@neat.is/core 0.4.20-dev.20260630 → 0.4.23

package/dist/cli.cjs

@@ -42,13 +42,13 @@ var init_cjs_shims = __esm({
 });
 
 // src/auth.ts
-function isLoopbackHost(host) {
+function isLoopbackHost2(host) {
   if (!host) return false;
   return LOOPBACK_HOSTS.has(host);
 }
 function assertBindAuthority(host, token) {
   if (token && token.length > 0) return;
-  if (isLoopbackHost(host)) return;
+  if (isLoopbackHost2(host)) return;
   throw new BindAuthorityError(host);
 }
 function mountBearerAuth(app, opts) {
@@ -574,7 +574,23 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path42, import_node_url3, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+async function listenSteppingOtlp(app, requestedPort, host) {
+  let port = requestedPort;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await app.listen({ port, host });
+    } catch (err) {
+      const code = err.code;
+      const canStep = requestedPort !== 0 && code === "EADDRINUSE" && attempt < OTLP_STEP_ATTEMPTS - 1;
+      if (!canStep) throw err;
+      console.warn(
+        `otel: OTLP port ${port} is in use, stepping to ${port + OTLP_STEP_STRIDE}`
+      );
+      port += OTLP_STEP_STRIDE;
+    }
+  }
+}
+var import_node_path42, import_node_url3, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody, OTLP_STEP_ATTEMPTS, OTLP_STEP_STRIDE;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
@@ -590,6 +606,8 @@ var init_otel = __esm({
     exportTraceServiceRequestType = null;
     exportTraceServiceResponseType = null;
     cachedProtobufResponseBody = null;
+    OTLP_STEP_ATTEMPTS = 8;
+    OTLP_STEP_STRIDE = 1;
   }
 });
 
@@ -605,6 +623,7 @@ __export(cli_exports, {
   parseArgs: () => parseArgs,
   printBanner: () => printBanner,
   readPackageVersion: () => readPackageVersion,
+  resolveDaemonUrl: () => resolveDaemonUrl,
   resolveProjectForVerb: () => resolveProjectForVerb,
   runInit: () => runInit,
   runQueryVerb: () => runQueryVerb,
@@ -1277,22 +1296,164 @@ var rootCauseShapes = {
   [import_types.NodeType.ServiceNode]: serviceRootCauseShape,
   [import_types.NodeType.FileNode]: fileRootCauseShape
 };
-function getRootCause(graph, errorNodeId, errorEvent) {
+function getRootCause(graph, errorNodeId, errorEvent, incidents) {
   if (!graph.hasNode(errorNodeId)) return null;
   const origin = graph.getNodeAttributes(errorNodeId);
   const shape = rootCauseShapes[origin.type];
-  if (!shape) return null;
-  const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
-  const match = shape(graph, origin, walk);
-  if (!match) return null;
-  const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+  if (shape) {
+    const walk = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+    const match = shape(graph, origin, walk);
+    if (match) {
+      const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+      return import_types.RootCauseResultSchema.parse({
+        rootCauseNode: match.rootCauseNode,
+        rootCauseReason: reason,
+        traversalPath: walk.path,
+        edgeProvenances: walk.edges.map((e) => e.provenance),
+        confidence: confidenceFromMix(walk.edges),
+        fixRecommendation: match.fixRecommendation
+      });
+    }
+  }
+  if (origin.type === import_types.NodeType.ServiceNode) {
+    const crossService = crossServiceRootCause(graph, errorNodeId, incidents, errorEvent);
+    if (crossService) return crossService;
+  }
+  return rootCauseFromIncidents(errorNodeId, incidents, errorEvent);
+}
+var INCIDENT_ROOT_CAUSE_CONFIDENCE = 0.6;
+function incidentMatchesNode(ev, nodeId) {
+  return ev.affectedNode === nodeId || ev.service === nodeId.replace(/^service:/, "");
+}
+function localizeFromIncidents(nodeId, incidents, errorEvent) {
+  const pool = incidents && incidents.length > 0 ? incidents : errorEvent ? [errorEvent] : [];
+  const relevant = pool.filter((ev) => incidentMatchesNode(ev, nodeId));
+  if (relevant.length === 0) return null;
+  const latest = [...relevant].sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
+  const attrs = latest.attributes ?? {};
+  const filepath = typeof attrs["code.filepath"] === "string" ? attrs["code.filepath"] : void 0;
+  const lineno = typeof attrs["code.lineno"] === "number" ? attrs["code.lineno"] : void 0;
+  const route = typeof attrs["http.route"] === "string" ? attrs["http.route"] : void 0;
+  const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
+  const sameMode = relevant.filter((ev) => ev.errorMessage === latest.errorMessage);
+  const count = sameMode.length;
+  const tail = count > 1 ? ` (${count} recorded incidents)` : " (1 recorded incident)";
+  const reasonParts = [`${latest.service}: ${latest.errorMessage}`];
+  if (location) reasonParts.push(`surfaced at ${location}`);
+  const rootCauseReason = `${reasonParts.join(" \u2014 ")}${tail}`;
+  const localizesToFile = latest.affectedNode !== nodeId && latest.affectedNode.startsWith("file:");
+  const fileNode = localizesToFile ? latest.affectedNode : void 0;
+  const fixRecommendation = location ? `Inspect ${location}${route ? ` handling ${route}` : ""}` : route ? `Inspect ${latest.service}'s handler for ${route}` : void 0;
+  return {
+    rootCauseNode: fileNode ?? nodeId,
+    rootCauseReason,
+    ...fileNode ? { fileNode } : {},
+    ...fixRecommendation ? { fixRecommendation } : {}
+  };
+}
+function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
+  const loc = localizeFromIncidents(nodeId, incidents, errorEvent);
+  if (!loc) return null;
+  const traversalPath = loc.fileNode ? [nodeId, loc.fileNode] : [nodeId];
+  const edgeProvenances = loc.fileNode ? [import_types.Provenance.OBSERVED] : [];
   return import_types.RootCauseResultSchema.parse({
-    rootCauseNode: match.rootCauseNode,
-    rootCauseReason: reason,
-    traversalPath: walk.path,
-    edgeProvenances: walk.edges.map((e) => e.provenance),
-    confidence: confidenceFromMix(walk.edges),
-    fixRecommendation: match.fixRecommendation
+    rootCauseNode: loc.rootCauseNode,
+    rootCauseReason: loc.rootCauseReason,
+    traversalPath,
+    edgeProvenances,
+    confidence: INCIDENT_ROOT_CAUSE_CONFIDENCE,
+    ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+  });
+}
+function isFailingCallEdge(e) {
+  return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
+}
+function callSourcesForService(graph, serviceId3) {
+  const ids = [serviceId3];
+  for (const edgeId of graph.outboundEdges(serviceId3)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== import_types.EdgeType.CONTAINS) continue;
+    const tgt = graph.getNodeAttributes(e.target);
+    if (tgt.type === import_types.NodeType.FileNode) ids.push(e.target);
+  }
+  return ids;
+}
+function failingCallDominates(e, id, curEdge, curId) {
+  const ec = e.signal?.errorCount ?? 0;
+  const cc = curEdge.signal?.errorCount ?? 0;
+  if (ec !== cc) return ec > cc;
+  if (import_types.PROV_RANK[e.provenance] !== import_types.PROV_RANK[curEdge.provenance]) {
+    return import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[curEdge.provenance];
+  }
+  return id < curId;
+}
+function dominantFailingCall(graph, serviceId3, visited) {
+  let best = null;
+  for (const src of callSourcesForService(graph, serviceId3)) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (!isFailingCallEdge(e)) continue;
+      if (isFrontierNode(graph, e.target)) continue;
+      const owner = resolveOwningService(graph, e.target);
+      if (!owner || visited.has(owner.id)) continue;
+      if (!best || failingCallDominates(e, owner.id, best.edge, best.nextService)) {
+        best = { nextService: owner.id, edge: e };
+      }
+    }
+  }
+  return best;
+}
+function followFailingCallChain(graph, originServiceId, maxDepth) {
+  const path53 = [originServiceId];
+  const edges = [];
+  const visited = /* @__PURE__ */ new Set([originServiceId]);
+  let current = originServiceId;
+  for (let depth = 0; depth < maxDepth; depth++) {
+    const hop = dominantFailingCall(graph, current, visited);
+    if (!hop) break;
+    path53.push(hop.nextService);
+    edges.push(hop.edge);
+    visited.add(hop.nextService);
+    current = hop.nextService;
+  }
+  if (edges.length === 0) return null;
+  return { path: path53, edges, culprit: current };
+}
+function crossServiceRootCause(graph, originId, incidents, errorEvent) {
+  const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
+  if (!chain) return null;
+  const culprit = chain.culprit;
+  const path53 = [...chain.path];
+  const edgeProvenances = chain.edges.map((e) => e.provenance);
+  const baseConfidence = confidenceFromMix(chain.edges);
+  const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
+  const loc = localizeFromIncidents(culprit, incidents, errorEvent);
+  if (loc) {
+    let rootCauseNode = culprit;
+    if (loc.fileNode) {
+      path53.push(loc.fileNode);
+      edgeProvenances.push(import_types.Provenance.OBSERVED);
+      rootCauseNode = loc.fileNode;
+    }
+    return import_types.RootCauseResultSchema.parse({
+      rootCauseNode,
+      rootCauseReason: loc.rootCauseReason,
+      traversalPath: path53,
+      edgeProvenances,
+      confidence,
+      ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+    });
+  }
+  const lastEdge = chain.edges[chain.edges.length - 1];
+  const errs = lastEdge.signal?.errorCount ?? 0;
+  const culpritName = culprit.replace(/^service:/, "");
+  return import_types.RootCauseResultSchema.parse({
+    rootCauseNode: culprit,
+    rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
+    traversalPath: path53,
+    edgeProvenances,
+    confidence,
+    fixRecommendation: `Inspect ${culpritName}'s failing handler`
   });
 }
 function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
@@ -1315,14 +1476,14 @@ function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
       });
     }
     if (frame.distance >= maxDepth) continue;
-    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
-    for (const [tgtId, edge] of outgoing) {
-      if (enqueued.has(tgtId)) continue;
-      enqueued.add(tgtId);
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(frame.nodeId));
+    for (const [srcId, edge] of incoming) {
+      if (enqueued.has(srcId)) continue;
+      enqueued.add(srcId);
       queue.push({
-        nodeId: tgtId,
+        nodeId: srcId,
         distance: frame.distance + 1,
-        path: [...frame.path, tgtId],
+        path: [...frame.path, srcId],
         pathEdges: [...frame.pathEdges, edge]
       });
     }
@@ -1378,6 +1539,62 @@ function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIE
     total: dependencies.length
   });
 }
+function getObservedDependencies(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) {
+    return import_types.ObservedDependenciesResultSchema.parse({
+      origin: nodeId,
+      dependencies: [],
+      observed: false,
+      inboundObservedCount: 0,
+      hasExtractedOutbound: false
+    });
+  }
+  const attrs = graph.getNodeAttributes(nodeId);
+  const scope = [nodeId];
+  if (attrs.type === import_types.NodeType.ServiceNode) {
+    for (const edgeId of graph.outboundEdges(nodeId)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== import_types.EdgeType.CONTAINS) continue;
+      const owned = graph.getNodeAttributes(e.target);
+      if (owned.type === import_types.NodeType.FileNode) scope.push(e.target);
+    }
+  }
+  const dependencies = [];
+  const seenEdge = /* @__PURE__ */ new Set();
+  let hasExtractedOutbound = false;
+  for (const src of scope) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (e.provenance === import_types.Provenance.OBSERVED) {
+        if (!seenEdge.has(e.id)) {
+          seenEdge.add(e.id);
+          dependencies.push(e);
+        }
+      } else if (e.provenance === import_types.Provenance.EXTRACTED) {
+        hasExtractedOutbound = true;
+      }
+    }
+  }
+  let inboundObservedCount = 0;
+  for (const tgt of scope) {
+    for (const edgeId of graph.inboundEdges(tgt)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (e.provenance === import_types.Provenance.OBSERVED) inboundObservedCount += 1;
+    }
+  }
+  dependencies.sort(
+    (a, b) => a.target.localeCompare(b.target) || a.source.localeCompare(b.source) || a.id.localeCompare(b.id)
+  );
+  return import_types.ObservedDependenciesResultSchema.parse({
+    origin: nodeId,
+    dependencies,
+    observed: dependencies.length > 0 || inboundObservedCount > 0,
+    inboundObservedCount,
+    hasExtractedOutbound
+  });
+}
 
 // src/policy.ts
 var DEFAULT_ACTION_BY_SEVERITY = {
@@ -1647,6 +1864,130 @@ function evaluateAllPolicies(graph, policies, ctx) {
   }
   return out;
 }
+function selectApplicablePolicies(graph, policies, nodeId) {
+  if (!graph.hasNode(nodeId)) return [];
+  const node = graph.getNodeAttributes(nodeId);
+  const out = [];
+  for (const policy of policies) {
+    const m = matchPolicyToNode(graph, policy, nodeId, node);
+    if (!m) continue;
+    out.push({
+      policyId: policy.id,
+      policyName: policy.name,
+      ...policy.description !== void 0 ? { description: policy.description } : {},
+      severity: policy.severity,
+      onViolation: resolveOnViolation(policy),
+      ruleType: policy.rule.type,
+      match: m.match,
+      reason: m.reason
+    });
+  }
+  return out;
+}
+function requiredProvenanceList(required) {
+  if (Array.isArray(required)) return required.join(" | ");
+  return String(required);
+}
+function nodeTouchesEdgeType(graph, nodeId, edgeType, requiredOtherEnd) {
+  const incident = [...graph.outboundEdges(nodeId), ...graph.inboundEdges(nodeId)];
+  for (const edgeId of incident) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== edgeType) continue;
+    if (requiredOtherEnd === void 0) return true;
+    if (e.source === requiredOtherEnd || e.target === requiredOtherEnd) return true;
+  }
+  return false;
+}
+function blastRadiusSubjectReaching(graph, rule, nodeId) {
+  let found = null;
+  graph.forEachNode((subjId, attrs) => {
+    if (found !== null) return;
+    if (subjId === nodeId) return;
+    if (attrs.type !== rule.nodeType) return;
+    const radius = rule.depth !== void 0 ? getBlastRadius(graph, subjId, rule.depth) : getBlastRadius(graph, subjId);
+    if (radius.affectedNodes.some((n) => n.nodeId === nodeId)) found = subjId;
+  });
+  return found;
+}
+function matchPolicyToNode(graph, policy, nodeId, node) {
+  const rule = policy.rule;
+  switch (rule.type) {
+    case "structural": {
+      if (node.type === rule.fromNodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.fromNodeType} must have a ${rule.edgeType} edge to a ${rule.toNodeType}`
+        };
+      }
+      if (node.type === rule.toNodeType) {
+        return {
+          match: "region",
+          reason: `${rule.fromNodeType} nodes must reach a ${rule.toNodeType} like this one via a ${rule.edgeType} edge`
+        };
+      }
+      return null;
+    }
+    case "ownership": {
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.nodeType} must declare a non-empty "${rule.field}" field`
+        };
+      }
+      return null;
+    }
+    case "blast-radius": {
+      const depthLabel = rule.depth !== void 0 ? ` at depth ${rule.depth}` : "";
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `no ${rule.nodeType} may exceed a blast radius of ${rule.maxAffected}${depthLabel}`
+        };
+      }
+      const subject = blastRadiusSubjectReaching(graph, rule, nodeId);
+      if (subject) {
+        return {
+          match: "region",
+          reason: `this node is in the blast radius of ${subject} (a ${rule.nodeType} held to a blast radius of ${rule.maxAffected}${depthLabel}) \u2014 it breaks if that ${rule.nodeType} changes`
+        };
+      }
+      return null;
+    }
+    case "compatibility": {
+      const kindLabel = rule.kind ?? "all compat shapes";
+      if (node.type === import_types2.NodeType.ServiceNode) {
+        return {
+          match: "subject",
+          reason: `this service's dependencies are compatibility-checked (${kindLabel})`
+        };
+      }
+      const reachesDriverEngine = rule.kind === void 0 || rule.kind === "driver-engine";
+      if (reachesDriverEngine && node.type === import_types2.NodeType.DatabaseNode && nodeTouchesEdgeType(graph, nodeId, import_types2.EdgeType.CONNECTS_TO)) {
+        return {
+          match: "region",
+          reason: "services connecting to this database have their driver/engine compatibility checked against it"
+        };
+      }
+      return null;
+    }
+    case "provenance": {
+      const requiredList = requiredProvenanceList(rule.required);
+      if (rule.targetNodeId !== void 0 && nodeId === rule.targetNodeId) {
+        return {
+          match: "subject",
+          reason: `every ${rule.edgeType} edge into ${rule.targetNodeId} must carry ${requiredList} provenance`
+        };
+      }
+      if (nodeTouchesEdgeType(graph, nodeId, rule.edgeType, rule.targetNodeId)) {
+        return {
+          match: "region",
+          reason: rule.targetNodeId !== void 0 ? `this node sits on a ${rule.edgeType} edge to ${rule.targetNodeId}, which must carry ${requiredList} provenance` : `this node sits on a ${rule.edgeType} edge, which must carry ${requiredList} provenance`
+        };
+      }
+      return null;
+    }
+  }
+}
 async function loadPolicyFile(policyPath) {
   let raw;
   try {
@@ -1755,9 +2096,9 @@ function loadIncidentThresholdsFromEnv() {
     return DEFAULT_INCIDENT_THRESHOLDS;
   }
 }
-function httpResponseStatus(span) {
+function httpResponseStatusFromAttrs(attrs) {
   for (const key of ["http.response.status_code", "http.status_code"]) {
-    const v = span.attributes[key];
+    const v = attrs[key];
     if (typeof v === "number" && Number.isFinite(v)) return v;
     if (typeof v === "string") {
       const n = Number(v);
@@ -1766,6 +2107,63 @@ function httpResponseStatus(span) {
   }
   return void 0;
 }
+function httpResponseStatus(span) {
+  return httpResponseStatusFromAttrs(span.attributes);
+}
+function httpFailureMessageFromAttrs(attrs) {
+  const status2 = httpResponseStatusFromAttrs(attrs);
+  const route = pickAttrFrom(attrs, "http.route", "http.target", "url.path");
+  const method = pickAttrFrom(attrs, "http.request.method", "http.method");
+  const where = route ? `${method ? `${method} ` : ""}${route}` : void 0;
+  if (status2 !== void 0 && where) return `${status2} on ${where}`;
+  if (status2 !== void 0) return `HTTP ${status2}`;
+  if (where) return `error on ${where}`;
+  return void 0;
+}
+var GRPC_STATUS_NAMES = {
+  1: "CANCELLED",
+  2: "UNKNOWN",
+  3: "INVALID_ARGUMENT",
+  4: "DEADLINE_EXCEEDED",
+  5: "NOT_FOUND",
+  6: "ALREADY_EXISTS",
+  7: "PERMISSION_DENIED",
+  8: "RESOURCE_EXHAUSTED",
+  9: "FAILED_PRECONDITION",
+  10: "ABORTED",
+  11: "OUT_OF_RANGE",
+  12: "UNIMPLEMENTED",
+  13: "INTERNAL",
+  14: "UNAVAILABLE",
+  15: "DATA_LOSS",
+  16: "UNAUTHENTICATED"
+};
+function grpcStatusCodeFromAttrs(attrs) {
+  const v = attrs["rpc.grpc.status_code"];
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  if (typeof v === "string") {
+    const n = Number(v);
+    if (Number.isFinite(n)) return n;
+  }
+  return void 0;
+}
+function nonHttpFailureMessageFromAttrs(attrs) {
+  const grpc2 = grpcStatusCodeFromAttrs(attrs);
+  if (grpc2 !== void 0 && grpc2 !== 0) {
+    const name = GRPC_STATUS_NAMES[grpc2] ?? `status ${grpc2}`;
+    const detail = pickAttrFrom(attrs, "rpc.grpc.status_message");
+    return detail ? `gRPC ${name}: ${detail}` : `gRPC ${name}`;
+  }
+  const errType = pickAttrFrom(attrs, "error.type");
+  if (errType && errType !== "_OTHER" && !/^\d+$/.test(errType)) {
+    const peer = pickAttrFrom(attrs, "server.address", "net.peer.name", "net.host.name");
+    return peer ? `${errType} connecting to ${peer}` : errType;
+  }
+  return void 0;
+}
+function incidentMessage(span) {
+  return span.exception?.message ?? httpFailureMessageFromAttrs(span.attributes) ?? nonHttpFailureMessageFromAttrs(span.attributes) ?? "unknown error";
+}
 function nowIso(ctx) {
   return new Date(ctx.now ? ctx.now() : Date.now()).toISOString();
 }
@@ -1785,13 +2183,16 @@ function warnNoSourceMaps(serviceName) {
     `[neat] ${serviceName}: no .map files found under dist/; observed file edges will land on dist paths, not src. Set sourceMap: true in tsconfig to enable file-level reconciliation.`
   );
 }
-function pickAttr(span, ...keys) {
+function pickAttrFrom(attrs, ...keys) {
   for (const k of keys) {
-    const v = span.attributes[k];
+    const v = attrs[k];
     if (typeof v === "string" && v.length > 0) return v;
   }
   return void 0;
 }
+function pickAttr(span, ...keys) {
+  return pickAttrFrom(span.attributes, ...keys);
+}
 function hostFromUrl(u) {
   if (!u) return void 0;
   try {
@@ -1803,6 +2204,10 @@ function hostFromUrl(u) {
 function pickAddress(span) {
   return pickAttr(span, "server.address", "net.peer.name", "net.host.name") ?? hostFromUrl(pickAttr(span, "url.full", "http.url"));
 }
+function isLoopbackHost(host) {
+  const h = host.toLowerCase();
+  return h === "localhost" || h === "ip6-localhost" || h === "::1" || h === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(h);
+}
 var CODE_FILEPATH_ATTR = "code.filepath";
 var CODE_LINENO_ATTR = "code.lineno";
 var CODE_FUNCTION_ATTR = "code.function";
@@ -1910,15 +2315,31 @@ function callSiteFromSpan(span, serviceNode, scanPath) {
     ...originalRelPath && originalRelPath !== relPath ? { originalRelPath } : {}
   };
 }
+function reconcileObservedRelPath(graph, serviceName, relPath) {
+  if (graph.hasNode((0, import_types3.fileId)(serviceName, relPath))) return relPath;
+  let best = null;
+  graph.forEachNode((_id, attrs) => {
+    const a = attrs;
+    if (a.type !== import_types3.NodeType.FileNode || a.service !== serviceName) return;
+    if (a.discoveredVia === "otel") return;
+    const p = a.path;
+    if (!p) return;
+    if ((relPath === p || relPath.endsWith(`/${p}`)) && (!best || p.length > best.length)) {
+      best = p;
+    }
+  });
+  return best ?? relPath;
+}
 function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
-  const fileNodeId = (0, import_types3.fileId)(serviceName, callSite.relPath);
+  const relPath = reconcileObservedRelPath(graph, serviceName, callSite.relPath);
+  const fileNodeId = (0, import_types3.fileId)(serviceName, relPath);
   if (!graph.hasNode(fileNodeId)) {
-    const language = languageForExt(callSite.relPath);
+    const language = languageForExt(relPath);
     const node = {
       id: fileNodeId,
       type: import_types3.NodeType.FileNode,
       service: serviceName,
-      path: callSite.relPath,
+      path: relPath,
       ...language ? { language } : {},
       ...callSite.originalRelPath ? { originalPath: callSite.originalRelPath } : {},
       discoveredVia: "otel"
@@ -1946,6 +2367,11 @@ function makeInferredEdgeId(type, source, target) {
 }
 var INFERRED_CONFIDENCE = 0.6;
 var STITCH_MAX_DEPTH = 2;
+var STITCH_EDGE_TYPES = /* @__PURE__ */ new Set([
+  import_types3.EdgeType.CALLS,
+  import_types3.EdgeType.CONNECTS_TO,
+  import_types3.EdgeType.DEPENDS_ON
+]);
 var WIRE_SPAN_KIND_CLIENT = 3;
 var WIRE_SPAN_KIND_PRODUCER = 4;
 function spanMintsObservedEdge(kind) {
@@ -2119,6 +2545,7 @@ function stitchTrace(graph, sourceServiceId, ts) {
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
       if (edge.provenance !== import_types3.Provenance.EXTRACTED) continue;
+      if (!STITCH_EDGE_TYPES.has(edge.type)) continue;
       if (graph.hasEdge((0, import_types3.observedEdgeId)(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
       if (!visited.has(edge.target)) {
@@ -2151,6 +2578,16 @@ async function appendErrorEvent(ctx, ev) {
   await import_node_fs4.promises.mkdir(import_node_path4.default.dirname(ctx.errorsPath), { recursive: true });
   await import_node_fs4.promises.appendFile(ctx.errorsPath, JSON.stringify(ev) + "\n", "utf8");
 }
+function incidentAffectedNode(span, graph, scanPath) {
+  const sid = (0, import_types3.serviceId)(span.service, span.env);
+  const serviceNode = graph && graph.hasNode(sid) ? graph.getNodeAttributes(sid) : void 0;
+  const callSite = callSiteFromSpan(span, serviceNode, scanPath);
+  if (callSite) {
+    const relPath = graph ? reconcileObservedRelPath(graph, span.service, callSite.relPath) : callSite.relPath;
+    return (0, import_types3.fileId)(span.service, relPath);
+  }
+  return sid;
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
@@ -2159,7 +2596,7 @@ function sanitizeAttributes(attrs) {
   }
   return out;
 }
-function buildErrorEventForReceiver(span) {
+function buildErrorEventForReceiver(span, graph, scanPath) {
   if (span.statusCode !== 2) return null;
   const ts = span.startTimeIso ?? (/* @__PURE__ */ new Date()).toISOString();
   const attrs = sanitizeAttributes(span.attributes);
@@ -2169,16 +2606,16 @@ function buildErrorEventForReceiver(span) {
     service: span.service,
     traceId: span.traceId,
     spanId: span.spanId,
-    errorMessage: span.exception?.message ?? "unknown error",
+    errorMessage: incidentMessage(span),
     ...span.exception?.type ? { exceptionType: span.exception.type } : {},
     ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
     ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-    affectedNode: (0, import_types3.serviceId)(span.service, span.env)
+    affectedNode: incidentAffectedNode(span, graph, scanPath)
   };
 }
-function makeErrorSpanWriter(errorsPath) {
+function makeErrorSpanWriter(errorsPath, graph, scanPath) {
   return async (span) => {
-    const ev = buildErrorEventForReceiver(span);
+    const ev = buildErrorEventForReceiver(span, graph, scanPath);
     if (!ev) return;
     await import_node_fs4.promises.mkdir(import_node_path4.default.dirname(errorsPath), { recursive: true });
     await import_node_fs4.promises.appendFile(errorsPath, JSON.stringify(ev) + "\n", "utf8");
@@ -2206,6 +2643,22 @@ async function recordFailingResponseIncident(ctx, span, affectedNode, timestamp,
   };
   await appendErrorEvent(ctx, ev);
 }
+async function recordExceptionIncident(ctx, span, ts) {
+  const attrs = sanitizeAttributes(span.attributes);
+  const ev = {
+    id: `${span.traceId}:${span.spanId}`,
+    timestamp: ts,
+    service: span.service,
+    traceId: span.traceId,
+    spanId: span.spanId,
+    errorMessage: incidentMessage(span),
+    ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+    ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+    ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
+    affectedNode: incidentAffectedNode(span, ctx.graph, ctx.scanPath)
+  };
+  await appendErrorEvent(ctx, ev);
+}
 async function advance4xxBurst(ctx, span, affectedNode, ts, nowMs, status2) {
   const { threshold, windowMs } = loadIncidentThresholdsFromEnv();
   if (!ctx.burstState) ctx.burstState = /* @__PURE__ */ new Map();
@@ -2262,7 +2715,10 @@ async function handleSpan(ctx, span) {
   const callSite = callSiteFromSpan(span, sourceServiceNode, ctx.scanPath);
   cacheSpanService(span, nowMs, callSite);
   const observedSource = () => callSite ? ensureObservedFileNode(ctx.graph, span.service, sourceId, callSite) : sourceId;
-  const callSiteEvidence = callSite ? { file: callSite.relPath, ...callSite.line !== void 0 ? { line: callSite.line } : {} } : void 0;
+  const callSiteEvidence = callSite ? {
+    file: reconcileObservedRelPath(ctx.graph, span.service, callSite.relPath),
+    ...callSite.line !== void 0 ? { line: callSite.line } : {}
+  } : void 0;
   let affectedNode = sourceId;
   const mintsFromCallerSide = spanMintsObservedEdge(span.kind);
   if (span.dbSystem) {
@@ -2284,7 +2740,7 @@ async function handleSpan(ctx, span) {
   } else {
     const host = pickAddress(span);
     let resolvedViaAddress = false;
-    if (mintsFromCallerSide && host && host !== span.service) {
+    if (mintsFromCallerSide && host && host !== span.service && !isLoopbackHost(host)) {
       const targetId = resolveServiceId(ctx.graph, host, env);
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
@@ -2319,7 +2775,11 @@ async function handleSpan(ctx, span) {
         const parentId = ensureServiceNode(ctx.graph, parent.service, parent.env);
         const fallbackSource = parent.callSite ? ensureObservedFileNode(ctx.graph, parent.service, parentId, parent.callSite) : parentId;
         const fallbackEvidence = parent.callSite ? {
-          file: parent.callSite.relPath,
+          file: reconcileObservedRelPath(
+            ctx.graph,
+            parent.service,
+            parent.callSite.relPath
+          ),
           ...parent.callSite.line !== void 0 ? { line: parent.callSite.line } : {}
         } : void 0;
         upsertObservedEdge(
@@ -2344,7 +2804,7 @@ async function handleSpan(ctx, span) {
         service: span.service,
         traceId: span.traceId,
         spanId: span.spanId,
-        errorMessage: span.exception?.message ?? "unknown error",
+        errorMessage: incidentMessage(span),
         ...span.exception?.type ? { exceptionType: span.exception.type } : {},
         ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
         ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
@@ -2355,7 +2815,9 @@ async function handleSpan(ctx, span) {
   }
   if (span.statusCode !== 2) {
     const status2 = httpResponseStatus(span);
-    if (status2 !== void 0 && status2 >= 500) {
+    if (span.exception) {
+      await recordExceptionIncident(ctx, span, ts);
+    } else if (status2 !== void 0 && status2 >= 500) {
       await recordFailingResponseIncident(ctx, span, sourceId, ts, status2, 1);
     } else if (status2 !== void 0 && status2 >= 400 && spanMintsObservedEdge(span.kind)) {
       await advance4xxBurst(ctx, span, sourceId, ts, nowMs, status2);
@@ -2520,12 +2982,43 @@ function startStalenessLoop(graph, options = {}) {
 async function readErrorEvents(errorsPath) {
   try {
     const raw = await import_node_fs4.promises.readFile(errorsPath, "utf8");
-    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    return dedupeIncidents(events);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
 }
+function isSynthesizedHttpIncident(ev) {
+  if (ev.exceptionType || ev.exceptionStacktrace) return false;
+  if (ev.errorType) return false;
+  if (!ev.attributes) return false;
+  const synth = httpFailureMessageFromAttrs(ev.attributes);
+  return synth !== void 0 && synth === ev.errorMessage;
+}
+function dedupeIncidents(events) {
+  const seen = /* @__PURE__ */ new Set();
+  const once = [];
+  for (const ev of events) {
+    const key = ev.id ?? (ev.traceId && ev.spanId ? `${ev.traceId}:${ev.spanId}` : void 0);
+    if (key === void 0) {
+      once.push(ev);
+      continue;
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    once.push(ev);
+  }
+  const groupKey = (ev) => `${ev.traceId}\0${ev.affectedNode}`;
+  const hasRealFailure = /* @__PURE__ */ new Set();
+  for (const ev of once) {
+    if (ev.traceId && !isSynthesizedHttpIncident(ev)) hasRealFailure.add(groupKey(ev));
+  }
+  return once.filter((ev) => {
+    if (!ev.traceId || !isSynthesizedHttpIncident(ev)) return true;
+    return !hasRealFailure.has(groupKey(ev));
+  });
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
   let nodesAdded = 0;
@@ -2606,10 +3099,17 @@ function isConfigFile(name) {
   if (CONFIG_FILE_EXTENSIONS.has(ext)) return { match: true, fileType: ext.slice(1) };
   if (name === ".env" || name.startsWith(".env.")) {
     if (isEnvTemplateFile(name)) return { match: false, fileType: "" };
+    if (isNeatAuthoredEnvFile(name)) return { match: false, fileType: "" };
     return { match: true, fileType: "env" };
   }
   return { match: false, fileType: "" };
 }
+function isNeatAuthoredEnvFile(name) {
+  return name === ".env.neat";
+}
+function isNeatAuthoredSourceFile(name) {
+  return /^otel-init\.(?:js|cjs|mjs|ts|tsx)$/i.test(name);
+}
 function isTestPath(filePath) {
   const normalised = filePath.replace(/\\/g, "/");
   const segments = normalised.split("/");
@@ -3315,7 +3815,9 @@ async function walkSourceFiles(dir) {
         if (IGNORED_DIRS.has(entry2.name)) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk(full);
-      } else if (entry2.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path11.default.extname(entry2.name))) {
+      } else if (entry2.isFile() && SERVICE_FILE_EXTENSIONS.has(import_node_path11.default.extname(entry2.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
+      // would attribute our instrumentation imports to the user's service.
+      !isNeatAuthoredSourceFile(entry2.name)) {
         out.push(full);
       }
     }
@@ -3485,11 +3987,28 @@ function collectJsImports(node, out) {
     if (child) collectJsImports(child, out);
   }
 }
+function collectImportedNames(node, out) {
+  if (node.type === "aliased_import") {
+    const nameNode = node.childForFieldName("name");
+    if (nameNode) out.push(nameNode.text);
+    return;
+  }
+  if (node.type === "dotted_name") {
+    out.push(node.text);
+    return;
+  }
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child) collectImportedNames(child, out);
+  }
+}
 function collectPyImports(node, out) {
   if (node.type === "import_from_statement") {
     let level = 0;
     let modulePath = "";
+    const names = [];
     let pastFrom = false;
+    let pastImport = false;
     for (let i = 0; i < node.childCount; i++) {
       const child = node.child(i);
       if (!child) continue;
@@ -3497,26 +4016,30 @@ function collectPyImports(node, out) {
         if (child.type === "from") pastFrom = true;
         continue;
       }
-      if (child.type === "import") break;
-      if (child.type === "relative_import") {
-        for (let j = 0; j < child.childCount; j++) {
-          const rc = child.child(j);
-          if (!rc) continue;
-          if (rc.type === "import_prefix") {
-            for (let k = 0; k < rc.childCount; k++) {
-              if (rc.child(k)?.type === ".") level++;
-            }
-          } else if (rc.type === "dotted_name") modulePath = rc.text;
+      if (!pastImport) {
+        if (child.type === "import") {
+          pastImport = true;
+          continue;
         }
-        break;
-      }
-      if (child.type === "dotted_name") {
-        modulePath = child.text;
-        break;
+        if (child.type === "relative_import") {
+          for (let j = 0; j < child.childCount; j++) {
+            const rc = child.child(j);
+            if (!rc) continue;
+            if (rc.type === "import_prefix") {
+              for (let k = 0; k < rc.childCount; k++) {
+                if (rc.child(k)?.type === ".") level++;
+              }
+            } else if (rc.type === "dotted_name") modulePath = rc.text;
+          }
+        } else if (child.type === "dotted_name") {
+          modulePath = child.text;
+        }
+        continue;
       }
+      collectImportedNames(child, names);
     }
     if (level > 0 || modulePath) {
-      out.push({ modulePath, level, line: node.startPosition.row + 1, snippet: clipSnippet(node.text) });
+      out.push({ modulePath, level, names, line: node.startPosition.row + 1, snippet: clipSnippet(node.text) });
     }
   }
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -3618,8 +4141,6 @@ async function resolveJsImport(specifier, importerDir, serviceDir, tsPaths) {
   return null;
 }
 async function resolvePyImport(imp, importerPath, serviceDir) {
-  if (!imp.modulePath) return null;
-  const relPath = imp.modulePath.split(".").join("/");
   let baseDir;
   if (imp.level > 0) {
     baseDir = import_node_path13.default.dirname(importerPath);
@@ -3627,13 +4148,30 @@ async function resolvePyImport(imp, importerPath, serviceDir) {
   } else {
     baseDir = serviceDir;
   }
-  const candidates = [import_node_path13.default.join(baseDir, `${relPath}.py`), import_node_path13.default.join(baseDir, relPath, "__init__.py")];
-  for (const candidate of candidates) {
-    if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
-      return toPosix2(import_node_path13.default.relative(serviceDir, candidate));
+  const moduleBase = imp.modulePath ? import_node_path13.default.join(baseDir, imp.modulePath.split(".").join("/")) : baseDir;
+  const resolved = /* @__PURE__ */ new Set();
+  let needModuleFile = imp.names.length === 0;
+  for (const name of imp.names) {
+    const submoduleFile = import_node_path13.default.join(moduleBase, `${name}.py`);
+    const subpackageInit = import_node_path13.default.join(moduleBase, name, "__init__.py");
+    if (isWithinServiceDir(submoduleFile, serviceDir) && await fileExists(submoduleFile)) {
+      resolved.add(toPosix2(import_node_path13.default.relative(serviceDir, submoduleFile)));
+    } else if (isWithinServiceDir(subpackageInit, serviceDir) && await fileExists(subpackageInit)) {
+      resolved.add(toPosix2(import_node_path13.default.relative(serviceDir, subpackageInit)));
+    } else {
+      needModuleFile = true;
     }
   }
-  return null;
+  if (needModuleFile) {
+    const moduleFileCandidates = imp.modulePath ? [`${moduleBase}.py`, import_node_path13.default.join(moduleBase, "__init__.py")] : [import_node_path13.default.join(moduleBase, "__init__.py")];
+    for (const candidate of moduleFileCandidates) {
+      if (isWithinServiceDir(candidate, serviceDir) && await fileExists(candidate)) {
+        resolved.add(toPosix2(import_node_path13.default.relative(serviceDir, candidate)));
+        break;
+      }
+    }
+  }
+  return [...resolved];
 }
 function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, importeeRelPath, line, snippet2) {
   const importeeFileId = (0, import_types8.fileId)(serviceName, importeeRelPath);
@@ -3674,17 +4212,18 @@ async function addImports(graph, services) {
           continue;
         }
         for (const imp of pyImports) {
-          const resolved = await resolvePyImport(imp, file.path, service.dir);
-          if (!resolved) continue;
-          edgesAdded += emitImportEdge(
-            graph,
-            service.pkg.name,
-            importerFileId,
-            relFile,
-            resolved,
-            imp.line,
-            imp.snippet
-          );
+          const resolvedPaths = await resolvePyImport(imp, file.path, service.dir);
+          for (const resolved of resolvedPaths) {
+            edgesAdded += emitImportEdge(
+              graph,
+              service.pkg.name,
+              importerFileId,
+              relFile,
+              resolved,
+              imp.line,
+              imp.snippet
+            );
+          }
         }
         continue;
       }
@@ -4320,6 +4859,36 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
         edgesAdded++;
       }
     }
+    if (allConfigs.length === 1) {
+      const primary = allConfigs[0];
+      service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
+      const relPath = import_node_path21.default.relative(scanPath, primary.sourceFile);
+      const cfgId = (0, import_types9.configId)(relPath);
+      if (!graph.hasNode(cfgId)) {
+        const cfgNode = {
+          id: cfgId,
+          type: import_types9.NodeType.ConfigNode,
+          name: import_node_path21.default.basename(primary.sourceFile),
+          path: relPath,
+          fileType: isConfigFile(import_node_path21.default.basename(primary.sourceFile)).fileType || "config"
+        };
+        graph.addNode(cfgId, cfgNode);
+        nodesAdded++;
+      }
+      const cfgEdge = {
+        id: (0, import_types4.extractedEdgeId)(service.node.id, cfgId, import_types9.EdgeType.CONFIGURED_BY),
+        source: service.node.id,
+        target: cfgId,
+        type: import_types9.EdgeType.CONFIGURED_BY,
+        provenance: import_types9.Provenance.EXTRACTED,
+        confidence: (0, import_types9.confidenceForExtracted)("structural"),
+        evidence: { file: toPosix2(relPath) }
+      };
+      if (!graph.hasEdge(cfgEdge.id)) {
+        graph.addEdgeWithKey(cfgEdge.id, cfgEdge.source, cfgEdge.target, cfgEdge);
+        edgesAdded++;
+      }
+    }
     attachIncompatibilities(service, allConfigs);
     if (graph.hasNode(service.node.id)) {
       const current = graph.getNodeAttributes(service.node.id);
@@ -4331,6 +4900,9 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       if (!service.node.incompatibilities || service.node.incompatibilities.length === 0) {
         delete updated.incompatibilities;
       }
+      if (!service.node.dbConnectionTarget) {
+        delete updated.dbConnectionTarget;
+      }
       graph.replaceNodeAttributes(service.node.id, updated);
     }
   }
@@ -4508,7 +5080,7 @@ async function addHttpCallEdges(graph, services) {
         const dedupKey = `${relFile}|${targetId}`;
         if (seen.has(dedupKey)) continue;
         seen.add(dedupKey);
-        const confidence = (0, import_types11.confidenceForExtracted)("hostname-shape-match");
+        const confidence = (0, import_types11.confidenceForExtracted)("url-literal-service-target");
         const ev = {
           file: relFile,
           line: site.line,
@@ -4528,7 +5100,7 @@ async function addHttpCallEdges(graph, services) {
             target: targetId,
             type: import_types11.EdgeType.CALLS,
             confidence,
-            confidenceKind: "hostname-shape-match",
+            confidenceKind: "url-literal-service-target",
             evidence: ev
           });
           continue;
@@ -5034,19 +5606,29 @@ init_cjs_shims();
 var import_node_path30 = __toESM(require("path"), 1);
 var import_node_fs16 = require("fs");
 var import_types20 = require("@neat.is/types");
-function runtimeImage(content) {
-  const lines = content.split("\n");
-  let last = null;
-  for (const raw of lines) {
+function readDockerfile(content) {
+  let image = null;
+  const ports = [];
+  let cmd = null;
+  let entrypoint = null;
+  for (const raw of content.split("\n")) {
     const line = raw.trim();
     if (!line || line.startsWith("#")) continue;
-    if (!/^from\s+/i.test(line)) continue;
-    const tokens = line.split(/\s+/);
-    const image = tokens[1];
-    if (!image || image.toLowerCase() === "scratch") continue;
-    last = image;
+    if (/^from\s+/i.test(line)) {
+      const candidate = line.split(/\s+/)[1];
+      if (candidate && candidate.toLowerCase() !== "scratch") image = candidate;
+    } else if (/^expose\s+/i.test(line)) {
+      for (const token of line.split(/\s+/).slice(1)) {
+        const port = Number.parseInt(token.split("/")[0], 10);
+        if (Number.isInteger(port) && !ports.includes(port)) ports.push(port);
+      }
+    } else if (/^entrypoint\s+/i.test(line)) {
+      entrypoint = line;
+    } else if (/^cmd\s+/i.test(line)) {
+      cmd = line;
+    }
   }
-  return last;
+  return { image, ports, entrypoint: entrypoint ?? cmd };
 }
 async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
@@ -5065,14 +5647,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       );
       continue;
     }
-    const image = runtimeImage(content);
-    if (!image) continue;
-    const node = makeInfraNode("container-image", image);
+    const facts = readDockerfile(content);
+    if (!facts.image) continue;
+    const node = makeInfraNode("container-image", facts.image);
     if (!graph.hasNode(node.id)) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
     const relDockerfile = toPosix2(import_node_path30.default.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix2(import_node_path30.default.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -5091,12 +5674,33 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         provenance: import_types20.Provenance.EXTRACTED,
         confidence: (0, import_types20.confidenceForExtracted)("structural"),
         evidence: {
-          file: toPosix2(import_node_path30.default.relative(scanPath, dockerfilePath))
+          file: evidenceFile,
+          ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
         }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
       edgesAdded++;
     }
+    for (const port of facts.ports) {
+      const portNode = makeInfraNode("port", String(port));
+      if (!graph.hasNode(portNode.id)) {
+        graph.addNode(portNode.id, portNode);
+        nodesAdded++;
+      }
+      const portEdgeId = (0, import_types4.extractedEdgeId)(fileNodeId, portNode.id, import_types20.EdgeType.CONNECTS_TO);
+      if (graph.hasEdge(portEdgeId)) continue;
+      const portEdge = {
+        id: portEdgeId,
+        source: fileNodeId,
+        target: portNode.id,
+        type: import_types20.EdgeType.CONNECTS_TO,
+        provenance: import_types20.Provenance.EXTRACTED,
+        confidence: (0, import_types20.confidenceForExtracted)("structural"),
+        evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
+      };
+      graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
+      edgesAdded++;
+    }
   }
   return { nodesAdded, edgesAdded };
 }
@@ -5105,7 +5709,9 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs17 = require("fs");
 var import_node_path31 = __toESM(require("path"), 1);
+var import_types21 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
@@ -5122,24 +5728,86 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   }
   return out;
 }
+function blockBody(content, from) {
+  const open = content.indexOf("{", from);
+  if (open === -1) return null;
+  let depth = 0;
+  for (let i = open; i < content.length; i++) {
+    const ch = content[i];
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) return { body: content.slice(open + 1, i), offset: open + 1 };
+    }
+  }
+  return null;
+}
+function lineAt(content, index) {
+  let line = 1;
+  for (let i = 0; i < index && i < content.length; i++) {
+    if (content[i] === "\n") line++;
+  }
+  return line;
+}
 async function addTerraformResources(graph, scanPath) {
   let nodesAdded = 0;
+  let edgesAdded = 0;
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
     const content = await import_node_fs17.promises.readFile(file, "utf8");
+    const evidenceFile = toPosix2(import_node_path31.default.relative(scanPath, file));
+    const resources = [];
+    const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
     let m;
     while ((m = RESOURCE_RE.exec(content)) !== null) {
-      const kind = m[1];
+      const type = m[1];
       const name = m[2];
-      const node = makeInfraNode(kind, name, "aws");
+      const node = makeInfraNode(type, name, "aws");
       if (!graph.hasNode(node.id)) {
         graph.addNode(node.id, node);
         nodesAdded++;
       }
+      const span = blockBody(content, RESOURCE_RE.lastIndex);
+      const resource = {
+        type,
+        name,
+        nodeId: node.id,
+        body: span?.body ?? "",
+        bodyOffset: span?.offset ?? RESOURCE_RE.lastIndex
+      };
+      resources.push(resource);
+      byKey.set(`${type}.${name}`, resource);
+    }
+    for (const resource of resources) {
+      const seen = /* @__PURE__ */ new Set();
+      REFERENCE_RE.lastIndex = 0;
+      let ref;
+      while ((ref = REFERENCE_RE.exec(resource.body)) !== null) {
+        const key = `${ref[1]}.${ref[2]}`;
+        if (key === `${resource.type}.${resource.name}`) continue;
+        const target = byKey.get(key);
+        if (!target) continue;
+        if (seen.has(target.nodeId)) continue;
+        seen.add(target.nodeId);
+        const edgeId = (0, import_types4.extractedEdgeId)(resource.nodeId, target.nodeId, import_types21.EdgeType.DEPENDS_ON);
+        if (graph.hasEdge(edgeId)) continue;
+        const line = lineAt(content, resource.bodyOffset + ref.index);
+        const edge = {
+          id: edgeId,
+          source: resource.nodeId,
+          target: target.nodeId,
+          type: import_types21.EdgeType.DEPENDS_ON,
+          provenance: import_types21.Provenance.EXTRACTED,
+          confidence: (0, import_types21.confidenceForExtracted)("structural"),
+          evidence: { file: evidenceFile, line, snippet: key }
+        };
+        graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+        edgesAdded++;
+      }
     }
   }
-  return { nodesAdded, edgesAdded: 0 };
+  return { nodesAdded, edgesAdded };
 }
 
 // src/extract/infra/k8s.ts
@@ -5217,11 +5885,11 @@ var import_node_path34 = __toESM(require("path"), 1);
 init_cjs_shims();
 var import_node_fs19 = require("fs");
 var import_node_path33 = __toESM(require("path"), 1);
-var import_types21 = require("@neat.is/types");
+var import_types22 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types21.NodeType.FileNode) return;
+    if (attrs.type !== import_types22.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -5234,7 +5902,7 @@ function retireEdgesByFile(graph, file) {
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types21.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types22.Provenance.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -5247,7 +5915,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types21.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types22.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (import_node_path33.default.isAbsolute(evidenceFile)) {
@@ -5328,7 +5996,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/divergences.ts
 init_cjs_shims();
-var import_types22 = require("@neat.is/types");
+var import_types23 = require("@neat.is/types");
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
@@ -5336,22 +6004,22 @@ function bucketEdges(graph) {
   const buckets = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    const parsed = (0, import_types22.parseEdgeId)(id);
+    const parsed = (0, import_types23.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
     const key = bucketKey(e.source, e.target, e.type);
     const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
-      case import_types22.Provenance.EXTRACTED:
+      case import_types23.Provenance.EXTRACTED:
         cur.extracted = e;
         break;
-      case import_types22.Provenance.OBSERVED:
+      case import_types23.Provenance.OBSERVED:
         cur.observed = e;
         break;
-      case import_types22.Provenance.INFERRED:
+      case import_types23.Provenance.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === import_types22.Provenance.STALE) cur.stale = e;
+        if (e.provenance === import_types23.Provenance.STALE) cur.stale = e;
     }
     buckets.set(key, cur);
   });
@@ -5360,7 +6028,7 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types22.NodeType.FrontierNode;
+  return attrs.type === import_types23.NodeType.FrontierNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -5379,10 +6047,16 @@ function gradedConfidence(edge) {
   if (typeof edge.confidence === "number") return clampConfidence(edge.confidence);
   return clampConfidence(confidenceForEdge(edge));
 }
+var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
+  import_types23.EdgeType.CALLS,
+  import_types23.EdgeType.CONNECTS_TO,
+  import_types23.EdgeType.PUBLISHES_TO,
+  import_types23.EdgeType.CONSUMES_FROM
+]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === import_types22.EdgeType.CONTAINS) return out;
-  if (bucket.extracted && !bucket.observed) {
+  if (bucket.type === import_types23.EdgeType.CONTAINS) return out;
+  if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
       out.push({
         type: "missing-observed",
@@ -5422,7 +6096,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === import_types22.EdgeType.CONFIGURED_BY && e.provenance === import_types22.Provenance.EXTRACTED) {
+    if (e.type === import_types23.EdgeType.CONFIGURED_BY && e.provenance === import_types23.Provenance.EXTRACTED) {
       return true;
     }
   }
@@ -5435,10 +6109,10 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types22.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types22.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types23.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types23.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types22.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types23.NodeType.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -5460,10 +6134,10 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types22.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types22.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types23.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types23.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types22.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types23.NodeType.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -5516,6 +6190,23 @@ function detectCompatDivergences(graph, svcId, svc) {
 function involvesNode(d, nodeId) {
   return d.source === nodeId || d.target === nodeId;
 }
+function suppressHostMismatchHalves(all) {
+  const observedHalf = /* @__PURE__ */ new Set();
+  const declaredHalf = /* @__PURE__ */ new Set();
+  for (const d of all) {
+    if (d.type !== "host-mismatch") continue;
+    observedHalf.add(`${d.source}->${d.target}`);
+    declaredHalf.add((0, import_types23.databaseId)(d.extractedHost));
+  }
+  if (observedHalf.size === 0) return all;
+  return all.filter((d) => {
+    if (d.type === "missing-extracted" && observedHalf.has(`${d.source}->${d.target}`)) {
+      return false;
+    }
+    if (d.type === "missing-observed" && declaredHalf.has(d.target)) return false;
+    return true;
+  });
+}
 function computeDivergences(graph, opts = {}) {
   const all = [];
   const buckets = bucketEdges(graph);
@@ -5524,12 +6215,13 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type !== import_types22.NodeType.ServiceNode) return;
+    if (n.type !== import_types23.NodeType.ServiceNode) return;
     const svc = n;
     for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
     for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
   });
-  let filtered = all;
+  const reconciled = suppressHostMismatchHalves(all);
+  let filtered = reconciled;
   if (opts.type) {
     const allowed = opts.type;
     filtered = filtered.filter((d) => allowed.has(d.type));
@@ -5557,7 +6249,7 @@ function computeDivergences(graph, opts = {}) {
     if (a.source !== b.source) return a.source.localeCompare(b.source);
     return a.target.localeCompare(b.target);
   });
-  return import_types22.DivergenceResultSchema.parse({
+  return import_types23.DivergenceResultSchema.parse({
     divergences: filtered,
     totalAffected: filtered.length,
     computedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -5568,7 +6260,7 @@ function computeDivergences(graph, opts = {}) {
 init_cjs_shims();
 var import_node_fs20 = require("fs");
 var import_node_path35 = __toESM(require("path"), 1);
-var import_types23 = require("@neat.is/types");
+var import_types24 = require("@neat.is/types");
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -5590,12 +6282,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types23.Provenance.OBSERVED;
+      attrs.provenance = import_types24.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types23.observedEdgeId)(source, target, type);
+        const newId = (0, import_types24.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -5721,7 +6413,7 @@ ${NEAT_OUT_LINE}
 
 // src/summary.ts
 init_cjs_shims();
-var import_types24 = require("@neat.is/types");
+var import_types25 = require("@neat.is/types");
 function renderOtelEnvBlock() {
   return [
     "for prod OTel routing, set these in your deploy platform's env:",
@@ -5731,19 +6423,19 @@ function renderOtelEnvBlock() {
 }
 function findIncompatServices(nodes) {
   return nodes.filter(
-    (n) => n.type === import_types24.NodeType.ServiceNode && Array.isArray(n.incompatibilities) && (n.incompatibilities ?? []).length > 0
+    (n) => n.type === import_types25.NodeType.ServiceNode && Array.isArray(n.incompatibilities) && (n.incompatibilities ?? []).length > 0
   );
 }
 function servicesWithoutObserved(nodes, edges) {
   const seen = /* @__PURE__ */ new Set();
   for (const e of edges) {
-    if (e.provenance === import_types24.Provenance.OBSERVED) {
+    if (e.provenance === import_types25.Provenance.OBSERVED) {
       seen.add(e.source);
       seen.add(e.target);
     }
   }
   return nodes.filter(
-    (n) => n.type === import_types24.NodeType.ServiceNode && !seen.has(n.id)
+    (n) => n.type === import_types25.NodeType.ServiceNode && !seen.has(n.id)
   );
 }
 function formatDivergence(d) {
@@ -5817,15 +6509,15 @@ function formatIncompat(inc) {
 
 // src/watch.ts
 init_cjs_shims();
-var import_node_fs27 = __toESM(require("fs"), 1);
-var import_node_path44 = __toESM(require("path"), 1);
+var import_node_fs29 = __toESM(require("fs"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
 var import_chokidar = __toESM(require("chokidar"), 1);
 
 // src/api.ts
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types26 = require("@neat.is/types");
+var import_types27 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -6276,7 +6968,7 @@ init_cjs_shims();
 var import_node_fs25 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path40 = __toESM(require("path"), 1);
-var import_types25 = require("@neat.is/types");
+var import_types26 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
@@ -6530,10 +7222,10 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types25.RegistryFileSchema.parse(parsed);
+  return import_types26.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types25.RegistryFileSchema.parse(reg);
+  const validated = import_types26.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
 var ProjectNameCollisionError = class extends Error {
@@ -6845,6 +7537,18 @@ function registerRoutes(scope, ctx) {
     }
     return getTransitiveDependencies(proj.graph, nodeId, depth);
   });
+  scope.get(
+    "/graph/observed-dependencies/:nodeId",
+    async (req, reply) => {
+      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+      if (!proj) return;
+      const { nodeId } = req.params;
+      if (!proj.graph.hasNode(nodeId)) {
+        return reply.code(404).send({ error: "node not found", id: nodeId });
+      }
+      return getObservedDependencies(proj.graph, nodeId);
+    }
+  );
   scope.get("/graph/divergences", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -6853,11 +7557,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types26.DivergenceTypeSchema.safeParse(c);
+        const r = import_types27.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types26.DivergenceTypeSchema.options
+            allowed: import_types27.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -6905,23 +7609,29 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  const incidentHistoryHandler = async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const { nodeId } = req.params;
+    if (!proj.graph.hasNode(nodeId)) {
+      reply.code(404).send({ error: "node not found", id: nodeId });
+      return;
+    }
+    const epath = errorsPathFor(proj);
+    if (!epath) return { count: 0, total: 0, events: [] };
+    const events = await readErrorEvents(epath);
+    const filtered = events.filter(
+      (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
+    );
+    return { count: filtered.length, total: filtered.length, events: filtered };
+  };
   scope.get(
     "/incidents/:nodeId",
-    async (req, reply) => {
-      const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
-      if (!proj) return;
-      const { nodeId } = req.params;
-      if (!proj.graph.hasNode(nodeId)) {
-        return reply.code(404).send({ error: "node not found", id: nodeId });
-      }
-      const epath = errorsPathFor(proj);
-      if (!epath) return { count: 0, total: 0, events: [] };
-      const events = await readErrorEvents(epath);
-      const filtered = events.filter(
-        (e) => e.affectedNode === nodeId || e.service === nodeId.replace(/^service:/, "")
-      );
-      return { count: filtered.length, total: filtered.length, events: filtered };
-    }
+    incidentHistoryHandler
+  );
+  scope.get(
+    "/graph/incident-history/:nodeId",
+    incidentHistoryHandler
   );
   scope.get("/graph/root-cause/:nodeId", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
@@ -6930,16 +7640,16 @@ function registerRoutes(scope, ctx) {
     if (!proj.graph.hasNode(nodeId)) {
       return reply.code(404).send({ error: "node not found", id: nodeId });
     }
-    let errorEvent;
     const epath = errorsPathFor(proj);
-    if (req.query.errorId && epath) {
-      const events = await readErrorEvents(epath);
-      errorEvent = events.find((e) => e.id === req.query.errorId);
+    const incidents = epath ? await readErrorEvents(epath) : [];
+    let errorEvent;
+    if (req.query.errorId) {
+      errorEvent = incidents.find((e) => e.id === req.query.errorId);
       if (!errorEvent) {
         return reply.code(404).send({ error: "error event not found", id: req.query.errorId });
       }
     }
-    const result = getRootCause(proj.graph, nodeId, errorEvent);
+    const result = getRootCause(proj.graph, nodeId, errorEvent, incidents);
     if (!result) return reply.code(404).send({ error: "no root cause found", id: nodeId });
     return result;
   });
@@ -7070,7 +7780,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types26.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types27.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -7084,10 +7794,32 @@ function registerRoutes(scope, ctx) {
     }
     return { violations };
   });
+  scope.get("/policies/applicable", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const nodeId = req.query.node;
+    if (!nodeId) {
+      return reply.code(400).send({ error: 'missing required query param "node"' });
+    }
+    const policyPath = ctx.policyFilePathFor(proj);
+    let policies = [];
+    if (policyPath) {
+      try {
+        policies = await loadPolicyFile(policyPath);
+      } catch (err) {
+        return reply.code(400).send({
+          error: "policy.json failed to parse",
+          details: err.message
+        });
+      }
+    }
+    const applicable = selectApplicablePolicies(proj.graph, policies, nodeId);
+    return { node: nodeId, applicable };
+  });
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types26.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types27.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -7346,12 +8078,111 @@ async function buildApi(opts) {
 // src/watch.ts
 init_auth();
 init_otel();
-init_otel_grpc();
 
-// src/search.ts
+// src/daemon.ts
+init_cjs_shims();
+var import_node_fs27 = require("fs");
+var import_node_path44 = __toESM(require("path"), 1);
+var import_node_module = require("module");
+init_otel();
+init_auth();
+
+// src/unrouted.ts
 init_cjs_shims();
 var import_node_fs26 = require("fs");
 var import_node_path43 = __toESM(require("path"), 1);
+
+// src/daemon.ts
+var import_types28 = require("@neat.is/types");
+function daemonJsonPath(scanPath) {
+  return import_node_path44.default.join(scanPath, "neat-out", "daemon.json");
+}
+function daemonsDiscoveryDir(home) {
+  const base = home && home.length > 0 ? home : neatHomeFromEnv();
+  return import_node_path44.default.join(base, "daemons");
+}
+function daemonDiscoveryPath(project, home) {
+  return import_node_path44.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+}
+function sanitizeDiscoveryName(project) {
+  return project.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function neatHomeFromEnv() {
+  const env = process.env.NEAT_HOME;
+  if (env && env.length > 0) return import_node_path44.default.resolve(env);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return import_node_path44.default.join(home, ".neat");
+}
+async function readDaemonRecord(scanPath) {
+  try {
+    const raw = await import_node_fs27.promises.readFile(daemonJsonPath(scanPath), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveNeatVersion() {
+  if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
+    return process.env.NEAT_LOCAL_VERSION;
+  }
+  try {
+    const req = (0, import_node_module.createRequire)(importMetaUrl);
+    const pkg = req("../package.json");
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function writeDaemonRecord(record, home) {
+  const body = JSON.stringify(record, null, 2) + "\n";
+  await writeAtomically(daemonJsonPath(record.projectPath), body);
+  try {
+    await writeAtomically(daemonDiscoveryPath(record.project, home), body);
+  } catch (err) {
+    console.warn(
+      `neatd: could not write discovery copy for "${record.project}" \u2014 ${err.message}`
+    );
+  }
+}
+async function clearDaemonRecord(record, home) {
+  try {
+    const stopped = { ...record, status: "stopped" };
+    await writeAtomically(daemonJsonPath(record.projectPath), JSON.stringify(stopped, null, 2) + "\n");
+  } catch {
+  }
+  try {
+    await import_node_fs27.promises.unlink(daemonDiscoveryPath(record.project, home));
+  } catch {
+  }
+}
+function portFromListenAddress(address, fallback) {
+  try {
+    const port = new URL(address).port;
+    const n = Number.parseInt(port, 10);
+    if (Number.isFinite(n) && n > 0) return n;
+  } catch {
+  }
+  return fallback;
+}
+function resolveHost(opts, authTokenSet) {
+  if (opts.host && opts.host.length > 0) return opts.host;
+  const env = process.env.HOST;
+  if (env && env.length > 0) return env;
+  if (!authTokenSet) return "127.0.0.1";
+  return "0.0.0.0";
+}
+
+// src/watch.ts
+init_otel_grpc();
+
+// src/search.ts
+init_cjs_shims();
+var import_node_fs28 = require("fs");
+var import_node_path45 = __toESM(require("path"), 1);
 var import_node_crypto3 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
@@ -7481,7 +8312,7 @@ async function pickEmbedder() {
 }
 async function readCache(cachePath) {
   try {
-    const raw = await import_node_fs26.promises.readFile(cachePath, "utf8");
+    const raw = await import_node_fs28.promises.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     return parsed;
@@ -7490,8 +8321,8 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  await import_node_fs26.promises.mkdir(import_node_path43.default.dirname(cachePath), { recursive: true });
-  await import_node_fs26.promises.writeFile(cachePath, JSON.stringify(cache));
+  await import_node_fs28.promises.mkdir(import_node_path45.default.dirname(cachePath), { recursive: true });
+  await import_node_fs28.promises.writeFile(cachePath, JSON.stringify(cache));
 }
 var VectorIndex = class {
   constructor(embedder, cachePath) {
@@ -7639,6 +8470,7 @@ async function buildSearchIndex(graph, options = {}) {
 var ALL_PHASES = [
   "services",
   "aliases",
+  "files",
   "imports",
   "databases",
   "configs",
@@ -7647,8 +8479,8 @@ var ALL_PHASES = [
 ];
 function classifyChange(relPath) {
   const phases = /* @__PURE__ */ new Set();
-  const base = import_node_path44.default.basename(relPath).toLowerCase();
-  const segments = relPath.split(import_node_path44.default.sep).map((s) => s.toLowerCase());
+  const base = import_node_path46.default.basename(relPath).toLowerCase();
+  const segments = relPath.split(import_node_path46.default.sep).map((s) => s.toLowerCase());
   if (base === "package.json" || base === "requirements.txt" || base === "pyproject.toml" || base === "setup.py") {
     phases.add("services");
     phases.add("aliases");
@@ -7663,6 +8495,7 @@ function classifyChange(relPath) {
     phases.add("aliases");
   }
   if (/\.(?:js|jsx|mjs|cjs|ts|tsx|py)$/.test(base)) {
+    phases.add("files");
     phases.add("imports");
     phases.add("calls");
   }
@@ -7685,6 +8518,11 @@ async function runExtractPhases(graph, scanPath, phases, project = DEFAULT_PROJE
   if (phases.has("aliases")) {
     await addServiceAliases(graph, scanPath, services);
   }
+  if (phases.has("files")) {
+    const r = await addFiles(graph, services);
+    nodesAdded += r.nodesAdded;
+    edgesAdded += r.edgesAdded;
+  }
   if (phases.has("imports")) {
     const r = await addImports(graph, services);
     nodesAdded += r.nodesAdded;
@@ -7719,6 +8557,7 @@ async function runExtractPhases(graph, scanPath, phases, project = DEFAULT_PROJE
     durationMs: Date.now() - started
   };
 }
+var DEFAULT_WATCH_WEB_PORT = 6328;
 var IGNORED_WATCH_GLOBS = [
   "**/node_modules/**",
   "**/.git/**",
@@ -7762,16 +8601,16 @@ function countWatchableDirs(scanPath, limit) {
     if (count >= limit) return;
     let entries;
     try {
-      entries = import_node_fs27.default.readdirSync(dir, { withFileTypes: true });
+      entries = import_node_fs29.default.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
       if (count >= limit) return;
       if (!e.isDirectory()) continue;
-      if (IGNORED_WATCH_PATHS.some((re) => re.test(import_node_path44.default.join(dir, e.name) + import_node_path44.default.sep))) continue;
+      if (IGNORED_WATCH_PATHS.some((re) => re.test(import_node_path46.default.join(dir, e.name) + import_node_path46.default.sep))) continue;
       count++;
-      if (depth < 2) visit(import_node_path44.default.join(dir, e.name), depth + 1);
+      if (depth < 2) visit(import_node_path46.default.join(dir, e.name), depth + 1);
     }
   };
   visit(scanPath, 0);
@@ -7789,8 +8628,8 @@ async function startWatch(graph, opts) {
   const projectName = opts.project ?? DEFAULT_PROJECT;
   await loadGraphFromDisk(graph, opts.outPath);
   const detachEventBus = attachGraphToEventBus(graph, { project: projectName });
-  const policyFilePath = import_node_path44.default.join(opts.scanPath, "policy.json");
-  const policyViolationsPath = import_node_path44.default.join(import_node_path44.default.dirname(opts.outPath), "policy-violations.ndjson");
+  const policyFilePath = import_node_path46.default.join(opts.scanPath, "policy.json");
+  const policyViolationsPath = import_node_path46.default.join(import_node_path46.default.dirname(opts.outPath), "policy-violations.ndjson");
   let policies = [];
   try {
     policies = await loadPolicyFile(policyFilePath);
@@ -7841,7 +8680,7 @@ async function startWatch(graph, opts) {
   assertBindAuthority(host, auth.authToken);
   const port = opts.port ?? 8080;
   const otelPort = opts.otelPort ?? 4318;
-  const cachePath = opts.embeddingsCachePath ?? import_node_path44.default.join(import_node_path44.default.dirname(opts.outPath), "embeddings.json");
+  const cachePath = opts.embeddingsCachePath ?? import_node_path46.default.join(import_node_path46.default.dirname(opts.outPath), "embeddings.json");
   let searchIndex;
   try {
     searchIndex = await buildSearchIndex(graph, { cachePath });
@@ -7859,7 +8698,7 @@ async function startWatch(graph, opts) {
       // Paths are derived from the explicit options the watch caller passes
       // — pathsForProject is only used to fill in the embeddings/snapshot
       // fields so the registry shape is complete.
-      ...pathsForProject(projectName, import_node_path44.default.dirname(opts.outPath)),
+      ...pathsForProject(projectName, import_node_path46.default.dirname(opts.outPath)),
       snapshotPath: opts.outPath,
       errorsPath: opts.errorsPath,
       staleEventsPath: opts.staleEventsPath
@@ -7867,7 +8706,7 @@ async function startWatch(graph, opts) {
     searchIndex
   });
   const api = await buildApi({ projects: registry });
-  await api.listen({ port, host });
+  const restAddress = await api.listen({ port, host });
   console.log(`neat-core listening on http://${host}:${port}`);
   console.log(`  scan path:     ${opts.scanPath} (watching for changes)`);
   console.log(`  snapshot path: ${opts.outPath}`);
@@ -7880,10 +8719,41 @@ async function startWatch(graph, opts) {
     writeErrorEventInline: false,
     onPolicyTrigger
   });
-  const onErrorSpanSync = makeErrorSpanWriter(opts.errorsPath);
+  const onErrorSpanSync = makeErrorSpanWriter(opts.errorsPath, graph, opts.scanPath);
   const otelHttp = await buildOtelReceiver({ onSpan, onErrorSpanSync });
-  await otelHttp.listen({ port: otelPort, host });
-  console.log(`neat-core OTLP receiver on http://${host}:${otelPort}/v1/traces`);
+  const otelAddress = await listenSteppingOtlp(otelHttp, otelPort, host);
+  const boundOtelPort = portFromListenAddress(otelAddress, otelPort);
+  console.log(`neat-core OTLP receiver on ${otelAddress}/v1/traces`);
+  const boundRestPort = portFromListenAddress(restAddress, port);
+  const daemonRecord = {
+    project: projectName,
+    projectPath: opts.scanPath,
+    pid: process.pid,
+    status: "running",
+    ports: {
+      rest: boundRestPort,
+      otlp: boundOtelPort,
+      // watch serves no dashboard of its own; record the canonical web port so
+      // the record shape is valid. Only ports.otlp is load-bearing here.
+      web: DEFAULT_WATCH_WEB_PORT
+    },
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    neatVersion: resolveNeatVersion()
+  };
+  try {
+    await writeDaemonRecord(daemonRecord);
+    console.log(
+      `neat watch: wrote daemon.json (REST ${boundRestPort} / OTLP ${boundOtelPort})`
+    );
+  } catch (err) {
+    await api.close().catch(() => {
+    });
+    await otelHttp.close().catch(() => {
+    });
+    throw new Error(
+      `neat watch: failed to write daemon.json \u2014 ${err.message}`
+    );
+  }
   let grpcReceiver = null;
   if (opts.otelGrpc) {
     const grpcPort = opts.otelGrpcPort ?? 4317;
@@ -7946,9 +8816,9 @@ async function startWatch(graph, opts) {
   };
   const onPath = (absPath) => {
     if (shouldIgnore(absPath)) return;
-    const rel = import_node_path44.default.relative(opts.scanPath, absPath);
+    const rel = import_node_path46.default.relative(opts.scanPath, absPath);
     if (!rel || rel.startsWith("..")) return;
-    pendingPaths.add(rel.split(import_node_path44.default.sep).join("/"));
+    pendingPaths.add(rel.split(import_node_path46.default.sep).join("/"));
     const phases = classifyChange(rel);
     if (phases.size === 0) {
       for (const p of ALL_PHASES) pending.add(p);
@@ -7996,14 +8866,16 @@ async function startWatch(graph, opts) {
     await api.close();
     await otelHttp.close();
     if (grpcReceiver) await grpcReceiver.stop();
+    await clearDaemonRecord(daemonRecord).catch(() => {
+    });
   };
   return { api, stop };
 }
 
 // src/deploy/detect.ts
 init_cjs_shims();
-var import_node_fs28 = require("fs");
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_fs30 = require("fs");
+var import_node_path47 = __toESM(require("path"), 1);
 var import_node_child_process2 = require("child_process");
 var import_node_crypto4 = require("crypto");
 function generateToken() {
@@ -8103,21 +8975,21 @@ async function runDeploy(opts = {}) {
   const token = generateToken();
   switch (substrate) {
     case "docker-compose": {
-      const artifactPath = import_node_path45.default.join(cwd, "docker-compose.neat.yml");
+      const artifactPath = import_node_path47.default.join(cwd, "docker-compose.neat.yml");
       const contents = emitDockerCompose(cwd);
-      await import_node_fs28.promises.writeFile(artifactPath, contents, "utf8");
+      await import_node_fs30.promises.writeFile(artifactPath, contents, "utf8");
       return {
         substrate,
         artifactPath,
         token,
         contents,
-        startCommand: `NEAT_AUTH_TOKEN=${token} docker compose -f ${import_node_path45.default.basename(artifactPath)} up -d`
+        startCommand: `NEAT_AUTH_TOKEN=${token} docker compose -f ${import_node_path47.default.basename(artifactPath)} up -d`
       };
     }
     case "systemd": {
-      const artifactPath = import_node_path45.default.join(cwd, "neat.service");
+      const artifactPath = import_node_path47.default.join(cwd, "neat.service");
       const contents = emitSystemdUnit(cwd);
-      await import_node_fs28.promises.writeFile(artifactPath, contents, "utf8");
+      await import_node_fs30.promises.writeFile(artifactPath, contents, "utf8");
       return {
         substrate,
         artifactPath,
@@ -8150,8 +9022,8 @@ init_cjs_shims();
 
 // src/installers/javascript.ts
 init_cjs_shims();
-var import_node_fs29 = require("fs");
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_fs31 = require("fs");
+var import_node_path48 = __toESM(require("path"), 1);
 var import_semver2 = __toESM(require("semver"), 1);
 
 // src/installers/templates.ts
@@ -8747,15 +9619,15 @@ var OTEL_ENV = {
   value: "http://localhost:4318/projects/<project>/v1/traces"
 };
 function serviceNodeName(pkg, serviceDir) {
-  return pkg.name ?? import_node_path46.default.basename(serviceDir);
+  return pkg.name ?? import_node_path48.default.basename(serviceDir);
 }
 function projectToken(pkg, serviceDir, project) {
   if (project && project.length > 0) return project;
-  return pkg.name ?? import_node_path46.default.basename(serviceDir);
+  return pkg.name ?? import_node_path48.default.basename(serviceDir);
 }
 async function readJsonFile(p) {
   try {
-    const raw = await import_node_fs29.promises.readFile(p, "utf8");
+    const raw = await import_node_fs31.promises.readFile(p, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -8764,16 +9636,16 @@ async function readJsonFile(p) {
 async function detectRuntimeKind(pkgRoot, pkg) {
   const deps = allDeps(pkg);
   if ("react-native" in deps || "expo" in deps) return "react-native";
-  const appJson = await readJsonFile(import_node_path46.default.join(pkgRoot, "app.json"));
+  const appJson = await readJsonFile(import_node_path48.default.join(pkgRoot, "app.json"));
   if (appJson && typeof appJson === "object" && "expo" in appJson) {
     return "react-native";
   }
-  if (await exists3(import_node_path46.default.join(pkgRoot, "vite.config.js")) || await exists3(import_node_path46.default.join(pkgRoot, "vite.config.ts")) || await exists3(import_node_path46.default.join(pkgRoot, "vite.config.mjs")) || "vite" in deps) {
+  if (await exists3(import_node_path48.default.join(pkgRoot, "vite.config.js")) || await exists3(import_node_path48.default.join(pkgRoot, "vite.config.ts")) || await exists3(import_node_path48.default.join(pkgRoot, "vite.config.mjs")) || "vite" in deps) {
     return "browser-bundle";
   }
-  if (await exists3(import_node_path46.default.join(pkgRoot, "wrangler.toml"))) return "cloudflare-workers";
-  if (await exists3(import_node_path46.default.join(pkgRoot, "bun.lockb"))) return "bun";
-  if (await exists3(import_node_path46.default.join(pkgRoot, "deno.json")) || await exists3(import_node_path46.default.join(pkgRoot, "deno.lock"))) {
+  if (await exists3(import_node_path48.default.join(pkgRoot, "wrangler.toml"))) return "cloudflare-workers";
+  if (await exists3(import_node_path48.default.join(pkgRoot, "bun.lockb"))) return "bun";
+  if (await exists3(import_node_path48.default.join(pkgRoot, "deno.json")) || await exists3(import_node_path48.default.join(pkgRoot, "deno.lock"))) {
     return "deno";
   }
   const engines = pkg.engines ?? {};
@@ -8782,7 +9654,7 @@ async function detectRuntimeKind(pkgRoot, pkg) {
 }
 async function readPackageJson2(serviceDir) {
   try {
-    const raw = await import_node_fs29.promises.readFile(import_node_path46.default.join(serviceDir, "package.json"), "utf8");
+    const raw = await import_node_fs31.promises.readFile(import_node_path48.default.join(serviceDir, "package.json"), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -8790,7 +9662,7 @@ async function readPackageJson2(serviceDir) {
 }
 async function exists3(p) {
   try {
-    await import_node_fs29.promises.stat(p);
+    await import_node_fs31.promises.stat(p);
     return true;
   } catch {
     return false;
@@ -8798,7 +9670,7 @@ async function exists3(p) {
 }
 async function readFileMaybe(p) {
   try {
-    return await import_node_fs29.promises.readFile(p, "utf8");
+    return await import_node_fs31.promises.readFile(p, "utf8");
   } catch {
     return null;
   }
@@ -8826,7 +9698,7 @@ function needsVersionUpgrade(installed, expected) {
 var NEXT_CONFIG_CANDIDATES = ["next.config.js", "next.config.ts", "next.config.mjs"];
 async function findNextConfig(serviceDir) {
   for (const name of NEXT_CONFIG_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, name);
+    const candidate = import_node_path48.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -8852,9 +9724,23 @@ var WEB_FRAMEWORK_DEPS = [
   "polka",
   "micro"
 ];
-function looksLikeWebApp(pkg) {
+var WORKER_FRAMEWORK_DEPS = [
+  "bullmq",
+  "bull",
+  "bee-queue",
+  "agenda",
+  "kafkajs",
+  "amqplib",
+  "amqp-connection-manager",
+  "nats",
+  "node-resque",
+  "pg-boss",
+  "graphile-worker"
+];
+var APP_FRAMEWORK_DEPS = [...WEB_FRAMEWORK_DEPS, ...WORKER_FRAMEWORK_DEPS];
+function appFrameworkDependencies(pkg) {
   const deps = allDeps(pkg);
-  return WEB_FRAMEWORK_DEPS.some((name) => name in deps);
+  return APP_FRAMEWORK_DEPS.filter((name) => name in deps);
 }
 function uninstrumentedLibraries(pkg) {
   const deps = allDeps(pkg);
@@ -8881,7 +9767,7 @@ function hasRemixDependency(pkg) {
 }
 async function findRemixEntry(serviceDir) {
   for (const rel of REMIX_ENTRY_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -8893,14 +9779,14 @@ function hasSvelteKitDependency(pkg) {
 }
 async function findSvelteKitHooks(serviceDir) {
   for (const rel of SVELTEKIT_HOOKS_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
 }
 async function findSvelteKitConfig(serviceDir) {
   for (const rel of SVELTEKIT_CONFIG_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -8911,7 +9797,7 @@ function hasNuxtDependency(pkg) {
 }
 async function findNuxtConfig(serviceDir) {
   for (const name of NUXT_CONFIG_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, name);
+    const candidate = import_node_path48.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -8922,7 +9808,7 @@ function hasAstroDependency(pkg) {
 }
 async function findAstroConfig(serviceDir) {
   for (const name of ASTRO_CONFIG_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, name);
+    const candidate = import_node_path48.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -8936,15 +9822,15 @@ function parseNextMajor(range) {
   return Number.isFinite(n) ? n : null;
 }
 async function isTypeScriptProject(serviceDir) {
-  return exists3(import_node_path46.default.join(serviceDir, "tsconfig.json"));
+  return exists3(import_node_path48.default.join(serviceDir, "tsconfig.json"));
 }
 var INDEX_EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs"];
 var INDEX_CANDIDATES = INDEX_EXTENSIONS.map((ext) => `index${ext}`);
 var SRC_INDEX_CANDIDATES = INDEX_EXTENSIONS.map((ext) => `src/index${ext}`);
-var SRC_NAMED_CANDIDATES = ["server", "main", "app"].flatMap(
+var SRC_NAMED_CANDIDATES = ["server", "main", "app", "worker"].flatMap(
   (name) => INDEX_EXTENSIONS.map((ext) => `src/${name}${ext}`)
 );
-var ROOT_NAMED_CANDIDATES = ["server", "app", "main"].flatMap(
+var ROOT_NAMED_CANDIDATES = ["server", "app", "main", "worker"].flatMap(
   (name) => INDEX_EXTENSIONS.map((ext) => `${name}${ext}`)
 );
 var SCRIPT_LAUNCHERS = /* @__PURE__ */ new Set([
@@ -8985,7 +9871,7 @@ function entryFromScript(script) {
 }
 async function resolveEntry(serviceDir, pkg) {
   if (typeof pkg.main === "string" && pkg.main.length > 0) {
-    const candidate = import_node_path46.default.resolve(serviceDir, pkg.main);
+    const candidate = import_node_path48.default.resolve(serviceDir, pkg.main);
     if (await exists3(candidate)) return candidate;
   }
   if (pkg.bin) {
@@ -8999,40 +9885,40 @@ async function resolveEntry(serviceDir, pkg) {
       if (typeof first === "string") binEntry = first;
     }
     if (binEntry) {
-      const candidate = import_node_path46.default.resolve(serviceDir, binEntry);
+      const candidate = import_node_path48.default.resolve(serviceDir, binEntry);
       if (await exists3(candidate)) return candidate;
     }
   }
   const startEntry = entryFromScript(pkg.scripts?.start);
   if (startEntry) {
-    const candidate = import_node_path46.default.resolve(serviceDir, startEntry);
+    const candidate = import_node_path48.default.resolve(serviceDir, startEntry);
     if (await exists3(candidate)) return candidate;
   }
   const devEntry = entryFromScript(pkg.scripts?.dev);
   if (devEntry) {
-    const candidate = import_node_path46.default.resolve(serviceDir, devEntry);
+    const candidate = import_node_path48.default.resolve(serviceDir, devEntry);
     if (await exists3(candidate)) return candidate;
   }
   for (const rel of SRC_INDEX_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   for (const rel of SRC_NAMED_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   for (const rel of ROOT_NAMED_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   for (const name of INDEX_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, name);
+    const candidate = import_node_path48.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
 }
 function dispatchEntry(entryFile, pkg) {
-  const ext = import_node_path46.default.extname(entryFile).toLowerCase();
+  const ext = import_node_path48.default.extname(entryFile).toLowerCase();
   if (ext === ".ts" || ext === ".tsx") return "ts";
   if (ext === ".mjs") return "esm";
   if (ext === ".cjs") return "cjs";
@@ -9049,9 +9935,9 @@ function otelInitContents(flavor) {
   return OTEL_INIT_CJS;
 }
 function injectionLine(flavor, entryFile, otelInitFile) {
-  let rel = import_node_path46.default.relative(import_node_path46.default.dirname(entryFile), otelInitFile);
+  let rel = import_node_path48.default.relative(import_node_path48.default.dirname(entryFile), otelInitFile);
   if (!rel.startsWith(".")) rel = `./${rel}`;
-  rel = rel.split(import_node_path46.default.sep).join("/");
+  rel = rel.split(import_node_path48.default.sep).join("/");
   if (flavor === "cjs") return `require('${rel}')`;
   if (flavor === "esm") return `import '${rel}'`;
   const tsRel = rel.replace(/\.ts$/, "");
@@ -9064,23 +9950,23 @@ function lineIsOtelInjection(line) {
 }
 async function detectsSrcLayout(serviceDir) {
   const [hasSrcApp, hasSrcPages, hasRootApp, hasRootPages] = await Promise.all([
-    exists3(import_node_path46.default.join(serviceDir, "src", "app")),
-    exists3(import_node_path46.default.join(serviceDir, "src", "pages")),
-    exists3(import_node_path46.default.join(serviceDir, "app")),
-    exists3(import_node_path46.default.join(serviceDir, "pages"))
+    exists3(import_node_path48.default.join(serviceDir, "src", "app")),
+    exists3(import_node_path48.default.join(serviceDir, "src", "pages")),
+    exists3(import_node_path48.default.join(serviceDir, "app")),
+    exists3(import_node_path48.default.join(serviceDir, "pages"))
   ]);
   return (hasSrcApp || hasSrcPages) && !hasRootApp && !hasRootPages;
 }
 async function planNext(serviceDir, pkg, manifestPath, nextConfigPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
   const srcLayout = await detectsSrcLayout(serviceDir);
-  const baseDir = srcLayout ? import_node_path46.default.join(serviceDir, "src") : serviceDir;
-  const instrumentationFile = import_node_path46.default.join(baseDir, useTs ? "instrumentation.ts" : "instrumentation.js");
-  const instrumentationNodeFile = import_node_path46.default.join(
+  const baseDir = srcLayout ? import_node_path48.default.join(serviceDir, "src") : serviceDir;
+  const instrumentationFile = import_node_path48.default.join(baseDir, useTs ? "instrumentation.ts" : "instrumentation.js");
+  const instrumentationNodeFile = import_node_path48.default.join(
     baseDir,
     useTs ? "instrumentation.node.ts" : "instrumentation.node.js"
   );
-  const envNeatFile = import_node_path46.default.join(baseDir, ".env.neat");
+  const envNeatFile = import_node_path48.default.join(baseDir, ".env.neat");
   const existingDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const dependencyEdits = [];
   for (const sdk of SDK_PACKAGES) {
@@ -9137,7 +10023,7 @@ async function planNext(serviceDir, pkg, manifestPath, nextConfigPath, project)
   const nextMajor = parseNextMajor(nextRange);
   if (nextMajor !== null && nextMajor < 15) {
     try {
-      const raw = await import_node_fs29.promises.readFile(nextConfigPath, "utf8");
+      const raw = await import_node_fs31.promises.readFile(nextConfigPath, "utf8");
       if (!raw.includes("instrumentationHook")) {
         nextConfigEdit = {
           file: nextConfigPath,
@@ -9185,7 +10071,7 @@ function buildDependencyEdits(pkg, manifestPath) {
   return edits;
 }
 async function queueEnvNeat(serviceDir, pkg, project, generatedFiles) {
-  const envNeatFile = import_node_path46.default.join(serviceDir, ".env.neat");
+  const envNeatFile = import_node_path48.default.join(serviceDir, ".env.neat");
   if (!await exists3(envNeatFile)) {
     generatedFiles.push({
       file: envNeatFile,
@@ -9220,7 +10106,7 @@ function fileImportsOtelHook(raw, specifiers) {
 }
 async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelServerFile = import_node_path46.default.join(
+  const otelServerFile = import_node_path48.default.join(
     serviceDir,
     useTs ? "app/otel.server.ts" : "app/otel.server.js"
   );
@@ -9241,7 +10127,7 @@ async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
   await queueEnvNeat(serviceDir, pkg, project, generatedFiles);
   const entrypointEdits = [];
   try {
-    const raw = await import_node_fs29.promises.readFile(entryFile, "utf8");
+    const raw = await import_node_fs31.promises.readFile(entryFile, "utf8");
     if (!fileImportsOtelHook(raw, ["./otel.server"])) {
       const lines = raw.split(/\r?\n/);
       const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
@@ -9277,11 +10163,11 @@ async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
 }
 async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelInitFile = import_node_path46.default.join(
+  const otelInitFile = import_node_path48.default.join(
     serviceDir,
     useTs ? "src/otel-init.ts" : "src/otel-init.js"
   );
-  const resolvedHooksFile = hooksFile ?? import_node_path46.default.join(serviceDir, useTs ? "src/hooks.server.ts" : "src/hooks.server.js");
+  const resolvedHooksFile = hooksFile ?? import_node_path48.default.join(serviceDir, useTs ? "src/hooks.server.ts" : "src/hooks.server.js");
   const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
   const generatedFiles = [];
   const entrypointEdits = [];
@@ -9306,7 +10192,7 @@ async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project)
     });
   } else {
     try {
-      const raw = await import_node_fs29.promises.readFile(hooksFile, "utf8");
+      const raw = await import_node_fs31.promises.readFile(hooksFile, "utf8");
       if (!fileImportsOtelHook(raw, ["./otel-init"])) {
         const lines = raw.split(/\r?\n/);
         const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
@@ -9343,11 +10229,11 @@ async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project)
 }
 async function planNuxt(serviceDir, pkg, manifestPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelPluginFile = import_node_path46.default.join(
+  const otelPluginFile = import_node_path48.default.join(
     serviceDir,
     useTs ? "server/plugins/otel.ts" : "server/plugins/otel.js"
   );
-  const otelInitFile = import_node_path46.default.join(
+  const otelInitFile = import_node_path48.default.join(
     serviceDir,
     useTs ? "server/plugins/otel-init.ts" : "server/plugins/otel-init.js"
   );
@@ -9398,19 +10284,19 @@ async function planNuxt(serviceDir, pkg, manifestPath, project) {
 var ASTRO_MIDDLEWARE_CANDIDATES = ["src/middleware.ts", "src/middleware.js"];
 async function findAstroMiddleware(serviceDir) {
   for (const rel of ASTRO_MIDDLEWARE_CANDIDATES) {
-    const candidate = import_node_path46.default.join(serviceDir, rel);
+    const candidate = import_node_path48.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
 }
 async function planAstro(serviceDir, pkg, manifestPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelInitFile = import_node_path46.default.join(
+  const otelInitFile = import_node_path48.default.join(
     serviceDir,
     useTs ? "src/otel-init.ts" : "src/otel-init.js"
   );
   const existingMiddleware = await findAstroMiddleware(serviceDir);
-  const middlewareFile = existingMiddleware ?? import_node_path46.default.join(serviceDir, useTs ? "src/middleware.ts" : "src/middleware.js");
+  const middlewareFile = existingMiddleware ?? import_node_path48.default.join(serviceDir, useTs ? "src/middleware.ts" : "src/middleware.js");
   const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
   const generatedFiles = [];
   const entrypointEdits = [];
@@ -9435,7 +10321,7 @@ async function planAstro(serviceDir, pkg, manifestPath, project) {
     });
   } else {
     try {
-      const raw = await import_node_fs29.promises.readFile(existingMiddleware, "utf8");
+      const raw = await import_node_fs31.promises.readFile(existingMiddleware, "utf8");
       if (!fileImportsOtelHook(raw, ["./otel-init"])) {
         const lines = raw.split(/\r?\n/);
         const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
@@ -9506,7 +10392,7 @@ async function findFrameworkDispatch(serviceDir, pkg, manifestPath, project) {
 }
 async function plan(serviceDir, opts) {
   const pkg = await readPackageJson2(serviceDir);
-  const manifestPath = import_node_path46.default.join(serviceDir, "package.json");
+  const manifestPath = import_node_path48.default.join(serviceDir, "package.json");
   const project = opts?.project;
   const empty = {
     language: "javascript",
@@ -9541,8 +10427,8 @@ async function plan(serviceDir, opts) {
     return { ...empty, libOnly: true };
   }
   const flavor = dispatchEntry(entryFile, pkg);
-  const otelInitFile = import_node_path46.default.join(import_node_path46.default.dirname(entryFile), otelInitFilename(flavor));
-  const envNeatFile = import_node_path46.default.join(serviceDir, ".env.neat");
+  const otelInitFile = import_node_path48.default.join(import_node_path48.default.dirname(entryFile), otelInitFilename(flavor));
+  const envNeatFile = import_node_path48.default.join(serviceDir, ".env.neat");
   const existingDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const dependencyEdits = [];
   for (const sdk of SDK_PACKAGES) {
@@ -9566,7 +10452,7 @@ async function plan(serviceDir, opts) {
   }
   const entrypointEdits = [];
   try {
-    const raw = await import_node_fs29.promises.readFile(entryFile, "utf8");
+    const raw = await import_node_fs31.promises.readFile(entryFile, "utf8");
     const lines = raw.split(/\r?\n/);
     const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
     if (!lineIsOtelInjection(firstReal)) {
@@ -9611,13 +10497,13 @@ async function plan(serviceDir, opts) {
   };
 }
 function isAllowedWritePath(serviceDir, target) {
-  const rel = import_node_path46.default.relative(serviceDir, target);
+  const rel = import_node_path48.default.relative(serviceDir, target);
   if (rel.startsWith("..")) return false;
-  const base = import_node_path46.default.basename(target);
+  const base = import_node_path48.default.basename(target);
   if (base === "package.json") return true;
   if (base === ".env.neat") return true;
   if (/^otel-init\.(?:js|cjs|mjs|ts)$/.test(base)) return true;
-  const relPosix = rel.split(import_node_path46.default.sep).join("/");
+  const relPosix = rel.split(import_node_path48.default.sep).join("/");
   if (/^instrumentation(?:\.node)?\.(?:js|cjs|mjs|ts)$/.test(base)) {
     if (relPosix === base) return true;
     if (relPosix === `src/${base}`) return true;
@@ -9634,10 +10520,10 @@ function isAllowedWritePath(serviceDir, target) {
   return false;
 }
 async function writeAtomic(file, contents) {
-  await import_node_fs29.promises.mkdir(import_node_path46.default.dirname(file), { recursive: true });
+  await import_node_fs31.promises.mkdir(import_node_path48.default.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
-  await import_node_fs29.promises.writeFile(tmp, contents, "utf8");
-  await import_node_fs29.promises.rename(tmp, file);
+  await import_node_fs31.promises.writeFile(tmp, contents, "utf8");
+  await import_node_fs31.promises.rename(tmp, file);
 }
 async function apply(installPlan) {
   const { serviceDir } = installPlan;
@@ -9713,7 +10599,7 @@ async function apply(installPlan) {
   for (const target of allTargets) {
     if (await exists3(target)) {
       try {
-        originals.set(target, await import_node_fs29.promises.readFile(target, "utf8"));
+        originals.set(target, await import_node_fs31.promises.readFile(target, "utf8"));
       } catch {
       }
     }
@@ -9796,14 +10682,14 @@ async function rollback(installPlan, originals, createdFiles) {
   const removed = [];
   for (const [file, raw] of originals.entries()) {
     try {
-      await import_node_fs29.promises.writeFile(file, raw, "utf8");
+      await import_node_fs31.promises.writeFile(file, raw, "utf8");
       restored.push(file);
     } catch {
     }
   }
   for (const file of createdFiles) {
     try {
-      await import_node_fs29.promises.unlink(file);
+      await import_node_fs31.promises.unlink(file);
       removed.push(file);
     } catch {
     }
@@ -9818,8 +10704,8 @@ async function rollback(installPlan, originals, createdFiles) {
     ...removed.map((f) => `removed:  ${f}`),
     ""
   ];
-  const rollbackPath = import_node_path46.default.join(installPlan.serviceDir, "neat-rollback.patch");
-  await import_node_fs29.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
+  const rollbackPath = import_node_path48.default.join(installPlan.serviceDir, "neat-rollback.patch");
+  await import_node_fs31.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
 }
 function injectInstrumentationHook(raw) {
   if (raw.includes("instrumentationHook")) return raw;
@@ -9848,8 +10734,8 @@ var javascriptInstaller = {
 
 // src/installers/python.ts
 init_cjs_shims();
-var import_node_fs30 = require("fs");
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_fs32 = require("fs");
+var import_node_path49 = __toESM(require("path"), 1);
 var SDK_PACKAGES2 = [
   { name: "opentelemetry-distro", version: ">=0.49b0" },
   { name: "opentelemetry-exporter-otlp", version: ">=1.28.0" }
@@ -9861,7 +10747,7 @@ var OTEL_ENV2 = {
 };
 async function exists4(p) {
   try {
-    await import_node_fs30.promises.stat(p);
+    await import_node_fs32.promises.stat(p);
     return true;
   } catch {
     return false;
@@ -9870,7 +10756,7 @@ async function exists4(p) {
 async function detect2(serviceDir) {
   const markers = ["requirements.txt", "pyproject.toml", "setup.py"];
   for (const m of markers) {
-    if (await exists4(import_node_path47.default.join(serviceDir, m))) return true;
+    if (await exists4(import_node_path49.default.join(serviceDir, m))) return true;
   }
   return false;
 }
@@ -9880,9 +10766,9 @@ function reqPackageName(line) {
   return head.replace(/[<>=!~].*$/, "").toLowerCase();
 }
 async function planRequirementsTxtEdits(serviceDir) {
-  const file = import_node_path47.default.join(serviceDir, "requirements.txt");
+  const file = import_node_path49.default.join(serviceDir, "requirements.txt");
   if (!await exists4(file)) return null;
-  const raw = await import_node_fs30.promises.readFile(file, "utf8");
+  const raw = await import_node_fs32.promises.readFile(file, "utf8");
   const presentNames = new Set(
     raw.split(/\r?\n/).map(reqPackageName).filter((n) => n.length > 0)
   );
@@ -9890,9 +10776,9 @@ async function planRequirementsTxtEdits(serviceDir) {
   return { manifest: file, missing: [...missing] };
 }
 async function planProcfileEdits(serviceDir) {
-  const procfile = import_node_path47.default.join(serviceDir, "Procfile");
+  const procfile = import_node_path49.default.join(serviceDir, "Procfile");
   if (!await exists4(procfile)) return [];
-  const raw = await import_node_fs30.promises.readFile(procfile, "utf8");
+  const raw = await import_node_fs32.promises.readFile(procfile, "utf8");
   const edits = [];
   for (const line of raw.split(/\r?\n/)) {
     if (line.length === 0) continue;
@@ -9944,8 +10830,8 @@ async function applyRequirementsTxt(manifest, edits, original) {
   const next = `${original}${trailing}${newlines.join("\n")}
 `;
   const tmp = `${manifest}.${process.pid}.${Date.now()}.tmp`;
-  await import_node_fs30.promises.writeFile(tmp, next, "utf8");
-  await import_node_fs30.promises.rename(tmp, manifest);
+  await import_node_fs32.promises.writeFile(tmp, next, "utf8");
+  await import_node_fs32.promises.rename(tmp, manifest);
 }
 async function applyProcfile(procfile, edits, original) {
   let next = original;
@@ -9954,8 +10840,8 @@ async function applyProcfile(procfile, edits, original) {
     next = next.replace(e.before, e.after);
   }
   const tmp = `${procfile}.${process.pid}.${Date.now()}.tmp`;
-  await import_node_fs30.promises.writeFile(tmp, next, "utf8");
-  await import_node_fs30.promises.rename(tmp, procfile);
+  await import_node_fs32.promises.writeFile(tmp, next, "utf8");
+  await import_node_fs32.promises.rename(tmp, procfile);
 }
 async function apply2(installPlan) {
   const { serviceDir } = installPlan;
@@ -9968,7 +10854,7 @@ async function apply2(installPlan) {
   const originals = /* @__PURE__ */ new Map();
   for (const file of touched) {
     try {
-      originals.set(file, await import_node_fs30.promises.readFile(file, "utf8"));
+      originals.set(file, await import_node_fs32.promises.readFile(file, "utf8"));
     } catch {
     }
   }
@@ -9979,7 +10865,7 @@ async function apply2(installPlan) {
       if (raw === void 0) {
         throw new Error(`python installer: cannot read ${file} during apply`);
       }
-      const base = import_node_path47.default.basename(file);
+      const base = import_node_path49.default.basename(file);
       if (base === "requirements.txt") {
         const edits = installPlan.dependencyEdits.filter((e) => e.file === file);
         if (edits.length > 0) {
@@ -10004,7 +10890,7 @@ async function rollback2(installPlan, originals) {
   const restored = [];
   for (const [file, raw] of originals.entries()) {
     try {
-      await import_node_fs30.promises.writeFile(file, raw, "utf8");
+      await import_node_fs32.promises.writeFile(file, raw, "utf8");
       restored.push(file);
     } catch {
     }
@@ -10018,8 +10904,8 @@ async function rollback2(installPlan, originals) {
     ...restored.map((f) => `restored: ${f}`),
     ""
   ];
-  const rollbackPath = import_node_path47.default.join(installPlan.serviceDir, "neat-rollback.patch");
-  await import_node_fs30.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
+  const rollbackPath = import_node_path49.default.join(installPlan.serviceDir, "neat-rollback.patch");
+  await import_node_fs32.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
 }
 var pythonInstaller = {
   name: "python",
@@ -10148,38 +11034,6 @@ var import_node_net = __toESM(require("net"), 1);
 var import_node_path50 = __toESM(require("path"), 1);
 var import_node_child_process3 = require("child_process");
 var import_node_readline = __toESM(require("readline"), 1);
-
-// src/daemon.ts
-init_cjs_shims();
-var import_node_fs32 = require("fs");
-var import_node_path49 = __toESM(require("path"), 1);
-var import_node_module = require("module");
-init_otel();
-init_auth();
-
-// src/unrouted.ts
-init_cjs_shims();
-var import_node_fs31 = require("fs");
-var import_node_path48 = __toESM(require("path"), 1);
-
-// src/daemon.ts
-function daemonJsonPath(scanPath) {
-  return import_node_path49.default.join(scanPath, "neat-out", "daemon.json");
-}
-async function readDaemonRecord(scanPath) {
-  try {
-    const raw = await import_node_fs32.promises.readFile(daemonJsonPath(scanPath), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-// src/orchestrator.ts
 async function extractAndPersist(opts) {
   const services = await discoverServices(opts.scanPath);
   const languages = [...new Set(services.map((s) => s.node.language))].sort();
@@ -10236,11 +11090,13 @@ async function applyInstallersOver(services, project, options = {}) {
     } else if (outcome.outcome === "already-instrumented") already++;
     else if (outcome.outcome === "lib-only") {
       libOnly++;
-      if (svc.pkg && looksLikeWebApp(svc.pkg)) {
+      const appDeps = svc.pkg ? appFrameworkDependencies(svc.pkg) : [];
+      if (appDeps.length > 0) {
         const svcName = import_node_path50.default.basename(svc.dir);
+        const list = appDeps.join(", ");
         console.warn(
           `neat: runtime layer won't engage for ${svcName}: no entry point found.
-  ${svc.dir} depends on a web framework but neat couldn't resolve an entry to instrument.
+  ${svc.dir} depends on ${list} \u2014 a runnable app \u2014 but neat couldn't resolve an entry to instrument.
   Add a "start" script to package.json, or point neat at the entry file directly.`
         );
       }
@@ -10308,10 +11164,11 @@ async function applyInstallersOver(services, project, options = {}) {
       if (gaps.length > 0) {
         const svcName = import_node_path50.default.basename(svc.dir);
         const list = gaps.join(", ");
-        const verb = gaps.length === 1 ? "this library" : "these libraries";
+        const subject = gaps.length === 1 ? "this library" : "these libraries";
+        const aux = gaps.length === 1 ? "isn't" : "aren't";
         console.warn(
           `neat: calls to ${list} won't be observed by default in ${svcName}.
-  ${verb} aren't in the default instrumentation set, so they produce no OBSERVED edges.
+  ${subject} ${aux} in the default instrumentation set, so they produce no OBSERVED edges.
   Run \`neat list-uninstrumented\` to review them, then \`neat extend\` to capture them.`
         );
       }
@@ -10405,29 +11262,22 @@ async function probeProjectHealth(restPort, name) {
     });
   });
 }
-async function snapshotProjectStatus(restPort, body) {
+async function snapshotProjectStatus(restPort, project, body) {
   if (body.projects && body.projects.length > 0) {
-    return body.projects.map((p) => ({
-      name: p.name,
-      status: p.status ?? "active"
-    }));
-  }
-  const entries = await listProjects().catch(() => []);
-  if (entries.length === 0) return [];
-  return Promise.all(
-    entries.map(async (entry2) => ({
-      name: entry2.name,
-      status: await probeProjectHealth(restPort, entry2.name)
-    }))
-  );
+    const mine = body.projects.filter((p) => p.name === project);
+    if (mine.length > 0) {
+      return mine.map((p) => ({ name: p.name, status: p.status ?? "active" }));
+    }
+  }
+  return [{ name: project, status: await probeProjectHealth(restPort, project) }];
 }
-async function waitForDaemonReady(restPort, timeoutMs) {
+async function waitForDaemonReady(restPort, project, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   let lastBootstrapping = [];
   while (Date.now() < deadline) {
     const body = await fetchDaemonHealth(restPort);
     if (body !== null) {
-      const projects2 = await snapshotProjectStatus(restPort, body);
+      const projects2 = await snapshotProjectStatus(restPort, project, body);
       const bootstrapping = projects2.filter((p) => p.status === "bootstrapping").map((p) => p.name);
       const broken = projects2.filter((p) => p.status === "broken").map((p) => p.name);
       if (bootstrapping.length === 0) {
@@ -10446,7 +11296,7 @@ async function waitForDaemonReady(restPort, timeoutMs) {
     await new Promise((r) => setTimeout(r, PROBE_INTERVAL_MS));
   }
   const final = await fetchDaemonHealth(restPort);
-  const projects = final ? await snapshotProjectStatus(restPort, final) : [];
+  const projects = final ? await snapshotProjectStatus(restPort, project, final) : [];
   return {
     ready: false,
     brokenProjects: projects.filter((p) => p.status === "broken").map((p) => p.name),
@@ -10454,14 +11304,37 @@ async function waitForDaemonReady(restPort, timeoutMs) {
   };
 }
 var NEAT_PORTS = [8080, 4318, 6328];
-async function isPortFree(port) {
+function probeBind(port, host) {
   return new Promise((resolve) => {
     const server = import_node_net.default.createServer();
-    server.once("error", () => resolve(false));
-    server.once("listening", () => server.close(() => resolve(true)));
-    server.listen(port, "127.0.0.1");
+    server.once("error", (err) => {
+      resolve(err.code === "EADDRINUSE" ? "in-use" : "unavailable");
+    });
+    server.once("listening", () => server.close(() => resolve("free")));
+    server.listen(port, host);
   });
 }
+function crossFamilyHost(host) {
+  switch (host) {
+    case "127.0.0.1":
+    case "localhost":
+      return "::1";
+    case "::1":
+      return "127.0.0.1";
+    case "0.0.0.0":
+      return "::";
+    case "::":
+      return "0.0.0.0";
+    default:
+      return null;
+  }
+}
+async function isPortFree(port, host = "127.0.0.1") {
+  if (await probeBind(port, host) !== "free") return false;
+  const sibling = crossFamilyHost(host);
+  if (sibling && await probeBind(port, sibling) === "in-use") return false;
+  return true;
+}
 function formatPortCollisionMessage(port) {
   return [
     `neat: port ${port} is in use; the NEAT daemon needs it.`,
@@ -10471,13 +11344,13 @@ function formatPortCollisionMessage(port) {
 }
 var PORT_ALLOCATION_ATTEMPTS = 8;
 var PORT_STRIDE = 1;
-async function tripleFree(ports) {
+async function tripleFree(ports, host = "127.0.0.1") {
   for (const p of [ports.rest, ports.otlp, ports.web]) {
-    if (!await isPortFree(p)) return false;
+    if (!await isPortFree(p, host)) return false;
   }
   return true;
 }
-async function allocatePorts() {
+async function allocatePorts(host = "127.0.0.1") {
   const [baseRest, baseOtlp, baseWeb] = NEAT_PORTS;
   for (let i = 0; i < PORT_ALLOCATION_ATTEMPTS; i++) {
     const candidate = {
@@ -10485,7 +11358,7 @@ async function allocatePorts() {
       otlp: baseOtlp + i * PORT_STRIDE,
       web: baseWeb + i * PORT_STRIDE
     };
-    if (await tripleFree(candidate)) return candidate;
+    if (await tripleFree(candidate, host)) return candidate;
   }
   return null;
 }
@@ -10691,16 +11564,20 @@ async function runOrchestrator(opts) {
     }
   }
   const timeoutMs = opts.daemonReadyTimeoutMs ?? DEFAULT_DAEMON_READY_TIMEOUT_MS;
+  const bindHost = resolveHost(
+    {},
+    typeof process.env.NEAT_AUTH_TOKEN === "string" && process.env.NEAT_AUTH_TOKEN.length > 0
+  );
   const persistedPorts = await persistedPortsFor(opts.scanPath);
   let allocated = null;
   if (persistedPorts && await healthIsForProject(persistedPorts.rest, currentProjectName)) {
     result.steps.daemon = "already-running";
     allocated = persistedPorts;
   } else {
-    if (persistedPorts && await isPortFree(persistedPorts.rest) && await tripleFree(persistedPorts)) {
+    if (persistedPorts && await isPortFree(persistedPorts.rest, bindHost) && await tripleFree(persistedPorts, bindHost)) {
       allocated = persistedPorts;
     } else {
-      allocated = await allocatePorts();
+      allocated = await allocatePorts(bindHost);
     }
     if (!allocated) {
       for (const line of formatPortCollisionMessage(NEAT_PORTS[0])) {
@@ -10729,7 +11606,7 @@ async function runOrchestrator(opts) {
             projectPath: opts.scanPath,
             ports: allocated
           });
-          const ready = await waitForDaemonReady(allocated.rest, timeoutMs);
+          const ready = await waitForDaemonReady(allocated.rest, currentProjectName, timeoutMs);
           result.steps.daemon = ready.ready ? "spawned" : "timed-out";
           if (!ready.ready) {
             console.error(`neat: daemon did not become ready within ${timeoutMs}ms`);
@@ -10797,7 +11674,7 @@ var import_node_path51 = __toESM(require("path"), 1);
 
 // src/cli-client.ts
 init_cjs_shims();
-var import_types27 = require("@neat.is/types");
+var import_types29 = require("@neat.is/types");
 var HttpError = class extends Error {
   constructor(status2, message, responseBody = "") {
     super(message);
@@ -10913,7 +11790,7 @@ async function runBlastRadius(client, input) {
     const result = await client.get(path53);
     if (result.totalAffected === 0) {
       return {
-        summary: `${result.origin} has no downstream dependencies. Nothing else would break if it failed.`
+        summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
       };
     }
     const sorted = [...result.affectedNodes].sort(
@@ -10926,7 +11803,7 @@ async function runBlastRadius(client, input) {
     );
     const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
     return {
-      summary: `Blast radius for ${result.origin}: ${result.totalAffected} affected node${result.totalAffected === 1 ? "" : "s"} reachable downstream.`,
+      summary: `Blast radius for ${result.origin}: ${result.totalAffected} dependent node${result.totalAffected === 1 ? "" : "s"} would break if it changed.`,
       block: blockLines.join("\n"),
       confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
       provenance: provenances.length ? provenances : void 0
@@ -10939,7 +11816,7 @@ async function runBlastRadius(client, input) {
   }
 }
 function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === import_types27.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  const tag = n.edgeProvenance === import_types29.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
   return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
 }
 async function runDependencies(client, input) {
@@ -10980,22 +11857,33 @@ async function runDependencies(client, input) {
     throw err;
   }
 }
+function observedDepLine(nodeId, e) {
+  const via = e.source !== nodeId ? ` (via ${e.source})` : "";
+  return `  \u2022 ${e.target} \u2014 ${e.type}${via}${edgeMeta(e)}`;
+}
 async function runObservedDependencies(client, input) {
   try {
-    const edges = await client.get(
-      projectPath(input.project, `/graph/edges/${encodeURIComponent(input.nodeId)}`)
+    const result = await client.get(
+      projectPath(
+        input.project,
+        `/graph/observed-dependencies/${encodeURIComponent(input.nodeId)}`
+      )
     );
-    const observed = edges.outbound.filter((e) => e.provenance === import_types27.Provenance.OBSERVED);
-    if (observed.length === 0) {
-      const hasExtracted = edges.outbound.some((e) => e.provenance === import_types27.Provenance.EXTRACTED);
-      const note = hasExtracted ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
+    if (result.dependencies.length === 0) {
+      if (result.observed) {
+        return {
+          summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
+          provenance: import_types29.Provenance.OBSERVED
+        };
+      }
+      const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
       return { summary: `No OBSERVED dependencies for ${input.nodeId}.${note}` };
     }
-    const blockLines = observed.map((e) => `  \u2022 ${e.target} \u2014 ${e.type}${edgeMeta(e)}`);
+    const blockLines = result.dependencies.map((e) => observedDepLine(input.nodeId, e));
     return {
-      summary: `${input.nodeId} has ${observed.length} runtime dependenc${observed.length === 1 ? "y" : "ies"} confirmed by OTel.`,
+      summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
       block: blockLines.join("\n"),
-      provenance: import_types27.Provenance.OBSERVED
+      provenance: import_types29.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -11049,7 +11937,7 @@ async function runIncidents(client, input) {
     return {
       summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
       block: blockLines.join("\n"),
-      provenance: import_types27.Provenance.OBSERVED
+      provenance: import_types29.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -11158,7 +12046,7 @@ async function runStaleEdges(client, input) {
   return {
     summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
     block: blockLines.join("\n"),
-    provenance: import_types27.Provenance.STALE
+    provenance: import_types29.Provenance.STALE
   };
 }
 async function runPolicies(client, input) {
@@ -11475,7 +12363,7 @@ async function runSync(opts) {
 }
 
 // src/cli.ts
-var import_types28 = require("@neat.is/types");
+var import_types30 = require("@neat.is/types");
 function isNpxInvocation() {
   if (process.env.npm_command === "exec") return true;
   const execpath = process.env.npm_execpath ?? "";
@@ -11540,7 +12428,7 @@ function usage() {
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  root-cause <node-id>             Walk inbound edges to find what broke first.");
   console.log(`                                   example: ${neat} root-cause service:<name>`);
-  console.log("  blast-radius <node-id>           BFS outbound \u2014 what would break if this dies.");
+  console.log("  blast-radius <node-id>           BFS inbound \u2014 the dependents that break if this dies.");
   console.log(`                                   example: ${neat} blast-radius database:<host>`);
   console.log("  dependencies <node-id>           Transitive outbound dependencies.");
   console.log("                                   Flags: --depth N (default 3, max 10)");
@@ -12267,11 +13155,18 @@ Pass --project <name> to choose:
 ${names}`
   );
 }
-function resolveDaemonUrl() {
-  return process.env.NEAT_API_URL ?? process.env.NEAT_CORE_URL ?? "http://localhost:8080";
+async function resolveDaemonUrl(project) {
+  const explicit = process.env.NEAT_API_URL ?? process.env.NEAT_CORE_URL;
+  if (explicit) return explicit;
+  if (project) {
+    const daemon = await findDaemonByProject(project);
+    if (daemon) return `http://localhost:${daemon.record.ports.rest}`;
+  }
+  return "http://localhost:8080";
 }
 async function runQueryVerb(cmd, parsed) {
-  const baseUrl = resolveDaemonUrl();
+  const requestedProject = resolveProjectFlag(parsed);
+  const baseUrl = await resolveDaemonUrl(requestedProject);
   const client = createHttpClient(baseUrl, resolveAuthToken());
   const positional = parsed.positional;
   let makeWork;
@@ -12389,10 +13284,10 @@ async function runQueryVerb(cmd, parsed) {
         const parts = parsed.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
         const out = [];
         for (const p of parts) {
-          const r = import_types28.DivergenceTypeSchema.safeParse(p);
+          const r = import_types30.DivergenceTypeSchema.safeParse(p);
           if (!r.success) {
             console.error(
-              `neat divergences: unknown --type "${p}". allowed: ${import_types28.DivergenceTypeSchema.options.join(", ")}`
+              `neat divergences: unknown --type "${p}". allowed: ${import_types30.DivergenceTypeSchema.options.join(", ")}`
             );
             return 2;
           }
@@ -12427,7 +13322,7 @@ async function runQueryVerb(cmd, parsed) {
       const detail = err.responseBody.length > 0 ? err.responseBody : err.message;
       console.error(`neat ${cmd}: ${detail.trim()}`);
     } else if (err instanceof TransportError) {
-      console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (NEAT_API_URL=${resolveDaemonUrl()})`);
+      console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${baseUrl})`);
     } else {
       console.error(`neat ${cmd}: ${err.message}`);
     }
@@ -12452,6 +13347,7 @@ if (/[\\/]cli\.(?:cjs|js)$/.test(entry) || entry.endsWith("/cli") || entry.endsW
   parseArgs,
   printBanner,
   readPackageVersion,
+  resolveDaemonUrl,
   resolveProjectForVerb,
   runInit,
   runQueryVerb,