@neat.is/core 0.2.5

package/dist/neatd.cjs

@@ -0,0 +1,3070 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/neatd.ts
+var import_node_fs18 = require("fs");
+var import_node_path31 = __toESM(require("path"), 1);
+
+// src/daemon.ts
+var import_node_fs17 = require("fs");
+var import_node_path30 = __toESM(require("path"), 1);
+
+// src/graph.ts
+var import_graphology = __toESM(require("graphology"), 1);
+var MultiDirectedGraph = import_graphology.default.MultiDirectedGraph;
+var DEFAULT_PROJECT = "default";
+var graphs = /* @__PURE__ */ new Map();
+function makeGraph() {
+  return new MultiDirectedGraph({ allowSelfLoops: false });
+}
+function getGraph(project = DEFAULT_PROJECT) {
+  let g = graphs.get(project);
+  if (!g) {
+    g = makeGraph();
+    graphs.set(project, g);
+  }
+  return g;
+}
+function resetGraph(project) {
+  if (project === void 0) {
+    graphs.clear();
+    return;
+  }
+  graphs.delete(project);
+}
+
+// src/ingest.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = __toESM(require("path"), 1);
+
+// src/policy.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = __toESM(require("path"), 1);
+var import_types2 = require("@neat.is/types");
+
+// src/compat.ts
+var import_node_fs = require("fs");
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path = __toESM(require("path"), 1);
+var import_semver = __toESM(require("semver"), 1);
+
+// compat.json
+var compat_default = {
+  pairs: [
+    {
+      kind: "driver-engine",
+      driver: "pg",
+      engine: "postgresql",
+      minDriverVersion: "8.0.0",
+      minEngineVersion: "14",
+      reason: "PostgreSQL 14+ requires scram-sha-256 auth by default; pg < 8.0.0 only speaks md5."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mysql2",
+      engine: "mysql",
+      minDriverVersion: "3.0.0",
+      minEngineVersion: "8",
+      reason: "MySQL 8 defaults to caching_sha2_password; mysql2 < 3.0.0 doesn't negotiate it."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mongoose",
+      engine: "mongodb",
+      minDriverVersion: "7.0.0",
+      minEngineVersion: "7",
+      reason: "MongoDB 7 drops legacy wire-protocol opcodes that mongoose < 7.0.0 still emits."
+    },
+    {
+      kind: "driver-engine",
+      driver: "psycopg2",
+      engine: "postgresql",
+      minDriverVersion: "2.9.0",
+      minEngineVersion: "14",
+      reason: "PostgreSQL 14+ requires scram-sha-256 auth by default; psycopg2 < 2.9.0 only speaks md5."
+    },
+    {
+      kind: "driver-engine",
+      driver: "pymongo",
+      engine: "mongodb",
+      minDriverVersion: "4.0.0",
+      minEngineVersion: "7",
+      reason: "MongoDB 7 drops legacy wire-protocol opcodes that pymongo < 4.0.0 still emits."
+    },
+    {
+      kind: "driver-engine",
+      driver: "mysql-connector-python",
+      engine: "mysql",
+      minDriverVersion: "8.0.0",
+      minEngineVersion: "8",
+      reason: "MySQL 8 defaults to caching_sha2_password; mysql-connector-python < 8.0.0 doesn't negotiate it."
+    }
+  ],
+  nodeEngineConstraints: [
+    {
+      kind: "node-engine",
+      package: "vitest",
+      packageMinVersion: "2.0.0",
+      minNodeVersion: "18.0.0",
+      reason: "vitest >= 2.0 drops Node 16 support; requires Node 18+."
+    },
+    {
+      kind: "node-engine",
+      package: "next",
+      packageMinVersion: "14.0.0",
+      minNodeVersion: "18.17.0",
+      reason: "Next 14+ requires Node 18.17+ (uses APIs introduced in that minor)."
+    },
+    {
+      kind: "node-engine",
+      package: "@modelcontextprotocol/sdk",
+      packageMinVersion: "1.0.0",
+      minNodeVersion: "18.0.0",
+      reason: "@modelcontextprotocol/sdk >= 1 requires Node 18+ (web-streams polyfill removed)."
+    }
+  ],
+  packageConflicts: [
+    {
+      kind: "package-conflict",
+      package: "@tanstack/react-query",
+      packageMinVersion: "5.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.0.0"
+      },
+      reason: "@tanstack/react-query 5+ uses useSyncExternalStore \u2014 only available in React 18+."
+    },
+    {
+      kind: "package-conflict",
+      package: "react-router-dom",
+      packageMinVersion: "7.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.0.0"
+      },
+      reason: "react-router-dom 7+ requires React 18+."
+    },
+    {
+      kind: "package-conflict",
+      package: "next",
+      packageMinVersion: "14.0.0",
+      requires: {
+        name: "react",
+        minVersion: "18.2.0"
+      },
+      reason: "Next.js 14+ requires React 18.2+."
+    }
+  ],
+  deprecatedApis: [
+    {
+      kind: "deprecated-api",
+      package: "request",
+      packageMaxVersion: "2.88.2",
+      reason: "request is deprecated; use undici, node-fetch, or axios instead."
+    },
+    {
+      kind: "deprecated-api",
+      package: "node-uuid",
+      reason: "node-uuid is deprecated; use the `uuid` package."
+    }
+  ]
+};
+
+// src/compat.ts
+var bundledMatrix = compat_default;
+var mergedMatrix = null;
+var remoteLoadAttempted = false;
+var REMOTE_CACHE_DIR = import_node_path.default.join(import_node_os.default.homedir(), ".neat");
+var REMOTE_CACHE_PATH = import_node_path.default.join(REMOTE_CACHE_DIR, "compat-cache.json");
+var REMOTE_TTL_MS = 24 * 60 * 60 * 1e3;
+function engineMeetsThreshold(engineVersion, threshold) {
+  const e = parseInt(engineVersion, 10);
+  const t = parseInt(threshold, 10);
+  if (Number.isFinite(e) && Number.isFinite(t)) return e >= t;
+  const ec = import_semver.default.coerce(engineVersion);
+  const tc = import_semver.default.coerce(threshold);
+  if (ec && tc) return import_semver.default.gte(ec, tc);
+  return false;
+}
+function checkCompatibility(driver, driverVersion, engine, engineVersion) {
+  const matrix = currentMatrix();
+  const pair = matrix.pairs.find((p) => p.driver === driver && p.engine === engine);
+  if (!pair) return { compatible: true };
+  if (pair.minEngineVersion && !engineMeetsThreshold(engineVersion, pair.minEngineVersion)) {
+    return { compatible: true };
+  }
+  const driverCoerced = import_semver.default.coerce(driverVersion);
+  if (!driverCoerced) return { compatible: true };
+  if (import_semver.default.lt(driverCoerced, pair.minDriverVersion)) {
+    return {
+      compatible: false,
+      reason: pair.reason,
+      minDriverVersion: pair.minDriverVersion
+    };
+  }
+  return { compatible: true };
+}
+function rangeAdmitsVersion(serviceNodeRange, requiredNodeVersion) {
+  try {
+    const required = import_semver.default.coerce(requiredNodeVersion);
+    if (!required) return true;
+    return import_semver.default.subset(serviceNodeRange, `>=${required.version}`, {
+      includePrerelease: false
+    });
+  } catch {
+    return true;
+  }
+}
+function checkNodeEngineConstraint(constraint, declaredPackageVersion, serviceNodeRange) {
+  if (constraint.packageMinVersion && declaredPackageVersion) {
+    const v = import_semver.default.coerce(declaredPackageVersion);
+    if (v && import_semver.default.lt(v, constraint.packageMinVersion)) {
+      return { compatible: true };
+    }
+  }
+  if (!serviceNodeRange) {
+    return { compatible: true };
+  }
+  if (rangeAdmitsVersion(serviceNodeRange, constraint.minNodeVersion)) {
+    return { compatible: true };
+  }
+  return {
+    compatible: false,
+    reason: constraint.reason,
+    requiredNodeVersion: constraint.minNodeVersion
+  };
+}
+function checkPackageConflict(conflict, declaredPackageVersion, declaredRequiredVersion) {
+  if (!declaredPackageVersion) return { compatible: true };
+  if (conflict.packageMinVersion) {
+    const v = import_semver.default.coerce(declaredPackageVersion);
+    if (v && import_semver.default.lt(v, conflict.packageMinVersion)) {
+      return { compatible: true };
+    }
+  }
+  if (!declaredRequiredVersion) {
+    return {
+      compatible: false,
+      reason: conflict.reason,
+      requires: conflict.requires
+    };
+  }
+  const requiredCoerced = import_semver.default.coerce(declaredRequiredVersion);
+  if (!requiredCoerced) return { compatible: true };
+  if (import_semver.default.lt(requiredCoerced, conflict.requires.minVersion)) {
+    return {
+      compatible: false,
+      reason: conflict.reason,
+      requires: conflict.requires,
+      foundVersion: declaredRequiredVersion
+    };
+  }
+  return { compatible: true };
+}
+function checkDeprecatedApi(rule, declaredVersion) {
+  if (declaredVersion === void 0) return { compatible: true };
+  if (rule.packageMaxVersion) {
+    const v = import_semver.default.coerce(declaredVersion);
+    const max = import_semver.default.coerce(rule.packageMaxVersion);
+    if (v && max && import_semver.default.gt(v, max)) return { compatible: true };
+  }
+  return { compatible: false, reason: rule.reason };
+}
+function currentMatrix() {
+  return mergedMatrix ?? bundledMatrix;
+}
+function mergeMatrices(a, b) {
+  return {
+    pairs: [...a.pairs, ...b.pairs ?? []],
+    nodeEngineConstraints: [
+      ...a.nodeEngineConstraints ?? [],
+      ...b.nodeEngineConstraints ?? []
+    ],
+    packageConflicts: [...a.packageConflicts ?? [], ...b.packageConflicts ?? []],
+    deprecatedApis: [...a.deprecatedApis ?? [], ...b.deprecatedApis ?? []]
+  };
+}
+async function readRemoteCache(url) {
+  try {
+    const raw = await import_node_fs.promises.readFile(REMOTE_CACHE_PATH, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.url !== url) return null;
+    const age = Date.now() - new Date(parsed.fetchedAt).getTime();
+    if (age > REMOTE_TTL_MS) return null;
+    return parsed.matrix;
+  } catch {
+    return null;
+  }
+}
+async function writeRemoteCache(url, matrix) {
+  const file = {
+    fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    url,
+    matrix
+  };
+  try {
+    await import_node_fs.promises.mkdir(REMOTE_CACHE_DIR, { recursive: true });
+    await import_node_fs.promises.writeFile(REMOTE_CACHE_PATH, JSON.stringify(file), "utf8");
+  } catch (err) {
+    console.warn(`[neat] failed to cache compat matrix: ${err.message}`);
+  }
+}
+async function ensureCompatLoaded() {
+  if (mergedMatrix) return mergedMatrix;
+  if (remoteLoadAttempted) {
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+  remoteLoadAttempted = true;
+  const url = process.env.NEAT_COMPAT_URL;
+  if (!url) {
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+  const cached = await readRemoteCache(url);
+  if (cached) {
+    mergedMatrix = mergeMatrices(bundledMatrix, cached);
+    return mergedMatrix;
+  }
+  try {
+    const res = await fetch(url);
+    if (!res.ok) throw new Error(`${res.status} ${res.statusText}`);
+    const remote = await res.json();
+    await writeRemoteCache(url, remote);
+    mergedMatrix = mergeMatrices(bundledMatrix, remote);
+    return mergedMatrix;
+  } catch (err) {
+    console.warn(
+      `[neat] NEAT_COMPAT_URL fetch failed (${err.message}); using bundled matrix only`
+    );
+    mergedMatrix = bundledMatrix;
+    return mergedMatrix;
+  }
+}
+function compatPairs() {
+  return currentMatrix().pairs;
+}
+function nodeEngineConstraints() {
+  return currentMatrix().nodeEngineConstraints ?? [];
+}
+function packageConflicts() {
+  return currentMatrix().packageConflicts ?? [];
+}
+function deprecatedApis() {
+  return currentMatrix().deprecatedApis ?? [];
+}
+
+// src/traverse.ts
+var import_types = require("@neat.is/types");
+var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function bestEdgeByTarget(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (e.provenance === import_types.Provenance.FRONTIER) continue;
+    const cur = best.get(e.target);
+    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+      best.set(e.target, e);
+    }
+  }
+  return best;
+}
+var PROVENANCE_CEILING = {
+  OBSERVED: 1,
+  INFERRED: 0.7,
+  EXTRACTED: 0.5,
+  STALE: 0.3,
+  FRONTIER: 0.3
+};
+function volumeWeight(spanCount) {
+  if (!spanCount || spanCount <= 0) return 0.5;
+  const w = 0.5 + Math.log10(spanCount + 1) / 3;
+  return Math.min(1, w);
+}
+function recencyWeight(ageMs) {
+  if (ageMs === void 0) return 0.8;
+  const hour = 60 * 60 * 1e3;
+  if (ageMs <= hour) return 1;
+  if (ageMs <= 24 * hour) {
+    const t = (ageMs - hour) / (23 * hour);
+    return 1 - 0.5 * t;
+  }
+  return 0.3;
+}
+function cleanlinessWeight(spanCount, errorCount) {
+  if (!spanCount || spanCount <= 0) return 1;
+  const rate = (errorCount ?? 0) / spanCount;
+  if (rate <= 0.01) return 1;
+  if (rate >= 0.5) return 0.3;
+  return 1 - rate * 1.4;
+}
+function confidenceForEdge(edge, now = Date.now()) {
+  const ceiling = PROVENANCE_CEILING[edge.provenance] ?? 0.5;
+  const spanCount = edge.signal?.spanCount ?? edge.callCount;
+  const ageMs = edge.signal?.lastObservedAgeMs ?? lastObservedAge(edge, now);
+  if (spanCount === void 0 && ageMs === void 0 && edge.signal === void 0) {
+    return ceiling;
+  }
+  const v = volumeWeight(spanCount);
+  const r = recencyWeight(ageMs);
+  const c = cleanlinessWeight(spanCount, edge.signal?.errorCount);
+  return Math.max(0, Math.min(1, ceiling * v * r * c));
+}
+function lastObservedAge(edge, now) {
+  if (!edge.lastObserved) return void 0;
+  const t = Date.parse(edge.lastObserved);
+  if (!Number.isFinite(t)) return void 0;
+  return Math.max(0, now - t);
+}
+function confidenceFromMix(edges, now = Date.now()) {
+  if (edges.length === 0) return 1;
+  let product = 1;
+  for (const e of edges) {
+    product *= confidenceForEdge(e, now);
+  }
+  return Math.max(0, Math.min(1, product));
+}
+function databaseRootCauseShape(graph, origin, walk) {
+  const targetDb = origin;
+  const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
+  if (candidatePairs.length === 0) return null;
+  for (const id of walk.path) {
+    const attrs = graph.getNodeAttributes(id);
+    if (attrs.type !== import_types.NodeType.ServiceNode) continue;
+    const svc = attrs;
+    const deps = svc.dependencies ?? {};
+    for (const pair of candidatePairs) {
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        targetDb.engine,
+        targetDb.engineVersion
+      );
+      if (!result.compatible) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason ?? "incompatible driver",
+          ...result.minDriverVersion ? {
+            fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
+          } : {}
+        };
+      }
+    }
+  }
+  return null;
+}
+function serviceRootCauseShape(graph, _origin, walk) {
+  for (const id of walk.path) {
+    const attrs = graph.getNodeAttributes(id);
+    if (attrs.type !== import_types.NodeType.ServiceNode) continue;
+    const svc = attrs;
+    const deps = svc.dependencies ?? {};
+    const serviceNodeEngine = svc.nodeEngine;
+    for (const constraint of nodeEngineConstraints()) {
+      const declared = deps[constraint.package];
+      if (!declared) continue;
+      const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason,
+          ...result.requiredNodeVersion ? {
+            fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
+          } : {}
+        };
+      }
+    }
+    for (const conflict of packageConflicts()) {
+      const declared = deps[conflict.package];
+      if (!declared) continue;
+      const requiredDeclared = deps[conflict.requires.name];
+      const result = checkPackageConflict(conflict, declared, requiredDeclared);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: id,
+          rootCauseReason: result.reason,
+          fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
+        };
+      }
+    }
+  }
+  return null;
+}
+var rootCauseShapes = {
+  [import_types.NodeType.DatabaseNode]: databaseRootCauseShape,
+  [import_types.NodeType.ServiceNode]: serviceRootCauseShape
+};
+function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return import_types.BlastRadiusResultSchema.parse({ origin: nodeId, affectedNodes: [], totalAffected: 0 });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, path: [nodeId], pathEdges: [] }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.pathEdges.length > 0) {
+      const lastEdge = frame.pathEdges[frame.pathEdges.length - 1];
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeProvenance: lastEdge.provenance,
+        path: frame.path,
+        confidence: confidenceFromMix(frame.pathEdges)
+      });
+    }
+    if (frame.distance >= maxDepth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({
+        nodeId: tgtId,
+        distance: frame.distance + 1,
+        path: [...frame.path, tgtId],
+        pathEdges: [...frame.pathEdges, edge]
+      });
+    }
+  }
+  const affectedNodes = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return import_types.BlastRadiusResultSchema.parse({
+    origin: nodeId,
+    affectedNodes,
+    totalAffected: affectedNodes.length
+  });
+}
+
+// src/policy.ts
+var DEFAULT_ACTION_BY_SEVERITY = {
+  info: "log",
+  warning: "alert",
+  error: "alert",
+  critical: "block"
+};
+function resolveOnViolation(policy) {
+  return policy.onViolation ?? DEFAULT_ACTION_BY_SEVERITY[policy.severity];
+}
+function makeViolation(policy, rule, contextSuffix, message, subject, ctx) {
+  return {
+    id: `${policy.id}:${contextSuffix}`,
+    policyId: policy.id,
+    policyName: policy.name,
+    severity: policy.severity,
+    onViolation: resolveOnViolation(policy),
+    ruleType: rule.type,
+    subject,
+    message,
+    observedAt: new Date(ctx.now()).toISOString()
+  };
+}
+var evaluateStructural = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.fromNodeType) return;
+    let satisfied = false;
+    for (const edgeId of graph.outboundEdges(id)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== rule.edgeType) continue;
+      if (e.provenance === import_types2.Provenance.FRONTIER) continue;
+      const target = graph.getNodeAttributes(e.target);
+      if (target.type === rule.toNodeType) {
+        satisfied = true;
+        break;
+      }
+    }
+    if (!satisfied) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.fromNodeType} ${id} has no ${rule.edgeType} edge to a ${rule.toNodeType}`,
+          { nodeId: id },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateOwnership = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const value = a[rule.field];
+    if (typeof value !== "string" || value.length === 0) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} is missing required field "${rule.field}"`,
+          { nodeId: id },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateProvenance = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const required = Array.isArray(rule.required) ? new Set(rule.required) : /* @__PURE__ */ new Set([rule.required]);
+  const violations = [];
+  graph.forEachEdge((edgeId, attrs) => {
+    const e = attrs;
+    if (e.type !== rule.edgeType) return;
+    if (rule.targetNodeId && e.target !== rule.targetNodeId) return;
+    if (!required.has(e.provenance)) {
+      const requiredList = [...required].join(" | ");
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          edgeId,
+          `${rule.edgeType} edge ${edgeId} has provenance ${e.provenance}; required ${requiredList}`,
+          { edgeId },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateBlastRadius = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const depth = rule.depth;
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const result = depth !== void 0 ? getBlastRadius(graph, id, depth) : getBlastRadius(graph, id);
+    if (result.totalAffected > rule.maxAffected) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} has blast radius ${result.totalAffected} > ${rule.maxAffected}`,
+          { nodeId: id, path: [id] },
+          ctx
+        )
+      );
+    }
+  });
+  return violations;
+};
+var evaluateCompatibility = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const wantsKind = (kind) => rule.kind === void 0 || rule.kind === kind;
+  graph.forEachNode((svcId, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types2.NodeType.ServiceNode) return;
+    const svc = a;
+    const deps = svc.dependencies ?? {};
+    if (wantsKind("driver-engine")) {
+      for (const edgeId of graph.outboundEdges(svcId)) {
+        const e = graph.getEdgeAttributes(edgeId);
+        if (e.type !== import_types2.EdgeType.CONNECTS_TO) continue;
+        if (e.provenance === import_types2.Provenance.FRONTIER) continue;
+        const dbAttrs = graph.getNodeAttributes(e.target);
+        if (dbAttrs.type !== import_types2.NodeType.DatabaseNode) continue;
+        const db = dbAttrs;
+        for (const pair of compatPairs()) {
+          if (pair.engine !== db.engine) continue;
+          const declared = deps[pair.driver];
+          if (!declared) continue;
+          const result = checkCompatibility(pair.driver, declared, db.engine, db.engineVersion);
+          if (!result.compatible && result.reason) {
+            violations.push(
+              makeViolation(
+                policy,
+                rule,
+                `${svcId}:driver-engine:${pair.driver}@${declared}:${db.engine}@${db.engineVersion}`,
+                result.reason,
+                { nodeId: svcId, edgeId },
+                ctx
+              )
+            );
+          }
+        }
+      }
+    }
+    if (wantsKind("node-engine")) {
+      const serviceNodeRange = svc.nodeEngine;
+      for (const constraint of nodeEngineConstraints()) {
+        const declared = deps[constraint.package];
+        if (!declared) continue;
+        const result = checkNodeEngineConstraint(constraint, declared, serviceNodeRange);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:node-engine:${constraint.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+    if (wantsKind("package-conflict")) {
+      for (const conflict of packageConflicts()) {
+        const declared = deps[conflict.package];
+        if (!declared) continue;
+        const requiredDeclared = deps[conflict.requires.name];
+        const result = checkPackageConflict(conflict, declared, requiredDeclared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:package-conflict:${conflict.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+    if (wantsKind("deprecated-api")) {
+      for (const dep of deprecatedApis()) {
+        const declared = deps[dep.package];
+        if (!declared) continue;
+        const result = checkDeprecatedApi(dep, declared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:deprecated-api:${dep.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
+    }
+  });
+  return violations;
+};
+var policyEvaluators = {
+  structural: evaluateStructural,
+  ownership: evaluateOwnership,
+  provenance: evaluateProvenance,
+  "blast-radius": evaluateBlastRadius,
+  compatibility: evaluateCompatibility
+};
+function canPromoteFrontier(graph, frontierId2, policies, ctx) {
+  if (policies.length === 0) return { allowed: true, violations: [] };
+  const all = evaluateAllPolicies(graph, policies, ctx);
+  const blocking = all.filter((v) => {
+    if (v.onViolation !== "block") return false;
+    return v.subject.nodeId === frontierId2 || v.subject.path?.includes(frontierId2) === true;
+  });
+  return { allowed: blocking.length === 0, violations: blocking };
+}
+function evaluateAllPolicies(graph, policies, ctx) {
+  const out = [];
+  for (const policy of policies) {
+    const evaluator = policyEvaluators[policy.rule.type];
+    const violations = evaluator({ graph, policy, rule: policy.rule, ctx });
+    for (const v of violations) out.push(v);
+  }
+  return out;
+}
+
+// src/ingest.ts
+var import_types3 = require("@neat.is/types");
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var DEFAULT_STALE_THRESHOLDS = {
+  CALLS: HOUR_MS,
+  CONNECTS_TO: 4 * HOUR_MS,
+  PUBLISHES_TO: 4 * HOUR_MS,
+  CONSUMES_FROM: 4 * HOUR_MS,
+  DEPENDS_ON: DAY_MS,
+  CONFIGURED_BY: DAY_MS,
+  RUNS_ON: DAY_MS
+};
+var PARENT_SPAN_CACHE_TTL_MS = 5 * 60 * 1e3;
+function promoteFrontierNodes(graph, opts = {}) {
+  const aliasIndex = /* @__PURE__ */ new Map();
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.ServiceNode) return;
+    aliasIndex.set(a.name, id);
+    if (a.aliases) {
+      for (const alias of a.aliases) aliasIndex.set(alias, id);
+    }
+  });
+  const toPromote = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.FrontierNode) return;
+    const target = aliasIndex.get(a.host);
+    if (!target) return;
+    if (target === id) return;
+    toPromote.push({ frontierId: id, serviceId: target });
+  });
+  let promoted = 0;
+  for (const { frontierId: frontierId2, serviceId: serviceId3 } of toPromote) {
+    if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
+      const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
+      if (!gate.allowed) {
+        continue;
+      }
+    }
+    rewireFrontierEdges(graph, frontierId2, serviceId3);
+    graph.dropNode(frontierId2);
+    promoted++;
+  }
+  return promoted;
+}
+function rewireFrontierEdges(graph, frontierId2, serviceId3) {
+  const inbound = [...graph.inboundEdges(frontierId2)];
+  const outbound = [...graph.outboundEdges(frontierId2)];
+  for (const edgeId of inbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId3, edgeId);
+  }
+  for (const edgeId of outbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, serviceId3, edge.target, edgeId);
+  }
+}
+function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
+  graph.dropEdge(oldEdgeId);
+  const promotedProvenance = edge.provenance === import_types3.Provenance.FRONTIER ? import_types3.Provenance.OBSERVED : edge.provenance;
+  const newId = promotedProvenance === import_types3.Provenance.OBSERVED ? (0, import_types3.observedEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types3.Provenance.INFERRED ? (0, import_types3.inferredEdgeId)(newSource, newTarget, edge.type) : promotedProvenance === import_types3.Provenance.EXTRACTED ? (0, import_types3.extractedEdgeId)(newSource, newTarget, edge.type) : (0, import_types3.frontierEdgeId)(newSource, newTarget, edge.type);
+  if (graph.hasEdge(newId)) {
+    const existing = graph.getEdgeAttributes(newId);
+    const merged = {
+      ...existing,
+      callCount: (existing.callCount ?? 0) + (edge.callCount ?? 0),
+      lastObserved: pickLater(existing.lastObserved, edge.lastObserved)
+    };
+    graph.replaceEdgeAttributes(newId, merged);
+    return;
+  }
+  const rebuilt = {
+    ...edge,
+    id: newId,
+    source: newSource,
+    target: newTarget,
+    provenance: promotedProvenance
+  };
+  graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
+}
+function pickLater(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return new Date(a).getTime() >= new Date(b).getTime() ? a : b;
+}
+
+// src/extract/services.ts
+var import_node_fs6 = require("fs");
+var import_node_path6 = __toESM(require("path"), 1);
+var import_ignore = __toESM(require("ignore"), 1);
+var import_minimatch = require("minimatch");
+var import_types5 = require("@neat.is/types");
+
+// src/extract/shared.ts
+var import_node_fs4 = require("fs");
+var import_node_path4 = __toESM(require("path"), 1);
+var import_yaml = require("yaml");
+var import_types4 = require("@neat.is/types");
+var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py"]);
+var CONFIG_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".yaml", ".yml"]);
+var IGNORED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".turbo",
+  "dist",
+  "build",
+  ".next"
+]);
+function isConfigFile(name) {
+  const ext = import_node_path4.default.extname(name);
+  if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
+  if (name === ".env" || name.startsWith(".env.")) return { match: true, fileType: "env" };
+  return { match: false, fileType: "" };
+}
+function cleanVersion(raw) {
+  if (!raw) return void 0;
+  return raw.replace(/^[\^~><=v\s]+/, "").trim() || void 0;
+}
+async function readJson(filePath) {
+  const raw = await import_node_fs4.promises.readFile(filePath, "utf8");
+  return JSON.parse(raw);
+}
+async function readYaml(filePath) {
+  const raw = await import_node_fs4.promises.readFile(filePath, "utf8");
+  return (0, import_yaml.parse)(raw);
+}
+async function exists(p) {
+  try {
+    await import_node_fs4.promises.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/extract/python.ts
+var import_node_fs5 = require("fs");
+var import_node_path5 = __toESM(require("path"), 1);
+var import_smol_toml = require("smol-toml");
+var REQUIREMENT_LINE = /^\s*([A-Za-z0-9_.-]+)(?:\[[^\]]*\])?\s*(?:(==)\s*([A-Za-z0-9_.+-]+))?/;
+function parseRequirementsTxt(content) {
+  const out = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.split("#")[0]?.trim();
+    if (!line) continue;
+    if (line.startsWith("-")) continue;
+    const match = REQUIREMENT_LINE.exec(line);
+    if (!match) continue;
+    const name = match[1].toLowerCase();
+    const version = match[3] ?? "";
+    out[name] = version;
+  }
+  return out;
+}
+function depsFromPyProject(pyproject) {
+  const out = {};
+  for (const entry2 of pyproject.project?.dependencies ?? []) {
+    const match = REQUIREMENT_LINE.exec(entry2);
+    if (!match) continue;
+    out[match[1].toLowerCase()] = match[3] ?? "";
+  }
+  const poetryDeps = pyproject.tool?.poetry?.dependencies ?? {};
+  for (const [name, value] of Object.entries(poetryDeps)) {
+    if (name.toLowerCase() === "python") continue;
+    const raw = typeof value === "string" ? value : value?.version ?? "";
+    out[name.toLowerCase()] = raw.replace(/^[\^~><=v\s]+/, "");
+  }
+  return out;
+}
+async function discoverPythonService(serviceDir) {
+  const pyprojectPath = import_node_path5.default.join(serviceDir, "pyproject.toml");
+  const requirementsPath = import_node_path5.default.join(serviceDir, "requirements.txt");
+  const setupPath = import_node_path5.default.join(serviceDir, "setup.py");
+  const hasPyproject = await exists(pyprojectPath);
+  const hasRequirements = await exists(requirementsPath);
+  const hasSetup = await exists(setupPath);
+  if (!hasPyproject && !hasRequirements && !hasSetup) return null;
+  let name = import_node_path5.default.basename(serviceDir);
+  let version;
+  const dependencies = {};
+  if (hasPyproject) {
+    const raw = await import_node_fs5.promises.readFile(pyprojectPath, "utf8");
+    const pyproject = (0, import_smol_toml.parse)(raw);
+    name = pyproject.project?.name ?? pyproject.tool?.poetry?.name ?? name;
+    version = pyproject.project?.version ?? pyproject.tool?.poetry?.version ?? void 0;
+    Object.assign(dependencies, depsFromPyProject(pyproject));
+  }
+  if (hasRequirements) {
+    const raw = await import_node_fs5.promises.readFile(requirementsPath, "utf8");
+    Object.assign(dependencies, parseRequirementsTxt(raw));
+  }
+  return { name, version, dependencies };
+}
+function pythonToPackage(service) {
+  return {
+    name: service.name,
+    version: service.version,
+    dependencies: service.dependencies
+  };
+}
+
+// src/extract/services.ts
+var DEFAULT_SCAN_DEPTH = 5;
+function parseScanDepth() {
+  const raw = process.env.NEAT_SCAN_DEPTH;
+  if (!raw) return DEFAULT_SCAN_DEPTH;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_SCAN_DEPTH;
+}
+function workspaceGlobs(pkg) {
+  const ws = pkg.workspaces;
+  if (!ws) return null;
+  if (Array.isArray(ws)) return ws.length > 0 ? ws : null;
+  if (Array.isArray(ws.packages)) return ws.packages.length > 0 ? ws.packages : null;
+  return null;
+}
+async function loadGitignore(scanPath) {
+  const gitignorePath = import_node_path6.default.join(scanPath, ".gitignore");
+  if (!await exists(gitignorePath)) return null;
+  const raw = await import_node_fs6.promises.readFile(gitignorePath, "utf8");
+  return (0, import_ignore.default)().add(raw);
+}
+async function walkDirs(start, scanPath, options, visit) {
+  async function recurse(current, depth) {
+    if (depth > options.maxDepth) return;
+    const entries = await import_node_fs6.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry2 of entries) {
+      if (!entry2.isDirectory()) continue;
+      if (IGNORED_DIRS.has(entry2.name)) continue;
+      const child = import_node_path6.default.join(current, entry2.name);
+      if (options.ig) {
+        const rel = import_node_path6.default.relative(scanPath, child).split(import_node_path6.default.sep).join("/");
+        if (rel && options.ig.ignores(rel + "/")) continue;
+      }
+      await visit(child);
+      await recurse(child, depth + 1);
+    }
+  }
+  await recurse(start, 0);
+}
+async function expandWorkspaceGlobs(scanPath, globs) {
+  const found = /* @__PURE__ */ new Set();
+  const scanDepth = parseScanDepth();
+  for (const raw of globs) {
+    const pattern = raw.replace(/^\.\//, "");
+    if (!pattern.includes("*")) {
+      const candidate = import_node_path6.default.join(scanPath, pattern);
+      if (await exists(import_node_path6.default.join(candidate, "package.json"))) found.add(candidate);
+      continue;
+    }
+    const segments = pattern.split("/");
+    const staticSegments = [];
+    for (const seg of segments) {
+      if (seg.includes("*")) break;
+      staticSegments.push(seg);
+    }
+    const start = import_node_path6.default.join(scanPath, ...staticSegments);
+    if (!await exists(start)) continue;
+    const hasDoubleStar = pattern.includes("**");
+    const walkDepth = hasDoubleStar ? scanDepth : Math.max(0, segments.length - staticSegments.length - 1);
+    await walkDirs(start, scanPath, { maxDepth: walkDepth, ig: null }, async (dir) => {
+      const rel = import_node_path6.default.relative(scanPath, dir).split(import_node_path6.default.sep).join("/");
+      if ((0, import_minimatch.minimatch)(rel, pattern) && await exists(import_node_path6.default.join(dir, "package.json"))) {
+        found.add(dir);
+      }
+    });
+  }
+  return [...found];
+}
+async function discoverNodeService(scanPath, dir) {
+  const pkgPath = import_node_path6.default.join(dir, "package.json");
+  if (!await exists(pkgPath)) return null;
+  const pkg = await readJson(pkgPath);
+  if (!pkg.name) return null;
+  const node = {
+    id: (0, import_types5.serviceId)(pkg.name),
+    type: import_types5.NodeType.ServiceNode,
+    name: pkg.name,
+    language: "javascript",
+    version: pkg.version,
+    dependencies: pkg.dependencies ?? {},
+    repoPath: import_node_path6.default.relative(scanPath, dir),
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+  };
+  return { pkg, dir, node };
+}
+async function discoverPyService(scanPath, dir) {
+  const py = await discoverPythonService(dir);
+  if (!py) return null;
+  const pkg = pythonToPackage(py);
+  const node = {
+    id: (0, import_types5.serviceId)(py.name),
+    type: import_types5.NodeType.ServiceNode,
+    name: py.name,
+    language: "python",
+    version: py.version,
+    dependencies: py.dependencies,
+    repoPath: import_node_path6.default.relative(scanPath, dir)
+  };
+  return { pkg, dir, node };
+}
+async function discoverServices(scanPath) {
+  const rootPkgPath = import_node_path6.default.join(scanPath, "package.json");
+  const rootPkg = await exists(rootPkgPath) ? await readJson(rootPkgPath) : null;
+  const wsGlobs = rootPkg ? workspaceGlobs(rootPkg) : null;
+  const candidateDirs = [];
+  if (wsGlobs) {
+    candidateDirs.push(...await expandWorkspaceGlobs(scanPath, wsGlobs));
+  } else {
+    if (rootPkg && rootPkg.name) candidateDirs.push(scanPath);
+    const ig = await loadGitignore(scanPath);
+    await walkDirs(
+      scanPath,
+      scanPath,
+      { maxDepth: parseScanDepth(), ig },
+      async (dir) => {
+        if (await exists(import_node_path6.default.join(dir, "package.json"))) {
+          candidateDirs.push(dir);
+        } else if (await exists(import_node_path6.default.join(dir, "pyproject.toml")) || await exists(import_node_path6.default.join(dir, "requirements.txt")) || await exists(import_node_path6.default.join(dir, "setup.py"))) {
+          candidateDirs.push(dir);
+        }
+      }
+    );
+  }
+  candidateDirs.sort();
+  const seen = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const dir of candidateDirs) {
+    const service = await discoverNodeService(scanPath, dir) ?? await discoverPyService(scanPath, dir);
+    if (!service) continue;
+    const existingDir = seen.get(service.node.name);
+    if (existingDir !== void 0) {
+      const a = import_node_path6.default.relative(scanPath, existingDir) || ".";
+      const b = import_node_path6.default.relative(scanPath, dir) || ".";
+      console.warn(
+        `[neat] duplicate package name "${service.node.name}" \u2014 keeping ${a}, ignoring ${b}`
+      );
+      continue;
+    }
+    seen.set(service.node.name, dir);
+    out.push(service);
+  }
+  return out;
+}
+function addServiceNodes(graph, services) {
+  let nodesAdded = 0;
+  for (const service of services) {
+    if (!graph.hasNode(service.node.id)) {
+      graph.addNode(service.node.id, { ...service.node, discoveredVia: "static" });
+      nodesAdded++;
+      continue;
+    }
+    const existing = graph.getNodeAttributes(service.node.id);
+    const mergedDiscoveredVia = existing.discoveredVia === "otel" ? "merged" : "static";
+    graph.replaceNodeAttributes(service.node.id, {
+      ...existing,
+      ...service.node,
+      discoveredVia: mergedDiscoveredVia
+    });
+  }
+  return nodesAdded;
+}
+
+// src/extract/aliases.ts
+var import_node_path7 = __toESM(require("path"), 1);
+var import_node_fs7 = require("fs");
+var import_yaml2 = require("yaml");
+var import_types6 = require("@neat.is/types");
+var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
+  "Service",
+  "Deployment",
+  "StatefulSet",
+  "DaemonSet"
+]);
+function addAliases(graph, serviceId3, candidates) {
+  if (!graph.hasNode(serviceId3)) return;
+  const node = graph.getNodeAttributes(serviceId3);
+  if (node.type !== import_types6.NodeType.ServiceNode) return;
+  const set = new Set(node.aliases ?? []);
+  for (const c of candidates) {
+    if (!c) continue;
+    if (c === node.name) continue;
+    set.add(c);
+  }
+  if (set.size === 0) return;
+  const updated = { ...node, aliases: [...set].sort() };
+  graph.replaceNodeAttributes(serviceId3, updated);
+}
+function indexServicesByName(services) {
+  const map = /* @__PURE__ */ new Map();
+  for (const s of services) {
+    map.set(s.node.name, s.node.id);
+    map.set(import_node_path7.default.basename(s.dir), s.node.id);
+  }
+  return map;
+}
+async function collectComposeAliases(graph, scanPath, serviceIndex) {
+  let composePath = null;
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = import_node_path7.default.join(scanPath, name);
+    if (await exists(abs)) {
+      composePath = abs;
+      break;
+    }
+  }
+  if (!composePath) return;
+  const compose = await readYaml(composePath);
+  if (!compose?.services) return;
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const serviceId3 = serviceIndex.get(composeName);
+    if (!serviceId3) continue;
+    const aliases = /* @__PURE__ */ new Set([composeName]);
+    if (svc.container_name) aliases.add(svc.container_name);
+    if (svc.hostname) aliases.add(svc.hostname);
+    addAliases(graph, serviceId3, aliases);
+  }
+}
+var LABEL_KEYS = /* @__PURE__ */ new Set([
+  "service",
+  "service.name",
+  "app",
+  "app.name",
+  "com.docker.compose.service",
+  "org.opencontainers.image.title"
+]);
+function parseDockerfileLabels(content) {
+  const out = [];
+  const lineRegex = /^\s*label\s+(.+)$/i;
+  for (const raw of content.split("\n")) {
+    const m = lineRegex.exec(raw);
+    if (!m) continue;
+    const rest = m[1];
+    const pairRegex = /([\w.-]+)\s*=\s*("([^"]*)"|'([^']*)'|([^\s]+))/g;
+    let pair;
+    while ((pair = pairRegex.exec(rest)) !== null) {
+      const key = pair[1].toLowerCase();
+      if (!LABEL_KEYS.has(key)) continue;
+      const value = pair[3] ?? pair[4] ?? pair[5] ?? "";
+      if (value) out.push(value);
+    }
+  }
+  return out;
+}
+async function collectDockerfileAliases(graph, services) {
+  for (const service of services) {
+    const dockerfilePath = import_node_path7.default.join(service.dir, "Dockerfile");
+    if (!await exists(dockerfilePath)) continue;
+    const content = await import_node_fs7.promises.readFile(dockerfilePath, "utf8");
+    const aliases = parseDockerfileLabels(content);
+    if (aliases.length > 0) addAliases(graph, service.node.id, aliases);
+  }
+}
+async function walkYamlFiles(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await import_node_fs7.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry2 of entries) {
+    if (entry2.isDirectory()) {
+      if (IGNORED_DIRS.has(entry2.name)) continue;
+      out.push(...await walkYamlFiles(import_node_path7.default.join(start, entry2.name), depth + 1, max));
+    } else if (entry2.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path7.default.extname(entry2.name))) {
+      out.push(import_node_path7.default.join(start, entry2.name));
+    }
+  }
+  return out;
+}
+function k8sHostnames(name, namespace) {
+  const ns = namespace ?? "default";
+  return [
+    name,
+    `${name}.${ns}`,
+    `${name}.${ns}.svc`,
+    `${name}.${ns}.svc.cluster.local`
+  ];
+}
+function k8sServiceTarget(doc, byName) {
+  const selector = doc.spec?.selector;
+  const selectorApp = selector?.app ?? selector?.matchLabels?.app;
+  if (selectorApp && byName.has(selectorApp)) return byName.get(selectorApp);
+  const labelApp = doc.metadata?.labels?.app;
+  if (labelApp && byName.has(labelApp)) return byName.get(labelApp);
+  const metaName = doc.metadata?.name;
+  if (metaName && byName.has(metaName)) return byName.get(metaName);
+  return null;
+}
+async function collectK8sAliases(graph, scanPath, serviceIndex) {
+  const files = await walkYamlFiles(scanPath);
+  for (const file of files) {
+    const content = await import_node_fs7.promises.readFile(file, "utf8");
+    let docs;
+    try {
+      docs = (0, import_yaml2.parseAllDocuments)(content).map((d) => d.toJSON());
+    } catch {
+      continue;
+    }
+    for (const doc of docs) {
+      if (!doc?.kind || !doc.metadata?.name) continue;
+      if (!K8S_KINDS_WITH_HOSTNAMES.has(doc.kind)) continue;
+      const target = k8sServiceTarget(doc, serviceIndex);
+      if (!target) continue;
+      addAliases(graph, target, k8sHostnames(doc.metadata.name, doc.metadata.namespace));
+    }
+  }
+}
+async function addServiceAliases(graph, scanPath, services) {
+  const byName = indexServicesByName(services);
+  await collectComposeAliases(graph, scanPath, byName);
+  await collectDockerfileAliases(graph, services);
+  await collectK8sAliases(graph, scanPath, byName);
+}
+
+// src/extract/databases/index.ts
+var import_node_path15 = __toESM(require("path"), 1);
+var import_types7 = require("@neat.is/types");
+
+// src/extract/databases/db-config-yaml.ts
+var import_node_path8 = __toESM(require("path"), 1);
+async function parse(serviceDir) {
+  const yamlPath = import_node_path8.default.join(serviceDir, "db-config.yaml");
+  if (!await exists(yamlPath)) return [];
+  const raw = await readYaml(yamlPath);
+  return [
+    {
+      host: raw.host,
+      port: raw.port,
+      database: raw.database,
+      engine: raw.engine,
+      engineVersion: raw.engineVersion !== void 0 ? String(raw.engineVersion) : "unknown",
+      sourceFile: yamlPath
+    }
+  ];
+}
+var dbConfigYamlParser = { name: "db-config.yaml", parse };
+
+// src/extract/databases/dotenv.ts
+var import_node_fs9 = require("fs");
+var import_node_path10 = __toESM(require("path"), 1);
+
+// src/extract/databases/shared.ts
+var import_node_fs8 = require("fs");
+var import_node_path9 = __toESM(require("path"), 1);
+function schemeToEngine(scheme) {
+  const s = scheme.toLowerCase().split("+")[0];
+  switch (s) {
+    case "postgres":
+    case "postgresql":
+      return "postgresql";
+    case "mysql":
+    case "mariadb":
+      return "mysql";
+    case "mongodb":
+    case "mongodb+srv":
+      return "mongodb";
+    case "redis":
+    case "rediss":
+      return "redis";
+    case "sqlite":
+      return "sqlite";
+    default:
+      return null;
+  }
+}
+function parseConnectionString(url) {
+  const m = url.match(
+    /^(?<scheme>[a-z][a-z+]*):\/\/(?:[^@/]+(?::[^@]*)?@)?(?<host>[^:/?]+)(?::(?<port>\d+))?(?:\/(?<db>[^?#]*))?/i
+  );
+  if (!m || !m.groups) return null;
+  const engine = schemeToEngine(m.groups.scheme);
+  if (!engine) return null;
+  return {
+    host: m.groups.host,
+    port: m.groups.port ? Number(m.groups.port) : void 0,
+    database: m.groups.db ?? "",
+    engine,
+    engineVersion: "unknown"
+  };
+}
+async function readIfExists(filePath) {
+  try {
+    return await import_node_fs8.promises.readFile(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function findFirst(serviceDir, candidates) {
+  for (const rel of candidates) {
+    const abs = import_node_path9.default.join(serviceDir, rel);
+    const content = await readIfExists(abs);
+    if (content !== null) return abs;
+  }
+  return null;
+}
+function engineFromImage(image) {
+  const lower = image.toLowerCase();
+  const colon = lower.lastIndexOf(":");
+  const repo = colon >= 0 ? lower.slice(0, colon) : lower;
+  const tag = colon >= 0 ? lower.slice(colon + 1) : "latest";
+  const last = repo.split("/").pop() ?? repo;
+  let engine = null;
+  if (last.startsWith("postgres")) engine = "postgresql";
+  else if (last.startsWith("mysql") || last.startsWith("mariadb")) engine = "mysql";
+  else if (last.startsWith("mongo")) engine = "mongodb";
+  else if (last.startsWith("redis")) engine = "redis";
+  else if (last.startsWith("sqlite")) engine = "sqlite";
+  if (!engine) return null;
+  const versionMatch = tag.match(/^(\d+(?:\.\d+){0,2})/);
+  return {
+    engine,
+    engineVersion: versionMatch ? versionMatch[1] : "unknown"
+  };
+}
+
+// src/extract/databases/dotenv.ts
+var CONNECTION_KEYS = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DB_URL",
+  "POSTGRES_URL",
+  "POSTGRESQL_URL",
+  "MYSQL_URL",
+  "MONGODB_URI",
+  "MONGO_URL",
+  "MONGO_URI",
+  "REDIS_URL"
+]);
+function parseDotenvLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return null;
+  const eq = trimmed.indexOf("=");
+  if (eq < 0) return null;
+  const key = trimmed.slice(0, eq).trim();
+  let value = trimmed.slice(eq + 1).trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return { key, value };
+}
+async function parse2(serviceDir) {
+  const entries = await import_node_fs9.promises.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const configs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry2 of entries) {
+    if (!entry2.isFile()) continue;
+    const match = isConfigFile(entry2.name);
+    if (!match.match || match.fileType !== "env") continue;
+    const filePath = import_node_path10.default.join(serviceDir, entry2.name);
+    const content = await import_node_fs9.promises.readFile(filePath, "utf8");
+    for (const line of content.split("\n")) {
+      const parsed = parseDotenvLine(line);
+      if (!parsed) continue;
+      if (!CONNECTION_KEYS.has(parsed.key.toUpperCase())) continue;
+      const config = parseConnectionString(parsed.value);
+      if (!config) continue;
+      const key = `${config.engine}://${config.host}:${config.port ?? ""}/${config.database}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      configs.push({ ...config, sourceFile: filePath });
+    }
+  }
+  return configs;
+}
+var dotenvParser = { name: ".env", parse: parse2 };
+
+// src/extract/databases/prisma.ts
+var import_node_path11 = __toESM(require("path"), 1);
+async function parse3(serviceDir) {
+  const schemaPath = import_node_path11.default.join(serviceDir, "prisma", "schema.prisma");
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  const block = content.match(/datasource\s+\w+\s*\{([^}]*)\}/s);
+  if (!block) return [];
+  const body = block[1] ?? "";
+  const providerMatch = body.match(/provider\s*=\s*"([^"]+)"/);
+  if (!providerMatch) return [];
+  const engine = schemeToEngine(providerMatch[1]);
+  if (!engine) return [];
+  const urlMatch = body.match(/url\s*=\s*"([^"]+)"/);
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: schemaPath }];
+  }
+  return [
+    {
+      host: `${engine}-prisma`,
+      database: "",
+      engine,
+      engineVersion: "unknown",
+      sourceFile: schemaPath
+    }
+  ];
+}
+var prismaParser = { name: "prisma", parse: parse3 };
+
+// src/extract/databases/drizzle.ts
+var DIALECT_TO_ENGINE = {
+  postgresql: "postgresql",
+  postgres: "postgresql",
+  pg: "postgresql",
+  mysql: "mysql",
+  mysql2: "mysql",
+  sqlite: "sqlite",
+  "better-sqlite": "sqlite"
+};
+async function parse4(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "drizzle.config.ts",
+    "drizzle.config.js",
+    "drizzle.config.mjs"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const dialectMatch = content.match(/dialect\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (!dialectMatch) return [];
+  const engine = DIALECT_TO_ENGINE[dialectMatch[1].toLowerCase()] ?? schemeToEngine(dialectMatch[1]);
+  if (!engine) return [];
+  const urlMatch = content.match(
+    /(?:url|connectionString)\s*:\s*['"`]([a-z][a-z+]*:\/\/[^'"`]+)['"`]/i
+  );
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
+  const hostMatch = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (hostMatch) {
+    const portMatch = content.match(/port\s*:\s*(\d+)/);
+    const dbMatch = content.match(/database\s*:\s*['"`]([^'"`]+)['"`]/);
+    return [
+      {
+        host: hostMatch[1],
+        port: portMatch ? Number(portMatch[1]) : void 0,
+        database: dbMatch?.[1] ?? "",
+        engine,
+        engineVersion: "unknown",
+        sourceFile: filePath
+      }
+    ];
+  }
+  return [
+    { host: `${engine}-drizzle`, database: "", engine, engineVersion: "unknown", sourceFile: filePath }
+  ];
+}
+var drizzleParser = { name: "drizzle", parse: parse4 };
+
+// src/extract/databases/knex.ts
+var CLIENT_TO_ENGINE = {
+  pg: "postgresql",
+  postgres: "postgresql",
+  postgresql: "postgresql",
+  mysql: "mysql",
+  mysql2: "mysql",
+  sqlite3: "sqlite",
+  "better-sqlite3": "sqlite"
+};
+async function parse5(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "knexfile.js",
+    "knexfile.ts",
+    "knexfile.cjs",
+    "knexfile.mjs"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const clientMatch = content.match(/client\s*:\s*['"`]([^'"`]+)['"`]/);
+  if (!clientMatch) return [];
+  const engine = CLIENT_TO_ENGINE[clientMatch[1].toLowerCase()];
+  if (!engine) return [];
+  const urlMatch = content.match(
+    /connection\s*:\s*['"`]([a-z][a-z+]*:\/\/[^'"`]+)['"`]/i
+  );
+  if (urlMatch) {
+    const config = parseConnectionString(urlMatch[1]);
+    if (config) return [{ ...config, sourceFile: filePath }];
+  }
+  const host = content.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
+  if (host) {
+    const port = content.match(/port\s*:\s*(\d+)/)?.[1];
+    const database = content.match(/database\s*:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? "";
+    return [
+      {
+        host,
+        port: port ? Number(port) : void 0,
+        database,
+        engine,
+        engineVersion: "unknown",
+        sourceFile: filePath
+      }
+    ];
+  }
+  return [{ host: `${engine}-knex`, database: "", engine, engineVersion: "unknown", sourceFile: filePath }];
+}
+var knexParser = { name: "knex", parse: parse5 };
+
+// src/extract/databases/ormconfig.ts
+var import_node_path12 = __toESM(require("path"), 1);
+async function parse6(serviceDir) {
+  for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
+    const abs = import_node_path12.default.join(serviceDir, candidate);
+    if (!await exists(abs)) continue;
+    const raw = candidate.endsWith(".json") ? await readJson(abs) : await readYaml(abs);
+    const entries = Array.isArray(raw) ? raw : [raw];
+    const out = [];
+    for (const entry2 of entries) {
+      if (!entry2?.type || !entry2.host) continue;
+      const engine = schemeToEngine(entry2.type);
+      if (!engine) continue;
+      out.push({
+        host: entry2.host,
+        port: entry2.port,
+        database: entry2.database ?? "",
+        engine,
+        engineVersion: "unknown",
+        sourceFile: abs
+      });
+    }
+    if (out.length > 0) return out;
+  }
+  return [];
+}
+var ormconfigParser = { name: "ormconfig", parse: parse6 };
+
+// src/extract/databases/typeorm.ts
+async function parse7(serviceDir) {
+  const filePath = await findFirst(serviceDir, [
+    "data-source.ts",
+    "data-source.js",
+    "src/data-source.ts",
+    "src/data-source.js"
+  ]);
+  if (!filePath) return [];
+  const content = await readIfExists(filePath);
+  if (!content) return [];
+  const block = content.match(/new\s+DataSource\s*\(\s*\{([\s\S]*?)\}\s*\)/);
+  const body = block ? block[1] : content;
+  const typeMatch = body.match(/type\s*:\s*['"`]([^'"`]+)['"`]/);
+  const host = body.match(/host\s*:\s*['"`]([^'"`]+)['"`]/)?.[1];
+  if (!typeMatch || !host) return [];
+  const engine = schemeToEngine(typeMatch[1]);
+  if (!engine) return [];
+  const port = body.match(/port\s*:\s*(\d+)/)?.[1];
+  const database = body.match(/database\s*:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? "";
+  return [
+    {
+      host,
+      port: port ? Number(port) : void 0,
+      database,
+      engine,
+      engineVersion: "unknown",
+      sourceFile: filePath
+    }
+  ];
+}
+var typeormParser = { name: "typeorm", parse: parse7 };
+
+// src/extract/databases/sequelize.ts
+var import_node_path13 = __toESM(require("path"), 1);
+async function parse8(serviceDir) {
+  const configPath = import_node_path13.default.join(serviceDir, "config", "config.json");
+  if (!await exists(configPath)) return [];
+  const raw = await readJson(configPath);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry2 of Object.values(raw)) {
+    if (!entry2?.dialect || !entry2.host) continue;
+    const engine = schemeToEngine(entry2.dialect);
+    if (!engine) continue;
+    const key = `${engine}://${entry2.host}:${entry2.port ?? ""}/${entry2.database ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({
+      host: entry2.host,
+      port: entry2.port,
+      database: entry2.database ?? "",
+      engine,
+      engineVersion: "unknown",
+      sourceFile: configPath
+    });
+  }
+  return out;
+}
+var sequelizeParser = { name: "sequelize", parse: parse8 };
+
+// src/extract/databases/docker-compose.ts
+var import_node_path14 = __toESM(require("path"), 1);
+function portFromService(svc) {
+  for (const raw of svc.ports ?? []) {
+    const str = String(raw);
+    const last = str.split(":").pop();
+    const n = Number(last);
+    if (Number.isFinite(n) && n > 0) return n;
+  }
+  return void 0;
+}
+function databaseFromEnv(svc) {
+  const env = svc.environment;
+  const get = (key) => {
+    if (!env) return void 0;
+    if (Array.isArray(env)) {
+      for (const line of env) {
+        const [k, v] = line.split("=");
+        if (k === key) return v;
+      }
+      return void 0;
+    }
+    return env[key];
+  };
+  return get("POSTGRES_DB") ?? get("MYSQL_DATABASE") ?? get("MONGO_INITDB_DATABASE") ?? "";
+}
+async function parse9(serviceDir) {
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = import_node_path14.default.join(serviceDir, name);
+    if (!await exists(abs)) continue;
+    const raw = await readYaml(abs);
+    if (!raw?.services) return [];
+    const out = [];
+    for (const [serviceName, svc] of Object.entries(raw.services)) {
+      if (!svc.image) continue;
+      const meta = engineFromImage(svc.image);
+      if (!meta) continue;
+      out.push({
+        host: serviceName,
+        port: portFromService(svc),
+        database: databaseFromEnv(svc),
+        engine: meta.engine,
+        engineVersion: meta.engineVersion,
+        sourceFile: abs
+      });
+    }
+    return out;
+  }
+  return [];
+}
+var dockerComposeParser = { name: "docker-compose", parse: parse9 };
+
+// src/extract/databases/index.ts
+var DB_PARSERS = [
+  dbConfigYamlParser,
+  dotenvParser,
+  prismaParser,
+  drizzleParser,
+  knexParser,
+  ormconfigParser,
+  typeormParser,
+  sequelizeParser,
+  dockerComposeParser
+];
+function compatibleDriversFor(engine) {
+  return compatPairs().filter((p) => p.engine === engine).map((p) => ({ name: p.driver, minVersion: p.minDriverVersion }));
+}
+function toDatabaseNode(config) {
+  return {
+    id: (0, import_types7.databaseId)(config.host),
+    type: import_types7.NodeType.DatabaseNode,
+    name: config.database || config.host,
+    engine: config.engine,
+    engineVersion: config.engineVersion,
+    compatibleDrivers: compatibleDriversFor(config.engine),
+    host: config.host,
+    port: config.port
+  };
+}
+function attachIncompatibilities(service, configs) {
+  const deps = { ...service.pkg.dependencies ?? {}, ...service.pkg.devDependencies ?? {} };
+  const incompatibilities = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const config of configs) {
+    for (const pair of compatPairs()) {
+      if (pair.engine !== config.engine) continue;
+      const declaredVersion = cleanVersion(deps[pair.driver]);
+      if (!declaredVersion) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declaredVersion,
+        config.engine,
+        config.engineVersion
+      );
+      if (!result.compatible && result.reason) {
+        const key = `driver-engine|${pair.driver}@${declaredVersion}|${config.engine}@${config.engineVersion}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        incompatibilities.push({
+          kind: "driver-engine",
+          driver: pair.driver,
+          driverVersion: declaredVersion,
+          engine: config.engine,
+          engineVersion: config.engineVersion,
+          reason: result.reason
+        });
+      }
+    }
+  }
+  const serviceNodeEngine = service.node.nodeEngine ?? service.pkg.engines?.node;
+  for (const constraint of nodeEngineConstraints()) {
+    const declared = cleanVersion(deps[constraint.package]);
+    if (!declared) continue;
+    const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+    if (!result.compatible && result.reason) {
+      const key = `node-engine|${constraint.package}@${declared}|${serviceNodeEngine ?? ""}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "node-engine",
+        package: constraint.package,
+        packageVersion: declared,
+        requiredNodeVersion: result.requiredNodeVersion ?? constraint.minNodeVersion,
+        ...serviceNodeEngine ? { declaredNodeEngine: serviceNodeEngine } : {},
+        reason: result.reason
+      });
+    }
+  }
+  for (const conflict of packageConflicts()) {
+    const declared = cleanVersion(deps[conflict.package]);
+    if (!declared) continue;
+    const requiredVersion = cleanVersion(deps[conflict.requires.name]);
+    const result = checkPackageConflict(conflict, declared, requiredVersion);
+    if (!result.compatible && result.reason) {
+      const key = `package-conflict|${conflict.package}@${declared}|${conflict.requires.name}@${requiredVersion ?? "missing"}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "package-conflict",
+        package: conflict.package,
+        packageVersion: declared,
+        requires: conflict.requires,
+        ...requiredVersion ? { foundVersion: requiredVersion } : {},
+        reason: result.reason
+      });
+    }
+  }
+  for (const rule of deprecatedApis()) {
+    const declared = cleanVersion(deps[rule.package]);
+    if (declared === void 0) continue;
+    const result = checkDeprecatedApi(rule, declared);
+    if (!result.compatible && result.reason) {
+      const key = `deprecated-api|${rule.package}@${declared}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      incompatibilities.push({
+        kind: "deprecated-api",
+        package: rule.package,
+        packageVersion: declared,
+        reason: result.reason
+      });
+    }
+  }
+  if (incompatibilities.length > 0) service.node.incompatibilities = incompatibilities;
+}
+async function addDatabasesAndCompat(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const merged = /* @__PURE__ */ new Map();
+    for (const parser of DB_PARSERS) {
+      let configs;
+      try {
+        configs = await parser.parse(service.dir);
+      } catch (err) {
+        console.warn(
+          `[neat] ${parser.name} parser failed on ${service.node.name}: ${err.message}`
+        );
+        continue;
+      }
+      for (const config of configs) {
+        if (!config.host) continue;
+        if (!merged.has(config.host)) merged.set(config.host, config);
+      }
+    }
+    const allConfigs = [...merged.values()];
+    for (const config of allConfigs) {
+      const dbNode = toDatabaseNode(config);
+      if (!graph.hasNode(dbNode.id)) {
+        graph.addNode(dbNode.id, { ...dbNode, discoveredVia: "static" });
+        nodesAdded++;
+      } else {
+        const existing = graph.getNodeAttributes(dbNode.id);
+        const mergedDiscoveredVia = existing.discoveredVia === "otel" ? "merged" : "static";
+        graph.replaceNodeAttributes(dbNode.id, {
+          ...existing,
+          ...dbNode,
+          discoveredVia: mergedDiscoveredVia
+        });
+      }
+      const edge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, dbNode.id, import_types7.EdgeType.CONNECTS_TO),
+        source: service.node.id,
+        target: dbNode.id,
+        type: import_types7.EdgeType.CONNECTS_TO,
+        provenance: import_types7.Provenance.EXTRACTED,
+        ...config.sourceFile ? {
+          evidence: {
+            file: import_node_path15.default.relative(scanPath, config.sourceFile).split(import_node_path15.default.sep).join("/")
+          }
+        } : {}
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+    attachIncompatibilities(service, allConfigs);
+    if (graph.hasNode(service.node.id)) {
+      const current = graph.getNodeAttributes(service.node.id);
+      const updated = {
+        ...current,
+        ...service.node,
+        ...current.aliases ? { aliases: current.aliases } : {}
+      };
+      if (!service.node.incompatibilities || service.node.incompatibilities.length === 0) {
+        delete updated.incompatibilities;
+      }
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/configs.ts
+var import_node_fs10 = require("fs");
+var import_node_path16 = __toESM(require("path"), 1);
+var import_types8 = require("@neat.is/types");
+async function walkConfigFiles(dir) {
+  const out = [];
+  async function walk(current) {
+    const entries = await import_node_fs10.promises.readdir(current, { withFileTypes: true });
+    for (const entry2 of entries) {
+      const full = import_node_path16.default.join(current, entry2.name);
+      if (entry2.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry2.name)) await walk(full);
+      } else if (entry2.isFile() && isConfigFile(entry2.name).match) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function addConfigNodes(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const configFiles = await walkConfigFiles(service.dir);
+    for (const file of configFiles) {
+      const relPath = import_node_path16.default.relative(scanPath, file);
+      const node = {
+        id: (0, import_types8.configId)(relPath),
+        type: import_types8.NodeType.ConfigNode,
+        name: import_node_path16.default.basename(file),
+        path: relPath,
+        fileType: isConfigFile(import_node_path16.default.basename(file)).fileType
+      };
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+      const edge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, node.id, import_types8.EdgeType.CONFIGURED_BY),
+        source: service.node.id,
+        target: node.id,
+        type: import_types8.EdgeType.CONFIGURED_BY,
+        provenance: import_types8.Provenance.EXTRACTED,
+        evidence: { file: relPath.split(import_node_path16.default.sep).join("/") }
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/calls/index.ts
+var import_types14 = require("@neat.is/types");
+
+// src/extract/calls/http.ts
+var import_node_path18 = __toESM(require("path"), 1);
+var import_tree_sitter = __toESM(require("tree-sitter"), 1);
+var import_tree_sitter_javascript = __toESM(require("tree-sitter-javascript"), 1);
+var import_tree_sitter_python = __toESM(require("tree-sitter-python"), 1);
+var import_types9 = require("@neat.is/types");
+
+// src/extract/calls/shared.ts
+var import_node_fs11 = require("fs");
+var import_node_path17 = __toESM(require("path"), 1);
+async function walkSourceFiles(dir) {
+  const out = [];
+  async function walk(current) {
+    const entries = await import_node_fs11.promises.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry2 of entries) {
+      const full = import_node_path17.default.join(current, entry2.name);
+      if (entry2.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry2.name)) await walk(full);
+      } else if (entry2.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path17.default.extname(entry2.name))) {
+        out.push(full);
+      }
+    }
+  }
+  await walk(dir);
+  return out;
+}
+async function loadSourceFiles(dir) {
+  const paths = await walkSourceFiles(dir);
+  const out = [];
+  for (const p of paths) {
+    try {
+      const content = await import_node_fs11.promises.readFile(p, "utf8");
+      out.push({ path: p, content });
+    } catch {
+    }
+  }
+  return out;
+}
+function lineOf(text, needle) {
+  const idx = text.indexOf(needle);
+  if (idx < 0) return 1;
+  return text.slice(0, idx).split("\n").length;
+}
+function snippet(text, line) {
+  const lines = text.split("\n");
+  return (lines[line - 1] ?? "").trim();
+}
+
+// src/extract/calls/http.ts
+var STRING_LITERAL_NODE_TYPES = /* @__PURE__ */ new Set(["string_fragment", "string_content"]);
+function collectStringLiterals(node, out) {
+  if (STRING_LITERAL_NODE_TYPES.has(node.type)) out.push(node.text);
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child) collectStringLiterals(child, out);
+  }
+}
+function callsFromSource(source, parser, knownHosts) {
+  const tree = parser.parse(source);
+  const literals = [];
+  collectStringLiterals(tree.rootNode, literals);
+  const targets = /* @__PURE__ */ new Set();
+  for (const lit of literals) {
+    for (const host of knownHosts) {
+      if (lit.includes(`//${host}`) || lit.includes(`//${host}:`)) {
+        targets.add(host);
+      }
+    }
+  }
+  return targets;
+}
+function makeJsParser() {
+  const p = new import_tree_sitter.default();
+  p.setLanguage(import_tree_sitter_javascript.default);
+  return p;
+}
+function makePyParser() {
+  const p = new import_tree_sitter.default();
+  p.setLanguage(import_tree_sitter_python.default);
+  return p;
+}
+async function addHttpCallEdges(graph, services) {
+  const jsParser = makeJsParser();
+  const pyParser = makePyParser();
+  const knownHosts = /* @__PURE__ */ new Set();
+  const hostToNodeId = /* @__PURE__ */ new Map();
+  for (const service of services) {
+    knownHosts.add(import_node_path18.default.basename(service.dir));
+    knownHosts.add(service.pkg.name);
+    hostToNodeId.set(import_node_path18.default.basename(service.dir), service.node.id);
+    hostToNodeId.set(service.pkg.name, service.node.id);
+  }
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const seenTargets = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const parser = import_node_path18.default.extname(file.path) === ".py" ? pyParser : jsParser;
+      const targets = callsFromSource(file.content, parser, knownHosts);
+      for (const t of targets) {
+        const targetId = hostToNodeId.get(t);
+        if (!targetId || targetId === service.node.id) continue;
+        if (!seenTargets.has(targetId)) {
+          seenTargets.set(targetId, { file: file.path, host: t });
+        }
+      }
+    }
+    for (const [targetId, evidenceFile] of seenTargets) {
+      const fileContent = files.find((f) => f.path === evidenceFile.file)?.content ?? "";
+      const line = lineOf(fileContent, `//${evidenceFile.host}`);
+      const edge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, targetId, import_types9.EdgeType.CALLS),
+        source: service.node.id,
+        target: targetId,
+        type: import_types9.EdgeType.CALLS,
+        provenance: import_types9.Provenance.EXTRACTED,
+        evidence: {
+          file: import_node_path18.default.relative(service.dir, evidenceFile.file),
+          line,
+          snippet: snippet(fileContent, line)
+        }
+      };
+      if (!graph.hasEdge(edge.id)) {
+        graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return edgesAdded;
+}
+
+// src/extract/calls/kafka.ts
+var import_node_path19 = __toESM(require("path"), 1);
+var import_types10 = require("@neat.is/types");
+var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
+var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
+function findAll(re, text) {
+  re.lastIndex = 0;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ topic: m[1], index: m.index });
+  }
+  return out;
+}
+function kafkaEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const make = (topic, edgeType) => {
+    const key = `${edgeType}|${topic}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    const line = lineOf(file.content, topic);
+    out.push({
+      infraId: (0, import_types10.infraId)("kafka-topic", topic),
+      name: topic,
+      kind: "kafka-topic",
+      edgeType,
+      evidence: {
+        file: import_node_path19.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  for (const { topic } of findAll(PRODUCER_TOPIC_RE, file.content)) make(topic, "PUBLISHES_TO");
+  for (const { topic } of findAll(CONSUMER_TOPIC_RE, file.content)) make(topic, "CONSUMES_FROM");
+  return out;
+}
+
+// src/extract/calls/redis.ts
+var import_node_path20 = __toESM(require("path"), 1);
+var import_types11 = require("@neat.is/types");
+var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
+function redisEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  REDIS_URL_RE.lastIndex = 0;
+  let m;
+  while ((m = REDIS_URL_RE.exec(file.content)) !== null) {
+    const host = m[1];
+    if (seen.has(host)) continue;
+    seen.add(host);
+    const line = lineOf(file.content, host);
+    out.push({
+      infraId: (0, import_types11.infraId)("redis", host),
+      name: host,
+      kind: "redis",
+      edgeType: "CALLS",
+      evidence: {
+        file: import_node_path20.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
+// src/extract/calls/aws.ts
+var import_node_path21 = __toESM(require("path"), 1);
+var import_types12 = require("@neat.is/types");
+var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
+var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
+function hasMarker(text, markers) {
+  return markers.some((m) => text.includes(m));
+}
+function findAll2(re, text) {
+  re.lastIndex = 0;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    out.push({ name: m[1], index: m.index });
+  }
+  return out;
+}
+function awsEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const make = (kind, name) => {
+    const key = `${kind}|${name}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    const line = lineOf(file.content, name);
+    out.push({
+      infraId: (0, import_types12.infraId)(kind, name),
+      name,
+      kind,
+      edgeType: "CALLS",
+      evidence: {
+        file: import_node_path21.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  if (hasMarker(file.content, ["S3Client", "PutObjectCommand", "GetObjectCommand", "DeleteObjectCommand"])) {
+    for (const { name } of findAll2(S3_BUCKET_RE, file.content)) make("s3-bucket", name);
+  }
+  if (hasMarker(file.content, [
+    "DynamoDBClient",
+    "DynamoDBDocumentClient",
+    "GetCommand",
+    "PutCommand",
+    "QueryCommand",
+    "UpdateCommand",
+    "DeleteCommand"
+  ])) {
+    for (const { name } of findAll2(DYNAMO_TABLE_RE, file.content)) make("dynamodb-table", name);
+  }
+  return out;
+}
+
+// src/extract/calls/grpc.ts
+var import_node_path22 = __toESM(require("path"), 1);
+var import_types13 = require("@neat.is/types");
+var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
+function isLikelyAddress(value) {
+  if (!value) return false;
+  return /:\d{2,5}$/.test(value) || value.includes(".");
+}
+function grpcEndpointsFromFile(file, serviceDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  GRPC_CLIENT_RE.lastIndex = 0;
+  let m;
+  while ((m = GRPC_CLIENT_RE.exec(file.content)) !== null) {
+    const symbol = m[1];
+    const addr = m[2]?.trim();
+    const name = isLikelyAddress(addr) ? addr : symbol;
+    if (seen.has(name)) continue;
+    seen.add(name);
+    const line = lineOf(file.content, m[0]);
+    out.push({
+      infraId: (0, import_types13.infraId)("grpc-service", name),
+      name,
+      kind: "grpc-service",
+      edgeType: "CALLS",
+      evidence: {
+        file: import_node_path22.default.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  }
+  return out;
+}
+
+// src/extract/calls/index.ts
+function edgeTypeFromEndpoint(ep) {
+  switch (ep.edgeType) {
+    case "PUBLISHES_TO":
+      return import_types14.EdgeType.PUBLISHES_TO;
+    case "CONSUMES_FROM":
+      return import_types14.EdgeType.CONSUMES_FROM;
+    default:
+      return import_types14.EdgeType.CALLS;
+  }
+}
+async function addExternalEndpointEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const endpoints = [];
+    for (const file of files) {
+      endpoints.push(...kafkaEndpointsFromFile(file, service.dir));
+      endpoints.push(...redisEndpointsFromFile(file, service.dir));
+      endpoints.push(...awsEndpointsFromFile(file, service.dir));
+      endpoints.push(...grpcEndpointsFromFile(file, service.dir));
+    }
+    if (endpoints.length === 0) continue;
+    const seenEdges = /* @__PURE__ */ new Set();
+    for (const ep of endpoints) {
+      if (!graph.hasNode(ep.infraId)) {
+        const node = {
+          id: ep.infraId,
+          type: import_types14.NodeType.InfraNode,
+          name: ep.name,
+          provider: ep.kind.startsWith("s3") || ep.kind.startsWith("dynamodb") ? "aws" : "self",
+          kind: ep.kind
+        };
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+      const edgeType = edgeTypeFromEndpoint(ep);
+      const edgeId = (0, import_types4.extractedEdgeId)(service.node.id, ep.infraId, edgeType);
+      if (seenEdges.has(edgeId)) continue;
+      seenEdges.add(edgeId);
+      if (!graph.hasEdge(edgeId)) {
+        const edge = {
+          id: edgeId,
+          source: service.node.id,
+          target: ep.infraId,
+          type: edgeType,
+          provenance: import_types14.Provenance.EXTRACTED,
+          evidence: ep.evidence
+        };
+        graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+async function addCallEdges(graph, services) {
+  const httpEdges = await addHttpCallEdges(graph, services);
+  const ext = await addExternalEndpointEdges(graph, services);
+  return {
+    nodesAdded: ext.nodesAdded,
+    edgesAdded: httpEdges + ext.edgesAdded
+  };
+}
+
+// src/extract/infra/docker-compose.ts
+var import_node_path23 = __toESM(require("path"), 1);
+var import_types16 = require("@neat.is/types");
+
+// src/extract/infra/shared.ts
+var import_types15 = require("@neat.is/types");
+function makeInfraNode(kind, name, provider = "self", extras) {
+  return {
+    id: (0, import_types15.infraId)(kind, name),
+    type: import_types15.NodeType.InfraNode,
+    name,
+    provider,
+    kind,
+    ...extras?.region ? { region: extras.region } : {}
+  };
+}
+function classifyImage(image) {
+  const lower = image.toLowerCase();
+  const repo = lower.split(":")[0];
+  const last = repo.split("/").pop() ?? repo;
+  if (last.startsWith("postgres")) return "postgres";
+  if (last.startsWith("mysql") || last.startsWith("mariadb")) return "mysql";
+  if (last.startsWith("mongo")) return "mongodb";
+  if (last.startsWith("redis")) return "redis";
+  if (last.startsWith("rabbitmq")) return "rabbitmq";
+  if (last.startsWith("kafka") || last.includes("kafka")) return "kafka";
+  if (last.startsWith("memcached")) return "memcached";
+  return "container";
+}
+
+// src/extract/infra/docker-compose.ts
+function dependsOnList(value) {
+  if (!value) return [];
+  if (Array.isArray(value)) return value;
+  return Object.keys(value);
+}
+function serviceNameToServiceNode(name, services) {
+  for (const s of services) {
+    if (s.node.name === name || import_node_path23.default.basename(s.dir) === name) return s.node.id;
+  }
+  return null;
+}
+async function addComposeInfra(graph, scanPath, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  let composePath = null;
+  for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
+    const abs = import_node_path23.default.join(scanPath, name);
+    if (await exists(abs)) {
+      composePath = abs;
+      break;
+    }
+  }
+  if (!composePath) return { nodesAdded, edgesAdded };
+  const compose = await readYaml(composePath);
+  if (!compose?.services) return { nodesAdded, edgesAdded };
+  const evidenceFile = import_node_path23.default.relative(scanPath, composePath).split(import_node_path23.default.sep).join("/");
+  const composeNameToNodeId = /* @__PURE__ */ new Map();
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const matchedServiceId = serviceNameToServiceNode(composeName, services);
+    if (matchedServiceId) {
+      composeNameToNodeId.set(composeName, matchedServiceId);
+      continue;
+    }
+    const kind = svc.image ? classifyImage(svc.image) : "container";
+    const node = makeInfraNode(kind, composeName);
+    if (!graph.hasNode(node.id)) {
+      graph.addNode(node.id, node);
+      nodesAdded++;
+    }
+    composeNameToNodeId.set(composeName, node.id);
+  }
+  for (const [composeName, svc] of Object.entries(compose.services)) {
+    const sourceId = composeNameToNodeId.get(composeName);
+    if (!sourceId) continue;
+    for (const dep of dependsOnList(svc.depends_on)) {
+      const targetId = composeNameToNodeId.get(dep);
+      if (!targetId) continue;
+      const edgeId = (0, import_types4.extractedEdgeId)(sourceId, targetId, import_types16.EdgeType.DEPENDS_ON);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: sourceId,
+        target: targetId,
+        type: import_types16.EdgeType.DEPENDS_ON,
+        provenance: import_types16.Provenance.EXTRACTED,
+        evidence: { file: evidenceFile }
+      };
+      graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/dockerfile.ts
+var import_node_path24 = __toESM(require("path"), 1);
+var import_node_fs12 = require("fs");
+var import_types17 = require("@neat.is/types");
+function runtimeImage(content) {
+  const lines = content.split("\n");
+  let last = null;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (!/^from\s+/i.test(line)) continue;
+    const tokens = line.split(/\s+/);
+    const image = tokens[1];
+    if (!image || image.toLowerCase() === "scratch") continue;
+    last = image;
+  }
+  return last;
+}
+async function addDockerfileRuntimes(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const dockerfilePath = import_node_path24.default.join(service.dir, "Dockerfile");
+    if (!await exists(dockerfilePath)) continue;
+    const content = await import_node_fs12.promises.readFile(dockerfilePath, "utf8");
+    const image = runtimeImage(content);
+    if (!image) continue;
+    const node = makeInfraNode("container-image", image);
+    if (!graph.hasNode(node.id)) {
+      graph.addNode(node.id, node);
+      nodesAdded++;
+    }
+    const edgeId = (0, import_types4.extractedEdgeId)(service.node.id, node.id, import_types17.EdgeType.RUNS_ON);
+    if (!graph.hasEdge(edgeId)) {
+      const edge = {
+        id: edgeId,
+        source: service.node.id,
+        target: node.id,
+        type: import_types17.EdgeType.RUNS_ON,
+        provenance: import_types17.Provenance.EXTRACTED,
+        evidence: {
+          file: import_node_path24.default.relative(scanPath, dockerfilePath).split(import_node_path24.default.sep).join("/")
+        }
+      };
+      graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/terraform.ts
+var import_node_fs13 = require("fs");
+var import_node_path25 = __toESM(require("path"), 1);
+var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+async function walkTfFiles(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await import_node_fs13.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry2 of entries) {
+    if (entry2.isDirectory()) {
+      if (IGNORED_DIRS.has(entry2.name) || entry2.name === ".terraform") continue;
+      out.push(...await walkTfFiles(import_node_path25.default.join(start, entry2.name), depth + 1, max));
+    } else if (entry2.isFile() && entry2.name.endsWith(".tf")) {
+      out.push(import_node_path25.default.join(start, entry2.name));
+    }
+  }
+  return out;
+}
+async function addTerraformResources(graph, scanPath) {
+  let nodesAdded = 0;
+  const files = await walkTfFiles(scanPath);
+  for (const file of files) {
+    const content = await import_node_fs13.promises.readFile(file, "utf8");
+    RESOURCE_RE.lastIndex = 0;
+    let m;
+    while ((m = RESOURCE_RE.exec(content)) !== null) {
+      const kind = m[1];
+      const name = m[2];
+      const node = makeInfraNode(kind, name, "aws");
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded: 0 };
+}
+
+// src/extract/infra/k8s.ts
+var import_node_fs14 = require("fs");
+var import_node_path26 = __toESM(require("path"), 1);
+var import_yaml3 = require("yaml");
+var K8S_KIND_TO_INFRA_KIND = {
+  Service: "k8s-service",
+  Deployment: "k8s-deployment",
+  StatefulSet: "k8s-statefulset",
+  DaemonSet: "k8s-daemonset",
+  CronJob: "k8s-cronjob",
+  Job: "k8s-job",
+  Ingress: "k8s-ingress"
+};
+async function walkYamlFiles2(start, depth = 0, max = 5) {
+  if (depth > max) return [];
+  const out = [];
+  const entries = await import_node_fs14.promises.readdir(start, { withFileTypes: true }).catch(() => []);
+  for (const entry2 of entries) {
+    if (entry2.isDirectory()) {
+      if (IGNORED_DIRS.has(entry2.name)) continue;
+      out.push(...await walkYamlFiles2(import_node_path26.default.join(start, entry2.name), depth + 1, max));
+    } else if (entry2.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path26.default.extname(entry2.name))) {
+      out.push(import_node_path26.default.join(start, entry2.name));
+    }
+  }
+  return out;
+}
+async function addK8sResources(graph, scanPath) {
+  let nodesAdded = 0;
+  const files = await walkYamlFiles2(scanPath);
+  for (const file of files) {
+    const content = await import_node_fs14.promises.readFile(file, "utf8");
+    let docs;
+    try {
+      docs = (0, import_yaml3.parseAllDocuments)(content).map((d) => d.toJSON());
+    } catch {
+      continue;
+    }
+    for (const doc of docs) {
+      if (!doc?.kind || !doc.metadata?.name) continue;
+      const infraKind = K8S_KIND_TO_INFRA_KIND[doc.kind];
+      if (!infraKind) continue;
+      const namespaced = doc.metadata.namespace ? `${doc.metadata.namespace}/${doc.metadata.name}` : doc.metadata.name;
+      const node = makeInfraNode(infraKind, namespaced, "kubernetes");
+      if (!graph.hasNode(node.id)) {
+        graph.addNode(node.id, node);
+        nodesAdded++;
+      }
+    }
+  }
+  return { nodesAdded, edgesAdded: 0 };
+}
+
+// src/extract/infra/index.ts
+async function addInfra(graph, scanPath, services) {
+  const compose = await addComposeInfra(graph, scanPath, services);
+  const dockerfile = await addDockerfileRuntimes(graph, services, scanPath);
+  const terraform = await addTerraformResources(graph, scanPath);
+  const k8s = await addK8sResources(graph, scanPath);
+  return {
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded
+  };
+}
+
+// src/extract/index.ts
+async function extractFromDirectory(graph, scanPath, opts = {}) {
+  await ensureCompatLoaded();
+  const services = await discoverServices(scanPath);
+  const phase1Nodes = addServiceNodes(graph, services);
+  await addServiceAliases(graph, scanPath, services);
+  const phase2 = await addDatabasesAndCompat(graph, services, scanPath);
+  const phase3 = await addConfigNodes(graph, services, scanPath);
+  const phase4 = await addCallEdges(graph, services);
+  const phase5 = await addInfra(graph, scanPath, services);
+  const frontiersPromoted = promoteFrontierNodes(graph);
+  if (opts.onPolicyTrigger) await opts.onPolicyTrigger(graph);
+  return {
+    nodesAdded: phase1Nodes + phase2.nodesAdded + phase3.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
+    edgesAdded: phase2.edgesAdded + phase3.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    frontiersPromoted
+  };
+}
+
+// src/persist.ts
+var import_node_fs15 = require("fs");
+var import_node_path27 = __toESM(require("path"), 1);
+var SCHEMA_VERSION = 2;
+function migrateV1ToV2(payload) {
+  const nodes = payload.graph.nodes;
+  if (Array.isArray(nodes)) {
+    for (const node of nodes) {
+      if (node.attributes && "pgDriverVersion" in node.attributes) {
+        delete node.attributes.pgDriverVersion;
+      }
+    }
+  }
+  return { ...payload, schemaVersion: 2 };
+}
+async function ensureDir(filePath) {
+  await import_node_fs15.promises.mkdir(import_node_path27.default.dirname(filePath), { recursive: true });
+}
+async function saveGraphToDisk(graph, outPath) {
+  await ensureDir(outPath);
+  const payload = {
+    schemaVersion: SCHEMA_VERSION,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: graph.export()
+  };
+  const tmp = `${outPath}.tmp`;
+  await import_node_fs15.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await import_node_fs15.promises.rename(tmp, outPath);
+}
+async function loadGraphFromDisk(graph, outPath) {
+  let raw;
+  try {
+    raw = await import_node_fs15.promises.readFile(outPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  let payload = JSON.parse(raw);
+  if (payload.schemaVersion === 1) {
+    payload = migrateV1ToV2(payload);
+  }
+  if (payload.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
+    );
+  }
+  graph.clear();
+  graph.import(payload.graph);
+}
+function startPersistLoop(graph, outPath, intervalMs = 6e4) {
+  let stopped = false;
+  const tick = async () => {
+    if (stopped) return;
+    try {
+      await saveGraphToDisk(graph, outPath);
+    } catch (err) {
+      console.error("persist: periodic save failed", err);
+    }
+  };
+  const interval = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  const onSignal = (signal) => {
+    void (async () => {
+      try {
+        await saveGraphToDisk(graph, outPath);
+      } catch (err) {
+        console.error(`persist: ${signal} save failed`, err);
+      } finally {
+        process.exit(0);
+      }
+    })();
+  };
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+    process.off("SIGTERM", onSignal);
+    process.off("SIGINT", onSignal);
+  };
+}
+
+// src/projects.ts
+var import_node_path28 = __toESM(require("path"), 1);
+function pathsForProject(project, baseDir) {
+  if (project === DEFAULT_PROJECT) {
+    return {
+      snapshotPath: import_node_path28.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path28.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path28.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path28.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path28.default.join(baseDir, "policy-violations.ndjson")
+    };
+  }
+  return {
+    snapshotPath: import_node_path28.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path28.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path28.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path28.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path28.default.join(baseDir, `policy-violations.${project}.ndjson`)
+  };
+}
+
+// src/registry.ts
+var import_node_fs16 = require("fs");
+var import_node_os2 = __toESM(require("os"), 1);
+var import_node_path29 = __toESM(require("path"), 1);
+var import_types18 = require("@neat.is/types");
+var LOCK_TIMEOUT_MS = 5e3;
+var LOCK_RETRY_MS = 50;
+function neatHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path29.default.resolve(override);
+  return import_node_path29.default.join(import_node_os2.default.homedir(), ".neat");
+}
+function registryPath() {
+  return import_node_path29.default.join(neatHome(), "projects.json");
+}
+function registryLockPath() {
+  return import_node_path29.default.join(neatHome(), "projects.json.lock");
+}
+async function writeAtomically(target, contents) {
+  await import_node_fs16.promises.mkdir(import_node_path29.default.dirname(target), { recursive: true });
+  const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await import_node_fs16.promises.open(tmp, "w");
+  try {
+    await fd.writeFile(contents, "utf8");
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await import_node_fs16.promises.rename(tmp, target);
+}
+async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  await import_node_fs16.promises.mkdir(import_node_path29.default.dirname(lockPath), { recursive: true });
+  while (true) {
+    try {
+      const fd = await import_node_fs16.promises.open(lockPath, "wx");
+      await fd.close();
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `neat registry: timed out after ${timeoutMs}ms waiting for ${lockPath}. Another neat process is holding the lock; if no such process exists, remove the file by hand.`
+        );
+      }
+      await new Promise((r) => setTimeout(r, LOCK_RETRY_MS));
+    }
+  }
+}
+async function releaseLock(lockPath) {
+  await import_node_fs16.promises.unlink(lockPath).catch(() => {
+  });
+}
+async function withLock(fn) {
+  const lock = registryLockPath();
+  await acquireLock(lock);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock(lock);
+  }
+}
+async function readRegistry() {
+  const file = registryPath();
+  let raw;
+  try {
+    raw = await import_node_fs16.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: 1, projects: [] };
+    }
+    throw err;
+  }
+  const parsed = JSON.parse(raw);
+  return import_types18.RegistryFileSchema.parse(parsed);
+}
+async function writeRegistry(reg) {
+  const validated = import_types18.RegistryFileSchema.parse(reg);
+  await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
+}
+async function listProjects() {
+  const reg = await readRegistry();
+  return reg.projects;
+}
+async function setStatus(name, status) {
+  return withLock(async () => {
+    const reg = await readRegistry();
+    const entry2 = reg.projects.find((p) => p.name === name);
+    if (!entry2) throw new Error(`neat registry: no project named "${name}"`);
+    entry2.status = status;
+    await writeRegistry(reg);
+    return entry2;
+  });
+}
+async function touchLastSeen(name, at = (/* @__PURE__ */ new Date()).toISOString()) {
+  await withLock(async () => {
+    const reg = await readRegistry();
+    const entry2 = reg.projects.find((p) => p.name === name);
+    if (!entry2) return;
+    entry2.lastSeenAt = at;
+    await writeRegistry(reg);
+  });
+}
+
+// src/daemon.ts
+function neatHomeFor(opts) {
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path30.default.resolve(opts.neatHome);
+  const env = process.env.NEAT_HOME;
+  if (env && env.length > 0) return import_node_path30.default.resolve(env);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return import_node_path30.default.join(home, ".neat");
+}
+async function bootstrapProject(entry2) {
+  try {
+    const stat = await import_node_fs17.promises.stat(entry2.path);
+    if (!stat.isDirectory()) {
+      throw new Error(`registered path ${entry2.path} is not a directory`);
+    }
+  } catch (err) {
+    await setStatus(entry2.name, "broken").catch(() => {
+    });
+    return {
+      entry: entry2,
+      // Empty graph is fine — `slots` keeps the entry visible in `status`
+      // output; nothing routes to it because it's not 'active'.
+      graph: getGraph(`__broken__:${entry2.name}`),
+      outPath: "",
+      stopPersist: () => {
+      },
+      status: "broken",
+      errorReason: err.message
+    };
+  }
+  resetGraph(entry2.name);
+  const graph = getGraph(entry2.name);
+  const outPath = pathsForProject(
+    entry2.name,
+    import_node_path30.default.join(entry2.path, "neat-out")
+  ).snapshotPath;
+  await loadGraphFromDisk(graph, outPath);
+  await extractFromDirectory(graph, entry2.path);
+  const stopPersist = startPersistLoop(graph, outPath);
+  await touchLastSeen(entry2.name).catch(() => {
+  });
+  return {
+    entry: entry2,
+    graph,
+    outPath,
+    stopPersist,
+    status: "active"
+  };
+}
+async function startDaemon(opts = {}) {
+  const home = neatHomeFor(opts);
+  const regPath = registryPath();
+  try {
+    await import_node_fs17.promises.access(regPath);
+  } catch {
+    throw new Error(
+      `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
+    );
+  }
+  const pidPath = import_node_path30.default.join(home, "neatd.pid");
+  await writeAtomically(pidPath, `${process.pid}
+`);
+  const slots = /* @__PURE__ */ new Map();
+  async function loadAll() {
+    const projects = await listProjects();
+    const seen = /* @__PURE__ */ new Set();
+    for (const entry2 of projects) {
+      seen.add(entry2.name);
+      if (slots.has(entry2.name)) continue;
+      try {
+        const slot = await bootstrapProject(entry2);
+        slots.set(entry2.name, slot);
+        if (slot.status === "broken") {
+          console.warn(`neatd: project "${entry2.name}" broken \u2014 ${slot.errorReason}`);
+        } else {
+          console.log(`neatd: project "${entry2.name}" active (${entry2.path})`);
+        }
+      } catch (err) {
+        console.warn(
+          `neatd: project "${entry2.name}" failed to bootstrap \u2014 ${err.message}`
+        );
+        await setStatus(entry2.name, "broken").catch(() => {
+        });
+      }
+    }
+    for (const [name, slot] of [...slots.entries()]) {
+      if (seen.has(name)) continue;
+      try {
+        slot.stopPersist();
+      } catch {
+      }
+      slots.delete(name);
+      console.log(`neatd: project "${name}" removed from registry \u2014 stopped`);
+    }
+  }
+  await loadAll();
+  let reloading = null;
+  const reload = async () => {
+    if (reloading) return reloading;
+    reloading = (async () => {
+      try {
+        await loadAll();
+      } finally {
+        reloading = null;
+      }
+    })();
+    return reloading;
+  };
+  const sighupHandler = () => {
+    void reload().catch((err) => {
+      console.warn(`neatd: SIGHUP reload failed \u2014 ${err.message}`);
+    });
+  };
+  process.on("SIGHUP", sighupHandler);
+  let stopped = false;
+  const stop = async () => {
+    if (stopped) return;
+    stopped = true;
+    process.off("SIGHUP", sighupHandler);
+    for (const slot of slots.values()) {
+      try {
+        slot.stopPersist();
+      } catch {
+      }
+    }
+    await import_node_fs17.promises.unlink(pidPath).catch(() => {
+    });
+  };
+  return { slots, reload, stop, pidPath };
+}
+
+// src/neatd.ts
+function neatHome2() {
+  if (process.env.NEAT_HOME && process.env.NEAT_HOME.length > 0) {
+    return import_node_path31.default.resolve(process.env.NEAT_HOME);
+  }
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return import_node_path31.default.join(home, ".neat");
+}
+async function readPid() {
+  try {
+    const raw = await import_node_fs18.promises.readFile(import_node_path31.default.join(neatHome2(), "neatd.pid"), "utf8");
+    const n = Number.parseInt(raw.trim(), 10);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+function usage() {
+  console.log("usage: neatd <start|stop|reload|status> [--foreground]");
+}
+async function cmdStart() {
+  const handle = await startDaemon();
+  console.log(`neatd: started, PID ${process.pid}, ${handle.slots.size} project(s)`);
+  console.log(`neatd: registry at ${registryPath()}`);
+  console.log("neatd: SIGHUP reloads, SIGTERM/SIGINT stops");
+  let stopping = false;
+  const shutdown = (signal) => {
+    if (stopping) return;
+    stopping = true;
+    console.log(`neatd: ${signal} received, stopping\u2026`);
+    void handle.stop().catch((err) => console.error(`neatd: shutdown error \u2014 ${err.message}`)).finally(() => process.exit(0));
+  };
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+  await new Promise(() => {
+  });
+}
+async function cmdStop() {
+  const pid = await readPid();
+  if (pid === null) {
+    console.error("neatd: no running daemon found (no PID file)");
+    process.exit(1);
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+    console.log(`neatd: SIGTERM sent to PID ${pid}`);
+  } catch (err) {
+    console.error(`neatd: failed to signal PID ${pid} \u2014 ${err.message}`);
+    process.exit(1);
+  }
+}
+async function cmdReload() {
+  const pid = await readPid();
+  if (pid === null) {
+    console.error("neatd: no running daemon found (no PID file)");
+    process.exit(1);
+  }
+  try {
+    process.kill(pid, "SIGHUP");
+    console.log(`neatd: SIGHUP sent to PID ${pid}`);
+  } catch (err) {
+    console.error(`neatd: failed to signal PID ${pid} \u2014 ${err.message}`);
+    process.exit(1);
+  }
+}
+async function cmdStatus() {
+  const pid = await readPid();
+  console.log(`pid:      ${pid ?? "(not running)"}`);
+  console.log(`registry: ${registryPath()}`);
+  const projects = await listProjects().catch(() => []);
+  if (projects.length === 0) {
+    console.log("projects: (none)");
+    return;
+  }
+  console.log("projects:");
+  for (const p of projects) {
+    const seen = p.lastSeenAt ?? "never";
+    console.log(`  ${p.name}	${p.status}	${p.path}	last-seen=${seen}`);
+  }
+}
+async function main() {
+  const cmd = process.argv[2];
+  if (!cmd || cmd === "-h" || cmd === "--help") {
+    usage();
+    process.exit(cmd ? 0 : 2);
+  }
+  if (cmd === "start") return cmdStart();
+  if (cmd === "stop") return cmdStop();
+  if (cmd === "reload") return cmdReload();
+  if (cmd === "status") return cmdStatus();
+  console.error(`neatd: unknown command "${cmd}"`);
+  usage();
+  process.exit(1);
+}
+var entry = process.argv[1] ?? "";
+if (/[\\/]neatd\.(?:cjs|js)$/.test(entry) || entry.endsWith("/neatd")) {
+  main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}
+//# sourceMappingURL=neatd.cjs.map