVED
+    provenance: import_types63.Provenance.OBSERVED
   }));
   return {
     heading: `Incidents across the system \u2014 ${incidents.length} recorded`,
@@ -18792,7 +18949,7 @@ function buildOverviewSections(graph, incidents) {
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
     nodeByType.set(node.type, (nodeByType.get(node.type) ?? 0) + 1);
-    if (node.type === import_types62.NodeType.ServiceNode) services.push(node.id);
+    if (node.type === import_types63.NodeType.ServiceNode) services.push(node.id);
   });
   const edgeByProv = /* @__PURE__ */ new Map();
   graph.forEachEdge((_id, attrs) => {
@@ -18804,10 +18961,10 @@ function buildOverviewSections(graph, incidents) {
   const shapeFacts = [
     { text: `${graph.order} nodes, ${graph.size} edges` },
     {
-      text: `${count(import_types62.NodeType.ServiceNode)} services, ${count(import_types62.NodeType.FileNode)} files, ${count(import_types62.NodeType.SymbolNode)} symbols, ${count(import_types62.NodeType.DatabaseNode)} databases`
+      text: `${count(import_types63.NodeType.ServiceNode)} services, ${count(import_types63.NodeType.FileNode)} files, ${count(import_types63.NodeType.SymbolNode)} symbols, ${count(import_types63.NodeType.DatabaseNode)} databases`
     }
   ];
-  for (const p of [import_types62.Provenance.EXTRACTED, import_types62.Provenance.OBSERVED, import_types62.Provenance.INFERRED, import_types62.Provenance.STALE]) {
+  for (const p of [import_types63.Provenance.EXTRACTED, import_types63.Provenance.OBSERVED, import_types63.Provenance.INFERRED, import_types63.Provenance.STALE]) {
     const n = edgeByProv.get(p) ?? 0;
     if (n > 0) shapeFacts.push({ text: `${n} ${p} edge${n === 1 ? "" : "s"}`, provenance: p });
   }
@@ -18824,7 +18981,7 @@ function buildOverviewSections(graph, incidents) {
   if (incidents && incidents.length > 0) {
     const incCount = /* @__PURE__ */ new Map();
     for (const ev of incidents) {
-      const key = ev.affectedNode || (0, import_types62.serviceId)(ev.service);
+      const key = ev.affectedNode || (0, import_types63.serviceId)(ev.service);
       incCount.set(key, (incCount.get(key) ?? 0) + 1);
     }
     const top = [...incCount.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, MAX_FACTS_PER_SECTION);
@@ -18832,7 +18989,7 @@ function buildOverviewSections(graph, incidents) {
       heading: `Nodes with incidents \u2014 ${incidents.length} recorded`,
       facts: top.map(([k, n]) => ({
         text: `${k} \u2014 ${n} incident${n === 1 ? "" : "s"}`,
-        provenance: import_types62.Provenance.OBSERVED
+        provenance: import_types63.Provenance.OBSERVED
       }))
     });
   }
@@ -18963,7 +19120,7 @@ async function askGraph(graph, question, opts = {}) {
   let scope;
   if (primary) {
     scope = "node";
-    const callersQuestion = intent === "dependencies" && graph.getNodeAttributes(primary).type === import_types62.NodeType.DatabaseNode && /\b(?:which|what)\s+services?\s+(?:talks?\s+to|connects?\s+to|uses?|hits?|calls?|reads?\s+from|writes?\s+to)\b/i.test(question);
+    const callersQuestion = intent === "dependencies" && graph.getNodeAttributes(primary).type === import_types63.NodeType.DatabaseNode && /\b(?:which|what)\s+services?\s+(?:talks?\s+to|connects?\s+to|uses?|hits?|calls?|reads?\s+from|writes?\s+to)\b/i.test(question);
     if (callersQuestion) sections.push(buildDatabaseCallersSection(graph, primary));
     for (const kind of SECTION_ORDER[intent]) {
       if (callersQuestion && kind === "blast") continue;
@@ -18981,7 +19138,7 @@ async function askGraph(graph, question, opts = {}) {
   const provSet = /* @__PURE__ */ new Set();
   for (const s of sections) for (const f of s.facts) if (f.provenance) provSet.add(f.provenance);
   const confidence = sections[0]?.facts[0]?.confidence;
-  return import_types62.AskResultSchema.parse({
+  return import_types63.AskResultSchema.parse({
     question,
     intent,
     matched,
@@ -19076,7 +19233,7 @@ init_cjs_shims();
 var import_node_fs39 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path75 = __toESM(require("path"), 1);
-var import_types63 = require("@neat.is/types");
+var import_types64 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
@@ -19294,10 +19451,10 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types63.RegistryFileSchema.parse(parsed);
+  return import_types64.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types63.RegistryFileSchema.parse(reg);
+  const validated = import_types64.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
 var RegistryError = class extends Error {
@@ -19396,11 +19553,11 @@ async function pruneRegistry(opts = {}) {
 init_cjs_shims();
 var import_node_fs40 = require("fs");
 var import_zod = require("zod");
-var import_types64 = require("@neat.is/types");
+var import_types65 = require("@neat.is/types");
 var SSE_HEARTBEAT_MS = 3e4;
 var SSE_BACKPRESSURE_CAP = 1e3;
 var INCIDENT_TRIGGER_STREAM_SCOPE = "incident-only-v1";
-var IncidentTriggerSchema = import_types64.IncidentEventPayloadSchema.extend({
+var IncidentTriggerSchema = import_types65.IncidentEventPayloadSchema.extend({
   incidentId: import_zod.z.string().regex(/^[A-Za-z0-9:_-]{1,100}$/),
   affectedNode: import_zod.z.string().min(1).max(512),
   service: import_zod.z.string().min(1).max(256),
@@ -19428,12 +19585,12 @@ function loadIncidentReplay(errorsPath, cursor) {
         if (!isExtractionFailure(row)) throw new Error("incident replay unavailable");
         continue;
       }
-      const event = import_types64.ErrorEventSchema.parse(row);
+      const event = import_types65.ErrorEventSchema.parse(row);
       const trigger = IncidentTriggerSchema.parse({
         incidentId: event.id,
         affectedNode: event.affectedNode,
         service: event.service,
-        incidentKind: (0, import_types64.incidentKindOf)(event),
+        incidentKind: (0, import_types65.incidentKindOf)(event),
         at: event.timestamp
       });
       const prior = seen.get(trigger.incidentId), encoded = JSON.stringify(trigger);
@@ -19808,7 +19965,7 @@ function renderVerdict({
 }
 
 // src/pr-verdict.ts
-var import_types65 = require("@neat.is/types");
+var import_types66 = require("@neat.is/types");
 
 // src/connectors/hosted-repos.ts
 init_cjs_shims();
@@ -19869,6 +20026,7 @@ var defaultCloneRepo = async (cloneUrl, ref, destDir) => {
   });
   try {
     await Promise.race([clone, timeout]);
+    return await git.resolveRef({ fs: fs44, dir: destDir, ref: "HEAD" });
   } finally {
     if (timer) clearTimeout(timer);
   }
@@ -19920,6 +20078,19 @@ function scrubCloneToken(s) {
 function needsSync(r) {
   return r.syncStatus === void 0 || r.syncStatus === "syncing";
 }
+function validRepoRow(row) {
+  if (!row || typeof row !== "object") return false;
+  const r = row;
+  if (typeof r.owner !== "string" || typeof r.name !== "string" || typeof r.cloneUrl !== "string") return false;
+  if (!/^[A-Za-z0-9_.-]+$/.test(r.owner) || !/^[A-Za-z0-9_.-]+$/.test(r.name)) return false;
+  if (r.syncStatus !== void 0 && !["syncing", "synced", "failed"].includes(r.syncStatus)) return false;
+  try {
+    const url = new URL(r.cloneUrl);
+    return url.protocol === "https:" && url.hostname === "github.com" && !url.port && !url.search && !url.hash && url.pathname === `/${r.owner}/${r.name}.git`;
+  } catch {
+    return false;
+  }
+}
 async function syncOneRepo(r, input) {
   const { deps, graph } = input;
   const cloneRepo = input.cloneRepo ?? defaultCloneRepo;
@@ -19928,20 +20099,30 @@ async function syncOneRepo(r, input) {
   const tmpRoot = input.tmpRoot ?? import_node_os4.default.tmpdir();
   let dir;
   try {
+    invalidateSourceBaseline(graph, label, "syncing");
     dir = await (0, import_promises.mkdtemp)(import_node_path76.default.join(tmpRoot, "neat-repo-"));
     await cpPostStatus(deps, r.owner, r.name, { syncStatus: "syncing", detail: "cloning" }).catch(() => {
     });
-    await cloneRepo(r.cloneUrl, r.defaultBranch, dir);
-    const extracted = await extract(graph, dir, { source: label });
+    const sha = await cloneRepo(r.cloneUrl, r.defaultBranch, dir);
+    const extracted = await extract(graph, dir, {
+      source: label,
+      ...typeof sha === "string" ? { sourceCommit: { repository: label, sha } } : {}
+    });
+    input.onExtracted?.(label);
+    const errors = extracted?.extractionErrors ?? 0;
+    const skipped = extracted?.skippedFiles ?? 0;
+    const incomplete = errors > 0 || skipped > 0;
+    if (incomplete) invalidateSourceBaseline(graph, label);
     const nodes = extracted?.nodesAdded ?? 0;
     const edges = extracted?.edgesAdded ?? 0;
     await cpPostStatus(deps, r.owner, r.name, {
       syncStatus: "synced",
-      detail: `extracted ${nodes} node${nodes === 1 ? "" : "s"}, ${edges} edge${edges === 1 ? "" : "s"}`,
+      detail: `extracted ${nodes} node${nodes === 1 ? "" : "s"}, ${edges} edge${edges === 1 ? "" : "s"}` + (incomplete ? ` (incomplete: ${errors} errors, ${skipped} skipped files)` : ""),
       lastSyncAt: new Date(input.now?.() ?? Date.now()).toISOString()
     });
     return true;
   } catch (err) {
+    invalidateSourceBaseline(graph, label);
     input.onError?.(label, err);
     await cpPostStatus(deps, r.owner, r.name, {
       syncStatus: "failed",
@@ -19960,13 +20141,30 @@ async function runRepoSyncPassCounted(input) {
   try {
     repos = await cpGet(`/internal/projects/${input.deps.projectId}/repos`, input.deps);
   } catch (err) {
+    invalidateSourceBaseline(input.graph);
     input.onSkip?.("(all)", `control plane repo list unreadable \u2014 ${err.message}`);
     return counts;
   }
-  if (!Array.isArray(repos)) return counts;
+  if (!Array.isArray(repos)) {
+    invalidateSourceBaseline(input.graph);
+    return counts;
+  }
   counts.listed = true;
-  for (const r of repos) {
-    if (!input.forceResync && !needsSync(r)) continue;
+  const validRepos = repos.filter(validRepoRow);
+  const invalidCount = repos.length - validRepos.length;
+  if (invalidCount) {
+    counts.failed += invalidCount;
+    for (let index = 0; index < invalidCount; index++) {
+      input.onSkip?.("(invalid)", "control plane repo row invalid");
+    }
+  }
+  retainSourceBaselines(input.graph, validRepos.map((r) => `${r.owner}/${r.name}`));
+  for (const r of validRepos) {
+    if (r.syncStatus === "failed") invalidateSourceBaseline(input.graph, `${r.owner}/${r.name}`);
+  }
+  for (const r of validRepos) {
+    const forced = typeof input.forceResync === "function" ? input.forceResync(`${r.owner}/${r.name}`) : input.forceResync === true;
+    if (!forced && !needsSync(r)) continue;
     if (await syncOneRepo(r, input)) counts.synced++;
     else counts.failed++;
   }
@@ -19979,14 +20177,20 @@ async function startRepoSync(input) {
   let inFlight = null;
   let again = false;
   let lastPass;
-  let bootResyncDone = false;
+  const bootExtracted = /* @__PURE__ */ new Set();
   const run = async () => {
     try {
       do {
         again = false;
         const startedAt = new Date(now()).toISOString();
-        const counts = await runRepoSyncPassCounted({ ...input, forceResync: !bootResyncDone });
-        if (counts.listed) bootResyncDone = true;
+        const counts = await runRepoSyncPassCounted({
+          ...input,
+          forceResync: (repo) => !bootExtracted.has(repo),
+          onExtracted: (repo) => {
+            bootExtracted.add(repo);
+            input.onExtracted?.(repo);
+          }
+        });
         lastPass = { ...counts, startedAt, finishedAt: new Date(now()).toISOString() };
       } while (again && !stopped);
     } finally {
@@ -20055,7 +20259,7 @@ var PrVerdictError = class extends Error {
   details;
 };
 function parsePrVerdictRequest(body) {
-  const parsed = import_types65.PrVerdictBodySchema.safeParse(body);
+  const parsed = import_types66.PrVerdictBodySchema.safeParse(body);
   if (!parsed.success) {
     throw new PrVerdictError("invalid pr-verdict body", 400, void 0, parsed.error.issues);
   }
@@ -20404,15 +20608,15 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 
 // src/connectors/index.ts
 init_cjs_shims();
-var import_types66 = require("@neat.is/types");
+var import_types67 = require("@neat.is/types");
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== import_types66.Provenance.EXTRACTED) continue;
-    const parsed = (0, import_types66.parseFileId)(edge.source);
+    if (edge.provenance !== import_types67.Provenance.EXTRACTED) continue;
+    const parsed = (0, import_types67.parseFileId)(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
     if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
@@ -20423,7 +20627,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== import_types66.NodeType.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== import_types67.NodeType.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -21147,23 +21351,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types68 = require("@neat.is/types");
+var import_types69 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types68.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types69.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types68.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types69.EdgeType.CALLS };
     }
-    const bareResourceId = (0, import_types68.infraId)(signal.targetKind, signal.targetName);
+    const bareResourceId = (0, import_types69.infraId)(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types68.EdgeType.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types69.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types68.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types69.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types68.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types69.EdgeType.CALLS };
     }
     return null;
   };
@@ -21256,7 +21460,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types72 = require("@neat.is/types");
+var import_types73 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -21407,7 +21611,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types72.NodeType.RouteNode) return;
+    if (node.type !== import_types73.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -21511,12 +21715,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types72.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types73.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types72.serviceId)(peerName), serviceName, edgeType: import_types72.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types73.serviceId)(peerName), serviceName, edgeType: import_types73.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -21704,11 +21908,11 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types74 = require("@neat.is/types");
+var import_types75 = require("@neat.is/types");
 
 // src/connectors/infer-service.ts
 init_cjs_shims();
-var import_types73 = require("@neat.is/types");
+var import_types74 = require("@neat.is/types");
 function normalizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
@@ -21719,11 +21923,11 @@ function inferServiceName(graph, resourceName, method, path84) {
   const owners = /* @__PURE__ */ new Set();
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type === import_types73.NodeType.ServiceNode && typeof node.name === "string") {
+    if (node.type === import_types74.NodeType.ServiceNode && typeof node.name === "string") {
       services.push(node.name);
       return;
     }
-    if (node.type !== import_types73.NodeType.RouteNode) return;
+    if (node.type !== import_types74.NodeType.RouteNode) return;
     const route = attrs;
     if (!route.pathTemplate || normalizePathTemplate(route.pathTemplate) !== wantedPath) return;
     const routeMethod = route.method.toUpperCase();
@@ -21750,7 +21954,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types74.NodeType.RouteNode) return;
+    if (node.type !== import_types75.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -21782,7 +21986,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types74.EdgeType.CALLS
+      edgeType: import_types75.EdgeType.CALLS
     };
   };
 }
@@ -21815,7 +22019,7 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types76 = require("@neat.is/types");
+var import_types77 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
@@ -21979,7 +22183,7 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types76.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types77.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
@@ -21991,7 +22195,7 @@ function findMatchingRouteNode(graph, serviceName, method, path84) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types76.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types77.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -22010,11 +22214,11 @@ function createCloudflareResolveTarget(config, graph) {
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types76.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types77.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types76.EdgeType.CALLS
+        edgeType: import_types77.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -22023,13 +22227,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types76.EdgeType.CALLS
+        edgeType: import_types77.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types76.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types77.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types76.EdgeType.CALLS,
+      edgeType: import_types77.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -22225,14 +22429,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 
 // src/connectors/neon/resolve.ts
 init_cjs_shims();
-var import_types80 = require("@neat.is/types");
+var import_types81 = require("@neat.is/types");
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: (0, import_types80.infraId)("sql-table", signal.targetName),
+      targetNodeId: (0, import_types81.infraId)("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: import_types80.EdgeType.CALLS,
+      edgeType: import_types81.EdgeType.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -22413,14 +22617,14 @@ function mapLogEntriesToSignals2(entries) {
 
 // src/connectors/cloud-run/resolve.ts
 init_cjs_shims();
-var import_types84 = require("@neat.is/types");
+var import_types85 = require("@neat.is/types");
 var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
 function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
   let found = null;
   graph.forEachNode((_id, attrs) => {
     if (found) return;
     const node = attrs;
-    if (node.type !== import_types84.NodeType.RouteNode) return;
+    if (node.type !== import_types85.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName || !route.pathTemplate) return;
     if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
@@ -22445,13 +22649,13 @@ function createCloudRunResolveTarget(graph, config) {
         normalizePathTemplate(path84)
       );
       if (routeNodeId) {
-        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types84.EdgeType.CALLS };
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types85.EdgeType.CALLS };
       }
     }
     return {
-      targetNodeId: (0, import_types84.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      targetNodeId: (0, import_types85.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
       serviceName: mappedService ?? gcpServiceName,
-      edgeType: import_types84.EdgeType.CALLS,
+      edgeType: import_types85.EdgeType.CALLS,
       ensureInfraNode: {
         kind: CLOUD_RUN_SERVICE_INFRA_KIND,
         name: gcpServiceName,
@@ -22633,14 +22837,14 @@ function mapLogEntriesToSignals3(entries) {
 
 // src/connectors/gcp-lb/resolve.ts
 init_cjs_shims();
-var import_types88 = require("@neat.is/types");
+var import_types89 = require("@neat.is/types");
 var GCP_LB_BACKEND_INFRA_KIND = "gcp-lb-backend";
 function findMatchingRouteNode3(graph, serviceName, method, normalizedPath) {
   let found = null;
   graph.forEachNode((_id, attrs) => {
     if (found) return;
     const node = attrs;
-    if (node.type !== import_types88.NodeType.RouteNode) return;
+    if (node.type !== import_types89.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName || !route.pathTemplate) return;
     if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
@@ -22665,13 +22869,13 @@ function createGcpLbResolveTarget(graph, config) {
         normalizePathTemplate(path84)
       );
       if (routeNodeId) {
-        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types88.EdgeType.CALLS };
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types89.EdgeType.CALLS };
       }
     }
     return {
-      targetNodeId: (0, import_types88.infraId)(GCP_LB_BACKEND_INFRA_KIND, backendServiceName),
+      targetNodeId: (0, import_types89.infraId)(GCP_LB_BACKEND_INFRA_KIND, backendServiceName),
       serviceName: mappedService ?? backendServiceName,
-      edgeType: import_types88.EdgeType.CALLS,
+      edgeType: import_types89.EdgeType.CALLS,
       ensureInfraNode: {
         kind: GCP_LB_BACKEND_INFRA_KIND,
         name: backendServiceName,
@@ -22712,7 +22916,7 @@ function createGcpLbConnector(graph, config = {}) {
 
 // src/connectors/render/index.ts
 init_cjs_shims();
-var import_types91 = require("@neat.is/types");
+var import_types92 = require("@neat.is/types");
 
 // src/connectors/render/types.ts
 init_cjs_shims();
@@ -22790,7 +22994,7 @@ function buildRenderRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types91.NodeType.RouteNode) return;
+    if (node.type !== import_types92.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -22875,7 +23079,7 @@ function mapRenderRequestLogsToSignals(entries, routeIndex) {
 function createRenderResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind === ROUTE_TARGET_KIND2) {
-      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types91.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types92.EdgeType.CALLS };
     }
     return null;
   };
@@ -23013,21 +23217,21 @@ function mapInsightsToSignals(rows, observedAtIso) {
 
 // src/connectors/planetscale/resolve.ts
 init_cjs_shims();
-var import_types95 = require("@neat.is/types");
+var import_types96 = require("@neat.is/types");
 var PLANETSCALE_DATABASE_KIND = "planetscale-database";
 function createPlanetscaleResolveTarget(graph, config) {
   const databaseName = `${config.organization}/${config.database}`;
   return (signal, _ctx) => {
     if (signal.targetKind !== PLANETSCALE_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
-    const tableId = (0, import_types95.infraId)("sql-table", signal.targetName);
+    const tableId = (0, import_types96.infraId)("sql-table", signal.targetName);
     if (graph.hasNode(tableId)) {
-      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types95.EdgeType.CALLS };
+      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types96.EdgeType.CALLS };
     }
-    const providerId = (0, import_types95.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
+    const providerId = (0, import_types96.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
     return {
       targetNodeId: providerId,
       serviceName: config.serviceName,
-      edgeType: import_types95.EdgeType.CALLS,
+      edgeType: import_types96.EdgeType.CALLS,
       ensureInfraNode: { kind: PLANETSCALE_DATABASE_KIND, name: databaseName, provider: "planetscale" }
     };
   };
@@ -23292,7 +23496,7 @@ function mapBuildsToSignals(builds, serviceName) {
 
 // src/connectors/eas/resolve.ts
 init_cjs_shims();
-var import_types100 = require("@neat.is/types");
+var import_types101 = require("@neat.is/types");
 var NO_ENV2 = "unknown";
 var EAS_JSON_PHASES = /* @__PURE__ */ new Set(["READ_EAS_JSON"]);
 var APP_CONFIG_PHASES = /* @__PURE__ */ new Set([
@@ -23308,8 +23512,8 @@ function configBasenamesForPhase(phase) {
 function configNodeService(graph, configNodeId) {
   for (const edgeId of graph.inboundEdges(configNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types100.EdgeType.CONFIGURED_BY) continue;
-    const parsed = (0, import_types100.parseFileId)(edge.source);
+    if (edge.type !== import_types101.EdgeType.CONFIGURED_BY) continue;
+    const parsed = (0, import_types101.parseFileId)(edge.source);
     if (parsed) return parsed.service;
   }
   return null;
@@ -23320,7 +23524,7 @@ function findConfigNode(graph, basenames, serviceName) {
   graph.forEachNode((id, attrs) => {
     if (scoped) return;
     const node = attrs;
-    if (node.type !== import_types100.NodeType.ConfigNode) return;
+    if (node.type !== import_types101.NodeType.ConfigNode) return;
     if (typeof node.name !== "string" || !basenames.includes(node.name)) return;
     if (anyMatch === null) anyMatch = id;
     if (configNodeService(graph, id) === serviceName) scoped = id;
@@ -23337,13 +23541,13 @@ function createEasResolveTarget(graph) {
     if (basenames.length > 0) {
       const configNodeId = findConfigNode(graph, basenames, serviceName);
       if (configNodeId) {
-        return { targetNodeId: configNodeId, serviceName, edgeType: import_types100.EdgeType.CALLS };
+        return { targetNodeId: configNodeId, serviceName, edgeType: import_types101.EdgeType.CALLS };
       }
     }
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV2),
       serviceName,
-      edgeType: import_types100.EdgeType.CALLS
+      edgeType: import_types101.EdgeType.CALLS
     };
   };
 }
@@ -23978,7 +24182,7 @@ function serializeGraph(graph) {
   graph.forEachEdge((_id, attrs) => {
     edges.push(attrs);
   });
-  return { nodes, edges };
+  return { nodes, edges, sourceBaselines: readSourceBaselines(graph) };
 }
 function projectFromReq(req2, singleProject, registry) {
   const params = req2.params;
@@ -24161,11 +24365,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req2.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types103.DivergenceTypeSchema.safeParse(c);
+        const r = import_types104.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types103.DivergenceTypeSchema.options
+            allowed: import_types104.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -24602,7 +24806,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req2.query.severity) {
-      const sev = import_types103.PolicySeveritySchema.safeParse(req2.query.severity);
+      const sev = import_types104.PolicySeveritySchema.safeParse(req2.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -24641,7 +24845,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req2, reply) => {
     const proj = resolveProject(registry, req2, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types103.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
+    const parsed = import_types104.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -25002,7 +25206,7 @@ init_otel();
 
 // src/hang-sensor.ts
 init_cjs_shims();
-var import_types104 = require("@neat.is/types");
+var import_types105 = require("@neat.is/types");
 var RECONCILE_INCIDENT_LIMIT = 500;
 function stageHangSurfaces(graph, incidents) {
   const boundaries = /* @__PURE__ */ new Set();
@@ -25015,7 +25219,7 @@ function stageHangSurfaces(graph, incidents) {
     if (!isBoundaryTimeoutSymptom(ctx)) continue;
     const hop = resolveHangHop(graph, boundary, incidents);
     if (!hop) continue;
-    if (stageFrontierEdge(graph, hop.source, hop.target, import_types104.EdgeType.CALLS)) staged++;
+    if (stageFrontierEdge(graph, hop.source, hop.target, import_types105.EdgeType.CALLS)) staged++;
   }
   return staged;
 }
@@ -25377,12 +25581,22 @@ init_cjs_shims();
 // src/connectors/kubernetes/client.ts
 init_cjs_shims();
 var import_node_https = require("https");
+var K8S_RATE_LIMIT = { capacity: 120, refillMs: 1e3 };
 function deploymentsPath(namespace) {
   return `/apis/apps/v1/namespaces/${namespace}/deployments`;
 }
 function podsPath(namespace) {
   return `/api/v1/namespaces/${namespace}/pods`;
 }
+function podLogPath(namespace, podName, opts = {}) {
+  const params = new URLSearchParams();
+  if (opts.container) params.set("container", opts.container);
+  if (typeof opts.tailLines === "number" && Number.isFinite(opts.tailLines)) params.set("tailLines", String(Math.trunc(opts.tailLines)));
+  if (typeof opts.limitBytes === "number" && Number.isFinite(opts.limitBytes)) params.set("limitBytes", String(Math.trunc(opts.limitBytes)));
+  if (opts.previous) params.set("previous", "true");
+  const qs = params.toString();
+  return `${podsPath(namespace)}/${podName}/log${qs ? `?${qs}` : ""}`;
+}
 function makeK8sFetchImpl(transport) {
   const agent = new import_node_https.Agent({
     ...transport.ca ? { ca: transport.ca } : {},
@@ -25433,7 +25647,7 @@ async function listResource(transport, namespace, path84, opts = {}) {
     { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "application/json" } },
     // accountKey: the (cluster, namespace) pair — an identifier, safe to log, the
     // rate-limit bucket for one namespace on one cluster (ADR-131).
-    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
+    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, rateLimit: K8S_RATE_LIMIT, fetchImpl }
   );
   if (!res.ok) {
     throw new Error(`kubernetes ${path84} failed: ${res.status} ${res.statusText}`);
@@ -25454,6 +25668,37 @@ async function fetchDeployments(transport, namespace, opts = {}) {
 async function fetchPods(transport, namespace, opts = {}) {
   return listResource(transport, namespace, podsPath(namespace), opts);
 }
+async function fetchPodLog(transport, namespace, podName, opts = {}) {
+  const base = opts.apiUrl ?? transport.server;
+  const path84 = podLogPath(namespace, podName, {
+    ...opts.container ? { container: opts.container } : {},
+    ...opts.tailLines !== void 0 ? { tailLines: opts.tailLines } : {},
+    ...opts.limitBytes !== void 0 ? { limitBytes: opts.limitBytes } : {},
+    ...opts.previous ? { previous: true } : {}
+  });
+  const url = `${base.replace(/\/$/, "")}${path84}`;
+  const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
+  try {
+    const res = await junctionFetch(
+      url,
+      { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "text/plain" } },
+      { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, rateLimit: K8S_RATE_LIMIT, fetchImpl }
+    );
+    if (!res.ok) return void 0;
+    return await res.text();
+  } catch {
+    return void 0;
+  }
+}
+function hasLogContent(text) {
+  return typeof text === "string" && text.trim().length > 0;
+}
+async function fetchPodProcessLog(transport, namespace, podName, opts = {}) {
+  const previous = await fetchPodLog(transport, namespace, podName, { ...opts, previous: true });
+  if (hasLogContent(previous)) return previous;
+  const current = await fetchPodLog(transport, namespace, podName, { ...opts, previous: false });
+  return hasLogContent(current) ? current : void 0;
+}
 
 // src/connectors/kubernetes/kubeconfig.ts
 init_cjs_shims();
@@ -25561,6 +25806,123 @@ function parseK8sTargetName(targetName) {
   return { serviceName, fault };
 }
 
+// src/connectors/kubernetes/process-context.ts
+init_cjs_shims();
+var DEFAULT_MAX_LOG_LINES = 50;
+var DEFAULT_MAX_LOG_BYTES2 = 2 * 1024;
+var DEFAULT_MAX_ENTRIES = 64;
+var DEFAULT_MAX_VALUE_CHARS = 512;
+var REDACTED = "***REDACTED***";
+var SECRET_KEY_RE = /TOKEN|SECRET|KEY|PASSW(?:OR)?D|PWD|(?:^|[^A-Z])PASS(?:$|[^A-Z])|CREDENTIAL|(?:^|[^A-Z])AUTH|PRIVATE|DSN|COOKIE|SESSION|SALT|SIGNATURE|CERT|CONN(?:ECTION)?_?STR/i;
+function isSecretKey(name) {
+  return SECRET_KEY_RE.test(name);
+}
+var PRIVATE_KEY_BLOCK_RE = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g;
+var PRIVATE_KEY_TAIL_RE = /(?:^[A-Za-z0-9+/=]{32,}\r?\n)+-----END [A-Z ]*PRIVATE KEY-----/gm;
+var URL_USERINFO_RE = /([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^\s/@]*)@/g;
+var SECRET_PAIR_RE = /((?:^|[\s?&;,{("'])[A-Za-z0-9_.-]*?(?:passw(?:or)?d|pwd|(?<![a-z])pass(?![a-z])|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?key|credentials?|(?<![a-z])auth(?![a-z])|(?<![a-z])dsn(?![a-z]))[A-Za-z0-9_.-]*["']?\s*[=:]\s*["']?)([^\s&;,"'})]+)/gi;
+var AUTH_SCHEME_RE = /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/g;
+var KNOWN_TOKEN_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|\bAKIA[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9]{20,}|\bgithub_pat_[A-Za-z0-9_]{20,}|\bsk_(?:live|test)_[A-Za-z0-9]{10,}|\bxox[abprs]-[A-Za-z0-9-]{10,}|\bglpat-[A-Za-z0-9_-]{16,}|\bAIza[0-9A-Za-z_-]{30,}|\bneat_pat_[A-Za-z0-9_-]{16,}/g;
+function redactText(text) {
+  return text.replace(PRIVATE_KEY_BLOCK_RE, REDACTED).replace(PRIVATE_KEY_TAIL_RE, REDACTED).replace(URL_USERINFO_RE, (_m, scheme, userinfo) => {
+    const colon = userinfo.indexOf(":");
+    return colon > 0 ? `${scheme}${userinfo.slice(0, colon)}:${REDACTED}@` : `${scheme}${REDACTED}@`;
+  }).replace(SECRET_PAIR_RE, (_m, key) => `${key}${REDACTED}`).replace(AUTH_SCHEME_RE, (_m, scheme) => `${scheme} ${REDACTED}`).replace(KNOWN_TOKEN_RE, REDACTED);
+}
+function redactValue(name, value) {
+  if (isSecretKey(name)) return REDACTED;
+  return redactText(value);
+}
+function redactArg(arg) {
+  const eq = /^(--?)?([A-Za-z0-9_.-]+)=([\s\S]*)$/.exec(arg);
+  if (eq && isSecretKey(eq[2])) {
+    return `${eq[1] ?? ""}${eq[2]}=${REDACTED}`;
+  }
+  return redactText(arg);
+}
+function isSecretFlag(arg) {
+  const m = /^--?([A-Za-z0-9_.-]+)$/.exec(arg);
+  return m !== null && isSecretKey(m[1]);
+}
+function capValue(s, max = DEFAULT_MAX_VALUE_CHARS) {
+  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
+}
+function describeEnvVar(ev) {
+  const name = typeof ev.name === "string" ? ev.name : "";
+  if (name.length === 0) return void 0;
+  if (typeof ev.value === "string") {
+    return `${name}=${capValue(redactValue(name, ev.value))}`;
+  }
+  const from = ev.valueFrom;
+  if (from) {
+    if (from.secretKeyRef) {
+      const ref = typeof from.secretKeyRef.name === "string" && from.secretKeyRef.name.length > 0 ? from.secretKeyRef.name : "<unnamed>";
+      return `${name}=<from secret ${ref}>`;
+    }
+    if (from.configMapKeyRef) {
+      const ref = typeof from.configMapKeyRef.name === "string" && from.configMapKeyRef.name.length > 0 ? from.configMapKeyRef.name : "<unnamed>";
+      const key = typeof from.configMapKeyRef.key === "string" && from.configMapKeyRef.key.length > 0 ? ` key ${from.configMapKeyRef.key}` : "";
+      return `${name}=<from configMap ${ref}${key}>`;
+    }
+    if (from.fieldRef && typeof from.fieldRef.fieldPath === "string" && from.fieldRef.fieldPath.length > 0) {
+      return `${name}=<from field ${from.fieldRef.fieldPath}>`;
+    }
+    if (from.resourceFieldRef && typeof from.resourceFieldRef.resource === "string" && from.resourceFieldRef.resource.length > 0) {
+      return `${name}=<from resource ${from.resourceFieldRef.resource}>`;
+    }
+    return `${name}=<from reference>`;
+  }
+  return `${name}=`;
+}
+function buildContainerEnv(container) {
+  const out = [];
+  for (const ev of container.env ?? []) {
+    const d = describeEnvVar(ev);
+    if (d !== void 0) out.push(d);
+    if (out.length >= DEFAULT_MAX_ENTRIES) break;
+  }
+  return out;
+}
+function buildContainerArgs(container) {
+  const raw = [];
+  for (const c of container.command ?? []) if (typeof c === "string") raw.push(c);
+  for (const a of container.args ?? []) if (typeof a === "string") raw.push(a);
+  const out = [];
+  for (let i = 0; i < raw.length && out.length < DEFAULT_MAX_ENTRIES; i++) {
+    const arg = raw[i];
+    out.push(capValue(redactArg(arg)));
+    const next = raw[i + 1];
+    if (isSecretFlag(arg) && next !== void 0 && !next.startsWith("-") && out.length < DEFAULT_MAX_ENTRIES) {
+      out.push(REDACTED);
+      i++;
+    }
+  }
+  return out;
+}
+function capProcessLog(text, maxLines = DEFAULT_MAX_LOG_LINES, maxBytes = DEFAULT_MAX_LOG_BYTES2) {
+  const trimmed = text.replace(/\s+$/, "");
+  if (trimmed.length === 0) return "";
+  const lines = trimmed.split("\n");
+  const tail = lines.length > maxLines ? lines.slice(lines.length - maxLines) : lines;
+  let out = tail.join("\n");
+  if (out.length > maxBytes) out = out.slice(out.length - maxBytes);
+  return out;
+}
+function buildProcessContext(input) {
+  const out = {};
+  if (typeof input.log === "string") {
+    const capped = capProcessLog(redactText(input.log));
+    if (capped.length > 0) out.processLog = capped;
+  }
+  if (input.container) {
+    const args = buildContainerArgs(input.container);
+    if (args.length > 0) out.containerArgs = args;
+    const env = buildContainerEnv(input.container);
+    if (env.length > 0) out.containerEnv = env;
+  }
+  return out;
+}
+
 // src/connectors/kubernetes/map.ts
 function serviceNameFor(deployment, config) {
   const name = deployment.metadata?.name ?? "";
@@ -25578,6 +25940,9 @@ function podsForDeployment(deployment, pods) {
 function nowIso2() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function podLogKey(podName, container) {
+  return container ? `${podName}\0${container}` : podName;
+}
 function podLevelFault(deployment, pods) {
   const name = deployment.metadata?.name ?? "";
   const owned = podsForDeployment(deployment, pods);
@@ -25595,7 +25960,9 @@ function podLevelFault(deployment, pods) {
           fault: "image-pull",
           message: `Deployment ${name} cannot pull image ${image} (${reason})`,
           timestamp: pod.status?.startTime ?? nowIso2(),
-          attributes: attrs
+          attributes: attrs,
+          pod,
+          ...typeof cs.name === "string" && cs.name.length > 0 ? { container: cs.name } : {}
         };
       }
       if (reason === CRASH_LOOP_REASON && !crash) crash = { cs, pod };
@@ -25617,11 +25984,47 @@ function podLevelFault(deployment, pods) {
       fault: "crash-loop",
       message: `Deployment ${name} is crashlooping (restarts: ${restarts}); ${detail}`,
       timestamp: term?.finishedAt ?? pod.status?.startTime ?? nowIso2(),
-      attributes: attrs
+      attributes: attrs,
+      pod,
+      ...typeof cs.name === "string" && cs.name.length > 0 ? { container: cs.name } : {}
     };
   }
   return null;
 }
+function faultedContainer(finding) {
+  const containers = finding.pod?.spec?.containers;
+  if (!Array.isArray(containers) || containers.length === 0) return void 0;
+  if (finding.container) {
+    const named2 = containers.find((c) => c.name === finding.container);
+    if (named2) return named2;
+  }
+  return containers.length === 1 ? containers[0] : void 0;
+}
+function mergeProcessContext(finding, logs) {
+  const container = faultedContainer(finding);
+  const podName = finding.pod?.metadata?.name;
+  const log = logs && podName ? logs.get(podLogKey(podName, finding.container)) : void 0;
+  if (!container && log === void 0) return;
+  const ctx = buildProcessContext({
+    ...log !== void 0 ? { log } : {},
+    ...container ? { container } : {}
+  });
+  if (ctx.processLog !== void 0) finding.attributes["k8s.processLog"] = ctx.processLog;
+  if (ctx.containerArgs !== void 0) finding.attributes["k8s.containerArgs"] = ctx.containerArgs;
+  if (ctx.containerEnv !== void 0) finding.attributes["k8s.containerEnv"] = ctx.containerEnv;
+}
+function faultedPods(deployments, pods, config) {
+  const out = [];
+  const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
+  for (const deployment of deployments) {
+    const finding = classifyDeployment(deployment, pods, expectedZero);
+    if (!finding || finding.fault !== "crash-loop") continue;
+    const podName = finding.pod?.metadata?.name;
+    if (typeof podName !== "string" || podName.length === 0) continue;
+    out.push({ podName, ...finding.container ? { container: finding.container } : {} });
+  }
+  return out;
+}
 function classifyDeployment(deployment, pods, expectedZero) {
   const name = deployment.metadata?.name ?? "";
   const desired = typeof deployment.spec?.replicas === "number" ? deployment.spec.replicas : 1;
@@ -25649,12 +26052,13 @@ function classifyDeployment(deployment, pods, expectedZero) {
     attributes: { "k8s.desiredReplicas": desired, "k8s.readyReplicas": ready }
   };
 }
-function mapDeploymentToSignal(deployment, pods, config) {
+function mapDeploymentToSignal(deployment, pods, config, logs) {
   const name = deployment.metadata?.name;
   if (typeof name !== "string" || name.length === 0) return null;
   const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
   const finding = classifyDeployment(deployment, pods, expectedZero);
   if (!finding) return null;
+  mergeProcessContext(finding, logs);
   const serviceName = serviceNameFor(deployment, config);
   const namespace = deployment.metadata?.namespace ?? config.namespace;
   const attributes = {
@@ -25707,12 +26111,12 @@ function deployStateSignal(deployment, pods, config) {
     deployState: observedDeployState(deployment, pods)
   };
 }
-function mapWorkloadsToSignals(deployments, pods, config) {
+function mapWorkloadsToSignals(deployments, pods, config, logs) {
   const out = [];
   for (const deployment of deployments) {
     const deployState = deployStateSignal(deployment, pods, config);
     if (deployState) out.push(deployState);
-    const incident = mapDeploymentToSignal(deployment, pods, config);
+    const incident = mapDeploymentToSignal(deployment, pods, config, logs);
     if (incident) out.push(incident);
   }
   return out;
@@ -25720,7 +26124,7 @@ function mapWorkloadsToSignals(deployments, pods, config) {
 
 // src/connectors/kubernetes/resolve.ts
 init_cjs_shims();
-var import_types106 = require("@neat.is/types");
+var import_types107 = require("@neat.is/types");
 var NO_ENV3 = "unknown";
 function createK8sResolveTarget(graph) {
   return (signal) => {
@@ -25731,7 +26135,7 @@ function createK8sResolveTarget(graph) {
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV3),
       serviceName,
-      edgeType: import_types106.EdgeType.CALLS
+      edgeType: import_types107.EdgeType.CALLS
     };
   };
 }
@@ -25811,6 +26215,8 @@ async function startK8sSubstratePolling(input) {
 }
 
 // src/connectors/kubernetes/index.ts
+var PROCESS_LOG_TAIL_LINES = 200;
+var PROCESS_LOG_LIMIT_BYTES = 64 * 1024;
 var KubernetesConnector = class {
   constructor(config, fetchImpl) {
     this.config = config;
@@ -25831,7 +26237,24 @@ var KubernetesConnector = class {
       fetchDeployments(transport, namespace, opts),
       fetchPods(transport, namespace, opts)
     ]);
-    return mapWorkloadsToSignals(deployments, pods, this.config);
+    const logs = await this.fetchFaultedPodLogs(transport, namespace, deployments, pods, opts);
+    return mapWorkloadsToSignals(deployments, pods, this.config, logs);
+  }
+  async fetchFaultedPodLogs(transport, namespace, deployments, pods, opts) {
+    const logs = /* @__PURE__ */ new Map();
+    const targets = faultedPods(deployments, pods, this.config);
+    await Promise.all(
+      targets.map(async (t) => {
+        const text = await fetchPodProcessLog(transport, namespace, t.podName, {
+          ...t.container ? { container: t.container } : {},
+          tailLines: PROCESS_LOG_TAIL_LINES,
+          limitBytes: PROCESS_LOG_LIMIT_BYTES,
+          ...opts
+        });
+        if (typeof text === "string" && text.length > 0) logs.set(podLogKey(t.podName, t.container), text);
+      })
+    );
+    return logs;
   }
 };
 function createKubernetesConnector(graph, config, fetchImpl) {
@@ -25866,7 +26289,7 @@ function unroutedErrorsPath(neatHome4) {
 }
 
 // src/daemon.ts
-var import_types109 = require("@neat.is/types");
+var import_types110 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path82.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -26017,7 +26440,7 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
   if (!serviceName) return true;
   if (serviceNameMatchesProject(serviceName, project)) return true;
   return graph.someNode(
-    (_id, attrs) => attrs.type === import_types109.NodeType.ServiceNode && attrs.name === serviceName
+    (_id, attrs) => attrs.type === import_types110.NodeType.ServiceNode && attrs.name === serviceName
   );
 }
 async function bootstrapProject(entry2, connectors = [], neatHome4) {