@neat.is/core 0.4.27 → 0.4.28-dev.20260708

package/dist/chunk-NY5Q6NE2.js

@@ -0,0 +1,2566 @@
+import {
+  DEFAULT_PROJECT,
+  Projects,
+  attachGraphToEventBus,
+  buildApi,
+  ensureObservedFileNode,
+  ensureServiceNode,
+  extractFromDirectory,
+  getGraph,
+  handleSpan,
+  listProjects,
+  loadGraphFromDisk,
+  makeErrorSpanWriter,
+  normalizePathTemplate,
+  pathsForProject,
+  pruneRegistry,
+  reconcileObservedRelPath,
+  registryPath,
+  resetGraph,
+  saveGraphToDisk,
+  setStatus,
+  startPersistLoop,
+  startStalenessLoop,
+  touchLastSeen,
+  upsertObservedEdge,
+  writeAtomically
+} from "./chunk-O4MRDWD7.js";
+import {
+  assertBindAuthority,
+  buildOtelReceiver,
+  listenSteppingOtlp,
+  readAuthEnv
+} from "./chunk-CFDPIMRP.js";
+
+// src/daemon.ts
+import {
+  promises as fs3,
+  watch,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import path3 from "path";
+import { createRequire } from "module";
+
+// src/connectors/index.ts
+var NO_ENV = "unknown";
+async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
+  const signals = await connector.poll(ctx);
+  let edgesCreated = 0;
+  let edgesUpdated = 0;
+  let unresolved = 0;
+  for (const signal of signals) {
+    const resolved = resolveTarget(signal, ctx);
+    if (!resolved) {
+      unresolved++;
+      continue;
+    }
+    const serviceNodeId = ensureServiceNode(graph, resolved.serviceName, NO_ENV);
+    const callSite = signal.callSite ? { relPath: signal.callSite.file, line: signal.callSite.line } : void 0;
+    const sourceId = callSite ? ensureObservedFileNode(graph, resolved.serviceName, serviceNodeId, callSite) : serviceNodeId;
+    const evidence = callSite ? {
+      file: reconcileObservedRelPath(graph, resolved.serviceName, callSite.relPath),
+      line: callSite.line
+    } : void 0;
+    const calls = Math.trunc(signal.callCount);
+    if (calls < 1) continue;
+    const errors = Math.min(Math.max(Math.trunc(signal.errorCount), 0), calls);
+    let created = false;
+    let ok = true;
+    for (let i = 0; i < calls; i++) {
+      const result = upsertObservedEdge(
+        graph,
+        resolved.edgeType,
+        sourceId,
+        resolved.targetNodeId,
+        signal.lastObservedIso,
+        i < errors,
+        evidence
+      );
+      if (!result) {
+        ok = false;
+        break;
+      }
+      if (i === 0) created = result.created;
+    }
+    if (!ok) {
+      unresolved++;
+      continue;
+    }
+    if (created) edgesCreated++;
+    else edgesUpdated++;
+  }
+  return { signalCount: signals.length, edgesCreated, edgesUpdated, unresolved };
+}
+var DEFAULT_POLL_INTERVAL_MS = 6e4;
+function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options = {}) {
+  let stopped = false;
+  let since = ctx.since;
+  const intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const onError = options.onError ?? ((err) => console.error(`[neatd] connector poll failed (${connector.provider})`, err));
+  const tick = () => {
+    if (stopped) return;
+    void (async () => {
+      const tickStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+      try {
+        await runConnectorPoll(connector, { ...ctx, since }, graph, resolveTarget);
+        since = tickStartedAt;
+      } catch (err) {
+        onError(err);
+      }
+    })();
+  };
+  const interval = setInterval(tick, intervalMs);
+  if (typeof interval.unref === "function") interval.unref();
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+  };
+}
+
+// src/connectors/junction.ts
+var buckets = /* @__PURE__ */ new Map();
+function bucketMapKey(provider, accountKey) {
+  return `${provider}\0${accountKey}`;
+}
+function getBucket(provider, accountKey, config) {
+  const key = bucketMapKey(provider, accountKey);
+  const existing = buckets.get(key);
+  if (existing && existing.capacity === config.capacity && existing.refillMs === config.refillMs) {
+    return existing;
+  }
+  const fresh = { ...config, tokens: config.capacity, updatedAt: Date.now() };
+  buckets.set(key, fresh);
+  return fresh;
+}
+function refillBucket(bucket, now) {
+  if (now <= bucket.updatedAt) return;
+  const elapsed = now - bucket.updatedAt;
+  const grant = elapsed / bucket.refillMs;
+  if (grant <= 0) return;
+  bucket.tokens = Math.min(bucket.capacity, bucket.tokens + grant);
+  bucket.updatedAt = now;
+}
+var RateLimitExceededError = class extends Error {
+  constructor(provider, accountKey) {
+    super(
+      `junction: rate limit exceeded for ${provider}:${accountKey} \u2014 waiting for the next token would exceed this call's wall-clock budget`
+    );
+    this.name = "RateLimitExceededError";
+  }
+};
+function delay(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    if (typeof timer.unref === "function") timer.unref();
+  });
+}
+async function acquireToken(provider, accountKey, config, remainingBudgetMs) {
+  const bucket = getBucket(provider, accountKey, config);
+  refillBucket(bucket, Date.now());
+  if (bucket.tokens >= 1) {
+    bucket.tokens -= 1;
+    return 0;
+  }
+  const waitMs = Math.ceil((1 - bucket.tokens) * bucket.refillMs);
+  if (waitMs > remainingBudgetMs) {
+    throw new RateLimitExceededError(provider, accountKey);
+  }
+  await delay(waitMs);
+  refillBucket(bucket, Date.now());
+  bucket.tokens = Math.max(0, bucket.tokens - 1);
+  return waitMs;
+}
+var JUNCTION_DEFAULT_RATE_LIMITS = {
+  // ~300 requests / 5 minutes (ADR-131). Burst capacity holds a third of
+  // that ceiling; steady-state refill (1 token / 3s = 20/min = 100/5min)
+  // stays well clear of the documented limit even under sustained polling.
+  cloudflare: { capacity: 100, refillMs: 3e3 },
+  // Placeholder pending a live project confirming the real cap
+  // (docs/connectors/railway.md: "does not appear to publish one as of this
+  // writing").
+  railway: { capacity: 30, refillMs: 1e4 },
+  // Placeholder pending a live rate-limit check (docs/connectors/
+  // firebase.md: "needs-endpoint-testing against entries.list's live rate
+  // limits").
+  firebase: { capacity: 30, refillMs: 1e4 },
+  // Placeholder pending a live rate-limit check (docs/connectors/supabase.md:
+  // "the documented rate limit for this specific endpoint is unconfirmed").
+  supabase: { capacity: 30, refillMs: 1e4 },
+  // Not a documented API limit at all — a self-imposed ceiling on the raw
+  // pg_stat_statements connection (see module header above).
+  "supabase-postgres": { capacity: 20, refillMs: 3e3 }
+};
+var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
+function defaultRateLimitFor(provider) {
+  return JUNCTION_DEFAULT_RATE_LIMITS[provider] ?? JUNCTION_GENERIC_RATE_LIMIT;
+}
+var JUNCTION_DEFAULT_TIMEOUT_MS = 1e4;
+var JUNCTION_DEFAULT_MAX_ATTEMPTS = 3;
+var JUNCTION_DEFAULT_INITIAL_BACKOFF_MS = 200;
+var JUNCTION_DEFAULT_BACKOFF_MULTIPLIER = 4;
+var JUNCTION_DEFAULT_MAX_ELAPSED_MS = 3e4;
+var JUNCTION_DEFAULT_DB_TIMEOUT_MS = 1e4;
+async function backoff(attempt, initialBackoffMs, backoffMultiplier, remainingBudgetMs) {
+  const raw = initialBackoffMs * backoffMultiplier ** (attempt - 1);
+  const capped = Math.max(0, Math.min(raw, remainingBudgetMs));
+  await delay(capped);
+}
+function safeUrlLabel(url) {
+  try {
+    const u = typeof url === "string" ? new URL(url) : url;
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return String(url);
+  }
+}
+function logOutcome(provider, accountKey, outcome, method, label, attempt, startedAt) {
+  const elapsedMs = Date.now() - startedAt;
+  const line = `[neat connector] ${provider}:${accountKey} ${method} ${label} \u2014 ${outcome} (attempt ${attempt}, ${elapsedMs}ms)`;
+  if (outcome === "success" || outcome === "retried-then-succeeded") {
+    console.log(line);
+  } else if (outcome === "rate-limited") {
+    console.warn(line);
+  } else {
+    console.error(line);
+  }
+}
+function bearerAuthHeader(token) {
+  return { Authorization: `Bearer ${token}` };
+}
+async function junctionFetch(url, init = {}, policy) {
+  const {
+    provider,
+    accountKey,
+    timeoutMs = JUNCTION_DEFAULT_TIMEOUT_MS,
+    maxAttempts = JUNCTION_DEFAULT_MAX_ATTEMPTS,
+    maxElapsedMs = JUNCTION_DEFAULT_MAX_ELAPSED_MS,
+    initialBackoffMs = JUNCTION_DEFAULT_INITIAL_BACKOFF_MS,
+    backoffMultiplier = JUNCTION_DEFAULT_BACKOFF_MULTIPLIER,
+    rateLimit = defaultRateLimitFor(provider),
+    fetchImpl = fetch
+  } = policy;
+  const method = (init.method ?? "GET").toUpperCase();
+  const label = safeUrlLabel(url);
+  const startedAt = Date.now();
+  let attempt = 0;
+  let sawRetry = false;
+  for (; ; ) {
+    attempt++;
+    const remainingBudget = maxElapsedMs - (Date.now() - startedAt);
+    if (remainingBudget <= 0) {
+      logOutcome(provider, accountKey, "retried-then-failed", method, label, attempt - 1, startedAt);
+      throw new Error(
+        `junction: ${provider}:${accountKey} ${method} ${label} exceeded its wall-clock budget (${maxElapsedMs}ms) after ${attempt - 1} attempt(s)`
+      );
+    }
+    try {
+      await acquireToken(provider, accountKey, rateLimit, remainingBudget);
+    } catch (err) {
+      if (err instanceof RateLimitExceededError) {
+        logOutcome(provider, accountKey, "rate-limited", method, label, attempt, startedAt);
+      }
+      throw err;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    try {
+      const res = await fetchImpl(url, { ...init, signal: controller.signal });
+      clearTimeout(timer);
+      if (res.ok || res.status < 500) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-succeeded" : "success", method, label, attempt, startedAt);
+        return res;
+      }
+      if (attempt >= maxAttempts) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", method, label, attempt, startedAt);
+        return res;
+      }
+      sawRetry = true;
+      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
+    } catch (err) {
+      clearTimeout(timer);
+      if (attempt >= maxAttempts) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", method, label, attempt, startedAt);
+        throw err;
+      }
+      sawRetry = true;
+      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
+    }
+  }
+}
+var DbJunctionTimeoutError = class extends Error {
+  constructor(ms) {
+    super(`junction: db query exceeded its ${ms}ms timeout`);
+    this.name = "DbJunctionTimeoutError";
+  }
+};
+function withTimeout(run, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new DbJunctionTimeoutError(timeoutMs)), timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    run().then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+var RETRYABLE_NODE_ERROR_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EHOSTUNREACH", "EAI_AGAIN", "EPIPE"]);
+function isRetryableDbError(err) {
+  if (err instanceof DbJunctionTimeoutError) return true;
+  const code = err?.code;
+  if (typeof code !== "string") return false;
+  if (code.startsWith("08") || code === "57P03") return true;
+  return RETRYABLE_NODE_ERROR_CODES.has(code);
+}
+async function dbJunction(run, policy) {
+  const {
+    provider,
+    accountKey,
+    timeoutMs = JUNCTION_DEFAULT_DB_TIMEOUT_MS,
+    maxAttempts = JUNCTION_DEFAULT_MAX_ATTEMPTS,
+    maxElapsedMs = JUNCTION_DEFAULT_MAX_ELAPSED_MS,
+    initialBackoffMs = JUNCTION_DEFAULT_INITIAL_BACKOFF_MS,
+    backoffMultiplier = JUNCTION_DEFAULT_BACKOFF_MULTIPLIER,
+    rateLimit = defaultRateLimitFor(provider)
+  } = policy;
+  const startedAt = Date.now();
+  let attempt = 0;
+  let sawRetry = false;
+  for (; ; ) {
+    attempt++;
+    const remainingBudget = maxElapsedMs - (Date.now() - startedAt);
+    if (remainingBudget <= 0) {
+      logOutcome(provider, accountKey, "retried-then-failed", "QUERY", "db", attempt - 1, startedAt);
+      throw new Error(
+        `junction: ${provider}:${accountKey} db query exceeded its wall-clock budget (${maxElapsedMs}ms) after ${attempt - 1} attempt(s)`
+      );
+    }
+    try {
+      await acquireToken(provider, accountKey, rateLimit, remainingBudget);
+    } catch (err) {
+      if (err instanceof RateLimitExceededError) {
+        logOutcome(provider, accountKey, "rate-limited", "QUERY", "db", attempt, startedAt);
+      }
+      throw err;
+    }
+    try {
+      const result = await withTimeout(run, timeoutMs);
+      logOutcome(provider, accountKey, sawRetry ? "retried-then-succeeded" : "success", "QUERY", "db", attempt, startedAt);
+      return result;
+    } catch (err) {
+      if (!isRetryableDbError(err) || attempt >= maxAttempts) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", "QUERY", "db", attempt, startedAt);
+        throw err;
+      }
+      sawRetry = true;
+      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
+    }
+  }
+}
+
+// src/connectors/supabase/client.ts
+var DEFAULT_SUPABASE_MANAGEMENT_API_URL = "https://api.supabase.com";
+var DEFAULT_LOG_LIMIT = 1e3;
+var SUPABASE_LOG_QUERY_MAX_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function boundedSupabaseLogWindow(since, now, maxLookbackMs) {
+  const window = Math.min(maxLookbackMs, SUPABASE_LOG_QUERY_MAX_WINDOW_MS);
+  const floor = new Date(now.getTime() - window);
+  const endIso = now.toISOString();
+  if (!since) return { startIso: floor.toISOString(), endIso, truncated: false };
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return { startIso: floor.toISOString(), endIso, truncated: false };
+  if (sinceMs < floor.getTime()) return { startIso: floor.toISOString(), endIso, truncated: true };
+  return { startIso: new Date(sinceMs).toISOString(), endIso, truncated: false };
+}
+function buildEdgeLogsQuery(limit) {
+  const safeLimit = Math.max(1, Math.trunc(limit) || DEFAULT_LOG_LIMIT);
+  return [
+    "select",
+    "  format_timestamp('%Y-%m-%dT%H:%M:%E6SZ', timestamp) as timestamp,",
+    "  request.method as method,",
+    "  request.path as path,",
+    "  response.status_code as status_code",
+    "from edge_logs",
+    "cross join unnest(metadata) as metadata",
+    "cross join unnest(metadata.request) as request",
+    "cross join unnest(metadata.response) as response",
+    "where regexp_contains(request.path, '^/rest/v1/')",
+    "order by timestamp asc",
+    `limit ${safeLimit}`
+  ].join("\n");
+}
+async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl = fetch) {
+  const baseUrl = config.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
+  const url = new URL(`${baseUrl}/v1/projects/${config.apiProjectRef}/analytics/endpoints/logs.all`);
+  url.searchParams.set("sql", buildEdgeLogsQuery(config.logLimit ?? DEFAULT_LOG_LIMIT));
+  url.searchParams.set("iso_timestamp_start", startIso);
+  url.searchParams.set("iso_timestamp_end", endIso);
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: bearerAuthHeader(token) },
+    // accountKey: the Supabase project ref (ADR-131's own worked example) —
+    // the Management API's rate limit is enforced per project.
+    { provider: "supabase", accountKey: config.apiProjectRef, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(`supabase connector: logs.all request failed (${res.status} ${res.statusText})`);
+  }
+  const body = await res.json();
+  if (body.error) {
+    const message = typeof body.error === "string" ? body.error : body.error.message;
+    throw new Error(`supabase connector: logs.all returned an error (${message})`);
+  }
+  return body.result ?? [];
+}
+
+// src/connectors/supabase/types.ts
+function readSupabaseCredentials(raw) {
+  const managementToken = raw["managementToken"];
+  if (typeof managementToken !== "string" || managementToken.length === 0) {
+    throw new Error("supabase connector: credentials.managementToken must be a non-empty string");
+  }
+  const postgresConnectionString = raw["postgresConnectionString"];
+  if (postgresConnectionString !== void 0 && (typeof postgresConnectionString !== "string" || postgresConnectionString.length === 0)) {
+    throw new Error(
+      "supabase connector: credentials.postgresConnectionString must be a non-empty string when present"
+    );
+  }
+  return {
+    managementToken,
+    ...postgresConnectionString ? { postgresConnectionString } : {}
+  };
+}
+var SUPABASE_TABLE_TARGET_KIND = "supabase-table";
+var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
+
+// src/connectors/supabase/map.ts
+var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
+var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
+function targetFromRestPath(path4) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path4);
+  if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
+  const tableMatch = REST_TABLE_PATH_RE.exec(path4);
+  if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
+  return null;
+}
+var ERROR_STATUS_THRESHOLD = 500;
+function mapEdgeLogRowsToSignals(rows) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const target = targetFromRestPath(row.path);
+    if (!target) continue;
+    const key = `${target.targetKind}:${target.name}`;
+    const isError = row.status_code >= ERROR_STATUS_THRESHOLD;
+    const existing = buckets2.get(key);
+    if (existing) {
+      existing.callCount += 1;
+      if (isError) existing.errorCount += 1;
+      if (row.timestamp > existing.lastObservedIso) existing.lastObservedIso = row.timestamp;
+    } else {
+      buckets2.set(key, {
+        targetKind: target.targetKind,
+        targetName: target.name,
+        callCount: 1,
+        errorCount: isError ? 1 : 0,
+        lastObservedIso: row.timestamp
+      });
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso
+  }));
+}
+var FROM_TABLE_RE = /\bfrom\s+"?(?:[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i;
+var SYSTEM_SCHEMA_PREFIXES = ["pg_", "information_schema"];
+function tableNameFromQueryText(query) {
+  const match = FROM_TABLE_RE.exec(query);
+  if (!match) return null;
+  const name = match[1];
+  const lower = name.toLowerCase();
+  if (SYSTEM_SCHEMA_PREFIXES.some((prefix) => lower.startsWith(prefix))) return null;
+  return name;
+}
+function diffPgStatStatementsToSignals(rows, previous, nowIso) {
+  const signals = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    seen.add(row.queryid);
+    const calls = Number(row.calls);
+    const prior = previous.get(row.queryid);
+    previous.set(row.queryid, { calls });
+    if (!prior || calls < prior.calls) continue;
+    const delta = calls - prior.calls;
+    if (delta <= 0) continue;
+    const table = tableNameFromQueryText(row.query);
+    if (!table) continue;
+    signals.push({
+      targetKind: SUPABASE_TABLE_TARGET_KIND,
+      targetName: table,
+      callCount: delta,
+      errorCount: 0,
+      lastObservedIso: nowIso
+    });
+  }
+  for (const queryid of [...previous.keys()]) {
+    if (!seen.has(queryid)) previous.delete(queryid);
+  }
+  return signals;
+}
+
+// src/connectors/supabase/postgres-client.ts
+import pg from "pg";
+var { Client } = pg;
+var DEFAULT_STATEMENT_LIMIT = 500;
+var STATEMENTS_QUERY = `
+  select queryid, query, calls, total_exec_time, rows
+  from pg_stat_statements
+  where query ~* '^\\s*select\\b'
+  order by calls desc
+  limit $1
+`;
+async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT_LIMIT, accountKey = "unknown", clientFactory = (cs) => new Client({ connectionString: cs })) {
+  return dbJunction(
+    async () => {
+      const client = clientFactory(connectionString);
+      await client.connect();
+      try {
+        await client.query("SET default_transaction_read_only = on");
+        const result = await client.query(STATEMENTS_QUERY, [limit]);
+        return result.rows;
+      } finally {
+        await client.end();
+      }
+    },
+    { provider: "supabase-postgres", accountKey }
+  );
+}
+
+// src/connectors/supabase/resolve.ts
+import { EdgeType, infraId } from "@neat.is/types";
+function createSupabaseResolveTarget(graph, config) {
+  return (signal, _ctx) => {
+    if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
+      return null;
+    }
+    const subResourceId = infraId(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    if (graph.hasNode(subResourceId)) {
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: EdgeType.CALLS };
+    }
+    const projectLevelId = infraId("supabase", config.nodeRef);
+    if (graph.hasNode(projectLevelId)) {
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: EdgeType.CALLS };
+    }
+    return null;
+  };
+}
+
+// src/connectors/supabase/index.ts
+var DEFAULT_MAX_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
+var SupabaseConnector = class {
+  // `deps.fetchPgStatStatements` defaults to the real Postgres-backed
+  // implementation; tests override it to exercise the "both surfaces
+  // combine" and "surface 2 only runs when a connection string is present"
+  // behavior without a live database — the same dependency-injection seam
+  // `fetchImpl` gives cloudflare/client.ts's tests for `fetch`.
+  constructor(config, deps = {}) {
+    this.config = config;
+    this.deps = deps;
+  }
+  config;
+  deps;
+  provider = "supabase";
+  // pg_stat_statements.calls is cumulative, not per-window (map.ts's
+  // diffPgStatStatementsToSignals doc comment) — this Map carries the
+  // previous poll's counts across ticks, the same way
+  // `startConnectorPollLoop` (connectors/index.ts) carries `since` across
+  // ticks for every connector. Lives on the instance, not `ConnectorContext`,
+  // because `ConnectorContext` is rebuilt fresh per tick (connectors/index.ts's
+  // `{ ...ctx, since }`) while this connector object is the one thing every
+  // tick shares.
+  statementBaselines = /* @__PURE__ */ new Map();
+  async poll(ctx) {
+    const creds = readSupabaseCredentials(ctx.credentials);
+    const now = /* @__PURE__ */ new Date();
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS;
+    const { startIso, endIso } = boundedSupabaseLogWindow(ctx.since, now, maxLookbackMs);
+    const logRows = await fetchSupabaseEdgeLogs(this.config, creds.managementToken, startIso, endIso);
+    const signals = mapEdgeLogRowsToSignals(logRows);
+    if (creds.postgresConnectionString) {
+      const fetchStatements = this.deps.fetchPgStatStatements ?? fetchPgStatStatements;
+      const statementRows = await fetchStatements(
+        creds.postgresConnectionString,
+        this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
+        this.config.apiProjectRef
+      );
+      signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
+    }
+    return signals;
+  }
+};
+function createSupabaseConnector(graph, config, deps = {}) {
+  return {
+    connector: new SupabaseConnector(config, deps),
+    resolveTarget: createSupabaseResolveTarget(graph, config)
+  };
+}
+
+// src/connectors/railway/index.ts
+import { EdgeType as EdgeType2, NodeType, serviceId } from "@neat.is/types";
+
+// src/connectors/railway/client.ts
+var DEFAULT_RAILWAY_API_URL = "https://backboard.railway.com/graphql/v2";
+var DEFAULT_MAX_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_LOG_LIMIT2 = 1e3;
+function readRailwayToken(credentials) {
+  const token = credentials.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error(
+      "Railway connector requires ctx.credentials.token (a Project-Access-Token or account Bearer token)"
+    );
+  }
+  return token;
+}
+async function railwayGraphQL(apiUrl, token, query, variables, accountKey) {
+  const res = await junctionFetch(
+    apiUrl,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        // docs.railway.com/integrations/api/graphql-overview confirms
+        // `Authorization: Bearer <token>` for an account/workspace token;
+        // Railway also documents a dedicated `Project-Access-Token: <token>`
+        // header for the project-scoped token ADR-127 targets specifically.
+        // This connector sends the Bearer form — needs-endpoint-testing
+        // whether a live Project-Access-Token requires the dedicated header
+        // instead once this poller runs against a real project.
+        ...bearerAuthHeader(token)
+      },
+      body: JSON.stringify({ query, variables })
+    },
+    { provider: "railway", accountKey }
+  );
+  if (!res.ok) {
+    throw new Error(`Railway GraphQL request failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  if (body.errors && body.errors.length > 0) {
+    throw new Error(`Railway GraphQL errors: ${body.errors.map((e) => e.message).join("; ")}`);
+  }
+  if (!body.data) throw new Error("Railway GraphQL response carried no data");
+  return body.data;
+}
+var HTTP_LOGS_QUERY = `
+  query HttpLogs(
+    $environmentId: String!
+    $serviceId: String!
+    $startDate: String!
+    $endDate: String!
+    $limit: Int
+  ) {
+    httpLogs(
+      environmentId: $environmentId
+      serviceId: $serviceId
+      startDate: $startDate
+      endDate: $endDate
+      limit: $limit
+    ) {
+      timestamp
+      method
+      path
+      httpStatus
+      totalDuration
+      requestId
+      deploymentId
+      edgeRegion
+    }
+  }
+`;
+var NETWORK_FLOW_LOGS_QUERY = `
+  query NetworkFlowLogs(
+    $environmentId: String!
+    $serviceId: String!
+    $startDate: String!
+    $endDate: String!
+    $limit: Int
+  ) {
+    networkFlowLogs(
+      environmentId: $environmentId
+      serviceId: $serviceId
+      startDate: $startDate
+      endDate: $endDate
+      limit: $limit
+    ) {
+      timestamp
+      peerServiceId
+      peerKind
+      direction
+      byteCount
+      packetCount
+      dropCause
+    }
+  }
+`;
+async function fetchRailwayHttpLogs(config, token, startDate, endDate) {
+  const data = await railwayGraphQL(
+    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+    token,
+    HTTP_LOGS_QUERY,
+    {
+      environmentId: config.environmentId,
+      serviceId: config.serviceId,
+      startDate,
+      endDate,
+      limit: config.limit ?? DEFAULT_LOG_LIMIT2
+    },
+    config.environmentId
+  );
+  return data.httpLogs;
+}
+async function fetchRailwayNetworkFlowLogs(config, token, startDate, endDate) {
+  const data = await railwayGraphQL(
+    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+    token,
+    NETWORK_FLOW_LOGS_QUERY,
+    {
+      environmentId: config.environmentId,
+      serviceId: config.serviceId,
+      startDate,
+      endDate,
+      limit: config.limit ?? DEFAULT_LOG_LIMIT2
+    },
+    config.environmentId
+  );
+  return data.networkFlowLogs;
+}
+function boundedRailwayStartDate(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+
+// src/connectors/railway/index.ts
+var ROUTE_TARGET_KIND = "route";
+var UNMATCHED_ROUTE_TARGET_KIND = "unmatched-route";
+var PEER_SERVICE_TARGET_KIND = "peer-service";
+function buildRailwayRouteIndex(graph, serviceName) {
+  const out = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    out.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id,
+      path: route.path,
+      line: route.line
+    });
+  });
+  return out;
+}
+function findRailwayRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function bucketKey(method, normalizedPath) {
+  return `${method} ${normalizedPath}`;
+}
+function isHttpErrorStatus(status) {
+  return status >= 400;
+}
+function upsertBucket(buckets2, key, isError, timestamp, build) {
+  const existing = buckets2.get(key);
+  if (existing) {
+    existing.callCount += 1;
+    if (isError) existing.errorCount += 1;
+    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
+    return;
+  }
+  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
+}
+function mapRailwayHttpLogsToSignals(entries, routeIndex) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const method = entry.method.toUpperCase();
+    const normalizedPath = normalizePathTemplate(entry.path);
+    const match = findRailwayRoute(routeIndex, method, normalizedPath);
+    const isError = isHttpErrorStatus(entry.httpStatus);
+    if (match) {
+      upsertBucket(buckets2, `route:${match.routeNodeId}`, isError, entry.timestamp, () => ({
+        targetKind: ROUTE_TARGET_KIND,
+        targetName: match.routeNodeId,
+        // RouteNode.line is optional in the schema (packages/types/src/
+        // nodes.ts) even though routes.ts always sets it today — skip the
+        // callSite rather than fabricate a line when it's ever absent
+        // (file-awareness.md §6).
+        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
+      }));
+    } else {
+      upsertBucket(
+        buckets2,
+        `unmatched:${bucketKey(method, normalizedPath)}`,
+        isError,
+        entry.timestamp,
+        () => ({
+          targetKind: UNMATCHED_ROUTE_TARGET_KIND,
+          targetName: bucketKey(method, normalizedPath)
+        })
+      );
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso,
+    ...b.callSite ? { callSite: b.callSite } : {}
+  }));
+}
+function mapRailwayNetworkFlowLogsToSignals(entries) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (!entry.peerServiceId) continue;
+    const isError = entry.dropCause !== null && entry.dropCause !== "";
+    upsertBucket(buckets2, entry.peerServiceId, isError, entry.timestamp, () => ({
+      targetKind: PEER_SERVICE_TARGET_KIND,
+      targetName: entry.peerServiceId
+    }));
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso
+  }));
+}
+function createRailwayResolveTarget(config) {
+  return (signal) => {
+    const serviceName = config.serviceNameById[config.serviceId];
+    if (!serviceName) return null;
+    if (signal.targetKind === ROUTE_TARGET_KIND) {
+      return { targetNodeId: signal.targetName, serviceName, edgeType: EdgeType2.CALLS };
+    }
+    if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
+      const peerName = config.serviceNameById[signal.targetName];
+      if (!peerName) return null;
+      return { targetNodeId: serviceId(peerName), serviceName, edgeType: EdgeType2.CONNECTS_TO };
+    }
+    return null;
+  };
+}
+function createRailwayConnector(graph, config) {
+  return {
+    provider: "railway",
+    async poll(ctx) {
+      const token = readRailwayToken(ctx.credentials);
+      const now = /* @__PURE__ */ new Date();
+      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS2;
+      const startDate = boundedRailwayStartDate(ctx.since, now, maxLookbackMs);
+      const endDate = now.toISOString();
+      const [httpLogs, flowLogs] = await Promise.all([
+        fetchRailwayHttpLogs(config, token, startDate, endDate),
+        fetchRailwayNetworkFlowLogs(config, token, startDate, endDate)
+      ]);
+      const serviceName = config.serviceNameById[config.serviceId];
+      const routeIndex = serviceName ? buildRailwayRouteIndex(graph, serviceName) : [];
+      return [
+        ...mapRailwayHttpLogsToSignals(httpLogs, routeIndex),
+        ...mapRailwayNetworkFlowLogsToSignals(flowLogs)
+      ];
+    }
+  };
+}
+
+// src/connectors/firebase/logging-api.ts
+function readFirebaseCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("firebase connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("firebase connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var RESOURCE_TYPES = [
+  "cloud_function",
+  "cloud_run_revision",
+  "firebase_domain"
+];
+function isFirebaseResourceType(value) {
+  return RESOURCE_TYPES.includes(value);
+}
+function buildEntriesFilter(sinceIso) {
+  return [
+    'resource.type = ("cloud_function" OR "cloud_run_revision" OR "firebase_domain")',
+    "httpRequest:*",
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var DEFAULT_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE = 1e3;
+var MAX_PAGES = 20;
+async function fetchHttpRequestLogEntries(creds, sinceIso) {
+  const filter = buildEntriesFilter(sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      ENTRIES_LIST_URL,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id (ADR-131's own worked example for
+      // Firebase) — one customer's Cloud Logging quota is scoped per GCP
+      // project, not per Firebase site/function.
+      { provider: "firebase", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    out.push(...json.entries ?? []);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/firebase/map.ts
+var FIELD_SEP = "\0";
+function packFirebaseTargetName(identity) {
+  return [identity.resourceName, identity.method, identity.path].join(FIELD_SEP);
+}
+function parseFirebaseTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP);
+  if (firstSep === -1) return null;
+  const resourceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path4 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path4) return null;
+  return { resourceName, method, path: path4 };
+}
+function resourceNameFor(type, labels) {
+  if (!labels) return null;
+  switch (type) {
+    case "cloud_function":
+      return labels["function_name"] ?? null;
+    case "cloud_run_revision":
+      return labels["service_name"] ?? null;
+    case "firebase_domain":
+      return labels["site_name"] ?? null;
+  }
+}
+function pathFromRequestUrl(requestUrl) {
+  if (!requestUrl) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD2 = 500;
+function mapLogEntryToSignal(entry) {
+  const resourceType = entry.resource?.type;
+  if (!resourceType || !isFirebaseResourceType(resourceType)) return null;
+  const resourceName = resourceNameFor(resourceType, entry.resource?.labels);
+  if (!resourceName) return null;
+  const req = entry.httpRequest;
+  if (!req) return null;
+  if (!req.requestMethod) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path4 = pathFromRequestUrl(req.requestUrl);
+  if (path4 === null) return null;
+  const timestamp = entry.timestamp;
+  if (!timestamp) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
+  return {
+    targetKind: resourceType,
+    targetName: packFirebaseTargetName({ resourceName, method, path: path4 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals(entries) {
+  const out = [];
+  for (const entry of entries) {
+    const signal = mapLogEntryToSignal(entry);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/firebase/resolve.ts
+import { NodeType as NodeType2, EdgeType as EdgeType3 } from "@neat.is/types";
+function neatServiceNameFor(resourceType, resourceName, serviceMap) {
+  switch (resourceType) {
+    case "cloud_function":
+      return serviceMap.functions?.[resourceName] ?? null;
+    case "cloud_run_revision":
+      return serviceMap.cloudRun?.[resourceName] ?? null;
+    case "firebase_domain":
+      return serviceMap.hosting?.[resourceName] ?? null;
+  }
+}
+function routeEntriesFor(graph, serviceName) {
+  const entries = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== NodeType2.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    entries.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id
+    });
+  });
+  return entries;
+}
+function findRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function createFirebaseResolveTarget(graph, serviceMap) {
+  return (signal, _ctx) => {
+    const resourceType = signal.targetKind;
+    if (resourceType !== "cloud_function" && resourceType !== "cloud_run_revision" && resourceType !== "firebase_domain") {
+      return null;
+    }
+    const identity = parseFirebaseTargetName(signal.targetName);
+    if (!identity) return null;
+    const serviceName = neatServiceNameFor(resourceType, identity.resourceName, serviceMap);
+    if (!serviceName) return null;
+    const normalizedPath = normalizePathTemplate(identity.path);
+    const match = findRoute(routeEntriesFor(graph, serviceName), identity.method, normalizedPath);
+    if (!match) return null;
+    return {
+      targetNodeId: match.routeNodeId,
+      serviceName,
+      edgeType: EdgeType3.CALLS
+    };
+  };
+}
+
+// src/connectors/firebase/index.ts
+var FirebaseConnector = class {
+  provider = "firebase";
+  async poll(ctx) {
+    const creds = readFirebaseCredentials(ctx.credentials);
+    const sinceIso = ctx.since ?? new Date(Date.now() - DEFAULT_LOOKBACK_MS).toISOString();
+    const entries = await fetchHttpRequestLogEntries(creds, sinceIso);
+    return mapLogEntriesToSignals(entries);
+  }
+};
+function createFirebaseConnector(graph, serviceMap) {
+  return {
+    connector: new FirebaseConnector(),
+    resolveTarget: createFirebaseResolveTarget(graph, serviceMap)
+  };
+}
+
+// src/connectors/cloudflare/connector.ts
+import { EdgeType as EdgeType4, fileId } from "@neat.is/types";
+
+// src/connectors/cloudflare/client.ts
+import { randomUUID } from "crypto";
+var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
+var DEFAULT_EVENT_LIMIT = 1e3;
+async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
+  const token = ctx.credentials.apiToken;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("cloudflare connector: ctx.credentials.apiToken must be a non-empty string");
+  }
+  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL;
+  const url = `${baseUrl}/accounts/${config.accountId}/workers/observability/telemetry/query`;
+  const body = {
+    // Cloudflare's schema requires an identifier per query even for an
+    // ad-hoc, unsaved one — a fresh id per tick, never reused.
+    queryId: `neat-connector-${randomUUID()}`,
+    timeframe: { from: window.fromMs, to: window.toMs },
+    view: "events",
+    limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
+    // Execute without persisting — this is a read, not a saved query
+    // (connectors.md §2's "never writes on the read path" applies to
+    // Cloudflare's own query-history state too).
+    dry: true
+  };
+  const res = await junctionFetch(
+    url,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...bearerAuthHeader(token)
+      },
+      body: JSON.stringify(body)
+    },
+    // accountKey: the Cloudflare account id (ADR-131's own worked example) —
+    // the Telemetry Query API's ~300/5min limit is enforced per account.
+    { provider: "cloudflare", accountKey: config.accountId, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(
+      `cloudflare connector: telemetry query failed (${res.status} ${res.statusText})`
+    );
+  }
+  const payload = await res.json();
+  if (!payload.success) {
+    const message = payload.errors?.map((e) => e.message).join("; ") || "unknown error";
+    throw new Error(`cloudflare connector: telemetry query returned an error (${message})`);
+  }
+  return payload.result?.events?.events ?? [];
+}
+
+// src/connectors/cloudflare/types.ts
+var CLOUDFLARE_TARGET_KIND = "cloudflare-worker-invocation";
+
+// src/connectors/cloudflare/map.ts
+var HTTP_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "TRACE",
+  "CONNECT"
+]);
+var LEADING_TOKEN_RE = /^(\S+)\s+\S/;
+function parseHttpMethodFromTrigger(trigger) {
+  if (!trigger) return null;
+  const match = LEADING_TOKEN_RE.exec(trigger.trim());
+  const token = match?.[1];
+  if (!token) return null;
+  const method = token.toUpperCase();
+  return HTTP_METHODS.has(method) ? method : null;
+}
+var ERROR_STATUS_THRESHOLD3 = 500;
+function mapEventToSignal(event) {
+  const metadata = event.$metadata;
+  const workers = event.$workers;
+  const method = parseHttpMethodFromTrigger(metadata?.trigger);
+  if (!method) return null;
+  const scriptName = workers?.scriptName ?? metadata?.service;
+  if (!scriptName) return null;
+  const timestampMs = event.timestamp ?? metadata?.startTime;
+  if (typeof timestampMs !== "number" || !Number.isFinite(timestampMs)) return null;
+  const statusCode = metadata?.statusCode;
+  const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
+  return {
+    targetKind: CLOUDFLARE_TARGET_KIND,
+    targetName: scriptName,
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: new Date(timestampMs).toISOString(),
+    method,
+    ...typeof statusCode === "number" ? { statusCode } : {},
+    ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
+  };
+}
+
+// src/connectors/cloudflare/connector.ts
+var DEFAULT_MAX_LOOKBACK_MS3 = 60 * 60 * 1e3;
+function resolveFromMs(since, maxLookbackMs) {
+  const cap = maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS3;
+  const now = Date.now();
+  const floor = now - cap;
+  if (!since) return floor;
+  const parsed = Date.parse(since);
+  if (Number.isNaN(parsed)) return floor;
+  return Math.max(parsed, floor);
+}
+var CloudflareConnector = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  provider = "cloudflare";
+  async poll(ctx) {
+    const toMs = Date.now();
+    const fromMs = resolveFromMs(ctx.since, this.config.maxLookbackMs);
+    const events = await queryWorkerInvocations(ctx, this.config, { fromMs, toMs });
+    const signals = [];
+    for (const event of events) {
+      const signal = mapEventToSignal(event);
+      if (signal) signals.push(signal);
+    }
+    return signals;
+  }
+};
+function createCloudflareResolveTarget(config) {
+  return (signal) => {
+    if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
+    const mapping = config.workers[signal.targetName];
+    if (!mapping) return null;
+    return {
+      targetNodeId: fileId(mapping.service, mapping.entryFile),
+      serviceName: mapping.service,
+      edgeType: EdgeType4.CALLS
+    };
+  };
+}
+
+// src/connectors-config.ts
+import os from "os";
+import path from "path";
+import { promises as fs } from "fs";
+var CONNECTORS_CONFIG_VERSION = 1;
+var EnvRefUnsetError = class extends Error {
+  ref;
+  varName;
+  constructor(ref, varName) {
+    super(`${ref} is unset`);
+    this.name = "EnvRefUnsetError";
+    this.ref = ref;
+    this.varName = varName;
+  }
+};
+function neatHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return path.resolve(override);
+  return path.join(os.homedir(), ".neat");
+}
+function connectorsConfigPath(home = neatHome()) {
+  return path.join(home, "connectors.json");
+}
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await fs.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
+      );
+    }
+  } catch {
+  }
+}
+async function readConnectorsConfig(home = neatHome()) {
+  const file = connectorsConfigPath(home);
+  let raw;
+  try {
+    raw = await fs.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
+    }
+    throw err;
+  }
+  await warnIfModeLooserThan0600(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig(parsed, file);
+}
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "connectors" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawConnectors = obj.connectors;
+  if (!Array.isArray(rawConnectors)) {
+    throw new Error(`${file}: "connectors" must be an array`);
+  }
+  const connectors = rawConnectors.map((entry, i) => validateEntry(entry, i, file));
+  return { version, connectors };
+}
+function validateEntry(entry, index, file) {
+  const where = `${file}: connectors[${index}]`;
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry;
+  const id = e.id;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error(`${where}.id must be a non-empty string`);
+  }
+  const provider = e.provider;
+  if (typeof provider !== "string" || provider.length === 0) {
+    throw new Error(`${where}.provider must be a non-empty string`);
+  }
+  if (e.project !== void 0 && typeof e.project !== "string") {
+    throw new Error(`${where}.project must be a string when present`);
+  }
+  const credential = validateCredentialRef(e.credential, `${where}.credential`);
+  let options;
+  if (e.options !== void 0) {
+    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
+      throw new Error(`${where}.options must be an object when present`);
+    }
+    options = e.options;
+  }
+  return {
+    id,
+    provider,
+    ...typeof e.project === "string" ? { project: e.project } : {},
+    credential,
+    ...options ? { options } : {}
+  };
+}
+function validateCredentialRef(raw, where) {
+  if (typeof raw === "string") {
+    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
+    return raw;
+  }
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    const fields = raw;
+    const keys = Object.keys(fields);
+    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
+    for (const key of keys) {
+      const v = fields[key];
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`${where}.${key} must be a non-empty string`);
+      }
+    }
+    return fields;
+  }
+  throw new Error(`${where} must be a string or an object of strings`);
+}
+function resolveCredential(ref, env = process.env) {
+  if (typeof ref === "string") {
+    return { kind: "single", value: resolveRef(ref, env) };
+  }
+  const fields = {};
+  for (const [key, value] of Object.entries(ref)) {
+    fields[key] = resolveRef(value, env);
+  }
+  return { kind: "fields", fields };
+}
+function resolveRef(value, env) {
+  if (value.length > 1 && value.startsWith("$")) {
+    const varName = value.slice(1);
+    const resolved = env[varName];
+    if (resolved === void 0 || resolved.length === 0) {
+      throw new EnvRefUnsetError(value, varName);
+    }
+    return resolved;
+  }
+  return value;
+}
+function connectorMatchesProject(entry, project) {
+  return entry.project === void 0 || entry.project === project;
+}
+var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
+var CONNECTORS_LOCK_RETRY_MS = 50;
+function connectorsConfigLockPath(home = neatHome()) {
+  return path.join(home, "connectors.json.lock");
+}
+function isEnvRef(value) {
+  return value.length > 1 && value.startsWith("$");
+}
+async function writeConfigAtomically0600(file, contents) {
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await fs.open(tmp, "w", 384);
+  try {
+    await fd.writeFile(contents, "utf8");
+    await fd.chmod(384);
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await fs.rename(tmp, file);
+}
+async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  await fs.mkdir(path.dirname(lockPath), { recursive: true });
+  for (; ; ) {
+    try {
+      const fd = await fs.open(lockPath, "wx");
+      try {
+        await fd.writeFile(`${process.pid}
+`, "utf8");
+      } finally {
+        await fd.close();
+      }
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `neat connector: timed out after ${timeoutMs}ms waiting for ${lockPath}. Another neat process may be writing the connector config; if none is, remove that file by hand.`
+        );
+      }
+      await new Promise((r) => setTimeout(r, CONNECTORS_LOCK_RETRY_MS));
+    }
+  }
+}
+async function releaseConnectorsLock(lockPath) {
+  await fs.unlink(lockPath).catch(() => {
+  });
+}
+async function withConnectorsLock(home, fn) {
+  const lock = connectorsConfigLockPath(home);
+  await acquireConnectorsLock(lock);
+  try {
+    return await fn();
+  } finally {
+    await releaseConnectorsLock(lock);
+  }
+}
+function serializeConfig(config) {
+  return JSON.stringify(
+    { version: config.version ?? CONNECTORS_CONFIG_VERSION, connectors: config.connectors },
+    null,
+    2
+  ) + "\n";
+}
+async function upsertConnectorEntry(entry, home = neatHome()) {
+  const file = connectorsConfigPath(home);
+  return withConnectorsLock(home, async () => {
+    const config = await readConnectorsConfig(home);
+    validateEntry(entry, config.connectors.length, file);
+    const idx = config.connectors.findIndex((c) => c.id === entry.id);
+    const replaced = idx >= 0;
+    if (replaced) config.connectors[idx] = entry;
+    else config.connectors.push(entry);
+    await writeConfigAtomically0600(file, serializeConfig(config));
+    return { replaced };
+  });
+}
+async function removeConnectorEntry(id, home = neatHome()) {
+  const file = connectorsConfigPath(home);
+  return withConnectorsLock(home, async () => {
+    const config = await readConnectorsConfig(home);
+    const idx = config.connectors.findIndex((c) => c.id === id);
+    if (idx < 0) return void 0;
+    const [removed] = config.connectors.splice(idx, 1);
+    await writeConfigAtomically0600(file, serializeConfig(config));
+    return removed;
+  });
+}
+function slugFragment(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function autoSlugConnectorId(provider, project, existingIds) {
+  const base = slugFragment(provider) || "connector";
+  if (!existingIds.has(base)) return base;
+  const projectFrag = project ? slugFragment(project) : "";
+  if (projectFrag) {
+    const withProject = `${base}-${projectFrag}`;
+    if (!existingIds.has(withProject)) return withProject;
+  }
+  const stem = projectFrag ? `${base}-${projectFrag}` : base;
+  for (let n = 2; ; n++) {
+    const candidate = `${stem}-${n}`;
+    if (!existingIds.has(candidate)) return candidate;
+  }
+}
+function describeCredential(ref, env = process.env) {
+  const one = (value, field) => {
+    if (isEnvRef(value)) {
+      const varName = value.slice(1);
+      const resolved = env[varName];
+      const set = typeof resolved === "string" && resolved.length > 0;
+      return {
+        ...field ? { field } : {},
+        kind: "env-ref",
+        display: value,
+        status: set ? "set" : "unset"
+      };
+    }
+    return { ...field ? { field } : {}, kind: "plaintext", display: "****" };
+  };
+  if (typeof ref === "string") return [one(ref)];
+  return Object.entries(ref).map(([k, v]) => one(v, k));
+}
+
+// src/connectors/registry.ts
+var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
+async function authProbe(input) {
+  const { provider, accountKey, url, token, init, fetchImpl } = input;
+  try {
+    const res = await junctionFetch(
+      url,
+      {
+        ...init ?? {},
+        headers: { ...bearerAuthHeader(token), ...init?.headers ?? {} }
+      },
+      { provider, accountKey, ...fetchImpl ? { fetchImpl } : {} }
+    );
+    if (res.ok) return { ok: true };
+    if (res.status === 401 || res.status === 403) {
+      return { ok: false, reason: `${provider} rejected the credential (HTTP ${res.status})` };
+    }
+    return {
+      ok: false,
+      reason: `${provider} auth check returned HTTP ${res.status} ${res.statusText} \u2014 could not confirm the credential`
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `${provider} auth check could not reach the provider: ${err.message}`
+    };
+  }
+}
+var PROVIDER_DISPATCH = {
+  supabase: {
+    provider: "supabase",
+    primaryCredentialKey: "managementToken",
+    requiredCredentialFields: ["managementToken"],
+    requiredOptionFields: ["apiProjectRef", "nodeRef", "serviceName"],
+    build(graph, options) {
+      return createSupabaseConnector(graph, options);
+    },
+    // GET /v1/projects — the Management API's own auth-gated list endpoint, the
+    // cheapest confirmation the management token is live (the same surface
+    // client.ts polls, minus the heavy log query).
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
+      return authProbe({
+        provider: "supabase",
+        accountKey: cfg.apiProjectRef ?? "validate",
+        url: `${baseUrl}/v1/projects`,
+        token: String(credentials.managementToken ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  railway: {
+    provider: "railway",
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token"],
+    requiredOptionFields: ["environmentId", "serviceId", "serviceNameById"],
+    build(graph, options) {
+      const config = options;
+      return {
+        connector: createRailwayConnector(graph, config),
+        resolveTarget: createRailwayResolveTarget(config)
+      };
+    },
+    // A minimal GraphQL POST — Railway's gateway 401s an unauthenticated call
+    // at the HTTP layer, so a 2xx confirms the token was accepted regardless of
+    // the query's own shape (the connector's real queries are still
+    // needs-endpoint-testing per railway/types.ts — auth is what we check).
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      return authProbe({
+        provider: "railway",
+        accountKey: cfg.environmentId ?? "validate",
+        url: cfg.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+        token: String(credentials.token ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ query: "{ __typename }" })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  firebase: {
+    provider: "firebase",
+    // Firebase reads both projectId and accessToken from the credential; the
+    // single-string form maps to the secret, and the required-fields check
+    // below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createFirebaseConnector(graph, options);
+    },
+    // GET the project's Cloud Logging log-name list (pageSize 1) — within the
+    // same `roles/logging.viewer` grant the connector polls under, and the
+    // lightest call that still fails 401/403 on a bad or wrong-scoped token.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "firebase",
+        accountKey: projectId || "validate",
+        url: `https://logging.googleapis.com/v2/projects/${projectId}/logs?pageSize=1`,
+        token: String(credentials.accessToken ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  cloudflare: {
+    provider: "cloudflare",
+    primaryCredentialKey: "apiToken",
+    requiredCredentialFields: ["apiToken"],
+    requiredOptionFields: ["accountId", "workers"],
+    build(_graph, options) {
+      const config = options;
+      return {
+        connector: new CloudflareConnector(config),
+        resolveTarget: createCloudflareResolveTarget(config)
+      };
+    },
+    // GET /user/tokens/verify — Cloudflare's own purpose-built "is this API
+    // token live" endpoint. 200 on a valid token, 401 on an invalid one.
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.baseUrl ?? CLOUDFLARE_API_BASE_URL;
+      return authProbe({
+        provider: "cloudflare",
+        accountKey: cfg.accountId ?? "validate",
+        url: `${baseUrl}/user/tokens/verify`,
+        token: String(credentials.apiToken ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  }
+};
+function getProviderDispatch(provider) {
+  return PROVIDER_DISPATCH[provider];
+}
+function resolveEntryCredentials(dispatch, entry, env) {
+  let credentials;
+  try {
+    const resolved = resolveCredential(entry.credential, env);
+    credentials = resolved.kind === "single" ? { [dispatch.primaryCredentialKey]: resolved.value } : { ...resolved.fields };
+  } catch (err) {
+    if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
+    return { ok: false, kind: "error", reason: err.message };
+  }
+  const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
+  if (missingCreds.length > 0) {
+    return {
+      ok: false,
+      kind: "missing-field",
+      reason: `credential missing required field(s): ${missingCreds.join(", ")}`
+    };
+  }
+  return { ok: true, credentials };
+}
+function buildRegistration(entry, graph, env = process.env) {
+  const dispatch = PROVIDER_DISPATCH[entry.provider];
+  if (!dispatch) {
+    return { ok: false, reason: `unknown provider "${entry.provider}"` };
+  }
+  const creds = resolveEntryCredentials(dispatch, entry, env);
+  if (!creds.ok) return { ok: false, reason: creds.reason };
+  const credentials = creds.credentials;
+  const options = entry.options ?? {};
+  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
+  if (missingOpts.length > 0) {
+    return {
+      ok: false,
+      reason: `options missing required field(s): ${missingOpts.join(", ")}`
+    };
+  }
+  let built;
+  try {
+    built = dispatch.build(graph, options);
+  } catch (err) {
+    return { ok: false, reason: err.message };
+  }
+  const intervalMs = typeof options.intervalMs === "number" ? options.intervalMs : void 0;
+  return {
+    ok: true,
+    registration: {
+      connector: built.connector,
+      credentials,
+      resolveTarget: built.resolveTarget,
+      ...intervalMs !== void 0 ? { intervalMs } : {}
+    }
+  };
+}
+async function validateConnectorEntry(entry, env = process.env, fetchImpl) {
+  const dispatch = PROVIDER_DISPATCH[entry.provider];
+  if (!dispatch) {
+    return { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` };
+  }
+  const creds = resolveEntryCredentials(dispatch, entry, env);
+  if (!creds.ok) {
+    if (creds.kind === "unset-env") return { status: "unset-env", reason: creds.reason };
+    return { status: "missing-field", reason: creds.reason };
+  }
+  const options = entry.options ?? {};
+  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
+  if (missingOpts.length > 0) {
+    return {
+      status: "missing-field",
+      reason: `options missing required field(s): ${missingOpts.join(", ")}`
+    };
+  }
+  const result = await dispatch.validate({
+    credentials: creds.credentials,
+    options,
+    ...fetchImpl ? { fetchImpl } : {}
+  });
+  return result.ok ? { status: "ok" } : { status: "rejected", reason: result.reason };
+}
+async function loadConnectorRegistrations(input) {
+  const { project, graph, home, env = process.env, onSkip } = input;
+  let connectors;
+  try {
+    connectors = (await readConnectorsConfig(home)).connectors;
+  } catch (err) {
+    onSkip?.(
+      { id: "(file)", provider: "(all)", credential: "" },
+      `connectors.json unreadable \u2014 ${err.message}`
+    );
+    return [];
+  }
+  const registrations = [];
+  for (const entry of connectors) {
+    if (!connectorMatchesProject(entry, project)) continue;
+    const result = buildRegistration(entry, graph, env);
+    if (result.ok) registrations.push(result.registration);
+    else onSkip?.(entry, result.reason);
+  }
+  return registrations;
+}
+
+// src/unrouted.ts
+import { promises as fs2 } from "fs";
+import path2 from "path";
+function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
+  return {
+    timestamp: now.toISOString(),
+    reason: "no-project-match",
+    service_name: serviceName ?? null,
+    traceId: traceId ?? null
+  };
+}
+async function appendUnroutedSpan(neatHome2, record) {
+  const target = path2.join(neatHome2, "errors.ndjson");
+  await fs2.mkdir(neatHome2, { recursive: true });
+  await fs2.appendFile(target, JSON.stringify(record) + "\n", "utf8");
+}
+function unroutedErrorsPath(neatHome2) {
+  return path2.join(neatHome2, "errors.ndjson");
+}
+
+// src/daemon.ts
+import { NodeType as NodeType3 } from "@neat.is/types";
+function daemonJsonPath(scanPath) {
+  return path3.join(scanPath, "neat-out", "daemon.json");
+}
+function daemonsDiscoveryDir(home) {
+  const base = home && home.length > 0 ? home : neatHomeFromEnv();
+  return path3.join(base, "daemons");
+}
+function daemonDiscoveryPath(project, home) {
+  return path3.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+}
+function sanitizeDiscoveryName(project) {
+  return project.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function neatHomeFromEnv() {
+  const env = process.env.NEAT_HOME;
+  if (env && env.length > 0) return path3.resolve(env);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return path3.join(home, ".neat");
+}
+async function readDaemonRecord(scanPath) {
+  try {
+    const raw = await fs3.readFile(daemonJsonPath(scanPath), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveNeatVersion() {
+  if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
+    return process.env.NEAT_LOCAL_VERSION;
+  }
+  try {
+    const req = createRequire(import.meta.url);
+    const pkg = req("../package.json");
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function writeDaemonRecord(record, home) {
+  const body = JSON.stringify(record, null, 2) + "\n";
+  await writeAtomically(daemonJsonPath(record.projectPath), body);
+  try {
+    await writeAtomically(daemonDiscoveryPath(record.project, home), body);
+  } catch (err) {
+    console.warn(
+      `neatd: could not write discovery copy for "${record.project}" \u2014 ${err.message}`
+    );
+  }
+}
+async function clearDaemonRecord(record, home) {
+  try {
+    const stopped = { ...record, status: "stopped" };
+    await writeAtomically(daemonJsonPath(record.projectPath), JSON.stringify(stopped, null, 2) + "\n");
+  } catch {
+  }
+  try {
+    await fs3.unlink(daemonDiscoveryPath(record.project, home));
+  } catch {
+  }
+}
+function reconcileDaemonRecordSync(record, home) {
+  try {
+    const stopped = { ...record, status: "stopped" };
+    const target = daemonJsonPath(record.projectPath);
+    const tmp = `${target}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(stopped, null, 2) + "\n");
+    renameSync(tmp, target);
+  } catch {
+  }
+  try {
+    unlinkSync(daemonDiscoveryPath(record.project, home));
+  } catch {
+  }
+}
+function teardownSlot(slot) {
+  try {
+    slot.stopPersist();
+  } catch {
+  }
+  try {
+    slot.stopStaleness();
+  } catch {
+  }
+  try {
+    slot.stopConnectors();
+  } catch {
+  }
+  try {
+    slot.detachEvents();
+  } catch {
+  }
+}
+function neatHomeFor(opts) {
+  if (opts.neatHome && opts.neatHome.length > 0) return path3.resolve(opts.neatHome);
+  const env = process.env.NEAT_HOME;
+  if (env && env.length > 0) return path3.resolve(env);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return path3.join(home, ".neat");
+}
+function routeSpanToProject(serviceName, projects) {
+  if (!serviceName) return DEFAULT_PROJECT;
+  for (const entry of projects) {
+    if (entry.status === "paused") continue;
+    if (entry.name === serviceName) return entry.name;
+  }
+  const candidates = [];
+  for (const entry of projects) {
+    if (entry.status === "paused") continue;
+    if (isTokenPrefix(entry.name, serviceName)) candidates.push(entry);
+  }
+  if (candidates.length > 0) {
+    candidates.sort((a, b) => b.name.length - a.name.length);
+    return candidates[0].name;
+  }
+  for (const entry of projects) {
+    if (entry.status === "paused") continue;
+    if (isTokenContained(entry.name, serviceName)) return entry.name;
+  }
+  return DEFAULT_PROJECT;
+}
+function isTokenPrefix(prefix, full) {
+  if (prefix.length >= full.length) return false;
+  if (!full.startsWith(prefix)) return false;
+  const sep = full.charAt(prefix.length);
+  return sep === "-" || sep === "_";
+}
+function isTokenContained(needle, haystack) {
+  if (!haystack.includes(needle)) return false;
+  const tokens = haystack.split(/[-_]/);
+  return tokens.includes(needle);
+}
+function serviceNameMatchesProject(serviceName, project) {
+  if (serviceName === project) return true;
+  if (isTokenPrefix(project, serviceName)) return true;
+  if (isTokenContained(project, serviceName)) return true;
+  return false;
+}
+function spanBelongsToSingleProject(graph, project, serviceName) {
+  if (!serviceName) return true;
+  if (serviceNameMatchesProject(serviceName, project)) return true;
+  return graph.someNode(
+    (_id, attrs) => attrs.type === NodeType3.ServiceNode && attrs.name === serviceName
+  );
+}
+async function bootstrapProject(entry, connectors = [], neatHome2) {
+  const paths = pathsForProject(entry.name, path3.join(entry.path, "neat-out"));
+  try {
+    const stat = await fs3.stat(entry.path);
+    if (!stat.isDirectory()) {
+      throw new Error(`registered path ${entry.path} is not a directory`);
+    }
+  } catch (err) {
+    await setStatus(entry.name, "broken").catch(() => {
+    });
+    return {
+      entry,
+      // Empty graph is fine — `slots` keeps the entry visible in `status`
+      // output; nothing routes to it because it's not 'active'.
+      graph: getGraph(`__broken__:${entry.name}`),
+      outPath: "",
+      paths,
+      stopPersist: () => {
+      },
+      stopStaleness: () => {
+      },
+      stopConnectors: () => {
+      },
+      detachEvents: () => {
+      },
+      status: "broken",
+      errorReason: err.message
+    };
+  }
+  resetGraph(entry.name);
+  const graph = getGraph(entry.name);
+  const outPath = paths.snapshotPath;
+  await loadGraphFromDisk(graph, outPath);
+  const detachEvents = attachGraphToEventBus(graph, { project: entry.name });
+  try {
+    await extractFromDirectory(graph, entry.path);
+    const stopPersist = startPersistLoop(graph, outPath, { exitOnSignal: false });
+    const stopStaleness = startStalenessLoop(graph, {
+      staleEventsPath: paths.staleEventsPath,
+      project: entry.name
+    });
+    const fileConnectors = neatHome2 ? await loadConnectorRegistrations({
+      project: entry.name,
+      graph,
+      home: neatHome2,
+      onSkip: (skipped, reason) => console.warn(
+        `neatd: connector "${skipped.id}" (${skipped.provider}) skipped for project "${entry.name}" \u2014 ${reason}`
+      )
+    }) : [];
+    const allConnectors = [...connectors, ...fileConnectors];
+    const stopFns = allConnectors.map(
+      (registration) => startConnectorPollLoop(
+        registration.connector,
+        { projectDir: entry.path, credentials: registration.credentials },
+        graph,
+        registration.resolveTarget,
+        { intervalMs: registration.intervalMs }
+      )
+    );
+    const stopConnectors = () => {
+      for (const stop of stopFns) stop();
+    };
+    await touchLastSeen(entry.name).catch(() => {
+    });
+    return {
+      entry,
+      graph,
+      outPath,
+      paths,
+      stopPersist,
+      stopStaleness,
+      stopConnectors,
+      detachEvents,
+      status: "active"
+    };
+  } catch (err) {
+    detachEvents();
+    throw err;
+  }
+}
+function resolveRestPort(opts) {
+  if (typeof opts.restPort === "number") return opts.restPort;
+  const env = process.env.PORT;
+  if (env && env.length > 0) {
+    const n = Number.parseInt(env, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  return 8080;
+}
+function resolveOtlpPort(opts) {
+  if (typeof opts.otlpPort === "number") return opts.otlpPort;
+  const env = process.env.OTEL_PORT;
+  if (env && env.length > 0) {
+    const n = Number.parseInt(env, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  return 4318;
+}
+function resolveWebPort() {
+  const env = process.env.NEAT_WEB_PORT;
+  if (env && env.length > 0) {
+    const n = Number.parseInt(env, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  return 6328;
+}
+function portFromListenAddress(address, fallback) {
+  try {
+    const port = new URL(address).port;
+    const n = Number.parseInt(port, 10);
+    if (Number.isFinite(n) && n > 0) return n;
+  } catch {
+  }
+  return fallback;
+}
+function resolveHost(opts, authTokenSet) {
+  if (opts.host && opts.host.length > 0) return opts.host;
+  const env = process.env.HOST;
+  if (env && env.length > 0) return env;
+  if (!authTokenSet) return "127.0.0.1";
+  return "0.0.0.0";
+}
+async function startDaemon(opts = {}) {
+  const home = neatHomeFor(opts);
+  const regPath = registryPath();
+  const projectArg = typeof opts.project === "string" && opts.project.length > 0 ? opts.project : process.env.NEAT_PROJECT && process.env.NEAT_PROJECT.length > 0 ? process.env.NEAT_PROJECT : null;
+  const projectPathArg = opts.projectPath && opts.projectPath.length > 0 ? opts.projectPath : process.env.NEAT_PROJECT_PATH && process.env.NEAT_PROJECT_PATH.length > 0 ? process.env.NEAT_PROJECT_PATH : null;
+  const singleProject = projectArg;
+  const singleProjectPath = singleProject && projectPathArg ? path3.resolve(projectPathArg) : null;
+  if (singleProject && !singleProjectPath) {
+    throw new Error(
+      `neatd: project "${singleProject}" given without a projectPath; pass NEAT_PROJECT_PATH alongside NEAT_PROJECT.`
+    );
+  }
+  if (!singleProject) {
+    try {
+      await fs3.access(regPath);
+    } catch {
+      throw new Error(
+        `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
+      );
+    }
+  }
+  const pidPath = path3.join(home, "neatd.pid");
+  await writeAtomically(pidPath, `${process.pid}
+`);
+  const slots = /* @__PURE__ */ new Map();
+  const registry = new Projects();
+  const bootstrapStatus = /* @__PURE__ */ new Map();
+  const bootstrapStartedAt = /* @__PURE__ */ new Map();
+  const DROP_WARN_INTERVAL_MS = 6e4;
+  const lastDropWarnAt = /* @__PURE__ */ new Map();
+  function warnDroppedSpan(project, reason) {
+    const now = Date.now();
+    const prev = lastDropWarnAt.get(project) ?? 0;
+    if (now - prev < DROP_WARN_INTERVAL_MS) return;
+    lastDropWarnAt.set(project, now);
+    console.warn(
+      `[neatd] dropping span for project "${project}" \u2014 project status: broken (${reason}). Run \`neatd reload\` to retry bootstrap.`
+    );
+  }
+  const unroutedPath = unroutedErrorsPath(home);
+  const lastUnroutedWarnAt = /* @__PURE__ */ new Map();
+  async function recordUnroutedSpan(serviceName, traceId) {
+    const key = serviceName ?? "<missing>";
+    const now = Date.now();
+    try {
+      await appendUnroutedSpan(home, buildUnroutedSpanRecord(serviceName, traceId, new Date(now)));
+    } catch {
+    }
+    const prev = lastUnroutedWarnAt.get(key) ?? 0;
+    if (now - prev < DROP_WARN_INTERVAL_MS) return;
+    lastUnroutedWarnAt.set(key, now);
+    console.warn(
+      `[neatd] dropping span \u2014 service.name "${key}" matches no registered project and no \`default\` project exists. See ${unroutedPath}.`
+    );
+  }
+  function upsertRegistryFromSlot(slot) {
+    if (slot.status !== "active") return;
+    registry.set(slot.entry.name, {
+      scanPath: slot.entry.path,
+      paths: slot.paths,
+      graph: slot.graph
+    });
+  }
+  async function tryRecoverSlot(entry) {
+    try {
+      const fresh = await bootstrapProject(entry, opts.connectors ?? [], home);
+      const prior = slots.get(entry.name);
+      if (prior) teardownSlot(prior);
+      slots.set(entry.name, fresh);
+      upsertRegistryFromSlot(fresh);
+      if (fresh.status === "active") {
+        await setStatus(entry.name, "active").catch(() => {
+        });
+        console.log(
+          `neatd: project "${entry.name}" recovered from broken \u2014 active`
+        );
+      }
+      return fresh;
+    } catch (err) {
+      console.warn(
+        `neatd: project "${entry.name}" still broken after recovery attempt \u2014 ${err.message}`
+      );
+      return slots.get(entry.name);
+    }
+  }
+  async function bootstrapOne(entry) {
+    bootstrapStatus.set(entry.name, "bootstrapping");
+    bootstrapStartedAt.set(entry.name, Date.now());
+    try {
+      const slot = await bootstrapProject(entry, opts.connectors ?? [], home);
+      const prior = slots.get(entry.name);
+      if (prior) teardownSlot(prior);
+      slots.set(entry.name, slot);
+      upsertRegistryFromSlot(slot);
+      bootstrapStatus.set(entry.name, slot.status === "broken" ? "broken" : "active");
+      if (slot.status === "broken") {
+        console.warn(`neatd: project "${entry.name}" broken \u2014 ${slot.errorReason}`);
+      } else {
+        console.log(`neatd: project "${entry.name}" active (${entry.path})`);
+      }
+    } catch (err) {
+      bootstrapStatus.set(entry.name, "broken");
+      console.warn(
+        `neatd: project "${entry.name}" failed to bootstrap \u2014 ${err.message}`
+      );
+      await setStatus(entry.name, "broken").catch(() => {
+      });
+    }
+  }
+  async function enumerateProjects() {
+    if (singleProject && singleProjectPath) {
+      return [
+        {
+          name: singleProject,
+          path: singleProjectPath,
+          registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          languages: [],
+          status: "active"
+        }
+      ];
+    }
+    return listProjects();
+  }
+  async function loadAll() {
+    if (!singleProject) {
+      try {
+        const pruned = await pruneRegistry();
+        for (const entry of pruned) {
+          console.log(
+            `neatd: pruned project "${entry.name}" \u2014 registered path ${entry.path} is gone`
+          );
+          slots.delete(entry.name);
+          bootstrapStatus.delete(entry.name);
+          bootstrapStartedAt.delete(entry.name);
+        }
+      } catch (err) {
+        console.warn(`neatd: registry prune skipped \u2014 ${err.message}`);
+      }
+    }
+    const projects = await enumerateProjects();
+    const seen = /* @__PURE__ */ new Set();
+    const pending = [];
+    for (const entry of projects) {
+      seen.add(entry.name);
+      const existing = slots.get(entry.name);
+      if (existing) {
+        if (existing.status === "broken") {
+          pending.push(tryRecoverSlot(entry).then(() => {
+          }));
+        }
+        continue;
+      }
+      pending.push(bootstrapOne(entry));
+    }
+    for (const [name, slot] of [...slots.entries()]) {
+      if (seen.has(name)) continue;
+      teardownSlot(slot);
+      slots.delete(name);
+      bootstrapStatus.delete(name);
+      bootstrapStartedAt.delete(name);
+      console.log(`neatd: project "${name}" removed from registry \u2014 stopped`);
+    }
+    await Promise.allSettled(pending);
+  }
+  const initialEntries = await enumerateProjects().catch(() => []);
+  for (const entry of initialEntries) {
+    bootstrapStatus.set(entry.name, "bootstrapping");
+    bootstrapStartedAt.set(entry.name, Date.now());
+  }
+  const bind = opts.bindListeners !== false;
+  let restApp = null;
+  let otlpApp = null;
+  let restAddress = "";
+  let otlpAddress = "";
+  let daemonRecord = null;
+  if (bind) {
+    const auth = readAuthEnv();
+    const host = resolveHost(opts, Boolean(auth.authToken));
+    const restPort = resolveRestPort(opts);
+    const otlpPort = resolveOtlpPort(opts);
+    assertBindAuthority(host, auth.authToken);
+    try {
+      restApp = await buildApi({
+        projects: registry,
+        authToken: auth.authToken,
+        trustProxy: auth.trustProxy,
+        publicRead: auth.publicRead,
+        bootstrap: {
+          status: (name) => bootstrapStatus.get(name),
+          list: () => {
+            const now = Date.now();
+            return [...bootstrapStatus.entries()].map(([name, status]) => ({
+              name,
+              status,
+              elapsedMs: now - (bootstrapStartedAt.get(name) ?? now)
+            }));
+          }
+        },
+        // ADR-096 §4/§5/§7 — hand the daemon's identity to buildApi so the REST
+        // surface reflects "the daemon is the project": `GET /projects` reports
+        // only this project (the dashboard pins to it), and the daemon-wide
+        // `/health` carries it at the top level for the spawn-reuse identity
+        // check. Absent for the legacy multi-project daemon.
+        singleProject: singleProject && singleProjectPath ? { name: singleProject, path: singleProjectPath } : void 0
+      });
+      restAddress = await restApp.listen({ port: restPort, host });
+      console.log(
+        `neatd: REST listening on http://${host}:${portFromListenAddress(restAddress, restPort)}`
+      );
+    } catch (err) {
+      for (const slot of slots.values()) {
+        teardownSlot(slot);
+      }
+      if (restApp) await restApp.close().catch(() => {
+      });
+      await fs3.unlink(pidPath).catch(() => {
+      });
+      throw new Error(
+        `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
+      );
+    }
+    async function resolveTargetSlot(serviceName, traceId) {
+      if (singleProject) {
+        let slot2 = slots.get(singleProject);
+        if (!slot2) {
+          slot2 = await tryRecoverSlot({
+            name: singleProject,
+            path: singleProjectPath,
+            registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+            languages: [],
+            status: "active"
+          });
+        } else if (slot2.status === "broken") {
+          slot2 = await tryRecoverSlot(slot2.entry);
+        }
+        if (!slot2 || slot2.status !== "active") {
+          warnDroppedSpan(singleProject, slot2?.errorReason ?? "unknown");
+          return null;
+        }
+        if (!spanBelongsToSingleProject(slot2.graph, singleProject, serviceName)) {
+          await recordUnroutedSpan(serviceName, traceId);
+          return null;
+        }
+        return slot2;
+      }
+      const liveEntries = await listProjects().catch(() => []);
+      const target = routeSpanToProject(serviceName, liveEntries);
+      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
+      if (!slot) {
+        await recordUnroutedSpan(serviceName, traceId);
+        return null;
+      }
+      if (slot.status === "broken") {
+        const entry = liveEntries.find((e) => e.name === slot.entry.name);
+        if (entry) {
+          slot = await tryRecoverSlot(entry);
+        }
+        if (slot.status !== "active") {
+          warnDroppedSpan(slot.entry.name, slot.errorReason ?? "unknown");
+          return null;
+        }
+      }
+      return slot.status === "active" ? slot : null;
+    }
+    async function resolveSlotByName(project, serviceName, traceId) {
+      const liveEntries = await listProjects().catch(() => []);
+      let slot = slots.get(project);
+      if (!slot) {
+        await recordUnroutedSpan(serviceName, traceId);
+        return null;
+      }
+      if (slot.status === "broken") {
+        const entry = liveEntries.find((e) => e.name === slot.entry.name);
+        if (entry) {
+          slot = await tryRecoverSlot(entry);
+        }
+        if (slot.status !== "active") {
+          warnDroppedSpan(slot.entry.name, slot.errorReason ?? "unknown");
+          return null;
+        }
+      }
+      return slot.status === "active" ? slot : null;
+    }
+    try {
+      otlpApp = await buildOtelReceiver({
+        authToken: auth.otelToken,
+        trustProxy: auth.trustProxy,
+        onSpan: async (span) => {
+          const slot = await resolveTargetSlot(span.service, span.traceId);
+          if (!slot) return;
+          await handleSpan(
+            {
+              graph: slot.graph,
+              errorsPath: slot.paths.errorsPath,
+              scanPath: slot.entry.path,
+              project: slot.entry.name,
+              // Receiver already wrote the error event synchronously below.
+              writeErrorEventInline: false
+            },
+            span
+          );
+        },
+        onErrorSpanSync: async (span) => {
+          const slot = await resolveTargetSlot(span.service, span.traceId);
+          if (!slot) return;
+          await makeErrorSpanWriter(slot.paths.errorsPath, slot.graph, slot.entry.path)(span);
+        },
+        // Project-scoped route (issue #367) — the URL already named the
+        // project. Resolution is a direct slot lookup; service.name resolves
+        // the ServiceNode inside the slot's graph instead of which project
+        // owns the span.
+        onProjectSpan: async (project, span) => {
+          const slot = await resolveSlotByName(project, span.service, span.traceId);
+          if (!slot) return;
+          await handleSpan(
+            {
+              graph: slot.graph,
+              errorsPath: slot.paths.errorsPath,
+              scanPath: slot.entry.path,
+              project: slot.entry.name,
+              writeErrorEventInline: false
+            },
+            span
+          );
+        },
+        onProjectErrorSpanSync: async (project, span) => {
+          const slot = await resolveSlotByName(project, span.service, span.traceId);
+          if (!slot) return;
+          await makeErrorSpanWriter(slot.paths.errorsPath, slot.graph, slot.entry.path)(span);
+        }
+      });
+      otlpAddress = await listenSteppingOtlp(otlpApp, otlpPort, host);
+      console.log(`neatd: OTLP listening on ${otlpAddress}/v1/traces`);
+    } catch (err) {
+      for (const slot of slots.values()) {
+        teardownSlot(slot);
+      }
+      if (restApp) await restApp.close().catch(() => {
+      });
+      if (otlpApp) await otlpApp.close().catch(() => {
+      });
+      await fs3.unlink(pidPath).catch(() => {
+      });
+      throw new Error(
+        `neatd: failed to bind OTLP on port ${otlpPort} \u2014 ${err.message}`
+      );
+    }
+    if (singleProject && singleProjectPath) {
+      const ports = {
+        rest: portFromListenAddress(restAddress, restPort),
+        otlp: portFromListenAddress(otlpAddress, otlpPort),
+        // The daemon doesn't bind the web port itself (neatd spawns the web
+        // child); it records the allocated value passed through so the
+        // dashboard and `neat ps` agree on where to look.
+        web: typeof opts.webPort === "number" ? opts.webPort : resolveWebPort()
+      };
+      daemonRecord = {
+        project: singleProject,
+        projectPath: singleProjectPath,
+        pid: process.pid,
+        status: "running",
+        ports,
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        neatVersion: resolveNeatVersion()
+      };
+      try {
+        await writeDaemonRecord(daemonRecord, home);
+        console.log(
+          `neatd: project "${singleProject}" \u2192 REST ${ports.rest} / OTLP ${ports.otlp} / web ${ports.web} (daemon.json written)`
+        );
+      } catch (err) {
+        for (const slot of slots.values()) teardownSlot(slot);
+        if (restApp) await restApp.close().catch(() => {
+        });
+        if (otlpApp) await otlpApp.close().catch(() => {
+        });
+        await fs3.unlink(pidPath).catch(() => {
+        });
+        throw new Error(
+          `neatd: failed to write daemon.json for "${singleProject}" \u2014 ${err.message}`
+        );
+      }
+    }
+  }
+  const initialBootstrap = loadAll().catch((err) => {
+    console.warn(`neatd: initial bootstrap pass failed \u2014 ${err.message}`);
+  });
+  let reloading = initialBootstrap;
+  const reload = async () => {
+    if (reloading) return reloading;
+    reloading = (async () => {
+      try {
+        await loadAll();
+      } finally {
+        reloading = null;
+      }
+    })();
+    return reloading;
+  };
+  void initialBootstrap.finally(() => {
+    if (reloading === initialBootstrap) reloading = null;
+  });
+  const tracker = {
+    status: (name) => bootstrapStatus.get(name),
+    list: () => {
+      const now = Date.now();
+      return [...bootstrapStatus.entries()].map(([name, status]) => ({
+        name,
+        status,
+        elapsedMs: now - (bootstrapStartedAt.get(name) ?? now)
+      }));
+    }
+  };
+  const sighupHandler = () => {
+    void reload().catch((err) => {
+      console.warn(`neatd: SIGHUP reload failed \u2014 ${err.message}`);
+    });
+  };
+  process.on("SIGHUP", sighupHandler);
+  const REGISTRY_RELOAD_DEBOUNCE_MS = 500;
+  let registryWatcher = null;
+  let reloadTimer = null;
+  if (!singleProject) try {
+    const regDir = path3.dirname(regPath);
+    const regBase = path3.basename(regPath);
+    registryWatcher = watch(regDir, (_eventType, filename) => {
+      if (filename !== null && filename !== regBase) return;
+      if (reloadTimer) clearTimeout(reloadTimer);
+      reloadTimer = setTimeout(() => {
+        reloadTimer = null;
+        void reload().catch((err) => {
+          console.warn(
+            `neatd: registry-watch reload failed \u2014 ${err.message}`
+          );
+        });
+      }, REGISTRY_RELOAD_DEBOUNCE_MS);
+    });
+  } catch (err) {
+    console.warn(
+      `neatd: failed to watch registry at ${regPath} \u2014 ${err.message}. Run \`neatd reload\` (or send SIGHUP) after registering new projects.`
+    );
+  }
+  let stopped = false;
+  const stop = async () => {
+    if (stopped) return;
+    stopped = true;
+    process.off("SIGHUP", sighupHandler);
+    if (reloadTimer) {
+      clearTimeout(reloadTimer);
+      reloadTimer = null;
+    }
+    if (registryWatcher) {
+      try {
+        registryWatcher.close();
+      } catch {
+      }
+      registryWatcher = null;
+    }
+    if (otlpApp) await otlpApp.close().catch(() => {
+    });
+    if (restApp) await restApp.close().catch(() => {
+    });
+    for (const slot of slots.values()) {
+      if (slot.status === "active" && slot.outPath) {
+        await saveGraphToDisk(slot.graph, slot.outPath).catch(() => {
+        });
+      }
+    }
+    for (const slot of slots.values()) {
+      teardownSlot(slot);
+    }
+    if (daemonRecord) {
+      await clearDaemonRecord(daemonRecord, home);
+    }
+    await fs3.unlink(pidPath).catch(() => {
+    });
+  };
+  return {
+    slots,
+    reload,
+    stop,
+    pidPath,
+    restAddress,
+    otlpAddress,
+    bootstrap: tracker,
+    initialBootstrap,
+    daemonRecord,
+    neatHome: home
+  };
+}
+
+export {
+  readConnectorsConfig,
+  isEnvRef,
+  upsertConnectorEntry,
+  removeConnectorEntry,
+  autoSlugConnectorId,
+  describeCredential,
+  PROVIDER_DISPATCH,
+  getProviderDispatch,
+  validateConnectorEntry,
+  readDaemonRecord,
+  resolveNeatVersion,
+  writeDaemonRecord,
+  clearDaemonRecord,
+  reconcileDaemonRecordSync,
+  routeSpanToProject,
+  portFromListenAddress,
+  resolveHost,
+  startDaemon
+};
+//# sourceMappingURL=chunk-NY5Q6NE2.js.map