@neat.is/core 0.4.10 → 0.4.12

package/dist/cli.js

@@ -17,6 +17,7 @@ import {
   attachGraphToEventBus,
   buildApi,
   computeDivergences,
+  detectPackageManager,
   discoverServices,
   emitNeatEvent,
   ensureCompatLoaded,
@@ -37,11 +38,12 @@ import {
   removeProject,
   resetGraph,
   retireEdgesByFile,
+  runPackageManagerInstall,
   saveGraphToDisk,
   setStatus,
   startPersistLoop,
   startStalenessLoop
-} from "./chunk-J5CEKCTR.js";
+} from "./chunk-WDG4QEFO.js";
 import {
   startOtelGrpcReceiver
 } from "./chunk-3QCRUEQD.js";
@@ -54,8 +56,8 @@ import {
 } from "./chunk-HVF4S7J3.js";
 
 // src/cli.ts
-import path9 from "path";
-import { promises as fs8, readFileSync } from "fs";
+import path8 from "path";
+import { promises as fs7, readFileSync } from "fs";
 import { fileURLToPath } from "url";
 
 // src/gitignore.ts
@@ -424,6 +426,7 @@ async function startWatch(graph, opts) {
   const onSpan = makeSpanHandler({
     graph,
     errorsPath: opts.errorsPath,
+    scanPath: opts.scanPath,
     project: projectName,
     writeErrorEventInline: false,
     onPolicyTrigger
@@ -438,6 +441,7 @@ async function startWatch(graph, opts) {
     const onSpanGrpc = makeSpanHandler({
       graph,
       errorsPath: opts.errorsPath,
+      scanPath: opts.scanPath,
       project: projectName,
       onPolicyTrigger
     });
@@ -694,16 +698,24 @@ ${contents}EOF
 // src/installers/javascript.ts
 import { promises as fs4 } from "fs";
 import path4 from "path";
+import semver from "semver";
 
 // src/installers/templates.ts
 var OTEL_INIT_HEADER = "// Generated by `neat init --apply` (ADR-069). OpenTelemetry auto-instrumentation hook.";
-var OTEL_INIT_STAMP = "// neat-template-version: 3 \u2014 file-first call-site capture (ADR-089) + OTLP bearer auth (#410).";
+var OTEL_INIT_STAMP = "// neat-template-version: 4 \u2014 layered file-first capture (ADR-090): stack walk + handler-entry + off-stack facades.";
 var OTEL_OTLP_HEADERS_JS = "if (process.env.NEAT_OTEL_TOKEN) process.env.OTEL_EXPORTER_OTLP_HEADERS ||= 'Authorization=Bearer ' + process.env.NEAT_OTEL_TOKEN";
-function neatCallsiteProcessorSource(ts) {
-  const stackT = ts ? ": string" : "";
+function neatCaptureSource(ts) {
   const spanT = ts ? ": any" : "";
   const strOpt = ts ? ": string | undefined" : "";
-  return `function __neatPickUserFrame(stack${stackT}) {
+  const anyT = ts ? ": any" : "";
+  const fnT = ts ? ": any" : "";
+  const arrAny = ts ? ": any[]" : "";
+  return `// Context key shared by the facade/handler wraps (writers) and the
+// processor fallback (reader). Symbol.for keeps it stable even if the wraps
+// and the processor end up in different module instances.
+const NEAT_USER_FRAME = Symbol.for('neat.user-frame')
+
+function __neatPickUserFrame(stack${strOpt}) {
   const lines = String(stack || '').split('\\n')
   for (let i = 0; i < lines.length; i++) {
     const raw = lines[i].trim()
@@ -712,6 +724,9 @@ function neatCallsiteProcessorSource(ts) {
     if (raw.indexOf('@opentelemetry') !== -1) continue
     if (raw.indexOf('node:') !== -1) continue
     if (raw.indexOf('NeatCallSiteSpanProcessor') !== -1) continue
+    // Skip NEAT's own inlined wraps/helpers (all carry the __neat prefix) so a
+    // facade frame never masquerades as the user's call site.
+    if (raw.indexOf('__neat') !== -1) continue
     const bodyText = raw.slice(3)
     const loc = bodyText.match(/:(\\d+):(\\d+)\\)?$/)
     if (!loc) continue
@@ -733,32 +748,245 @@ function neatCallsiteProcessorSource(ts) {
   return null
 }
 
+// Layer 2/3 fallback source: the frame a handler-entry or facade wrap pushed
+// into context. Reads the span's own parent context first, then the active
+// context \u2014 the capture spike confirmed both return the value for undici.
+function __neatFrameFromContext(parentContext${anyT}) {
+  try {
+    const fromParent =
+      parentContext && typeof parentContext.getValue === 'function'
+        ? parentContext.getValue(NEAT_USER_FRAME)
+        : undefined
+    return fromParent || context.active().getValue(NEAT_USER_FRAME) || null
+  } catch (_e) {
+    return null
+  }
+}
+
+function __neatSetCodeAttrs(span${spanT}, frame${anyT}) {
+  span.setAttribute('code.filepath', frame.filepath)
+  if (typeof frame.lineno === 'number') span.setAttribute('code.lineno', frame.lineno)
+  if (frame.function) span.setAttribute('code.function', frame.function)
+}
+
 class NeatCallSiteSpanProcessor {
-  onStart(span${spanT}) {
+  onStart(span${spanT}, parentContext${anyT}) {
     if (!span || (span.kind !== 2 && span.kind !== 3)) return
-    const frame = __neatPickUserFrame(new Error().stack)
+    // Layer 1 \u2014 synchronous stack walk (sync-wrapper instrumentations).
+    let frame = __neatPickUserFrame(new Error().stack)
+    // Layer 2/3 \u2014 the handler-entry or off-stack-facade frame from context.
+    if (!frame) frame = __neatFrameFromContext(parentContext)
     if (!frame) return
-    span.setAttribute('code.filepath', frame.filepath)
-    if (typeof frame.lineno === 'number') span.setAttribute('code.lineno', frame.lineno)
-    if (frame.function) span.setAttribute('code.function', frame.function)
+    __neatSetCodeAttrs(span, frame)
   }
   onEnd() {}
   forceFlush() { return Promise.resolve() }
   shutdown() { return Promise.resolve() }
+}
+
+// Capture the caller's synchronous frame at the wrap point and run \`fn\` with
+// that frame pushed into the active context (file-awareness.md \xA74 layer 3). An
+// off-stack instrumentation that creates its span inside \`fn\` inherits the
+// frame; the processor reads it via __neatFrameFromContext.
+function __neatRunWithUserFrame(fn${fnT}) {
+  const frame = __neatPickUserFrame(new Error().stack)
+  if (!frame) return fn()
+  return context.with(context.active().setValue(NEAT_USER_FRAME, frame), fn)
+}
+
+// Handler-entry attribution (file-awareness.md \xA74 layer 2). Stamp the framework
+// SERVER span with the handler frame captured at route registration, and push
+// the same frame into context so downstream CLIENT/PRODUCER spans inherit the
+// handler-file floor when their own stack carries none.
+function __neatStampHandler(frame${anyT}, run${fnT}) {
+  try {
+    const active = trace.getActiveSpan()
+    if (active && active.kind === 1 && typeof active.setAttribute === 'function') {
+      __neatSetCodeAttrs(active, frame)
+    }
+  } catch (_e) {}
+  try {
+    return context.with(context.active().setValue(NEAT_USER_FRAME, frame), run)
+  } catch (_e) {
+    return run()
+  }
+}
+
+// require-in-the-middle is a transitive dependency of the OTel instrumentation
+// packages NEAT installs, so it resolves in any instrumented CJS service.
+// Guarded: when it's absent (or the host runs as pure ESM, where require isn't
+// defined) the off-stack/handler wraps degrade to the stack walk + context
+// floor, never to a crash.
+function __neatHook(modules${arrAny}, onload${fnT}) {
+  try {
+    const RITM = require('require-in-the-middle')
+    const Hook = RITM && RITM.Hook ? RITM.Hook : RITM
+    new Hook(modules, { internals: false }, onload)
+    return true
+  } catch (_e) {
+    return false
+  }
+}
+
+// Off-stack facade: Node's built-in fetch / undici. The instrumentation creates
+// the CLIENT span inside a diagnostics_channel handler detached from the
+// caller's stack, so wrap the global so the user frame is in context when the
+// span is created. The capture spike (2026-05-28) validated this on real
+// undici. .name is restored to 'fetch' for ecosystem compatibility; the inner
+// __neat name is what the frame skip keys on.
+function __neatWrapFetch() {
+  try {
+    const g${anyT} = globalThis
+    if (typeof g.fetch === 'function' && !g.fetch.__neatWrapped) {
+      const realFetch = g.fetch
+      // The wrapper keeps its __neat-prefixed name so the frame skip in
+      // __neatPickUserFrame never mistakes the wrapper's own frame for the
+      // user's call site (renaming it to 'fetch' would defeat the skip).
+      const __neatFetch${anyT} = function (input${anyT}, init${anyT}) {
+        return __neatRunWithUserFrame(function () { return realFetch(input, init) })
+      }
+      __neatFetch.__neatWrapped = true
+      g.fetch = __neatFetch
+    }
+  } catch (_e) {}
+}
+
+// Off-stack facade: @prisma/client. Prisma's query engine backdates its spans
+// from Rust, off the caller's stack. Wrap the model methods on the client
+// prototype so the call-site frame (still synchronous at \`prisma.user.find\`)
+// is pushed into context for the engine dispatch.
+function __neatWrapPrisma() {
+  __neatHook(['@prisma/client'], function (exports${anyT}) {
+    try {
+      const Client = exports && exports.PrismaClient
+      if (typeof Client === 'function' && !Client.__neatWrapped) {
+        const ops = ['findUnique','findUniqueOrThrow','findFirst','findFirstOrThrow','findMany','create','createMany','update','updateMany','upsert','delete','deleteMany','count','aggregate','groupBy']
+        const __neatPrismaWrapModel = function (model${anyT}) {
+          if (!model || model.__neatWrapped) return model
+          for (let i = 0; i < ops.length; i++) {
+            const op = ops[i]
+            const orig = model[op]
+            if (typeof orig !== 'function') continue
+            model[op] = function __neatPrismaOp(${ts ? "...args: any[]" : "...args"}) {
+              const self = this
+              return __neatRunWithUserFrame(function () { return orig.apply(self, args) })
+            }
+          }
+          model.__neatWrapped = true
+          return model
+        }
+        const proto = Client.prototype
+        const handler = function (model${anyT}) { return __neatPrismaWrapModel(model) }
+        // Model accessors are lazily created getters on the instance; wrap the
+        // \`$extends\`-free common path by trapping property access via a proxy
+        // on each constructed client.
+        exports.PrismaClient = new Proxy(Client, {
+          construct(Target${anyT}, argList${anyT}, NewTarget${anyT}) {
+            const instance = Reflect.construct(Target, argList, NewTarget)
+            return new Proxy(instance, {
+              get(target${anyT}, prop${anyT}, receiver${anyT}) {
+                const value = Reflect.get(target, prop, receiver)
+                if (value && typeof value === 'object' && typeof prop === 'string' && prop[0] !== '$' && prop[0] !== '_') {
+                  return handler(value)
+                }
+                return value
+              },
+            })
+          },
+        })
+        exports.PrismaClient.__neatWrapped = true
+        void proto
+      }
+    } catch (_e) {}
+    return exports
+  })
+}
+
+// Handler-entry facades. express / connect share the Layer model (each route
+// handler is a function registered on a Router); the wrap captures the
+// registration frame and stamps + propagates it when the handler runs. The
+// registry is the extensibility seam \u2014 koa, fastify (via @fastify/otel),
+// nestjs, restify, and hapi add an entry as their patch surface is wired.
+function __neatWrapConnectStyle(mod${anyT}) {
+  try {
+    // express() returns an app whose route verbs live on Router.prototype and
+    // the application proto; connect apps expose \`use\`. Wrap the registration
+    // verbs so the user handler is wound with its registration frame.
+    const verbs = ['use','get','post','put','delete','patch','all','options','head']
+    const wrapTarget = function (target${anyT}) {
+      if (!target || target.__neatVerbsWrapped) return
+      for (let i = 0; i < verbs.length; i++) {
+        const verb = verbs[i]
+        const orig = target[verb]
+        if (typeof orig !== 'function') continue
+        target[verb] = function __neatVerb(${ts ? "...args: any[]" : "...args"}) {
+          const frame = __neatPickUserFrame(new Error().stack)
+          if (frame) {
+            for (let a = 0; a < args.length; a++) {
+              const h = args[a]
+              if (typeof h === 'function' && !h.__neatHandlerWrapped && h.length <= 4) {
+                const inner = h
+                const __neatHandler${anyT} = function (${ts ? "...hargs: any[]" : "...hargs"}) {
+                  const self = this
+                  return __neatStampHandler(frame, function () { return inner.apply(self, hargs) })
+                }
+                __neatHandler.__neatHandlerWrapped = true
+                args[a] = __neatHandler
+              }
+            }
+          }
+          return orig.apply(this, args)
+        }
+      }
+      target.__neatVerbsWrapped = true
+    }
+    if (mod && mod.Router && mod.Router.prototype) wrapTarget(mod.Router.prototype)
+    if (mod && mod.application) wrapTarget(mod.application)
+    if (mod && mod.prototype) wrapTarget(mod.prototype)
+  } catch (_e) {}
+}
+
+function __neatInstallHandlerEntry() {
+  __neatHook(['express'], function (exports${anyT}) { __neatWrapConnectStyle(exports); return exports })
+  __neatHook(['connect'], function (exports${anyT}) { __neatWrapConnectStyle(exports); return exports })
+}
+
+// Install every off-stack and handler-entry wrap. Called once after sdk.start()
+// \u2014 before user code requires the framework / Prisma modules, so the hooks land
+// on first require. Each wrap is independently guarded.
+function __neatInstallFacades() {
+  __neatWrapFetch()
+  __neatWrapPrisma()
+  __neatInstallHandlerEntry()
 }`;
 }
-var CALLSITE_PROCESSOR_JS = neatCallsiteProcessorSource(false);
-var CALLSITE_PROCESSOR_TS = neatCallsiteProcessorSource(true);
-function neatRegisterCallsiteSource(ts) {
+var CALLSITE_PROCESSOR_JS = neatCaptureSource(false);
+var CALLSITE_PROCESSOR_TS = neatCaptureSource(true);
+function neatWireCaptureSource(ts) {
   const providerT = ts ? ": any" : "";
   return `try {
   const provider${providerT} = trace.getTracerProvider()
   const delegate = provider && typeof provider.getDelegate === 'function' ? provider.getDelegate() : provider
-  if (delegate && typeof delegate.addSpanProcessor === 'function') {
-    delegate.addSpanProcessor(new NeatCallSiteSpanProcessor())
-  }
-} catch {
-  // capture is best-effort; span export is unaffected
+  if (!delegate || typeof delegate.addSpanProcessor !== 'function') {
+    throw new Error('[neat] could not resolve a TracerProvider to attach the call-site processor; file-first OBSERVED capture would be silent (file-awareness.md \xA74)')
+  }
+  const __neatProcessor = new NeatCallSiteSpanProcessor()
+  delegate.addSpanProcessor(__neatProcessor)
+  // Post-init assertion: confirm attachment on providers that expose their
+  // processor list. An un-introspectable provider is trusted (we just called
+  // its addSpanProcessor); a list that exists and lacks our processor throws.
+  const registered = delegate._registeredSpanProcessors
+  if (Array.isArray(registered) && registered.indexOf(__neatProcessor) === -1) {
+    throw new Error('[neat] call-site processor did not attach to the active TracerProvider (file-awareness.md \xA74)')
+  }
+} catch (err) {
+  throw err
+}
+try {
+  __neatInstallFacades()
+} catch (_e) {
+  // Facade install is best-effort: the stack-walk + handler-entry floor still
+  // attribute the sync-wrapper majority even if an off-stack wrap fails.
 }`;
 }
 var OTEL_INIT_CJS = `${OTEL_INIT_HEADER}
@@ -769,7 +997,7 @@ ${OTEL_OTLP_HEADERS_JS}
 
 const { NodeSDK } = require('@opentelemetry/sdk-node')
 const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node')
-const { trace } = require('@opentelemetry/api')
+const { trace, context } = require('@opentelemetry/api')
 
 ${CALLSITE_PROCESSOR_JS}
 
@@ -777,7 +1005,7 @@ const instrumentations = [getNodeAutoInstrumentations()]
 __INSTRUMENTATION_BLOCK__
 const sdk = new NodeSDK({ instrumentations })
 sdk.start()
-${neatRegisterCallsiteSource(false)}
+${neatWireCaptureSource(false)}
 `;
 var OTEL_INIT_ESM = `${OTEL_INIT_HEADER}
 ${OTEL_INIT_STAMP}
@@ -787,7 +1015,7 @@ ${OTEL_OTLP_HEADERS_JS}
 
 import { NodeSDK } from '@opentelemetry/sdk-node'
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
-import { trace } from '@opentelemetry/api'
+import { trace, context } from '@opentelemetry/api'
 
 ${CALLSITE_PROCESSOR_JS}
 
@@ -795,17 +1023,22 @@ const instrumentations = [getNodeAutoInstrumentations()]
 __INSTRUMENTATION_BLOCK__
 const sdk = new NodeSDK({ instrumentations })
 sdk.start()
-${neatRegisterCallsiteSource(false)}
+${neatWireCaptureSource(false)}
 `;
 var OTEL_INIT_TS = `${OTEL_INIT_HEADER}
 ${OTEL_INIT_STAMP}
+// @ts-nocheck \u2014 generated runtime shim. The layered capture mechanism uses
+// dynamic patterns (facade wraps, Proxy traps, a createRequire bridge) that a
+// strict user tsconfig would reject; suppressing type-checking here keeps the
+// generated file from breaking the host project's \`tsc\` gate (#427) without
+// constraining the runtime logic. The file is regenerated, never hand-edited.
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
 ${OTEL_OTLP_HEADERS_JS}
 
 import { NodeSDK } from '@opentelemetry/sdk-node'
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
-import { trace } from '@opentelemetry/api'
+import { trace, context } from '@opentelemetry/api'
 
 ${CALLSITE_PROCESSOR_TS}
 
@@ -813,7 +1046,7 @@ const instrumentations = [getNodeAutoInstrumentations()]
 __INSTRUMENTATION_BLOCK__
 const sdk = new NodeSDK({ instrumentations })
 sdk.start()
-${neatRegisterCallsiteSource(true)}
+${neatWireCaptureSource(true)}
 `;
 function renderNodeOtelInit(template, serviceName, projectName, registrations = []) {
   const block = registrations.length === 0 ? "" : `
@@ -1025,6 +1258,13 @@ async function detectRuntimeKind(pkgRoot, pkg) {
   if (await exists(path4.join(pkgRoot, "vite.config.js")) || await exists(path4.join(pkgRoot, "vite.config.ts")) || await exists(path4.join(pkgRoot, "vite.config.mjs")) || "vite" in deps) {
     return "browser-bundle";
   }
+  if (await exists(path4.join(pkgRoot, "wrangler.toml"))) return "cloudflare-workers";
+  if (await exists(path4.join(pkgRoot, "bun.lockb"))) return "bun";
+  if (await exists(path4.join(pkgRoot, "deno.json")) || await exists(path4.join(pkgRoot, "deno.lock"))) {
+    return "deno";
+  }
+  const engines = pkg.engines ?? {};
+  if ("electron" in engines) return "electron";
   return "node";
 }
 async function readPackageJson(serviceDir) {
@@ -1064,6 +1304,12 @@ async function detect(serviceDir) {
   const pkg = await readPackageJson(serviceDir);
   return pkg !== null && typeof pkg.name === "string";
 }
+function needsVersionUpgrade(installed, expected) {
+  return !semver.satisfies(
+    semver.minVersion(installed)?.version ?? installed,
+    expected
+  ) && !semver.intersects(installed, expected);
+}
 var NEXT_CONFIG_CANDIDATES = ["next.config.js", "next.config.ts", "next.config.mjs"];
 async function findNextConfig(serviceDir) {
   for (const name of NEXT_CONFIG_CANDIDATES) {
@@ -1290,23 +1536,23 @@ async function planNext(serviceDir, pkg, manifestPath, nextConfigPath, project)
   const existingDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const dependencyEdits = [];
   for (const sdk of SDK_PACKAGES) {
-    if (sdk.name in existingDeps) continue;
-    dependencyEdits.push({
-      file: manifestPath,
-      kind: "add",
-      name: sdk.name,
-      version: sdk.version
-    });
+    if (sdk.name in existingDeps) {
+      if (needsVersionUpgrade(existingDeps[sdk.name], sdk.version)) {
+        dependencyEdits.push({ file: manifestPath, kind: "upgrade", name: sdk.name, version: sdk.version, fromVersion: existingDeps[sdk.name] });
+      }
+      continue;
+    }
+    dependencyEdits.push({ file: manifestPath, kind: "add", name: sdk.name, version: sdk.version });
   }
   const nonBundled = detectNonBundledInstrumentations(pkg);
   for (const inst of nonBundled) {
-    if (inst.pkg in existingDeps) continue;
-    dependencyEdits.push({
-      file: manifestPath,
-      kind: "add",
-      name: inst.pkg,
-      version: inst.version
-    });
+    if (inst.pkg in existingDeps) {
+      if (needsVersionUpgrade(existingDeps[inst.pkg], inst.version)) {
+        dependencyEdits.push({ file: manifestPath, kind: "upgrade", name: inst.pkg, version: inst.version, fromVersion: existingDeps[inst.pkg] });
+      }
+      continue;
+    }
+    dependencyEdits.push({ file: manifestPath, kind: "add", name: inst.pkg, version: inst.version });
   }
   const svcName = serviceNodeName(pkg, serviceDir);
   const projectName = projectToken(pkg, serviceDir, project);
@@ -1752,23 +1998,23 @@ async function plan(serviceDir, opts) {
   const existingDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const dependencyEdits = [];
   for (const sdk of SDK_PACKAGES) {
-    if (sdk.name in existingDeps) continue;
-    dependencyEdits.push({
-      file: manifestPath,
-      kind: "add",
-      name: sdk.name,
-      version: sdk.version
-    });
+    if (sdk.name in existingDeps) {
+      if (needsVersionUpgrade(existingDeps[sdk.name], sdk.version)) {
+        dependencyEdits.push({ file: manifestPath, kind: "upgrade", name: sdk.name, version: sdk.version, fromVersion: existingDeps[sdk.name] });
+      }
+      continue;
+    }
+    dependencyEdits.push({ file: manifestPath, kind: "add", name: sdk.name, version: sdk.version });
   }
   const nonBundled = detectNonBundledInstrumentations(pkg);
   for (const inst of nonBundled) {
-    if (inst.pkg in existingDeps) continue;
-    dependencyEdits.push({
-      file: manifestPath,
-      kind: "add",
-      name: inst.pkg,
-      version: inst.version
-    });
+    if (inst.pkg in existingDeps) {
+      if (needsVersionUpgrade(existingDeps[inst.pkg], inst.version)) {
+        dependencyEdits.push({ file: manifestPath, kind: "upgrade", name: inst.pkg, version: inst.version, fromVersion: existingDeps[inst.pkg] });
+      }
+      continue;
+    }
+    dependencyEdits.push({ file: manifestPath, kind: "add", name: inst.pkg, version: inst.version });
   }
   const entrypointEdits = [];
   try {
@@ -1871,6 +2117,28 @@ async function apply(installPlan) {
       writtenFiles: []
     };
   }
+  if (installPlan.runtimeKind === "bun") {
+    return { serviceDir, outcome: "bun", reason: "Bun runtime; use BYO-OTel", writtenFiles: [] };
+  }
+  if (installPlan.runtimeKind === "deno") {
+    return { serviceDir, outcome: "deno", reason: "Deno runtime; use BYO-OTel", writtenFiles: [] };
+  }
+  if (installPlan.runtimeKind === "cloudflare-workers") {
+    return {
+      serviceDir,
+      outcome: "cloudflare-workers",
+      reason: "Cloudflare Workers runtime; use BYO-OTel",
+      writtenFiles: []
+    };
+  }
+  if (installPlan.runtimeKind === "electron") {
+    return {
+      serviceDir,
+      outcome: "electron",
+      reason: "Electron; use BYO-OTel",
+      writtenFiles: []
+    };
+  }
   if (installPlan.dependencyEdits.length === 0 && installPlan.entrypointEdits.length === 0 && (installPlan.generatedFiles?.length ?? 0) === 0 && installPlan.nextConfigEdit === void 0) {
     return {
       serviceDir,
@@ -1921,6 +2189,8 @@ async function apply(installPlan) {
           if (!(dep.name in (pkg.dependencies ?? {}))) {
             pkg.dependencies[dep.name] = dep.version;
           }
+        } else if (dep.kind === "upgrade") {
+          pkg.dependencies[dep.name] = dep.version;
         } else {
           delete pkg.dependencies[dep.name];
         }
@@ -2321,99 +2591,19 @@ function renderPatch(sections) {
 }
 
 // src/orchestrator.ts
-import { promises as fs7 } from "fs";
+import { promises as fs6 } from "fs";
 import http from "http";
 import net from "net";
-import path7 from "path";
-import { spawn as spawn3 } from "child_process";
-import readline from "readline";
-
-// src/installers/package-manager.ts
-import { promises as fs6 } from "fs";
 import path6 from "path";
 import { spawn as spawn2 } from "child_process";
-var LOCKFILE_PRIORITY = [
-  { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
-  { lockfile: "pnpm-lock.yaml", pm: "pnpm", args: ["install", "--no-summary"] },
-  { lockfile: "yarn.lock", pm: "yarn", args: ["install", "--silent"] },
-  {
-    lockfile: "package-lock.json",
-    pm: "npm",
-    args: ["install", "--no-audit", "--no-fund", "--prefer-offline"]
-  }
-];
-var NPM_FALLBACK_ARGS = ["install", "--no-audit", "--no-fund", "--prefer-offline"];
-async function exists3(p) {
-  try {
-    await fs6.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function detectPackageManager(serviceDir) {
-  let dir = path6.resolve(serviceDir);
-  const stops = /* @__PURE__ */ new Set();
-  for (let i = 0; i < 64; i++) {
-    if (stops.has(dir)) break;
-    stops.add(dir);
-    for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path6.join(dir, candidate.lockfile);
-      if (await exists3(lockPath)) {
-        return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
-      }
-    }
-    const parent = path6.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return { pm: "npm", cwd: path6.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
-}
-async function runPackageManagerInstall(cmd) {
-  return new Promise((resolve) => {
-    const child = spawn2(cmd.pm, cmd.args, {
-      cwd: cmd.cwd,
-      // Inherit PATH + HOME so the user's installed managers resolve.
-      env: process.env,
-      // `false` keeps the parent in control of cleanup if the orchestrator
-      // exits before install finishes. Cross-platform-safe.
-      shell: false,
-      stdio: ["ignore", "ignore", "pipe"]
-    });
-    let stderr = "";
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString("utf8");
-    });
-    child.on("error", (err) => {
-      resolve({
-        pm: cmd.pm,
-        cwd: cmd.cwd,
-        args: cmd.args,
-        exitCode: 127,
-        stderr: stderr + `
-${err.message}`
-      });
-    });
-    child.on("close", (code) => {
-      resolve({
-        pm: cmd.pm,
-        cwd: cmd.cwd,
-        args: cmd.args,
-        exitCode: code ?? 1,
-        stderr: stderr.trim()
-      });
-    });
-  });
-}
-
-// src/orchestrator.ts
+import readline from "readline";
 async function extractAndPersist(opts) {
   const services = await discoverServices(opts.scanPath);
   const languages = [...new Set(services.map((s) => s.node.language))].sort();
   const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
   resetGraph(graphKey);
   const graph = getGraph(graphKey);
-  const projectPaths = pathsForProject(graphKey, path7.join(opts.scanPath, "neat-out"));
+  const projectPaths = pathsForProject(graphKey, path6.join(opts.scanPath, "neat-out"));
   const extraction = await extractFromDirectory(graph, opts.scanPath, {
     errorsPath: projectPaths.errorsPath
   });
@@ -2439,6 +2629,10 @@ async function applyInstallersOver(services, project, options = {}) {
   let libOnly = 0;
   let browserBundle = 0;
   let reactNative = 0;
+  let bun = 0;
+  let deno = 0;
+  let cloudflareWorkers = 0;
+  let electron = 0;
   const installPlans = /* @__PURE__ */ new Map();
   for (const svc of services) {
     const installer = await pickInstaller(svc.dir);
@@ -2463,7 +2657,59 @@ async function applyInstallersOver(services, project, options = {}) {
       console.log(`skipping ${svc.dir}: browser bundle; browser-OTel support lands in a future release.`);
     } else if (outcome.outcome === "react-native") {
       reactNative++;
-      console.log(`skipping ${svc.dir}: React Native target; browser-OTel support lands in a future release.`);
+      const svcName = path6.basename(svc.dir);
+      console.log(
+        `neat: ${svc.dir} detected as React Native / Expo
+  The installer doesn't cover this runtime deterministically.
+  Configure your OTel binding to send spans to:
+    http://localhost:4318/projects/${project}/v1/traces
+  Set OTEL_SERVICE_NAME=${svcName}
+  See docs/installer-scope.md \u2192 "Manual setup for out-of-scope runtimes"`
+      );
+    } else if (outcome.outcome === "bun") {
+      bun++;
+      const svcName = path6.basename(svc.dir);
+      console.log(
+        `neat: ${svc.dir} detected as Bun
+  The installer doesn't cover this runtime deterministically.
+  Configure your OTel binding to send spans to:
+    http://localhost:4318/projects/${project}/v1/traces
+  Set OTEL_SERVICE_NAME=${svcName}
+  See docs/installer-scope.md \u2192 "Manual setup for out-of-scope runtimes"`
+      );
+    } else if (outcome.outcome === "deno") {
+      deno++;
+      const svcName = path6.basename(svc.dir);
+      console.log(
+        `neat: ${svc.dir} detected as Deno
+  The installer doesn't cover this runtime deterministically.
+  Configure your OTel binding to send spans to:
+    http://localhost:4318/projects/${project}/v1/traces
+  Set OTEL_SERVICE_NAME=${svcName}
+  See docs/installer-scope.md \u2192 "Manual setup for out-of-scope runtimes"`
+      );
+    } else if (outcome.outcome === "cloudflare-workers") {
+      cloudflareWorkers++;
+      const svcName = path6.basename(svc.dir);
+      console.log(
+        `neat: ${svc.dir} detected as Cloudflare Workers
+  The installer doesn't cover this runtime deterministically.
+  Configure your OTel binding to send spans to:
+    http://localhost:4318/projects/${project}/v1/traces
+  Set OTEL_SERVICE_NAME=${svcName}
+  See docs/installer-scope.md \u2192 "Manual setup for out-of-scope runtimes"`
+      );
+    } else if (outcome.outcome === "electron") {
+      electron++;
+      const svcName = path6.basename(svc.dir);
+      console.log(
+        `neat: ${svc.dir} detected as Electron
+  The installer doesn't cover this runtime deterministically.
+  Configure your OTel binding to send spans to:
+    http://localhost:4318/projects/${project}/v1/traces
+  Set OTEL_SERVICE_NAME=${svcName}
+  See docs/installer-scope.md \u2192 "Manual setup for out-of-scope runtimes"`
+      );
     }
   }
   const packageManagerInstalls = [];
@@ -2488,6 +2734,10 @@ async function applyInstallersOver(services, project, options = {}) {
     libOnly,
     browserBundle,
     reactNative,
+    bun,
+    deno,
+    cloudflareWorkers,
+    electron,
     packageManagerInstalls
   };
 }
@@ -2625,10 +2875,10 @@ function formatPortCollisionMessage(port) {
   ];
 }
 function spawnDaemonDetached() {
-  const here = path7.dirname(new URL(import.meta.url).pathname);
+  const here = path6.dirname(new URL(import.meta.url).pathname);
   const candidates = [
-    path7.join(here, "neatd.cjs"),
-    path7.join(here, "neatd.js")
+    path6.join(here, "neatd.cjs"),
+    path6.join(here, "neatd.js")
   ];
   let entry2 = null;
   const fsSync = __require("fs");
@@ -2648,7 +2898,7 @@ function spawnDaemonDetached() {
   if (!hasToken && (!env.HOST || env.HOST.length === 0)) {
     env.HOST = "127.0.0.1";
   }
-  const child = spawn3(process.execPath, [entry2, "start"], {
+  const child = spawn2(process.execPath, [entry2, "start"], {
     detached: true,
     // stderr inherits the orchestrator's fd so the daemon's
     // `BindAuthorityError` message lands in front of the operator instead
@@ -2665,7 +2915,7 @@ function openBrowser(url) {
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = spawn3(cmd, args, { detached: true, stdio: "ignore" });
+    const child = spawn2(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -2686,7 +2936,7 @@ async function runOrchestrator(opts) {
       browser: "skipped"
     }
   };
-  const stat = await fs7.stat(opts.scanPath).catch(() => null);
+  const stat = await fs6.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat: ${opts.scanPath} is not a directory`);
     result.exitCode = 2;
@@ -2828,7 +3078,7 @@ function printSummary(result, graph, dashboardUrl) {
 }
 
 // src/cli-verbs.ts
-import path8 from "path";
+import path7 from "path";
 
 // src/cli-client.ts
 import { Provenance as Provenance2 } from "@neat.is/types";
@@ -2856,10 +3106,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path10) {
+    async get(path9) {
       let res;
       try {
-        res = await fetch(`${root}${path10}`, {
+        res = await fetch(`${root}${path9}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -2871,16 +3121,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path10}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path9}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path10, body) {
+    async post(path9, body) {
       let res;
       try {
-        res = await fetch(`${root}${path10}`, {
+        res = await fetch(`${root}${path9}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -2894,7 +3144,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path10}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path9}: ${text}`,
           text
         );
       }
@@ -2908,12 +3158,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path10 = projectPath(
+  const path9 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path10);
+    const result = await client.get(path9);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -2939,12 +3189,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path10 = projectPath(
+  const path9 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path10);
+    const result = await client.get(path9);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no downstream dependencies. Nothing else would break if it failed.`
@@ -2978,12 +3228,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path10 = projectPath(
+  const path9 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path10);
+    const result = await client.get(path9);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -3064,9 +3314,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path10 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path9 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path10);
+    const body = await client.get(path9);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -3356,7 +3606,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path8.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path7.sep}`)) {
       return entry2;
     }
   }
@@ -3716,10 +3966,10 @@ function assignFlag(out, field, value) {
   out[field] = value;
 }
 function readPackageVersion() {
-  const here = typeof __dirname !== "undefined" ? __dirname : path9.dirname(fileURLToPath(import.meta.url));
+  const here = typeof __dirname !== "undefined" ? __dirname : path8.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path9.resolve(here, "../package.json"),
-    path9.resolve(here, "../../package.json")
+    path8.resolve(here, "../package.json"),
+    path8.resolve(here, "../../package.json")
   ];
   for (const candidate of candidates) {
     try {
@@ -3787,7 +4037,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await fs8.stat(opts.scanPath).catch(() => null);
+  const stat = await fs7.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -3796,13 +4046,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = path9.join(opts.scanPath, "neat.patch");
+  const patchPath = path8.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await fs8.writeFile(patchPath, patch, "utf8");
+    await fs7.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = path9.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await fs8.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = path8.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await fs7.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -3813,9 +4063,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    path9.join(opts.scanPath, "neat-out")
+    path8.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = path9.join(path9.dirname(opts.outPath), path9.basename(projectPaths.errorsPath));
+  const errorsPath = path8.join(path8.dirname(opts.outPath), path8.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -3894,7 +4144,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await fs8.writeFile(patchPath, patch, "utf8");
+      await fs7.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -3934,9 +4184,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return path9.resolve(override);
+  if (override && override.length > 0) return path8.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path9.join(home, ".claude.json");
+  return path8.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -3948,7 +4198,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await fs8.readFile(target, "utf8"));
+      existing = JSON.parse(await fs7.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -3960,8 +4210,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await fs8.mkdir(path9.dirname(target), { recursive: true });
-    await fs8.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs7.mkdir(path8.dirname(target), { recursive: true });
+    await fs7.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     return { exitCode: 0 };
@@ -3999,12 +4249,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = path9.resolve(target);
+    const scanPath = path8.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : path9.basename(scanPath);
+    const projectName = projectExplicit ? project : path8.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, path9.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = path9.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, path8.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = path8.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -4025,21 +4275,21 @@ async function main() {
       usage();
       process.exit(2);
     }
-    const scanPath = path9.resolve(target);
-    const stat = await fs8.stat(scanPath).catch(() => null);
+    const scanPath = path8.resolve(target);
+    const stat = await fs7.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, path9.join(scanPath, "neat-out"));
-    const outPath = path9.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = path9.resolve(
-      process.env.NEAT_ERRORS_PATH ?? path9.join(path9.dirname(outPath), path9.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, path8.join(scanPath, "neat-out"));
+    const outPath = path8.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = path8.resolve(
+      process.env.NEAT_ERRORS_PATH ?? path8.join(path8.dirname(outPath), path8.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = path9.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? path9.join(path9.dirname(outPath), path9.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = path8.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? path8.join(path8.dirname(outPath), path8.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path9.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path8.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -4185,11 +4435,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = path9.resolve(cmd);
-  const stat = await fs8.stat(scanPath).catch(() => null);
+  const scanPath = path8.resolve(cmd);
+  const stat = await fs7.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : path9.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : path8.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,