@neat.is/core 0.3.8 → 0.4.2

package/dist/cli.cjs

@@ -47,14 +47,19 @@ function mountBearerAuth(app, opts) {
   if (opts.trustProxy) return;
   const expected = Buffer.from(opts.token, "utf8");
   const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path44 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    const path45 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
     for (const suffix of suffixes) {
-      if (path44 === suffix || path44.endsWith(suffix)) {
+      if (path45 === suffix || path45.endsWith(suffix)) {
         done();
         return;
       }
     }
+    if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
+      done();
+      return;
+    }
     const header = req.headers.authorization;
     if (typeof header !== "string" || !header.startsWith("Bearer ")) {
       void reply.code(401).send({ error: "unauthorized" });
@@ -68,13 +73,19 @@ function mountBearerAuth(app, opts) {
     done();
   });
 }
-var import_node_crypto, DEFAULT_UNAUTH_SUFFIXES;
+var import_node_crypto, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_crypto = require("crypto");
-    DEFAULT_UNAUTH_SUFFIXES = ["/health", "/healthz", "/readyz"];
+    PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+    DEFAULT_UNAUTH_SUFFIXES = [
+      "/health",
+      "/healthz",
+      "/readyz",
+      "/api/config"
+    ];
   }
 });
 
@@ -277,6 +288,15 @@ function isoFromUnixNano(nanos) {
     return void 0;
   }
 }
+function pickEnv(spanAttrs, resourceAttrs) {
+  for (const attrs of [spanAttrs, resourceAttrs]) {
+    for (const key of [ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT]) {
+      const v = attrs[key];
+      if (typeof v === "string" && v.length > 0) return v;
+    }
+  }
+  return ENV_FALLBACK;
+}
 function parseOtlpRequest(body) {
   const out = [];
   for (const rs of body.resourceSpans ?? []) {
@@ -296,6 +316,7 @@ function parseOtlpRequest(body) {
           endTimeUnixNano: span.endTimeUnixNano ?? "0",
           startTimeIso: isoFromUnixNano(span.startTimeUnixNano),
           durationNanos: durationNanos(span.startTimeUnixNano, span.endTimeUnixNano),
+          env: pickEnv(attrs, resourceAttrs),
           attributes: attrs,
           dbSystem: typeof attrs["db.system"] === "string" ? attrs["db.system"] : void 0,
           dbName: typeof attrs["db.name"] === "string" ? attrs["db.name"] : void 0,
@@ -434,7 +455,7 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path36, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+var import_node_path36, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
@@ -444,6 +465,9 @@ var init_otel = __esm({
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
     init_auth();
+    ENV_ATTR_CANONICAL = "deployment.environment.name";
+    ENV_ATTR_COMPAT = "deployment.environment";
+    ENV_FALLBACK = "unknown";
     exportTraceServiceRequestType = null;
     exportTraceServiceResponseType = null;
     cachedProtobufResponseBody = null;
@@ -456,14 +480,16 @@ __export(cli_exports, {
   CLAUDE_SKILL_CONFIG: () => CLAUDE_SKILL_CONFIG,
   QUERY_VERBS: () => QUERY_VERBS,
   parseArgs: () => parseArgs,
+  readPackageVersion: () => readPackageVersion,
   runInit: () => runInit,
   runQueryVerb: () => runQueryVerb,
   runSkill: () => runSkill
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path43 = __toESM(require("path"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 var import_node_fs28 = require("fs");
+var import_node_url3 = require("url");
 
 // src/graph.ts
 init_cjs_shims();
@@ -973,19 +999,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path44, edges) {
-    if (path44.length > best.path.length) {
-      best = { path: [...path44], edges: [...edges] };
+  function step(node, path45, edges) {
+    if (path45.length > best.path.length) {
+      best = { path: [...path45], edges: [...edges] };
     }
-    if (path44.length - 1 >= maxDepth) return;
+    if (path45.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path44.push(srcId);
+      path45.push(srcId);
       edges.push(edge);
-      step(srcId, path44, edges);
-      path44.pop();
+      step(srcId, path45, edges);
+      path45.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1558,52 +1584,64 @@ function cacheSpanService(span, now) {
   if (!span.traceId || !span.spanId) return;
   const key = parentSpanKey(span.traceId, span.spanId);
   parentSpanCache.delete(key);
-  parentSpanCache.set(key, { service: span.service, expiresAt: now + PARENT_SPAN_CACHE_TTL_MS });
+  parentSpanCache.set(key, {
+    service: span.service,
+    env: span.env ?? "unknown",
+    expiresAt: now + PARENT_SPAN_CACHE_TTL_MS
+  });
   while (parentSpanCache.size > PARENT_SPAN_CACHE_SIZE) {
     const oldest = parentSpanCache.keys().next().value;
     if (!oldest) break;
     parentSpanCache.delete(oldest);
   }
 }
-function lookupParentSpanService(traceId, parentSpanId, now) {
+function lookupParentSpan(traceId, parentSpanId, now) {
   const entry2 = parentSpanCache.get(parentSpanKey(traceId, parentSpanId));
   if (!entry2) return null;
   if (entry2.expiresAt <= now) {
     parentSpanCache.delete(parentSpanKey(traceId, parentSpanId));
     return null;
   }
-  return entry2.service;
+  return { service: entry2.service, env: entry2.env };
 }
-function resolveServiceId(graph, host) {
-  const direct = (0, import_types3.serviceId)(host);
-  if (graph.hasNode(direct)) return direct;
-  let found = null;
+function resolveServiceId(graph, host, env) {
+  const envTagged = (0, import_types3.serviceId)(host, env);
+  if (graph.hasNode(envTagged)) return envTagged;
+  const envLess = (0, import_types3.serviceId)(host);
+  if (envLess !== envTagged && graph.hasNode(envLess)) return envLess;
+  let sameEnv = null;
+  let envLessMatch = null;
+  let anyMatch = null;
   graph.forEachNode((id, attrs) => {
-    if (found) return;
+    if (sameEnv) return;
     const a = attrs;
     if (a.type !== import_types3.NodeType.ServiceNode) return;
-    if (a.name === host) {
-      found = id;
+    const matchesByName = a.name === host;
+    const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
+    if (!matchesByName && !matchesByAlias) return;
+    const nodeEnv = a.env ?? "unknown";
+    if (nodeEnv === env) {
+      sameEnv = id;
       return;
     }
-    if (a.aliases && a.aliases.includes(host)) {
-      found = id;
-    }
+    if (nodeEnv === "unknown" && !envLessMatch) envLessMatch = id;
+    else if (!anyMatch) anyMatch = id;
   });
-  return found;
+  return sameEnv ?? envLessMatch ?? anyMatch;
 }
 function frontierIdFor(host) {
   return (0, import_types3.frontierId)(host);
 }
-function ensureServiceNode(graph, serviceName) {
-  const id = (0, import_types3.serviceId)(serviceName);
+function ensureServiceNode(graph, serviceName, env) {
+  const id = (0, import_types3.serviceId)(serviceName, env);
   if (graph.hasNode(id)) return id;
   const node = {
     id,
     type: import_types3.NodeType.ServiceNode,
     name: serviceName,
     language: "unknown",
-    discoveredVia: "otel"
+    discoveredVia: "otel",
+    ...env !== "unknown" ? { env } : {}
   };
   graph.addNode(id, node);
   return id;
@@ -1749,7 +1787,7 @@ function buildErrorEventForReceiver(span) {
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: (0, import_types3.serviceId)(span.service)
+    affectedNode: (0, import_types3.serviceId)(span.service, span.env)
   };
 }
 function makeErrorSpanWriter(errorsPath) {
@@ -1763,7 +1801,8 @@ function makeErrorSpanWriter(errorsPath) {
 async function handleSpan(ctx, span) {
   const ts = span.startTimeIso ?? nowIso(ctx);
   const nowMs = ctx.now ? ctx.now() : Date.now();
-  const sourceId = ensureServiceNode(ctx.graph, span.service);
+  const env = span.env ?? "unknown";
+  const sourceId = ensureServiceNode(ctx.graph, span.service, env);
   const isError = span.statusCode === 2;
   cacheSpanService(span, nowMs);
   let affectedNode = sourceId;
@@ -1786,7 +1825,7 @@ async function handleSpan(ctx, span) {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
     if (host && host !== span.service) {
-      const targetId = resolveServiceId(ctx.graph, host);
+      const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
@@ -1813,9 +1852,9 @@ async function handleSpan(ctx, span) {
       }
     }
     if (!resolvedViaAddress && span.parentSpanId) {
-      const parentService = lookupParentSpanService(span.traceId, span.parentSpanId, nowMs);
-      if (parentService && parentService !== span.service) {
-        const parentId = ensureServiceNode(ctx.graph, parentService);
+      const parent = lookupParentSpan(span.traceId, span.parentSpanId, nowMs);
+      if (parent && parent.service !== span.service) {
+        const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         upsertObservedEdge(
           ctx.graph,
           import_types3.EdgeType.CALLS,
@@ -2011,6 +2050,28 @@ async function readErrorEvents(errorsPath) {
     throw err;
   }
 }
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of exported.nodes ?? []) {
+    if (graph.hasNode(node.key)) continue;
+    if (!node.attributes) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of exported.edges ?? []) {
+    const attrs = edge.attributes;
+    if (!attrs) continue;
+    const id = edge.key ?? attrs.id;
+    if (!id) continue;
+    if (graph.hasEdge(id)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/services.ts
 init_cjs_shims();
@@ -2034,8 +2095,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   ".turbo",
   "dist",
   "build",
-  ".next"
+  ".next",
+  // Python virtualenv shapes (issue #344). Walking into a venv pulls in the
+  // entire CPython stdlib + every installed package as if it were first-party
+  // service code — 20k+ files, none of which the user wrote. The shape names
+  // cover the three common venv tools (`venv` / `python -m venv`,
+  // `virtualenv`) and the tox + PEP 582 conventions.
+  ".venv",
+  "venv",
+  "__pypackages__",
+  ".tox",
+  // `site-packages` shows up nested inside venvs that don't carry one of the
+  // outer names (system Python on macOS, in-place pyenv layouts). Listing it
+  // here means we stop the walk at the boundary even when the wrapper dir
+  // wasn't recognisable.
+  "site-packages"
 ]);
+var PYVENV_MARKER_CACHE = /* @__PURE__ */ new Map();
+async function isPythonVenvDir(dir) {
+  const cached = PYVENV_MARKER_CACHE.get(dir);
+  if (cached !== void 0) return cached;
+  try {
+    const stat = await import_node_fs4.promises.stat(import_node_path4.default.join(dir, "pyvenv.cfg"));
+    const ok = stat.isFile();
+    PYVENV_MARKER_CACHE.set(dir, ok);
+    return ok;
+  } catch {
+    PYVENV_MARKER_CACHE.set(dir, false);
+    return false;
+  }
+}
 function isConfigFile(name) {
   const ext = import_node_path4.default.extname(name);
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
@@ -2384,6 +2473,7 @@ async function walkDirs(start, scanPath, options, visit) {
         const rel = import_node_path8.default.relative(scanPath, child).split(import_node_path8.default.sep).join("/");
         if (rel && options.ig.ignores(rel + "/")) continue;
       }
+      if (await isPythonVenvDir(child)) continue;
       await visit(child);
       await recurse(child, depth + 1);
     }
@@ -2419,6 +2509,18 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   }
   return [...found];
 }
+function detectJsFramework(pkg) {
+  const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+  if (deps["next"] !== void 0) return "next";
+  if (deps["remix"] !== void 0) return "remix";
+  for (const k of Object.keys(deps)) {
+    if (k.startsWith("@remix-run/")) return "remix";
+  }
+  if (deps["@sveltejs/kit"] !== void 0) return "sveltekit";
+  if (deps["nuxt"] !== void 0) return "nuxt";
+  if (deps["astro"] !== void 0) return "astro";
+  return void 0;
+}
 async function discoverNodeService(scanPath, dir) {
   const pkgPath = import_node_path8.default.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
@@ -2430,6 +2532,7 @@ async function discoverNodeService(scanPath, dir) {
     return null;
   }
   if (!pkg.name) return null;
+  const framework = detectJsFramework(pkg);
   const node = {
     id: (0, import_types5.serviceId)(pkg.name),
     type: import_types5.NodeType.ServiceNode,
@@ -2438,7 +2541,8 @@ async function discoverNodeService(scanPath, dir) {
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
     repoPath: import_node_path8.default.relative(scanPath, dir),
-    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {}
+    ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
+    ...framework ? { framework } : {}
   };
   return { pkg, dir, node };
 }
@@ -2648,7 +2752,9 @@ async function walkYamlFiles(start, depth = 0, max = 5) {
   for (const entry2 of entries) {
     if (entry2.isDirectory()) {
       if (IGNORED_DIRS.has(entry2.name)) continue;
-      out.push(...await walkYamlFiles(import_node_path9.default.join(start, entry2.name), depth + 1, max));
+      const child = import_node_path9.default.join(start, entry2.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkYamlFiles(child, depth + 1, max));
     } else if (entry2.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path9.default.extname(entry2.name))) {
       out.push(import_node_path9.default.join(start, entry2.name));
     }
@@ -3330,7 +3436,9 @@ async function walkConfigFiles(dir) {
     for (const entry2 of entries) {
       const full = import_node_path18.default.join(current, entry2.name);
       if (entry2.isDirectory()) {
-        if (!IGNORED_DIRS.has(entry2.name)) await walk(full);
+        if (IGNORED_DIRS.has(entry2.name)) continue;
+        if (await isPythonVenvDir(full)) continue;
+        await walk(full);
       } else if (entry2.isFile() && isConfigFile(entry2.name).match) {
         out.push(full);
       }
@@ -3398,7 +3506,9 @@ async function walkSourceFiles(dir) {
     for (const entry2 of entries) {
       const full = import_node_path19.default.join(current, entry2.name);
       if (entry2.isDirectory()) {
-        if (!IGNORED_DIRS.has(entry2.name)) await walk(full);
+        if (IGNORED_DIRS.has(entry2.name)) continue;
+        if (await isPythonVenvDir(full)) continue;
+        await walk(full);
       } else if (entry2.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path19.default.extname(entry2.name))) {
         out.push(full);
       }
@@ -4034,7 +4144,9 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   for (const entry2 of entries) {
     if (entry2.isDirectory()) {
       if (IGNORED_DIRS.has(entry2.name) || entry2.name === ".terraform") continue;
-      out.push(...await walkTfFiles(import_node_path27.default.join(start, entry2.name), depth + 1, max));
+      const child = import_node_path27.default.join(start, entry2.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry2.isFile() && entry2.name.endsWith(".tf")) {
       out.push(import_node_path27.default.join(start, entry2.name));
     }
@@ -4082,7 +4194,9 @@ async function walkYamlFiles2(start, depth = 0, max = 5) {
   for (const entry2 of entries) {
     if (entry2.isDirectory()) {
       if (IGNORED_DIRS.has(entry2.name)) continue;
-      out.push(...await walkYamlFiles2(import_node_path28.default.join(start, entry2.name), depth + 1, max));
+      const child = import_node_path28.default.join(start, entry2.name);
+      if (await isPythonVenvDir(child)) continue;
+      out.push(...await walkYamlFiles2(child, depth + 1, max));
     } else if (entry2.isFile() && CONFIG_FILE_EXTENSIONS.has(import_node_path28.default.extname(entry2.name))) {
       out.push(import_node_path28.default.join(start, entry2.name));
     }
@@ -4470,7 +4584,7 @@ init_cjs_shims();
 var import_node_fs18 = require("fs");
 var import_node_path31 = __toESM(require("path"), 1);
 var import_types20 = require("@neat.is/types");
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
   if (Array.isArray(nodes)) {
@@ -4482,6 +4596,9 @@ function migrateV1ToV2(payload) {
   }
   return { ...payload, schemaVersion: 2 };
 }
+function migrateV3ToV4(payload) {
+  return { ...payload, schemaVersion: 4 };
+}
 function migrateV2ToV3(payload) {
   const edges = payload.graph.edges;
   if (Array.isArray(edges)) {
@@ -4530,6 +4647,9 @@ async function loadGraphFromDisk(graph, outPath) {
   if (payload.schemaVersion === 2) {
     payload = migrateV2ToV3(payload);
   }
+  if (payload.schemaVersion === 3) {
+    payload = migrateV3ToV4(payload);
+  }
   if (payload.schemaVersion !== SCHEMA_VERSION) {
     throw new Error(
       `persist: unsupported snapshot schemaVersion ${payload.schemaVersion} (expected ${SCHEMA_VERSION})`
@@ -5076,10 +5196,19 @@ function projectFromReq(req) {
   const params = req.params;
   return params.project ?? DEFAULT_PROJECT;
 }
-function resolveProject(registry, req, reply) {
+function resolveProject(registry, req, reply, bootstrap) {
   const name = projectFromReq(req);
   const ctx = registry.get(name);
   if (!ctx) {
+    const phase = bootstrap?.status(name);
+    if (phase === "bootstrapping") {
+      void reply.code(503).send({ ready: false, project: name, status: "bootstrapping" });
+      return null;
+    }
+    if (phase === "broken") {
+      void reply.code(503).send({ ready: false, project: name, status: "broken" });
+      return null;
+    }
     void reply.code(404).send({ error: "project not found", project: name });
     return null;
   }
@@ -5109,36 +5238,38 @@ function buildLegacyRegistry(opts) {
 function registerRoutes(scope, ctx) {
   const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
   scope.get("/events", (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     handleSse(req, reply, { project: proj.name });
   });
-  scope.get("/health", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
-    if (!proj) return;
-    const uptimeMs = Date.now() - startedAt;
-    return {
-      ok: true,
-      project: proj.name,
-      uptimeMs,
-      // Legacy fields kept additively. The web shell's StatusBar reads
-      // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
-      // the canonical triple and lets the extras pass through.
-      uptime: Math.floor(uptimeMs / 1e3),
-      nodeCount: proj.graph.order,
-      edgeCount: proj.graph.size,
-      lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  });
+  if (ctx.scope === "project") {
+    scope.get("/health", async (req, reply) => {
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
+      if (!proj) return;
+      const uptimeMs = Date.now() - startedAt;
+      return {
+        ok: true,
+        project: proj.name,
+        uptimeMs,
+        // Legacy fields kept additively. The web shell's StatusBar reads
+        // nodeCount / edgeCount; ADR-061's HealthResponseSchema validates
+        // the canonical triple and lets the extras pass through.
+        uptime: Math.floor(uptimeMs / 1e3),
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size,
+        lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    });
+  }
   scope.get("/graph", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     return serializeGraph(proj.graph);
   });
   scope.get(
     "/graph/node/:id",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const { id } = req.params;
       if (!proj.graph.hasNode(id)) {
@@ -5150,7 +5281,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/graph/edges/:id",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const { id } = req.params;
       if (!proj.graph.hasNode(id)) {
@@ -5162,7 +5293,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.get("/graph/dependencies/:nodeId", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -5177,7 +5308,7 @@ function registerRoutes(scope, ctx) {
     return getTransitiveDependencies(proj.graph, nodeId, depth);
   });
   scope.get("/graph/divergences", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     let typeFilter;
     if (req.query.type) {
@@ -5212,7 +5343,7 @@ function registerRoutes(scope, ctx) {
     });
   });
   scope.get("/incidents", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const epath = errorsPathFor(proj);
     if (!epath) return { count: 0, total: 0, events: [] };
@@ -5224,7 +5355,7 @@ function registerRoutes(scope, ctx) {
     return { count: sliced.length, total, events: sliced };
   });
   scope.get("/stale-events", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const spath = staleEventsPathFor(proj);
     if (!spath) return { count: 0, total: 0, events: [] };
@@ -5239,7 +5370,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/incidents/:nodeId",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const { nodeId } = req.params;
       if (!proj.graph.hasNode(nodeId)) {
@@ -5255,7 +5386,7 @@ function registerRoutes(scope, ctx) {
     }
   );
   scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -5275,7 +5406,7 @@ function registerRoutes(scope, ctx) {
     return result;
   });
   scope.get("/graph/blast-radius/:nodeId", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const { nodeId } = req.params;
     if (!proj.graph.hasNode(nodeId)) {
@@ -5288,7 +5419,7 @@ function registerRoutes(scope, ctx) {
     return getBlastRadius(proj.graph, nodeId, depth);
   });
   scope.get("/search", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const raw = (req.query.q ?? "").trim();
     if (!raw) return reply.code(400).send({ error: "query parameter `q` is required" });
@@ -5319,7 +5450,7 @@ function registerRoutes(scope, ctx) {
   scope.get(
     "/graph/diff",
     async (req, reply) => {
-      const proj = resolveProject(registry, req, reply);
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap);
       if (!proj) return;
       const against = req.query.against;
       if (!against) {
@@ -5333,8 +5464,37 @@ function registerRoutes(scope, ctx) {
       }
     }
   );
+  scope.post("/snapshot", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
+    if (!proj) return;
+    const body = req.body;
+    if (!body || typeof body !== "object" || !body.snapshot) {
+      return reply.code(400).send({ error: "request body must be { snapshot: <persisted-graph> }" });
+    }
+    const snap = body.snapshot;
+    if (typeof snap.schemaVersion !== "number" || snap.schemaVersion !== SCHEMA_VERSION) {
+      return reply.code(400).send({
+        error: `unsupported snapshot schemaVersion ${snap.schemaVersion} (expected ${SCHEMA_VERSION})`
+      });
+    }
+    try {
+      const result = mergeSnapshot(proj.graph, snap);
+      return {
+        project: proj.name,
+        nodesAdded: result.nodesAdded,
+        edgesAdded: result.edgesAdded,
+        nodeCount: proj.graph.order,
+        edgeCount: proj.graph.size
+      };
+    } catch (err) {
+      return reply.code(400).send({
+        error: "snapshot merge failed",
+        details: err.message
+      });
+    }
+  });
   scope.post("/graph/scan", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     if (!proj.scanPath) {
       return reply.code(409).send({ error: "scan path not configured for this project", project: proj.name });
@@ -5350,7 +5510,7 @@ function registerRoutes(scope, ctx) {
     };
   });
   scope.get("/policies", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const policyPath = ctx.policyFilePathFor(proj);
     if (!policyPath) {
@@ -5367,7 +5527,7 @@ function registerRoutes(scope, ctx) {
     }
   });
   scope.get("/policies/violations", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
@@ -5387,7 +5547,7 @@ function registerRoutes(scope, ctx) {
     return { violations };
   });
   scope.post("/policies/check", async (req, reply) => {
-    const proj = resolveProject(registry, req, reply);
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap);
     if (!proj) return;
     const parsed = import_types23.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
@@ -5426,7 +5586,15 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
-  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
+  mountBearerAuth(app, {
+    token: opts.authToken,
+    trustProxy: opts.trustProxy,
+    publicRead: opts.publicRead
+  });
+  app.get("/api/config", async () => ({
+    publicRead: opts.publicRead === true,
+    authProxy: opts.trustProxy === true
+  }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -5450,10 +5618,36 @@ async function buildApi(opts) {
   const routeCtx = {
     registry,
     startedAt,
+    scope: "root",
     errorsPathFor,
     staleEventsPathFor,
-    policyFilePathFor
+    policyFilePathFor,
+    bootstrap: opts.bootstrap
   };
+  app.get("/health", async () => {
+    const uptimeMs = Date.now() - startedAt;
+    const bootstrapList = opts.bootstrap?.list() ?? [];
+    const byName = new Map(bootstrapList.map((p) => [p.name, p]));
+    const names = /* @__PURE__ */ new Set([
+      ...registry.list(),
+      ...bootstrapList.map((p) => p.name)
+    ]);
+    const projects = [...names].sort().map((name) => {
+      const proj = registry.get(name);
+      const tracked = byName.get(name);
+      return {
+        name,
+        nodeCount: proj?.graph.order ?? 0,
+        edgeCount: proj?.graph.size ?? 0,
+        ...tracked ? { status: tracked.status, elapsedMs: tracked.elapsedMs } : {}
+      };
+    });
+    return {
+      ok: true,
+      uptimeMs,
+      projects
+    };
+  });
   app.get("/projects", async (_req, reply) => {
     try {
       return await listProjects();
@@ -5481,7 +5675,7 @@ async function buildApi(opts) {
   registerRoutes(app, routeCtx);
   await app.register(
     async (scope) => {
-      registerRoutes(scope, routeCtx);
+      registerRoutes(scope, { ...routeCtx, scope: "project" });
     },
     { prefix: "/projects/:project" }
   );
@@ -5864,6 +6058,14 @@ var IGNORED_WATCH_GLOBS = [
   "**/.turbo/**",
   "**/.next/**",
   "**/neat-out/**",
+  // Python venv shapes (issue #344). chokidar opens one watch handle per
+  // descended dir; a CPython venv carries 20k+ files and trivially blows
+  // through the macOS kqueue cap before extraction even runs.
+  "**/.venv/**",
+  "**/venv/**",
+  "**/__pypackages__/**",
+  "**/.tox/**",
+  "**/site-packages/**",
   "**/.DS_Store"
 ];
 var IGNORED_WATCH_PATHS = [
@@ -5874,6 +6076,11 @@ var IGNORED_WATCH_PATHS = [
   /(?:^|[\\/])\.turbo[\\/]/,
   /(?:^|[\\/])\.next[\\/]/,
   /(?:^|[\\/])neat-out[\\/]/,
+  /(?:^|[\\/])\.venv[\\/]/,
+  /(?:^|[\\/])venv[\\/]/,
+  /(?:^|[\\/])__pypackages__[\\/]/,
+  /(?:^|[\\/])\.tox[\\/]/,
+  /(?:^|[\\/])site-packages[\\/]/,
   /[\\/]?\.DS_Store$/
 ];
 function shouldIgnore(absPath) {
@@ -6311,10 +6518,10 @@ dotenv.config({ path: path.join(here, '.env.neat') })
 
 await import('@opentelemetry/auto-instrumentations-node/register')
 `;
-function renderEnvNeat(serviceName) {
+function renderEnvNeat(projectName) {
   return [
     "# Generated by `neat init --apply` (ADR-069).",
-    `OTEL_SERVICE_NAME=${serviceName}`,
+    `OTEL_SERVICE_NAME=${projectName}`,
     "OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318",
     ""
   ].join("\n");
@@ -6370,6 +6577,100 @@ const sdk = new NodeSDK({
 })
 sdk.start()
 `;
+var FRAMEWORK_OTEL_INIT_HEADER = "// Generated by `neat init --apply` (ADR-074). OpenTelemetry SDK hook.";
+var FRAMEWORK_OTEL_INIT_TS_BODY = `${FRAMEWORK_OTEL_INIT_HEADER}
+// Loads .env.neat (OTEL_SERVICE_NAME, OTEL_EXPORTER_OTLP_ENDPOINT) before
+// the OTel SDK starts so the exporter target and service name are in scope.
+import { fileURLToPath } from 'node:url'
+import path from 'node:path'
+import dotenv from 'dotenv'
+import { NodeSDK } from '@opentelemetry/sdk-node'
+import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+dotenv.config({ path: path.join(here, '.env.neat') })
+
+const sdk = new NodeSDK({
+  serviceName: process.env.OTEL_SERVICE_NAME,
+  instrumentations: [getNodeAutoInstrumentations()],
+})
+sdk.start()
+`;
+var FRAMEWORK_OTEL_INIT_JS_BODY = `${FRAMEWORK_OTEL_INIT_HEADER}
+// Loads .env.neat (OTEL_SERVICE_NAME, OTEL_EXPORTER_OTLP_ENDPOINT) before
+// the OTel SDK starts so the exporter target and service name are in scope.
+const path = require('node:path')
+try {
+  require('dotenv').config({ path: path.join(__dirname, '.env.neat') })
+} catch (err) {
+  // dotenv unavailable \u2014 fall through to process.env.
+}
+const { NodeSDK } = require('@opentelemetry/sdk-node')
+const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node')
+
+const sdk = new NodeSDK({
+  serviceName: process.env.OTEL_SERVICE_NAME,
+  instrumentations: [getNodeAutoInstrumentations()],
+})
+sdk.start()
+`;
+var REMIX_OTEL_SERVER_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var REMIX_OTEL_SERVER_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var SVELTEKIT_OTEL_INIT_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var SVELTEKIT_OTEL_INIT_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var SVELTEKIT_HOOKS_SERVER_TS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+import type { Handle } from '@sveltejs/kit'
+
+export const handle: Handle = async ({ event, resolve }) => {
+  return resolve(event)
+}
+`;
+var SVELTEKIT_HOOKS_SERVER_JS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+/** @type {import('@sveltejs/kit').Handle} */
+export const handle = async ({ event, resolve }) => {
+  return resolve(event)
+}
+`;
+var NUXT_OTEL_INIT_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var NUXT_OTEL_INIT_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var NUXT_OTEL_PLUGIN_TS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+export default defineNitroPlugin(() => {
+  // OTel SDK is initialised at module-load via the side-effect import above.
+})
+`;
+var NUXT_OTEL_PLUGIN_JS = `${FRAMEWORK_OTEL_INIT_HEADER}
+require('./otel-init')
+
+module.exports = defineNitroPlugin(() => {
+  // OTel SDK is initialised at module-load via the side-effect import above.
+})
+`;
+var ASTRO_OTEL_INIT_TS = FRAMEWORK_OTEL_INIT_TS_BODY;
+var ASTRO_OTEL_INIT_JS = FRAMEWORK_OTEL_INIT_JS_BODY;
+var ASTRO_MIDDLEWARE_TS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+import { defineMiddleware } from 'astro:middleware'
+
+export const onRequest = defineMiddleware(async (context, next) => {
+  return next()
+})
+`;
+var ASTRO_MIDDLEWARE_JS = `${FRAMEWORK_OTEL_INIT_HEADER}
+import './otel-init'
+
+import { defineMiddleware } from 'astro:middleware'
+
+export const onRequest = defineMiddleware(async (context, next) => {
+  return next()
+})
+`;
 
 // src/installers/javascript.ts
 var SDK_PACKAGES = [
@@ -6390,6 +6691,10 @@ var OTEL_ENV = {
   key: "OTEL_EXPORTER_OTLP_ENDPOINT",
   value: "http://localhost:4318"
 };
+function envServiceName(pkg, serviceDir, project) {
+  if (project && project.length > 0) return project;
+  return pkg.name ?? import_node_path40.default.basename(serviceDir);
+}
 async function readPackageJson(serviceDir) {
   try {
     const raw = await import_node_fs25.promises.readFile(import_node_path40.default.join(serviceDir, "package.json"), "utf8");
@@ -6421,6 +6726,71 @@ async function findNextConfig(serviceDir) {
 function hasNextDependency(pkg) {
   return pkg.dependencies?.next !== void 0 || pkg.devDependencies?.next !== void 0;
 }
+function allDeps(pkg) {
+  return { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+}
+var REMIX_ENTRY_CANDIDATES = [
+  "app/entry.server.ts",
+  "app/entry.server.tsx",
+  "app/entry.server.js",
+  "app/entry.server.jsx"
+];
+function hasRemixDependency(pkg) {
+  const deps = allDeps(pkg);
+  if ("remix" in deps) return true;
+  for (const name of Object.keys(deps)) {
+    if (name.startsWith("@remix-run/")) return true;
+  }
+  return false;
+}
+async function findRemixEntry(serviceDir) {
+  for (const rel of REMIX_ENTRY_CANDIDATES) {
+    const candidate = import_node_path40.default.join(serviceDir, rel);
+    if (await exists2(candidate)) return candidate;
+  }
+  return null;
+}
+var SVELTEKIT_HOOKS_CANDIDATES = ["src/hooks.server.ts", "src/hooks.server.js"];
+var SVELTEKIT_CONFIG_CANDIDATES = ["svelte.config.js", "svelte.config.ts"];
+function hasSvelteKitDependency(pkg) {
+  return "@sveltejs/kit" in allDeps(pkg);
+}
+async function findSvelteKitHooks(serviceDir) {
+  for (const rel of SVELTEKIT_HOOKS_CANDIDATES) {
+    const candidate = import_node_path40.default.join(serviceDir, rel);
+    if (await exists2(candidate)) return candidate;
+  }
+  return null;
+}
+async function findSvelteKitConfig(serviceDir) {
+  for (const rel of SVELTEKIT_CONFIG_CANDIDATES) {
+    const candidate = import_node_path40.default.join(serviceDir, rel);
+    if (await exists2(candidate)) return candidate;
+  }
+  return null;
+}
+var NUXT_CONFIG_CANDIDATES = ["nuxt.config.ts", "nuxt.config.js", "nuxt.config.mjs"];
+function hasNuxtDependency(pkg) {
+  return "nuxt" in allDeps(pkg);
+}
+async function findNuxtConfig(serviceDir) {
+  for (const name of NUXT_CONFIG_CANDIDATES) {
+    const candidate = import_node_path40.default.join(serviceDir, name);
+    if (await exists2(candidate)) return candidate;
+  }
+  return null;
+}
+var ASTRO_CONFIG_CANDIDATES = ["astro.config.mjs", "astro.config.ts", "astro.config.js"];
+function hasAstroDependency(pkg) {
+  return "astro" in allDeps(pkg);
+}
+async function findAstroConfig(serviceDir) {
+  for (const name of ASTRO_CONFIG_CANDIDATES) {
+    const candidate = import_node_path40.default.join(serviceDir, name);
+    if (await exists2(candidate)) return candidate;
+  }
+  return null;
+}
 function parseNextMajor(range) {
   if (!range) return null;
   const cleaned = range.trim().replace(/^[\^~>=<\s]+/, "");
@@ -6549,7 +6919,7 @@ function lineIsOtelInjection(line) {
   if (trimmed.length === 0) return false;
   return /(?:require\(|import\s+)['"]\.\/otel-init[^'"]*['"]/.test(trimmed);
 }
-async function planNext(serviceDir, pkg, manifestPath, nextConfigPath) {
+async function planNext(serviceDir, pkg, manifestPath, nextConfigPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
   const instrumentationFile = import_node_path40.default.join(serviceDir, useTs ? "instrumentation.ts" : "instrumentation.js");
   const instrumentationNodeFile = import_node_path40.default.join(
@@ -6586,7 +6956,7 @@ async function planNext(serviceDir, pkg, manifestPath, nextConfigPath) {
   if (!await exists2(envNeatFile)) {
     generatedFiles.push({
       file: envNeatFile,
-      contents: renderEnvNeat(pkg.name ?? import_node_path40.default.basename(serviceDir)),
+      contents: renderEnvNeat(envServiceName(pkg, serviceDir, project)),
       skipIfExists: true
     });
   }
@@ -6628,9 +6998,280 @@ async function planNext(serviceDir, pkg, manifestPath, nextConfigPath) {
     ...nextConfigEdit ? { nextConfigEdit } : {}
   };
 }
-async function plan(serviceDir) {
+function buildDependencyEdits(pkg, manifestPath) {
+  const existingDeps = allDeps(pkg);
+  const edits = [];
+  for (const sdk of SDK_PACKAGES) {
+    if (sdk.name in existingDeps) continue;
+    edits.push({
+      file: manifestPath,
+      kind: "add",
+      name: sdk.name,
+      version: sdk.version
+    });
+  }
+  return edits;
+}
+async function queueEnvNeat(serviceDir, pkg, project, generatedFiles) {
+  const envNeatFile = import_node_path40.default.join(serviceDir, ".env.neat");
+  if (!await exists2(envNeatFile)) {
+    generatedFiles.push({
+      file: envNeatFile,
+      contents: renderEnvNeat(envServiceName(pkg, serviceDir, project)),
+      skipIfExists: true
+    });
+  }
+}
+function fileImportsOtelHook(raw, specifiers) {
+  const lines = raw.split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    for (const spec of specifiers) {
+      const escaped = spec.replace(/\./g, "\\.");
+      const pattern = new RegExp(
+        `(?:import\\s+['"]${escaped}['"]|require\\(['"]${escaped}['"]\\))`
+      );
+      if (pattern.test(trimmed)) return true;
+    }
+  }
+  return false;
+}
+async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelServerFile = import_node_path40.default.join(
+    serviceDir,
+    useTs ? "app/otel.server.ts" : "app/otel.server.js"
+  );
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  if (!await exists2(otelServerFile)) {
+    generatedFiles.push({
+      file: otelServerFile,
+      contents: useTs ? REMIX_OTEL_SERVER_TS : REMIX_OTEL_SERVER_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, project, generatedFiles);
+  const entrypointEdits = [];
+  try {
+    const raw = await import_node_fs25.promises.readFile(entryFile, "utf8");
+    if (!fileImportsOtelHook(raw, ["./otel.server"])) {
+      const lines = raw.split(/\r?\n/);
+      const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
+      entrypointEdits.push({
+        file: entryFile,
+        before: firstReal,
+        after: "import './otel.server'"
+      });
+    }
+  } catch {
+  }
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0 && entrypointEdits.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "remix"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits,
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "remix"
+  };
+}
+async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelInitFile = import_node_path40.default.join(
+    serviceDir,
+    useTs ? "src/otel-init.ts" : "src/otel-init.js"
+  );
+  const resolvedHooksFile = hooksFile ?? import_node_path40.default.join(serviceDir, useTs ? "src/hooks.server.ts" : "src/hooks.server.js");
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  const entrypointEdits = [];
+  if (!await exists2(otelInitFile)) {
+    generatedFiles.push({
+      file: otelInitFile,
+      contents: useTs ? SVELTEKIT_OTEL_INIT_TS : SVELTEKIT_OTEL_INIT_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, project, generatedFiles);
+  if (hooksFile === null) {
+    generatedFiles.push({
+      file: resolvedHooksFile,
+      contents: useTs ? SVELTEKIT_HOOKS_SERVER_TS : SVELTEKIT_HOOKS_SERVER_JS,
+      skipIfExists: true
+    });
+  } else {
+    try {
+      const raw = await import_node_fs25.promises.readFile(hooksFile, "utf8");
+      if (!fileImportsOtelHook(raw, ["./otel-init"])) {
+        const lines = raw.split(/\r?\n/);
+        const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
+        entrypointEdits.push({
+          file: hooksFile,
+          before: firstReal,
+          after: "import './otel-init'"
+        });
+      }
+    } catch {
+    }
+  }
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0 && entrypointEdits.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "sveltekit"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits,
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "sveltekit"
+  };
+}
+async function planNuxt(serviceDir, pkg, manifestPath, project) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelPluginFile = import_node_path40.default.join(
+    serviceDir,
+    useTs ? "server/plugins/otel.ts" : "server/plugins/otel.js"
+  );
+  const otelInitFile = import_node_path40.default.join(
+    serviceDir,
+    useTs ? "server/plugins/otel-init.ts" : "server/plugins/otel-init.js"
+  );
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  if (!await exists2(otelInitFile)) {
+    generatedFiles.push({
+      file: otelInitFile,
+      contents: useTs ? NUXT_OTEL_INIT_TS : NUXT_OTEL_INIT_JS,
+      skipIfExists: true
+    });
+  }
+  if (!await exists2(otelPluginFile)) {
+    generatedFiles.push({
+      file: otelPluginFile,
+      contents: useTs ? NUXT_OTEL_PLUGIN_TS : NUXT_OTEL_PLUGIN_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, project, generatedFiles);
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "nuxt"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits: [],
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "nuxt"
+  };
+}
+var ASTRO_MIDDLEWARE_CANDIDATES = ["src/middleware.ts", "src/middleware.js"];
+async function findAstroMiddleware(serviceDir) {
+  for (const rel of ASTRO_MIDDLEWARE_CANDIDATES) {
+    const candidate = import_node_path40.default.join(serviceDir, rel);
+    if (await exists2(candidate)) return candidate;
+  }
+  return null;
+}
+async function planAstro(serviceDir, pkg, manifestPath, project) {
+  const useTs = await isTypeScriptProject(serviceDir);
+  const otelInitFile = import_node_path40.default.join(
+    serviceDir,
+    useTs ? "src/otel-init.ts" : "src/otel-init.js"
+  );
+  const existingMiddleware = await findAstroMiddleware(serviceDir);
+  const middlewareFile = existingMiddleware ?? import_node_path40.default.join(serviceDir, useTs ? "src/middleware.ts" : "src/middleware.js");
+  const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
+  const generatedFiles = [];
+  const entrypointEdits = [];
+  if (!await exists2(otelInitFile)) {
+    generatedFiles.push({
+      file: otelInitFile,
+      contents: useTs ? ASTRO_OTEL_INIT_TS : ASTRO_OTEL_INIT_JS,
+      skipIfExists: true
+    });
+  }
+  await queueEnvNeat(serviceDir, pkg, project, generatedFiles);
+  if (existingMiddleware === null) {
+    generatedFiles.push({
+      file: middlewareFile,
+      contents: useTs ? ASTRO_MIDDLEWARE_TS : ASTRO_MIDDLEWARE_JS,
+      skipIfExists: true
+    });
+  } else {
+    try {
+      const raw = await import_node_fs25.promises.readFile(existingMiddleware, "utf8");
+      if (!fileImportsOtelHook(raw, ["./otel-init"])) {
+        const lines = raw.split(/\r?\n/);
+        const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
+        entrypointEdits.push({
+          file: existingMiddleware,
+          before: firstReal,
+          after: "import './otel-init'"
+        });
+      }
+    } catch {
+    }
+  }
+  const empty = dependencyEdits.length === 0 && generatedFiles.length === 0 && entrypointEdits.length === 0;
+  if (empty) {
+    return {
+      language: "javascript",
+      serviceDir,
+      dependencyEdits: [],
+      entrypointEdits: [],
+      envEdits: [],
+      generatedFiles: [],
+      framework: "astro"
+    };
+  }
+  return {
+    language: "javascript",
+    serviceDir,
+    dependencyEdits,
+    entrypointEdits,
+    envEdits: [OTEL_ENV],
+    generatedFiles,
+    framework: "astro"
+  };
+}
+async function plan(serviceDir, opts) {
   const pkg = await readPackageJson(serviceDir);
   const manifestPath = import_node_path40.default.join(serviceDir, "package.json");
+  const project = opts?.project;
   const empty = {
     language: "javascript",
     serviceDir,
@@ -6643,7 +7284,32 @@ async function plan(serviceDir) {
   if (hasNextDependency(pkg)) {
     const nextConfig = await findNextConfig(serviceDir);
     if (nextConfig) {
-      return planNext(serviceDir, pkg, manifestPath, nextConfig);
+      return planNext(serviceDir, pkg, manifestPath, nextConfig, project);
+    }
+  }
+  if (hasRemixDependency(pkg)) {
+    const remixEntry = await findRemixEntry(serviceDir);
+    if (remixEntry) {
+      return planRemix(serviceDir, pkg, manifestPath, remixEntry, project);
+    }
+  }
+  if (hasSvelteKitDependency(pkg)) {
+    const hooks = await findSvelteKitHooks(serviceDir);
+    const config = await findSvelteKitConfig(serviceDir);
+    if (hooks || config) {
+      return planSvelteKit(serviceDir, pkg, manifestPath, hooks, project);
+    }
+  }
+  if (hasNuxtDependency(pkg)) {
+    const nuxtConfig = await findNuxtConfig(serviceDir);
+    if (nuxtConfig) {
+      return planNuxt(serviceDir, pkg, manifestPath, project);
+    }
+  }
+  if (hasAstroDependency(pkg)) {
+    const astroConfig = await findAstroConfig(serviceDir);
+    if (astroConfig) {
+      return planAstro(serviceDir, pkg, manifestPath, project);
     }
   }
   const entryFile = await resolveEntry(serviceDir, pkg);
@@ -6691,7 +7357,7 @@ async function plan(serviceDir) {
   if (!await exists2(envNeatFile)) {
     generatedFiles.push({
       file: envNeatFile,
-      contents: renderEnvNeat(pkg.name ?? import_node_path40.default.basename(serviceDir)),
+      contents: renderEnvNeat(envServiceName(pkg, serviceDir, project)),
       skipIfExists: true
     });
   }
@@ -6718,9 +7384,18 @@ function isAllowedWritePath(serviceDir, target) {
   if (/^otel-init\.(?:js|cjs|mjs|ts)$/.test(base)) return true;
   if (/^instrumentation(?:\.node)?\.(?:js|cjs|mjs|ts)$/.test(base)) return true;
   if (/^next\.config\.(?:js|mjs|ts)$/.test(base)) return true;
+  const relPosix = rel.split(import_node_path40.default.sep).join("/");
+  if (relPosix === "app/otel.server.ts" || relPosix === "app/otel.server.js") return true;
+  if (/^app\/entry\.server\.(?:tsx?|jsx?)$/.test(relPosix)) return true;
+  if (relPosix === "src/otel-init.ts" || relPosix === "src/otel-init.js") return true;
+  if (relPosix === "src/hooks.server.ts" || relPosix === "src/hooks.server.js") return true;
+  if (relPosix === "server/plugins/otel.ts" || relPosix === "server/plugins/otel.js") return true;
+  if (relPosix === "server/plugins/otel-init.ts" || relPosix === "server/plugins/otel-init.js") return true;
+  if (relPosix === "src/middleware.ts" || relPosix === "src/middleware.js") return true;
   return false;
 }
 async function writeAtomic(file, contents) {
+  await import_node_fs25.promises.mkdir(import_node_path40.default.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
   await import_node_fs25.promises.writeFile(tmp, contents, "utf8");
   await import_node_fs25.promises.rename(tmp, file);
@@ -7193,6 +7868,49 @@ var import_node_http = __toESM(require("http"), 1);
 var import_node_path42 = __toESM(require("path"), 1);
 var import_node_child_process2 = require("child_process");
 var import_node_readline = __toESM(require("readline"), 1);
+async function extractAndPersist(opts) {
+  const services = await discoverServices(opts.scanPath);
+  const languages = [...new Set(services.map((s) => s.node.language))].sort();
+  const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
+  resetGraph(graphKey);
+  const graph = getGraph(graphKey);
+  const projectPaths = pathsForProject(graphKey, import_node_path42.default.join(opts.scanPath, "neat-out"));
+  const extraction = await extractFromDirectory(graph, opts.scanPath, {
+    errorsPath: projectPaths.errorsPath
+  });
+  if (!opts.dryRun) {
+    await saveGraphToDisk(graph, projectPaths.snapshotPath);
+  }
+  return {
+    graph,
+    graphKey,
+    services,
+    languages,
+    nodesAdded: extraction.nodesAdded,
+    edgesAdded: extraction.edgesAdded,
+    snapshotPath: projectPaths.snapshotPath,
+    errorsPath: projectPaths.errorsPath
+  };
+}
+async function applyInstallersOver(services, project) {
+  let instrumented = 0;
+  let already = 0;
+  let libOnly = 0;
+  for (const svc of services) {
+    const installer = await pickInstaller(svc.dir);
+    if (!installer) continue;
+    const plan3 = await installer.plan(svc.dir, { project });
+    if (isEmptyPlan(plan3) && !plan3.libOnly) {
+      already++;
+      continue;
+    }
+    const outcome = await installer.apply(plan3);
+    if (outcome.outcome === "instrumented") instrumented++;
+    else if (outcome.outcome === "already-instrumented") already++;
+    else if (outcome.outcome === "lib-only") libOnly++;
+  }
+  return { instrumented, alreadyInstrumented: already, libOnly };
+}
 async function promptYesNo(question) {
   const rl = import_node_readline.default.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
@@ -7203,28 +7921,106 @@ async function promptYesNo(question) {
     });
   });
 }
-var DEFAULT_DAEMON_READY_TIMEOUT_MS = 15e3;
-async function checkDaemonHealth(restPort) {
+var DEFAULT_DAEMON_READY_TIMEOUT_MS = 6e4;
+var PROBE_INTERVAL_MS = 500;
+async function fetchDaemonHealth(restPort) {
   return new Promise((resolve) => {
     const req = import_node_http.default.get(`http://127.0.0.1:${restPort}/health`, (res) => {
       const ok = res.statusCode !== void 0 && res.statusCode >= 200 && res.statusCode < 300;
-      res.resume();
-      resolve(ok);
+      if (!ok) {
+        res.resume();
+        resolve(null);
+        return;
+      }
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => {
+        body += chunk;
+      });
+      res.on("end", () => {
+        try {
+          resolve(JSON.parse(body));
+        } catch {
+          resolve({ ok: true });
+        }
+      });
     });
-    req.on("error", () => resolve(false));
+    req.on("error", () => resolve(null));
     req.setTimeout(1e3, () => {
       req.destroy();
-      resolve(false);
+      resolve(null);
     });
   });
 }
+async function checkDaemonHealth(restPort) {
+  const body = await fetchDaemonHealth(restPort);
+  return body !== null;
+}
+async function probeProjectHealth(restPort, name) {
+  return new Promise((resolve) => {
+    const req = import_node_http.default.get(
+      `http://127.0.0.1:${restPort}/projects/${encodeURIComponent(name)}/health`,
+      (res) => {
+        const code = res.statusCode ?? 0;
+        res.resume();
+        if (code >= 200 && code < 300) resolve("active");
+        else resolve("bootstrapping");
+      }
+    );
+    req.on("error", () => resolve("bootstrapping"));
+    req.setTimeout(1e3, () => {
+      req.destroy();
+      resolve("bootstrapping");
+    });
+  });
+}
+async function snapshotProjectStatus(restPort, body) {
+  if (body.projects && body.projects.length > 0) {
+    return body.projects.map((p) => ({
+      name: p.name,
+      status: p.status ?? "active"
+    }));
+  }
+  const entries = await listProjects().catch(() => []);
+  if (entries.length === 0) return [];
+  return Promise.all(
+    entries.map(async (entry2) => ({
+      name: entry2.name,
+      status: await probeProjectHealth(restPort, entry2.name)
+    }))
+  );
+}
 async function waitForDaemonReady(restPort, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
+  let lastBootstrapping = [];
   while (Date.now() < deadline) {
-    if (await checkDaemonHealth(restPort)) return true;
-    await new Promise((r) => setTimeout(r, 300));
+    const body = await fetchDaemonHealth(restPort);
+    if (body !== null) {
+      const projects2 = await snapshotProjectStatus(restPort, body);
+      const bootstrapping = projects2.filter((p) => p.status === "bootstrapping").map((p) => p.name);
+      const broken = projects2.filter((p) => p.status === "broken").map((p) => p.name);
+      if (bootstrapping.length === 0) {
+        return { ready: true, brokenProjects: broken, stillBootstrapping: [] };
+      }
+      const key = bootstrapping.slice().sort().join(",");
+      const prevKey = lastBootstrapping.slice().sort().join(",");
+      if (key !== prevKey) {
+        const plural = bootstrapping.length === 1 ? "" : "s";
+        console.log(
+          `neat: waiting on ${bootstrapping.length} project${plural}: ${bootstrapping.join(", ")}`
+        );
+        lastBootstrapping = bootstrapping;
+      }
+    }
+    await new Promise((r) => setTimeout(r, PROBE_INTERVAL_MS));
   }
-  return false;
+  const final = await fetchDaemonHealth(restPort);
+  const projects = final ? await snapshotProjectStatus(restPort, final) : [];
+  return {
+    ready: false,
+    brokenProjects: projects.filter((p) => p.status === "broken").map((p) => p.name),
+    stillBootstrapping: projects.filter((p) => p.status === "bootstrapping").map((p) => p.name)
+  };
 }
 function spawnDaemonDetached() {
   const here = import_node_path42.default.dirname(new URL(importMetaUrl).pathname);
@@ -7245,12 +8041,21 @@ function spawnDaemonDetached() {
   if (!entry2) {
     throw new Error(`orchestrator: cannot locate neatd entry in ${here}`);
   }
+  const env = { ...process.env };
+  const hasToken = typeof env.NEAT_AUTH_TOKEN === "string" && env.NEAT_AUTH_TOKEN.length > 0;
+  if (!hasToken && (!env.HOST || env.HOST.length === 0)) {
+    env.HOST = "127.0.0.1";
+  }
   const child = (0, import_node_child_process2.spawn)(process.execPath, [entry2, "start"], {
     detached: true,
-    stdio: "ignore",
-    env: process.env
+    // stderr inherits the orchestrator's fd so the daemon's
+    // `BindAuthorityError` message lands in front of the operator instead
+    // of being swallowed (issue #341).
+    stdio: ["ignore", "ignore", "inherit"],
+    env
   });
   child.unref();
+  return child;
 }
 function openBrowser(url) {
   if (!process.stdout.isTTY) return "failed";
@@ -7287,24 +8092,21 @@ async function runOrchestrator(opts) {
   }
   console.log(`neat: ${opts.scanPath}`);
   console.log("");
-  const services = await discoverServices(opts.scanPath);
-  const languages = [...new Set(services.map((s) => s.node.language))].sort();
+  const persisted = await extractAndPersist({
+    scanPath: opts.scanPath,
+    project: opts.project,
+    projectExplicit: opts.projectExplicit
+  });
+  const { graph, services, languages } = persisted;
   result.steps.discovery = { services: services.length, languages };
   console.log(`discovered ${services.length} service(s) across ${languages.length} language(s)`);
   let runApply = !opts.noInstrument;
   if (runApply && !opts.yes && process.stdout.isTTY && process.stdin.isTTY) {
     runApply = await promptYesNo("instrument your services and open the dashboard?");
   }
-  const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
-  resetGraph(graphKey);
-  const graph = getGraph(graphKey);
-  const projectPaths = pathsForProject(graphKey, import_node_path42.default.join(opts.scanPath, "neat-out"));
-  const errorsPath = projectPaths.errorsPath;
-  const extraction = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
-  await saveGraphToDisk(graph, projectPaths.snapshotPath);
   result.steps.extraction = {
-    nodesAdded: extraction.nodesAdded,
-    edgesAdded: extraction.edgesAdded
+    nodesAdded: persisted.nodesAdded,
+    edgesAdded: persisted.edgesAdded
   };
   const gi = await ensureNeatOutIgnored(opts.scanPath);
   result.steps.gitignore = gi.action;
@@ -7329,24 +8131,11 @@ async function runOrchestrator(opts) {
     result.steps.apply.skipped = true;
     console.log("skipped instrumentation (--no-instrument)");
   } else {
-    let instrumented = 0;
-    let already = 0;
-    let libOnly = 0;
-    for (const svc of services) {
-      const installer = await pickInstaller(svc.dir);
-      if (!installer) continue;
-      const plan3 = await installer.plan(svc.dir);
-      if (isEmptyPlan(plan3) && !plan3.libOnly) {
-        already++;
-        continue;
-      }
-      const outcome = await installer.apply(plan3);
-      if (outcome.outcome === "instrumented") instrumented++;
-      else if (outcome.outcome === "already-instrumented") already++;
-      else if (outcome.outcome === "lib-only") libOnly++;
-    }
-    result.steps.apply = { instrumented, alreadyInstrumented: already, libOnly, skipped: false };
-    console.log(`instrumented ${instrumented}, already ${already}, lib-only ${libOnly}`);
+    const tally = await applyInstallersOver(services, opts.project);
+    result.steps.apply = { ...tally, skipped: false };
+    console.log(
+      `instrumented ${tally.instrumented}, already ${tally.alreadyInstrumented}, lib-only ${tally.libOnly}`
+    );
   }
   const restPort = Number(process.env.PORT ?? 8080);
   const timeoutMs = opts.daemonReadyTimeoutMs ?? DEFAULT_DAEMON_READY_TIMEOUT_MS;
@@ -7361,12 +8150,25 @@ async function runOrchestrator(opts) {
       return result;
     }
     const ready = await waitForDaemonReady(restPort, timeoutMs);
-    result.steps.daemon = ready ? "spawned" : "timed-out";
-    if (!ready) {
+    result.steps.daemon = ready.ready ? "spawned" : "timed-out";
+    if (!ready.ready) {
       console.error(`neat: daemon did not become ready within ${timeoutMs}ms`);
+      if (ready.stillBootstrapping.length > 0) {
+        console.error(
+          `neat: still bootstrapping: ${ready.stillBootstrapping.join(", ")}`
+        );
+      }
+      if (ready.brokenProjects.length > 0) {
+        console.error(`neat: broken projects: ${ready.brokenProjects.join(", ")}`);
+      }
       result.exitCode = 1;
       return result;
     }
+    if (ready.brokenProjects.length > 0) {
+      console.warn(
+        `neat: ${ready.brokenProjects.length} project(s) reported broken: ${ready.brokenProjects.join(", ")}`
+      );
+    }
   }
   const dashboardUrl = opts.dashboardUrl ?? "http://localhost:6328";
   if (opts.noOpen || !process.stdout.isTTY) {
@@ -7395,8 +8197,9 @@ function printSummary(result, graph, dashboardUrl) {
   console.log(`dashboard: ${dashboardUrl}`);
 }
 
-// src/cli.ts
-var import_types25 = require("@neat.is/types");
+// src/cli-verbs.ts
+init_cjs_shims();
+var import_node_path43 = __toESM(require("path"), 1);
 
 // src/cli-client.ts
 init_cjs_shims();
@@ -7417,13 +8220,16 @@ var TransportError = class extends Error {
     this.name = "TransportError";
   }
 };
-function createHttpClient(baseUrl) {
+function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
+  const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path44) {
+    async get(path45) {
       let res;
       try {
-        res = await fetch(`${root}${path44}`);
+        res = await fetch(`${root}${path45}`, {
+          headers: { ...authHeader }
+        });
       } catch (err) {
         throw new TransportError(
           `cannot reach neat-core at ${root}: ${err.message}`
@@ -7433,18 +8239,18 @@ function createHttpClient(baseUrl) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path44}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path45}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path44, body) {
+    async post(path45, body) {
       let res;
       try {
-        res = await fetch(`${root}${path44}`, {
+        res = await fetch(`${root}${path45}`, {
           method: "POST",
-          headers: { "content-type": "application/json" },
+          headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
         });
       } catch (err) {
@@ -7456,7 +8262,7 @@ function createHttpClient(baseUrl) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path44}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path45}: ${text}`,
           text
         );
       }
@@ -7470,12 +8276,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path44 = projectPath(
+  const path45 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path44);
+    const result = await client.get(path45);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -7501,12 +8307,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path44 = projectPath(
+  const path45 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path44);
+    const result = await client.get(path45);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no downstream dependencies. Nothing else would break if it failed.`
@@ -7540,12 +8346,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path44 = projectPath(
+  const path45 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path44);
+    const result = await client.get(path45);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -7626,9 +8432,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path44 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path45 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path44);
+    const body = await client.get(path45);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -7894,8 +8700,181 @@ function exitCodeForError(err) {
   if (err instanceof HttpError) return 1;
   return 1;
 }
+function createSnapshotPushClient(baseUrl, token) {
+  return createHttpClient(baseUrl, token && token.length > 0 ? token : void 0);
+}
+async function pushSnapshotToRemote(input) {
+  const client = createSnapshotPushClient(input.baseUrl, input.token);
+  if (typeof client.post !== "function") {
+    throw new Error("HttpClient does not support POST \u2014 required for snapshot push");
+  }
+  return client.post(
+    `/projects/${encodeURIComponent(input.project)}/snapshot`,
+    { snapshot: input.snapshot }
+  );
+}
+
+// src/cli-verbs.ts
+async function resolveProjectEntry(opts) {
+  const entries = await listProjects();
+  if (opts.project) {
+    const match = entries.find((e) => e.name === opts.project);
+    return match ?? null;
+  }
+  const cwd = opts.cwd ?? process.cwd();
+  const resolvedCwd = await normalizeProjectPath(cwd);
+  for (const entry2 of entries) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path43.default.sep}`)) {
+      return entry2;
+    }
+  }
+  return null;
+}
+async function checkDaemonHealth2(baseUrl) {
+  try {
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/health`, {
+      signal: AbortSignal.timeout(1500)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function snapshotForGraph(persisted) {
+  return {
+    schemaVersion: 3,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    graph: persisted.graph.export()
+  };
+}
+function emitResult(result, json) {
+  if (json) {
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return;
+  }
+  const verb = result.mode === "dry-run" ? "dry-run" : result.mode === "remote" ? "pushed" : "synced";
+  console.log(
+    `${verb}: ${result.project} \u2014 ${result.nodesAdded} node(s) and ${result.edgesAdded} edge(s) added` + (result.snapshotPath ? `; snapshot at ${result.snapshotPath}` : "")
+  );
+  if (!result.apply.skipped) {
+    const { instrumented, alreadyInstrumented, libOnly } = result.apply;
+    console.log(
+      `instrumented ${instrumented}, already ${alreadyInstrumented}, lib-only ${libOnly}`
+    );
+  } else {
+    console.log("skipped instrumentation (--no-instrument)");
+  }
+  for (const warn of result.warnings) console.error(warn);
+}
+async function runSync(opts) {
+  const entry2 = await resolveProjectEntry(opts);
+  if (!entry2) {
+    const target = opts.project ?? opts.cwd ?? process.cwd();
+    console.error(
+      `neat sync: no registered project ${opts.project ? `named "${opts.project}"` : `covers ${target}`}. Run \`neat <path>\` or \`neat init <path>\` first.`
+    );
+    return {
+      exitCode: 1,
+      project: opts.project ?? "",
+      scanPath: target,
+      nodesAdded: 0,
+      edgesAdded: 0,
+      snapshotPath: null,
+      mode: opts.to ? "remote" : "local",
+      daemon: "skipped",
+      apply: { instrumented: 0, alreadyInstrumented: 0, libOnly: 0, skipped: true },
+      warnings: []
+    };
+  }
+  const persisted = await extractAndPersist({
+    scanPath: entry2.path,
+    project: entry2.name,
+    projectExplicit: true,
+    dryRun: true
+  });
+  let snapshotPath = null;
+  if (!opts.dryRun) {
+    const target = persisted.snapshotPath;
+    await saveGraphToDisk(persisted.graph, target);
+    snapshotPath = target;
+  }
+  const skipApply = opts.dryRun || opts.noInstrument;
+  const applyTally = skipApply ? { instrumented: 0, alreadyInstrumented: 0, libOnly: 0 } : await applyInstallersOver(persisted.services, entry2.name);
+  const warnings = [];
+  let daemonState = "skipped";
+  let exitCode = 0;
+  const mode = opts.dryRun ? "dry-run" : opts.to ? "remote" : "local";
+  if (!opts.dryRun) {
+    const snapshot = snapshotForGraph(persisted);
+    if (opts.to) {
+      const token = opts.token ?? process.env.NEAT_REMOTE_TOKEN;
+      try {
+        await pushSnapshotToRemote({
+          baseUrl: opts.to,
+          token,
+          project: entry2.name,
+          snapshot
+        });
+        daemonState = "remote-ok";
+      } catch (err) {
+        if (err instanceof HttpError) {
+          console.error(`neat sync: ${err.message}`);
+          exitCode = 1;
+        } else if (err instanceof TransportError) {
+          console.error(`neat sync: ${err.message}`);
+          exitCode = 3;
+        } else {
+          console.error(`neat sync: ${err.message}`);
+          exitCode = 1;
+        }
+        daemonState = "skipped";
+      }
+    } else {
+      const daemonUrl = opts.daemonUrl ?? process.env.NEAT_API_URL ?? "http://localhost:8080";
+      const healthy = await checkDaemonHealth2(daemonUrl);
+      if (healthy) {
+        try {
+          await pushSnapshotToRemote({
+            baseUrl: daemonUrl,
+            token: process.env.NEAT_AUTH_TOKEN,
+            project: entry2.name,
+            snapshot
+          });
+          daemonState = "reloaded";
+        } catch (err) {
+          warnings.push(
+            `neat sync: daemon merge failed \u2014 ${err.message}. Snapshot is on disk at ${snapshotPath}.`
+          );
+          daemonState = "down";
+          exitCode = 2;
+        }
+      } else {
+        warnings.push(
+          "neat sync: daemon not running; snapshot updated, run `neatd start` to serve it"
+        );
+        daemonState = "down";
+        exitCode = 2;
+      }
+    }
+  }
+  const result = {
+    exitCode,
+    project: entry2.name,
+    scanPath: entry2.path,
+    nodesAdded: persisted.nodesAdded,
+    edgesAdded: persisted.edgesAdded,
+    snapshotPath,
+    mode,
+    daemon: daemonState,
+    apply: { ...applyTally, skipped: skipApply },
+    warnings
+  };
+  emitResult(result, opts.json);
+  return result;
+}
 
 // src/cli.ts
+var import_types25 = require("@neat.is/types");
 function usage() {
   console.log("usage: neat <command> [args] [--project <name>]");
   console.log("");
@@ -7916,6 +8895,8 @@ function usage() {
   console.log("  uninstall <name>");
   console.log("                 Remove a project from the registry. Does not touch");
   console.log("                 neat-out/, policy.json, or any user file.");
+  console.log("  version        Print the installed @neat.is/core version and exit.");
+  console.log("                 Aliases: --version, -v.");
   console.log("  skill          Install or print the Claude Code MCP drop-in.");
   console.log("                 Flags:");
   console.log("                   --print-config   print the JSON snippet to stdout");
@@ -7923,6 +8904,15 @@ function usage() {
   console.log("  deploy         Detect the deploy substrate, generate NEAT_AUTH_TOKEN,");
   console.log("                 emit a docker-compose / systemd / docker run artifact, and");
   console.log("                 print the OTel env-vars block to paste into your platform.");
+  console.log("  sync           Re-run discovery, extraction, and SDK apply against the");
+  console.log("                 registered project, then notify the running daemon.");
+  console.log("                 Flags:");
+  console.log("                   --project <name>   target a registered project by name");
+  console.log("                   --to <url>         push the snapshot to a remote daemon");
+  console.log("                   --token <token>    bearer token for --to (or $NEAT_REMOTE_TOKEN)");
+  console.log("                   --dry-run          run extraction in-memory; do not write");
+  console.log("                   --no-instrument    skip the SDK install apply step");
+  console.log("                   --json             emit the delta summary as JSON");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  root-cause <node-id>             Walk inbound edges to find what broke first.");
@@ -7976,7 +8966,9 @@ var STRING_FLAGS = [
   ["--error-id", "errorId"],
   ["--hypothetical-action", "hypotheticalAction"],
   ["--type", "type"],
-  ["--min-confidence", "minConfidence"]
+  ["--min-confidence", "minConfidence"],
+  ["--to", "to"],
+  ["--token", "token"]
 ];
 function parseArgs(rest) {
   const positional = [];
@@ -8001,6 +8993,8 @@ function parseArgs(rest) {
     hypotheticalAction: null,
     type: null,
     minConfidence: null,
+    to: null,
+    token: null,
     positional: []
   };
   for (let i = 0; i < rest.length; i++) {
@@ -8029,7 +9023,7 @@ function parseArgs(rest) {
       out.yes = true;
       continue;
     }
-    if (arg === "--verbose" || arg === "-v") {
+    if (arg === "--verbose") {
       out.verbose = true;
       continue;
     }
@@ -8088,6 +9082,28 @@ function assignFlag(out, field, value) {
   ;
   out[field] = value;
 }
+function readPackageVersion() {
+  const here = typeof __dirname !== "undefined" ? __dirname : import_node_path44.default.dirname((0, import_node_url3.fileURLToPath)(importMetaUrl));
+  const candidates = [
+    import_node_path44.default.resolve(here, "../package.json"),
+    import_node_path44.default.resolve(here, "../../package.json")
+  ];
+  for (const candidate of candidates) {
+    try {
+      const raw = (0, import_node_fs28.readFileSync)(candidate, "utf8");
+      const parsed = JSON.parse(raw);
+      if (parsed.name === "@neat.is/core" && typeof parsed.version === "string") {
+        return parsed.version;
+      }
+    } catch {
+    }
+  }
+  return "unknown";
+}
+function printVersion() {
+  process.stdout.write(`${readPackageVersion()}
+`);
+}
 function printBanner() {
   console.log("\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557");
   console.log("\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D");
@@ -8097,7 +9113,7 @@ function printBanner() {
   console.log("\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   ");
   console.log("");
   console.log("  Network Expressive Architecting Tool");
-  console.log("  neat.is  \xB7  v0.2.5  \xB7  BSL 1.1");
+  console.log("  neat.is  \xB7  v0.4.0  \xB7  Apache 2.0");
   console.log("");
 }
 function printDiscoveryReport(opts, services) {
@@ -8125,12 +9141,12 @@ function printDiscoveryReport(opts, services) {
   }
   console.log("");
 }
-async function buildPatchSections(services) {
+async function buildPatchSections(services, project) {
   const sections = [];
   for (const svc of services) {
     const installer = await pickInstaller(svc.dir);
     if (!installer) continue;
-    const plan3 = await installer.plan(svc.dir);
+    const plan3 = await installer.plan(svc.dir, { project });
     if (isEmptyPlan(plan3) && !plan3.libOnly) continue;
     sections.push({ installer: installer.name, plan: plan3 });
   }
@@ -8145,14 +9161,14 @@ async function runInit(opts) {
   }
   const services = await discoverServices(opts.scanPath);
   printDiscoveryReport(opts, services);
-  const sections = opts.noInstall ? [] : await buildPatchSections(services);
+  const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path43.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path44.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
     await import_node_fs28.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path43.default.join(opts.scanPath, ".gitignore");
+    const gitignorePath = import_node_path44.default.join(opts.scanPath, ".gitignore");
     const gitignoreExists = await import_node_fs28.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
@@ -8164,9 +9180,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path43.default.join(opts.scanPath, "neat-out")
+    import_node_path44.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path43.default.join(import_node_path43.default.dirname(opts.outPath), import_node_path43.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path44.default.join(import_node_path44.default.dirname(opts.outPath), import_node_path44.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -8256,9 +9272,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path43.default.resolve(override);
+  if (override && override.length > 0) return import_node_path44.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path43.default.join(home, ".claude.json");
+  return import_node_path44.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -8282,7 +9298,7 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs28.promises.mkdir(import_node_path43.default.dirname(target), { recursive: true });
+    await import_node_fs28.promises.mkdir(import_node_path44.default.dirname(target), { recursive: true });
     await import_node_fs28.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
@@ -8303,6 +9319,10 @@ async function main() {
     usage();
     process.exit(0);
   }
+  if (cmd === "--version" || cmd === "-v" || cmd === "version") {
+    printVersion();
+    process.exit(0);
+  }
   const parsed = parseArgs(rest);
   const { positional, apply: apply3, dryRun, noInstall } = parsed;
   const project = parsed.project ?? DEFAULT_PROJECT;
@@ -8317,12 +9337,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path43.default.resolve(target);
+    const scanPath = import_node_path44.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path43.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path44.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path43.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path43.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path44.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path44.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -8343,21 +9363,21 @@ async function main() {
       usage();
       process.exit(2);
     }
-    const scanPath = import_node_path43.default.resolve(target);
+    const scanPath = import_node_path44.default.resolve(target);
     const stat = await import_node_fs28.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path43.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path43.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path43.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path43.default.join(import_node_path43.default.dirname(outPath), import_node_path43.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path44.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path44.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path44.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path44.default.join(import_node_path44.default.dirname(outPath), import_node_path44.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path43.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path43.default.join(import_node_path43.default.dirname(outPath), import_node_path43.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path44.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path44.default.join(import_node_path44.default.dirname(outPath), import_node_path44.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path43.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path44.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -8476,6 +9496,18 @@ async function main() {
     console.log(`  ${artifact.startCommand}`);
     return;
   }
+  if (cmd === "sync") {
+    const result = await runSync({
+      ...parsed.project ? { project: parsed.project } : {},
+      ...parsed.to ? { to: parsed.to } : {},
+      ...parsed.token ? { token: parsed.token } : {},
+      dryRun: parsed.dryRun,
+      noInstrument: parsed.noInstrument,
+      json: parsed.json
+    });
+    if (result.exitCode !== 0) process.exit(result.exitCode);
+    return;
+  }
   if (QUERY_VERBS.has(cmd)) {
     const code = await runQueryVerb(cmd, parsed);
     if (code !== 0) process.exit(code);
@@ -8491,11 +9523,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path43.default.resolve(cmd);
+  const scanPath = import_node_path44.default.resolve(cmd);
   const stat = await import_node_fs28.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path43.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path44.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -8697,6 +9729,7 @@ if (/[\\/]cli\.(?:cjs|js)$/.test(entry) || entry.endsWith("/cli") || entry.endsW
   CLAUDE_SKILL_CONFIG,
   QUERY_VERBS,
   parseArgs,
+  readPackageVersion,
   runInit,
   runQueryVerb,
   runSkill