@neat.is/core 0.4.27 → 0.4.28-dev.20260708

package/dist/cli.cjs

@@ -55,15 +55,16 @@ function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
   const expected = Buffer.from(opts.token, "utf8");
-  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const exactUnauthPaths = /* @__PURE__ */ new Set([
+    ...DEFAULT_UNAUTH_PATHS,
+    ...opts.extraUnauthenticatedSuffixes ?? []
+  ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path56 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    for (const suffix of suffixes) {
-      if (path56 === suffix || path56.endsWith(suffix)) {
-        done();
-        return;
-      }
+    const path57 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path57) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path57)) {
+      done();
+      return;
     }
     if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
       done();
@@ -98,7 +99,7 @@ function readAuthEnv(env = process.env) {
     publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -119,12 +120,15 @@ var init_auth = __esm({
       }
     };
     PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-    DEFAULT_UNAUTH_SUFFIXES = [
+    DEFAULT_UNAUTH_PATHS = [
       "/health",
       "/healthz",
       "/readyz",
       "/api/config"
     ];
+    PROJECT_SCOPED_UNAUTH_PATTERN = new RegExp(
+      `^/projects/[^/]+/(?:${DEFAULT_UNAUTH_PATHS.map((p) => p.slice(1)).join("|")})$`
+    );
   }
 });
 
@@ -358,8 +362,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path56 = q === -1 ? v : v.slice(0, q);
-      if (path56.length > 0) return path56;
+      const path57 = q === -1 ? v : v.slice(0, q);
+      if (path57.length > 0) return path57;
     }
   }
   return void 0;
@@ -686,8 +690,8 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path55 = __toESM(require("path"), 1);
-var import_node_fs35 = require("fs");
+var import_node_path56 = __toESM(require("path"), 1);
+var import_node_fs36 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1252,19 +1256,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path56, edges) {
-    if (path56.length > best.path.length) {
-      best = { path: [...path56], edges: [...edges] };
+  function step(node, path57, edges) {
+    if (path57.length > best.path.length) {
+      best = { path: [...path57], edges: [...edges] };
     }
-    if (path56.length - 1 >= maxDepth) return;
+    if (path57.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path56.push(srcId);
+      path57.push(srcId);
       edges.push(edge);
-      step(srcId, path56, edges);
-      path56.pop();
+      step(srcId, path57, edges);
+      path57.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1279,7 +1283,7 @@ function databaseRootCauseShape(graph, origin, walk3) {
   for (const id of walk3.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId4, svc } = owner;
+    const { id: serviceId5, svc } = owner;
     const deps = svc.dependencies ?? {};
     for (const pair of candidatePairs) {
       const declared = deps[pair.driver];
@@ -1292,7 +1296,7 @@ function databaseRootCauseShape(graph, origin, walk3) {
       );
       if (!result.compatible) {
         return {
-          rootCauseNode: serviceId4,
+          rootCauseNode: serviceId5,
           rootCauseReason: result.reason ?? "incompatible driver",
           ...result.minDriverVersion ? {
             fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
@@ -1307,7 +1311,7 @@ function serviceRootCauseShape(graph, _origin, walk3) {
   for (const id of walk3.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId4, svc } = owner;
+    const { id: serviceId5, svc } = owner;
     const deps = svc.dependencies ?? {};
     const serviceNodeEngine = svc.nodeEngine;
     for (const constraint of nodeEngineConstraints()) {
@@ -1316,7 +1320,7 @@ function serviceRootCauseShape(graph, _origin, walk3) {
       const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId4,
+          rootCauseNode: serviceId5,
           rootCauseReason: result.reason,
           ...result.requiredNodeVersion ? {
             fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
@@ -1331,7 +1335,7 @@ function serviceRootCauseShape(graph, _origin, walk3) {
       const result = checkPackageConflict(conflict, declared, requiredDeclared);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId4,
+          rootCauseNode: serviceId5,
           rootCauseReason: result.reason,
           fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
         };
@@ -1422,9 +1426,9 @@ function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
 function isFailingCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
 }
-function callSourcesForService(graph, serviceId4) {
-  const ids = [serviceId4];
-  for (const edgeId of graph.outboundEdges(serviceId4)) {
+function callSourcesForService(graph, serviceId5) {
+  const ids = [serviceId5];
+  for (const edgeId of graph.outboundEdges(serviceId5)) {
     const e = graph.getEdgeAttributes(edgeId);
     if (e.type !== import_types.EdgeType.CONTAINS) continue;
     const tgt = graph.getNodeAttributes(e.target);
@@ -1441,9 +1445,9 @@ function failingCallDominates(e, id, curEdge, curId) {
   }
   return id < curId;
 }
-function dominantFailingCall(graph, serviceId4, visited) {
+function dominantFailingCall(graph, serviceId5, visited) {
   let best = null;
-  for (const src of callSourcesForService(graph, serviceId4)) {
+  for (const src of callSourcesForService(graph, serviceId5)) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (!isFailingCallEdge(e)) continue;
@@ -1458,26 +1462,26 @@ function dominantFailingCall(graph, serviceId4, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path56 = [originServiceId];
+  const path57 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path56.push(hop.nextService);
+    path57.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path56, edges, culprit: current };
+  return { path: path57, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path56 = [...chain.path];
+  const path57 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1485,14 +1489,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path56.push(loc.fileNode);
+      path57.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path56,
+      traversalPath: path57,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1504,7 +1508,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path56,
+    traversalPath: path57,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -3060,29 +3064,29 @@ function promoteFrontierNodes(graph, opts = {}) {
     toPromote.push({ frontierId: id, serviceId: target });
   });
   let promoted = 0;
-  for (const { frontierId: frontierId2, serviceId: serviceId4 } of toPromote) {
+  for (const { frontierId: frontierId2, serviceId: serviceId5 } of toPromote) {
     if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
       const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
       if (!gate.allowed) {
         continue;
       }
     }
-    rewireFrontierEdges(graph, frontierId2, serviceId4);
+    rewireFrontierEdges(graph, frontierId2, serviceId5);
     graph.dropNode(frontierId2);
     promoted++;
   }
   return promoted;
 }
-function rewireFrontierEdges(graph, frontierId2, serviceId4) {
+function rewireFrontierEdges(graph, frontierId2, serviceId5) {
   const inbound = [...graph.inboundEdges(frontierId2)];
   const outbound = [...graph.outboundEdges(frontierId2)];
   for (const edgeId of inbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, edge.source, serviceId4, edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId5, edgeId);
   }
   for (const edgeId of outbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, serviceId4, edge.target, edgeId);
+    rebuildEdge(graph, edge, serviceId5, edge.target, edgeId);
   }
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
@@ -3233,24 +3237,58 @@ function dedupeIncidents(events) {
     return !hasRealFailure.has(groupKey(ev));
   });
 }
+var SnapshotValidationError = class extends Error {
+  constructor(issues) {
+    super(`snapshot failed validation (${issues.length} invalid ${issues.length === 1 ? "entry" : "entries"})`);
+    this.issues = issues;
+    this.name = "SnapshotValidationError";
+  }
+  issues;
+};
+function describeZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
+  const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
+  const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
+  const issues = [];
+  const validNodes = [];
+  const validEdges = [];
+  for (const node of incomingNodes) {
+    if (node.attributes === void 0) continue;
+    const parsed = import_types3.GraphNodeSchema.safeParse(node.attributes);
+    if (!parsed.success) {
+      issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    validNodes.push({ key: node.key, attributes: parsed.data });
+  }
+  for (const edge of incomingEdges) {
+    if (edge.attributes === void 0) continue;
+    const parsed = import_types3.GraphEdgeSchema.safeParse(edge.attributes);
+    if (!parsed.success) {
+      const label = edge.key ?? `${edge.source}->${edge.target}`;
+      issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    const id = edge.key ?? parsed.data.id;
+    validEdges.push({ key: id, source: edge.source, target: edge.target, attributes: parsed.data });
+  }
+  if (issues.length > 0) {
+    throw new SnapshotValidationError(issues);
+  }
   let nodesAdded = 0;
   let edgesAdded = 0;
-  for (const node of exported.nodes ?? []) {
+  for (const node of validNodes) {
     if (graph.hasNode(node.key)) continue;
-    if (!node.attributes) continue;
     graph.addNode(node.key, node.attributes);
     nodesAdded++;
   }
-  for (const edge of exported.edges ?? []) {
-    const attrs = edge.attributes;
-    if (!attrs) continue;
-    const id = edge.key ?? attrs.id;
-    if (!id) continue;
-    if (graph.hasEdge(id)) continue;
+  for (const edge of validEdges) {
+    if (graph.hasEdge(edge.key)) continue;
     if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
-    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    graph.addEdgeWithKey(edge.key, edge.source, edge.target, edge.attributes);
     edgesAdded++;
   }
   return { nodesAdded, edgesAdded };
@@ -3856,9 +3894,9 @@ var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
   "StatefulSet",
   "DaemonSet"
 ]);
-function addAliases(graph, serviceId4, candidates) {
-  if (!graph.hasNode(serviceId4)) return;
-  const node = graph.getNodeAttributes(serviceId4);
+function addAliases(graph, serviceId5, candidates) {
+  if (!graph.hasNode(serviceId5)) return;
+  const node = graph.getNodeAttributes(serviceId5);
   if (node.type !== import_types6.NodeType.ServiceNode) return;
   const set = new Set(node.aliases ?? []);
   for (const c of candidates) {
@@ -3868,7 +3906,7 @@ function addAliases(graph, serviceId4, candidates) {
   }
   if (set.size === 0) return;
   const updated = { ...node, aliases: [...set].sort() };
-  graph.replaceNodeAttributes(serviceId4, updated);
+  graph.replaceNodeAttributes(serviceId5, updated);
 }
 function indexServicesByName(services) {
   const map = /* @__PURE__ */ new Map();
@@ -3901,12 +3939,12 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
   }
   if (!compose?.services) return;
   for (const [composeName, svc] of Object.entries(compose.services)) {
-    const serviceId4 = serviceIndex.get(composeName);
-    if (!serviceId4) continue;
+    const serviceId5 = serviceIndex.get(composeName);
+    if (!serviceId5) continue;
     const aliases = /* @__PURE__ */ new Set([composeName]);
     if (svc.container_name) aliases.add(svc.container_name);
     if (svc.hostname) aliases.add(svc.hostname);
-    addAliases(graph, serviceId4, aliases);
+    addAliases(graph, serviceId5, aliases);
   }
 }
 var LABEL_KEYS = /* @__PURE__ */ new Set([
@@ -6943,13 +6981,13 @@ function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
 function bucketEdges(graph) {
-  const buckets = /* @__PURE__ */ new Map();
+  const buckets2 = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
     const parsed = (0, import_types26.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
     const key = bucketKey(e.source, e.target, e.type);
-    const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
+    const cur = buckets2.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
       case import_types26.Provenance.EXTRACTED:
         cur.extracted = e;
@@ -6963,9 +7001,9 @@ function bucketEdges(graph) {
       default:
         if (e.provenance === import_types26.Provenance.STALE) cur.stale = e;
     }
-    buckets.set(key, cur);
+    buckets2.set(key, cur);
   });
-  return buckets;
+  return buckets2;
 }
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
@@ -7156,8 +7194,8 @@ function suppressHostMismatchHalves(all) {
 }
 function computeDivergences(graph, opts = {}) {
   const all = [];
-  const buckets = bucketEdges(graph);
-  for (const bucket of buckets.values()) {
+  const buckets2 = bucketEdges(graph);
+  for (const bucket of buckets2.values()) {
     for (const d of detectMissingDivergences(graph, bucket)) all.push(d);
   }
   graph.forEachNode((nodeId, attrs) => {
@@ -7456,8 +7494,8 @@ function formatIncompat(inc) {
 
 // src/watch.ts
 init_cjs_shims();
-var import_node_fs30 = __toESM(require("fs"), 1);
-var import_node_path49 = __toESM(require("path"), 1);
+var import_node_fs31 = __toESM(require("fs"), 1);
+var import_node_path50 = __toESM(require("path"), 1);
 var import_chokidar = __toESM(require("chokidar"), 1);
 
 // src/api.ts
@@ -7781,6 +7819,51 @@ async function rollbackExtension(ctx, args) {
   };
 }
 
+// src/logs-store.ts
+init_cjs_shims();
+var LOGS_STORE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LOGS_QUERY_DEFAULT_LIMIT = 100;
+var LOGS_QUERY_MAX_LIMIT = 1e3;
+var buffers = /* @__PURE__ */ new Map();
+var KEY_SEP = "::";
+function bufferKey(projectName, source) {
+  return `${projectName}${KEY_SEP}${source}`;
+}
+function sourcesForProject(projectName) {
+  const prefix = `${projectName}${KEY_SEP}`;
+  const sources = [];
+  for (const key of buffers.keys()) {
+    if (key.startsWith(prefix)) sources.push(key.slice(prefix.length));
+  }
+  return sources;
+}
+function queryLogEntries(opts) {
+  const { projectName, source, service, since, limit } = opts;
+  const sources = source && source.length > 0 ? source : sourcesForProject(projectName);
+  let merged = [];
+  for (const src of sources) {
+    const buf = buffers.get(bufferKey(projectName, src));
+    if (buf) merged = merged.concat(buf);
+  }
+  if (service) {
+    merged = merged.filter((e) => e.serviceName === service);
+  }
+  if (since) {
+    const sinceMs = Date.parse(since);
+    if (!Number.isNaN(sinceMs)) {
+      merged = merged.filter((e) => {
+        const t = Date.parse(e.timestamp);
+        return Number.isNaN(t) || t >= sinceMs;
+      });
+    }
+  }
+  merged.sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp));
+  if (typeof limit === "number" && Number.isFinite(limit) && limit >= 0) {
+    return merged.slice(0, limit);
+  }
+  return merged;
+}
+
 // src/diff.ts
 init_cjs_shims();
 var import_node_fs25 = require("fs");
@@ -8556,6 +8639,23 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  scope.get("/logs", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const rawSource = req.query.source;
+    const sources = rawSource === void 0 ? void 0 : Array.isArray(rawSource) ? rawSource : [rawSource];
+    const filtered = queryLogEntries({
+      projectName: proj.name,
+      ...sources && sources.length > 0 ? { source: sources } : {},
+      ...req.query.service ? { service: req.query.service } : {},
+      ...req.query.since ? { since: req.query.since } : {}
+    });
+    const total = filtered.length;
+    const limit = req.query.limit ? Number(req.query.limit) : LOGS_QUERY_DEFAULT_LIMIT;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, LOGS_QUERY_MAX_LIMIT) : LOGS_QUERY_DEFAULT_LIMIT;
+    const sliced = filtered.slice(0, safeLimit);
+    return { count: sliced.length, total, logs: sliced };
+  });
   const incidentHistoryHandler = async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -8651,8 +8751,16 @@ function registerRoutes(scope, ctx) {
       if (!against) {
         return reply.code(400).send({ error: "query parameter `against` is required" });
       }
+      const targetProjectName = against === "self" ? proj.name : against;
+      const targetProject = registry.get(targetProjectName);
+      if (!targetProject) {
+        return reply.code(400).send({
+          error: "unknown snapshot id \u2014 `against` must be `self` or the name of a project this server has a snapshot for",
+          against
+        });
+      }
       try {
-        const snapshot = await loadSnapshotForDiff(against);
+        const snapshot = await loadSnapshotForDiff(targetProject.paths.snapshotPath);
         return computeGraphDiff(proj.graph, snapshot);
       } catch (err) {
         return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
@@ -8682,6 +8790,13 @@ function registerRoutes(scope, ctx) {
         edgeCount: proj.graph.size
       };
     } catch (err) {
+      if (err instanceof SnapshotValidationError) {
+        return reply.code(400).send({
+          error: "snapshot merge failed",
+          details: err.message,
+          issues: err.issues
+        });
+      }
       return reply.code(400).send({
         error: "snapshot merge failed",
         details: err.message
@@ -9028,164 +9143,1779 @@ init_otel();
 
 // src/daemon.ts
 init_cjs_shims();
-var import_node_fs28 = require("fs");
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_fs29 = require("fs");
+var import_node_path48 = __toESM(require("path"), 1);
 var import_node_module = require("module");
 init_otel();
 
 // src/connectors/index.ts
 init_cjs_shims();
 
-// src/daemon.ts
-init_auth();
-
-// src/unrouted.ts
+// src/connectors/registry.ts
 init_cjs_shims();
-var import_node_fs27 = require("fs");
-var import_node_path46 = __toESM(require("path"), 1);
 
-// src/daemon.ts
-var import_types31 = require("@neat.is/types");
-function daemonJsonPath(scanPath) {
-  return import_node_path47.default.join(scanPath, "neat-out", "daemon.json");
-}
-function daemonsDiscoveryDir(home) {
-  const base = home && home.length > 0 ? home : neatHomeFromEnv();
-  return import_node_path47.default.join(base, "daemons");
+// src/connectors/junction.ts
+init_cjs_shims();
+var buckets = /* @__PURE__ */ new Map();
+function bucketMapKey(provider, accountKey) {
+  return `${provider}\0${accountKey}`;
+}
+function getBucket(provider, accountKey, config) {
+  const key = bucketMapKey(provider, accountKey);
+  const existing = buckets.get(key);
+  if (existing && existing.capacity === config.capacity && existing.refillMs === config.refillMs) {
+    return existing;
+  }
+  const fresh = { ...config, tokens: config.capacity, updatedAt: Date.now() };
+  buckets.set(key, fresh);
+  return fresh;
+}
+function refillBucket(bucket, now) {
+  if (now <= bucket.updatedAt) return;
+  const elapsed = now - bucket.updatedAt;
+  const grant = elapsed / bucket.refillMs;
+  if (grant <= 0) return;
+  bucket.tokens = Math.min(bucket.capacity, bucket.tokens + grant);
+  bucket.updatedAt = now;
+}
+var RateLimitExceededError = class extends Error {
+  constructor(provider, accountKey) {
+    super(
+      `junction: rate limit exceeded for ${provider}:${accountKey} \u2014 waiting for the next token would exceed this call's wall-clock budget`
+    );
+    this.name = "RateLimitExceededError";
+  }
+};
+function delay(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    if (typeof timer.unref === "function") timer.unref();
+  });
 }
-function daemonDiscoveryPath(project, home) {
-  return import_node_path47.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+async function acquireToken(provider, accountKey, config, remainingBudgetMs) {
+  const bucket = getBucket(provider, accountKey, config);
+  refillBucket(bucket, Date.now());
+  if (bucket.tokens >= 1) {
+    bucket.tokens -= 1;
+    return 0;
+  }
+  const waitMs = Math.ceil((1 - bucket.tokens) * bucket.refillMs);
+  if (waitMs > remainingBudgetMs) {
+    throw new RateLimitExceededError(provider, accountKey);
+  }
+  await delay(waitMs);
+  refillBucket(bucket, Date.now());
+  bucket.tokens = Math.max(0, bucket.tokens - 1);
+  return waitMs;
+}
+var JUNCTION_DEFAULT_RATE_LIMITS = {
+  // ~300 requests / 5 minutes (ADR-131). Burst capacity holds a third of
+  // that ceiling; steady-state refill (1 token / 3s = 20/min = 100/5min)
+  // stays well clear of the documented limit even under sustained polling.
+  cloudflare: { capacity: 100, refillMs: 3e3 },
+  // Placeholder pending a live project confirming the real cap
+  // (docs/connectors/railway.md: "does not appear to publish one as of this
+  // writing").
+  railway: { capacity: 30, refillMs: 1e4 },
+  // Placeholder pending a live rate-limit check (docs/connectors/
+  // firebase.md: "needs-endpoint-testing against entries.list's live rate
+  // limits").
+  firebase: { capacity: 30, refillMs: 1e4 },
+  // Placeholder pending a live rate-limit check (docs/connectors/supabase.md:
+  // "the documented rate limit for this specific endpoint is unconfirmed").
+  supabase: { capacity: 30, refillMs: 1e4 },
+  // Not a documented API limit at all — a self-imposed ceiling on the raw
+  // pg_stat_statements connection (see module header above).
+  "supabase-postgres": { capacity: 20, refillMs: 3e3 }
+};
+var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
+function defaultRateLimitFor(provider) {
+  return JUNCTION_DEFAULT_RATE_LIMITS[provider] ?? JUNCTION_GENERIC_RATE_LIMIT;
+}
+var JUNCTION_DEFAULT_TIMEOUT_MS = 1e4;
+var JUNCTION_DEFAULT_MAX_ATTEMPTS = 3;
+var JUNCTION_DEFAULT_INITIAL_BACKOFF_MS = 200;
+var JUNCTION_DEFAULT_BACKOFF_MULTIPLIER = 4;
+var JUNCTION_DEFAULT_MAX_ELAPSED_MS = 3e4;
+var JUNCTION_DEFAULT_DB_TIMEOUT_MS = 1e4;
+async function backoff(attempt, initialBackoffMs, backoffMultiplier, remainingBudgetMs) {
+  const raw = initialBackoffMs * backoffMultiplier ** (attempt - 1);
+  const capped = Math.max(0, Math.min(raw, remainingBudgetMs));
+  await delay(capped);
+}
+function safeUrlLabel(url) {
+  try {
+    const u = typeof url === "string" ? new URL(url) : url;
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return String(url);
+  }
 }
-function sanitizeDiscoveryName(project) {
-  return project.replace(/[^A-Za-z0-9._-]/g, "_");
+function logOutcome(provider, accountKey, outcome, method, label, attempt, startedAt) {
+  const elapsedMs = Date.now() - startedAt;
+  const line = `[neat connector] ${provider}:${accountKey} ${method} ${label} \u2014 ${outcome} (attempt ${attempt}, ${elapsedMs}ms)`;
+  if (outcome === "success" || outcome === "retried-then-succeeded") {
+    console.log(line);
+  } else if (outcome === "rate-limited") {
+    console.warn(line);
+  } else {
+    console.error(line);
+  }
 }
-function neatHomeFromEnv() {
-  const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path47.default.resolve(env);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path47.default.join(home, ".neat");
+function bearerAuthHeader(token) {
+  return { Authorization: `Bearer ${token}` };
 }
-async function readDaemonRecord(scanPath) {
-  try {
-    const raw = await import_node_fs28.promises.readFile(daemonJsonPath(scanPath), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
-      return parsed;
+async function junctionFetch(url, init = {}, policy) {
+  const {
+    provider,
+    accountKey,
+    timeoutMs = JUNCTION_DEFAULT_TIMEOUT_MS,
+    maxAttempts = JUNCTION_DEFAULT_MAX_ATTEMPTS,
+    maxElapsedMs = JUNCTION_DEFAULT_MAX_ELAPSED_MS,
+    initialBackoffMs = JUNCTION_DEFAULT_INITIAL_BACKOFF_MS,
+    backoffMultiplier = JUNCTION_DEFAULT_BACKOFF_MULTIPLIER,
+    rateLimit = defaultRateLimitFor(provider),
+    fetchImpl = fetch
+  } = policy;
+  const method = (init.method ?? "GET").toUpperCase();
+  const label = safeUrlLabel(url);
+  const startedAt = Date.now();
+  let attempt = 0;
+  let sawRetry = false;
+  for (; ; ) {
+    attempt++;
+    const remainingBudget = maxElapsedMs - (Date.now() - startedAt);
+    if (remainingBudget <= 0) {
+      logOutcome(provider, accountKey, "retried-then-failed", method, label, attempt - 1, startedAt);
+      throw new Error(
+        `junction: ${provider}:${accountKey} ${method} ${label} exceeded its wall-clock budget (${maxElapsedMs}ms) after ${attempt - 1} attempt(s)`
+      );
+    }
+    try {
+      await acquireToken(provider, accountKey, rateLimit, remainingBudget);
+    } catch (err) {
+      if (err instanceof RateLimitExceededError) {
+        logOutcome(provider, accountKey, "rate-limited", method, label, attempt, startedAt);
+      }
+      throw err;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    try {
+      const res = await fetchImpl(url, { ...init, signal: controller.signal });
+      clearTimeout(timer);
+      if (res.ok || res.status < 500) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-succeeded" : "success", method, label, attempt, startedAt);
+        return res;
+      }
+      if (attempt >= maxAttempts) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", method, label, attempt, startedAt);
+        return res;
+      }
+      sawRetry = true;
+      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
+    } catch (err) {
+      clearTimeout(timer);
+      if (attempt >= maxAttempts) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", method, label, attempt, startedAt);
+        throw err;
+      }
+      sawRetry = true;
+      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
     }
-    return null;
-  } catch {
-    return null;
   }
 }
-function resolveNeatVersion() {
-  if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
-    return process.env.NEAT_LOCAL_VERSION;
+var DbJunctionTimeoutError = class extends Error {
+  constructor(ms) {
+    super(`junction: db query exceeded its ${ms}ms timeout`);
+    this.name = "DbJunctionTimeoutError";
   }
-  try {
-    const req = (0, import_node_module.createRequire)(importMetaUrl);
-    const pkg = req("../package.json");
-    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
-  } catch {
-    return "0.0.0";
+};
+function withTimeout(run, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new DbJunctionTimeoutError(timeoutMs)), timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+    run().then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+var RETRYABLE_NODE_ERROR_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EHOSTUNREACH", "EAI_AGAIN", "EPIPE"]);
+function isRetryableDbError(err) {
+  if (err instanceof DbJunctionTimeoutError) return true;
+  const code = err?.code;
+  if (typeof code !== "string") return false;
+  if (code.startsWith("08") || code === "57P03") return true;
+  return RETRYABLE_NODE_ERROR_CODES.has(code);
+}
+async function dbJunction(run, policy) {
+  const {
+    provider,
+    accountKey,
+    timeoutMs = JUNCTION_DEFAULT_DB_TIMEOUT_MS,
+    maxAttempts = JUNCTION_DEFAULT_MAX_ATTEMPTS,
+    maxElapsedMs = JUNCTION_DEFAULT_MAX_ELAPSED_MS,
+    initialBackoffMs = JUNCTION_DEFAULT_INITIAL_BACKOFF_MS,
+    backoffMultiplier = JUNCTION_DEFAULT_BACKOFF_MULTIPLIER,
+    rateLimit = defaultRateLimitFor(provider)
+  } = policy;
+  const startedAt = Date.now();
+  let attempt = 0;
+  let sawRetry = false;
+  for (; ; ) {
+    attempt++;
+    const remainingBudget = maxElapsedMs - (Date.now() - startedAt);
+    if (remainingBudget <= 0) {
+      logOutcome(provider, accountKey, "retried-then-failed", "QUERY", "db", attempt - 1, startedAt);
+      throw new Error(
+        `junction: ${provider}:${accountKey} db query exceeded its wall-clock budget (${maxElapsedMs}ms) after ${attempt - 1} attempt(s)`
+      );
+    }
+    try {
+      await acquireToken(provider, accountKey, rateLimit, remainingBudget);
+    } catch (err) {
+      if (err instanceof RateLimitExceededError) {
+        logOutcome(provider, accountKey, "rate-limited", "QUERY", "db", attempt, startedAt);
+      }
+      throw err;
+    }
+    try {
+      const result = await withTimeout(run, timeoutMs);
+      logOutcome(provider, accountKey, sawRetry ? "retried-then-succeeded" : "success", "QUERY", "db", attempt, startedAt);
+      return result;
+    } catch (err) {
+      if (!isRetryableDbError(err) || attempt >= maxAttempts) {
+        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", "QUERY", "db", attempt, startedAt);
+        throw err;
+      }
+      sawRetry = true;
+      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
+    }
   }
 }
-async function writeDaemonRecord(record, home) {
-  const body = JSON.stringify(record, null, 2) + "\n";
-  await writeAtomically(daemonJsonPath(record.projectPath), body);
-  try {
-    await writeAtomically(daemonDiscoveryPath(record.project, home), body);
-  } catch (err) {
-    console.warn(
-      `neatd: could not write discovery copy for "${record.project}" \u2014 ${err.message}`
-    );
+
+// src/connectors/supabase/index.ts
+init_cjs_shims();
+
+// src/connectors/supabase/client.ts
+init_cjs_shims();
+var DEFAULT_SUPABASE_MANAGEMENT_API_URL = "https://api.supabase.com";
+var DEFAULT_LOG_LIMIT = 1e3;
+var SUPABASE_LOG_QUERY_MAX_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function boundedSupabaseLogWindow(since, now, maxLookbackMs) {
+  const window = Math.min(maxLookbackMs, SUPABASE_LOG_QUERY_MAX_WINDOW_MS);
+  const floor = new Date(now.getTime() - window);
+  const endIso = now.toISOString();
+  if (!since) return { startIso: floor.toISOString(), endIso, truncated: false };
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return { startIso: floor.toISOString(), endIso, truncated: false };
+  if (sinceMs < floor.getTime()) return { startIso: floor.toISOString(), endIso, truncated: true };
+  return { startIso: new Date(sinceMs).toISOString(), endIso, truncated: false };
+}
+function buildEdgeLogsQuery(limit) {
+  const safeLimit = Math.max(1, Math.trunc(limit) || DEFAULT_LOG_LIMIT);
+  return [
+    "select",
+    "  format_timestamp('%Y-%m-%dT%H:%M:%E6SZ', timestamp) as timestamp,",
+    "  request.method as method,",
+    "  request.path as path,",
+    "  response.status_code as status_code",
+    "from edge_logs",
+    "cross join unnest(metadata) as metadata",
+    "cross join unnest(metadata.request) as request",
+    "cross join unnest(metadata.response) as response",
+    "where regexp_contains(request.path, '^/rest/v1/')",
+    "order by timestamp asc",
+    `limit ${safeLimit}`
+  ].join("\n");
+}
+async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl = fetch) {
+  const baseUrl = config.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
+  const url = new URL(`${baseUrl}/v1/projects/${config.apiProjectRef}/analytics/endpoints/logs.all`);
+  url.searchParams.set("sql", buildEdgeLogsQuery(config.logLimit ?? DEFAULT_LOG_LIMIT));
+  url.searchParams.set("iso_timestamp_start", startIso);
+  url.searchParams.set("iso_timestamp_end", endIso);
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: bearerAuthHeader(token) },
+    // accountKey: the Supabase project ref (ADR-131's own worked example) —
+    // the Management API's rate limit is enforced per project.
+    { provider: "supabase", accountKey: config.apiProjectRef, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(`supabase connector: logs.all request failed (${res.status} ${res.statusText})`);
+  }
+  const body = await res.json();
+  if (body.error) {
+    const message = typeof body.error === "string" ? body.error : body.error.message;
+    throw new Error(`supabase connector: logs.all returned an error (${message})`);
   }
+  return body.result ?? [];
 }
-async function clearDaemonRecord(record, home) {
-  try {
-    const stopped = { ...record, status: "stopped" };
-    await writeAtomically(daemonJsonPath(record.projectPath), JSON.stringify(stopped, null, 2) + "\n");
-  } catch {
+
+// src/connectors/supabase/map.ts
+init_cjs_shims();
+
+// src/connectors/supabase/types.ts
+init_cjs_shims();
+function readSupabaseCredentials(raw) {
+  const managementToken = raw["managementToken"];
+  if (typeof managementToken !== "string" || managementToken.length === 0) {
+    throw new Error("supabase connector: credentials.managementToken must be a non-empty string");
   }
-  try {
-    await import_node_fs28.promises.unlink(daemonDiscoveryPath(record.project, home));
-  } catch {
+  const postgresConnectionString = raw["postgresConnectionString"];
+  if (postgresConnectionString !== void 0 && (typeof postgresConnectionString !== "string" || postgresConnectionString.length === 0)) {
+    throw new Error(
+      "supabase connector: credentials.postgresConnectionString must be a non-empty string when present"
+    );
   }
+  return {
+    managementToken,
+    ...postgresConnectionString ? { postgresConnectionString } : {}
+  };
 }
-function portFromListenAddress(address, fallback) {
-  try {
-    const port = new URL(address).port;
-    const n = Number.parseInt(port, 10);
-    if (Number.isFinite(n) && n > 0) return n;
-  } catch {
+var SUPABASE_TABLE_TARGET_KIND = "supabase-table";
+var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
+
+// src/connectors/supabase/map.ts
+var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
+var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
+function targetFromRestPath(path57) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path57);
+  if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
+  const tableMatch = REST_TABLE_PATH_RE.exec(path57);
+  if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
+  return null;
+}
+var ERROR_STATUS_THRESHOLD = 500;
+function mapEdgeLogRowsToSignals(rows) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const target = targetFromRestPath(row.path);
+    if (!target) continue;
+    const key = `${target.targetKind}:${target.name}`;
+    const isError = row.status_code >= ERROR_STATUS_THRESHOLD;
+    const existing = buckets2.get(key);
+    if (existing) {
+      existing.callCount += 1;
+      if (isError) existing.errorCount += 1;
+      if (row.timestamp > existing.lastObservedIso) existing.lastObservedIso = row.timestamp;
+    } else {
+      buckets2.set(key, {
+        targetKind: target.targetKind,
+        targetName: target.name,
+        callCount: 1,
+        errorCount: isError ? 1 : 0,
+        lastObservedIso: row.timestamp
+      });
+    }
   }
-  return fallback;
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso
+  }));
 }
-function resolveHost(opts, authTokenSet) {
-  if (opts.host && opts.host.length > 0) return opts.host;
-  const env = process.env.HOST;
-  if (env && env.length > 0) return env;
-  if (!authTokenSet) return "127.0.0.1";
-  return "0.0.0.0";
+var FROM_TABLE_RE = /\bfrom\s+"?(?:[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i;
+var SYSTEM_SCHEMA_PREFIXES = ["pg_", "information_schema"];
+function tableNameFromQueryText(query) {
+  const match = FROM_TABLE_RE.exec(query);
+  if (!match) return null;
+  const name = match[1];
+  const lower = name.toLowerCase();
+  if (SYSTEM_SCHEMA_PREFIXES.some((prefix) => lower.startsWith(prefix))) return null;
+  return name;
+}
+function diffPgStatStatementsToSignals(rows, previous, nowIso2) {
+  const signals = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    seen.add(row.queryid);
+    const calls = Number(row.calls);
+    const prior = previous.get(row.queryid);
+    previous.set(row.queryid, { calls });
+    if (!prior || calls < prior.calls) continue;
+    const delta = calls - prior.calls;
+    if (delta <= 0) continue;
+    const table = tableNameFromQueryText(row.query);
+    if (!table) continue;
+    signals.push({
+      targetKind: SUPABASE_TABLE_TARGET_KIND,
+      targetName: table,
+      callCount: delta,
+      errorCount: 0,
+      lastObservedIso: nowIso2
+    });
+  }
+  for (const queryid of [...previous.keys()]) {
+    if (!seen.has(queryid)) previous.delete(queryid);
+  }
+  return signals;
 }
 
-// src/watch.ts
-init_otel_grpc();
-
-// src/search.ts
+// src/connectors/supabase/postgres-client.ts
 init_cjs_shims();
-var import_node_fs29 = require("fs");
-var import_node_path48 = __toESM(require("path"), 1);
-var import_node_crypto3 = require("crypto");
-var DEFAULT_LIMIT = 10;
-var NOMIC_DIM = 768;
-var MINI_LM_DIM = 384;
-function shouldEmbed(node) {
-  return node.type !== "FrontierNode";
+var import_pg = __toESM(require("pg"), 1);
+var { Client } = import_pg.default;
+var DEFAULT_STATEMENT_LIMIT = 500;
+var STATEMENTS_QUERY = `
+  select queryid, query, calls, total_exec_time, rows
+  from pg_stat_statements
+  where query ~* '^\\s*select\\b'
+  order by calls desc
+  limit $1
+`;
+async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT_LIMIT, accountKey = "unknown", clientFactory = (cs) => new Client({ connectionString: cs })) {
+  return dbJunction(
+    async () => {
+      const client = clientFactory(connectionString);
+      await client.connect();
+      try {
+        await client.query("SET default_transaction_read_only = on");
+        const result = await client.query(STATEMENTS_QUERY, [limit]);
+        return result.rows;
+      } finally {
+        await client.end();
+      }
+    },
+    { provider: "supabase-postgres", accountKey }
+  );
 }
-function embedText(node) {
-  const parts = [node.id];
-  const name = node.name;
-  if (name) parts.push(name);
-  switch (node.type) {
-    case "ServiceNode": {
-      const lang = node.language;
-      if (lang) parts.push(`language=${lang}`);
-      break;
-    }
-    case "DatabaseNode": {
-      const eng = node.engine;
-      const ver = node.engineVersion;
-      if (eng) parts.push(`engine=${eng}`);
-      if (ver) parts.push(`engineVersion=${ver}`);
-      break;
-    }
-    case "InfraNode": {
-      const kind = node.kind;
-      if (kind) parts.push(`kind=${kind}`);
-      break;
+
+// src/connectors/supabase/resolve.ts
+init_cjs_shims();
+var import_types32 = require("@neat.is/types");
+function createSupabaseResolveTarget(graph, config) {
+  return (signal, _ctx) => {
+    if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
+      return null;
     }
-    case "ConfigNode": {
-      const filePath = node.path;
-      if (filePath) parts.push(`path=${filePath}`);
-      break;
+    const subResourceId = (0, import_types32.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    if (graph.hasNode(subResourceId)) {
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types32.EdgeType.CALLS };
     }
-    case "RouteNode": {
-      const method = node.method;
-      const tmpl = node.pathTemplate;
-      if (method) parts.push(`method=${method}`);
-      if (tmpl) parts.push(`path=${tmpl}`);
-      break;
+    const projectLevelId = (0, import_types32.infraId)("supabase", config.nodeRef);
+    if (graph.hasNode(projectLevelId)) {
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types32.EdgeType.CALLS };
     }
-    case "GraphQLOperationNode": {
-      const opType = node.operationType;
-      if (opType) parts.push(`operationType=${opType}`);
-      break;
+    return null;
+  };
+}
+
+// src/connectors/supabase/index.ts
+var DEFAULT_MAX_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
+var SupabaseConnector = class {
+  // `deps.fetchPgStatStatements` defaults to the real Postgres-backed
+  // implementation; tests override it to exercise the "both surfaces
+  // combine" and "surface 2 only runs when a connection string is present"
+  // behavior without a live database — the same dependency-injection seam
+  // `fetchImpl` gives cloudflare/client.ts's tests for `fetch`.
+  constructor(config, deps = {}) {
+    this.config = config;
+    this.deps = deps;
+  }
+  config;
+  deps;
+  provider = "supabase";
+  // pg_stat_statements.calls is cumulative, not per-window (map.ts's
+  // diffPgStatStatementsToSignals doc comment) — this Map carries the
+  // previous poll's counts across ticks, the same way
+  // `startConnectorPollLoop` (connectors/index.ts) carries `since` across
+  // ticks for every connector. Lives on the instance, not `ConnectorContext`,
+  // because `ConnectorContext` is rebuilt fresh per tick (connectors/index.ts's
+  // `{ ...ctx, since }`) while this connector object is the one thing every
+  // tick shares.
+  statementBaselines = /* @__PURE__ */ new Map();
+  async poll(ctx) {
+    const creds = readSupabaseCredentials(ctx.credentials);
+    const now = /* @__PURE__ */ new Date();
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS;
+    const { startIso, endIso } = boundedSupabaseLogWindow(ctx.since, now, maxLookbackMs);
+    const logRows = await fetchSupabaseEdgeLogs(this.config, creds.managementToken, startIso, endIso);
+    const signals = mapEdgeLogRowsToSignals(logRows);
+    if (creds.postgresConnectionString) {
+      const fetchStatements = this.deps.fetchPgStatStatements ?? fetchPgStatStatements;
+      const statementRows = await fetchStatements(
+        creds.postgresConnectionString,
+        this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
+        this.config.apiProjectRef
+      );
+      signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
     }
-    case "GrpcMethodNode": {
-      const rpcService = node.rpcService;
-      const rpcMethod = node.rpcMethod;
-      if (rpcService) parts.push(`rpcService=${rpcService}`);
-      if (rpcMethod) parts.push(`rpcMethod=${rpcMethod}`);
+    return signals;
+  }
+};
+function createSupabaseConnector(graph, config, deps = {}) {
+  return {
+    connector: new SupabaseConnector(config, deps),
+    resolveTarget: createSupabaseResolveTarget(graph, config)
+  };
+}
+
+// src/connectors/railway/index.ts
+init_cjs_shims();
+var import_types36 = require("@neat.is/types");
+
+// src/connectors/railway/client.ts
+init_cjs_shims();
+var DEFAULT_RAILWAY_API_URL = "https://backboard.railway.com/graphql/v2";
+var DEFAULT_MAX_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_LOG_LIMIT2 = 1e3;
+function readRailwayToken(credentials) {
+  const token = credentials.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error(
+      "Railway connector requires ctx.credentials.token (a Project-Access-Token or account Bearer token)"
+    );
+  }
+  return token;
+}
+async function railwayGraphQL(apiUrl, token, query, variables, accountKey) {
+  const res = await junctionFetch(
+    apiUrl,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        // docs.railway.com/integrations/api/graphql-overview confirms
+        // `Authorization: Bearer <token>` for an account/workspace token;
+        // Railway also documents a dedicated `Project-Access-Token: <token>`
+        // header for the project-scoped token ADR-127 targets specifically.
+        // This connector sends the Bearer form — needs-endpoint-testing
+        // whether a live Project-Access-Token requires the dedicated header
+        // instead once this poller runs against a real project.
+        ...bearerAuthHeader(token)
+      },
+      body: JSON.stringify({ query, variables })
+    },
+    { provider: "railway", accountKey }
+  );
+  if (!res.ok) {
+    throw new Error(`Railway GraphQL request failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  if (body.errors && body.errors.length > 0) {
+    throw new Error(`Railway GraphQL errors: ${body.errors.map((e) => e.message).join("; ")}`);
+  }
+  if (!body.data) throw new Error("Railway GraphQL response carried no data");
+  return body.data;
+}
+var HTTP_LOGS_QUERY = `
+  query HttpLogs(
+    $environmentId: String!
+    $serviceId: String!
+    $startDate: String!
+    $endDate: String!
+    $limit: Int
+  ) {
+    httpLogs(
+      environmentId: $environmentId
+      serviceId: $serviceId
+      startDate: $startDate
+      endDate: $endDate
+      limit: $limit
+    ) {
+      timestamp
+      method
+      path
+      httpStatus
+      totalDuration
+      requestId
+      deploymentId
+      edgeRegion
+    }
+  }
+`;
+var NETWORK_FLOW_LOGS_QUERY = `
+  query NetworkFlowLogs(
+    $environmentId: String!
+    $serviceId: String!
+    $startDate: String!
+    $endDate: String!
+    $limit: Int
+  ) {
+    networkFlowLogs(
+      environmentId: $environmentId
+      serviceId: $serviceId
+      startDate: $startDate
+      endDate: $endDate
+      limit: $limit
+    ) {
+      timestamp
+      peerServiceId
+      peerKind
+      direction
+      byteCount
+      packetCount
+      dropCause
+    }
+  }
+`;
+async function fetchRailwayHttpLogs(config, token, startDate, endDate) {
+  const data = await railwayGraphQL(
+    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+    token,
+    HTTP_LOGS_QUERY,
+    {
+      environmentId: config.environmentId,
+      serviceId: config.serviceId,
+      startDate,
+      endDate,
+      limit: config.limit ?? DEFAULT_LOG_LIMIT2
+    },
+    config.environmentId
+  );
+  return data.httpLogs;
+}
+async function fetchRailwayNetworkFlowLogs(config, token, startDate, endDate) {
+  const data = await railwayGraphQL(
+    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+    token,
+    NETWORK_FLOW_LOGS_QUERY,
+    {
+      environmentId: config.environmentId,
+      serviceId: config.serviceId,
+      startDate,
+      endDate,
+      limit: config.limit ?? DEFAULT_LOG_LIMIT2
+    },
+    config.environmentId
+  );
+  return data.networkFlowLogs;
+}
+function boundedRailwayStartDate(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+
+// src/connectors/railway/index.ts
+var ROUTE_TARGET_KIND = "route";
+var UNMATCHED_ROUTE_TARGET_KIND = "unmatched-route";
+var PEER_SERVICE_TARGET_KIND = "peer-service";
+function buildRailwayRouteIndex(graph, serviceName) {
+  const out = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== import_types36.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    out.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id,
+      path: route.path,
+      line: route.line
+    });
+  });
+  return out;
+}
+function findRailwayRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function bucketKey2(method, normalizedPath) {
+  return `${method} ${normalizedPath}`;
+}
+function isHttpErrorStatus(status2) {
+  return status2 >= 400;
+}
+function upsertBucket(buckets2, key, isError, timestamp, build) {
+  const existing = buckets2.get(key);
+  if (existing) {
+    existing.callCount += 1;
+    if (isError) existing.errorCount += 1;
+    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
+    return;
+  }
+  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
+}
+function mapRailwayHttpLogsToSignals(entries, routeIndex) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const entry2 of entries) {
+    const method = entry2.method.toUpperCase();
+    const normalizedPath = normalizePathTemplate(entry2.path);
+    const match = findRailwayRoute(routeIndex, method, normalizedPath);
+    const isError = isHttpErrorStatus(entry2.httpStatus);
+    if (match) {
+      upsertBucket(buckets2, `route:${match.routeNodeId}`, isError, entry2.timestamp, () => ({
+        targetKind: ROUTE_TARGET_KIND,
+        targetName: match.routeNodeId,
+        // RouteNode.line is optional in the schema (packages/types/src/
+        // nodes.ts) even though routes.ts always sets it today — skip the
+        // callSite rather than fabricate a line when it's ever absent
+        // (file-awareness.md §6).
+        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
+      }));
+    } else {
+      upsertBucket(
+        buckets2,
+        `unmatched:${bucketKey2(method, normalizedPath)}`,
+        isError,
+        entry2.timestamp,
+        () => ({
+          targetKind: UNMATCHED_ROUTE_TARGET_KIND,
+          targetName: bucketKey2(method, normalizedPath)
+        })
+      );
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso,
+    ...b.callSite ? { callSite: b.callSite } : {}
+  }));
+}
+function mapRailwayNetworkFlowLogsToSignals(entries) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  for (const entry2 of entries) {
+    if (!entry2.peerServiceId) continue;
+    const isError = entry2.dropCause !== null && entry2.dropCause !== "";
+    upsertBucket(buckets2, entry2.peerServiceId, isError, entry2.timestamp, () => ({
+      targetKind: PEER_SERVICE_TARGET_KIND,
+      targetName: entry2.peerServiceId
+    }));
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso
+  }));
+}
+function createRailwayResolveTarget(config) {
+  return (signal) => {
+    const serviceName = config.serviceNameById[config.serviceId];
+    if (!serviceName) return null;
+    if (signal.targetKind === ROUTE_TARGET_KIND) {
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types36.EdgeType.CALLS };
+    }
+    if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
+      const peerName = config.serviceNameById[signal.targetName];
+      if (!peerName) return null;
+      return { targetNodeId: (0, import_types36.serviceId)(peerName), serviceName, edgeType: import_types36.EdgeType.CONNECTS_TO };
+    }
+    return null;
+  };
+}
+function createRailwayConnector(graph, config) {
+  return {
+    provider: "railway",
+    async poll(ctx) {
+      const token = readRailwayToken(ctx.credentials);
+      const now = /* @__PURE__ */ new Date();
+      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS2;
+      const startDate = boundedRailwayStartDate(ctx.since, now, maxLookbackMs);
+      const endDate = now.toISOString();
+      const [httpLogs, flowLogs] = await Promise.all([
+        fetchRailwayHttpLogs(config, token, startDate, endDate),
+        fetchRailwayNetworkFlowLogs(config, token, startDate, endDate)
+      ]);
+      const serviceName = config.serviceNameById[config.serviceId];
+      const routeIndex = serviceName ? buildRailwayRouteIndex(graph, serviceName) : [];
+      return [
+        ...mapRailwayHttpLogsToSignals(httpLogs, routeIndex),
+        ...mapRailwayNetworkFlowLogsToSignals(flowLogs)
+      ];
+    }
+  };
+}
+
+// src/connectors/firebase/index.ts
+init_cjs_shims();
+
+// src/connectors/firebase/logging-api.ts
+init_cjs_shims();
+function readFirebaseCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("firebase connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("firebase connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var RESOURCE_TYPES = [
+  "cloud_function",
+  "cloud_run_revision",
+  "firebase_domain"
+];
+function isFirebaseResourceType(value) {
+  return RESOURCE_TYPES.includes(value);
+}
+function buildEntriesFilter(sinceIso) {
+  return [
+    'resource.type = ("cloud_function" OR "cloud_run_revision" OR "firebase_domain")',
+    "httpRequest:*",
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var DEFAULT_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE = 1e3;
+var MAX_PAGES = 20;
+async function fetchHttpRequestLogEntries(creds, sinceIso) {
+  const filter = buildEntriesFilter(sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      ENTRIES_LIST_URL,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id (ADR-131's own worked example for
+      // Firebase) — one customer's Cloud Logging quota is scoped per GCP
+      // project, not per Firebase site/function.
+      { provider: "firebase", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    out.push(...json.entries ?? []);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/firebase/map.ts
+init_cjs_shims();
+var FIELD_SEP = "\0";
+function packFirebaseTargetName(identity) {
+  return [identity.resourceName, identity.method, identity.path].join(FIELD_SEP);
+}
+function parseFirebaseTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP);
+  if (firstSep === -1) return null;
+  const resourceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path57 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path57) return null;
+  return { resourceName, method, path: path57 };
+}
+function resourceNameFor(type, labels) {
+  if (!labels) return null;
+  switch (type) {
+    case "cloud_function":
+      return labels["function_name"] ?? null;
+    case "cloud_run_revision":
+      return labels["service_name"] ?? null;
+    case "firebase_domain":
+      return labels["site_name"] ?? null;
+  }
+}
+function pathFromRequestUrl(requestUrl) {
+  if (!requestUrl) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD2 = 500;
+function mapLogEntryToSignal(entry2) {
+  const resourceType = entry2.resource?.type;
+  if (!resourceType || !isFirebaseResourceType(resourceType)) return null;
+  const resourceName = resourceNameFor(resourceType, entry2.resource?.labels);
+  if (!resourceName) return null;
+  const req = entry2.httpRequest;
+  if (!req) return null;
+  if (!req.requestMethod) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path57 = pathFromRequestUrl(req.requestUrl);
+  if (path57 === null) return null;
+  const timestamp = entry2.timestamp;
+  if (!timestamp) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
+  return {
+    targetKind: resourceType,
+    targetName: packFirebaseTargetName({ resourceName, method, path: path57 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals(entries) {
+  const out = [];
+  for (const entry2 of entries) {
+    const signal = mapLogEntryToSignal(entry2);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/firebase/resolve.ts
+init_cjs_shims();
+var import_types37 = require("@neat.is/types");
+function neatServiceNameFor(resourceType, resourceName, serviceMap) {
+  switch (resourceType) {
+    case "cloud_function":
+      return serviceMap.functions?.[resourceName] ?? null;
+    case "cloud_run_revision":
+      return serviceMap.cloudRun?.[resourceName] ?? null;
+    case "firebase_domain":
+      return serviceMap.hosting?.[resourceName] ?? null;
+  }
+}
+function routeEntriesFor(graph, serviceName) {
+  const entries = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== import_types37.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    entries.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id
+    });
+  });
+  return entries;
+}
+function findRoute2(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function createFirebaseResolveTarget(graph, serviceMap) {
+  return (signal, _ctx) => {
+    const resourceType = signal.targetKind;
+    if (resourceType !== "cloud_function" && resourceType !== "cloud_run_revision" && resourceType !== "firebase_domain") {
+      return null;
+    }
+    const identity = parseFirebaseTargetName(signal.targetName);
+    if (!identity) return null;
+    const serviceName = neatServiceNameFor(resourceType, identity.resourceName, serviceMap);
+    if (!serviceName) return null;
+    const normalizedPath = normalizePathTemplate(identity.path);
+    const match = findRoute2(routeEntriesFor(graph, serviceName), identity.method, normalizedPath);
+    if (!match) return null;
+    return {
+      targetNodeId: match.routeNodeId,
+      serviceName,
+      edgeType: import_types37.EdgeType.CALLS
+    };
+  };
+}
+
+// src/connectors/firebase/index.ts
+var FirebaseConnector = class {
+  provider = "firebase";
+  async poll(ctx) {
+    const creds = readFirebaseCredentials(ctx.credentials);
+    const sinceIso = ctx.since ?? new Date(Date.now() - DEFAULT_LOOKBACK_MS).toISOString();
+    const entries = await fetchHttpRequestLogEntries(creds, sinceIso);
+    return mapLogEntriesToSignals(entries);
+  }
+};
+function createFirebaseConnector(graph, serviceMap) {
+  return {
+    connector: new FirebaseConnector(),
+    resolveTarget: createFirebaseResolveTarget(graph, serviceMap)
+  };
+}
+
+// src/connectors/cloudflare/index.ts
+init_cjs_shims();
+
+// src/connectors/cloudflare/connector.ts
+init_cjs_shims();
+var import_types39 = require("@neat.is/types");
+
+// src/connectors/cloudflare/client.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
+var DEFAULT_EVENT_LIMIT = 1e3;
+async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
+  const token = ctx.credentials.apiToken;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("cloudflare connector: ctx.credentials.apiToken must be a non-empty string");
+  }
+  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL;
+  const url = `${baseUrl}/accounts/${config.accountId}/workers/observability/telemetry/query`;
+  const body = {
+    // Cloudflare's schema requires an identifier per query even for an
+    // ad-hoc, unsaved one — a fresh id per tick, never reused.
+    queryId: `neat-connector-${(0, import_node_crypto3.randomUUID)()}`,
+    timeframe: { from: window.fromMs, to: window.toMs },
+    view: "events",
+    limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
+    // Execute without persisting — this is a read, not a saved query
+    // (connectors.md §2's "never writes on the read path" applies to
+    // Cloudflare's own query-history state too).
+    dry: true
+  };
+  const res = await junctionFetch(
+    url,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...bearerAuthHeader(token)
+      },
+      body: JSON.stringify(body)
+    },
+    // accountKey: the Cloudflare account id (ADR-131's own worked example) —
+    // the Telemetry Query API's ~300/5min limit is enforced per account.
+    { provider: "cloudflare", accountKey: config.accountId, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(
+      `cloudflare connector: telemetry query failed (${res.status} ${res.statusText})`
+    );
+  }
+  const payload = await res.json();
+  if (!payload.success) {
+    const message = payload.errors?.map((e) => e.message).join("; ") || "unknown error";
+    throw new Error(`cloudflare connector: telemetry query returned an error (${message})`);
+  }
+  return payload.result?.events?.events ?? [];
+}
+
+// src/connectors/cloudflare/map.ts
+init_cjs_shims();
+
+// src/connectors/cloudflare/types.ts
+init_cjs_shims();
+var CLOUDFLARE_TARGET_KIND = "cloudflare-worker-invocation";
+
+// src/connectors/cloudflare/map.ts
+var HTTP_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "TRACE",
+  "CONNECT"
+]);
+var LEADING_TOKEN_RE = /^(\S+)\s+\S/;
+function parseHttpMethodFromTrigger(trigger) {
+  if (!trigger) return null;
+  const match = LEADING_TOKEN_RE.exec(trigger.trim());
+  const token = match?.[1];
+  if (!token) return null;
+  const method = token.toUpperCase();
+  return HTTP_METHODS.has(method) ? method : null;
+}
+var ERROR_STATUS_THRESHOLD3 = 500;
+function mapEventToSignal(event) {
+  const metadata = event.$metadata;
+  const workers = event.$workers;
+  const method = parseHttpMethodFromTrigger(metadata?.trigger);
+  if (!method) return null;
+  const scriptName = workers?.scriptName ?? metadata?.service;
+  if (!scriptName) return null;
+  const timestampMs = event.timestamp ?? metadata?.startTime;
+  if (typeof timestampMs !== "number" || !Number.isFinite(timestampMs)) return null;
+  const statusCode = metadata?.statusCode;
+  const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
+  return {
+    targetKind: CLOUDFLARE_TARGET_KIND,
+    targetName: scriptName,
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: new Date(timestampMs).toISOString(),
+    method,
+    ...typeof statusCode === "number" ? { statusCode } : {},
+    ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
+  };
+}
+
+// src/connectors/cloudflare/connector.ts
+var DEFAULT_MAX_LOOKBACK_MS3 = 60 * 60 * 1e3;
+function resolveFromMs(since, maxLookbackMs) {
+  const cap = maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS3;
+  const now = Date.now();
+  const floor = now - cap;
+  if (!since) return floor;
+  const parsed = Date.parse(since);
+  if (Number.isNaN(parsed)) return floor;
+  return Math.max(parsed, floor);
+}
+var CloudflareConnector = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  provider = "cloudflare";
+  async poll(ctx) {
+    const toMs = Date.now();
+    const fromMs = resolveFromMs(ctx.since, this.config.maxLookbackMs);
+    const events = await queryWorkerInvocations(ctx, this.config, { fromMs, toMs });
+    const signals = [];
+    for (const event of events) {
+      const signal = mapEventToSignal(event);
+      if (signal) signals.push(signal);
+    }
+    return signals;
+  }
+};
+function createCloudflareResolveTarget(config) {
+  return (signal) => {
+    if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
+    const mapping = config.workers[signal.targetName];
+    if (!mapping) return null;
+    return {
+      targetNodeId: (0, import_types39.fileId)(mapping.service, mapping.entryFile),
+      serviceName: mapping.service,
+      edgeType: import_types39.EdgeType.CALLS
+    };
+  };
+}
+
+// src/connectors-config.ts
+init_cjs_shims();
+var import_node_os4 = __toESM(require("os"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
+var import_node_fs27 = require("fs");
+var CONNECTORS_CONFIG_VERSION = 1;
+var EnvRefUnsetError = class extends Error {
+  ref;
+  varName;
+  constructor(ref, varName) {
+    super(`${ref} is unset`);
+    this.name = "EnvRefUnsetError";
+    this.ref = ref;
+    this.varName = varName;
+  }
+};
+function neatHome2() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path46.default.resolve(override);
+  return import_node_path46.default.join(import_node_os4.default.homedir(), ".neat");
+}
+function connectorsConfigPath(home = neatHome2()) {
+  return import_node_path46.default.join(home, "connectors.json");
+}
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await import_node_fs27.promises.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
+      );
+    }
+  } catch {
+  }
+}
+async function readConnectorsConfig(home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  let raw;
+  try {
+    raw = await import_node_fs27.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
+    }
+    throw err;
+  }
+  await warnIfModeLooserThan0600(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig(parsed, file);
+}
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "connectors" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawConnectors = obj.connectors;
+  if (!Array.isArray(rawConnectors)) {
+    throw new Error(`${file}: "connectors" must be an array`);
+  }
+  const connectors = rawConnectors.map((entry2, i) => validateEntry(entry2, i, file));
+  return { version, connectors };
+}
+function validateEntry(entry2, index, file) {
+  const where = `${file}: connectors[${index}]`;
+  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry2;
+  const id = e.id;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error(`${where}.id must be a non-empty string`);
+  }
+  const provider = e.provider;
+  if (typeof provider !== "string" || provider.length === 0) {
+    throw new Error(`${where}.provider must be a non-empty string`);
+  }
+  if (e.project !== void 0 && typeof e.project !== "string") {
+    throw new Error(`${where}.project must be a string when present`);
+  }
+  const credential = validateCredentialRef(e.credential, `${where}.credential`);
+  let options;
+  if (e.options !== void 0) {
+    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
+      throw new Error(`${where}.options must be an object when present`);
+    }
+    options = e.options;
+  }
+  return {
+    id,
+    provider,
+    ...typeof e.project === "string" ? { project: e.project } : {},
+    credential,
+    ...options ? { options } : {}
+  };
+}
+function validateCredentialRef(raw, where) {
+  if (typeof raw === "string") {
+    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
+    return raw;
+  }
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    const fields = raw;
+    const keys = Object.keys(fields);
+    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
+    for (const key of keys) {
+      const v = fields[key];
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`${where}.${key} must be a non-empty string`);
+      }
+    }
+    return fields;
+  }
+  throw new Error(`${where} must be a string or an object of strings`);
+}
+function resolveCredential(ref, env = process.env) {
+  if (typeof ref === "string") {
+    return { kind: "single", value: resolveRef(ref, env) };
+  }
+  const fields = {};
+  for (const [key, value] of Object.entries(ref)) {
+    fields[key] = resolveRef(value, env);
+  }
+  return { kind: "fields", fields };
+}
+function resolveRef(value, env) {
+  if (value.length > 1 && value.startsWith("$")) {
+    const varName = value.slice(1);
+    const resolved = env[varName];
+    if (resolved === void 0 || resolved.length === 0) {
+      throw new EnvRefUnsetError(value, varName);
+    }
+    return resolved;
+  }
+  return value;
+}
+var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
+var CONNECTORS_LOCK_RETRY_MS = 50;
+function connectorsConfigLockPath(home = neatHome2()) {
+  return import_node_path46.default.join(home, "connectors.json.lock");
+}
+function isEnvRef(value) {
+  return value.length > 1 && value.startsWith("$");
+}
+async function writeConfigAtomically0600(file, contents) {
+  await import_node_fs27.promises.mkdir(import_node_path46.default.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await import_node_fs27.promises.open(tmp, "w", 384);
+  try {
+    await fd.writeFile(contents, "utf8");
+    await fd.chmod(384);
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await import_node_fs27.promises.rename(tmp, file);
+}
+async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  await import_node_fs27.promises.mkdir(import_node_path46.default.dirname(lockPath), { recursive: true });
+  for (; ; ) {
+    try {
+      const fd = await import_node_fs27.promises.open(lockPath, "wx");
+      try {
+        await fd.writeFile(`${process.pid}
+`, "utf8");
+      } finally {
+        await fd.close();
+      }
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `neat connector: timed out after ${timeoutMs}ms waiting for ${lockPath}. Another neat process may be writing the connector config; if none is, remove that file by hand.`
+        );
+      }
+      await new Promise((r) => setTimeout(r, CONNECTORS_LOCK_RETRY_MS));
+    }
+  }
+}
+async function releaseConnectorsLock(lockPath) {
+  await import_node_fs27.promises.unlink(lockPath).catch(() => {
+  });
+}
+async function withConnectorsLock(home, fn) {
+  const lock = connectorsConfigLockPath(home);
+  await acquireConnectorsLock(lock);
+  try {
+    return await fn();
+  } finally {
+    await releaseConnectorsLock(lock);
+  }
+}
+function serializeConfig(config) {
+  return JSON.stringify(
+    { version: config.version ?? CONNECTORS_CONFIG_VERSION, connectors: config.connectors },
+    null,
+    2
+  ) + "\n";
+}
+async function upsertConnectorEntry(entry2, home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  return withConnectorsLock(home, async () => {
+    const config = await readConnectorsConfig(home);
+    validateEntry(entry2, config.connectors.length, file);
+    const idx = config.connectors.findIndex((c) => c.id === entry2.id);
+    const replaced = idx >= 0;
+    if (replaced) config.connectors[idx] = entry2;
+    else config.connectors.push(entry2);
+    await writeConfigAtomically0600(file, serializeConfig(config));
+    return { replaced };
+  });
+}
+async function removeConnectorEntry(id, home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  return withConnectorsLock(home, async () => {
+    const config = await readConnectorsConfig(home);
+    const idx = config.connectors.findIndex((c) => c.id === id);
+    if (idx < 0) return void 0;
+    const [removed] = config.connectors.splice(idx, 1);
+    await writeConfigAtomically0600(file, serializeConfig(config));
+    return removed;
+  });
+}
+function slugFragment(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function autoSlugConnectorId(provider, project, existingIds) {
+  const base = slugFragment(provider) || "connector";
+  if (!existingIds.has(base)) return base;
+  const projectFrag = project ? slugFragment(project) : "";
+  if (projectFrag) {
+    const withProject = `${base}-${projectFrag}`;
+    if (!existingIds.has(withProject)) return withProject;
+  }
+  const stem = projectFrag ? `${base}-${projectFrag}` : base;
+  for (let n = 2; ; n++) {
+    const candidate = `${stem}-${n}`;
+    if (!existingIds.has(candidate)) return candidate;
+  }
+}
+function describeCredential(ref, env = process.env) {
+  const one = (value, field) => {
+    if (isEnvRef(value)) {
+      const varName = value.slice(1);
+      const resolved = env[varName];
+      const set = typeof resolved === "string" && resolved.length > 0;
+      return {
+        ...field ? { field } : {},
+        kind: "env-ref",
+        display: value,
+        status: set ? "set" : "unset"
+      };
+    }
+    return { ...field ? { field } : {}, kind: "plaintext", display: "****" };
+  };
+  if (typeof ref === "string") return [one(ref)];
+  return Object.entries(ref).map(([k, v]) => one(v, k));
+}
+
+// src/connectors/registry.ts
+var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
+async function authProbe(input) {
+  const { provider, accountKey, url, token, init, fetchImpl } = input;
+  try {
+    const res = await junctionFetch(
+      url,
+      {
+        ...init ?? {},
+        headers: { ...bearerAuthHeader(token), ...init?.headers ?? {} }
+      },
+      { provider, accountKey, ...fetchImpl ? { fetchImpl } : {} }
+    );
+    if (res.ok) return { ok: true };
+    if (res.status === 401 || res.status === 403) {
+      return { ok: false, reason: `${provider} rejected the credential (HTTP ${res.status})` };
+    }
+    return {
+      ok: false,
+      reason: `${provider} auth check returned HTTP ${res.status} ${res.statusText} \u2014 could not confirm the credential`
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `${provider} auth check could not reach the provider: ${err.message}`
+    };
+  }
+}
+var PROVIDER_DISPATCH = {
+  supabase: {
+    provider: "supabase",
+    primaryCredentialKey: "managementToken",
+    requiredCredentialFields: ["managementToken"],
+    requiredOptionFields: ["apiProjectRef", "nodeRef", "serviceName"],
+    build(graph, options) {
+      return createSupabaseConnector(graph, options);
+    },
+    // GET /v1/projects — the Management API's own auth-gated list endpoint, the
+    // cheapest confirmation the management token is live (the same surface
+    // client.ts polls, minus the heavy log query).
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
+      return authProbe({
+        provider: "supabase",
+        accountKey: cfg.apiProjectRef ?? "validate",
+        url: `${baseUrl}/v1/projects`,
+        token: String(credentials.managementToken ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  railway: {
+    provider: "railway",
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token"],
+    requiredOptionFields: ["environmentId", "serviceId", "serviceNameById"],
+    build(graph, options) {
+      const config = options;
+      return {
+        connector: createRailwayConnector(graph, config),
+        resolveTarget: createRailwayResolveTarget(config)
+      };
+    },
+    // A minimal GraphQL POST — Railway's gateway 401s an unauthenticated call
+    // at the HTTP layer, so a 2xx confirms the token was accepted regardless of
+    // the query's own shape (the connector's real queries are still
+    // needs-endpoint-testing per railway/types.ts — auth is what we check).
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      return authProbe({
+        provider: "railway",
+        accountKey: cfg.environmentId ?? "validate",
+        url: cfg.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+        token: String(credentials.token ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ query: "{ __typename }" })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  firebase: {
+    provider: "firebase",
+    // Firebase reads both projectId and accessToken from the credential; the
+    // single-string form maps to the secret, and the required-fields check
+    // below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createFirebaseConnector(graph, options);
+    },
+    // GET the project's Cloud Logging log-name list (pageSize 1) — within the
+    // same `roles/logging.viewer` grant the connector polls under, and the
+    // lightest call that still fails 401/403 on a bad or wrong-scoped token.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "firebase",
+        accountKey: projectId || "validate",
+        url: `https://logging.googleapis.com/v2/projects/${projectId}/logs?pageSize=1`,
+        token: String(credentials.accessToken ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  cloudflare: {
+    provider: "cloudflare",
+    primaryCredentialKey: "apiToken",
+    requiredCredentialFields: ["apiToken"],
+    requiredOptionFields: ["accountId", "workers"],
+    build(_graph, options) {
+      const config = options;
+      return {
+        connector: new CloudflareConnector(config),
+        resolveTarget: createCloudflareResolveTarget(config)
+      };
+    },
+    // GET /user/tokens/verify — Cloudflare's own purpose-built "is this API
+    // token live" endpoint. 200 on a valid token, 401 on an invalid one.
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.baseUrl ?? CLOUDFLARE_API_BASE_URL;
+      return authProbe({
+        provider: "cloudflare",
+        accountKey: cfg.accountId ?? "validate",
+        url: `${baseUrl}/user/tokens/verify`,
+        token: String(credentials.apiToken ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  }
+};
+function getProviderDispatch(provider) {
+  return PROVIDER_DISPATCH[provider];
+}
+function resolveEntryCredentials(dispatch, entry2, env) {
+  let credentials;
+  try {
+    const resolved = resolveCredential(entry2.credential, env);
+    credentials = resolved.kind === "single" ? { [dispatch.primaryCredentialKey]: resolved.value } : { ...resolved.fields };
+  } catch (err) {
+    if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
+    return { ok: false, kind: "error", reason: err.message };
+  }
+  const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
+  if (missingCreds.length > 0) {
+    return {
+      ok: false,
+      kind: "missing-field",
+      reason: `credential missing required field(s): ${missingCreds.join(", ")}`
+    };
+  }
+  return { ok: true, credentials };
+}
+async function validateConnectorEntry(entry2, env = process.env, fetchImpl) {
+  const dispatch = PROVIDER_DISPATCH[entry2.provider];
+  if (!dispatch) {
+    return { status: "unknown-provider", reason: `unknown provider "${entry2.provider}"` };
+  }
+  const creds = resolveEntryCredentials(dispatch, entry2, env);
+  if (!creds.ok) {
+    if (creds.kind === "unset-env") return { status: "unset-env", reason: creds.reason };
+    return { status: "missing-field", reason: creds.reason };
+  }
+  const options = entry2.options ?? {};
+  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
+  if (missingOpts.length > 0) {
+    return {
+      status: "missing-field",
+      reason: `options missing required field(s): ${missingOpts.join(", ")}`
+    };
+  }
+  const result = await dispatch.validate({
+    credentials: creds.credentials,
+    options,
+    ...fetchImpl ? { fetchImpl } : {}
+  });
+  return result.ok ? { status: "ok" } : { status: "rejected", reason: result.reason };
+}
+
+// src/daemon.ts
+init_auth();
+
+// src/unrouted.ts
+init_cjs_shims();
+var import_node_fs28 = require("fs");
+var import_node_path47 = __toESM(require("path"), 1);
+
+// src/daemon.ts
+var import_types42 = require("@neat.is/types");
+function daemonJsonPath(scanPath) {
+  return import_node_path48.default.join(scanPath, "neat-out", "daemon.json");
+}
+function daemonsDiscoveryDir(home) {
+  const base = home && home.length > 0 ? home : neatHomeFromEnv();
+  return import_node_path48.default.join(base, "daemons");
+}
+function daemonDiscoveryPath(project, home) {
+  return import_node_path48.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+}
+function sanitizeDiscoveryName(project) {
+  return project.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function neatHomeFromEnv() {
+  const env = process.env.NEAT_HOME;
+  if (env && env.length > 0) return import_node_path48.default.resolve(env);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return import_node_path48.default.join(home, ".neat");
+}
+async function readDaemonRecord(scanPath) {
+  try {
+    const raw = await import_node_fs29.promises.readFile(daemonJsonPath(scanPath), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function resolveNeatVersion() {
+  if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
+    return process.env.NEAT_LOCAL_VERSION;
+  }
+  try {
+    const req = (0, import_node_module.createRequire)(importMetaUrl);
+    const pkg = req("../package.json");
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+async function writeDaemonRecord(record, home) {
+  const body = JSON.stringify(record, null, 2) + "\n";
+  await writeAtomically(daemonJsonPath(record.projectPath), body);
+  try {
+    await writeAtomically(daemonDiscoveryPath(record.project, home), body);
+  } catch (err) {
+    console.warn(
+      `neatd: could not write discovery copy for "${record.project}" \u2014 ${err.message}`
+    );
+  }
+}
+async function clearDaemonRecord(record, home) {
+  try {
+    const stopped = { ...record, status: "stopped" };
+    await writeAtomically(daemonJsonPath(record.projectPath), JSON.stringify(stopped, null, 2) + "\n");
+  } catch {
+  }
+  try {
+    await import_node_fs29.promises.unlink(daemonDiscoveryPath(record.project, home));
+  } catch {
+  }
+}
+function portFromListenAddress(address, fallback) {
+  try {
+    const port = new URL(address).port;
+    const n = Number.parseInt(port, 10);
+    if (Number.isFinite(n) && n > 0) return n;
+  } catch {
+  }
+  return fallback;
+}
+function resolveHost(opts, authTokenSet) {
+  if (opts.host && opts.host.length > 0) return opts.host;
+  const env = process.env.HOST;
+  if (env && env.length > 0) return env;
+  if (!authTokenSet) return "127.0.0.1";
+  return "0.0.0.0";
+}
+
+// src/watch.ts
+init_otel_grpc();
+
+// src/search.ts
+init_cjs_shims();
+var import_node_fs30 = require("fs");
+var import_node_path49 = __toESM(require("path"), 1);
+var import_node_crypto4 = require("crypto");
+var DEFAULT_LIMIT = 10;
+var NOMIC_DIM = 768;
+var MINI_LM_DIM = 384;
+function shouldEmbed(node) {
+  return node.type !== "FrontierNode";
+}
+function embedText(node) {
+  const parts = [node.id];
+  const name = node.name;
+  if (name) parts.push(name);
+  switch (node.type) {
+    case "ServiceNode": {
+      const lang = node.language;
+      if (lang) parts.push(`language=${lang}`);
+      break;
+    }
+    case "DatabaseNode": {
+      const eng = node.engine;
+      const ver = node.engineVersion;
+      if (eng) parts.push(`engine=${eng}`);
+      if (ver) parts.push(`engineVersion=${ver}`);
+      break;
+    }
+    case "InfraNode": {
+      const kind = node.kind;
+      if (kind) parts.push(`kind=${kind}`);
+      break;
+    }
+    case "ConfigNode": {
+      const filePath = node.path;
+      if (filePath) parts.push(`path=${filePath}`);
+      break;
+    }
+    case "RouteNode": {
+      const method = node.method;
+      const tmpl = node.pathTemplate;
+      if (method) parts.push(`method=${method}`);
+      if (tmpl) parts.push(`path=${tmpl}`);
+      break;
+    }
+    case "GraphQLOperationNode": {
+      const opType = node.operationType;
+      if (opType) parts.push(`operationType=${opType}`);
+      break;
+    }
+    case "GrpcMethodNode": {
+      const rpcService = node.rpcService;
+      const rpcMethod = node.rpcMethod;
+      if (rpcService) parts.push(`rpcService=${rpcService}`);
+      if (rpcMethod) parts.push(`rpcMethod=${rpcMethod}`);
       break;
     }
     case "WebSocketChannelNode": {
@@ -9199,7 +10929,7 @@ function embedText(node) {
   return parts.join(" ");
 }
 function attrsHash(node) {
-  return (0, import_node_crypto3.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto4.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
 }
 function cosine(a, b) {
   if (a.length !== b.length) return 0;
@@ -9288,7 +11018,7 @@ async function pickEmbedder() {
 }
 async function readCache(cachePath) {
   try {
-    const raw = await import_node_fs29.promises.readFile(cachePath, "utf8");
+    const raw = await import_node_fs30.promises.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     return parsed;
@@ -9297,8 +11027,8 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  await import_node_fs29.promises.mkdir(import_node_path48.default.dirname(cachePath), { recursive: true });
-  await import_node_fs29.promises.writeFile(cachePath, JSON.stringify(cache));
+  await import_node_fs30.promises.mkdir(import_node_path49.default.dirname(cachePath), { recursive: true });
+  await import_node_fs30.promises.writeFile(cachePath, JSON.stringify(cache));
 }
 var VectorIndex = class {
   constructor(embedder, cachePath) {
@@ -9455,8 +11185,8 @@ var ALL_PHASES = [
 ];
 function classifyChange(relPath) {
   const phases = /* @__PURE__ */ new Set();
-  const base = import_node_path49.default.basename(relPath).toLowerCase();
-  const segments = relPath.split(import_node_path49.default.sep).map((s) => s.toLowerCase());
+  const base = import_node_path50.default.basename(relPath).toLowerCase();
+  const segments = relPath.split(import_node_path50.default.sep).map((s) => s.toLowerCase());
   if (base === "package.json" || base === "requirements.txt" || base === "pyproject.toml" || base === "setup.py") {
     phases.add("services");
     phases.add("aliases");
@@ -9577,16 +11307,16 @@ function countWatchableDirs(scanPath, limit) {
     if (count >= limit) return;
     let entries;
     try {
-      entries = import_node_fs30.default.readdirSync(dir, { withFileTypes: true });
+      entries = import_node_fs31.default.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e of entries) {
       if (count >= limit) return;
       if (!e.isDirectory()) continue;
-      if (IGNORED_WATCH_PATHS.some((re) => re.test(import_node_path49.default.join(dir, e.name) + import_node_path49.default.sep))) continue;
+      if (IGNORED_WATCH_PATHS.some((re) => re.test(import_node_path50.default.join(dir, e.name) + import_node_path50.default.sep))) continue;
       count++;
-      if (depth < 2) visit(import_node_path49.default.join(dir, e.name), depth + 1);
+      if (depth < 2) visit(import_node_path50.default.join(dir, e.name), depth + 1);
     }
   };
   visit(scanPath, 0);
@@ -9604,8 +11334,8 @@ async function startWatch(graph, opts) {
   const projectName = opts.project ?? DEFAULT_PROJECT;
   await loadGraphFromDisk(graph, opts.outPath);
   const detachEventBus = attachGraphToEventBus(graph, { project: projectName });
-  const policyFilePath = import_node_path49.default.join(opts.scanPath, "policy.json");
-  const policyViolationsPath = import_node_path49.default.join(import_node_path49.default.dirname(opts.outPath), "policy-violations.ndjson");
+  const policyFilePath = import_node_path50.default.join(opts.scanPath, "policy.json");
+  const policyViolationsPath = import_node_path50.default.join(import_node_path50.default.dirname(opts.outPath), "policy-violations.ndjson");
   let policies = [];
   try {
     policies = await loadPolicyFile(policyFilePath);
@@ -9656,7 +11386,7 @@ async function startWatch(graph, opts) {
   assertBindAuthority(host, auth.authToken);
   const port = opts.port ?? 8080;
   const otelPort = opts.otelPort ?? 4318;
-  const cachePath = opts.embeddingsCachePath ?? import_node_path49.default.join(import_node_path49.default.dirname(opts.outPath), "embeddings.json");
+  const cachePath = opts.embeddingsCachePath ?? import_node_path50.default.join(import_node_path50.default.dirname(opts.outPath), "embeddings.json");
   let searchIndex;
   try {
     searchIndex = await buildSearchIndex(graph, { cachePath });
@@ -9674,7 +11404,7 @@ async function startWatch(graph, opts) {
       // Paths are derived from the explicit options the watch caller passes
       // — pathsForProject is only used to fill in the embeddings/snapshot
       // fields so the registry shape is complete.
-      ...pathsForProject(projectName, import_node_path49.default.dirname(opts.outPath)),
+      ...pathsForProject(projectName, import_node_path50.default.dirname(opts.outPath)),
       snapshotPath: opts.outPath,
       errorsPath: opts.errorsPath,
       staleEventsPath: opts.staleEventsPath
@@ -9792,9 +11522,9 @@ async function startWatch(graph, opts) {
   };
   const onPath = (absPath) => {
     if (shouldIgnore(absPath)) return;
-    const rel = import_node_path49.default.relative(opts.scanPath, absPath);
+    const rel = import_node_path50.default.relative(opts.scanPath, absPath);
     if (!rel || rel.startsWith("..")) return;
-    pendingPaths.add(rel.split(import_node_path49.default.sep).join("/"));
+    pendingPaths.add(rel.split(import_node_path50.default.sep).join("/"));
     const phases = classifyChange(rel);
     if (phases.size === 0) {
       for (const p of ALL_PHASES) pending.add(p);
@@ -9850,12 +11580,12 @@ async function startWatch(graph, opts) {
 
 // src/deploy/detect.ts
 init_cjs_shims();
-var import_node_fs31 = require("fs");
-var import_node_path50 = __toESM(require("path"), 1);
+var import_node_fs32 = require("fs");
+var import_node_path51 = __toESM(require("path"), 1);
 var import_node_child_process2 = require("child_process");
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 function generateToken() {
-  return (0, import_node_crypto4.randomBytes)(32).toString("base64url");
+  return (0, import_node_crypto5.randomBytes)(32).toString("base64url");
 }
 async function probeBinary(binary, arg) {
   return new Promise((resolve) => {
@@ -9951,21 +11681,21 @@ async function runDeploy(opts = {}) {
   const token = generateToken();
   switch (substrate) {
     case "docker-compose": {
-      const artifactPath = import_node_path50.default.join(cwd, "docker-compose.neat.yml");
+      const artifactPath = import_node_path51.default.join(cwd, "docker-compose.neat.yml");
       const contents = emitDockerCompose(cwd);
-      await import_node_fs31.promises.writeFile(artifactPath, contents, "utf8");
+      await import_node_fs32.promises.writeFile(artifactPath, contents, "utf8");
       return {
         substrate,
         artifactPath,
         token,
         contents,
-        startCommand: `NEAT_AUTH_TOKEN=${token} docker compose -f ${import_node_path50.default.basename(artifactPath)} up -d`
+        startCommand: `NEAT_AUTH_TOKEN=${token} docker compose -f ${import_node_path51.default.basename(artifactPath)} up -d`
       };
     }
     case "systemd": {
-      const artifactPath = import_node_path50.default.join(cwd, "neat.service");
+      const artifactPath = import_node_path51.default.join(cwd, "neat.service");
       const contents = emitSystemdUnit(cwd);
-      await import_node_fs31.promises.writeFile(artifactPath, contents, "utf8");
+      await import_node_fs32.promises.writeFile(artifactPath, contents, "utf8");
       return {
         substrate,
         artifactPath,
@@ -9998,8 +11728,8 @@ init_cjs_shims();
 
 // src/installers/javascript.ts
 init_cjs_shims();
-var import_node_fs32 = require("fs");
-var import_node_path51 = __toESM(require("path"), 1);
+var import_node_fs33 = require("fs");
+var import_node_path52 = __toESM(require("path"), 1);
 var import_semver2 = __toESM(require("semver"), 1);
 
 // src/installers/templates.ts
@@ -10614,15 +12344,15 @@ var OTEL_ENV = {
   value: "http://localhost:4318/projects/<project>/v1/traces"
 };
 function serviceNodeName(pkg, serviceDir) {
-  return pkg.name ?? import_node_path51.default.basename(serviceDir);
+  return pkg.name ?? import_node_path52.default.basename(serviceDir);
 }
 function projectToken(pkg, serviceDir, project) {
   if (project && project.length > 0) return project;
-  return pkg.name ?? import_node_path51.default.basename(serviceDir);
+  return pkg.name ?? import_node_path52.default.basename(serviceDir);
 }
 async function readJsonFile(p) {
   try {
-    const raw = await import_node_fs32.promises.readFile(p, "utf8");
+    const raw = await import_node_fs33.promises.readFile(p, "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -10631,16 +12361,16 @@ async function readJsonFile(p) {
 async function detectRuntimeKind(pkgRoot, pkg) {
   const deps = allDeps(pkg);
   if ("react-native" in deps || "expo" in deps) return "react-native";
-  const appJson = await readJsonFile(import_node_path51.default.join(pkgRoot, "app.json"));
+  const appJson = await readJsonFile(import_node_path52.default.join(pkgRoot, "app.json"));
   if (appJson && typeof appJson === "object" && "expo" in appJson) {
     return "react-native";
   }
-  if (await exists3(import_node_path51.default.join(pkgRoot, "vite.config.js")) || await exists3(import_node_path51.default.join(pkgRoot, "vite.config.ts")) || await exists3(import_node_path51.default.join(pkgRoot, "vite.config.mjs")) || "vite" in deps) {
+  if (await exists3(import_node_path52.default.join(pkgRoot, "vite.config.js")) || await exists3(import_node_path52.default.join(pkgRoot, "vite.config.ts")) || await exists3(import_node_path52.default.join(pkgRoot, "vite.config.mjs")) || "vite" in deps) {
     return "browser-bundle";
   }
-  if (await exists3(import_node_path51.default.join(pkgRoot, "wrangler.toml"))) return "cloudflare-workers";
-  if (await exists3(import_node_path51.default.join(pkgRoot, "bun.lockb"))) return "bun";
-  if (await exists3(import_node_path51.default.join(pkgRoot, "deno.json")) || await exists3(import_node_path51.default.join(pkgRoot, "deno.lock"))) {
+  if (await exists3(import_node_path52.default.join(pkgRoot, "wrangler.toml"))) return "cloudflare-workers";
+  if (await exists3(import_node_path52.default.join(pkgRoot, "bun.lockb"))) return "bun";
+  if (await exists3(import_node_path52.default.join(pkgRoot, "deno.json")) || await exists3(import_node_path52.default.join(pkgRoot, "deno.lock"))) {
     return "deno";
   }
   const engines = pkg.engines ?? {};
@@ -10649,7 +12379,7 @@ async function detectRuntimeKind(pkgRoot, pkg) {
 }
 async function readPackageJson2(serviceDir) {
   try {
-    const raw = await import_node_fs32.promises.readFile(import_node_path51.default.join(serviceDir, "package.json"), "utf8");
+    const raw = await import_node_fs33.promises.readFile(import_node_path52.default.join(serviceDir, "package.json"), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -10657,7 +12387,7 @@ async function readPackageJson2(serviceDir) {
 }
 async function exists3(p) {
   try {
-    await import_node_fs32.promises.stat(p);
+    await import_node_fs33.promises.stat(p);
     return true;
   } catch {
     return false;
@@ -10665,7 +12395,7 @@ async function exists3(p) {
 }
 async function readFileMaybe(p) {
   try {
-    return await import_node_fs32.promises.readFile(p, "utf8");
+    return await import_node_fs33.promises.readFile(p, "utf8");
   } catch {
     return null;
   }
@@ -10693,7 +12423,7 @@ function needsVersionUpgrade(installed, expected) {
 var NEXT_CONFIG_CANDIDATES = ["next.config.js", "next.config.ts", "next.config.mjs"];
 async function findNextConfig(serviceDir) {
   for (const name of NEXT_CONFIG_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, name);
+    const candidate = import_node_path52.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -10762,7 +12492,7 @@ function hasRemixDependency(pkg) {
 }
 async function findRemixEntry(serviceDir) {
   for (const rel of REMIX_ENTRY_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -10774,14 +12504,14 @@ function hasSvelteKitDependency(pkg) {
 }
 async function findSvelteKitHooks(serviceDir) {
   for (const rel of SVELTEKIT_HOOKS_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
 }
 async function findSvelteKitConfig(serviceDir) {
   for (const rel of SVELTEKIT_CONFIG_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -10792,7 +12522,7 @@ function hasNuxtDependency(pkg) {
 }
 async function findNuxtConfig(serviceDir) {
   for (const name of NUXT_CONFIG_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, name);
+    const candidate = import_node_path52.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -10803,7 +12533,7 @@ function hasAstroDependency(pkg) {
 }
 async function findAstroConfig(serviceDir) {
   for (const name of ASTRO_CONFIG_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, name);
+    const candidate = import_node_path52.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
@@ -10817,7 +12547,7 @@ function parseNextMajor(range) {
   return Number.isFinite(n) ? n : null;
 }
 async function isTypeScriptProject(serviceDir) {
-  return exists3(import_node_path51.default.join(serviceDir, "tsconfig.json"));
+  return exists3(import_node_path52.default.join(serviceDir, "tsconfig.json"));
 }
 var INDEX_EXTENSIONS = [".ts", ".tsx", ".js", ".mjs", ".cjs"];
 var INDEX_CANDIDATES = INDEX_EXTENSIONS.map((ext) => `index${ext}`);
@@ -10866,7 +12596,7 @@ function entryFromScript(script) {
 }
 async function resolveEntry(serviceDir, pkg) {
   if (typeof pkg.main === "string" && pkg.main.length > 0) {
-    const candidate = import_node_path51.default.resolve(serviceDir, pkg.main);
+    const candidate = import_node_path52.default.resolve(serviceDir, pkg.main);
     if (await exists3(candidate)) return candidate;
   }
   if (pkg.bin) {
@@ -10880,40 +12610,40 @@ async function resolveEntry(serviceDir, pkg) {
       if (typeof first === "string") binEntry = first;
     }
     if (binEntry) {
-      const candidate = import_node_path51.default.resolve(serviceDir, binEntry);
+      const candidate = import_node_path52.default.resolve(serviceDir, binEntry);
       if (await exists3(candidate)) return candidate;
     }
   }
   const startEntry = entryFromScript(pkg.scripts?.start);
   if (startEntry) {
-    const candidate = import_node_path51.default.resolve(serviceDir, startEntry);
+    const candidate = import_node_path52.default.resolve(serviceDir, startEntry);
     if (await exists3(candidate)) return candidate;
   }
   const devEntry = entryFromScript(pkg.scripts?.dev);
   if (devEntry) {
-    const candidate = import_node_path51.default.resolve(serviceDir, devEntry);
+    const candidate = import_node_path52.default.resolve(serviceDir, devEntry);
     if (await exists3(candidate)) return candidate;
   }
   for (const rel of SRC_INDEX_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   for (const rel of SRC_NAMED_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   for (const rel of ROOT_NAMED_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   for (const name of INDEX_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, name);
+    const candidate = import_node_path52.default.join(serviceDir, name);
     if (await exists3(candidate)) return candidate;
   }
   return null;
 }
 function dispatchEntry(entryFile, pkg) {
-  const ext = import_node_path51.default.extname(entryFile).toLowerCase();
+  const ext = import_node_path52.default.extname(entryFile).toLowerCase();
   if (ext === ".ts" || ext === ".tsx") return "ts";
   if (ext === ".mjs") return "esm";
   if (ext === ".cjs") return "cjs";
@@ -10930,9 +12660,9 @@ function otelInitContents(flavor) {
   return OTEL_INIT_CJS;
 }
 function injectionLine(flavor, entryFile, otelInitFile) {
-  let rel = import_node_path51.default.relative(import_node_path51.default.dirname(entryFile), otelInitFile);
+  let rel = import_node_path52.default.relative(import_node_path52.default.dirname(entryFile), otelInitFile);
   if (!rel.startsWith(".")) rel = `./${rel}`;
-  rel = rel.split(import_node_path51.default.sep).join("/");
+  rel = rel.split(import_node_path52.default.sep).join("/");
   if (flavor === "cjs") return `require('${rel}')`;
   if (flavor === "esm") return `import '${rel}'`;
   const tsRel = rel.replace(/\.ts$/, "");
@@ -10945,27 +12675,27 @@ function lineIsOtelInjection(line) {
 }
 async function detectsSrcLayout(serviceDir) {
   const [hasSrcApp, hasSrcPages, hasRootApp, hasRootPages] = await Promise.all([
-    exists3(import_node_path51.default.join(serviceDir, "src", "app")),
-    exists3(import_node_path51.default.join(serviceDir, "src", "pages")),
-    exists3(import_node_path51.default.join(serviceDir, "app")),
-    exists3(import_node_path51.default.join(serviceDir, "pages"))
+    exists3(import_node_path52.default.join(serviceDir, "src", "app")),
+    exists3(import_node_path52.default.join(serviceDir, "src", "pages")),
+    exists3(import_node_path52.default.join(serviceDir, "app")),
+    exists3(import_node_path52.default.join(serviceDir, "pages"))
   ]);
   return (hasSrcApp || hasSrcPages) && !hasRootApp && !hasRootPages;
 }
 async function planNext(serviceDir, pkg, manifestPath, nextConfigPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
   const srcLayout = await detectsSrcLayout(serviceDir);
-  const baseDir = srcLayout ? import_node_path51.default.join(serviceDir, "src") : serviceDir;
-  const instrumentationFile = import_node_path51.default.join(baseDir, useTs ? "instrumentation.ts" : "instrumentation.js");
-  const instrumentationNodeFile = import_node_path51.default.join(
+  const baseDir = srcLayout ? import_node_path52.default.join(serviceDir, "src") : serviceDir;
+  const instrumentationFile = import_node_path52.default.join(baseDir, useTs ? "instrumentation.ts" : "instrumentation.js");
+  const instrumentationNodeFile = import_node_path52.default.join(
     baseDir,
     useTs ? "instrumentation.node.ts" : "instrumentation.node.js"
   );
-  const instrumentationEdgeFile = import_node_path51.default.join(
+  const instrumentationEdgeFile = import_node_path52.default.join(
     baseDir,
     useTs ? "instrumentation.edge.ts" : "instrumentation.edge.js"
   );
-  const envNeatFile = import_node_path51.default.join(baseDir, ".env.neat");
+  const envNeatFile = import_node_path52.default.join(baseDir, ".env.neat");
   const existingDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const dependencyEdits = [];
   for (const sdk of SDK_PACKAGES) {
@@ -11042,7 +12772,7 @@ async function planNext(serviceDir, pkg, manifestPath, nextConfigPath, project)
   const nextMajor = parseNextMajor(nextRange);
   if (nextMajor !== null && nextMajor < 15) {
     try {
-      const raw = await import_node_fs32.promises.readFile(nextConfigPath, "utf8");
+      const raw = await import_node_fs33.promises.readFile(nextConfigPath, "utf8");
       if (!raw.includes("instrumentationHook")) {
         nextConfigEdit = {
           file: nextConfigPath,
@@ -11090,7 +12820,7 @@ function buildDependencyEdits(pkg, manifestPath) {
   return edits;
 }
 async function queueEnvNeat(serviceDir, pkg, project, generatedFiles) {
-  const envNeatFile = import_node_path51.default.join(serviceDir, ".env.neat");
+  const envNeatFile = import_node_path52.default.join(serviceDir, ".env.neat");
   if (!await exists3(envNeatFile)) {
     generatedFiles.push({
       file: envNeatFile,
@@ -11125,7 +12855,7 @@ function fileImportsOtelHook(raw, specifiers) {
 }
 async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelServerFile = import_node_path51.default.join(
+  const otelServerFile = import_node_path52.default.join(
     serviceDir,
     useTs ? "app/otel.server.ts" : "app/otel.server.js"
   );
@@ -11146,7 +12876,7 @@ async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
   await queueEnvNeat(serviceDir, pkg, project, generatedFiles);
   const entrypointEdits = [];
   try {
-    const raw = await import_node_fs32.promises.readFile(entryFile, "utf8");
+    const raw = await import_node_fs33.promises.readFile(entryFile, "utf8");
     if (!fileImportsOtelHook(raw, ["./otel.server"])) {
       const lines = raw.split(/\r?\n/);
       const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
@@ -11182,11 +12912,11 @@ async function planRemix(serviceDir, pkg, manifestPath, entryFile, project) {
 }
 async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelInitFile = import_node_path51.default.join(
+  const otelInitFile = import_node_path52.default.join(
     serviceDir,
     useTs ? "src/otel-init.ts" : "src/otel-init.js"
   );
-  const resolvedHooksFile = hooksFile ?? import_node_path51.default.join(serviceDir, useTs ? "src/hooks.server.ts" : "src/hooks.server.js");
+  const resolvedHooksFile = hooksFile ?? import_node_path52.default.join(serviceDir, useTs ? "src/hooks.server.ts" : "src/hooks.server.js");
   const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
   const generatedFiles = [];
   const entrypointEdits = [];
@@ -11211,7 +12941,7 @@ async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project)
     });
   } else {
     try {
-      const raw = await import_node_fs32.promises.readFile(hooksFile, "utf8");
+      const raw = await import_node_fs33.promises.readFile(hooksFile, "utf8");
       if (!fileImportsOtelHook(raw, ["./otel-init"])) {
         const lines = raw.split(/\r?\n/);
         const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
@@ -11248,11 +12978,11 @@ async function planSvelteKit(serviceDir, pkg, manifestPath, hooksFile, project)
 }
 async function planNuxt(serviceDir, pkg, manifestPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelPluginFile = import_node_path51.default.join(
+  const otelPluginFile = import_node_path52.default.join(
     serviceDir,
     useTs ? "server/plugins/otel.ts" : "server/plugins/otel.js"
   );
-  const otelInitFile = import_node_path51.default.join(
+  const otelInitFile = import_node_path52.default.join(
     serviceDir,
     useTs ? "server/plugins/otel-init.ts" : "server/plugins/otel-init.js"
   );
@@ -11303,19 +13033,19 @@ async function planNuxt(serviceDir, pkg, manifestPath, project) {
 var ASTRO_MIDDLEWARE_CANDIDATES = ["src/middleware.ts", "src/middleware.js"];
 async function findAstroMiddleware(serviceDir) {
   for (const rel of ASTRO_MIDDLEWARE_CANDIDATES) {
-    const candidate = import_node_path51.default.join(serviceDir, rel);
+    const candidate = import_node_path52.default.join(serviceDir, rel);
     if (await exists3(candidate)) return candidate;
   }
   return null;
 }
 async function planAstro(serviceDir, pkg, manifestPath, project) {
   const useTs = await isTypeScriptProject(serviceDir);
-  const otelInitFile = import_node_path51.default.join(
+  const otelInitFile = import_node_path52.default.join(
     serviceDir,
     useTs ? "src/otel-init.ts" : "src/otel-init.js"
   );
   const existingMiddleware = await findAstroMiddleware(serviceDir);
-  const middlewareFile = existingMiddleware ?? import_node_path51.default.join(serviceDir, useTs ? "src/middleware.ts" : "src/middleware.js");
+  const middlewareFile = existingMiddleware ?? import_node_path52.default.join(serviceDir, useTs ? "src/middleware.ts" : "src/middleware.js");
   const dependencyEdits = buildDependencyEdits(pkg, manifestPath);
   const generatedFiles = [];
   const entrypointEdits = [];
@@ -11340,7 +13070,7 @@ async function planAstro(serviceDir, pkg, manifestPath, project) {
     });
   } else {
     try {
-      const raw = await import_node_fs32.promises.readFile(existingMiddleware, "utf8");
+      const raw = await import_node_fs33.promises.readFile(existingMiddleware, "utf8");
       if (!fileImportsOtelHook(raw, ["./otel-init"])) {
         const lines = raw.split(/\r?\n/);
         const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
@@ -11411,7 +13141,7 @@ async function findFrameworkDispatch(serviceDir, pkg, manifestPath, project) {
 }
 async function plan(serviceDir, opts) {
   const pkg = await readPackageJson2(serviceDir);
-  const manifestPath = import_node_path51.default.join(serviceDir, "package.json");
+  const manifestPath = import_node_path52.default.join(serviceDir, "package.json");
   const project = opts?.project;
   const empty = {
     language: "javascript",
@@ -11446,8 +13176,8 @@ async function plan(serviceDir, opts) {
     return { ...empty, libOnly: true };
   }
   const flavor = dispatchEntry(entryFile, pkg);
-  const otelInitFile = import_node_path51.default.join(import_node_path51.default.dirname(entryFile), otelInitFilename(flavor));
-  const envNeatFile = import_node_path51.default.join(serviceDir, ".env.neat");
+  const otelInitFile = import_node_path52.default.join(import_node_path52.default.dirname(entryFile), otelInitFilename(flavor));
+  const envNeatFile = import_node_path52.default.join(serviceDir, ".env.neat");
   const existingDeps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   const dependencyEdits = [];
   for (const sdk of SDK_PACKAGES) {
@@ -11471,7 +13201,7 @@ async function plan(serviceDir, opts) {
   }
   const entrypointEdits = [];
   try {
-    const raw = await import_node_fs32.promises.readFile(entryFile, "utf8");
+    const raw = await import_node_fs33.promises.readFile(entryFile, "utf8");
     const lines = raw.split(/\r?\n/);
     const firstReal = lines[0]?.startsWith("#!") ? lines[1] ?? "" : lines[0] ?? "";
     if (!lineIsOtelInjection(firstReal)) {
@@ -11516,13 +13246,13 @@ async function plan(serviceDir, opts) {
   };
 }
 function isAllowedWritePath(serviceDir, target) {
-  const rel = import_node_path51.default.relative(serviceDir, target);
+  const rel = import_node_path52.default.relative(serviceDir, target);
   if (rel.startsWith("..")) return false;
-  const base = import_node_path51.default.basename(target);
+  const base = import_node_path52.default.basename(target);
   if (base === "package.json") return true;
   if (base === ".env.neat") return true;
   if (/^otel-init\.(?:js|cjs|mjs|ts)$/.test(base)) return true;
-  const relPosix = rel.split(import_node_path51.default.sep).join("/");
+  const relPosix = rel.split(import_node_path52.default.sep).join("/");
   if (/^instrumentation(?:\.(?:node|edge))?\.(?:js|cjs|mjs|ts)$/.test(base)) {
     if (relPosix === base) return true;
     if (relPosix === `src/${base}`) return true;
@@ -11539,10 +13269,10 @@ function isAllowedWritePath(serviceDir, target) {
   return false;
 }
 async function writeAtomic(file, contents) {
-  await import_node_fs32.promises.mkdir(import_node_path51.default.dirname(file), { recursive: true });
+  await import_node_fs33.promises.mkdir(import_node_path52.default.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
-  await import_node_fs32.promises.writeFile(tmp, contents, "utf8");
-  await import_node_fs32.promises.rename(tmp, file);
+  await import_node_fs33.promises.writeFile(tmp, contents, "utf8");
+  await import_node_fs33.promises.rename(tmp, file);
 }
 async function apply(installPlan) {
   const { serviceDir } = installPlan;
@@ -11618,7 +13348,7 @@ async function apply(installPlan) {
   for (const target of allTargets) {
     if (await exists3(target)) {
       try {
-        originals.set(target, await import_node_fs32.promises.readFile(target, "utf8"));
+        originals.set(target, await import_node_fs33.promises.readFile(target, "utf8"));
       } catch {
       }
     }
@@ -11701,14 +13431,14 @@ async function rollback(installPlan, originals, createdFiles) {
   const removed = [];
   for (const [file, raw] of originals.entries()) {
     try {
-      await import_node_fs32.promises.writeFile(file, raw, "utf8");
+      await import_node_fs33.promises.writeFile(file, raw, "utf8");
       restored.push(file);
     } catch {
     }
   }
   for (const file of createdFiles) {
     try {
-      await import_node_fs32.promises.unlink(file);
+      await import_node_fs33.promises.unlink(file);
       removed.push(file);
     } catch {
     }
@@ -11723,8 +13453,8 @@ async function rollback(installPlan, originals, createdFiles) {
     ...removed.map((f) => `removed:  ${f}`),
     ""
   ];
-  const rollbackPath = import_node_path51.default.join(installPlan.serviceDir, "neat-rollback.patch");
-  await import_node_fs32.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
+  const rollbackPath = import_node_path52.default.join(installPlan.serviceDir, "neat-rollback.patch");
+  await import_node_fs33.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
 }
 function injectInstrumentationHook(raw) {
   if (raw.includes("instrumentationHook")) return raw;
@@ -11753,8 +13483,8 @@ var javascriptInstaller = {
 
 // src/installers/python.ts
 init_cjs_shims();
-var import_node_fs33 = require("fs");
-var import_node_path52 = __toESM(require("path"), 1);
+var import_node_fs34 = require("fs");
+var import_node_path53 = __toESM(require("path"), 1);
 var SDK_PACKAGES2 = [
   { name: "opentelemetry-distro", version: ">=0.49b0" },
   { name: "opentelemetry-exporter-otlp", version: ">=1.28.0" }
@@ -11766,7 +13496,7 @@ var OTEL_ENV2 = {
 };
 async function exists4(p) {
   try {
-    await import_node_fs33.promises.stat(p);
+    await import_node_fs34.promises.stat(p);
     return true;
   } catch {
     return false;
@@ -11775,7 +13505,7 @@ async function exists4(p) {
 async function detect2(serviceDir) {
   const markers = ["requirements.txt", "pyproject.toml", "setup.py"];
   for (const m of markers) {
-    if (await exists4(import_node_path52.default.join(serviceDir, m))) return true;
+    if (await exists4(import_node_path53.default.join(serviceDir, m))) return true;
   }
   return false;
 }
@@ -11785,9 +13515,9 @@ function reqPackageName(line) {
   return head.replace(/[<>=!~].*$/, "").toLowerCase();
 }
 async function planRequirementsTxtEdits(serviceDir) {
-  const file = import_node_path52.default.join(serviceDir, "requirements.txt");
+  const file = import_node_path53.default.join(serviceDir, "requirements.txt");
   if (!await exists4(file)) return null;
-  const raw = await import_node_fs33.promises.readFile(file, "utf8");
+  const raw = await import_node_fs34.promises.readFile(file, "utf8");
   const presentNames = new Set(
     raw.split(/\r?\n/).map(reqPackageName).filter((n) => n.length > 0)
   );
@@ -11795,9 +13525,9 @@ async function planRequirementsTxtEdits(serviceDir) {
   return { manifest: file, missing: [...missing] };
 }
 async function planProcfileEdits(serviceDir) {
-  const procfile = import_node_path52.default.join(serviceDir, "Procfile");
+  const procfile = import_node_path53.default.join(serviceDir, "Procfile");
   if (!await exists4(procfile)) return [];
-  const raw = await import_node_fs33.promises.readFile(procfile, "utf8");
+  const raw = await import_node_fs34.promises.readFile(procfile, "utf8");
   const edits = [];
   for (const line of raw.split(/\r?\n/)) {
     if (line.length === 0) continue;
@@ -11849,8 +13579,8 @@ async function applyRequirementsTxt(manifest, edits, original) {
   const next = `${original}${trailing}${newlines.join("\n")}
 `;
   const tmp = `${manifest}.${process.pid}.${Date.now()}.tmp`;
-  await import_node_fs33.promises.writeFile(tmp, next, "utf8");
-  await import_node_fs33.promises.rename(tmp, manifest);
+  await import_node_fs34.promises.writeFile(tmp, next, "utf8");
+  await import_node_fs34.promises.rename(tmp, manifest);
 }
 async function applyProcfile(procfile, edits, original) {
   let next = original;
@@ -11859,8 +13589,8 @@ async function applyProcfile(procfile, edits, original) {
     next = next.replace(e.before, e.after);
   }
   const tmp = `${procfile}.${process.pid}.${Date.now()}.tmp`;
-  await import_node_fs33.promises.writeFile(tmp, next, "utf8");
-  await import_node_fs33.promises.rename(tmp, procfile);
+  await import_node_fs34.promises.writeFile(tmp, next, "utf8");
+  await import_node_fs34.promises.rename(tmp, procfile);
 }
 async function apply2(installPlan) {
   const { serviceDir } = installPlan;
@@ -11873,7 +13603,7 @@ async function apply2(installPlan) {
   const originals = /* @__PURE__ */ new Map();
   for (const file of touched) {
     try {
-      originals.set(file, await import_node_fs33.promises.readFile(file, "utf8"));
+      originals.set(file, await import_node_fs34.promises.readFile(file, "utf8"));
     } catch {
     }
   }
@@ -11884,7 +13614,7 @@ async function apply2(installPlan) {
       if (raw === void 0) {
         throw new Error(`python installer: cannot read ${file} during apply`);
       }
-      const base = import_node_path52.default.basename(file);
+      const base = import_node_path53.default.basename(file);
       if (base === "requirements.txt") {
         const edits = installPlan.dependencyEdits.filter((e) => e.file === file);
         if (edits.length > 0) {
@@ -11909,7 +13639,7 @@ async function rollback2(installPlan, originals) {
   const restored = [];
   for (const [file, raw] of originals.entries()) {
     try {
-      await import_node_fs33.promises.writeFile(file, raw, "utf8");
+      await import_node_fs34.promises.writeFile(file, raw, "utf8");
       restored.push(file);
     } catch {
     }
@@ -11923,8 +13653,8 @@ async function rollback2(installPlan, originals) {
     ...restored.map((f) => `restored: ${f}`),
     ""
   ];
-  const rollbackPath = import_node_path52.default.join(installPlan.serviceDir, "neat-rollback.patch");
-  await import_node_fs33.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
+  const rollbackPath = import_node_path53.default.join(installPlan.serviceDir, "neat-rollback.patch");
+  await import_node_fs34.promises.writeFile(rollbackPath, lines.join("\n"), "utf8");
 }
 var pythonInstaller = {
   name: "python",
@@ -12047,10 +13777,10 @@ function renderPatch(sections) {
 
 // src/orchestrator.ts
 init_cjs_shims();
-var import_node_fs34 = require("fs");
+var import_node_fs35 = require("fs");
 var import_node_http = __toESM(require("http"), 1);
 var import_node_net = __toESM(require("net"), 1);
-var import_node_path53 = __toESM(require("path"), 1);
+var import_node_path54 = __toESM(require("path"), 1);
 var import_node_child_process3 = require("child_process");
 var import_node_readline = __toESM(require("readline"), 1);
 async function extractAndPersist(opts) {
@@ -12059,7 +13789,7 @@ async function extractAndPersist(opts) {
   const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
   resetGraph(graphKey);
   const graph = getGraph(graphKey);
-  const projectPaths = pathsForProject(graphKey, import_node_path53.default.join(opts.scanPath, "neat-out"));
+  const projectPaths = pathsForProject(graphKey, import_node_path54.default.join(opts.scanPath, "neat-out"));
   const extraction = await extractFromDirectory(graph, opts.scanPath, {
     errorsPath: projectPaths.errorsPath
   });
@@ -12111,7 +13841,7 @@ async function applyInstallersOver(services, project, options = {}) {
       libOnly++;
       const appDeps = svc.pkg ? appFrameworkDependencies(svc.pkg) : [];
       if (appDeps.length > 0) {
-        const svcName = import_node_path53.default.basename(svc.dir);
+        const svcName = import_node_path54.default.basename(svc.dir);
         const list = appDeps.join(", ");
         console.warn(
           `neat: runtime layer won't engage for ${svcName}: no entry point found.
@@ -12124,7 +13854,7 @@ async function applyInstallersOver(services, project, options = {}) {
       console.log(`skipping ${svc.dir}: browser bundle; browser-OTel support lands in a future release.`);
     } else if (outcome.outcome === "react-native") {
       reactNative++;
-      const svcName = import_node_path53.default.basename(svc.dir);
+      const svcName = import_node_path54.default.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as React Native / Expo
   The installer doesn't cover this runtime deterministically.
@@ -12135,7 +13865,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "bun") {
       bun++;
-      const svcName = import_node_path53.default.basename(svc.dir);
+      const svcName = import_node_path54.default.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Bun
   The installer doesn't cover this runtime deterministically.
@@ -12146,7 +13876,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "deno") {
       deno++;
-      const svcName = import_node_path53.default.basename(svc.dir);
+      const svcName = import_node_path54.default.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Deno
   The installer doesn't cover this runtime deterministically.
@@ -12157,7 +13887,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "cloudflare-workers") {
       cloudflareWorkers++;
-      const svcName = import_node_path53.default.basename(svc.dir);
+      const svcName = import_node_path54.default.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Cloudflare Workers
   The installer doesn't cover this runtime deterministically.
@@ -12168,7 +13898,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "electron") {
       electron++;
-      const svcName = import_node_path53.default.basename(svc.dir);
+      const svcName = import_node_path54.default.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Electron
   The installer doesn't cover this runtime deterministically.
@@ -12181,7 +13911,7 @@ async function applyInstallersOver(services, project, options = {}) {
     if (svc.pkg && (outcome.outcome === "instrumented" || outcome.outcome === "already-instrumented")) {
       const gaps = uninstrumentedLibraries(svc.pkg);
       if (gaps.length > 0) {
-        const svcName = import_node_path53.default.basename(svc.dir);
+        const svcName = import_node_path54.default.basename(svc.dir);
         const list = gaps.join(", ");
         const subject = gaps.length === 1 ? "this library" : "these libraries";
         const aux = gaps.length === 1 ? "isn't" : "aren't";
@@ -12387,24 +14117,24 @@ async function persistedPortsFor(scanPath) {
   return { rest: record.ports.rest, otlp: record.ports.otlp, web: record.ports.web };
 }
 async function acquireSpawnLock(scanPath) {
-  const lockPath = import_node_path53.default.join(scanPath, "neat-out", "daemon.spawn.lock");
-  await import_node_fs34.promises.mkdir(import_node_path53.default.dirname(lockPath), { recursive: true });
+  const lockPath = import_node_path54.default.join(scanPath, "neat-out", "daemon.spawn.lock");
+  await import_node_fs35.promises.mkdir(import_node_path54.default.dirname(lockPath), { recursive: true });
   const STALE_LOCK_MS = 6e4;
   try {
-    const fd = await import_node_fs34.promises.open(lockPath, "wx");
+    const fd = await import_node_fs35.promises.open(lockPath, "wx");
     await fd.writeFile(`${process.pid}
 `, "utf8");
     await fd.close();
     return async () => {
-      await import_node_fs34.promises.unlink(lockPath).catch(() => {
+      await import_node_fs35.promises.unlink(lockPath).catch(() => {
       });
     };
   } catch (err) {
     if (err.code !== "EEXIST") return null;
     try {
-      const stat = await import_node_fs34.promises.stat(lockPath);
+      const stat = await import_node_fs35.promises.stat(lockPath);
       if (Date.now() - stat.mtimeMs > STALE_LOCK_MS) {
-        await import_node_fs34.promises.unlink(lockPath).catch(() => {
+        await import_node_fs35.promises.unlink(lockPath).catch(() => {
         });
         return acquireSpawnLock(scanPath);
       }
@@ -12433,13 +14163,13 @@ async function healthIsForProject(restPort, project) {
   return false;
 }
 function daemonLogPath(projectPath2) {
-  return import_node_path53.default.join(projectPath2, "neat-out", "daemon.log");
+  return import_node_path54.default.join(projectPath2, "neat-out", "daemon.log");
 }
 function spawnDaemonDetached(spec) {
-  const here = import_node_path53.default.dirname(new URL(importMetaUrl).pathname);
+  const here = import_node_path54.default.dirname(new URL(importMetaUrl).pathname);
   const candidates = [
-    import_node_path53.default.join(here, "neatd.cjs"),
-    import_node_path53.default.join(here, "neatd.js")
+    import_node_path54.default.join(here, "neatd.cjs"),
+    import_node_path54.default.join(here, "neatd.js")
   ];
   let entry2 = null;
   const fsSync = require("fs");
@@ -12469,7 +14199,7 @@ function spawnDaemonDetached(spec) {
   let logFd = null;
   if (spec) {
     const logPath = daemonLogPath(spec.projectPath);
-    fsSync.mkdirSync(import_node_path53.default.dirname(logPath), { recursive: true });
+    fsSync.mkdirSync(import_node_path54.default.dirname(logPath), { recursive: true });
     logFd = fsSync.openSync(logPath, "a");
   }
   const child = (0, import_node_child_process3.spawn)(process.execPath, [entry2, "start"], {
@@ -12508,7 +14238,7 @@ async function runOrchestrator(opts) {
       browser: "skipped"
     }
   };
-  const stat = await import_node_fs34.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs35.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat: ${opts.scanPath} is not a directory`);
     result.exitCode = 2;
@@ -12668,7 +14398,7 @@ async function runOrchestrator(opts) {
     result.steps.browser = openBrowser(dashboardUrl);
   }
   const daemonRunning = result.steps.daemon === "spawned" || result.steps.daemon === "already-running";
-  const daemonLog = daemonRunning ? import_node_path53.default.relative(opts.scanPath, daemonLogPath(opts.scanPath)) : null;
+  const daemonLog = daemonRunning ? import_node_path54.default.relative(opts.scanPath, daemonLogPath(opts.scanPath)) : null;
   printSummary(result, graph, dashboardUrl, daemonLog);
   return result;
 }
@@ -12704,13 +14434,343 @@ function printSummary(result, graph, dashboardUrl, daemonLog) {
   }
 }
 
+// src/connector-cli.ts
+init_cjs_shims();
+var import_node_readline2 = __toESM(require("readline"), 1);
+async function defaultPrompt(question) {
+  if (!process.stdin.isTTY) return "";
+  const rl = import_node_readline2.default.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await new Promise((resolve) => rl.question(`${question} `, resolve));
+  } finally {
+    rl.close();
+  }
+}
+function resolveDeps(deps) {
+  return {
+    home: deps.home,
+    env: deps.env ?? process.env,
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+    prompt: deps.prompt ?? defaultPrompt,
+    interactive: deps.interactive ?? Boolean(process.stdin.isTTY),
+    out: deps.out ?? ((l) => console.log(l)),
+    err: deps.err ?? ((l) => console.error(l))
+  };
+}
+function kebabToCamel(name) {
+  return name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function coerceFieldValue(name, raw) {
+  const t = raw.trim();
+  if (t.startsWith("{") || t.startsWith("[")) {
+    try {
+      return JSON.parse(t);
+    } catch {
+      return raw;
+    }
+  }
+  if (/Ms$/.test(name) && /^\d+$/.test(t)) return Number(t);
+  return raw;
+}
+function parseConnectorArgs(args) {
+  const out = {
+    subcommand: "",
+    positional: [],
+    skipValidate: false,
+    plaintext: false,
+    fields: {}
+  };
+  const positional = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--skip-validate") {
+      out.skipValidate = true;
+      continue;
+    }
+    if (arg === "--plaintext") {
+      out.plaintext = true;
+      continue;
+    }
+    if (arg.startsWith("--")) {
+      let flag = arg;
+      let value;
+      const eq = arg.indexOf("=");
+      if (eq >= 0) {
+        flag = arg.slice(0, eq);
+        value = arg.slice(eq + 1);
+      } else {
+        const next = args[i + 1];
+        if (next === void 0 || next.startsWith("--")) {
+          return { ok: false, error: `${flag} requires a value` };
+        }
+        value = next;
+        i++;
+      }
+      const name = flag.slice(2);
+      if (name === "project") {
+        out.project = value;
+        continue;
+      }
+      if (name === "credential" || name === "token") {
+        out.credential = value;
+        continue;
+      }
+      if (name === "id") {
+        out.id = value;
+        continue;
+      }
+      const field = kebabToCamel(name);
+      out.fields[field] = coerceFieldValue(field, value);
+      continue;
+    }
+    positional.push(arg);
+  }
+  out.subcommand = positional[0] ?? "";
+  out.positional = positional.slice(1);
+  return { ok: true, value: out };
+}
+async function buildCredentialRef(dispatch, args, deps) {
+  const hint = "an env-var reference like $PROVIDER_TOKEN is recommended (stored as a pointer, not the secret); a literal value is stored as-is";
+  if (dispatch.requiredCredentialFields.length <= 1) {
+    const key = dispatch.primaryCredentialKey;
+    let value = args.credential;
+    if (value === void 0 && typeof args.fields[key] === "string") {
+      value = args.fields[key];
+    }
+    if (value === void 0 && deps.interactive) {
+      value = await deps.prompt(`Credential for ${dispatch.provider} (${hint}):`);
+    }
+    return (value ?? "").trim();
+  }
+  const out = {};
+  for (const f of dispatch.requiredCredentialFields) {
+    let value;
+    if (typeof args.fields[f] === "string") value = args.fields[f];
+    else if (f === dispatch.primaryCredentialKey && args.credential !== void 0) value = args.credential;
+    if (value === void 0 && deps.interactive) {
+      value = await deps.prompt(`Credential field "${f}" for ${dispatch.provider} (${hint}):`);
+    }
+    out[f] = (value ?? "").trim();
+  }
+  return out;
+}
+function credentialComplete(dispatch, ref) {
+  if (typeof ref === "string") {
+    return ref.length > 0 ? [] : [dispatch.primaryCredentialKey];
+  }
+  return dispatch.requiredCredentialFields.filter((f) => !ref[f] || ref[f].length === 0);
+}
+function plaintextFields(ref) {
+  if (typeof ref === "string") return isEnvRef(ref) ? [] : ["credential"];
+  return Object.entries(ref).filter(([, v]) => !isEnvRef(v)).map(([k]) => k);
+}
+async function connectorAdd(args, deps) {
+  let provider = args.positional[0];
+  if (!provider && deps.interactive) {
+    provider = (await deps.prompt(`Provider (${Object.keys(PROVIDER_DISPATCH).sort().join(", ")}):`)).trim();
+  }
+  if (!provider) {
+    deps.err("neat connector add: a provider is required (e.g. `neat connector add supabase`)");
+    return 2;
+  }
+  const dispatch = getProviderDispatch(provider);
+  if (!dispatch) {
+    deps.err(
+      `neat connector add: unknown provider "${provider}". known providers: ${Object.keys(PROVIDER_DISPATCH).sort().join(", ")}`
+    );
+    return 2;
+  }
+  let project = args.project;
+  if (project === void 0 && deps.interactive) {
+    const answer = (await deps.prompt("Project (blank = the project the daemon is bootstrapping):")).trim();
+    if (answer.length > 0) project = answer;
+  }
+  const credential = await buildCredentialRef(dispatch, args, deps);
+  const options = { ...args.fields };
+  for (const k of dispatch.requiredCredentialFields) delete options[k];
+  for (const field of dispatch.requiredOptionFields) {
+    if (field in options) continue;
+    if (!deps.interactive) continue;
+    const answer = (await deps.prompt(`Option "${field}" for ${provider}:`)).trim();
+    if (answer.length > 0) options[field] = coerceFieldValue(field, answer);
+  }
+  const missingCred = credentialComplete(dispatch, credential);
+  if (missingCred.length > 0) {
+    deps.err(
+      `neat connector add: credential is incomplete \u2014 missing ${missingCred.join(", ")}. Pass it as a flag (e.g. \`--token $PROVIDER_TOKEN\`) or run interactively.`
+    );
+    return 2;
+  }
+  const missingOpts = dispatch.requiredOptionFields.filter((f) => !(f in options));
+  if (missingOpts.length > 0) {
+    deps.err(
+      `neat connector add: missing required option(s) for ${provider}: ${missingOpts.join(", ")}. Pass e.g. \`--${missingOpts[0].replace(/([A-Z])/g, "-$1").toLowerCase()} <value>\`.`
+    );
+    return 2;
+  }
+  const existing = await readConnectorsConfig(deps.home);
+  const existingIds = new Set(existing.connectors.map((c) => c.id));
+  const id = args.id ?? autoSlugConnectorId(provider, project, existingIds);
+  const entry2 = {
+    id,
+    provider,
+    ...project ? { project } : {},
+    credential,
+    ...Object.keys(options).length > 0 ? { options } : {}
+  };
+  if (!args.skipValidate) {
+    const outcome = await validateConnectorEntry(entry2, deps.env, deps.fetchImpl);
+    const code = reportPreWriteValidation(outcome, deps);
+    if (code !== 0) return code;
+  }
+  const plaintext = plaintextFields(credential);
+  if (plaintext.length > 0 && !args.plaintext) {
+    deps.err(
+      `neat connector add: storing a literal secret at rest for ${plaintext.join(", ")} \u2014 prefer an env-var reference like \`$PROVIDER_TOKEN\` (pass --plaintext to silence this).`
+    );
+  }
+  const { replaced } = await upsertConnectorEntry(entry2, deps.home);
+  const verb = replaced ? "updated" : "added";
+  const where = project ? `project "${project}"` : "the bootstrapping project";
+  deps.out(`${verb} connector "${id}" (${provider}) for ${where}.`);
+  if (args.skipValidate) {
+    deps.out("skipped validation (--skip-validate) \u2014 the credential is checked at the next daemon poll.");
+  }
+  deps.out("Restart the project's daemon (or start it) to begin polling this connector.");
+  return 0;
+}
+function reportPreWriteValidation(outcome, deps) {
+  switch (outcome.status) {
+    case "ok":
+      deps.out("credential validated against the provider.");
+      return 0;
+    case "unset-env":
+      deps.err(
+        `neat connector add: ${outcome.reason}. Export the variable before adding, or pass --skip-validate to add now and set it before the daemon runs.`
+      );
+      return 1;
+    case "rejected":
+      deps.err(
+        `neat connector add: the provider rejected the credential \u2014 ${outcome.reason}. Nothing was written. Fix the credential, or pass --skip-validate to store it anyway.`
+      );
+      return 1;
+    case "missing-field":
+      deps.err(`neat connector add: ${outcome.reason}.`);
+      return 2;
+    case "unknown-provider":
+      deps.err(`neat connector add: ${outcome.reason}.`);
+      return 2;
+  }
+}
+async function connectorList(deps, filterProject) {
+  const config = await readConnectorsConfig(deps.home);
+  let entries = config.connectors;
+  if (filterProject) entries = entries.filter((e) => e.project === filterProject);
+  if (entries.length === 0) {
+    deps.out(
+      filterProject ? `no connectors configured for project "${filterProject}".` : "no connectors configured. run `neat connector add <provider>` to add one."
+    );
+    return 0;
+  }
+  deps.out("id	provider	project	credential");
+  for (const e of entries) {
+    const project = e.project ?? "(bootstrapping project)";
+    const credential = describeCredential(e.credential, deps.env).map((c) => {
+      const status2 = c.status ? ` (${c.status})` : c.kind === "plaintext" ? " (plaintext)" : "";
+      return c.field ? `${c.field}=${c.display}${status2}` : `${c.display}${status2}`;
+    }).join(", ");
+    deps.out(`${e.id}	${e.provider}	${project}	${credential}`);
+  }
+  return 0;
+}
+async function connectorRemove(deps, id) {
+  if (!id) {
+    deps.err("neat connector remove: missing <id>. run `neat connector list` to see configured ids.");
+    return 2;
+  }
+  const removed = await removeConnectorEntry(id, deps.home);
+  if (!removed) {
+    deps.err(`neat connector remove: no connector with id "${id}". run \`neat connector list\` to see configured ids.`);
+    return 1;
+  }
+  deps.out(`removed connector "${id}" (${removed.provider}).`);
+  return 0;
+}
+async function connectorTest(deps, id) {
+  if (!id) {
+    deps.err("neat connector test: missing <id>. run `neat connector list` to see configured ids.");
+    return 2;
+  }
+  const config = await readConnectorsConfig(deps.home);
+  const entry2 = config.connectors.find((c) => c.id === id);
+  if (!entry2) {
+    deps.err(`neat connector test: no connector with id "${id}". run \`neat connector list\` to see configured ids.`);
+    return 1;
+  }
+  const outcome = await validateConnectorEntry(entry2, deps.env, deps.fetchImpl);
+  switch (outcome.status) {
+    case "ok":
+      deps.out(`ok: "${id}" (${entry2.provider}) authenticated against the provider.`);
+      return 0;
+    case "unset-env":
+      deps.err(`unset: "${id}" (${entry2.provider}) \u2014 ${outcome.reason}. Export the variable so the daemon can resolve it.`);
+      return 1;
+    case "rejected":
+      deps.err(`rejected: "${id}" (${entry2.provider}) \u2014 ${outcome.reason}.`);
+      return 1;
+    case "missing-field":
+      deps.err(`incomplete: "${id}" (${entry2.provider}) \u2014 ${outcome.reason}.`);
+      return 2;
+    case "unknown-provider":
+      deps.err(`unknown provider: "${id}" \u2014 ${outcome.reason}.`);
+      return 2;
+  }
+}
+function printConnectorUsage(write) {
+  write("usage: neat connector <add|list|remove|test> [args]");
+  write("  add <provider>    add a connector; validates the credential first (--skip-validate to skip)");
+  write("                    flags: --project <name>  --credential/--token <$VAR|value>  --id <id>");
+  write("                           --<option> <value> (provider-specific)  --plaintext  --skip-validate");
+  write("  list              list configured connectors (credentials shown redacted)");
+  write("                    flags: --project <name>");
+  write("  remove <id>       remove a connector by id");
+  write("  test <id>         re-run the credential validation for an existing connector");
+}
+async function runConnectorCommand(rawArgs, deps = {}) {
+  const resolved = resolveDeps(deps);
+  const parsed = parseConnectorArgs(rawArgs);
+  if (!parsed.ok) {
+    resolved.err(`neat connector: ${parsed.error}`);
+    return 2;
+  }
+  const a = parsed.value;
+  switch (a.subcommand) {
+    case "add":
+      return connectorAdd(a, resolved);
+    case "list":
+      return connectorList(resolved, a.project);
+    case "remove":
+      return connectorRemove(resolved, a.positional[0]);
+    case "test":
+      return connectorTest(resolved, a.positional[0]);
+    case "":
+      resolved.err("neat connector: missing subcommand.");
+      printConnectorUsage(resolved.err);
+      return 2;
+    default:
+      resolved.err(`neat connector: unknown subcommand "${a.subcommand}".`);
+      printConnectorUsage(resolved.err);
+      return 2;
+  }
+}
+
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path54 = __toESM(require("path"), 1);
+var import_node_path55 = __toESM(require("path"), 1);
 
 // src/cli-client.ts
 init_cjs_shims();
-var import_types32 = require("@neat.is/types");
+var import_types43 = require("@neat.is/types");
 var HttpError = class extends Error {
   constructor(status2, message, responseBody = "") {
     super(message);
@@ -12735,10 +14795,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path56) {
+    async get(path57) {
       let res;
       try {
-        res = await fetch(`${root}${path56}`, {
+        res = await fetch(`${root}${path57}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -12750,16 +14810,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path56}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path57}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path56, body) {
+    async post(path57, body) {
       let res;
       try {
-        res = await fetch(`${root}${path56}`, {
+        res = await fetch(`${root}${path57}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -12773,7 +14833,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path56}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path57}: ${text}`,
           text
         );
       }
@@ -12787,12 +14847,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path56 = projectPath(
+  const path57 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path56);
+    const result = await client.get(path57);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -12818,12 +14878,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path56 = projectPath(
+  const path57 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path56);
+    const result = await client.get(path57);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -12852,17 +14912,17 @@ async function runBlastRadius(client, input) {
   }
 }
 function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === import_types32.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  const tag = n.edgeProvenance === import_types43.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
   return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path56 = projectPath(
+  const path57 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path56);
+    const result = await client.get(path57);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -12909,7 +14969,7 @@ async function runObservedDependencies(client, input) {
       if (result.observed) {
         return {
           summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
-          provenance: import_types32.Provenance.OBSERVED
+          provenance: import_types43.Provenance.OBSERVED
         };
       }
       const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
@@ -12919,7 +14979,7 @@ async function runObservedDependencies(client, input) {
     return {
       summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
       block: blockLines.join("\n"),
-      provenance: import_types32.Provenance.OBSERVED
+      provenance: import_types43.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -12954,9 +15014,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path56 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path57 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path56);
+    const body = await client.get(path57);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -12973,7 +15033,7 @@ async function runIncidents(client, input) {
     return {
       summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
       block: blockLines.join("\n"),
-      provenance: import_types32.Provenance.OBSERVED
+      provenance: import_types43.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -13082,7 +15142,7 @@ async function runStaleEdges(client, input) {
   return {
     summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
     block: blockLines.join("\n"),
-    provenance: import_types32.Provenance.STALE
+    provenance: import_types43.Provenance.STALE
   };
 }
 async function runPolicies(client, input) {
@@ -13246,7 +15306,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path54.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path55.default.sep}`)) {
       return entry2;
     }
   }
@@ -13399,7 +15459,7 @@ async function runSync(opts) {
 }
 
 // src/cli.ts
-var import_types33 = require("@neat.is/types");
+var import_types44 = require("@neat.is/types");
 function isNpxInvocation() {
   if (process.env.npm_command === "exec") return true;
   const execpath = process.env.npm_execpath ?? "";
@@ -13460,6 +15520,17 @@ function usage() {
   console.log("                   --dry-run          run extraction in-memory; do not write");
   console.log("                   --no-instrument    skip the SDK install apply step");
   console.log("                   --json             emit the delta summary as JSON");
+  console.log("  connector      Configure pull-based OBSERVED connectors (supabase, railway,");
+  console.log("                 firebase, cloudflare). Subcommands:");
+  console.log("                   add <provider>   add a connector; validates the credential");
+  console.log("                                    against the provider first (--skip-validate to skip)");
+  console.log("                                    flags: --project <name>, --credential/--token <$VAR|value>,");
+  console.log("                                    --id <id>, --<option> <value>, --plaintext, --skip-validate");
+  console.log("                   list             list configured connectors (credentials redacted)");
+  console.log("                   remove <id>      remove a connector by id");
+  console.log("                   test <id>        re-check an existing connector's credential");
+  console.log("                 Credentials default to an env-var reference ($VAR) resolved at");
+  console.log("                 run time; the config file is written owner-only (0600).");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  root-cause <node-id>             Walk inbound edges to find what broke first.");
@@ -13681,7 +15752,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs35.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs36.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -13690,13 +15761,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path55.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path56.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs35.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs36.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path55.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs35.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path56.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs36.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -13707,9 +15778,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path55.default.join(opts.scanPath, "neat-out")
+    import_node_path56.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path55.default.join(import_node_path55.default.dirname(opts.outPath), import_node_path55.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path56.default.join(import_node_path56.default.dirname(opts.outPath), import_node_path56.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -13788,7 +15859,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs35.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs36.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -13828,9 +15899,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path55.default.resolve(override);
+  if (override && override.length > 0) return import_node_path56.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path55.default.join(home, ".claude.json");
+  return import_node_path56.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -13842,7 +15913,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs35.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs36.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -13854,8 +15925,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs35.promises.mkdir(import_node_path55.default.dirname(target), { recursive: true });
-    await import_node_fs35.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs36.promises.mkdir(import_node_path56.default.dirname(target), { recursive: true });
+    await import_node_fs36.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     return { exitCode: 0 };
@@ -13883,6 +15954,11 @@ async function main() {
     printVersion();
     process.exit(0);
   }
+  if (cmd0 === "connector") {
+    const code = await runConnectorCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   const argvParsed = parseArgs(argv);
   if (argvParsed.positional.length === 0) {
     const orchestratorCode2 = await tryOrchestrator(process.cwd(), argvParsed);
@@ -13904,12 +15980,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path55.default.resolve(target);
+    const scanPath = import_node_path56.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path55.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path56.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path55.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path55.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path56.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path56.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -13930,21 +16006,21 @@ async function main() {
       usage();
       process.exit(2);
     }
-    const scanPath = import_node_path55.default.resolve(target);
-    const stat = await import_node_fs35.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path56.default.resolve(target);
+    const stat = await import_node_fs36.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path55.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path55.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path55.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path55.default.join(import_node_path55.default.dirname(outPath), import_node_path55.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path56.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path56.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path56.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path56.default.join(import_node_path56.default.dirname(outPath), import_node_path56.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path55.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path55.default.join(import_node_path55.default.dirname(outPath), import_node_path55.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path56.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path56.default.join(import_node_path56.default.dirname(outPath), import_node_path56.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path55.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path56.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -14127,11 +16203,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path55.default.resolve(cmd);
-  const stat = await import_node_fs35.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path56.default.resolve(cmd);
+  const stat = await import_node_fs36.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path55.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path56.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -14320,10 +16396,10 @@ async function runQueryVerb(cmd, parsed) {
         const parts = parsed.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
         const out = [];
         for (const p of parts) {
-          const r = import_types33.DivergenceTypeSchema.safeParse(p);
+          const r = import_types44.DivergenceTypeSchema.safeParse(p);
           if (!r.success) {
             console.error(
-              `neat divergences: unknown --type "${p}". allowed: ${import_types33.DivergenceTypeSchema.options.join(", ")}`
+              `neat divergences: unknown --type "${p}". allowed: ${import_types44.DivergenceTypeSchema.options.join(", ")}`
             );
             return 2;
           }