@neat.is/core 0.4.28-dev.20260712 → 0.4.28-dev.20260713

package/dist/{chunk-5T6J3WKC.js → chunk-N7HEYLOF.js}

@@ -456,19 +456,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path43, edges) {
-    if (path43.length > best.path.length) {
-      best = { path: [...path43], edges: [...edges] };
+  function step(node, path47, edges) {
+    if (path47.length > best.path.length) {
+      best = { path: [...path47], edges: [...edges] };
     }
-    if (path43.length - 1 >= maxDepth) return;
+    if (path47.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path43.push(srcId);
+      path47.push(srcId);
       edges.push(edge);
-      step(srcId, path43, edges);
-      path43.pop();
+      step(srcId, path47, edges);
+      path47.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -662,26 +662,26 @@ function dominantFailingCall(graph, serviceId4, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path43 = [originServiceId];
+  const path47 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path43.push(hop.nextService);
+    path47.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path43, edges, culprit: current };
+  return { path: path47, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path43 = [...chain.path];
+  const path47 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -689,14 +689,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path43.push(loc.fileNode);
+      path47.push(loc.fileNode);
       edgeProvenances.push(Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path43,
+      traversalPath: path47,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -708,7 +708,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path43,
+    traversalPath: path47,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -5803,10 +5803,10 @@ async function addCallEdges(graph, services) {
 
 // src/extract/infra/docker-compose.ts
 import path31 from "path";
-import { EdgeType as EdgeType13, Provenance as Provenance12, confidenceForExtracted as confidenceForExtracted10 } from "@neat.is/types";
+import { EdgeType as EdgeType13, Provenance as Provenance13, confidenceForExtracted as confidenceForExtracted11 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
-import { NodeType as NodeType13, infraId as infraId7 } from "@neat.is/types";
+import { NodeType as NodeType13, Provenance as Provenance12, confidenceForExtracted as confidenceForExtracted10, infraId as infraId7 } from "@neat.is/types";
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
     id: infraId7(kind, name),
@@ -5830,6 +5830,39 @@ function classifyImage(image) {
   if (last.startsWith("memcached")) return "memcached";
   return "container";
 }
+function lineContaining(raw, needle) {
+  if (!needle) return void 0;
+  const idx = raw.indexOf(needle);
+  if (idx === -1) return void 0;
+  let line = 1;
+  for (let i = 0; i < idx; i++) if (raw[i] === "\n") line++;
+  return line;
+}
+function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provider, evidenceFile, line) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const node = makeInfraNode(kind, name, provider);
+  if (!graph.hasNode(node.id)) {
+    graph.addNode(node.id, node);
+    nodesAdded++;
+  }
+  if (node.id === anchorId) return { nodesAdded, edgesAdded };
+  const edgeId = extractedEdgeId2(anchorId, node.id, edgeType);
+  if (!graph.hasEdge(edgeId)) {
+    const edge = {
+      id: edgeId,
+      source: anchorId,
+      target: node.id,
+      type: edgeType,
+      provenance: Provenance12.EXTRACTED,
+      confidence: confidenceForExtracted10("structural"),
+      evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
+    };
+    graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/infra/docker-compose.ts
 function dependsOnList(value) {
@@ -5896,8 +5929,8 @@ async function addComposeInfra(graph, scanPath, services) {
         source: sourceId,
         target: targetId,
         type: EdgeType13.DEPENDS_ON,
-        provenance: Provenance12.EXTRACTED,
-        confidence: confidenceForExtracted10("structural"),
+        provenance: Provenance13.EXTRACTED,
+        confidence: confidenceForExtracted11("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -5910,7 +5943,7 @@ async function addComposeInfra(graph, scanPath, services) {
 // src/extract/infra/dockerfile.ts
 import path32 from "path";
 import { promises as fs16 } from "fs";
-import { EdgeType as EdgeType14, Provenance as Provenance13, confidenceForExtracted as confidenceForExtracted11 } from "@neat.is/types";
+import { EdgeType as EdgeType14, Provenance as Provenance14, confidenceForExtracted as confidenceForExtracted12 } from "@neat.is/types";
 function readDockerfile(content) {
   let image = null;
   const ports = [];
@@ -5976,8 +6009,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         source: fileNodeId,
         target: node.id,
         type: EdgeType14.RUNS_ON,
-        provenance: Provenance13.EXTRACTED,
-        confidence: confidenceForExtracted11("structural"),
+        provenance: Provenance14.EXTRACTED,
+        confidence: confidenceForExtracted12("structural"),
         evidence: {
           file: evidenceFile,
           ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
@@ -5999,8 +6032,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         source: fileNodeId,
         target: portNode.id,
         type: EdgeType14.CONNECTS_TO,
-        provenance: Provenance13.EXTRACTED,
-        confidence: confidenceForExtracted11("structural"),
+        provenance: Provenance14.EXTRACTED,
+        confidence: confidenceForExtracted12("structural"),
         evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
       };
       graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
@@ -6013,7 +6046,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 // src/extract/infra/terraform.ts
 import { promises as fs17 } from "fs";
 import path33 from "path";
-import { EdgeType as EdgeType15, Provenance as Provenance14, confidenceForExtracted as confidenceForExtracted12 } from "@neat.is/types";
+import { EdgeType as EdgeType15, Provenance as Provenance15, confidenceForExtracted as confidenceForExtracted13 } from "@neat.is/types";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
@@ -6102,8 +6135,8 @@ async function addTerraformResources(graph, scanPath) {
           source: resource.nodeId,
           target: target.nodeId,
           type: EdgeType15.DEPENDS_ON,
-          provenance: Provenance14.EXTRACTED,
-          confidence: confidenceForExtracted12("structural"),
+          provenance: Provenance15.EXTRACTED,
+          confidence: confidenceForExtracted13("structural"),
           evidence: { file: evidenceFile, line, snippet: key }
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -6173,7 +6206,7 @@ async function addK8sResources(graph, scanPath) {
 import { promises as fs19 } from "fs";
 import path35 from "path";
 import { parse as parseToml2 } from "smol-toml";
-import { EdgeType as EdgeType16, Provenance as Provenance15, confidenceForExtracted as confidenceForExtracted13 } from "@neat.is/types";
+import { EdgeType as EdgeType16, Provenance as Provenance16, confidenceForExtracted as confidenceForExtracted14 } from "@neat.is/types";
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
@@ -6185,7 +6218,7 @@ async function readWranglerConfig(dir) {
   }
   return null;
 }
-function lineContaining(raw, needle) {
+function lineContaining2(raw, needle) {
   if (!needle) return void 0;
   const idx = raw.indexOf(needle);
   if (idx === -1) return void 0;
@@ -6221,8 +6254,8 @@ function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, li
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: Provenance15.EXTRACTED,
-      confidence: confidenceForExtracted13("structural"),
+      provenance: Provenance16.EXTRACTED,
+      confidence: confidenceForExtracted14("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -6290,8 +6323,8 @@ async function addCloudflareWorkers(graph, services, scanPath) {
           source: anchorId,
           target: runtimeNode.id,
           type: EdgeType16.RUNS_ON,
-          provenance: Provenance15.EXTRACTED,
-          confidence: confidenceForExtracted13("structural"),
+          provenance: Provenance16.EXTRACTED,
+          confidence: confidenceForExtracted14("structural"),
           evidence: {
             file: evidenceFile,
             ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
@@ -6309,7 +6342,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-route",
         route,
         evidenceFile,
-        lineContaining(raw, route)
+        lineContaining2(raw, route)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -6333,7 +6366,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
           group.kind,
           name,
           evidenceFile,
-          lineContaining(raw, name)
+          lineContaining2(raw, name)
         );
         nodesAdded += result.nodesAdded;
         edgesAdded += result.edgesAdded;
@@ -6347,7 +6380,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-cron",
         cron,
         evidenceFile,
-        lineContaining(raw, cron)
+        lineContaining2(raw, cron)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -6360,7 +6393,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-env-var",
         varName,
         evidenceFile,
-        lineContaining(raw, varName)
+        lineContaining2(raw, varName)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -6376,9 +6409,9 @@ async function addCloudflareWorkers(graph, services, scanPath) {
             source: anchorId,
             target: target.anchorId,
             type: EdgeType16.CALLS,
-            provenance: Provenance15.EXTRACTED,
-            confidence: confidenceForExtracted13("structural"),
-            evidence: { file: evidenceFile, line: lineContaining(raw, svc.service) }
+            provenance: Provenance16.EXTRACTED,
+            confidence: confidenceForExtracted14("structural"),
+            evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
           edgesAdded++;
@@ -6392,15 +6425,209 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
-        lineContaining(raw, svc.service)
+        lineContaining2(raw, svc.service)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/vercel.ts
+import { promises as fs20 } from "fs";
+import path36 from "path";
+import { EdgeType as EdgeType17 } from "@neat.is/types";
+var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
+async function readVercelConfig(dir) {
+  for (const filename of VERCEL_CONFIG_FILENAMES) {
+    const abs = path36.join(dir, filename);
+    if (!await exists(abs)) continue;
+    const raw = await fs20.readFile(abs, "utf8");
+    const config = JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+async function readLinkedProjectName(dir) {
+  const abs = path36.join(dir, ".vercel", "project.json");
+  if (!await exists(abs)) return void 0;
+  const parsed = JSON.parse(await fs20.readFile(abs, "utf8"));
+  return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
+}
+function routeSource(route) {
+  return route.source ?? route.src;
+}
+async function addVercelServices(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    let projectName;
+    try {
+      read = await readVercelConfig(service.dir);
+      projectName = await readLinkedProjectName(service.dir);
+    } catch (err) {
+      recordExtractionError("infra vercel", path36.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read && !projectName) continue;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "vercel" || projectName && serviceNode.platformName !== projectName) {
+      const updated = {
+        ...serviceNode,
+        platform: "vercel",
+        ...projectName ? { platformName: projectName } : {}
+      };
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+    const anchorId = service.node.id;
+    if (!read) continue;
+    const { config, relFile, raw } = read;
+    const evidenceFile = toPosix2(path36.relative(scanPath, path36.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "vercel",
+        evidenceFile,
+        lineContaining(raw, name)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
+    };
+    add(EdgeType17.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(EdgeType17.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(EdgeType17.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(EdgeType17.DEPENDS_ON, "vercel-env-var", varName);
+    for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
+      add(EdgeType17.CONNECTS_TO, "vercel-route", routeSource(route));
     }
   }
   return { nodesAdded, edgesAdded };
 }
 
+// src/extract/infra/railway.ts
+import { promises as fs21 } from "fs";
+import path37 from "path";
+import { parse as parseToml3 } from "smol-toml";
+import { EdgeType as EdgeType18 } from "@neat.is/types";
+var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
+async function readRailwayConfig(dir) {
+  for (const filename of RAILWAY_FILENAMES) {
+    const abs = path37.join(dir, filename);
+    if (!await exists(abs)) continue;
+    const raw = await fs21.readFile(abs, "utf8");
+    const config = filename === "railway.toml" ? parseToml3(raw) : JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+async function addRailwayServices(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    try {
+      read = await readRailwayConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra railway", path37.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read) continue;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "railway") {
+      graph.replaceNodeAttributes(service.node.id, { ...serviceNode, platform: "railway" });
+    }
+    const anchorId = service.node.id;
+    const { config, relFile, raw } = read;
+    const evidenceFile = toPosix2(path37.relative(scanPath, path37.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "railway",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(EdgeType18.RUNS_ON, "railway", "railway");
+    add(EdgeType18.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(EdgeType18.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/supabase.ts
+import { promises as fs22 } from "fs";
+import path38 from "path";
+import { parse as parseToml4 } from "smol-toml";
+import { EdgeType as EdgeType19 } from "@neat.is/types";
+async function readSupabaseConfig(dir) {
+  const relFile = path38.join("supabase", "config.toml");
+  const abs = path38.join(dir, relFile);
+  if (!await exists(abs)) return null;
+  const raw = await fs22.readFile(abs, "utf8");
+  const config = parseToml4(raw);
+  return { config, relFile, raw };
+}
+async function addSupabaseProjects(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    try {
+      read = await readSupabaseConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra supabase", path38.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read) continue;
+    const { config, relFile, raw } = read;
+    const projectId = typeof config.project_id === "string" ? config.project_id : void 0;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "supabase" || projectId && serviceNode.platformName !== projectId) {
+      graph.replaceNodeAttributes(service.node.id, {
+        ...serviceNode,
+        platform: "supabase",
+        ...projectId ? { platformName: projectId } : {}
+      });
+    }
+    const anchorId = service.node.id;
+    const evidenceFile = toPosix2(path38.relative(scanPath, path38.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "supabase",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(EdgeType19.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(EdgeType19.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(EdgeType19.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(EdgeType19.DEPENDS_ON, "supabase-auth", "auth");
+  }
+  return { nodesAdded, edgesAdded };
+}
+
 // src/extract/infra/index.ts
 async function addInfra(graph, scanPath, services) {
   const compose = await addComposeInfra(graph, scanPath, services);
@@ -6408,19 +6635,22 @@ async function addInfra(graph, scanPath, services) {
   const terraform = await addTerraformResources(graph, scanPath);
   const k8s = await addK8sResources(graph, scanPath);
   const cloudflare = await addCloudflareWorkers(graph, services, scanPath);
+  const vercel = await addVercelServices(graph, services, scanPath);
+  const railway = await addRailwayServices(graph, services, scanPath);
+  const supabase = await addSupabaseProjects(graph, services, scanPath);
   return {
-    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded,
-    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded + vercel.nodesAdded + railway.nodesAdded + supabase.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded + vercel.edgesAdded + railway.edgesAdded + supabase.edgesAdded
   };
 }
 
 // src/extract/index.ts
-import path37 from "path";
+import path40 from "path";
 
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
-import path36 from "path";
-import { NodeType as NodeType14, Provenance as Provenance16 } from "@neat.is/types";
+import path39 from "path";
+import { NodeType as NodeType14, Provenance as Provenance17 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
@@ -6437,7 +6667,7 @@ function retireEdgesByFile(graph, file) {
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance16.EXTRACTED) return;
+    if (edge.provenance !== Provenance17.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -6450,14 +6680,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance16.EXTRACTED) return;
+    if (edge.provenance !== Provenance17.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (path36.isAbsolute(evidenceFile)) {
+    if (path39.isAbsolute(evidenceFile)) {
       if (!existsSync2(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => existsSync2(path36.join(base, evidenceFile)));
+    const found = bases.some((base) => existsSync2(path39.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -6499,7 +6729,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = path37.join(path37.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = path40.join(path40.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -6535,10 +6765,10 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 import {
   databaseId as databaseId3,
   DivergenceResultSchema,
-  EdgeType as EdgeType17,
+  EdgeType as EdgeType20,
   NodeType as NodeType15,
   parseEdgeId,
-  Provenance as Provenance17
+  Provenance as Provenance18
 } from "@neat.is/types";
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
@@ -6552,17 +6782,17 @@ function bucketEdges(graph) {
     const key = bucketKey(e.source, e.target, e.type);
     const cur = buckets.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
-      case Provenance17.EXTRACTED:
+      case Provenance18.EXTRACTED:
         cur.extracted = e;
         break;
-      case Provenance17.OBSERVED:
+      case Provenance18.OBSERVED:
         cur.observed = e;
         break;
-      case Provenance17.INFERRED:
+      case Provenance18.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === Provenance17.STALE) cur.stale = e;
+        if (e.provenance === Provenance18.STALE) cur.stale = e;
     }
     buckets.set(key, cur);
   });
@@ -6596,14 +6826,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  EdgeType17.CALLS,
-  EdgeType17.CONNECTS_TO,
-  EdgeType17.PUBLISHES_TO,
-  EdgeType17.CONSUMES_FROM
+  EdgeType20.CALLS,
+  EdgeType20.CONNECTS_TO,
+  EdgeType20.PUBLISHES_TO,
+  EdgeType20.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === EdgeType17.CONTAINS) return out;
+  if (bucket.type === EdgeType20.CONTAINS) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
       out.push({
@@ -6644,7 +6874,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType17.CONFIGURED_BY && e.provenance === Provenance17.EXTRACTED) {
+    if (e.type === EdgeType20.CONFIGURED_BY && e.provenance === Provenance18.EXTRACTED) {
       return true;
     }
   }
@@ -6657,8 +6887,8 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType17.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance17.OBSERVED) continue;
+    if (edge.type !== EdgeType20.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance18.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType15.DatabaseNode) continue;
     const observedHost = target.host?.trim();
@@ -6682,8 +6912,8 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType17.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance17.OBSERVED) continue;
+    if (edge.type !== EdgeType20.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance18.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
     if (target.type !== NodeType15.DatabaseNode) continue;
     for (const pair of compatPairs()) {
@@ -6805,9 +7035,9 @@ function computeDivergences(graph, opts = {}) {
 }
 
 // src/persist.ts
-import { promises as fs20 } from "fs";
-import path38 from "path";
-import { Provenance as Provenance18, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+import { promises as fs23 } from "fs";
+import path41 from "path";
+import { Provenance as Provenance19, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -6829,7 +7059,7 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = Provenance18.OBSERVED;
+      attrs.provenance = Provenance19.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
@@ -6843,7 +7073,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await fs20.mkdir(path38.dirname(filePath), { recursive: true });
+  await fs23.mkdir(path41.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -6853,13 +7083,13 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  await fs20.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await fs20.rename(tmp, outPath);
+  await fs23.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await fs23.rename(tmp, outPath);
 }
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await fs20.readFile(outPath, "utf8");
+    raw = await fs23.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -6923,7 +7153,7 @@ function startPersistLoop(graph, outPath, opts = {}) {
 }
 
 // src/diff.ts
-import { promises as fs21 } from "fs";
+import { promises as fs24 } from "fs";
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -6932,7 +7162,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await fs21.readFile(target, "utf8");
+  const raw = await fs24.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -6999,23 +7229,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path39 from "path";
+import path42 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path39.join(baseDir, "graph.json"),
-      errorsPath: path39.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path39.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path39.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path39.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path42.join(baseDir, "graph.json"),
+      errorsPath: path42.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path42.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path42.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path42.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path39.join(baseDir, `${project}.json`),
-    errorsPath: path39.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path39.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path39.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path39.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path42.join(baseDir, `${project}.json`),
+    errorsPath: path42.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path42.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path42.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path42.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -7054,9 +7284,9 @@ function parseExtraProjects(raw) {
 }
 
 // src/registry.ts
-import { promises as fs22 } from "fs";
+import { promises as fs25 } from "fs";
 import os2 from "os";
-import path40 from "path";
+import path43 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -7064,20 +7294,20 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path40.resolve(override);
-  return path40.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path43.resolve(override);
+  return path43.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path40.join(neatHome(), "projects.json");
+  return path43.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path40.join(neatHome(), "projects.json.lock");
+  return path43.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return path40.join(neatHome(), "neatd.pid");
+  return path43.join(neatHome(), "neatd.pid");
 }
 function daemonsDir() {
-  return path40.join(neatHome(), "daemons");
+  return path43.join(neatHome(), "daemons");
 }
 function isFiniteInt(v) {
   return typeof v === "number" && Number.isFinite(v);
@@ -7110,7 +7340,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const dir = daemonsDir();
   let names;
   try {
-    names = await fs22.readdir(dir);
+    names = await fs25.readdir(dir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -7118,10 +7348,10 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const out = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const file = path40.join(dir, name);
+    const file = path43.join(dir, name);
     let raw;
     try {
-      raw = await fs22.readFile(file, "utf8");
+      raw = await fs25.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -7134,7 +7364,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   return out;
 }
 async function removeDaemonRecord(source) {
-  await fs22.unlink(source).catch(() => {
+  await fs25.unlink(source).catch(() => {
   });
 }
 async function listMachineProjects(probe = defaultDiscoveryProbe) {
@@ -7191,7 +7421,7 @@ function isPidAliveDefault(pid) {
 }
 async function readPidFile(file) {
   try {
-    const raw = await fs22.readFile(file, "utf8");
+    const raw = await fs25.readFile(file, "utf8");
     const pid = Number.parseInt(raw.trim(), 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
   } catch {
@@ -7239,32 +7469,32 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function normalizeProjectPath(input) {
-  const resolved = path40.resolve(input);
+  const resolved = path43.resolve(input);
   try {
-    return await fs22.realpath(resolved);
+    return await fs25.realpath(resolved);
   } catch {
     return resolved;
   }
 }
 async function writeAtomically(target, contents) {
-  await fs22.mkdir(path40.dirname(target), { recursive: true });
+  await fs25.mkdir(path43.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs22.open(tmp, "w");
+  const fd = await fs25.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await fs22.rename(tmp, target);
+  await fs25.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await fs22.mkdir(path40.dirname(lockPath), { recursive: true });
+  await fs25.mkdir(path43.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
-      const fd = await fs22.open(lockPath, "wx");
+      const fd = await fs25.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -7289,7 +7519,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaul
   }
 }
 async function releaseLock(lockPath) {
-  await fs22.unlink(lockPath).catch(() => {
+  await fs25.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -7305,7 +7535,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await fs22.readFile(file, "utf8");
+    raw = await fs25.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -7410,7 +7640,7 @@ function pruneTtlMs() {
 }
 async function statPathStatus(p) {
   try {
-    const stat = await fs22.stat(p);
+    const stat = await fs25.stat(p);
     return stat.isDirectory() ? "present" : "unknown";
   } catch (err) {
     return err.code === "ENOENT" ? "gone" : "unknown";
@@ -7455,14 +7685,14 @@ import cors from "@fastify/cors";
 import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
 
 // src/extend/index.ts
-import { promises as fs24 } from "fs";
-import path42 from "path";
+import { promises as fs27 } from "fs";
+import path45 from "path";
 import os3 from "os";
 import { resolve as registryResolve, list as registryList } from "@neat.is/instrumentation-registry";
 
 // src/installers/package-manager.ts
-import { promises as fs23 } from "fs";
-import path41 from "path";
+import { promises as fs26 } from "fs";
+import path44 from "path";
 import { spawn } from "child_process";
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -7477,29 +7707,29 @@ var LOCKFILE_PRIORITY = [
 var NPM_FALLBACK_ARGS = ["install", "--no-audit", "--no-fund", "--prefer-offline"];
 async function exists2(p) {
   try {
-    await fs23.access(p);
+    await fs26.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = path41.resolve(serviceDir);
+  let dir = path44.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path41.join(dir, candidate.lockfile);
+      const lockPath = path44.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = path41.dirname(dir);
+    const parent = path44.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: path41.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: path44.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -7541,30 +7771,30 @@ ${err.message}`
 // src/extend/index.ts
 async function fileExists2(p) {
   try {
-    await fs24.access(p);
+    await fs27.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = path42.join(scanPath, "package.json");
-  const raw = await fs24.readFile(pkgPath, "utf8");
+  const pkgPath = path45.join(scanPath, "package.json");
+  const raw = await fs27.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
 async function findHookFiles(scanPath) {
-  const entries = await fs24.readdir(scanPath);
+  const entries = await fs27.readdir(scanPath);
   return entries.filter(
     (e) => (e.startsWith("instrumentation") || e.startsWith("otel-init")) && /\.(ts|js)$/.test(e)
   ).sort();
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? path42.join(os3.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? path45.join(os3.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry) {
   const logPath = extendLogPath();
-  await fs24.mkdir(path42.dirname(logPath), { recursive: true });
-  await fs24.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
+  await fs27.mkdir(path45.dirname(logPath), { recursive: true });
+  await fs27.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
   if (fileContent.includes("__INSTRUMENTATION_BLOCK__")) {
@@ -7622,7 +7852,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(path42.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(path45.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     registryList().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -7644,31 +7874,31 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await fs24.readFile(path42.join(ctx.scanPath, file), "utf8");
+    const content = await fs27.readFile(path45.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
   }
   const primaryFile = hookFiles[0];
-  const primaryPath = path42.join(ctx.scanPath, primaryFile);
+  const primaryPath = path45.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = path42.join(ctx.scanPath, "package.json");
+  const pkgPath = path45.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
-    await fs24.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    await fs27.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     filesTouched.push("package.json");
     depsAdded.push(`${args.instrumentation_package}@${args.version}`);
   }
-  const hookContent = await fs24.readFile(primaryPath, "utf8");
+  const hookContent = await fs27.readFile(primaryPath, "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (!patched) {
     throw new Error(
       `Could not find instrumentation insertion point in ${primaryFile}. Expected __INSTRUMENTATION_BLOCK__, instrumentations.push(, or new NodeSDK(.`
     );
   }
-  await fs24.writeFile(primaryPath, patched, "utf8");
+  await fs27.writeFile(primaryPath, patched, "utf8");
   filesTouched.push(primaryFile);
   const cmd = await detectPackageManager(ctx.scanPath);
   const installer = options?.runInstall ?? runPackageManagerInstall;
@@ -7699,7 +7929,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await fs24.readFile(path42.join(ctx.scanPath, file), "utf8");
+    const content = await fs27.readFile(path45.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -7721,7 +7951,7 @@ async function dryRunExtension(ctx, args) {
     depsToAdd.push(`${args.instrumentation_package}@${args.version}`);
     filesTouched.push("package.json");
   }
-  const hookContent = await fs24.readFile(path42.join(ctx.scanPath, primaryFile), "utf8");
+  const hookContent = await fs27.readFile(path45.join(ctx.scanPath, primaryFile), "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (patched) {
     filesTouched.push(primaryFile);
@@ -7736,28 +7966,28 @@ async function rollbackExtension(ctx, args) {
   if (!await fileExists2(logPath)) {
     return { undone: false, message: "no apply found for library" };
   }
-  const raw = await fs24.readFile(logPath, "utf8");
+  const raw = await fs27.readFile(logPath, "utf8");
   const entries = raw.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line));
   const match = [...entries].reverse().find((e) => e.project === ctx.project && e.library === args.library);
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = path42.join(ctx.scanPath, "package.json");
+  const pkgPath = path45.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
       const { [match.instrumentation_package]: _removed, ...rest } = pkg.dependencies;
       pkg.dependencies = rest;
-      await fs24.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+      await fs27.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     }
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = path42.join(ctx.scanPath, file);
-    const content = await fs24.readFile(filePath, "utf8");
+    const filePath = path45.join(ctx.scanPath, file);
+    const content = await fs27.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
-      await fs24.writeFile(filePath, filtered, "utf8");
+      await fs27.writeFile(filePath, filtered, "utf8");
       break;
     }
   }
@@ -7866,6 +8096,332 @@ data: ${JSON.stringify(envelope.payload)}
   reply.raw.on("error", closeConnection);
 }
 
+// src/connectors-config.ts
+import os4 from "os";
+import path46 from "path";
+import { promises as fs28 } from "fs";
+var CONNECTORS_CONFIG_VERSION = 1;
+var EnvRefUnsetError = class extends Error {
+  ref;
+  varName;
+  constructor(ref, varName) {
+    super(`${ref} is unset`);
+    this.name = "EnvRefUnsetError";
+    this.ref = ref;
+    this.varName = varName;
+  }
+};
+function neatHome2() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return path46.resolve(override);
+  return path46.join(os4.homedir(), ".neat");
+}
+function connectorsConfigPath(home = neatHome2()) {
+  return path46.join(home, "connectors.json");
+}
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await fs28.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
+      );
+    }
+  } catch {
+  }
+}
+async function readConnectorsConfig(home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  let raw;
+  try {
+    raw = await fs28.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
+    }
+    throw err;
+  }
+  await warnIfModeLooserThan0600(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig(parsed, file);
+}
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "connectors" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawConnectors = obj.connectors;
+  if (!Array.isArray(rawConnectors)) {
+    throw new Error(`${file}: "connectors" must be an array`);
+  }
+  const connectors = rawConnectors.map((entry, i) => validateEntry(entry, i, file));
+  return { version, connectors };
+}
+function validateEntry(entry, index, file) {
+  const where = `${file}: connectors[${index}]`;
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry;
+  const id = e.id;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error(`${where}.id must be a non-empty string`);
+  }
+  const provider = e.provider;
+  if (typeof provider !== "string" || provider.length === 0) {
+    throw new Error(`${where}.provider must be a non-empty string`);
+  }
+  if (e.project !== void 0 && typeof e.project !== "string") {
+    throw new Error(`${where}.project must be a string when present`);
+  }
+  const credential = validateCredentialRef(e.credential, `${where}.credential`);
+  let options;
+  if (e.options !== void 0) {
+    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
+      throw new Error(`${where}.options must be an object when present`);
+    }
+    options = e.options;
+  }
+  return {
+    id,
+    provider,
+    ...typeof e.project === "string" ? { project: e.project } : {},
+    credential,
+    ...options ? { options } : {}
+  };
+}
+function validateCredentialRef(raw, where) {
+  if (typeof raw === "string") {
+    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
+    return raw;
+  }
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    const fields = raw;
+    const keys = Object.keys(fields);
+    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
+    for (const key of keys) {
+      const v = fields[key];
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`${where}.${key} must be a non-empty string`);
+      }
+    }
+    return fields;
+  }
+  throw new Error(`${where} must be a string or an object of strings`);
+}
+function resolveCredential(ref, env = process.env) {
+  if (typeof ref === "string") {
+    return { kind: "single", value: resolveRef(ref, env) };
+  }
+  const fields = {};
+  for (const [key, value] of Object.entries(ref)) {
+    fields[key] = resolveRef(value, env);
+  }
+  return { kind: "fields", fields };
+}
+function resolveRef(value, env) {
+  if (value.length > 1 && value.startsWith("$")) {
+    const varName = value.slice(1);
+    const resolved = env[varName];
+    if (resolved === void 0 || resolved.length === 0) {
+      throw new EnvRefUnsetError(value, varName);
+    }
+    return resolved;
+  }
+  return value;
+}
+function connectorMatchesProject(entry, project) {
+  return entry.project === void 0 || entry.project === project;
+}
+var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
+var CONNECTORS_LOCK_RETRY_MS = 50;
+function connectorsConfigLockPath(home = neatHome2()) {
+  return path46.join(home, "connectors.json.lock");
+}
+function isEnvRef(value) {
+  return value.length > 1 && value.startsWith("$");
+}
+function redactCredentialRef(ref) {
+  const one = (value) => isEnvRef(value) ? value : "****";
+  if (typeof ref === "string") return one(ref);
+  const out = {};
+  for (const [key, value] of Object.entries(ref)) out[key] = one(value);
+  return out;
+}
+async function writeConfigAtomically0600(file, contents) {
+  await fs28.mkdir(path46.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await fs28.open(tmp, "w", 384);
+  try {
+    await fd.writeFile(contents, "utf8");
+    await fd.chmod(384);
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await fs28.rename(tmp, file);
+}
+async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
+  const deadline = Date.now() + timeoutMs;
+  await fs28.mkdir(path46.dirname(lockPath), { recursive: true });
+  for (; ; ) {
+    try {
+      const fd = await fs28.open(lockPath, "wx");
+      try {
+        await fd.writeFile(`${process.pid}
+`, "utf8");
+      } finally {
+        await fd.close();
+      }
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `neat connector: timed out after ${timeoutMs}ms waiting for ${lockPath}. Another neat process may be writing the connector config; if none is, remove that file by hand.`
+        );
+      }
+      await new Promise((r) => setTimeout(r, CONNECTORS_LOCK_RETRY_MS));
+    }
+  }
+}
+async function releaseConnectorsLock(lockPath) {
+  await fs28.unlink(lockPath).catch(() => {
+  });
+}
+async function withConnectorsLock(home, fn) {
+  const lock = connectorsConfigLockPath(home);
+  await acquireConnectorsLock(lock);
+  try {
+    return await fn();
+  } finally {
+    await releaseConnectorsLock(lock);
+  }
+}
+function serializeConfig(config) {
+  return JSON.stringify(
+    { version: config.version ?? CONNECTORS_CONFIG_VERSION, connectors: config.connectors },
+    null,
+    2
+  ) + "\n";
+}
+async function upsertConnectorEntry(entry, home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  return withConnectorsLock(home, async () => {
+    const config = await readConnectorsConfig(home);
+    validateEntry(entry, config.connectors.length, file);
+    const idx = config.connectors.findIndex((c) => c.id === entry.id);
+    const replaced = idx >= 0;
+    if (replaced) config.connectors[idx] = entry;
+    else config.connectors.push(entry);
+    await writeConfigAtomically0600(file, serializeConfig(config));
+    return { replaced };
+  });
+}
+async function removeConnectorEntry(id, home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  return withConnectorsLock(home, async () => {
+    const config = await readConnectorsConfig(home);
+    const idx = config.connectors.findIndex((c) => c.id === id);
+    if (idx < 0) return void 0;
+    const [removed] = config.connectors.splice(idx, 1);
+    await writeConfigAtomically0600(file, serializeConfig(config));
+    return removed;
+  });
+}
+function slugFragment(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function autoSlugConnectorId(provider, project, existingIds) {
+  const base = slugFragment(provider) || "connector";
+  if (!existingIds.has(base)) return base;
+  const projectFrag = project ? slugFragment(project) : "";
+  if (projectFrag) {
+    const withProject = `${base}-${projectFrag}`;
+    if (!existingIds.has(withProject)) return withProject;
+  }
+  const stem = projectFrag ? `${base}-${projectFrag}` : base;
+  for (let n = 2; ; n++) {
+    const candidate = `${stem}-${n}`;
+    if (!existingIds.has(candidate)) return candidate;
+  }
+}
+function describeCredential(ref, env = process.env) {
+  const one = (value, field) => {
+    if (isEnvRef(value)) {
+      const varName = value.slice(1);
+      const resolved = env[varName];
+      const set = typeof resolved === "string" && resolved.length > 0;
+      return {
+        ...field ? { field } : {},
+        kind: "env-ref",
+        display: value,
+        status: set ? "set" : "unset"
+      };
+    }
+    return { ...field ? { field } : {}, kind: "plaintext", display: "****" };
+  };
+  if (typeof ref === "string") return [one(ref)];
+  return Object.entries(ref).map(([k, v]) => one(v, k));
+}
+
+// src/connectors/status.ts
+var CONNECTOR_STALE_THRESHOLD_MS = 5 * 6e4;
+var records = /* @__PURE__ */ new Map();
+var MAX_ERROR_LEN = 200;
+function sanitizePollError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  const collapsed = msg.replace(/\s+/g, " ").trim();
+  return collapsed.length > MAX_ERROR_LEN ? `${collapsed.slice(0, MAX_ERROR_LEN - 1)}\u2026` : collapsed;
+}
+function recordConnectorPoll(id, tick) {
+  const prev = records.get(id);
+  records.set(id, {
+    lastPollAt: tick.at,
+    lastOutcome: tick.outcome,
+    lastError: tick.outcome === "error" ? tick.error ?? null : null,
+    signalsLastPoll: tick.signalsLastPoll ?? 0,
+    lastOkAt: tick.outcome === "ok" ? tick.at : prev?.lastOkAt ?? null
+  });
+}
+function deriveState(rec, now, thresholdMs) {
+  if (rec.lastOutcome === "error") return "error";
+  const okAt = rec.lastOkAt ? Date.parse(rec.lastOkAt) : NaN;
+  if (!Number.isNaN(okAt) && now - okAt > thresholdMs) return "stale";
+  return "healthy";
+}
+function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_THRESHOLD_MS) {
+  const rec = records.get(id);
+  if (!rec) {
+    return {
+      state: "idle",
+      lastPollAt: null,
+      lastOutcome: null,
+      lastError: null,
+      signalsLastPoll: 0
+    };
+  }
+  return {
+    state: deriveState(rec, now, thresholdMs),
+    lastPollAt: rec.lastPollAt,
+    lastOutcome: rec.lastOutcome,
+    lastError: rec.lastError,
+    signalsLastPoll: rec.signalsLastPoll
+  };
+}
+
 // src/api.ts
 function serializeGraph(graph) {
   const nodes = [];
@@ -8086,6 +8642,26 @@ function registerRoutes(scope, ctx) {
     const sliced = filtered.slice(0, safeLimit);
     return { count: sliced.length, total, logs: sliced };
   });
+  scope.get("/connectors", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    let entries;
+    try {
+      entries = (await readConnectorsConfig(ctx.connectorsHome)).connectors;
+    } catch (err) {
+      return reply.code(500).send({
+        error: "connectors.json failed to read",
+        details: err.message
+      });
+    }
+    const connectors = entries.filter((entry) => connectorMatchesProject(entry, proj.name)).map((entry) => ({
+      id: entry.id,
+      provider: entry.provider,
+      credentialRef: redactCredentialRef(entry.credential),
+      status: getConnectorStatus(entry.id)
+    }));
+    return { connectors };
+  });
   const incidentHistoryHandler = async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -8488,7 +9064,8 @@ async function buildApi(opts) {
     staleEventsPathFor,
     policyFilePathFor,
     bootstrap: opts.bootstrap,
-    singleProject: opts.singleProject?.name
+    singleProject: opts.singleProject?.name,
+    connectorsHome: opts.connectorsHome
   };
   app.get("/health", async () => {
     const uptimeMs = Date.now() - startedAt;
@@ -8641,6 +9218,17 @@ export {
   touchLastSeen,
   removeProject,
   pruneRegistry,
+  EnvRefUnsetError,
+  readConnectorsConfig,
+  resolveCredential,
+  connectorMatchesProject,
+  isEnvRef,
+  upsertConnectorEntry,
+  removeConnectorEntry,
+  autoSlugConnectorId,
+  describeCredential,
+  sanitizePollError,
+  recordConnectorPoll,
   buildApi
 };
-//# sourceMappingURL=chunk-5T6J3WKC.js.map
+//# sourceMappingURL=chunk-N7HEYLOF.js.map