@neat.is/core 0.3.8 → 0.4.0

package/dist/cli.js

@@ -31,6 +31,7 @@ import {
   loadPolicyFile,
   makeErrorSpanWriter,
   makeSpanHandler,
+  normalizeProjectPath,
   pathsForProject,
   promoteFrontierNodes,
   removeProject,
@@ -40,17 +41,17 @@ import {
   setStatus,
   startPersistLoop,
   startStalenessLoop
-} from "./chunk-CZ3T6TE2.js";
+} from "./chunk-UPW4CMOH.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-V4TU7OKZ.js";
+} from "./chunk-IXIFJKMM.js";
 import {
   __require,
   buildOtelReceiver
-} from "./chunk-7TYESDAI.js";
+} from "./chunk-4V23KYOP.js";
 
 // src/cli.ts
-import path7 from "path";
+import path8 from "path";
 import { promises as fs7 } from "fs";
 
 // src/gitignore.ts
@@ -771,6 +772,100 @@ const sdk = new NodeSDK({
 })
 sdk.start()
 `;
+var FRAMEWORK_OTEL_INIT_HEADER = "// Generated by `neat init --apply` (ADR-074). OpenTelemetry SDK hook.";
+var FRAMEWORK_OTEL_INIT_TS_BODY = `${FRAMEWORK_OTEL_INIT_HEADER}
+// Loads .env.neat (OTEL_SERVICE_NAME, OTEL_EXPORTER_OTLP_ENDPOINT) before
+// the OTel SDK starts so the exporter target and service name are in scope.
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+import dotenv from 'dotenv'
+import { NodeSDK } from '@opentelemetry/sdk-node'
+import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+dotenv.config({ path: path.join(here, '.env.neat') })
+
+const sdk = new NodeSDK({
+  serviceName: process.env.OTEL_SERVICE_NAME,
+  instrumentations: [getNodeAutoInstrumentations()],
+})
+sdk.start()
+`;
+var FRAMEWORK_OTEL_INIT_JS_BODY = `${FRAMEWORK_OTEL_INIT_HEADER}
+// Loads .env.neat (OTEL_SERVICE_NAME, OTEL_EXPORTER_OTLP_ENDPOINT) before
+// the OTel SDK starts so the exporter target and service name are in scope.
+const path = require('node:path')
+try {
+  require('dotenv').config({ path: path.join(__dirname, '.env.neat') })
+} catch (err) {
+  // dotenv unavailable \u2014 fall through to process.env.
+}
+const { NodeSDK } = require('@opentelemetry/sdk-node')
+const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node')
+
+const sdk = new NodeSDK({
+  serviceName: process.env.OTEL_SERVICE_NAME,
+  instrumentations: [getNodeAutoInstrumentations()],
+})
+sdk.start()
+`;
+var REMIX_OTEL_SERVER_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var REMIX_OTEL_SERVER_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var SVELTEKIT_OTEL_INIT_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var SVELTEKIT_OTEL_INIT_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var SVELTEKIT_HOOKS_SERVER_TS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+import type { Handle } from '@sveltejs/kit'
+
+export const handle: Handle = async ({ event, resolve }) => {
+  return resolve(event)
+}
+`;
+var SVELTEKIT_HOOKS_SERVER_JS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+/** @type {import('@sveltejs/kit').Handle} */
+export const handle = async ({ event, resolve }) => {
+  return resolve(event)
+}
+`;
+var NUXT_OTEL_INIT_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var NUXT_OTEL_INIT_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var NUXT_OTEL_PLUGIN_TS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+export default defineNitroPlugin(() => {
+  // OTel SDK is initialised at module-load via the side-effect import above.
+})
+`;
+var NUXT_OTEL_PLUGIN_JS = `${FRAMEWORK_OTEL_INIT_HEADER}
+require('./otel-init')
+
+module.exports = defineNitroPlugin(() => {
+  // OTel SDK is initialised at module-load via the side-effect import above.
+})
+`;
+var ASTRO_OTEL_INIT_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var ASTRO_OTEL_INIT_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var ASTRO_MIDDLEWARE_TS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+import { defineMiddleware } from 'astro:middleware'
+
+export const onRequest = defineMiddleware(async (context, next) => {
+  return next()
+})
+`;
+var ASTRO_MIDDLEWARE_JS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+import { defineMiddleware } from 'astro:middleware'
+
+export const onRequest = defineMiddleware(async (context, next) => {
+  return next()
+})
+`;
 
 // src/installers/javascript.ts
 var SDK_PACKAGES = [
@@ -822,6 +917,71 @@ async function findNextConfig(serviceDir) {
 function hasNextDependency(pkg) {
   return pkg.dependencies?.next !== void 0 || pkg.devDependencies?.next !== void 0;
 }
+function allDeps(pkg) {
+  return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+}
+var REMIX_ENTRY_CANDIDATES = [
+  "app/entry.server.ts",
+  "app/entry.server.tsx",
+  "app/entry.server.js",
+  "app/entry.server.jsx"
+];
+function hasRemixDependency(pkg) {
+  const deps = allDeps(pkg);
+  if ("remix" in deps) return true;
+  for (const name of Object.keys(deps)) {
+    if (name.startsWith("@remix-run/")) return true;
+  }
+  return false;
+}
+async function findRemixEntry(serviceDir) {
+  for (const rel of REMIX_ENTRY_CANDIDATES) {
+    const candidate = path4.join(serviceDir, rel);
+    if (await exists(candidate)) return candidate;
+  }
+  return null;
+}
+var SVELTEKIT_HOOKS_CANDIDATES = ["src/hooks.server.ts", "src/hooks.server.js"];
+var SVELTEKIT_CONFIG_CANDIDATES = ["svelte.config.js", "svelte.config.ts"];
+function hasSvelteKitDependency(pkg) {
+  return "@sveltejs/kit" in allDeps(pkg);
+}
+async function findSvelteKitHooks(serviceDir) {
+  for (const rel of SVELTEKIT_HOOKS_CANDIDATES) {
+    const candidate = path4.join(serviceDir, rel);
+    if (await exists(candidate)) return candidate;
+  }
+  return null;
+}
+async function findSvelteKitConfig(serviceDir) {
+  for (const rel of SVELTEKIT_CONFIG_CANDIDATES) {
+    const candidate = path4.join(serviceDir, rel);
+    if (await exists(candidate)) return candidate;
+  }
+  return null;
+}
+var NUXT_CONFIG_CANDIDATES = ["nuxt.config.ts", "nuxt.config.js", "nuxt.config.mjs"];
+function hasNuxtDependency(pkg) {
+  return "nuxt" in allDeps(pkg);
+}
+async function findNuxtConfig(serviceDir) {
+  for (const name of NUXT_CONFIG_CANDIDATES) {
+    const candidate = path4.join(serviceDir, name);
+    if (await exists(candidate)) return candidate;
+  }
+  return null;
+}
+var ASTRO_CONFIG_CANDIDATES = ["astro.config.mjs", "astro.config.ts", "astro.config.js"];
+function hasAstroDependency(pkg) {
+  return "astro" in allDeps(pkg);
+}
+async function findAstroConfig(serviceDir) {
+  for (const name of ASTRO_CONFIG_CANDIDATES) {
+    const candidate = path4.join(serviceDir, name);
+    if (await exists(candidate)) return candidate;
+  }
+  return null;
+}
 function parseNextMajor(range) {
   if (!range) return null;
   const cleaned = range.trim().replace(/^[\^~>=<\s]+/, "");
@@ -1029,6 +1189,276 @@ async function planNext(serviceDir, pkg, manifestPath, nextConfigPath) {
     ...nextConfigEdit ? { nextConfigEdit } : {}
   };
 }
+function buildDependencyEdits(pkg, manifestPath) {
+  const existingDeps = allDeps(pkg);
+  const edits = [];
+  for (const sdk of SDK_PACKAGES) {
+    if (sdk.name in existingDeps) continue;
+    edits.push({
+      file: manifestPath,
+      kind: "add",
+      name: sdk.name,
+      version: sdk.version
+    });
+  }
+  return edits;
+}
+async function queueEnvNeat(serviceDir, pkg, generatedFiles) {
+  const envNeatFile = path4.join(serviceDir, ".env.neat");
+  if (!await exists(envNeatFile)) {
+    generatedFiles.push({
+      file: envNeatFile,
+      contents: renderEnvNeat(pkg.name ?? path4.basename(serviceDir)),
+      skipIfExists: true
+    });
+  }
+}
+function fileImportsOtelHook(raw, specifiers) {
+  const lines = raw.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    for (const spec of specifiers) {
+      const escaped = spec.replace(/\./g, "\\.");
+      const pattern = new RegExp(
+        `(?:import\\s+['"]${escaped}['"]|require\\(['"]${escaped}['"]\\))`
+      );
+      if (pattern.test(trimmed)) return true;
+    }
+  }
+  return false;
+}
+async function planRemix(serviceDir, pkg, manifestPath, entryFile) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelServerFile = path4.join(
+    serviceDir,
+    useTs ? "app/otel.server.ts" : "app/otel.server.js"
+  );
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  if (!await exists(otelServerFile)) {
+    generatedFiles.push({
+      file: otelServerFile,
+      contents: useTs ? REMIX_OTEL_SERVER_TS : REMIX_OTEL_SERVER_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, generatedFiles);
+  const entrypointEdits = [];
+  try {
+    const raw = await fs4.readFile(entryFile, "utf8");
+    if (!fileImportsOtelHook(raw, ["./otel.server"])) {
+      const lines = raw.split(/\r?\n/);
+      const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
+      entrypointEdits.push({
+        file: entryFile,
+        before: firstReal,
+        after: "import './otel.server'"
+      });
+    }
+  } catch {
+  }
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0 && entrypointEdits.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "remix"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits,
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "remix"
+  };
+}
+async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelInitFile = path4.join(
+    serviceDir,
+    useTs ? "src/otel-init.ts" : "src/otel-init.js"
+  );
+  const resolvedHooksFile = hooksFile ?? path4.join(serviceDir, useTs ? "src/hooks.server.ts" : "src/hooks.server.js");
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  const entrypointEdits = [];
+  if (!await exists(otelInitFile)) {
+    generatedFiles.push({
+      file: otelInitFile,
+      contents: useTs ? SVELTEKIT_OTEL_INIT_TS : SVELTEKIT_OTEL_INIT_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, generatedFiles);
+  if (hooksFile === null) {
+    generatedFiles.push({
+      file: resolvedHooksFile,
+      contents: useTs ? SVELTEKIT_HOOKS_SERVER_TS : SVELTEKIT_HOOKS_SERVER_JS,
+      skipIfExists: true
+    });
+  } else {
+    try {
+      const raw = await fs4.readFile(hooksFile, "utf8");
+      if (!fileImportsOtelHook(raw, ["./otel-init"])) {
+        const lines = raw.split(/\r?\n/);
+        const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
+        entrypointEdits.push({
+          file: hooksFile,
+          before: firstReal,
+          after: "import './otel-init'"
+        });
+      }
+    } catch {
+    }
+  }
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0 && entrypointEdits.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "sveltekit"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits,
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "sveltekit"
+  };
+}
+async function planNuxt(serviceDir, pkg, manifestPath) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelPluginFile = path4.join(
+    serviceDir,
+    useTs ? "server/plugins/otel.ts" : "server/plugins/otel.js"
+  );
+  const otelInitFile = path4.join(
+    serviceDir,
+    useTs ? "server/plugins/otel-init.ts" : "server/plugins/otel-init.js"
+  );
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  if (!await exists(otelInitFile)) {
+    generatedFiles.push({
+      file: otelInitFile,
+      contents: useTs ? NUXT_OTEL_INIT_TS : NUXT_OTEL_INIT_JS,
+      skipIfExists: true
+    });
+  }
+  if (!await exists(otelPluginFile)) {
+    generatedFiles.push({
+      file: otelPluginFile,
+      contents: useTs ? NUXT_OTEL_PLUGIN_TS : NUXT_OTEL_PLUGIN_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, generatedFiles);
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "nuxt"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits: [],
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "nuxt"
+  };
+}
+var ASTRO_MIDDLEWARE_CANDIDATES = ["src/middleware.ts", "src/middleware.js"];
+async function findAstroMiddleware(serviceDir) {
+  for (const rel of ASTRO_MIDDLEWARE_CANDIDATES) {
+    const candidate = path4.join(serviceDir, rel);
+    if (await exists(candidate)) return candidate;
+  }
+  return null;
+}
+async function planAstro(serviceDir, pkg, manifestPath) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelInitFile = path4.join(
+    serviceDir,
+    useTs ? "src/otel-init.ts" : "src/otel-init.js"
+  );
+  const existingMiddleware = await findAstroMiddleware(serviceDir);
+  const middlewareFile = existingMiddleware ?? path4.join(serviceDir, useTs ? "src/middleware.ts" : "src/middleware.js");
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  const entrypointEdits = [];
+  if (!await exists(otelInitFile)) {
+    generatedFiles.push({
+      file: otelInitFile,
+      contents: useTs ? ASTRO_OTEL_INIT_TS : ASTRO_OTEL_INIT_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, generatedFiles);
+  if (existingMiddleware === null) {
+    generatedFiles.push({
+      file: middlewareFile,
+      contents: useTs ? ASTRO_MIDDLEWARE_TS : ASTRO_MIDDLEWARE_JS,
+      skipIfExists: true
+    });
+  } else {
+    try {
+      const raw = await fs4.readFile(existingMiddleware, "utf8");
+      if (!fileImportsOtelHook(raw, ["./otel-init"])) {
+        const lines = raw.split(/\r?\n/);
+        const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
+        entrypointEdits.push({
+          file: existingMiddleware,
+          before: firstReal,
+          after: "import './otel-init'"
+        });
+      }
+    } catch {
+    }
+  }
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0 && entrypointEdits.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "astro"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits,
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "astro"
+  };
+}
 async function plan(serviceDir) {
   const pkg = await readPackageJson(serviceDir);
   const manifestPath = path4.join(serviceDir, "package.json");
@@ -1047,6 +1477,31 @@ async function plan(serviceDir) {
       return planNext(serviceDir, pkg, manifestPath, nextConfig);
     }
   }
+  if (hasRemixDependency(pkg)) {
+    const remixEntry = await findRemixEntry(serviceDir);
+    if (remixEntry) {
+      return planRemix(serviceDir, pkg, manifestPath, remixEntry);
+    }
+  }
+  if (hasSvelteKitDependency(pkg)) {
+    const hooks = await findSvelteKitHooks(serviceDir);
+    const config = await findSvelteKitConfig(serviceDir);
+    if (hooks || config) {
+      return planSvelteKit(serviceDir, pkg, manifestPath, hooks);
+    }
+  }
+  if (hasNuxtDependency(pkg)) {
+    const nuxtConfig = await findNuxtConfig(serviceDir);
+    if (nuxtConfig) {
+      return planNuxt(serviceDir, pkg, manifestPath);
+    }
+  }
+  if (hasAstroDependency(pkg)) {
+    const astroConfig = await findAstroConfig(serviceDir);
+    if (astroConfig) {
+      return planAstro(serviceDir, pkg, manifestPath);
+    }
+  }
   const entryFile = await resolveEntry(serviceDir, pkg);
   if (!entryFile) {
     return { ...empty, libOnly: true };
@@ -1119,9 +1574,18 @@ function isAllowedWritePath(serviceDir, target) {
   if (/^otel-init\.(?:js|cjs|mjs|ts)$/.test(base)) return true;
   if (/^instrumentation(?:\.node)?\.(?:js|cjs|mjs|ts)$/.test(base)) return true;
   if (/^next\.config\.(?:js|mjs|ts)$/.test(base)) return true;
+  const relPosix = rel.split(path4.sep).join("/");
+  if (relPosix === "app/otel.server.ts" || relPosix === "app/otel.server.js") return true;
+  if (/^app\/entry\.server\.(?:tsx?|jsx?)$/.test(relPosix)) return true;
+  if (relPosix === "src/otel-init.ts" || relPosix === "src/otel-init.js") return true;
+  if (relPosix === "src/hooks.server.ts" || relPosix === "src/hooks.server.js") return true;
+  if (relPosix === "server/plugins/otel.ts" || relPosix === "server/plugins/otel.js") return true;
+  if (relPosix === "server/plugins/otel-init.ts" || relPosix === "server/plugins/otel-init.js") return true;
+  if (relPosix === "src/middleware.ts" || relPosix === "src/middleware.js") return true;
   return false;
 }
 async function writeAtomic(file, contents) {
+  await fs4.mkdir(path4.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
   await fs4.writeFile(tmp, contents, "utf8");
   await fs4.rename(tmp, file);
@@ -1591,6 +2055,49 @@ import http from "http";
 import path6 from "path";
 import { spawn as spawn2 } from "child_process";
 import readline from "readline";
+async function extractAndPersist(opts) {
+  const services = await discoverServices(opts.scanPath);
+  const languages = [...new Set(services.map((s) => s.node.language))].sort();
+  const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
+  resetGraph(graphKey);
+  const graph = getGraph(graphKey);
+  const projectPaths = pathsForProject(graphKey, path6.join(opts.scanPath, "neat-out"));
+  const extraction = await extractFromDirectory(graph, opts.scanPath, {
+    errorsPath: projectPaths.errorsPath
+  });
+  if (!opts.dryRun) {
+    await saveGraphToDisk(graph, projectPaths.snapshotPath);
+  }
+  return {
+    graph,
+    graphKey,
+    services,
+    languages,
+    nodesAdded: extraction.nodesAdded,
+    edgesAdded: extraction.edgesAdded,
+    snapshotPath: projectPaths.snapshotPath,
+    errorsPath: projectPaths.errorsPath
+  };
+}
+async function applyInstallersOver(services) {
+  let instrumented = 0;
+  let already = 0;
+  let libOnly = 0;
+  for (const svc of services) {
+    const installer = await pickInstaller(svc.dir);
+    if (!installer) continue;
+    const plan3 = await installer.plan(svc.dir);
+    if (isEmptyPlan(plan3) && !plan3.libOnly) {
+      already++;
+      continue;
+    }
+    const outcome = await installer.apply(plan3);
+    if (outcome.outcome === "instrumented") instrumented++;
+    else if (outcome.outcome === "already-instrumented") already++;
+    else if (outcome.outcome === "lib-only") libOnly++;
+  }
+  return { instrumented, alreadyInstrumented: already, libOnly };
+}
 async function promptYesNo(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
@@ -1685,24 +2192,21 @@ async function runOrchestrator(opts) {
   }
   console.log(`neat: ${opts.scanPath}`);
   console.log("");
-  const services = await discoverServices(opts.scanPath);
-  const languages = [...new Set(services.map((s) => s.node.language))].sort();
+  const persisted = await extractAndPersist({
+    scanPath: opts.scanPath,
+    project: opts.project,
+    projectExplicit: opts.projectExplicit
+  });
+  const { graph, services, languages } = persisted;
   result.steps.discovery = { services: services.length, languages };
   console.log(`discovered ${services.length} service(s) across ${languages.length} language(s)`);
   let runApply = !opts.noInstrument;
   if (runApply && !opts.yes && process.stdout.isTTY && process.stdin.isTTY) {
     runApply = await promptYesNo("instrument your services and open the dashboard?");
   }
-  const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
-  resetGraph(graphKey);
-  const graph = getGraph(graphKey);
-  const projectPaths = pathsForProject(graphKey, path6.join(opts.scanPath, "neat-out"));
-  const errorsPath = projectPaths.errorsPath;
-  const extraction = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
-  await saveGraphToDisk(graph, projectPaths.snapshotPath);
   result.steps.extraction = {
-    nodesAdded: extraction.nodesAdded,
-    edgesAdded: extraction.edgesAdded
+    nodesAdded: persisted.nodesAdded,
+    edgesAdded: persisted.edgesAdded
   };
   const gi = await ensureNeatOutIgnored(opts.scanPath);
   result.steps.gitignore = gi.action;
@@ -1727,24 +2231,11 @@ async function runOrchestrator(opts) {
     result.steps.apply.skipped = true;
     console.log("skipped instrumentation (--no-instrument)");
   } else {
-    let instrumented = 0;
-    let already = 0;
-    let libOnly = 0;
-    for (const svc of services) {
-      const installer = await pickInstaller(svc.dir);
-      if (!installer) continue;
-      const plan3 = await installer.plan(svc.dir);
-      if (isEmptyPlan(plan3) && !plan3.libOnly) {
-        already++;
-        continue;
-      }
-      const outcome = await installer.apply(plan3);
-      if (outcome.outcome === "instrumented") instrumented++;
-      else if (outcome.outcome === "already-instrumented") already++;
-      else if (outcome.outcome === "lib-only") libOnly++;
-    }
-    result.steps.apply = { instrumented, alreadyInstrumented: already, libOnly, skipped: false };
-    console.log(`instrumented ${instrumented}, already ${already}, lib-only ${libOnly}`);
+    const tally = await applyInstallersOver(services);
+    result.steps.apply = { ...tally, skipped: false };
+    console.log(
+      `instrumented ${tally.instrumented}, already ${tally.alreadyInstrumented}, lib-only ${tally.libOnly}`
+    );
   }
   const restPort = Number(process.env.PORT ?? 8080);
   const timeoutMs = opts.daemonReadyTimeoutMs ?? DEFAULT_DAEMON_READY_TIMEOUT_MS;
@@ -1793,8 +2284,8 @@ function printSummary(result, graph, dashboardUrl) {
   console.log(`dashboard: ${dashboardUrl}`);
 }
 
-// src/cli.ts
-import { DivergenceTypeSchema } from "@neat.is/types";
+// src/cli-verbs.ts
+import path7 from "path";
 
 // src/cli-client.ts
 import { Provenance as Provenance2 } from "@neat.is/types";
@@ -1814,13 +2305,16 @@ var TransportError = class extends Error {
     this.name = "TransportError";
   }
 };
-function createHttpClient(baseUrl) {
+function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
+  const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path8) {
+    async get(path9) {
       let res;
       try {
-        res = await fetch(`${root}${path8}`);
+        res = await fetch(`${root}${path9}`, {
+          headers: { ...authHeader }
+        });
       } catch (err) {
         throw new TransportError(
           `cannot reach neat-core at ${root}: ${err.message}`
@@ -1830,18 +2324,18 @@ function createHttpClient(baseUrl) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path8}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path9}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path8, body) {
+    async post(path9, body) {
       let res;
       try {
-        res = await fetch(`${root}${path8}`, {
+        res = await fetch(`${root}${path9}`, {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
         });
       } catch (err) {
@@ -1853,7 +2347,7 @@ function createHttpClient(baseUrl) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path8}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path9}: ${text}`,
           text
         );
       }
@@ -1867,12 +2361,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path8 = projectPath(
+  const path9 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path8);
+    const result = await client.get(path9);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -1898,12 +2392,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path8 = projectPath(
+  const path9 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path8);
+    const result = await client.get(path9);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no downstream dependencies. Nothing else would break if it failed.`
@@ -1937,12 +2431,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path8 = projectPath(
+  const path9 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path8);
+    const result = await client.get(path9);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -2023,9 +2517,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path8 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path9 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path8);
+    const body = await client.get(path9);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -2291,8 +2785,181 @@ function exitCodeForError(err) {
   if (err instanceof HttpError) return 1;
   return 1;
 }
+function createSnapshotPushClient(baseUrl, token) {
+  return createHttpClient(baseUrl, token && token.length > 0 ? token : void 0);
+}
+async function pushSnapshotToRemote(input) {
+  const client = createSnapshotPushClient(input.baseUrl, input.token);
+  if (typeof client.post !== "function") {
+    throw new Error("HttpClient does not support POST \u2014 required for snapshot push");
+  }
+  return client.post(
+    `/projects/${encodeURIComponent(input.project)}/snapshot`,
+    { snapshot: input.snapshot }
+  );
+}
+
+// src/cli-verbs.ts
+async function resolveProjectEntry(opts) {
+  const entries = await listProjects();
+  if (opts.project) {
+    const match = entries.find((e) => e.name === opts.project);
+    return match ?? null;
+  }
+  const cwd = opts.cwd ?? process.cwd();
+  const resolvedCwd = await normalizeProjectPath(cwd);
+  for (const entry2 of entries) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path7.sep}`)) {
+      return entry2;
+    }
+  }
+  return null;
+}
+async function checkDaemonHealth2(baseUrl) {
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/health`, {
+      signal: AbortSignal.timeout(1500)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function snapshotForGraph(persisted) {
+  return {
+    schemaVersion: 3,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: persisted.graph.export()
+  };
+}
+function emitResult(result, json) {
+  if (json) {
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return;
+  }
+  const verb = result.mode === "dry-run" ? "dry-run" : result.mode === "remote" ? "pushed" : "synced";
+  console.log(
+    `${verb}: ${result.project} \u2014 ${result.nodesAdded} node(s) and ${result.edgesAdded} edge(s) added` + (result.snapshotPath ? `; snapshot at ${result.snapshotPath}` : "")
+  );
+  if (!result.apply.skipped) {
+    const { instrumented, alreadyInstrumented, libOnly } = result.apply;
+    console.log(
+      `instrumented ${instrumented}, already ${alreadyInstrumented}, lib-only ${libOnly}`
+    );
+  } else {
+    console.log("skipped instrumentation (--no-instrument)");
+  }
+  for (const warn of result.warnings) console.error(warn);
+}
+async function runSync(opts) {
+  const entry2 = await resolveProjectEntry(opts);
+  if (!entry2) {
+    const target = opts.project ?? opts.cwd ?? process.cwd();
+    console.error(
+      `neat sync: no registered project ${opts.project ? `named "${opts.project}"` : `covers ${target}`}. Run \`neat <path>\` or \`neat init <path>\` first.`
+    );
+    return {
+      exitCode: 1,
+      project: opts.project ?? "",
+      scanPath: target,
+      nodesAdded: 0,
+      edgesAdded: 0,
+      snapshotPath: null,
+      mode: opts.to ? "remote" : "local",
+      daemon: "skipped",
+      apply: { instrumented: 0, alreadyInstrumented: 0, libOnly: 0, skipped: true },
+      warnings: []
+    };
+  }
+  const persisted = await extractAndPersist({
+    scanPath: entry2.path,
+    project: entry2.name,
+    projectExplicit: true,
+    dryRun: true
+  });
+  let snapshotPath = null;
+  if (!opts.dryRun) {
+    const target = persisted.snapshotPath;
+    await saveGraphToDisk(persisted.graph, target);
+    snapshotPath = target;
+  }
+  const skipApply = opts.dryRun || opts.noInstrument;
+  const applyTally = skipApply ? { instrumented: 0, alreadyInstrumented: 0, libOnly: 0 } : await applyInstallersOver(persisted.services);
+  const warnings = [];
+  let daemonState = "skipped";
+  let exitCode = 0;
+  const mode = opts.dryRun ? "dry-run" : opts.to ? "remote" : "local";
+  if (!opts.dryRun) {
+    const snapshot = snapshotForGraph(persisted);
+    if (opts.to) {
+      const token = opts.token ?? process.env.NEAT_REMOTE_TOKEN;
+      try {
+        await pushSnapshotToRemote({
+          baseUrl: opts.to,
+          token,
+          project: entry2.name,
+          snapshot
+        });
+        daemonState = "remote-ok";
+      } catch (err) {
+        if (err instanceof HttpError) {
+          console.error(`neat sync: ${err.message}`);
+          exitCode = 1;
+        } else if (err instanceof TransportError) {
+          console.error(`neat sync: ${err.message}`);
+          exitCode = 3;
+        } else {
+          console.error(`neat sync: ${err.message}`);
+          exitCode = 1;
+        }
+        daemonState = "skipped";
+      }
+    } else {
+      const daemonUrl = opts.daemonUrl ?? process.env.NEAT_API_URL ?? "http://localhost:8080";
+      const healthy = await checkDaemonHealth2(daemonUrl);
+      if (healthy) {
+        try {
+          await pushSnapshotToRemote({
+            baseUrl: daemonUrl,
+            token: process.env.NEAT_AUTH_TOKEN,
+            project: entry2.name,
+            snapshot
+          });
+          daemonState = "reloaded";
+        } catch (err) {
+          warnings.push(
+            `neat sync: daemon merge failed \u2014 ${err.message}. Snapshot is on disk at ${snapshotPath}.`
+          );
+          daemonState = "down";
+          exitCode = 2;
+        }
+      } else {
+        warnings.push(
+          "neat sync: daemon not running; snapshot updated, run `neatd start` to serve it"
+        );
+        daemonState = "down";
+        exitCode = 2;
+      }
+    }
+  }
+  const result = {
+    exitCode,
+    project: entry2.name,
+    scanPath: entry2.path,
+    nodesAdded: persisted.nodesAdded,
+    edgesAdded: persisted.edgesAdded,
+    snapshotPath,
+    mode,
+    daemon: daemonState,
+    apply: { ...applyTally, skipped: skipApply },
+    warnings
+  };
+  emitResult(result, opts.json);
+  return result;
+}
 
 // src/cli.ts
+import { DivergenceTypeSchema } from "@neat.is/types";
 function usage() {
   console.log("usage: neat <command> [args] [--project <name>]");
   console.log("");
@@ -2320,6 +2987,15 @@ function usage() {
   console.log("  deploy         Detect the deploy substrate, generate NEAT_AUTH_TOKEN,");
   console.log("                 emit a docker-compose / systemd / docker run artifact, and");
   console.log("                 print the OTel env-vars block to paste into your platform.");
+  console.log("  sync           Re-run discovery, extraction, and SDK apply against the");
+  console.log("                 registered project, then notify the running daemon.");
+  console.log("                 Flags:");
+  console.log("                   --project <name>   target a registered project by name");
+  console.log("                   --to <url>         push the snapshot to a remote daemon");
+  console.log("                   --token <token>    bearer token for --to (or $NEAT_REMOTE_TOKEN)");
+  console.log("                   --dry-run          run extraction in-memory; do not write");
+  console.log("                   --no-instrument    skip the SDK install apply step");
+  console.log("                   --json             emit the delta summary as JSON");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  root-cause <node-id>             Walk inbound edges to find what broke first.");
@@ -2373,7 +3049,9 @@ var STRING_FLAGS = [
   ["--error-id", "errorId"],
   ["--hypothetical-action", "hypotheticalAction"],
   ["--type", "type"],
-  ["--min-confidence", "minConfidence"]
+  ["--min-confidence", "minConfidence"],
+  ["--to", "to"],
+  ["--token", "token"]
 ];
 function parseArgs(rest) {
   const positional = [];
@@ -2398,6 +3076,8 @@ function parseArgs(rest) {
     hypotheticalAction: null,
     type: null,
     minConfidence: null,
+    to: null,
+    token: null,
     positional: []
   };
   for (let i = 0; i < rest.length; i++) {
@@ -2544,12 +3224,12 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services);
   const patch = renderPatch(sections);
-  const patchPath = path7.join(opts.scanPath, "neat.patch");
+  const patchPath = path8.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
     await fs7.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = path7.join(opts.scanPath, ".gitignore");
+    const gitignorePath = path8.join(opts.scanPath, ".gitignore");
     const gitignoreExists = await fs7.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
@@ -2561,9 +3241,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    path7.join(opts.scanPath, "neat-out")
+    path8.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = path7.join(path7.dirname(opts.outPath), path7.basename(projectPaths.errorsPath));
+  const errorsPath = path8.join(path8.dirname(opts.outPath), path8.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -2653,9 +3333,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return path7.resolve(override);
+  if (override && override.length > 0) return path8.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path7.join(home, ".claude.json");
+  return path8.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -2679,7 +3359,7 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await fs7.mkdir(path7.dirname(target), { recursive: true });
+    await fs7.mkdir(path8.dirname(target), { recursive: true });
     await fs7.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
@@ -2714,12 +3394,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = path7.resolve(target);
+    const scanPath = path8.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : path7.basename(scanPath);
+    const projectName = projectExplicit ? project : path8.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, path7.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = path7.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, path8.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = path8.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -2740,21 +3420,21 @@ async function main() {
       usage();
       process.exit(2);
     }
-    const scanPath = path7.resolve(target);
+    const scanPath = path8.resolve(target);
     const stat = await fs7.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, path7.join(scanPath, "neat-out"));
-    const outPath = path7.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = path7.resolve(
-      process.env.NEAT_ERRORS_PATH ?? path7.join(path7.dirname(outPath), path7.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, path8.join(scanPath, "neat-out"));
+    const outPath = path8.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = path8.resolve(
+      process.env.NEAT_ERRORS_PATH ?? path8.join(path8.dirname(outPath), path8.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = path7.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? path7.join(path7.dirname(outPath), path7.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = path8.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? path8.join(path8.dirname(outPath), path8.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path7.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path8.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -2873,6 +3553,18 @@ async function main() {
     console.log(`  ${artifact.startCommand}`);
     return;
   }
+  if (cmd === "sync") {
+    const result = await runSync({
+      ...parsed.project ? { project: parsed.project } : {},
+      ...parsed.to ? { to: parsed.to } : {},
+      ...parsed.token ? { token: parsed.token } : {},
+      dryRun: parsed.dryRun,
+      noInstrument: parsed.noInstrument,
+      json: parsed.json
+    });
+    if (result.exitCode !== 0) process.exit(result.exitCode);
+    return;
+  }
   if (QUERY_VERBS.has(cmd)) {
     const code = await runQueryVerb(cmd, parsed);
     if (code !== 0) process.exit(code);
@@ -2888,11 +3580,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = path7.resolve(cmd);
+  const scanPath = path8.resolve(cmd);
   const stat = await fs7.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : path7.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : path8.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,