@neat.is/core 0.2.5

package/dist/index.cjs

@@ -0,0 +1,4552 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../../node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl, importMetaUrl;
+var init_cjs_shims = __esm({
+  "../../node_modules/tsup/assets/cjs_shims.js"() {
+    "use strict";
+    getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+    importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+  }
+});
+
+// src/otel-grpc.ts
+var otel_grpc_exports = {};
+__export(otel_grpc_exports, {
+  reshapeGrpcRequest: () => reshapeGrpcRequest,
+  startOtelGrpcReceiver: () => startOtelGrpcReceiver
+});
+function bytesToHex(buf) {
+  if (!buf) return "";
+  return Buffer.isBuffer(buf) ? buf.toString("hex") : "";
+}
+function nanosToString(n) {
+  if (n === void 0 || n === null) return "0";
+  return typeof n === "string" ? n : String(n);
+}
+function reshapeAttributes(attrs) {
+  const out = (attrs ?? []).map((kv) => ({
+    key: kv.key ?? "",
+    value: kv.value ? {
+      stringValue: kv.value.string_value,
+      boolValue: kv.value.bool_value,
+      intValue: kv.value.int_value,
+      doubleValue: kv.value.double_value,
+      arrayValue: kv.value.array_value ? {
+        values: (kv.value.array_value.values ?? []).map((v) => ({
+          stringValue: v.string_value,
+          boolValue: v.bool_value,
+          intValue: v.int_value,
+          doubleValue: v.double_value
+        }))
+      } : void 0
+    } : void 0
+  }));
+  return out;
+}
+function reshapeGrpcRequest(req) {
+  return {
+    resourceSpans: (req.resource_spans ?? []).map((rs) => ({
+      resource: rs.resource ? { attributes: reshapeAttributes(rs.resource.attributes) } : void 0,
+      scopeSpans: (rs.scope_spans ?? []).map((ss) => ({
+        spans: (ss.spans ?? []).map((s) => ({
+          traceId: bytesToHex(s.trace_id),
+          spanId: bytesToHex(s.span_id),
+          parentSpanId: s.parent_span_id ? bytesToHex(s.parent_span_id) : void 0,
+          name: s.name,
+          kind: s.kind,
+          startTimeUnixNano: nanosToString(s.start_time_unix_nano),
+          endTimeUnixNano: nanosToString(s.end_time_unix_nano),
+          attributes: reshapeAttributes(s.attributes),
+          events: (s.events ?? []).map((e) => ({
+            name: e.name,
+            timeUnixNano: nanosToString(e.time_unix_nano),
+            attributes: reshapeAttributes(e.attributes)
+          })),
+          status: s.status ? { code: s.status.code, message: s.status.message } : void 0
+        }))
+      }))
+    }))
+  };
+}
+function resolveProtoRoot() {
+  const here = import_node_path29.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path29.default.resolve(here, "..", "proto");
+}
+function loadTraceService() {
+  const protoRoot = resolveProtoRoot();
+  const def = protoLoader.loadSync(
+    "opentelemetry/proto/collector/trace/v1/trace_service.proto",
+    {
+      keepCase: true,
+      longs: String,
+      enums: Number,
+      defaults: true,
+      oneofs: true,
+      includeDirs: [protoRoot]
+    }
+  );
+  const pkg = grpc.loadPackageDefinition(def);
+  return pkg.opentelemetry.proto.collector.trace.v1.TraceService.service;
+}
+async function startOtelGrpcReceiver(opts) {
+  const server = new grpc.Server();
+  const service = loadTraceService();
+  server.addService(service, {
+    Export: (call, callback) => {
+      void (async () => {
+        try {
+          const reshaped = reshapeGrpcRequest(call.request ?? {});
+          const spans = parseOtlpRequest(reshaped);
+          for (const span of spans) {
+            await opts.onSpan(span);
+          }
+          callback(null, { partial_success: {} });
+        } catch (err) {
+          callback({
+            code: grpc.status.INTERNAL,
+            message: err instanceof Error ? err.message : String(err)
+          });
+        }
+      })();
+    }
+  });
+  const host = opts.host ?? "0.0.0.0";
+  const port = opts.port ?? 4317;
+  const boundPort = await new Promise((resolve, reject) => {
+    server.bindAsync(`${host}:${port}`, grpc.ServerCredentials.createInsecure(), (err, p) => {
+      if (err) return reject(err);
+      resolve(p);
+    });
+  });
+  return {
+    address: `${host}:${boundPort}`,
+    stop: () => new Promise((resolve) => {
+      server.tryShutdown(() => resolve());
+    })
+  };
+}
+var import_node_url, import_node_path29, grpc, protoLoader;
+var init_otel_grpc = __esm({
+  "src/otel-grpc.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_url = require("url");
+    import_node_path29 = __toESM(require("path"), 1);
+    grpc = __toESM(require("@grpc/grpc-js"), 1);
+    protoLoader = __toESM(require("@grpc/proto-loader"), 1);
+    init_otel();
+  }
+});
+
+// src/otel.ts
+function extractExceptionFromEvents(events) {
+  if (!events) return void 0;
+  for (const ev of events) {
+    if (ev.name !== "exception") continue;
+    const attrs = attrsToRecord(ev.attributes);
+    const out = {};
+    const t = attrs["exception.type"];
+    const m = attrs["exception.message"];
+    const s = attrs["exception.stacktrace"];
+    if (typeof t === "string") out.type = t;
+    if (typeof m === "string") out.message = m;
+    if (typeof s === "string") out.stacktrace = s;
+    if (out.type || out.message || out.stacktrace) return out;
+  }
+  return void 0;
+}
+function flattenAttribute(v) {
+  if (!v) return null;
+  if (v.stringValue !== void 0) return v.stringValue;
+  if (v.boolValue !== void 0) return v.boolValue;
+  if (v.intValue !== void 0) {
+    return typeof v.intValue === "string" ? Number(v.intValue) : v.intValue;
+  }
+  if (v.doubleValue !== void 0) return v.doubleValue;
+  if (v.arrayValue?.values) {
+    return v.arrayValue.values.map((x) => flattenAttribute(x));
+  }
+  return null;
+}
+function attrsToRecord(attrs) {
+  const out = {};
+  if (!attrs) return out;
+  for (const kv of attrs) {
+    if (kv.key) out[kv.key] = flattenAttribute(kv.value);
+  }
+  return out;
+}
+function durationNanos(start, end) {
+  if (!start || !end) return 0n;
+  try {
+    return BigInt(end) - BigInt(start);
+  } catch {
+    return 0n;
+  }
+}
+function isoFromUnixNano(nanos) {
+  if (!nanos || nanos === "0") return void 0;
+  try {
+    const ms = Number(BigInt(nanos) / 1000000n);
+    if (!Number.isFinite(ms)) return void 0;
+    return new Date(ms).toISOString();
+  } catch {
+    return void 0;
+  }
+}
+function parseOtlpRequest(body) {
+  const out = [];
+  for (const rs of body.resourceSpans ?? []) {
+    const resourceAttrs = attrsToRecord(rs.resource?.attributes);
+    const service = typeof resourceAttrs["service.name"] === "string" ? resourceAttrs["service.name"] : "unknown";
+    for (const ss of rs.scopeSpans ?? []) {
+      for (const span of ss.spans ?? []) {
+        const attrs = attrsToRecord(span.attributes);
+        const parsed = {
+          service,
+          traceId: span.traceId ?? "",
+          spanId: span.spanId ?? "",
+          parentSpanId: span.parentSpanId || void 0,
+          name: span.name ?? "",
+          kind: span.kind,
+          startTimeUnixNano: span.startTimeUnixNano ?? "0",
+          endTimeUnixNano: span.endTimeUnixNano ?? "0",
+          startTimeIso: isoFromUnixNano(span.startTimeUnixNano),
+          durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),
+          attributes: attrs,
+          dbSystem: typeof attrs["db.system"] === "string" ? attrs["db.system"] : void 0,
+          dbName: typeof attrs["db.name"] === "string" ? attrs["db.name"] : void 0,
+          statusCode: span.status?.code,
+          errorMessage: span.status?.message,
+          exception: extractExceptionFromEvents(span.events)
+        };
+        out.push(parsed);
+      }
+    }
+  }
+  return out;
+}
+function loadProtobufDecoder() {
+  if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
+  const here = import_node_path30.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path30.default.resolve(here, "..", "proto");
+  const root = new import_protobufjs.default.Root();
+  root.resolvePath = (_origin, target) => import_node_path30.default.resolve(protoRoot, target);
+  root.loadSync(
+    "opentelemetry/proto/collector/trace/v1/trace_service.proto",
+    { keepCase: true }
+  );
+  exportTraceServiceRequestType = root.lookupType(
+    "opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest"
+  );
+  return exportTraceServiceRequestType;
+}
+async function decodeProtobufBody(buf) {
+  const Type = loadProtobufDecoder();
+  const decoded = Type.decode(buf).toJSON();
+  const { reshapeGrpcRequest: reshapeGrpcRequest2 } = await Promise.resolve().then(() => (init_otel_grpc(), otel_grpc_exports));
+  return reshapeGrpcRequest2(decoded);
+}
+async function buildOtelReceiver(opts) {
+  const app = (0, import_fastify2.default)({
+    logger: false,
+    bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024
+  });
+  const queue = [];
+  let draining = false;
+  let drainPromise = Promise.resolve();
+  const drain = async () => {
+    if (draining) return;
+    draining = true;
+    try {
+      while (queue.length > 0) {
+        const span = queue.shift();
+        try {
+          await opts.onSpan(span);
+        } catch (err) {
+          console.warn(`[neat] otel handler error: ${err.message}`);
+        }
+      }
+    } finally {
+      draining = false;
+    }
+  };
+  const enqueue = (spans) => {
+    if (spans.length === 0) return;
+    for (const s of spans) queue.push(s);
+    drainPromise = drainPromise.then(() => drain());
+  };
+  app.addContentTypeParser(
+    "application/x-protobuf",
+    { parseAs: "buffer", bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024 },
+    (_req, body, done) => {
+      done(null, body);
+    }
+  );
+  app.get("/health", async () => ({ ok: true }));
+  app.post("/v1/traces", async (req, reply) => {
+    const ct = (req.headers["content-type"] ?? "").toString().split(";")[0].trim().toLowerCase();
+    let body;
+    if (ct === "application/x-protobuf") {
+      try {
+        body = await decodeProtobufBody(req.body);
+      } catch (err) {
+        return reply.code(400).send({
+          error: `protobuf decode failed: ${err.message}`
+        });
+      }
+    } else if (!ct || ct === "application/json") {
+      body = req.body ?? {};
+    } else {
+      return reply.code(415).send({ error: `unsupported content-type: ${ct}` });
+    }
+    const spans = parseOtlpRequest(body);
+    if (opts.onErrorSpanSync) {
+      try {
+        for (const span of spans) {
+          if (span.statusCode === 2) await opts.onErrorSpanSync(span);
+        }
+      } catch (err) {
+        return reply.code(500).send({
+          error: `error-event write failed: ${err.message}`
+        });
+      }
+    }
+    enqueue(spans);
+    return reply.code(200).send({ partialSuccess: {} });
+  });
+  const decorated = app;
+  decorated.flushPending = async () => {
+    while (queue.length > 0 || draining) {
+      await drainPromise;
+    }
+  };
+  return decorated;
+}
+function logSpanHandler(span) {
+  const parent = span.parentSpanId ? span.parentSpanId.slice(0, 8) : "<root>";
+  const status2 = span.statusCode === 2 ? "ERROR" : "OK";
+  const db = span.dbSystem ? ` db=${span.dbSystem}/${span.dbName ?? "?"}` : "";
+  console.log(
+    `otel: ${span.service} ${span.name} parent=${parent} status=${status2}${db}`
+  );
+}
+var import_node_path30, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType;
+var init_otel = __esm({
+  "src/otel.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_path30 = __toESM(require("path"), 1);
+    import_node_url2 = require("url");
+    import_fastify2 = __toESM(require("fastify"), 1);
+    import_protobufjs = __toESM(require("protobufjs"), 1);
+    exportTraceServiceRequestType = null;
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ProjectNameCollisionError: () => ProjectNameCollisionError,
+  addProject: () => addProject,
+  buildApi: () => buildApi,
+  buildOtelReceiver: () => buildOtelReceiver,
+  checkCompatibility: () => checkCompatibility,
+  compatPairs: () => compatPairs,
+  computeGraphDiff: () => computeGraphDiff,
+  confidenceForEdge: () => confidenceForEdge,
+  extractFromDirectory: () => extractFromDirectory,
+  getBlastRadius: () => getBlastRadius,
+  getGraph: () => getGraph,
+  getProject: () => getProject,
+  getRootCause: () => getRootCause,
+  handleSpan: () => handleSpan,
+  listProjects: () => listProjects,
+  loadGraphFromDisk: () => loadGraphFromDisk,
+  loadSnapshotForDiff: () => loadSnapshotForDiff,
+  logSpanHandler: () => logSpanHandler,
+  makeSpanHandler: () => makeSpanHandler,
+  markStaleEdges: () => markStaleEdges,
+  normalizeProjectPath: () => normalizeProjectPath,
+  parseOtlpRequest: () => parseOtlpRequest,
+  readErrorEvents: () => readErrorEvents,
+  readRegistry: () => readRegistry,
+  readStaleEvents: () => readStaleEvents,
+  registryLockPath: () => registryLockPath,
+  registryPath: () => registryPath,
+  removeProject: () => removeProject,
+  resetGraph: () => resetGraph,
+  routeSpanToProject: () => routeSpanToProject,
+  saveGraphToDisk: () => saveGraphToDisk,
+  setStatus: () => setStatus,
+  startDaemon: () => startDaemon,
+  startOtelGrpcReceiver: () => startOtelGrpcReceiver,
+  startPersistLoop: () => startPersistLoop,
+  startStalenessLoop: () => startStalenessLoop,
+  stitchTrace: () => stitchTrace,
+  thresholdForEdgeType: () => thresholdForEdgeType,
+  touchLastSeen: () => touchLastSeen,
+  writeAtomically: () => writeAtomically
+});
+module.exports = __toCommonJS(index_exports);
+init_cjs_shims();
+
+// src/graph.ts
+init_cjs_shims();
+var import_graphology = __toESM(require("graphology"), 1);
+var MultiDirectedGraph = import_graphology.default.MultiDirectedGraph;
+var DEFAULT_PROJECT = "default";
+var graphs = /* @__PURE__ */ new Map();
+function makeGraph() {
+  return new MultiDirectedGraph({ allowSelfLoops: false });
+}
+function getGraph(project = DEFAULT_PROJECT) {
+  let g = graphs.get(project);
+  if (!g) {
+    g = makeGraph();
+    graphs.set(project, g);
+  }
+  return g;
+}
+function resetGraph(project) {
+  if (project === void 0) {
+    graphs.clear();
+    return;
+  }
+  graphs.delete(project);
+}
+
+// src/extract.ts
+init_cjs_shims();
+
+// src/extract/index.ts
+init_cjs_shims();
+
+// src/ingest.ts
+init_cjs_shims();
+var import_node_fs3 = require("fs");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// src/policy.ts
+init_cjs_shims();
+var import_node_fs2 = require("fs");
+var import_node_path2 = __toESM(require("path"), 1);
+var import_types2 = require("@neat.is/types");
+
+// src/compat.ts
+init_cjs_shims();
+var import_node_fs = require("fs");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path = __toESM(require("path"), 1);
+var import_semver = __toESM(require("semver"), 1);
+
+// compat.json
+var compat_default = {
+  pairs: [
+    {
+      kind: "driver-engine",
+      driver: "pg",
+      engine: "postgresql",
+      minDriverVersion: "8.0.0",
+      minEngineVersion: "14",
+      reason: "PostgreSQL 14+ requires scram-sha-256 auth by default; pg < 8.0.0 only speaks md5."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mysql2",
+      engine: "mysql",
+      minDriverVersion: "3.0.0",
+      minEngineVersion: "8",
+      reason: "MySQL 8 defaults to caching_sha2_password; mysql2 < 3.0.0 doesn't negotiate it."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mongoose",
+      engine: "mongodb",
+      minDriverVersion: "7.0.0",
+      minEngineVersion: "7",
+      reason: "MongoDB 7 drops legacy wire-protocol opcodes that mongoose < 7.0.0 still emits."
+    },
+    {
+      kind: "driver-engine",
+      driver: "psycopg2",
+      engine: "postgresql",
+      minDriverVersion: "2.9.0",
+      minEngineVersion: "14",
+      reason: "PostgreSQL 14+ requires scram-sha-256 auth by default; psycopg2 < 2.9.0 only speaks md5."
+    },
+    {
+      kind: "driver-engine",
+      driver: "pymongo",
+      engine: "mongodb",
+      minDriverVersion: "4.0.0",
+      minEngineVersion: "7",
+      reason: "MongoDB 7 drops legacy wire-protocol opcodes that pymongo < 4.0.0 still emits."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mysql-connector-python",
+      engine: "mysql",
+      minDriverVersion: "8.0.0",
+      minEngineVersion: "8",
+      reason: "MySQL 8 defaults to caching_sha2_password; mysql-connector-python < 8.0.0 doesn't negotiate it."
+    }
+  ],
+  nodeEngineConstraints: [
+    {
+      kind: "node-engine",
+      package: "vitest",
+      packageMinVersion: "2.0.0",
+      minNodeVersion: "18.0.0",
+      reason: "vitest >= 2.0 drops Node 16 support; requires Node 18+."
+    },
+    {
+      kind: "node-engine",
+      package: "next",
+      packageMinVersion: "14.0.0",
+      minNodeVersion: "18.17.0",
+      reason: "Next 14+ requires Node 18.17+ (uses APIs introduced in that minor)."
+    },
+    {
+      kind: "node-engine",
+      package: "@modelcontextprotocol/sdk",
+      packageMinVersion: "1.0.0",
+      minNodeVersion: "18.0.0",
+      reason: "@modelcontextprotocol/sdk >= 1 requires Node 18+ (web-streams polyfill removed)."
+    }
+  ],
+  packageConflicts: [
+    {
+      kind: "package-conflict",
+      package: "@tanstack/react-query",
+      packageMinVersion: "5.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.0.0"
+      },
+      reason: "@tanstack/react-query 5+ uses useSyncExternalStore \u2014 only available in React 18+."
+    },
+    {
+      kind: "package-conflict",
+      package: "react-router-dom",
+      packageMinVersion: "7.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.0.0"
+      },
+      reason: "react-router-dom 7+ requires React 18+."
+    },
+    {
+      kind: "package-conflict",
+      package: "next",
+      packageMinVersion: "14.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.2.0"
+      },
+      reason: "Next.js 14+ requires React 18.2+."
+    }
+  ],
+  deprecatedApis: [
+    {
+      kind: "deprecated-api",
+      package: "request",
+      packageMaxVersion: "2.88.2",
+      reason: "request is deprecated; use undici, node-fetch, or axios instead."
+    },
+    {
+      kind: "deprecated-api",
+      package: "node-uuid",
+      reason: "node-uuid is deprecated; use the `uuid` package."
+    }
+  ]
+};
+
+// src/compat.ts
+var bundledMatrix = compat_default;
+var mergedMatrix = null;
+var remoteLoadAttempted = false;
+var REMOTE_CACHE_DIR = import_node_path.default.join(import_node_os.default.homedir(), ".neat");
+var REMOTE_CACHE_PATH = import_node_path.default.join(REMOTE_CACHE_DIR, "compat-cache.json");
+var REMOTE_TTL_MS = 24 * 60 * 60 * 1e3;
+function engineMeetsThreshold(engineVersion, threshold) {
+  const e = parseInt(engineVersion, 10);
+  const t = parseInt(threshold, 10);
+  if (Number.isFinite(e) && Number.isFinite(t)) return e >= t;
+  const ec = import_semver.default.coerce(engineVersion);
+  const tc = import_semver.default.coerce(threshold);
+  if (ec && tc) return import_semver.default.gte(ec, tc);
+  return false;
+}
+function checkCompatibility(driver, driverVersion, engine, engineVersion) {
+  const matrix = currentMatrix();
+  const pair = matrix.pairs.find((p) => p.driver === driver && p.engine === engine);
+  if (!pair) return { compatible: true };
+  if (pair.minEngineVersion && !engineMeetsThreshold(engineVersion, pair.minEngineVersion)) {
+    return { compatible: true };
+  }
+  const driverCoerced = import_semver.default.coerce(driverVersion);
+  if (!driverCoerced) return { compatible: true };
+  if (import_semver.default.lt(driverCoerced, pair.minDriverVersion)) {
+    return {
+      compatible: false,
+      reason: pair.reason,
+      minDriverVersion: pair.minDriverVersion
+    };
+  }
+  return { compatible: true };
+}
+function rangeAdmitsVersion(serviceNodeRange, requiredNodeVersion) {
+  try {
+    const required = import_semver.default.coerce(requiredNodeVersion);
+    if (!required) return true;
+    return import_semver.default.subset(serviceNodeRange, `>=${required.version}`, {
+      includePrerelease: false
+    });
+  } catch {
+    return true;
+  }
+}
+function checkNodeEngineConstraint(constraint, declaredPackageVersion, serviceNodeRange) {
+  if (constraint.packageMinVersion && declaredPackageVersion) {
+    const v = import_semver.default.coerce(declaredPackageVersion);
+    if (v && import_semver.default.lt(v, constraint.packageMinVersion)) {
+      return { compatible: true };
+    }
+  }
+  if (!serviceNodeRange) {
+    return { compatible: true };
+  }
+  if (rangeAdmitsVersion(serviceNodeRange, constraint.minNodeVersion)) {
+    return { compatible: true };
+  }
+  return {
+    compatible: false,
+    reason: constraint.reason,
+    requiredNodeVersion: constraint.minNodeVersion
+  };
+}
+function checkPackageConflict(conflict, declaredPackageVersion, declaredRequiredVersion) {
+  if (!declaredPackageVersion) return { compatible: true };
+  if (conflict.packageMinVersion) {
+    const v = import_semver.default.coerce(declaredPackageVersion);
+    if (v && import_semver.default.lt(v, conflict.packageMinVersion)) {
+      return { compatible: true };
+    }
+  }
+  if (!declaredRequiredVersion) {
+    return {
+      compatible: false,
+      reason: conflict.reason,
+      requires: conflict.requires
+    };
+  }
+  const requiredCoerced = import_semver.default.coerce(declaredRequiredVersion);
+  if (!requiredCoerced) return { compatible: true };
+  if (import_semver.default.lt(requiredCoerced, conflict.requires.minVersion)) {
+    return {
+      compatible: false,
+      reason: conflict.reason,
+      requires: conflict.requires,
+      foundVersion: declaredRequiredVersion
+    };
+  }
+  return { compatible: true };
+}
+function checkDeprecatedApi(rule, declaredVersion) {
+  if (declaredVersion === void 0) return { compatible: true };
+  if (rule.packageMaxVersion) {
+    const v = import_semver.default.coerce(declaredVersion);
+    const max = import_semver.default.coerce(rule.packageMaxVersion);
+    if (v && max && import_semver.default.gt(v, max)) return { compatible: true };
+  }
+  return { compatible: false, reason: rule.reason };
+}
+function currentMatrix() {
+  return mergedMatrix ?? bundledMatrix;
+}
+function mergeMatrices(a, b) {
+  return {
+    pairs: [...a.pairs, ...b.pairs ?? []],
+    nodeEngineConstraints: [
+      ...a.nodeEngineConstraints ?? [],
+      ...b.nodeEngineConstraints ?? []
+    ],
+    packageConflicts: [...a.packageConflicts ?? [], ...b.packageConflicts ?? []],
+    deprecatedApis: [...a.deprecatedApis ?? [], ...b.deprecatedApis ?? []]
+  };
+}
+async function readRemoteCache(url) {
+  try {
+    const raw = await import_node_fs.promises.readFile(REMOTE_CACHE_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.url !== url) return null;
+    const age = Date.now() - new Date(parsed.fetchedAt).getTime();
+    if (age > REMOTE_TTL_MS) return null;
+    return parsed.matrix;
+  } catch {
+    return null;
+  }
+}
+async function writeRemoteCache(url, matrix) {
+  const file = {
+    fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    url,
+    matrix
+  };
+  try {
+    await import_node_fs.promises.mkdir(REMOTE_CACHE_DIR, { recursive: true });
+    await import_node_fs.promises.writeFile(REMOTE_CACHE_PATH, JSON.stringify(file), "utf8");
+  } catch (err) {
+    console.warn(`[neat] failed to cache compat matrix: ${err.message}`);
+  }
+}
+async function ensureCompatLoaded() {
+  if (mergedMatrix) return mergedMatrix;
+  if (remoteLoadAttempted) {
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+  remoteLoadAttempted = true;
+  const url = process.env.NEAT_COMPAT_URL;
+  if (!url) {
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+  const cached = await readRemoteCache(url);
+  if (cached) {
+    mergedMatrix = mergeMatrices(bundledMatrix, cached);
+    return mergedMatrix;
+  }
+  try {
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
+    const remote = await res.json();
+    await writeRemoteCache(url, remote);
+    mergedMatrix = mergeMatrices(bundledMatrix, remote);
+    return mergedMatrix;
+  } catch (err) {
+    console.warn(
+      `[neat] NEAT_COMPAT_URL fetch failed (${err.message}); using bundled matrix only`
+    );
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+}
+function compatPairs() {
+  return currentMatrix().pairs;
+}
+function nodeEngineConstraints() {
+  return currentMatrix().nodeEngineConstraints ?? [];
+}
+function packageConflicts() {
+  return currentMatrix().packageConflicts ?? [];
+}
+function deprecatedApis() {
+  return currentMatrix().deprecatedApis ?? [];
+}
+
+// src/traverse.ts
+init_cjs_shims();
+var import_types = require("@neat.is/types");
+var ROOT_CAUSE_MAX_DEPTH = 5;
+var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function bestEdgeBySource(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (e.provenance === import_types.Provenance.FRONTIER) continue;
+    const cur = best.get(e.source);
+    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+      best.set(e.source, e);
+    }
+  }
+  return best;
+}
+function bestEdgeByTarget(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (e.provenance === import_types.Provenance.FRONTIER) continue;
+    const cur = best.get(e.target);
+    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+      best.set(e.target, e);
+    }
+  }
+  return best;
+}
+var PROVENANCE_CEILING = {
+  OBSERVED: 1,
+  INFERRED: 0.7,
+  EXTRACTED: 0.5,
+  STALE: 0.3,
+  FRONTIER: 0.3
+};
+function volumeWeight(spanCount) {
+  if (!spanCount || spanCount <= 0) return 0.5;
+  const w = 0.5 + Math.log10(spanCount + 1) / 3;
+  return Math.min(1, w);
+}
+function recencyWeight(ageMs) {
+  if (ageMs === void 0) return 0.8;
+  const hour = 60 * 60 * 1e3;
+  if (ageMs <= hour) return 1;
+  if (ageMs <= 24 * hour) {
+    const t = (ageMs - hour) / (23 * hour);
+    return 1 - 0.5 * t;
+  }
+  return 0.3;
+}
+function cleanlinessWeight(spanCount, errorCount) {
+  if (!spanCount || spanCount <= 0) return 1;
+  const rate = (errorCount ?? 0) / spanCount;
+  if (rate <= 0.01) return 1;
+  if (rate >= 0.5) return 0.3;
+  return 1 - rate * 1.4;
+}
+function confidenceForEdge(edge, now = Date.now()) {
+  const ceiling = PROVENANCE_CEILING[edge.provenance] ?? 0.5;
+  const spanCount = edge.signal?.spanCount ?? edge.callCount;
+  const ageMs = edge.signal?.lastObservedAgeMs ?? lastObservedAge(edge, now);
+  if (spanCount === void 0 && ageMs === void 0 && edge.signal === void 0) {
+    return ceiling;
+  }
+  const v = volumeWeight(spanCount);
+  const r = recencyWeight(ageMs);
+  const c = cleanlinessWeight(spanCount, edge.signal?.errorCount);
+  return Math.max(0, Math.min(1, ceiling * v * r * c));
+}
+function lastObservedAge(edge, now) {
+  if (!edge.lastObserved) return void 0;
+  const t = Date.parse(edge.lastObserved);
+  if (!Number.isFinite(t)) return void 0;
+  return Math.max(0, now - t);
+}
+function confidenceFromMix(edges, now = Date.now()) {
+  if (edges.length === 0) return 1;
+  let product = 1;
+  for (const e of edges) {
+    product *= confidenceForEdge(e, now);
+  }
+  return Math.max(0, Math.min(1, product));
+}
+function longestIncomingWalk(graph, start, maxDepth) {
+  let best = { path: [start], edges: [] };
+  const visited = /* @__PURE__ */ new Set([start]);
+  function step(node, path33, edges) {
+    if (path33.length > best.path.length) {
+      best = { path: [...path33], edges: [...edges] };
+    }
+    if (path33.length - 1 >= maxDepth) return;
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
+    for (const [srcId, edge] of incoming) {
+      if (visited.has(srcId)) continue;
+      visited.add(srcId);
+      path33.push(srcId);
+      edges.push(edge);
+      step(srcId, path33, edges);
+      path33.pop();
+      edges.pop();
+      visited.delete(srcId);
+    }
+  }
+  step(start, [start], []);
+  return best;
+}
+function databaseRootCauseShape(graph, origin, walk) {
+  const targetDb = origin;
+  const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
+  if (candidatePairs.length === 0) return null;
+  for (const id of walk.path) {
+    const attrs = graph.getNodeAttributes(id);
+    if (attrs.type !== import_types.NodeType.ServiceNode) continue;
+    const svc = attrs;
+    const deps = svc.dependencies ?? {};
+    for (const pair of candidatePairs) {
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        targetDb.engine,
+        targetDb.engineVersion
+      );
+      if (!result.compatible) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason ?? "incompatible driver",
+          ...result.minDriverVersion ? {
+            fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
+          } : {}
+        };
+      }
+    }
+  }
+  return null;
+}
+function serviceRootCauseShape(graph, _origin, walk) {
+  for (const id of walk.path) {
+    const attrs = graph.getNodeAttributes(id);
+    if (attrs.type !== import_types.NodeType.ServiceNode) continue;
+    const svc = attrs;
+    const deps = svc.dependencies ?? {};
+    const serviceNodeEngine = svc.nodeEngine;
+    for (const constraint of nodeEngineConstraints()) {
+      const declared = deps[constraint.package];
+      if (!declared) continue;
+      const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason,
+          ...result.requiredNodeVersion ? {
+            fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
+          } : {}
+        };
+      }
+    }
+    for (const conflict of packageConflicts()) {
+      const declared = deps[conflict.package];
+      if (!declared) continue;
+      const requiredDeclared = deps[conflict.requires.name];
+      const result = checkPackageConflict(conflict, declared, requiredDeclared);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason,
+          fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
+        };
+      }
+    }
+  }
+  return null;
+}
+var rootCauseShapes = {
+  [import_types.NodeType.DatabaseNode]: databaseRootCauseShape,
+  [import_types.NodeType.ServiceNode]: serviceRootCauseShape
+};
+function getRootCause(graph, errorNodeId, errorEvent) {
+  if (!graph.hasNode(errorNodeId)) return null;
+  const origin = graph.getNodeAttributes(errorNodeId);
+  const shape = rootCauseShapes[origin.type];
+  if (!shape) return null;
+  const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+  const match = shape(graph, origin, walk);
+  if (!match) return null;
+  const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+  return import_types.RootCauseResultSchema.parse({
+    rootCauseNode: match.rootCauseNode,
+    rootCauseReason: reason,
+    traversalPath: walk.path,
+    edgeProvenances: walk.edges.map((e) => e.provenance),
+    confidence: confidenceFromMix(walk.edges),
+    fixRecommendation: match.fixRecommendation
+  });
+}
+function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return import_types.BlastRadiusResultSchema.parse({ origin: nodeId, affectedNodes: [], totalAffected: 0 });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, path: [nodeId], pathEdges: [] }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.pathEdges.length > 0) {
+      const lastEdge = frame.pathEdges[frame.pathEdges.length - 1];
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeProvenance: lastEdge.provenance,
+        path: frame.path,
+        confidence: confidenceFromMix(frame.pathEdges)
+      });
+    }
+    if (frame.distance >= maxDepth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({
+        nodeId: tgtId,
+        distance: frame.distance + 1,
+        path: [...frame.path, tgtId],
+        pathEdges: [...frame.pathEdges, edge]
+      });
+    }
+  }
+  const affectedNodes = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return import_types.BlastRadiusResultSchema.parse({
+    origin: nodeId,
+    affectedNodes,
+    totalAffected: affectedNodes.length
+  });
+}
+var TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH = 3;
+var TRANSITIVE_DEPENDENCIES_MAX_DEPTH = 10;
+function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return import_types.TransitiveDependenciesResultSchema.parse({
+      origin: nodeId,
+      depth,
+      dependencies: [],
+      total: 0
+    });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, edge: null }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.edge) {
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeType: frame.edge.type,
+        provenance: frame.edge.provenance
+      });
+    }
+    if (frame.distance >= depth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({ nodeId: tgtId, distance: frame.distance + 1, edge });
+    }
+  }
+  const dependencies = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return import_types.TransitiveDependenciesResultSchema.parse({
+    origin: nodeId,
+    depth,
+    dependencies,
+    total: dependencies.length
+  });
+}
+
+// src/policy.ts
+var DEFAULT_ACTION_BY_SEVERITY = {
+  info: "log",
+  warning: "alert",
+  error: "alert",
+  critical: "block"
+};
+function resolveOnViolation(policy) {
+  return policy.onViolation ?? DEFAULT_ACTION_BY_SEVERITY[policy.severity];
+}
+function makeViolation(policy, rule, contextSuffix, message, subject, ctx) {
+  return {
+    id: `${policy.id}:${contextSuffix}`,
+    policyId: policy.id,
+    policyName: policy.name,
+    severity: policy.severity,
+    onViolation: resolveOnViolation(policy),
+    ruleType: rule.type,
+    subject,
+    message,
+    observedAt: new Date(ctx.now()).toISOString()
+  };
+}
+var evaluateStructural = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.fromNodeType) return;
+    let satisfied = false;
+    for (const edgeId of graph.outboundEdges(id)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== rule.edgeType) continue;
+      if (e.provenance === import_types2.Provenance.FRONTIER) continue;
+      const target = graph.getNodeAttributes(e.target);
+      if (target.type === rule.toNodeType) {
+        satisfied = true;
+        break;
+      }
+    }
+    if (!satisfied) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.fromNodeType} ${id} has no ${rule.edgeType} edge to a ${rule.toNodeType}`,
+          { nodeId: id },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateOwnership = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const value = a[rule.field];
+    if (typeof value !== "string" || value.length === 0) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} is missing required field "${rule.field}"`,
+          { nodeId: id },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateProvenance = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const required = Array.isArray(rule.required) ? new Set(rule.required) : /* @__PURE__ */ new Set([rule.required]);
+  const violations = [];
+  graph.forEachEdge((edgeId, attrs) => {
+    const e = attrs;
+    if (e.type !== rule.edgeType) return;
+    if (rule.targetNodeId && e.target !== rule.targetNodeId) return;
+    if (!required.has(e.provenance)) {
+      const requiredList = [...required].join(" | ");
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          edgeId,
+          `${rule.edgeType} edge ${edgeId} has provenance ${e.provenance}; required ${requiredList}`,
+          { edgeId },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateBlastRadius = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const depth = rule.depth;
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const result = depth !== void 0 ? getBlastRadius(graph, id, depth) : getBlastRadius(graph, id);
+    if (result.totalAffected > rule.maxAffected) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} has blast radius ${result.totalAffected} > ${rule.maxAffected}`,
+          { nodeId: id, path: [id] },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateCompatibility = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const wantsKind = (kind) => rule.kind === void 0 || rule.kind === kind;
+  graph.forEachNode((svcId, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types2.NodeType.ServiceNode) return;
+    const svc = a;
+    const deps = svc.dependencies ?? {};
+    if (wantsKind("driver-engine")) {
+      for (const edgeId of graph.outboundEdges(svcId)) {
+        const e = graph.getEdgeAttributes(edgeId);
+        if (e.type !== import_types2.EdgeType.CONNECTS_TO) continue;
+        if (e.provenance === import_types2.Provenance.FRONTIER) continue;
+        const dbAttrs = graph.getNodeAttributes(e.target);
+        if (dbAttrs.type !== import_types2.NodeType.DatabaseNode) continue;
+        const db = dbAttrs;
+        for (const pair of compatPairs()) {
+          if (pair.engine !== db.engine) continue;
+          const declared = deps[pair.driver];
+          if (!declared) continue;
+          const result = checkCompatibility(pair.driver, declared, db.engine, db.engineVersion);
+          if (!result.compatible && result.reason) {
+            violations.push(
+              makeViolation(
+                policy,
+                rule,
+                `${svcId}:driver-engine:${pair.driver}@${declared}:${db.engine}@${db.engineVersion}`,
+                result.reason,
+                { nodeId: svcId, edgeId },
+                ctx
+              )
+            );
+          }
+        }
+      }
+    }
+    if (wantsKind("node-engine")) {
+      const serviceNodeRange = svc.nodeEngine;
+      for (const constraint of nodeEngineConstraints()) {
+        const declared = deps[constraint.package];
+        if (!declared) continue;
+        const result = checkNodeEngineConstraint(constraint, declared, serviceNodeRange);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:node-engine:${constraint.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+    if (wantsKind("package-conflict")) {
+      for (const conflict of packageConflicts()) {
+        const declared = deps[conflict.package];
+        if (!declared) continue;
+        const requiredDeclared = deps[conflict.requires.name];
+        const result = checkPackageConflict(conflict, declared, requiredDeclared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:package-conflict:${conflict.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+    if (wantsKind("deprecated-api")) {
+      for (const dep of deprecatedApis()) {
+        const declared = deps[dep.package];
+        if (!declared) continue;
+        const result = checkDeprecatedApi(dep, declared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:deprecated-api:${dep.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+  });
+  return violations;
+};
+var policyEvaluators = {
+  structural: evaluateStructural,
+  ownership: evaluateOwnership,
+  provenance: evaluateProvenance,
+  "blast-radius": evaluateBlastRadius,
+  compatibility: evaluateCompatibility
+};
+function canPromoteFrontier(graph, frontierId2, policies, ctx) {
+  if (policies.length === 0) return { allowed: true, violations: [] };
+  const all = evaluateAllPolicies(graph, policies, ctx);
+  const blocking = all.filter((v) => {
+    if (v.onViolation !== "block") return false;
+    return v.subject.nodeId === frontierId2 || v.subject.path?.includes(frontierId2) === true;
+  });
+  return { allowed: blocking.length === 0, violations: blocking };
+}
+function evaluateAllPolicies(graph, policies, ctx) {
+  const out = [];
+  for (const policy of policies) {
+    const evaluator = policyEvaluators[policy.rule.type];
+    const violations = evaluator({ graph, policy, rule: policy.rule, ctx });
+    for (const v of violations) out.push(v);
+  }
+  return out;
+}
+async function loadPolicyFile(policyPath) {
+  let raw;
+  try {
+    raw = await import_node_fs2.promises.readFile(policyPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  const json = JSON.parse(raw);
+  const file = import_types2.PolicyFileSchema.parse(json);
+  return file.policies;
+}
+var PolicyViolationsLog = class {
+  path;
+  seen = null;
+  constructor(logPath) {
+    this.path = logPath;
+  }
+  async append(v) {
+    if (!this.seen) await this.hydrate();
+    if (this.seen.has(v.id)) return false;
+    this.seen.add(v.id);
+    await import_node_fs2.promises.mkdir(import_node_path2.default.dirname(this.path), { recursive: true });
+    await import_node_fs2.promises.appendFile(this.path, JSON.stringify(v) + "\n", "utf8");
+    return true;
+  }
+  async readAll() {
+    try {
+      const raw = await import_node_fs2.promises.readFile(this.path, "utf8");
+      return raw.split("\n").filter(Boolean).map((line) => JSON.parse(line));
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+  }
+  async hydrate() {
+    this.seen = /* @__PURE__ */ new Set();
+    const existing = await this.readAll();
+    for (const v of existing) this.seen.add(v.id);
+  }
+};
+
+// src/ingest.ts
+var import_types3 = require("@neat.is/types");
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_STALE_THRESHOLDS = {
+  CALLS: HOUR_MS,
+  CONNECTS_TO: 4 * HOUR_MS,
+  PUBLISHES_TO: 4 * HOUR_MS,
+  CONSUMES_FROM: 4 * HOUR_MS,
+  DEPENDS_ON: DAY_MS,
+  CONFIGURED_BY: DAY_MS,
+  RUNS_ON: DAY_MS
+};
+var FALLBACK_STALE_THRESHOLD_MS = DAY_MS;
+function loadStaleThresholdsFromEnv() {
+  const raw = process.env.NEAT_STALE_THRESHOLDS;
+  if (!raw) return DEFAULT_STALE_THRESHOLDS;
+  try {
+    const overrides = JSON.parse(raw);
+    const merged = { ...DEFAULT_STALE_THRESHOLDS };
+    for (const [k, v] of Object.entries(overrides)) {
+      if (typeof v === "number" && Number.isFinite(v) && v >= 0) merged[k] = v;
+    }
+    return merged;
+  } catch (err) {
+    console.warn(
+      `[neat] NEAT_STALE_THRESHOLDS could not be parsed (${err.message}); using defaults`
+    );
+    return DEFAULT_STALE_THRESHOLDS;
+  }
+}
+function thresholdForEdgeType(edgeType, overrides) {
+  const map = overrides ?? loadStaleThresholdsFromEnv();
+  return map[edgeType] ?? FALLBACK_STALE_THRESHOLD_MS;
+}
+function nowIso(ctx) {
+  return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
+}
+function pickAttr(span, ...keys) {
+  for (const k of keys) {
+    const v = span.attributes[k];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return void 0;
+}
+function hostFromUrl(u) {
+  if (!u) return void 0;
+  try {
+    return new URL(u).hostname;
+  } catch {
+    return void 0;
+  }
+}
+function pickAddress(span) {
+  return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
+}
+function makeObservedEdgeId(type, source, target) {
+  return (0, import_types3.observedEdgeId)(source, target, type);
+}
+function makeInferredEdgeId(type, source, target) {
+  return (0, import_types3.inferredEdgeId)(source, target, type);
+}
+var INFERRED_CONFIDENCE = 0.6;
+var STITCH_MAX_DEPTH = 2;
+var PARENT_SPAN_CACHE_SIZE = 1e4;
+var PARENT_SPAN_CACHE_TTL_MS = 5 * 60 * 1e3;
+var parentSpanCache = /* @__PURE__ */ new Map();
+function parentSpanKey(traceId, spanId) {
+  return `${traceId}:${spanId}`;
+}
+function cacheSpanService(span, now) {
+  if (!span.traceId || !span.spanId) return;
+  const key = parentSpanKey(span.traceId, span.spanId);
+  parentSpanCache.delete(key);
+  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
+    const oldest = parentSpanCache.keys().next().value;
+    if (!oldest) break;
+    parentSpanCache.delete(oldest);
+  }
+}
+function lookupParentSpanService(traceId, parentSpanId, now) {
+  const entry = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
+  if (!entry) return null;
+  if (entry.expiresAt <= now) {
+    parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
+    return null;
+  }
+  return entry.service;
+}
+function resolveServiceId(graph, host) {
+  const direct = (0, import_types3.serviceId)(host);
+  if (graph.hasNode(direct)) return direct;
+  let found = null;
+  graph.forEachNode((id, attrs) => {
+    if (found) return;
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.ServiceNode) return;
+    if (a.name === host) {
+      found = id;
+      return;
+    }
+    if (a.aliases && a.aliases.includes(host)) {
+      found = id;
+    }
+  });
+  return found;
+}
+function frontierIdFor(host) {
+  return (0, import_types3.frontierId)(host);
+}
+function ensureServiceNode(graph, serviceName) {
+  const id = (0, import_types3.serviceId)(serviceName);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: import_types3.NodeType.ServiceNode,
+    name: serviceName,
+    language: "unknown",
+    discoveredVia: "otel"
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function ensureDatabaseNode(graph, host, engine) {
+  const id = (0, import_types3.databaseId)(host);
+  if (graph.hasNode(id)) return id;
+  const node = {
+    id,
+    type: import_types3.NodeType.DatabaseNode,
+    name: host,
+    engine,
+    engineVersion: "unknown",
+    compatibleDrivers: [],
+    host,
+    discoveredVia: "otel"
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function ensureFrontierNode(graph, host, ts) {
+  const id = frontierIdFor(host);
+  if (graph.hasNode(id)) {
+    const existing = graph.getNodeAttributes(id);
+    graph.replaceNodeAttributes(id, { ...existing, lastObserved: ts });
+    return id;
+  }
+  const node = {
+    id,
+    type: import_types3.NodeType.FrontierNode,
+    name: host,
+    host,
+    firstObserved: ts,
+    lastObserved: ts
+  };
+  graph.addNode(id, node);
+  return id;
+}
+function upsertFrontierEdge(graph, type, source, target, ts) {
+  const id = (0, import_types3.frontierEdgeId)(source, target, type);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const updated = {
+      ...existing,
+      provenance: import_types3.Provenance.FRONTIER,
+      lastObserved: ts,
+      callCount: (existing.callCount ?? 0) + 1
+    };
+    graph.replaceEdgeAttributes(id, updated);
+    return;
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: import_types3.Provenance.FRONTIER,
+    confidence: 1,
+    lastObserved: ts,
+    callCount: 1
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+}
+function upsertObservedEdge(graph, type, source, target, ts, isError = false) {
+  if (!graph.hasNode(source) || !graph.hasNode(target)) return null;
+  const id = makeObservedEdgeId(type, source, target);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const newSpanCount = (existing.signal?.spanCount ?? existing.callCount ?? 0) + 1;
+    const newErrorCount = (existing.signal?.errorCount ?? 0) + (isError ? 1 : 0);
+    const updated = {
+      ...existing,
+      provenance: import_types3.Provenance.OBSERVED,
+      lastObserved: ts,
+      callCount: newSpanCount,
+      signal: {
+        spanCount: newSpanCount,
+        errorCount: newErrorCount,
+        lastObservedAgeMs: 0
+      },
+      confidence: 1
+    };
+    graph.replaceEdgeAttributes(id, updated);
+    return { edge: updated, created: false };
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: import_types3.Provenance.OBSERVED,
+    confidence: 1,
+    lastObserved: ts,
+    callCount: 1,
+    signal: {
+      spanCount: 1,
+      errorCount: isError ? 1 : 0,
+      lastObservedAgeMs: 0
+    }
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+  return { edge, created: true };
+}
+function stitchTrace(graph, sourceServiceId, ts) {
+  if (!graph.hasNode(sourceServiceId)) return;
+  const visited = /* @__PURE__ */ new Set([sourceServiceId]);
+  const queue = [{ nodeId: sourceServiceId, depth: 0 }];
+  while (queue.length > 0) {
+    const { nodeId, depth } = queue.shift();
+    if (depth >= STITCH_MAX_DEPTH) continue;
+    const outbound = graph.outboundEdges(nodeId);
+    for (const edgeId of outbound) {
+      const edge = graph.getEdgeAttributes(edgeId);
+      if (edge.provenance !== import_types3.Provenance.EXTRACTED) continue;
+      if (graph.hasEdge((0, import_types3.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
+      upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
+      if (!visited.has(edge.target)) {
+        visited.add(edge.target);
+        queue.push({ nodeId: edge.target, depth: depth + 1 });
+      }
+    }
+  }
+}
+function upsertInferredEdge(graph, type, source, target, ts) {
+  const id = makeInferredEdgeId(type, source, target);
+  if (graph.hasEdge(id)) {
+    const existing = graph.getEdgeAttributes(id);
+    const updated = { ...existing, lastObserved: ts };
+    graph.replaceEdgeAttributes(id, updated);
+    return;
+  }
+  const edge = {
+    id,
+    source,
+    target,
+    type,
+    provenance: import_types3.Provenance.INFERRED,
+    confidence: INFERRED_CONFIDENCE,
+    lastObserved: ts
+  };
+  graph.addEdgeWithKey(id, source, target, edge);
+}
+async function appendErrorEvent(ctx, ev) {
+  await import_node_fs3.promises.mkdir(import_node_path3.default.dirname(ctx.errorsPath), { recursive: true });
+  await import_node_fs3.promises.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
+}
+async function handleSpan(ctx, span) {
+  const ts = span.startTimeIso ?? nowIso(ctx);
+  const nowMs = ctx.now ? ctx.now() : Date.now();
+  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const isError = span.statusCode === 2;
+  cacheSpanService(span, nowMs);
+  let affectedNode = sourceId;
+  if (span.dbSystem) {
+    const host = pickAddress(span);
+    if (host) {
+      ensureDatabaseNode(ctx.graph, host, span.dbSystem);
+      const targetId = (0, import_types3.databaseId)(host);
+      const result = upsertObservedEdge(
+        ctx.graph,
+        import_types3.EdgeType.CONNECTS_TO,
+        sourceId,
+        targetId,
+        ts,
+        isError
+      );
+      if (result) affectedNode = targetId;
+    }
+  } else {
+    const host = pickAddress(span);
+    let resolvedViaAddress = false;
+    if (host && host !== span.service) {
+      const targetId = resolveServiceId(ctx.graph, host);
+      if (targetId && targetId !== sourceId) {
+        upsertObservedEdge(
+          ctx.graph,
+          import_types3.EdgeType.CALLS,
+          sourceId,
+          targetId,
+          ts,
+          isError
+        );
+        affectedNode = targetId;
+        resolvedViaAddress = true;
+      } else if (!targetId) {
+        const frontierId2 = ensureFrontierNode(ctx.graph, host, ts);
+        if (ctx.graph.hasNode(sourceId)) {
+          upsertFrontierEdge(ctx.graph, import_types3.EdgeType.CALLS, sourceId, frontierId2, ts);
+        }
+        affectedNode = frontierId2;
+        resolvedViaAddress = true;
+      }
+    }
+    if (!resolvedViaAddress && span.parentSpanId) {
+      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
+      if (parentService && parentService !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parentService);
+        upsertObservedEdge(
+          ctx.graph,
+          import_types3.EdgeType.CALLS,
+          parentId,
+          sourceId,
+          ts,
+          isError
+        );
+      }
+    }
+  }
+  if (span.statusCode === 2) {
+    stitchTrace(ctx.graph, sourceId, ts);
+    if (ctx.writeErrorEventInline !== false) {
+      const ev = {
+        id: `${span.traceId}:${span.spanId}`,
+        timestamp: ts,
+        service: span.service,
+        traceId: span.traceId,
+        spanId: span.spanId,
+        errorMessage: span.exception?.message ?? span.errorMessage ?? span.name ?? "unknown error",
+        ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+        ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+        affectedNode
+      };
+      await appendErrorEvent(ctx, ev);
+    }
+  }
+  void affectedNode;
+  if (ctx.onPolicyTrigger) await ctx.onPolicyTrigger(ctx.graph);
+}
+function promoteFrontierNodes(graph, opts = {}) {
+  const aliasIndex = /* @__PURE__ */ new Map();
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.ServiceNode) return;
+    aliasIndex.set(a.name, id);
+    if (a.aliases) {
+      for (const alias of a.aliases) aliasIndex.set(alias, id);
+    }
+  });
+  const toPromote = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.FrontierNode) return;
+    const target = aliasIndex.get(a.host);
+    if (!target) return;
+    if (target === id) return;
+    toPromote.push({ frontierId: id, serviceId: target });
+  });
+  let promoted = 0;
+  for (const { frontierId: frontierId2, serviceId: serviceId3 } of toPromote) {
+    if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
+      const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
+      if (!gate.allowed) {
+        continue;
+      }
+    }
+    rewireFrontierEdges(graph, frontierId2, serviceId3);
+    graph.dropNode(frontierId2);
+    promoted++;
+  }
+  return promoted;
+}
+function rewireFrontierEdges(graph, frontierId2, serviceId3) {
+  const inbound = [...graph.inboundEdges(frontierId2)];
+  const outbound = [...graph.outboundEdges(frontierId2)];
+  for (const edgeId of inbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId3, edgeId);
+  }
+  for (const edgeId of outbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, serviceId3, edge.target, edgeId);
+  }
+}
+function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
+  graph.dropEdge(oldEdgeId);
+  const promotedProvenance = edge.provenance === import_types3.Provenance.FRONTIER ? import_types3.Provenance.OBSERVED : edge.provenance;
+  const newId = promotedProvenance === import_types3.Provenance.OBSERVED ? (0, import_types3.observedEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types3.Provenance.INFERRED ? (0, import_types3.inferredEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types3.Provenance.EXTRACTED ? (0, import_types3.extractedEdgeId)(newSource, newTarget, edge.type) : (0, import_types3.frontierEdgeId)(newSource, newTarget, edge.type);
+  if (graph.hasEdge(newId)) {
+    const existing = graph.getEdgeAttributes(newId);
+    const merged = {
+      ...existing,
+      callCount: (existing.callCount ?? 0) + (edge.callCount ?? 0),
+      lastObserved: pickLater(existing.lastObserved, edge.lastObserved)
+    };
+    graph.replaceEdgeAttributes(newId, merged);
+    return;
+  }
+  const rebuilt = {
+    ...edge,
+    id: newId,
+    source: newSource,
+    target: newTarget,
+    provenance: promotedProvenance
+  };
+  graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
+}
+function pickLater(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return new Date(a).getTime() >= new Date(b).getTime() ? a : b;
+}
+function makeSpanHandler(ctx) {
+  return (span) => handleSpan(ctx, span);
+}
+async function markStaleEdges(graph, options = {}) {
+  const thresholds = options.thresholds ?? loadStaleThresholdsFromEnv();
+  const now = options.now ?? Date.now();
+  const events = [];
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    if (e.provenance !== import_types3.Provenance.OBSERVED) return;
+    if (!e.lastObserved) return;
+    const threshold = thresholdForEdgeType(e.type, thresholds);
+    const age = now - new Date(e.lastObserved).getTime();
+    if (age > threshold) {
+      const updated = { ...e, provenance: import_types3.Provenance.STALE, confidence: 0.3 };
+      graph.replaceEdgeAttributes(id, updated);
+      events.push({
+        edgeId: id,
+        source: e.source,
+        target: e.target,
+        edgeType: e.type,
+        thresholdMs: threshold,
+        ageMs: age,
+        lastObserved: e.lastObserved,
+        transitionedAt: new Date(now).toISOString()
+      });
+    }
+  });
+  if (options.staleEventsPath && events.length > 0) {
+    await appendStaleEvents(options.staleEventsPath, events);
+  }
+  return { count: events.length, events };
+}
+async function appendStaleEvents(staleEventsPath, events) {
+  await import_node_fs3.promises.mkdir(import_node_path3.default.dirname(staleEventsPath), { recursive: true });
+  const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
+  await import_node_fs3.promises.appendFile(staleEventsPath, lines, "utf8");
+}
+async function readStaleEvents(staleEventsPath) {
+  try {
+    const raw = await import_node_fs3.promises.readFile(staleEventsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+function startStalenessLoop(graph, options = {}) {
+  let stopped = false;
+  const intervalMs = options.intervalMs ?? 6e4;
+  const tick = () => {
+    if (stopped) return;
+    void (async () => {
+      try {
+        await markStaleEdges(graph, {
+          thresholds: options.thresholds,
+          staleEventsPath: options.staleEventsPath
+        });
+        if (options.onPolicyTrigger) await options.onPolicyTrigger(graph);
+      } catch (err) {
+        console.error("staleness tick failed", err);
+      }
+    })();
+  };
+  const interval = setInterval(tick, intervalMs);
+  if (typeof interval.unref === "function") interval.unref();
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+  };
+}
+async function readErrorEvents(errorsPath) {
+  try {
+    const raw = await import_node_fs3.promises.readFile(errorsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+
+// src/extract/services.ts
+init_cjs_shims();
+var import_node_fs6 = require("fs");
+var import_node_path6 = __toESM(require("path"), 1);
+var import_ignore = __toESM(require("ignore"), 1);
+var import_minimatch = require("minimatch");
+var import_types5 = require("@neat.is/types");
+
+// src/extract/shared.ts
+init_cjs_shims();
+var import_node_fs4 = require("fs");
+var import_node_path4 = __toESM(require("path"), 1);
+var import_yaml = require("yaml");
+var import_types4 = require("@neat.is/types");
+var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py"]);
+var CONFIG_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".yaml", ".yml"]);
+var IGNORED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".turbo",
+  "dist",
+  "build",
+  ".next"
+]);
+function isConfigFile(name) {
+  const ext = import_node_path4.default.extname(name);
+  if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
+  if (name === ".env" || name.startsWith(".env.")) return { match: true, fileType: "env" };
+  return { match: false, fileType: "" };
+}
+function cleanVersion(raw) {
+  if (!raw) return void 0;
+  return raw.replace(/^[\^~><=v\s]+/, "").trim() || void 0;
+}
+async function readJson(filePath) {
+  const raw = await import_node_fs4.promises.readFile(filePath, "utf8");
+  return JSON.parse(raw);
+}
+async function readYaml(filePath) {
+  const raw = await import_node_fs4.promises.readFile(filePath, "utf8");
+  return (0, import_yaml.parse)(raw);
+}
+async function exists(p) {
+  try {
+    await import_node_fs4.promises.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/extract/python.ts
+init_cjs_shims();
+var import_node_fs5 = require("fs");
+var import_node_path5 = __toESM(require("path"), 1);
+var import_smol_toml = require("smol-toml");
+var REQUIREMENT_LINE = /^\s*([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?\s*(?:(==)\s*([A-Za-z0-9_.+-]+))?/;
+function parseRequirementsTxt(content) {
+  const out = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.split("#")[0]?.trim();
+    if (!line) continue;
+    if (line.startsWith("-")) continue;
+    const match = REQUIREMENT_LINE.exec(line);
+    if (!match) continue;
+    const name = match[1].toLowerCase();
+    const version = match[3] ?? "";
+    out[name] = version;
+  }
+  return out;
+}
+function depsFromPyProject(pyproject) {
+  const out = {};
+  for (const entry of pyproject.project?.dependencies ?? []) {
+    const match = REQUIREMENT_LINE.exec(entry);
+    if (!match) continue;
+    out[match[1].toLowerCase()] = match[3] ?? "";
+  }
+  const poetryDeps = pyproject.tool?.poetry?.dependencies ?? {};
+  for (const [name, value] of Object.entries(poetryDeps)) {
+    if (name.toLowerCase() === "python") continue;
+    const raw = typeof value === "string" ? value : value?.version ?? "";
+    out[name.toLowerCase()] = raw.replace(/^[\^~><=v\s]+/, "");
+  }
+  return out;
+}
+async function discoverPythonService(serviceDir) {
+  const pyprojectPath = import_node_path5.default.join(serviceDir, "pyproject.toml");
+  const requirementsPath = import_node_path5.default.join(serviceDir, "requirements.txt");
+  const setupPath = import_node_path5.default.join(serviceDir, "setup.py");
+  const hasPyproject = await exists(pyprojectPath);
+  const hasRequirements = await exists(requirementsPath);
+  const hasSetup = await exists(setupPath);
+  if (!hasPyproject && !hasRequirements && !hasSetup) return null;
+  let name = import_node_path5.default.basename(serviceDir);
+  let version;
+  const dependencies = {};
+  if (hasPyproject) {
+    const raw = await import_node_fs5.promises.readFile(pyprojectPath, "utf8");
+    const pyproject = (0, import_smol_toml.parse)(raw);
+    name = pyproject.project?.name ?? pyproject.tool?.poetry?.name ?? name;
+    version = pyproject.project?.version ?? pyproject.tool?.poetry?.version ?? void 0;
+    Object.assign(dependencies, depsFromPyProject(pyproject));
+  }
+  if (hasRequirements) {
+    const raw = await import_node_fs5.promises.readFile(requirementsPath, "utf8");
+    Object.assign(dependencies, parseRequirementsTxt(raw));
+  }
+  return { name, version, dependencies };
+}
+function pythonToPackage(service) {
+  return {
+    name: service.name,
+    version: service.version,
+    dependencies: service.dependencies
+  };
+}
+
+// src/extract/services.ts
+var DEFAULT_SCAN_DEPTH = 5;
+function parseScanDepth() {
+  const raw = process.env.NEAT_SCAN_DEPTH;
+  if (!raw) return DEFAULT_SCAN_DEPTH;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_SCAN_DEPTH;
+}
+function workspaceGlobs(pkg) {
+  const ws = pkg.workspaces;
+  if (!ws) return null;
+  if (Array.isArray(ws)) return ws.length > 0 ? ws : null;
+  if (Array.isArray(ws.packages)) return ws.packages.length > 0 ? ws.packages : null;
+  return null;
+}
+async function loadGitignore(scanPath) {
+  const gitignorePath = import_node_path6.default.join(scanPath, ".gitignore");
+  if (!await exists(gitignorePath)) return null;
+  const raw = await import_node_fs6.promises.readFile(gitignorePath, "utf8");
+  return (0, import_ignore.default)().add(raw);
+}
+async function walkDirs(start, scanPath, options, visit) {
+  async function recurse(current, depth) {
+    if (depth > options.maxDepth) return;
+    const entries = await import_node_fs6.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      const child = import_node_path6.default.join(current, entry.name);
+      if (options.ig) {
+        const rel = import_node_path6.default.relative(scanPath, child).split(import_node_path6.default.sep).join("/");
+        if (rel && options.ig.ignores(rel + "/")) continue;
+      }
+      await visit(child);
+      await recurse(child, depth + 1);
+    }
+  }
+  await recurse(start, 0);
+}
+async function expandWorkspaceGlobs(scanPath, globs) {
+  const found = /* @__PURE__ */ new Set();
+  const scanDepth = parseScanDepth();
+  for (const raw of globs) {
+    const pattern = raw.replace(/^\.\//, "");
+    if (!pattern.includes("*")) {
+      const candidate = import_node_path6.default.join(scanPath, pattern);
+      if (await exists(import_node_path6.default.join(candidate, "package.json"))) found.add(candidate);
+      continue;
+    }
+    const segments = pattern.split("/");
+    const staticSegments = [];
+    for (const seg of segments) {
+      if (seg.includes("*")) break;
+      staticSegments.push(seg);
+    }
+    const start = import_node_path6.default.join(scanPath, ...staticSegments);
+    if (!await exists(start)) continue;
+    const hasDoubleStar = pattern.includes("**");
+    const walkDepth = hasDoubleStar ? scanDepth : Math.max(0, segments.length - staticSegments.length - 1);
+    await walkDirs(start, scanPath, { maxDepth: walkDepth, ig: null }, async (dir) => {
+      const rel = import_node_path6.default.relative(scanPath, dir).split(import_node_path6.default.sep).join("/");
+      if ((0, import_minimatch.minimatch)(rel, pattern) && await exists(import_node_path6.default.join(dir, "package.json"))) {
+        found.add(dir);
+      }
+    });
+  }
+  return [...found];
+}
+async function discoverNodeService(scanPath, dir) {
+  const pkgPath = import_node_path6.default.join(dir, "package.json");
+  if (!await exists(pkgPath)) return null;
+  const pkg = await readJson(pkgPath);
+  if (!pkg.name) return null;
+  const node = {
+    id: (0, import_types5.serviceId)(pkg.name),
+    type: import_types5.NodeType.ServiceNode,
+    name: pkg.name,
+    language: "javascript",
+    version: pkg.version,
+    dependencies: pkg.dependencies ?? {},
+    repoPath: import_node_path6.default.relative(scanPath, dir),
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+  };
+  return { pkg, dir, node };
+}
+async function discoverPyService(scanPath, dir) {
+  const py = await discoverPythonService(dir);
+  if (!py) return null;
+  const pkg = pythonToPackage(py);
+  const node = {
+    id: (0, import_types5.serviceId)(py.name),
+    type: import_types5.NodeType.ServiceNode,
+    name: py.name,
+    language: "python",
+    version: py.version,
+    dependencies: py.dependencies,
+    repoPath: import_node_path6.default.relative(scanPath, dir)
+  };
+  return { pkg, dir, node };
+}
+async function discoverServices(scanPath) {
+  const rootPkgPath = import_node_path6.default.join(scanPath, "package.json");
+  const rootPkg = await exists(rootPkgPath) ? await readJson(rootPkgPath) : null;
+  const wsGlobs = rootPkg ? workspaceGlobs(rootPkg) : null;
+  const candidateDirs = [];
+  if (wsGlobs) {
+    candidateDirs.push(...await expandWorkspaceGlobs(scanPath, wsGlobs));
+  } else {
+    if (rootPkg && rootPkg.name) candidateDirs.push(scanPath);
+    const ig = await loadGitignore(scanPath);
+    await walkDirs(
+      scanPath,
+      scanPath,
+      { maxDepth: parseScanDepth(), ig },
+      async (dir) => {
+        if (await exists(import_node_path6.default.join(dir, "package.json"))) {
+          candidateDirs.push(dir);
+        } else if (await exists(import_node_path6.default.join(dir, "pyproject.toml")) || await exists(import_node_path6.default.join(dir, "requirements.txt")) || await exists(import_node_path6.default.join(dir, "setup.py"))) {
+          candidateDirs.push(dir);
+        }
+      }
+    );
+  }
+  candidateDirs.sort();
+  const seen = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const dir of candidateDirs) {
+    const service = await discoverNodeService(scanPath, dir) ?? await discoverPyService(scanPath, dir);
+    if (!service) continue;
+    const existingDir = seen.get(service.node.name);
+    if (existingDir !== void 0) {
+      const a = import_node_path6.default.relative(scanPath, existingDir) || ".";
+      const b = import_node_path6.default.relative(scanPath, dir) || ".";
+      console.warn(
+        `[neat] duplicate package name "${service.node.name}" \u2014 keeping ${a}, ignoring ${b}`
+      );
+      continue;
+    }
+    seen.set(service.node.name, dir);
+    out.push(service);
+  }
+  return out;
+}
+function addServiceNodes(graph, services) {
+  let nodesAdded = 0;
+  for (const service of services) {
+    if (!graph.hasNode(service.node.id)) {
+      graph.addNode(service.node.id, { ...service.node, discoveredVia: "static" });
+      nodesAdded++;
+      continue;
+    }
+    const existing = graph.getNodeAttributes(service.node.id);
+    const mergedDiscoveredVia = existing.discoveredVia === "otel" ? "merged" : "static";
+    graph.replaceNodeAttributes(service.node.id, {
+      ...existing,
+      ...service.node,
+      discoveredVia: mergedDiscoveredVia
+    });
+  }
+  return nodesAdded;
+}
+
+// src/extract/aliases.ts
+init_cjs_shims();
+var import_node_path7 = __toESM(require("path"), 1);
+var import_node_fs7 = require("fs");
+var import_yaml2 = require("yaml");
+var import_types6 = require("@neat.is/types");
+var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
+  "Service",
+  "Deployment",
+  "StatefulSet",
+  "DaemonSet"
+]);
+function addAliases(graph, serviceId3, candidates) {
+  if (!graph.hasNode(serviceId3)) return;
+  const node = graph.getNodeAttributes(serviceId3);
+  if (node.type !== import_types6.NodeType.ServiceNode) return;
+  const set = new Set(node.aliases ?? []);
+  for (const c of candidates) {
+    if (!c) continue;
+    if (c === node.name) continue;
+    set.add(c);
+  }
+  if (set.size === 0) return;
+  const updated = { ...node, aliases: [...set].sort() };
+  graph.replaceNodeAttributes(serviceId3, updated);
+}
+function indexServicesByName(services) {
+  const map = /* @__PURE__ */ new Map();
+  for (const s of services) {
+    map.set(s.node.name, s.node.id);
+    map.set(import_node_path7.default.basename(s.dir), s.node.id);
+  }
+  return map;
+}
+async function collectComposeAliases(graph, scanPath, serviceIndex) {
+  let composePath = null;
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = import_node_path7.default.join(scanPath, name);
+    if (await exists(abs)) {
+      composePath = abs;
+      break;
+    }
+  }
+  if (!composePath) return;
+  const compose = await readYaml(composePath);
+  if (!compose?.services) return;
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const serviceId3 = serviceIndex.get(composeName);
+    if (!serviceId3) continue;
+    const aliases = /* @__PURE__ */ new Set([composeName]);
+    if (svc.container_name) aliases.add(svc.container_name);
+    if (svc.hostname) aliases.add(svc.hostname);
+    addAliases(graph, serviceId3, aliases);
+  }
+}
+var LABEL_KEYS = /* @__PURE__ */ new Set([
+  "service",
+  "service.name",
+  "app",
+  "app.name",
+  "com.docker.compose.service",
+  "org.opencontainers.image.title"
+]);
+function parseDockerfileLabels(content) {
+  const out = [];
+  const lineRegex = /^\s*label\s+(.+)$/i;
+  for (const raw of content.split("\n")) {
+    const m = lineRegex.exec(raw);
+    if (!m) continue;
+    const rest = m[1];
+    const pairRegex = /([\w.-]+)\s*=\s*("([^"]*)"|'([^']*)'|([^\s]+))/g;
+    let pair;
+    while ((pair = pairRegex.exec(rest)) !== null) {
+      const key = pair[1].toLowerCase();
+      if (!LABEL_KEYS.has(key)) continue;
+      const value = pair[3] ?? pair[4] ?? pair[5] ?? "";
+      if (value) out.push(value);
+    }
+  }
+  return out;
+}
+async function collectDockerfileAliases(graph, services) {
+  for (const service of services) {
+    const dockerfilePath = import_node_path7.default.join(service.dir, "Dockerfile");
+    if (!await exists(dockerfilePath)) continue;
+    const content = await import_node_fs7.promises.readFile(dockerfilePath, "utf8");
+    const aliases = parseDockerfileLabels(content);
+    if (aliases.length > 0) addAliases(graph, service.node.id, aliases);
+  }
+}
+async function walkYamlFiles(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await import_node_fs7.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      out.push(...await walkYamlFiles(import_node_path7.default.join(start, entry.name), depth + 1, max));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path7.default.extname(entry.name))) {
+      out.push(import_node_path7.default.join(start, entry.name));
+    }
+  }
+  return out;
+}
+function k8sHostnames(name, namespace) {
+  const ns = namespace ?? "default";
+  return [
+    name,
+    `${name}.${ns}`,
+    `${name}.${ns}.svc`,
+    `${name}.${ns}.svc.cluster.local`
+  ];
+}
+function k8sServiceTarget(doc, byName) {
+  const selector = doc.spec?.selector;
+  const selectorApp = selector?.app ?? selector?.matchLabels?.app;
+  if (selectorApp && byName.has(selectorApp)) return byName.get(selectorApp);
+  const labelApp = doc.metadata?.labels?.app;
+  if (labelApp && byName.has(labelApp)) return byName.get(labelApp);
+  const metaName = doc.metadata?.name;
+  if (metaName && byName.has(metaName)) return byName.get(metaName);
+  return null;
+}
+async function collectK8sAliases(graph, scanPath, serviceIndex) {
+  const files = await walkYamlFiles(scanPath);
+  for (const file of files) {
+    const content = await import_node_fs7.promises.readFile(file, "utf8");
+    let docs;
+    try {
+      docs = (0, import_yaml2.parseAllDocuments)(content).map((d) => d.toJSON());
+    } catch {
+      continue;
+    }
+    for (const doc of docs) {
+      if (!doc?.kind || !doc.metadata?.name) continue;
+      if (!K8S_KINDS_WITH_HOSTNAMES.has(doc.kind)) continue;
+      const target = k8sServiceTarget(doc, serviceIndex);
+      if (!target) continue;
+      addAliases(graph, target, k8sHostnames(doc.metadata.name, doc.metadata.namespace));
+    }
+  }
+}
+async function addServiceAliases(graph, scanPath, services) {
+  const byName = indexServicesByName(services);
+  await collectComposeAliases(graph, scanPath, byName);
+  await collectDockerfileAliases(graph, services);
+  await collectK8sAliases(graph, scanPath, byName);
+}
+
+// src/extract/databases/index.ts
+init_cjs_shims();
+var import_node_path15 = __toESM(require("path"), 1);
+var import_types7 = require("@neat.is/types");
+
+// src/extract/databases/db-config-yaml.ts
+init_cjs_shims();
+var import_node_path8 = __toESM(require("path"), 1);
+async function parse(serviceDir) {
+  const yamlPath = import_node_path8.default.join(serviceDir, "db-config.yaml");
+  if (!await exists(yamlPath)) return [];
+  const raw = await readYaml(yamlPath);
+  return [
+    {
+      host: raw.host,
+      port: raw.port,
+      database: raw.database,
+      engine: raw.engine,
+      engineVersion: raw.engineVersion !== void 0 ? String(raw.engineVersion) : "unknown",
+      sourceFile: yamlPath
+    }
+  ];
+}
+var dbConfigYamlParser = { name: "db-config.yaml", parse };
+
+// src/extract/databases/dotenv.ts
+init_cjs_shims();
+var import_node_fs9 = require("fs");
+var import_node_path10 = __toESM(require("path"), 1);
+
+// src/extract/databases/shared.ts
+init_cjs_shims();
+var import_node_fs8 = require("fs");
+var import_node_path9 = __toESM(require("path"), 1);
+function schemeToEngine(scheme) {
+  const s = scheme.toLowerCase().split("+")[0];
+  switch (s) {
+    case "postgres":
+    case "postgresql":
+      return "postgresql";
+    case "mysql":
+    case "mariadb":
+      return "mysql";
+    case "mongodb":
+    case "mongodb+srv":
+      return "mongodb";
+    case "redis":
+    case "rediss":
+      return "redis";
+    case "sqlite":
+      return "sqlite";
+    default:
+      return null;
+  }
+}
+function parseConnectionString(url) {
+  const m = url.match(
+    /^(?<scheme>[a-z][a-z+]*):\/\/(?:[^@/]+(?::[^@]*)?@)?(?<host>[^:/?]+)(?::(?<port>\d+))?(?:\/(?<db>[^?#]*))?/i
+  );
+  if (!m || !m.groups) return null;
+  const engine = schemeToEngine(m.groups.scheme);
+  if (!engine) return null;
+  return {
+    host: m.groups.host,
+    port: m.groups.port ? Number(m.groups.port) : void 0,
+    database: m.groups.db ?? "",
+    engine,
+    engineVersion: "unknown"
+  };
+}
+async function readIfExists(filePath) {
+  try {
+    return await import_node_fs8.promises.readFile(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function findFirst(serviceDir, candidates) {
+  for (const rel of candidates) {
+    const abs = import_node_path9.default.join(serviceDir, rel);
+    const content = await readIfExists(abs);
+    if (content !== null) return abs;
+  }
+  return null;
+}
+function engineFromImage(image) {
+  const lower = image.toLowerCase();
+  const colon = lower.lastIndexOf(":");
+  const repo = colon >= 0 ? lower.slice(0, colon) : lower;
+  const tag = colon >= 0 ? lower.slice(colon + 1) : "latest";
+  const last = repo.split("/").pop() ?? repo;
+  let engine = null;
+  if (last.startsWith("postgres")) engine = "postgresql";
+  else if (last.startsWith("mysql") || last.startsWith("mariadb")) engine = "mysql";
+  else if (last.startsWith("mongo")) engine = "mongodb";
+  else if (last.startsWith("redis")) engine = "redis";
+  else if (last.startsWith("sqlite")) engine = "sqlite";
+  if (!engine) return null;
+  const versionMatch = tag.match(/^(\d+(?:\.\d+){0,2})/);
+  return {
+    engine,
+    engineVersion: versionMatch ? versionMatch[1] : "unknown"
+  };
+}
+
+// src/extract/databases/dotenv.ts
+var CONNECTION_KEYS = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DB_URL",
+  "POSTGRES_URL",
+  "POSTGRESQL_URL",
+  "MYSQL_URL",
+  "MONGODB_URI",
+  "MONGO_URL",
+  "MONGO_URI",
+  "REDIS_URL"
+]);
+function parseDotenvLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return null;
+  const eq = trimmed.indexOf("=");
+  if (eq < 0) return null;
+  const key = trimmed.slice(0, eq).trim();
+  let value = trimmed.slice(eq + 1).trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return { key, value };
+}
+async function parse2(serviceDir) {
+  const entries = await import_node_fs9.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const configs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const match = isConfigFile(entry.name);
+    if (!match.match || match.fileType !== "env") continue;
+    const filePath = import_node_path10.default.join(serviceDir, entry.name);
+    const content = await import_node_fs9.promises.readFile(filePath, "utf8");
+    for (const line of content.split("\n")) {
+      const parsed = parseDotenvLine(line);
+      if (!parsed) continue;
+      if (!CONNECTION_KEYS.has(parsed.key.toUpperCase())) continue;
+      const config = parseConnectionString(parsed.value);
+      if (!config) continue;
+      const key = `${config.engine}://${config.host}:${config.port ?? ""}/${config.database}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      configs.push({ ...config, sourceFile: filePath });
+    }
+  }
+  return configs;
+}
+var dotenvParser = { name: ".env", parse: parse2 };
+
+// src/extract/databases/prisma.ts
+init_cjs_shims();
+var import_node_path11 = __toESM(require("path"), 1);
+async function parse3(serviceDir) {
+  const schemaPath = import_node_path11.default.join(serviceDir, "prisma", "schema.prisma");
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  const block = content.match(/datasource\s+\w+\s*\{([^}]*)\}/s);
+  if (!block) return [];
+  const body = block[1] ?? "";
+  const providerMatch = body.match(/provider\s*=\s*"([^"]+)"/);
+  if (!providerMatch) return [];
+  const engine = schemeToEngine(providerMatch[1]);
+  if (!engine) return [];
+  const urlMatch = body.match(/url\s*=\s*"([^"]+)"/);
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: schemaPath }];
+  }
+  return [
+    {
+      host: `${engine}-prisma`,
+      database: "",
+      engine,
+      engineVersion: "unknown",
+      sourceFile: schemaPath
+    }
+  ];
+}
+var prismaParser = { name: "prisma", parse: parse3 };
+
+// src/extract/databases/drizzle.ts
+init_cjs_shims();
+var DIALECT_TO_ENGINE = {
+  postgresql: "postgresql",
+  postgres: "postgresql",
+  pg: "postgresql",
+  mysql: "mysql",
+  mysql2: "mysql",
+  sqlite: "sqlite",
+  "better-sqlite": "sqlite"
+};
+async function parse4(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "drizzle.config.ts",
+    "drizzle.config.js",
+    "drizzle.config.mjs"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const dialectMatch = content.match(/dialect\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (!dialectMatch) return [];
+  const engine = DIALECT_TO_ENGINE[dialectMatch[1].toLowerCase()] ?? schemeToEngine(dialectMatch[1]);
+  if (!engine) return [];
+  const urlMatch = content.match(
+    /(?:url|connectionString)\s*:\s*['"`]([a-z][a-z+]*:\/\/[^'"`]+)['"`]/i
+  );
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
+  const hostMatch = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (hostMatch) {
+    const portMatch = content.match(/port\s*:\s*(\d+)/);
+    const dbMatch = content.match(/database\s*:\s*['"`]([^'"`]+)['"`]/);
+    return [
+      {
+        host: hostMatch[1],
+        port: portMatch ? Number(portMatch[1]) : void 0,
+        database: dbMatch?.[1] ?? "",
+        engine,
+        engineVersion: "unknown",
+        sourceFile: filePath
+      }
+    ];
+  }
+  return [
+    { host: `${engine}-drizzle`, database: "", engine, engineVersion: "unknown", sourceFile: filePath }
+  ];
+}
+var drizzleParser = { name: "drizzle", parse: parse4 };
+
+// src/extract/databases/knex.ts
+init_cjs_shims();
+var CLIENT_TO_ENGINE = {
+  pg: "postgresql",
+  postgres: "postgresql",
+  postgresql: "postgresql",
+  mysql: "mysql",
+  mysql2: "mysql",
+  sqlite3: "sqlite",
+  "better-sqlite3": "sqlite"
+};
+async function parse5(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "knexfile.js",
+    "knexfile.ts",
+    "knexfile.cjs",
+    "knexfile.mjs"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const clientMatch = content.match(/client\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (!clientMatch) return [];
+  const engine = CLIENT_TO_ENGINE[clientMatch[1].toLowerCase()];
+  if (!engine) return [];
+  const urlMatch = content.match(
+    /connection\s*:\s*['"`]([a-z][a-z+]*:\/\/[^'"`]+)['"`]/i
+  );
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
+  const host = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
+  if (host) {
+    const port = content.match(/port\s*:\s*(\d+)/)?.[1];
+    const database = content.match(/database\s*:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? "";
+    return [
+      {
+        host,
+        port: port ? Number(port) : void 0,
+        database,
+        engine,
+        engineVersion: "unknown",
+        sourceFile: filePath
+      }
+    ];
+  }
+  return [{ host: `${engine}-knex`, database: "", engine, engineVersion: "unknown", sourceFile: filePath }];
+}
+var knexParser = { name: "knex", parse: parse5 };
+
+// src/extract/databases/ormconfig.ts
+init_cjs_shims();
+var import_node_path12 = __toESM(require("path"), 1);
+async function parse6(serviceDir) {
+  for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
+    const abs = import_node_path12.default.join(serviceDir, candidate);
+    if (!await exists(abs)) continue;
+    const raw = candidate.endsWith(".json") ? await readJson(abs) : await readYaml(abs);
+    const entries = Array.isArray(raw) ? raw : [raw];
+    const out = [];
+    for (const entry of entries) {
+      if (!entry?.type || !entry.host) continue;
+      const engine = schemeToEngine(entry.type);
+      if (!engine) continue;
+      out.push({
+        host: entry.host,
+        port: entry.port,
+        database: entry.database ?? "",
+        engine,
+        engineVersion: "unknown",
+        sourceFile: abs
+      });
+    }
+    if (out.length > 0) return out;
+  }
+  return [];
+}
+var ormconfigParser = { name: "ormconfig", parse: parse6 };
+
+// src/extract/databases/typeorm.ts
+init_cjs_shims();
+async function parse7(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "data-source.ts",
+    "data-source.js",
+    "src/data-source.ts",
+    "src/data-source.js"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const block = content.match(/new\s+DataSource\s*\(\s*\{([\s\S]*?)\}\s*\)/);
+  const body = block ? block[1] : content;
+  const typeMatch = body.match(/type\s*:\s*['"`]([^'"`]+)['"`]/);
+  const host = body.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
+  if (!typeMatch || !host) return [];
+  const engine = schemeToEngine(typeMatch[1]);
+  if (!engine) return [];
+  const port = body.match(/port\s*:\s*(\d+)/)?.[1];
+  const database = body.match(/database\s*:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? "";
+  return [
+    {
+      host,
+      port: port ? Number(port) : void 0,
+      database,
+      engine,
+      engineVersion: "unknown",
+      sourceFile: filePath
+    }
+  ];
+}
+var typeormParser = { name: "typeorm", parse: parse7 };
+
+// src/extract/databases/sequelize.ts
+init_cjs_shims();
+var import_node_path13 = __toESM(require("path"), 1);
+async function parse8(serviceDir) {
+  const configPath = import_node_path13.default.join(serviceDir, "config", "config.json");
+  if (!await exists(configPath)) return [];
+  const raw = await readJson(configPath);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of Object.values(raw)) {
+    if (!entry?.dialect || !entry.host) continue;
+    const engine = schemeToEngine(entry.dialect);
+    if (!engine) continue;
+    const key = `${engine}://${entry.host}:${entry.port ?? ""}/${entry.database ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      host: entry.host,
+      port: entry.port,
+      database: entry.database ?? "",
+      engine,
+      engineVersion: "unknown",
+      sourceFile: configPath
+    });
+  }
+  return out;
+}
+var sequelizeParser = { name: "sequelize", parse: parse8 };
+
+// src/extract/databases/docker-compose.ts
+init_cjs_shims();
+var import_node_path14 = __toESM(require("path"), 1);
+function portFromService(svc) {
+  for (const raw of svc.ports ?? []) {
+    const str = String(raw);
+    const last = str.split(":").pop();
+    const n = Number(last);
+    if (Number.isFinite(n) && n > 0) return n;
+  }
+  return void 0;
+}
+function databaseFromEnv(svc) {
+  const env = svc.environment;
+  const get = (key) => {
+    if (!env) return void 0;
+    if (Array.isArray(env)) {
+      for (const line of env) {
+        const [k, v] = line.split("=");
+        if (k === key) return v;
+      }
+      return void 0;
+    }
+    return env[key];
+  };
+  return get("POSTGRES_DB") ?? get("MYSQL_DATABASE") ?? get("MONGO_INITDB_DATABASE") ?? "";
+}
+async function parse9(serviceDir) {
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = import_node_path14.default.join(serviceDir, name);
+    if (!await exists(abs)) continue;
+    const raw = await readYaml(abs);
+    if (!raw?.services) return [];
+    const out = [];
+    for (const [serviceName, svc] of Object.entries(raw.services)) {
+      if (!svc.image) continue;
+      const meta = engineFromImage(svc.image);
+      if (!meta) continue;
+      out.push({
+        host: serviceName,
+        port: portFromService(svc),
+        database: databaseFromEnv(svc),
+        engine: meta.engine,
+        engineVersion: meta.engineVersion,
+        sourceFile: abs
+      });
+    }
+    return out;
+  }
+  return [];
+}
+var dockerComposeParser = { name: "docker-compose", parse: parse9 };
+
+// src/extract/databases/index.ts
+var DB_PARSERS = [
+  dbConfigYamlParser,
+  dotenvParser,
+  prismaParser,
+  drizzleParser,
+  knexParser,
+  ormconfigParser,
+  typeormParser,
+  sequelizeParser,
+  dockerComposeParser
+];
+function compatibleDriversFor(engine) {
+  return compatPairs().filter((p) => p.engine === engine).map((p) => ({ name: p.driver, minVersion: p.minDriverVersion }));
+}
+function toDatabaseNode(config) {
+  return {
+    id: (0, import_types7.databaseId)(config.host),
+    type: import_types7.NodeType.DatabaseNode,
+    name: config.database || config.host,
+    engine: config.engine,
+    engineVersion: config.engineVersion,
+    compatibleDrivers: compatibleDriversFor(config.engine),
+    host: config.host,
+    port: config.port
+  };
+}
+function attachIncompatibilities(service, configs) {
+  const deps = { ...service.pkg.dependencies ?? {}, ...service.pkg.devDependencies ?? {} };
+  const incompatibilities = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const config of configs) {
+    for (const pair of compatPairs()) {
+      if (pair.engine !== config.engine) continue;
+      const declaredVersion = cleanVersion(deps[pair.driver]);
+      if (!declaredVersion) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declaredVersion,
+        config.engine,
+        config.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        const key = `driver-engine|${pair.driver}@${declaredVersion}|${config.engine}@${config.engineVersion}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        incompatibilities.push({
+          kind: "driver-engine",
+          driver: pair.driver,
+          driverVersion: declaredVersion,
+          engine: config.engine,
+          engineVersion: config.engineVersion,
+          reason: result.reason
+        });
+      }
+    }
+  }
+  const serviceNodeEngine = service.node.nodeEngine ?? service.pkg.engines?.node;
+  for (const constraint of nodeEngineConstraints()) {
+    const declared = cleanVersion(deps[constraint.package]);
+    if (!declared) continue;
+    const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+    if (!result.compatible && result.reason) {
+      const key = `node-engine|${constraint.package}@${declared}|${serviceNodeEngine ?? ""}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "node-engine",
+        package: constraint.package,
+        packageVersion: declared,
+        requiredNodeVersion: result.requiredNodeVersion ?? constraint.minNodeVersion,
+        ...serviceNodeEngine ? { declaredNodeEngine: serviceNodeEngine } : {},
+        reason: result.reason
+      });
+    }
+  }
+  for (const conflict of packageConflicts()) {
+    const declared = cleanVersion(deps[conflict.package]);
+    if (!declared) continue;
+    const requiredVersion = cleanVersion(deps[conflict.requires.name]);
+    const result = checkPackageConflict(conflict, declared, requiredVersion);
+    if (!result.compatible && result.reason) {
+      const key = `package-conflict|${conflict.package}@${declared}|${conflict.requires.name}@${requiredVersion ?? "missing"}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "package-conflict",
+        package: conflict.package,
+        packageVersion: declared,
+        requires: conflict.requires,
+        ...requiredVersion ? { foundVersion: requiredVersion } : {},
+        reason: result.reason
+      });
+    }
+  }
+  for (const rule of deprecatedApis()) {
+    const declared = cleanVersion(deps[rule.package]);
+    if (declared === void 0) continue;
+    const result = checkDeprecatedApi(rule, declared);
+    if (!result.compatible && result.reason) {
+      const key = `deprecated-api|${rule.package}@${declared}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "deprecated-api",
+        package: rule.package,
+        packageVersion: declared,
+        reason: result.reason
+      });
+    }
+  }
+  if (incompatibilities.length > 0) service.node.incompatibilities = incompatibilities;
+}
+async function addDatabasesAndCompat(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const merged = /* @__PURE__ */ new Map();
+    for (const parser of DB_PARSERS) {
+      let configs;
+      try {
+        configs = await parser.parse(service.dir);
+      } catch (err) {
+        console.warn(
+          `[neat] ${parser.name} parser failed on ${service.node.name}: ${err.message}`
+        );
+        continue;
+      }
+      for (const config of configs) {
+        if (!config.host) continue;
+        if (!merged.has(config.host)) merged.set(config.host, config);
+      }
+    }
+    const allConfigs = [...merged.values()];
+    for (const config of allConfigs) {
+      const dbNode = toDatabaseNode(config);
+      if (!graph.hasNode(dbNode.id)) {
+        graph.addNode(dbNode.id, { ...dbNode, discoveredVia: "static" });
+        nodesAdded++;
+      } else {
+        const existing = graph.getNodeAttributes(dbNode.id);
+        const mergedDiscoveredVia = existing.discoveredVia === "otel" ? "merged" : "static";
+        graph.replaceNodeAttributes(dbNode.id, {
+          ...existing,
+          ...dbNode,
+          discoveredVia: mergedDiscoveredVia
+        });
+      }
+      const edge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, dbNode.id, import_types7.EdgeType.CONNECTS_TO),
+        source: service.node.id,
+        target: dbNode.id,
+        type: import_types7.EdgeType.CONNECTS_TO,
+        provenance: import_types7.Provenance.EXTRACTED,
+        ...config.sourceFile ? {
+          evidence: {
+            file: import_node_path15.default.relative(scanPath, config.sourceFile).split(import_node_path15.default.sep).join("/")
+          }
+        } : {}
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+    attachIncompatibilities(service, allConfigs);
+    if (graph.hasNode(service.node.id)) {
+      const current = graph.getNodeAttributes(service.node.id);
+      const updated = {
+        ...current,
+        ...service.node,
+        ...current.aliases ? { aliases: current.aliases } : {}
+      };
+      if (!service.node.incompatibilities || service.node.incompatibilities.length === 0) {
+        delete updated.incompatibilities;
+      }
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/configs.ts
+init_cjs_shims();
+var import_node_fs10 = require("fs");
+var import_node_path16 = __toESM(require("path"), 1);
+var import_types8 = require("@neat.is/types");
+async function walkConfigFiles(dir) {
+  const out = [];
+  async function walk(current) {
+    const entries = await import_node_fs10.promises.readdir(current, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = import_node_path16.default.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry.name)) await walk(full);
+      } else if (entry.isFile() && isConfigFile(entry.name).match) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function addConfigNodes(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const configFiles = await walkConfigFiles(service.dir);
+    for (const file of configFiles) {
+      const relPath = import_node_path16.default.relative(scanPath, file);
+      const node = {
+        id: (0, import_types8.configId)(relPath),
+        type: import_types8.NodeType.ConfigNode,
+        name: import_node_path16.default.basename(file),
+        path: relPath,
+        fileType: isConfigFile(import_node_path16.default.basename(file)).fileType
+      };
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+      const edge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, node.id, import_types8.EdgeType.CONFIGURED_BY),
+        source: service.node.id,
+        target: node.id,
+        type: import_types8.EdgeType.CONFIGURED_BY,
+        provenance: import_types8.Provenance.EXTRACTED,
+        evidence: { file: relPath.split(import_node_path16.default.sep).join("/") }
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/calls/index.ts
+init_cjs_shims();
+var import_types14 = require("@neat.is/types");
+
+// src/extract/calls/http.ts
+init_cjs_shims();
+var import_node_path18 = __toESM(require("path"), 1);
+var import_tree_sitter = __toESM(require("tree-sitter"), 1);
+var import_tree_sitter_javascript = __toESM(require("tree-sitter-javascript"), 1);
+var import_tree_sitter_python = __toESM(require("tree-sitter-python"), 1);
+var import_types9 = require("@neat.is/types");
+
+// src/extract/calls/shared.ts
+init_cjs_shims();
+var import_node_fs11 = require("fs");
+var import_node_path17 = __toESM(require("path"), 1);
+async function walkSourceFiles(dir) {
+  const out = [];
+  async function walk(current) {
+    const entries = await import_node_fs11.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      const full = import_node_path17.default.join(current, entry.name);
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry.name)) await walk(full);
+      } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path17.default.extname(entry.name))) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function loadSourceFiles(dir) {
+  const paths = await walkSourceFiles(dir);
+  const out = [];
+  for (const p of paths) {
+    try {
+      const content = await import_node_fs11.promises.readFile(p, "utf8");
+      out.push({ path: p, content });
+    } catch {
+    }
+  }
+  return out;
+}
+function lineOf(text, needle) {
+  const idx = text.indexOf(needle);
+  if (idx < 0) return 1;
+  return text.slice(0, idx).split("\n").length;
+}
+function snippet(text, line) {
+  const lines = text.split("\n");
+  return (lines[line - 1] ?? "").trim();
+}
+
+// src/extract/calls/http.ts
+var STRING_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set(["string_fragment", "string_content"]);
+function collectStringLiterals(node, out) {
+  if (STRING_LITERAL_NODE_TYPES.has(node.type)) out.push(node.text);
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child) collectStringLiterals(child, out);
+  }
+}
+function callsFromSource(source, parser, knownHosts) {
+  const tree = parser.parse(source);
+  const literals = [];
+  collectStringLiterals(tree.rootNode, literals);
+  const targets = /* @__PURE__ */ new Set();
+  for (const lit of literals) {
+    for (const host of knownHosts) {
+      if (lit.includes(`//${host}`) || lit.includes(`//${host}:`)) {
+        targets.add(host);
+      }
+    }
+  }
+  return targets;
+}
+function makeJsParser() {
+  const p = new import_tree_sitter.default();
+  p.setLanguage(import_tree_sitter_javascript.default);
+  return p;
+}
+function makePyParser() {
+  const p = new import_tree_sitter.default();
+  p.setLanguage(import_tree_sitter_python.default);
+  return p;
+}
+async function addHttpCallEdges(graph, services) {
+  const jsParser = makeJsParser();
+  const pyParser = makePyParser();
+  const knownHosts = /* @__PURE__ */ new Set();
+  const hostToNodeId = /* @__PURE__ */ new Map();
+  for (const service of services) {
+    knownHosts.add(import_node_path18.default.basename(service.dir));
+    knownHosts.add(service.pkg.name);
+    hostToNodeId.set(import_node_path18.default.basename(service.dir), service.node.id);
+    hostToNodeId.set(service.pkg.name, service.node.id);
+  }
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const seenTargets = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const parser = import_node_path18.default.extname(file.path) === ".py" ? pyParser : jsParser;
+      const targets = callsFromSource(file.content, parser, knownHosts);
+      for (const t of targets) {
+        const targetId = hostToNodeId.get(t);
+        if (!targetId || targetId === service.node.id) continue;
+        if (!seenTargets.has(targetId)) {
+          seenTargets.set(targetId, { file: file.path, host: t });
+        }
+      }
+    }
+    for (const [targetId, evidenceFile] of seenTargets) {
+      const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
+      const line = lineOf(fileContent, `//${evidenceFile.host}`);
+      const edge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, targetId, import_types9.EdgeType.CALLS),
+        source: service.node.id,
+        target: targetId,
+        type: import_types9.EdgeType.CALLS,
+        provenance: import_types9.Provenance.EXTRACTED,
+        evidence: {
+          file: import_node_path18.default.relative(service.dir, evidenceFile.file),
+          line,
+          snippet: snippet(fileContent, line)
+        }
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return edgesAdded;
+}
+
+// src/extract/calls/kafka.ts
+init_cjs_shims();
+var import_node_path19 = __toESM(require("path"), 1);
+var import_types10 = require("@neat.is/types");
+var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
+var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
+function findAll(re, text) {
+  re.lastIndex = 0;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ topic: m[1], index: m.index });
+  }
+  return out;
+}
+function kafkaEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const make = (topic, edgeType) => {
+    const key = `${edgeType}|${topic}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    const line = lineOf(file.content, topic);
+    out.push({
+      infraId: (0, import_types10.infraId)("kafka-topic", topic),
+      name: topic,
+      kind: "kafka-topic",
+      edgeType,
+      evidence: {
+        file: import_node_path19.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  for (const { topic } of findAll(PRODUCER_TOPIC_RE, file.content)) make(topic, "PUBLISHES_TO");
+  for (const { topic } of findAll(CONSUMER_TOPIC_RE, file.content)) make(topic, "CONSUMES_FROM");
+  return out;
+}
+
+// src/extract/calls/redis.ts
+init_cjs_shims();
+var import_node_path20 = __toESM(require("path"), 1);
+var import_types11 = require("@neat.is/types");
+var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
+function redisEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  REDIS_URL_RE.lastIndex = 0;
+  let m;
+  while ((m = REDIS_URL_RE.exec(file.content)) !== null) {
+    const host = m[1];
+    if (seen.has(host)) continue;
+    seen.add(host);
+    const line = lineOf(file.content, host);
+    out.push({
+      infraId: (0, import_types11.infraId)("redis", host),
+      name: host,
+      kind: "redis",
+      edgeType: "CALLS",
+      evidence: {
+        file: import_node_path20.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
+// src/extract/calls/aws.ts
+init_cjs_shims();
+var import_node_path21 = __toESM(require("path"), 1);
+var import_types12 = require("@neat.is/types");
+var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
+var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
+function hasMarker(text, markers) {
+  return markers.some((m) => text.includes(m));
+}
+function findAll2(re, text) {
+  re.lastIndex = 0;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ name: m[1], index: m.index });
+  }
+  return out;
+}
+function awsEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const make = (kind, name) => {
+    const key = `${kind}|${name}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    const line = lineOf(file.content, name);
+    out.push({
+      infraId: (0, import_types12.infraId)(kind, name),
+      name,
+      kind,
+      edgeType: "CALLS",
+      evidence: {
+        file: import_node_path21.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  if (hasMarker(file.content, ["S3Client", "PutObjectCommand", "GetObjectCommand", "DeleteObjectCommand"])) {
+    for (const { name } of findAll2(S3_BUCKET_RE, file.content)) make("s3-bucket", name);
+  }
+  if (hasMarker(file.content, [
+    "DynamoDBClient",
+    "DynamoDBDocumentClient",
+    "GetCommand",
+    "PutCommand",
+    "QueryCommand",
+    "UpdateCommand",
+    "DeleteCommand"
+  ])) {
+    for (const { name } of findAll2(DYNAMO_TABLE_RE, file.content)) make("dynamodb-table", name);
+  }
+  return out;
+}
+
+// src/extract/calls/grpc.ts
+init_cjs_shims();
+var import_node_path22 = __toESM(require("path"), 1);
+var import_types13 = require("@neat.is/types");
+var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
+function isLikelyAddress(value) {
+  if (!value) return false;
+  return /:\d{2,5}$/.test(value) || value.includes(".");
+}
+function grpcEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  GRPC_CLIENT_RE.lastIndex = 0;
+  let m;
+  while ((m = GRPC_CLIENT_RE.exec(file.content)) !== null) {
+    const symbol = m[1];
+    const addr = m[2]?.trim();
+    const name = isLikelyAddress(addr) ? addr : symbol;
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const line = lineOf(file.content, m[0]);
+    out.push({
+      infraId: (0, import_types13.infraId)("grpc-service", name),
+      name,
+      kind: "grpc-service",
+      edgeType: "CALLS",
+      evidence: {
+        file: import_node_path22.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
+// src/extract/calls/index.ts
+function edgeTypeFromEndpoint(ep) {
+  switch (ep.edgeType) {
+    case "PUBLISHES_TO":
+      return import_types14.EdgeType.PUBLISHES_TO;
+    case "CONSUMES_FROM":
+      return import_types14.EdgeType.CONSUMES_FROM;
+    default:
+      return import_types14.EdgeType.CALLS;
+  }
+}
+async function addExternalEndpointEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const endpoints = [];
+    for (const file of files) {
+      endpoints.push(...kafkaEndpointsFromFile(file, service.dir));
+      endpoints.push(...redisEndpointsFromFile(file, service.dir));
+      endpoints.push(...awsEndpointsFromFile(file, service.dir));
+      endpoints.push(...grpcEndpointsFromFile(file, service.dir));
+    }
+    if (endpoints.length === 0) continue;
+    const seenEdges = /* @__PURE__ */ new Set();
+    for (const ep of endpoints) {
+      if (!graph.hasNode(ep.infraId)) {
+        const node = {
+          id: ep.infraId,
+          type: import_types14.NodeType.InfraNode,
+          name: ep.name,
+          provider: ep.kind.startsWith("s3") || ep.kind.startsWith("dynamodb") ? "aws" : "self",
+          kind: ep.kind
+        };
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+      const edgeType = edgeTypeFromEndpoint(ep);
+      const edgeId = (0, import_types4.extractedEdgeId)(service.node.id, ep.infraId, edgeType);
+      if (seenEdges.has(edgeId)) continue;
+      seenEdges.add(edgeId);
+      if (!graph.hasEdge(edgeId)) {
+        const edge = {
+          id: edgeId,
+          source: service.node.id,
+          target: ep.infraId,
+          type: edgeType,
+          provenance: import_types14.Provenance.EXTRACTED,
+          evidence: ep.evidence
+        };
+        graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+async function addCallEdges(graph, services) {
+  const httpEdges = await addHttpCallEdges(graph, services);
+  const ext = await addExternalEndpointEdges(graph, services);
+  return {
+    nodesAdded: ext.nodesAdded,
+    edgesAdded: httpEdges + ext.edgesAdded
+  };
+}
+
+// src/extract/infra/index.ts
+init_cjs_shims();
+
+// src/extract/infra/docker-compose.ts
+init_cjs_shims();
+var import_node_path23 = __toESM(require("path"), 1);
+var import_types16 = require("@neat.is/types");
+
+// src/extract/infra/shared.ts
+init_cjs_shims();
+var import_types15 = require("@neat.is/types");
+function makeInfraNode(kind, name, provider = "self", extras) {
+  return {
+    id: (0, import_types15.infraId)(kind, name),
+    type: import_types15.NodeType.InfraNode,
+    name,
+    provider,
+    kind,
+    ...extras?.region ? { region: extras.region } : {}
+  };
+}
+function classifyImage(image) {
+  const lower = image.toLowerCase();
+  const repo = lower.split(":")[0];
+  const last = repo.split("/").pop() ?? repo;
+  if (last.startsWith("postgres")) return "postgres";
+  if (last.startsWith("mysql") || last.startsWith("mariadb")) return "mysql";
+  if (last.startsWith("mongo")) return "mongodb";
+  if (last.startsWith("redis")) return "redis";
+  if (last.startsWith("rabbitmq")) return "rabbitmq";
+  if (last.startsWith("kafka") || last.includes("kafka")) return "kafka";
+  if (last.startsWith("memcached")) return "memcached";
+  return "container";
+}
+
+// src/extract/infra/docker-compose.ts
+function dependsOnList(value) {
+  if (!value) return [];
+  if (Array.isArray(value)) return value;
+  return Object.keys(value);
+}
+function serviceNameToServiceNode(name, services) {
+  for (const s of services) {
+    if (s.node.name === name || import_node_path23.default.basename(s.dir) === name) return s.node.id;
+  }
+  return null;
+}
+async function addComposeInfra(graph, scanPath, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  let composePath = null;
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = import_node_path23.default.join(scanPath, name);
+    if (await exists(abs)) {
+      composePath = abs;
+      break;
+    }
+  }
+  if (!composePath) return { nodesAdded, edgesAdded };
+  const compose = await readYaml(composePath);
+  if (!compose?.services) return { nodesAdded, edgesAdded };
+  const evidenceFile = import_node_path23.default.relative(scanPath, composePath).split(import_node_path23.default.sep).join("/");
+  const composeNameToNodeId = /* @__PURE__ */ new Map();
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const matchedServiceId = serviceNameToServiceNode(composeName, services);
+    if (matchedServiceId) {
+      composeNameToNodeId.set(composeName, matchedServiceId);
+      continue;
+    }
+    const kind = svc.image ? classifyImage(svc.image) : "container";
+    const node = makeInfraNode(kind, composeName);
+    if (!graph.hasNode(node.id)) {
+      graph.addNode(node.id, node);
+      nodesAdded++;
+    }
+    composeNameToNodeId.set(composeName, node.id);
+  }
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const sourceId = composeNameToNodeId.get(composeName);
+    if (!sourceId) continue;
+    for (const dep of dependsOnList(svc.depends_on)) {
+      const targetId = composeNameToNodeId.get(dep);
+      if (!targetId) continue;
+      const edgeId = (0, import_types4.extractedEdgeId)(sourceId, targetId, import_types16.EdgeType.DEPENDS_ON);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: sourceId,
+        target: targetId,
+        type: import_types16.EdgeType.DEPENDS_ON,
+        provenance: import_types16.Provenance.EXTRACTED,
+        evidence: { file: evidenceFile }
+      };
+      graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/dockerfile.ts
+init_cjs_shims();
+var import_node_path24 = __toESM(require("path"), 1);
+var import_node_fs12 = require("fs");
+var import_types17 = require("@neat.is/types");
+function runtimeImage(content) {
+  const lines = content.split("\n");
+  let last = null;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (!/^from\s+/i.test(line)) continue;
+    const tokens = line.split(/\s+/);
+    const image = tokens[1];
+    if (!image || image.toLowerCase() === "scratch") continue;
+    last = image;
+  }
+  return last;
+}
+async function addDockerfileRuntimes(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const dockerfilePath = import_node_path24.default.join(service.dir, "Dockerfile");
+    if (!await exists(dockerfilePath)) continue;
+    const content = await import_node_fs12.promises.readFile(dockerfilePath, "utf8");
+    const image = runtimeImage(content);
+    if (!image) continue;
+    const node = makeInfraNode("container-image", image);
+    if (!graph.hasNode(node.id)) {
+      graph.addNode(node.id, node);
+      nodesAdded++;
+    }
+    const edgeId = (0, import_types4.extractedEdgeId)(service.node.id, node.id, import_types17.EdgeType.RUNS_ON);
+    if (!graph.hasEdge(edgeId)) {
+      const edge = {
+        id: edgeId,
+        source: service.node.id,
+        target: node.id,
+        type: import_types17.EdgeType.RUNS_ON,
+        provenance: import_types17.Provenance.EXTRACTED,
+        evidence: {
+          file: import_node_path24.default.relative(scanPath, dockerfilePath).split(import_node_path24.default.sep).join("/")
+        }
+      };
+      graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/terraform.ts
+init_cjs_shims();
+var import_node_fs13 = require("fs");
+var import_node_path25 = __toESM(require("path"), 1);
+var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+async function walkTfFiles(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await import_node_fs13.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
+      out.push(...await walkTfFiles(import_node_path25.default.join(start, entry.name), depth + 1, max));
+    } else if (entry.isFile() && entry.name.endsWith(".tf")) {
+      out.push(import_node_path25.default.join(start, entry.name));
+    }
+  }
+  return out;
+}
+async function addTerraformResources(graph, scanPath) {
+  let nodesAdded = 0;
+  const files = await walkTfFiles(scanPath);
+  for (const file of files) {
+    const content = await import_node_fs13.promises.readFile(file, "utf8");
+    RESOURCE_RE.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_RE.exec(content)) !== null) {
+      const kind = m[1];
+      const name = m[2];
+      const node = makeInfraNode(kind, name, "aws");
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded: 0 };
+}
+
+// src/extract/infra/k8s.ts
+init_cjs_shims();
+var import_node_fs14 = require("fs");
+var import_node_path26 = __toESM(require("path"), 1);
+var import_yaml3 = require("yaml");
+var K8S_KIND_TO_INFRA_KIND = {
+  Service: "k8s-service",
+  Deployment: "k8s-deployment",
+  StatefulSet: "k8s-statefulset",
+  DaemonSet: "k8s-daemonset",
+  CronJob: "k8s-cronjob",
+  Job: "k8s-job",
+  Ingress: "k8s-ingress"
+};
+async function walkYamlFiles2(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await import_node_fs14.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (IGNORED_DIRS.has(entry.name)) continue;
+      out.push(...await walkYamlFiles2(import_node_path26.default.join(start, entry.name), depth + 1, max));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path26.default.extname(entry.name))) {
+      out.push(import_node_path26.default.join(start, entry.name));
+    }
+  }
+  return out;
+}
+async function addK8sResources(graph, scanPath) {
+  let nodesAdded = 0;
+  const files = await walkYamlFiles2(scanPath);
+  for (const file of files) {
+    const content = await import_node_fs14.promises.readFile(file, "utf8");
+    let docs;
+    try {
+      docs = (0, import_yaml3.parseAllDocuments)(content).map((d) => d.toJSON());
+    } catch {
+      continue;
+    }
+    for (const doc of docs) {
+      if (!doc?.kind || !doc.metadata?.name) continue;
+      const infraKind = K8S_KIND_TO_INFRA_KIND[doc.kind];
+      if (!infraKind) continue;
+      const namespaced = doc.metadata.namespace ? `${doc.metadata.namespace}/${doc.metadata.name}` : doc.metadata.name;
+      const node = makeInfraNode(infraKind, namespaced, "kubernetes");
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded: 0 };
+}
+
+// src/extract/infra/index.ts
+async function addInfra(graph, scanPath, services) {
+  const compose = await addComposeInfra(graph, scanPath, services);
+  const dockerfile = await addDockerfileRuntimes(graph, services, scanPath);
+  const terraform = await addTerraformResources(graph, scanPath);
+  const k8s = await addK8sResources(graph, scanPath);
+  return {
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded
+  };
+}
+
+// src/extract/index.ts
+async function extractFromDirectory(graph, scanPath, opts = {}) {
+  await ensureCompatLoaded();
+  const services = await discoverServices(scanPath);
+  const phase1Nodes = addServiceNodes(graph, services);
+  await addServiceAliases(graph, scanPath, services);
+  const phase2 = await addDatabasesAndCompat(graph, services, scanPath);
+  const phase3 = await addConfigNodes(graph, services, scanPath);
+  const phase4 = await addCallEdges(graph, services);
+  const phase5 = await addInfra(graph, scanPath, services);
+  const frontiersPromoted = promoteFrontierNodes(graph);
+  if (opts.onPolicyTrigger) await opts.onPolicyTrigger(graph);
+  return {
+    nodesAdded: phase1Nodes + phase2.nodesAdded + phase3.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
+    edgesAdded: phase2.edgesAdded + phase3.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    frontiersPromoted
+  };
+}
+
+// src/persist.ts
+init_cjs_shims();
+var import_node_fs15 = require("fs");
+var import_node_path27 = __toESM(require("path"), 1);
+var SCHEMA_VERSION = 2;
+function migrateV1ToV2(payload) {
+  const nodes = payload.graph.nodes;
+  if (Array.isArray(nodes)) {
+    for (const node of nodes) {
+      if (node.attributes && "pgDriverVersion" in node.attributes) {
+        delete node.attributes.pgDriverVersion;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 2 };
+}
+async function ensureDir(filePath) {
+  await import_node_fs15.promises.mkdir(import_node_path27.default.dirname(filePath), { recursive: true });
+}
+async function saveGraphToDisk(graph, outPath) {
+  await ensureDir(outPath);
+  const payload = {
+    schemaVersion: SCHEMA_VERSION,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: graph.export()
+  };
+  const tmp = `${outPath}.tmp`;
+  await import_node_fs15.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await import_node_fs15.promises.rename(tmp, outPath);
+}
+async function loadGraphFromDisk(graph, outPath) {
+  let raw;
+  try {
+    raw = await import_node_fs15.promises.readFile(outPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  let payload = JSON.parse(raw);
+  if (payload.schemaVersion === 1) {
+    payload = migrateV1ToV2(payload);
+  }
+  if (payload.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
+    );
+  }
+  graph.clear();
+  graph.import(payload.graph);
+}
+function startPersistLoop(graph, outPath, intervalMs = 6e4) {
+  let stopped = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      await saveGraphToDisk(graph, outPath);
+    } catch (err) {
+      console.error("persist: periodic save failed", err);
+    }
+  };
+  const interval = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  const onSignal = (signal) => {
+    void (async () => {
+      try {
+        await saveGraphToDisk(graph, outPath);
+      } catch (err) {
+        console.error(`persist: ${signal} save failed`, err);
+      } finally {
+        process.exit(0);
+      }
+    })();
+  };
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+    process.off("SIGTERM", onSignal);
+    process.off("SIGINT", onSignal);
+  };
+}
+
+// src/api.ts
+init_cjs_shims();
+var import_fastify = __toESM(require("fastify"), 1);
+var import_cors = __toESM(require("@fastify/cors"), 1);
+var import_types18 = require("@neat.is/types");
+
+// src/diff.ts
+init_cjs_shims();
+var import_node_fs16 = require("fs");
+async function loadSnapshotForDiff(target) {
+  if (/^https?:\/\//i.test(target)) {
+    const res = await fetch(target);
+    if (!res.ok) {
+      throw new Error(`fetch ${target} failed: ${res.status} ${res.statusText}`);
+    }
+    return await res.json();
+  }
+  const raw = await import_node_fs16.promises.readFile(target, "utf8");
+  return JSON.parse(raw);
+}
+function indexEntries(entries) {
+  const m = /* @__PURE__ */ new Map();
+  if (!entries) return m;
+  for (const entry of entries) {
+    const id = entry.attributes?.id ?? entry.key;
+    if (!id) continue;
+    m.set(id, entry.attributes);
+  }
+  return m;
+}
+function computeGraphDiff(liveGraph, baseSnapshot, currentExportedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const baseNodes = indexEntries(baseSnapshot.graph?.nodes);
+  const baseEdges = indexEntries(baseSnapshot.graph?.edges);
+  const liveNodes = /* @__PURE__ */ new Map();
+  liveGraph.forEachNode((id, attrs) => liveNodes.set(id, attrs));
+  const liveEdges = /* @__PURE__ */ new Map();
+  liveGraph.forEachEdge((id, attrs) => liveEdges.set(id, attrs));
+  const result = {
+    base: { exportedAt: baseSnapshot.exportedAt },
+    current: { exportedAt: currentExportedAt },
+    added: { nodes: [], edges: [] },
+    removed: { nodes: [], edges: [] },
+    changed: { nodes: [], edges: [] }
+  };
+  for (const [id, after] of liveNodes) {
+    const before = baseNodes.get(id);
+    if (!before) {
+      result.added.nodes.push(after);
+    } else if (!shallowEqual(before, after)) {
+      result.changed.nodes.push({ id, before, after });
+    }
+  }
+  for (const [id, before] of baseNodes) {
+    if (!liveNodes.has(id)) result.removed.nodes.push(before);
+  }
+  for (const [id, after] of liveEdges) {
+    const before = baseEdges.get(id);
+    if (!before) {
+      result.added.edges.push(after);
+    } else if (!shallowEqual(before, after)) {
+      result.changed.edges.push({ id, before, after });
+    }
+  }
+  for (const [id, before] of baseEdges) {
+    if (!liveEdges.has(id)) result.removed.edges.push(before);
+  }
+  return result;
+}
+function shallowEqual(a, b) {
+  return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(value) {
+  return JSON.stringify(value, (_key, v) => {
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      return Object.keys(v).sort().reduce((acc, k) => {
+        acc[k] = v[k];
+        return acc;
+      }, {});
+    }
+    return v;
+  });
+}
+
+// src/projects.ts
+init_cjs_shims();
+var import_node_path28 = __toESM(require("path"), 1);
+function pathsForProject(project, baseDir) {
+  if (project === DEFAULT_PROJECT) {
+    return {
+      snapshotPath: import_node_path28.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path28.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path28.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path28.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path28.default.join(baseDir, "policy-violations.ndjson")
+    };
+  }
+  return {
+    snapshotPath: import_node_path28.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path28.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path28.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path28.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path28.default.join(baseDir, `policy-violations.${project}.ndjson`)
+  };
+}
+var Projects = class {
+  contexts = /* @__PURE__ */ new Map();
+  upsert(ctx) {
+    this.contexts.set(ctx.name, ctx);
+  }
+  set(name, init) {
+    const ctx = {
+      name,
+      graph: init.graph ?? getGraph(name),
+      scanPath: init.scanPath,
+      paths: init.paths,
+      searchIndex: init.searchIndex
+    };
+    this.contexts.set(name, ctx);
+    return ctx;
+  }
+  get(name) {
+    return this.contexts.get(name);
+  }
+  has(name) {
+    return this.contexts.has(name);
+  }
+  list() {
+    return [...this.contexts.keys()].sort();
+  }
+  attachSearchIndex(name, index) {
+    const ctx = this.contexts.get(name);
+    if (ctx) ctx.searchIndex = index;
+  }
+};
+
+// src/api.ts
+function serializeGraph(graph) {
+  const nodes = [];
+  graph.forEachNode((_id, attrs) => {
+    nodes.push(attrs);
+  });
+  const edges = [];
+  graph.forEachEdge((_id, attrs) => {
+    edges.push(attrs);
+  });
+  return { nodes, edges };
+}
+function projectFromReq(req) {
+  const params = req.params;
+  return params.project ?? DEFAULT_PROJECT;
+}
+function resolveProject(registry, req, reply) {
+  const name = projectFromReq(req);
+  const ctx = registry.get(name);
+  if (!ctx) {
+    void reply.code(404).send({ error: "project not found", project: name });
+    return null;
+  }
+  return ctx;
+}
+function buildLegacyRegistry(opts) {
+  if (opts.projects) return opts.projects;
+  if (!opts.graph) {
+    throw new Error("buildApi: either `projects` or `graph` must be provided");
+  }
+  const registry = new Projects();
+  const paths = pathsForProject(DEFAULT_PROJECT, "");
+  registry.set(DEFAULT_PROJECT, {
+    graph: opts.graph,
+    scanPath: opts.scanPath,
+    paths: {
+      snapshotPath: paths.snapshotPath,
+      errorsPath: opts.errorsPath ?? paths.errorsPath,
+      staleEventsPath: opts.staleEventsPath ?? paths.staleEventsPath,
+      embeddingsCachePath: paths.embeddingsCachePath,
+      policyViolationsPath: paths.policyViolationsPath
+    },
+    searchIndex: opts.searchIndex
+  });
+  return registry;
+}
+function registerRoutes(scope, ctx) {
+  const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
+  scope.get("/health", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    return {
+      uptime: Math.floor((Date.now() - startedAt) / 1e3),
+      project: proj.name,
+      nodeCount: proj.graph.order,
+      edgeCount: proj.graph.size,
+      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  });
+  scope.get("/graph", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    return serializeGraph(proj.graph);
+  });
+  scope.get(
+    "/graph/node/:id",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const { id } = req.params;
+      if (!proj.graph.hasNode(id)) {
+        return reply.code(404).send({ error: "node not found", id });
+      }
+      return proj.graph.getNodeAttributes(id);
+    }
+  );
+  scope.get(
+    "/graph/edges/:id",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const { id } = req.params;
+      if (!proj.graph.hasNode(id)) {
+        return reply.code(404).send({ error: "node not found", id });
+      }
+      const inbound = proj.graph.inboundEdges(id).map((e) => proj.graph.getEdgeAttributes(e));
+      const outbound = proj.graph.outboundEdges(id).map((e) => proj.graph.getEdgeAttributes(e));
+      return { inbound, outbound };
+    }
+  );
+  scope.get("/graph/node/:id/dependencies", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const { id } = req.params;
+    if (!proj.graph.hasNode(id)) {
+      return reply.code(404).send({ error: "node not found", id });
+    }
+    const depth = req.query.depth ? Number(req.query.depth) : TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH;
+    if (!Number.isFinite(depth) || depth < 1 || depth > TRANSITIVE_DEPENDENCIES_MAX_DEPTH) {
+      return reply.code(400).send({
+        error: `depth must be an integer in [1, ${TRANSITIVE_DEPENDENCIES_MAX_DEPTH}]`
+      });
+    }
+    return getTransitiveDependencies(proj.graph, id, depth);
+  });
+  scope.get("/incidents", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const epath = errorsPathFor(proj);
+    if (!epath) return [];
+    return readErrorEvents(epath);
+  });
+  scope.get("/incidents/stale", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const spath = staleEventsPathFor(proj);
+    if (!spath) return [];
+    const events = await readStaleEvents(spath);
+    const filtered = req.query.edgeType ? events.filter((e) => e.edgeType === req.query.edgeType) : events;
+    const ordered = [...filtered].reverse();
+    const limit = req.query.limit ? Number(req.query.limit) : 50;
+    return ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
+  });
+  scope.get(
+    "/incidents/:nodeId",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const { nodeId } = req.params;
+      if (!proj.graph.hasNode(nodeId)) {
+        return reply.code(404).send({ error: "node not found", id: nodeId });
+      }
+      const epath = errorsPathFor(proj);
+      if (!epath) return [];
+      const events = await readErrorEvents(epath);
+      return events.filter(
+        (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
+      );
+    }
+  );
+  scope.get("/traverse/root-cause/:nodeId", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    let errorEvent;
+    const epath = errorsPathFor(proj);
+    if (req.query.errorId && epath) {
+      const events = await readErrorEvents(epath);
+      errorEvent = events.find((e) => e.id === req.query.errorId);
+      if (!errorEvent) {
+        return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
+      }
+    }
+    const result = getRootCause(proj.graph, nodeId, errorEvent);
+    if (!result) return reply.code(404).send({ error: "no root cause found", id: nodeId });
+    return result;
+  });
+  scope.get("/traverse/blast-radius/:nodeId", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      return reply.code(404).send({ error: "node not found", id: nodeId });
+    }
+    const depth = req.query.depth ? Number(req.query.depth) : void 0;
+    if (depth !== void 0 && (!Number.isFinite(depth) || depth < 0)) {
+      return reply.code(400).send({ error: "depth must be a non-negative number" });
+    }
+    return getBlastRadius(proj.graph, nodeId, depth);
+  });
+  scope.get("/search", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const raw = (req.query.q ?? "").trim();
+    if (!raw) return reply.code(400).send({ error: "query parameter `q` is required" });
+    const limit = req.query.limit ? Number(req.query.limit) : void 0;
+    const safeLimit = limit !== void 0 && Number.isFinite(limit) && limit > 0 ? limit : void 0;
+    if (proj.searchIndex) {
+      const result = await proj.searchIndex.search(raw, safeLimit);
+      return {
+        query: result.query,
+        provider: result.provider,
+        matches: result.matches.map((m) => ({ ...m.node, score: m.score }))
+      };
+    }
+    const q = raw.toLowerCase();
+    const matches = [];
+    proj.graph.forEachNode((id, attrs) => {
+      const name = attrs.name ?? "";
+      if (id.toLowerCase().includes(q) || name.toLowerCase().includes(q)) {
+        matches.push({ ...attrs, score: 1 });
+      }
+    });
+    return {
+      query: q,
+      provider: "substring",
+      matches: matches.slice(0, safeLimit)
+    };
+  });
+  scope.get(
+    "/graph/diff",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply);
+      if (!proj) return;
+      const against = req.query.against;
+      if (!against) {
+        return reply.code(400).send({ error: "query parameter `against` is required" });
+      }
+      try {
+        const snapshot = await loadSnapshotForDiff(against);
+        return computeGraphDiff(proj.graph, snapshot);
+      } catch (err) {
+        return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
+      }
+    }
+  );
+  scope.post("/graph/scan", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    if (!proj.scanPath) {
+      return reply.code(409).send({ error: "scan path not configured for this project", project: proj.name });
+    }
+    const result = await extractFromDirectory(proj.graph, proj.scanPath);
+    return {
+      project: proj.name,
+      scanned: proj.scanPath,
+      nodesAdded: result.nodesAdded,
+      edgesAdded: result.edgesAdded,
+      nodeCount: proj.graph.order,
+      edgeCount: proj.graph.size
+    };
+  });
+  scope.get("/policies", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const policyPath = ctx.policyFilePathFor(proj);
+    if (!policyPath) {
+      return { version: 1, policies: [] };
+    }
+    try {
+      const policies = await loadPolicyFile(policyPath);
+      return { version: 1, policies };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "policy.json failed to parse",
+        details: err.message
+      });
+    }
+  });
+  scope.get("/policies/violations", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
+    let violations = await log.readAll();
+    if (req.query.severity) {
+      const sev = import_types18.PolicySeveritySchema.safeParse(req.query.severity);
+      if (!sev.success) {
+        return reply.code(400).send({
+          error: "invalid severity",
+          details: sev.error.format()
+        });
+      }
+      violations = violations.filter((v) => v.severity === sev.data);
+    }
+    if (req.query.policyId) {
+      violations = violations.filter((v) => v.policyId === req.query.policyId);
+    }
+    return violations;
+  });
+  scope.post("/policies/check", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply);
+    if (!proj) return;
+    const parsed = import_types18.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    if (!parsed.success) {
+      return reply.code(400).send({
+        error: "invalid /policies/check body",
+        details: parsed.error.format()
+      });
+    }
+    const policyPath = ctx.policyFilePathFor(proj);
+    let policies = [];
+    if (policyPath) {
+      try {
+        policies = await loadPolicyFile(policyPath);
+      } catch (err) {
+        return reply.code(400).send({
+          error: "policy.json failed to parse",
+          details: err.message
+        });
+      }
+    }
+    const evalCtx = { now: () => Date.now() };
+    if (!parsed.data.hypotheticalAction) {
+      const violations2 = evaluateAllPolicies(proj.graph, policies, evalCtx);
+      const blocking2 = violations2.filter((v) => v.onViolation === "block");
+      return { allowed: blocking2.length === 0, violations: violations2 };
+    }
+    const violations = evaluateAllPolicies(proj.graph, policies, evalCtx);
+    const blocking = violations.filter((v) => v.onViolation === "block");
+    return {
+      allowed: blocking.length === 0,
+      hypotheticalAction: parsed.data.hypotheticalAction,
+      violations
+    };
+  });
+}
+async function buildApi(opts) {
+  const app = (0, import_fastify.default)({ logger: false });
+  await app.register(import_cors.default, { origin: true });
+  const startedAt = opts.startedAt ?? Date.now();
+  const registry = buildLegacyRegistry(opts);
+  const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
+  const legacyStaleExplicit = !opts.projects && opts.staleEventsPath !== void 0;
+  const errorsPathFor = (proj) => {
+    if (proj.name === DEFAULT_PROJECT && !opts.projects) {
+      return legacyErrorsExplicit ? opts.errorsPath : void 0;
+    }
+    return proj.paths.errorsPath;
+  };
+  const staleEventsPathFor = (proj) => {
+    if (proj.name === DEFAULT_PROJECT && !opts.projects) {
+      return legacyStaleExplicit ? opts.staleEventsPath : void 0;
+    }
+    return proj.paths.staleEventsPath;
+  };
+  const policyFilePathFor = (proj) => {
+    if (!proj.scanPath) return void 0;
+    return `${proj.scanPath}/policy.json`;
+  };
+  const routeCtx = {
+    registry,
+    startedAt,
+    errorsPathFor,
+    staleEventsPathFor,
+    policyFilePathFor
+  };
+  app.get("/projects", async () => ({
+    projects: registry.list().map((name) => {
+      const proj = registry.get(name);
+      return {
+        name,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size,
+        scanPath: proj.scanPath
+      };
+    })
+  }));
+  registerRoutes(app, routeCtx);
+  await app.register(
+    async (scope) => {
+      registerRoutes(scope, routeCtx);
+    },
+    { prefix: "/projects/:project" }
+  );
+  return app;
+}
+
+// src/index.ts
+init_otel();
+init_otel_grpc();
+
+// src/daemon.ts
+init_cjs_shims();
+var import_node_fs18 = require("fs");
+var import_node_path32 = __toESM(require("path"), 1);
+
+// src/registry.ts
+init_cjs_shims();
+var import_node_fs17 = require("fs");
+var import_node_os2 = __toESM(require("os"), 1);
+var import_node_path31 = __toESM(require("path"), 1);
+var import_types19 = require("@neat.is/types");
+var LOCK_TIMEOUT_MS = 5e3;
+var LOCK_RETRY_MS = 50;
+function neatHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path31.default.resolve(override);
+  return import_node_path31.default.join(import_node_os2.default.homedir(), ".neat");
+}
+function registryPath() {
+  return import_node_path31.default.join(neatHome(), "projects.json");
+}
+function registryLockPath() {
+  return import_node_path31.default.join(neatHome(), "projects.json.lock");
+}
+async function normalizeProjectPath(input) {
+  const resolved = import_node_path31.default.resolve(input);
+  try {
+    return await import_node_fs17.promises.realpath(resolved);
+  } catch {
+    return resolved;
+  }
+}
+async function writeAtomically(target, contents) {
+  await import_node_fs17.promises.mkdir(import_node_path31.default.dirname(target), { recursive: true });
+  const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await import_node_fs17.promises.open(tmp, "w");
+  try {
+    await fd.writeFile(contents, "utf8");
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await import_node_fs17.promises.rename(tmp, target);
+}
+async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  await import_node_fs17.promises.mkdir(import_node_path31.default.dirname(lockPath), { recursive: true });
+  while (true) {
+    try {
+      const fd = await import_node_fs17.promises.open(lockPath, "wx");
+      await fd.close();
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `neat registry: timed out after ${timeoutMs}ms waiting for ${lockPath}. Another neat process is holding the lock; if no such process exists, remove the file by hand.`
+        );
+      }
+      await new Promise((r) => setTimeout(r, LOCK_RETRY_MS));
+    }
+  }
+}
+async function releaseLock(lockPath) {
+  await import_node_fs17.promises.unlink(lockPath).catch(() => {
+  });
+}
+async function withLock(fn) {
+  const lock = registryLockPath();
+  await acquireLock(lock);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock(lock);
+  }
+}
+async function readRegistry() {
+  const file = registryPath();
+  let raw;
+  try {
+    raw = await import_node_fs17.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: 1, projects: [] };
+    }
+    throw err;
+  }
+  const parsed = JSON.parse(raw);
+  return import_types19.RegistryFileSchema.parse(parsed);
+}
+async function writeRegistry(reg) {
+  const validated = import_types19.RegistryFileSchema.parse(reg);
+  await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
+}
+var ProjectNameCollisionError = class extends Error {
+  projectName;
+  constructor(name) {
+    super(`neat registry: a project named "${name}" is already registered`);
+    this.name = "ProjectNameCollisionError";
+    this.projectName = name;
+  }
+};
+async function addProject(opts) {
+  const resolvedPath = await normalizeProjectPath(opts.path);
+  return withLock(async () => {
+    const reg = await readRegistry();
+    const byName = reg.projects.find((p) => p.name === opts.name);
+    const byPath = reg.projects.find((p) => p.path === resolvedPath);
+    if (byName && byName.path !== resolvedPath) {
+      throw new ProjectNameCollisionError(opts.name);
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (byName && byName.path === resolvedPath) {
+      byName.lastSeenAt = now;
+      if (opts.languages) byName.languages = opts.languages;
+      if (opts.status) byName.status = opts.status;
+      await writeRegistry(reg);
+      return byName;
+    }
+    if (byPath && byPath.name !== opts.name) {
+      throw new ProjectNameCollisionError(byPath.name);
+    }
+    const entry = {
+      name: opts.name,
+      path: resolvedPath,
+      registeredAt: now,
+      languages: opts.languages ?? [],
+      status: opts.status ?? "active"
+    };
+    reg.projects.push(entry);
+    await writeRegistry(reg);
+    return entry;
+  });
+}
+async function getProject(name) {
+  const reg = await readRegistry();
+  return reg.projects.find((p) => p.name === name);
+}
+async function listProjects() {
+  const reg = await readRegistry();
+  return reg.projects;
+}
+async function setStatus(name, status2) {
+  return withLock(async () => {
+    const reg = await readRegistry();
+    const entry = reg.projects.find((p) => p.name === name);
+    if (!entry) throw new Error(`neat registry: no project named "${name}"`);
+    entry.status = status2;
+    await writeRegistry(reg);
+    return entry;
+  });
+}
+async function touchLastSeen(name, at = (/* @__PURE__ */ new Date()).toISOString()) {
+  await withLock(async () => {
+    const reg = await readRegistry();
+    const entry = reg.projects.find((p) => p.name === name);
+    if (!entry) return;
+    entry.lastSeenAt = at;
+    await writeRegistry(reg);
+  });
+}
+async function removeProject(name) {
+  return withLock(async () => {
+    const reg = await readRegistry();
+    const idx = reg.projects.findIndex((p) => p.name === name);
+    if (idx < 0) return void 0;
+    const [removed] = reg.projects.splice(idx, 1);
+    await writeRegistry(reg);
+    return removed;
+  });
+}
+
+// src/daemon.ts
+function neatHomeFor(opts) {
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path32.default.resolve(opts.neatHome);
+  const env = process.env.NEAT_HOME;
+  if (env && env.length > 0) return import_node_path32.default.resolve(env);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return import_node_path32.default.join(home, ".neat");
+}
+function routeSpanToProject(serviceName, projects) {
+  if (!serviceName) return DEFAULT_PROJECT;
+  for (const entry of projects) {
+    if (entry.status !== "active") continue;
+    if (entry.languages.length === 0) {
+    }
+    if (entry.name === serviceName) return entry.name;
+  }
+  return DEFAULT_PROJECT;
+}
+async function bootstrapProject(entry) {
+  try {
+    const stat = await import_node_fs18.promises.stat(entry.path);
+    if (!stat.isDirectory()) {
+      throw new Error(`registered path ${entry.path} is not a directory`);
+    }
+  } catch (err) {
+    await setStatus(entry.name, "broken").catch(() => {
+    });
+    return {
+      entry,
+      // Empty graph is fine — `slots` keeps the entry visible in `status`
+      // output; nothing routes to it because it's not 'active'.
+      graph: getGraph(`__broken__:${entry.name}`),
+      outPath: "",
+      stopPersist: () => {
+      },
+      status: "broken",
+      errorReason: err.message
+    };
+  }
+  resetGraph(entry.name);
+  const graph = getGraph(entry.name);
+  const outPath = pathsForProject(
+    entry.name,
+    import_node_path32.default.join(entry.path, "neat-out")
+  ).snapshotPath;
+  await loadGraphFromDisk(graph, outPath);
+  await extractFromDirectory(graph, entry.path);
+  const stopPersist = startPersistLoop(graph, outPath);
+  await touchLastSeen(entry.name).catch(() => {
+  });
+  return {
+    entry,
+    graph,
+    outPath,
+    stopPersist,
+    status: "active"
+  };
+}
+async function startDaemon(opts = {}) {
+  const home = neatHomeFor(opts);
+  const regPath = registryPath();
+  try {
+    await import_node_fs18.promises.access(regPath);
+  } catch {
+    throw new Error(
+      `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
+    );
+  }
+  const pidPath = import_node_path32.default.join(home, "neatd.pid");
+  await writeAtomically(pidPath, `${process.pid}
+`);
+  const slots = /* @__PURE__ */ new Map();
+  async function loadAll() {
+    const projects = await listProjects();
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry of projects) {
+      seen.add(entry.name);
+      if (slots.has(entry.name)) continue;
+      try {
+        const slot = await bootstrapProject(entry);
+        slots.set(entry.name, slot);
+        if (slot.status === "broken") {
+          console.warn(`neatd: project "${entry.name}" broken \u2014 ${slot.errorReason}`);
+        } else {
+          console.log(`neatd: project "${entry.name}" active (${entry.path})`);
+        }
+      } catch (err) {
+        console.warn(
+          `neatd: project "${entry.name}" failed to bootstrap \u2014 ${err.message}`
+        );
+        await setStatus(entry.name, "broken").catch(() => {
+        });
+      }
+    }
+    for (const [name, slot] of [...slots.entries()]) {
+      if (seen.has(name)) continue;
+      try {
+        slot.stopPersist();
+      } catch {
+      }
+      slots.delete(name);
+      console.log(`neatd: project "${name}" removed from registry \u2014 stopped`);
+    }
+  }
+  await loadAll();
+  let reloading = null;
+  const reload = async () => {
+    if (reloading) return reloading;
+    reloading = (async () => {
+      try {
+        await loadAll();
+      } finally {
+        reloading = null;
+      }
+    })();
+    return reloading;
+  };
+  const sighupHandler = () => {
+    void reload().catch((err) => {
+      console.warn(`neatd: SIGHUP reload failed \u2014 ${err.message}`);
+    });
+  };
+  process.on("SIGHUP", sighupHandler);
+  let stopped = false;
+  const stop = async () => {
+    if (stopped) return;
+    stopped = true;
+    process.off("SIGHUP", sighupHandler);
+    for (const slot of slots.values()) {
+      try {
+        slot.stopPersist();
+      } catch {
+      }
+    }
+    await import_node_fs18.promises.unlink(pidPath).catch(() => {
+    });
+  };
+  return { slots, reload, stop, pidPath };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ProjectNameCollisionError,
+  addProject,
+  buildApi,
+  buildOtelReceiver,
+  checkCompatibility,
+  compatPairs,
+  computeGraphDiff,
+  confidenceForEdge,
+  extractFromDirectory,
+  getBlastRadius,
+  getGraph,
+  getProject,
+  getRootCause,
+  handleSpan,
+  listProjects,
+  loadGraphFromDisk,
+  loadSnapshotForDiff,
+  logSpanHandler,
+  makeSpanHandler,
+  markStaleEdges,
+  normalizeProjectPath,
+  parseOtlpRequest,
+  readErrorEvents,
+  readRegistry,
+  readStaleEvents,
+  registryLockPath,
+  registryPath,
+  removeProject,
+  resetGraph,
+  routeSpanToProject,
+  saveGraphToDisk,
+  setStatus,
+  startDaemon,
+  startOtelGrpcReceiver,
+  startPersistLoop,
+  startStalenessLoop,
+  stitchTrace,
+  thresholdForEdgeType,
+  touchLastSeen,
+  writeAtomically
+});
+//# sourceMappingURL=index.cjs.map