@neat.is/core 0.4.28-dev.20260712 → 0.4.28-dev.20260713

package/dist/{chunk-UJ6WBLIE.js → chunk-V2HUBS5J.js}

@@ -1,8 +1,10 @@
 import {
   DEFAULT_PROJECT,
+  EnvRefUnsetError,
   Projects,
   attachGraphToEventBus,
   buildApi,
+  connectorMatchesProject,
   ensureInfraNode,
   ensureObservedFileNode,
   ensureServiceNode,
@@ -15,9 +17,13 @@ import {
   normalizePathTemplate,
   pathsForProject,
   pruneRegistry,
+  readConnectorsConfig,
   reconcileObservedRelPath,
+  recordConnectorPoll,
   registryPath,
   resetGraph,
+  resolveCredential,
+  sanitizePollError,
   saveGraphToDisk,
   setStatus,
   startPersistLoop,
@@ -25,7 +31,7 @@ import {
   touchLastSeen,
   upsertObservedEdge,
   writeAtomically
-} from "./chunk-5T6J3WKC.js";
+} from "./chunk-N7HEYLOF.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
@@ -35,13 +41,13 @@ import {
 
 // src/daemon.ts
 import {
-  promises as fs3,
+  promises as fs2,
   watch,
   renameSync,
   unlinkSync,
   writeFileSync
 } from "fs";
-import path3 from "path";
+import path2 from "path";
 import { createRequire } from "module";
 
 // src/connectors/index.ts
@@ -103,16 +109,31 @@ function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options =
   let stopped = false;
   let since = ctx.since;
   const intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const connectorId = options.connectorId;
   const onError = options.onError ?? ((err) => console.error(`[neatd] connector poll failed (${connector.provider})`, err));
   const tick = () => {
     if (stopped) return;
     void (async () => {
       const tickStartedAt = (/* @__PURE__ */ new Date()).toISOString();
       try {
-        await runConnectorPoll(connector, { ...ctx, since }, graph, resolveTarget);
+        const result = await runConnectorPoll(connector, { ...ctx, since }, graph, resolveTarget);
         since = tickStartedAt;
+        if (connectorId) {
+          recordConnectorPoll(connectorId, {
+            outcome: "ok",
+            at: tickStartedAt,
+            signalsLastPoll: result.signalCount
+          });
+        }
       } catch (err) {
         onError(err);
+        if (connectorId) {
+          recordConnectorPoll(connectorId, {
+            outcome: "error",
+            at: tickStartedAt,
+            error: sanitizePollError(err)
+          });
+        }
       }
     })();
   };
@@ -403,6 +424,30 @@ function buildEdgeLogsQuery(limit) {
     `limit ${safeLimit}`
   ].join("\n");
 }
+function logsAllHttpFailureMessage(status) {
+  if (status === 401 || status === 403) {
+    return `supabase connector: logs.all request rejected (HTTP ${status}). Check the Management API token, its analytics read scope, and --api-project-ref.`;
+  }
+  if (status === 404) {
+    return "supabase connector: logs.all project not found (HTTP 404). Check --api-project-ref.";
+  }
+  if (status === 429) {
+    return "supabase connector: logs.all rate-limited (HTTP 429). The connector will retry on the next poll; reduce poll cadence if this persists.";
+  }
+  if (status === 400) {
+    return "supabase connector: logs.all query rejected (HTTP 400). Provider details redacted; confirm the live log-query dialect before shipping this connector.";
+  }
+  return `supabase connector: logs.all request failed (HTTP ${status}); provider details redacted.`;
+}
+function providerErrorDetails(error) {
+  if (!error || typeof error === "string") return "";
+  const parts = [];
+  if (typeof error.code === "number") parts.push(`code ${error.code}`);
+  if (typeof error.status === "string" && /^[A-Z0-9_.-]+$/.test(error.status)) {
+    parts.push(`status ${error.status}`);
+  }
+  return parts.length > 0 ? ` (${parts.join(", ")})` : "";
+}
 async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl = fetch) {
   const baseUrl = config.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
   const url = new URL(`${baseUrl}/v1/projects/${config.apiProjectRef}/analytics/endpoints/logs.all`);
@@ -417,12 +462,18 @@ async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl
     { provider: "supabase", accountKey: config.apiProjectRef, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`supabase connector: logs.all request failed (${res.status} ${res.statusText})`);
+    throw new Error(logsAllHttpFailureMessage(res.status));
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    throw new Error("supabase connector: logs.all returned invalid JSON; provider details redacted.");
   }
-  const body = await res.json();
   if (body.error) {
-    const message = typeof body.error === "string" ? body.error : body.error.message;
-    throw new Error(`supabase connector: logs.all returned an error (${message})`);
+    throw new Error(
+      `supabase connector: logs.all returned a provider error${providerErrorDetails(body.error)}; provider message redacted.`
+    );
   }
   return body.result ?? [];
 }
@@ -450,10 +501,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path4) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path4);
+function targetFromRestPath(path3) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path3);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path4);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path3);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -574,6 +625,35 @@ function createSupabaseResolveTarget(graph, config) {
 
 // src/connectors/supabase/index.ts
 var DEFAULT_MAX_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
+function errorCode(err) {
+  const code = err?.code;
+  return typeof code === "string" && code.length > 0 ? code : void 0;
+}
+function describeSupabasePostgresSurfaceFailure(projectRef, err) {
+  const code = errorCode(err);
+  let reason;
+  switch (code) {
+    case "42501":
+      reason = "permission denied; grant pg_read_all_stats to the configured Postgres role";
+      break;
+    case "42P01":
+    case "42704":
+      reason = "pg_stat_statements is not enabled or visible to the configured Postgres role";
+      break;
+    case "28P01":
+    case "28000":
+      reason = "Postgres credential rejected";
+      break;
+    case "3D000":
+      reason = "database not found";
+      break;
+    default: {
+      const name = err instanceof Error && err.name ? err.name : "Error";
+      reason = code ? `${name} ${code}` : name;
+    }
+  }
+  return `supabase connector: pg_stat_statements surface unavailable for project ${projectRef} (${reason}); continuing with Management API log surface.`;
+}
 var SupabaseConnector = class {
   // `deps.fetchPgStatStatements` defaults to the real Postgres-backed
   // implementation; tests override it to exercise the "both surfaces
@@ -605,12 +685,18 @@ var SupabaseConnector = class {
     const signals = mapEdgeLogRowsToSignals(logRows);
     if (creds.postgresConnectionString) {
       const fetchStatements = this.deps.fetchPgStatStatements ?? fetchPgStatStatements;
-      const statementRows = await fetchStatements(
-        creds.postgresConnectionString,
-        this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
-        this.config.apiProjectRef
-      );
-      signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
+      try {
+        const statementRows = await fetchStatements(
+          creds.postgresConnectionString,
+          this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
+          this.config.apiProjectRef
+        );
+        signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
+      } catch (err) {
+        const summary = describeSupabasePostgresSurfaceFailure(this.config.apiProjectRef, err);
+        if (this.deps.onPostgresSurfaceError) this.deps.onPostgresSurfaceError(err, summary);
+        else console.warn(summary);
+      }
     }
     return signals;
   }
@@ -978,9 +1064,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path4 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path4) return null;
-  return { resourceName, method, path: path4 };
+  const path3 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path3) return null;
+  return { resourceName, method, path: path3 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -1017,14 +1103,14 @@ function mapLogEntryToSignal(entry) {
   if (!req) return null;
   if (!req.requestMethod) return null;
   const method = req.requestMethod.toUpperCase();
-  const path4 = pathFromRequestUrl(req.requestUrl);
-  if (path4 === null) return null;
+  const path3 = pathFromRequestUrl(req.requestUrl);
+  if (path3 === null) return null;
   const timestamp = entry.timestamp;
   if (!timestamp) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path4 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path3 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -1212,7 +1298,7 @@ function mapEventToSignal(event) {
   if (typeof timestampMs !== "number" || !Number.isFinite(timestampMs)) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path4 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path3 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -1220,7 +1306,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: new Date(timestampMs).toISOString(),
     method,
-    ...path4 ? { path: path4 } : {},
+    ...path3 ? { path: path3 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -1266,8 +1352,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path4) {
-  const normalizedPath = normalizePathTemplate(path4);
+function findMatchingRouteNode(graph, serviceName, method, path3) {
+  const normalizedPath = normalizePathTemplate(path3);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -1284,10 +1370,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path4 } = signal;
+    const { method, path: path3 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path4) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path4) ?? wholeFileId;
+      if (!method || !path3) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path3) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -1316,280 +1402,6 @@ function createCloudflareResolveTarget(config, graph) {
   };
 }
 
-// src/connectors-config.ts
-import os from "os";
-import path from "path";
-import { promises as fs } from "fs";
-var CONNECTORS_CONFIG_VERSION = 1;
-var EnvRefUnsetError = class extends Error {
-  ref;
-  varName;
-  constructor(ref, varName) {
-    super(`${ref} is unset`);
-    this.name = "EnvRefUnsetError";
-    this.ref = ref;
-    this.varName = varName;
-  }
-};
-function neatHome() {
-  const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path.resolve(override);
-  return path.join(os.homedir(), ".neat");
-}
-function connectorsConfigPath(home = neatHome()) {
-  return path.join(home, "connectors.json");
-}
-var MODE_MASK_LOOSER_THAN_0600 = 63;
-async function warnIfModeLooserThan0600(file) {
-  if (process.platform === "win32") return;
-  try {
-    const stat = await fs.stat(file);
-    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
-      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
-      console.warn(
-        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
-      );
-    }
-  } catch {
-  }
-}
-async function readConnectorsConfig(home = neatHome()) {
-  const file = connectorsConfigPath(home);
-  let raw;
-  try {
-    raw = await fs.readFile(file, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
-    }
-    throw err;
-  }
-  await warnIfModeLooserThan0600(file);
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`${file} is not valid JSON: ${err.message}`);
-  }
-  return validateConfig(parsed, file);
-}
-function validateConfig(parsed, file) {
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${file} must be a JSON object with a "connectors" array`);
-  }
-  const obj = parsed;
-  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
-  if (typeof version !== "number" || !Number.isInteger(version)) {
-    throw new Error(`${file}: "version" must be an integer`);
-  }
-  const rawConnectors = obj.connectors;
-  if (!Array.isArray(rawConnectors)) {
-    throw new Error(`${file}: "connectors" must be an array`);
-  }
-  const connectors = rawConnectors.map((entry, i) => validateEntry(entry, i, file));
-  return { version, connectors };
-}
-function validateEntry(entry, index, file) {
-  const where = `${file}: connectors[${index}]`;
-  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-    throw new Error(`${where} must be an object`);
-  }
-  const e = entry;
-  const id = e.id;
-  if (typeof id !== "string" || id.length === 0) {
-    throw new Error(`${where}.id must be a non-empty string`);
-  }
-  const provider = e.provider;
-  if (typeof provider !== "string" || provider.length === 0) {
-    throw new Error(`${where}.provider must be a non-empty string`);
-  }
-  if (e.project !== void 0 && typeof e.project !== "string") {
-    throw new Error(`${where}.project must be a string when present`);
-  }
-  const credential = validateCredentialRef(e.credential, `${where}.credential`);
-  let options;
-  if (e.options !== void 0) {
-    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
-      throw new Error(`${where}.options must be an object when present`);
-    }
-    options = e.options;
-  }
-  return {
-    id,
-    provider,
-    ...typeof e.project === "string" ? { project: e.project } : {},
-    credential,
-    ...options ? { options } : {}
-  };
-}
-function validateCredentialRef(raw, where) {
-  if (typeof raw === "string") {
-    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
-    return raw;
-  }
-  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
-    const fields = raw;
-    const keys = Object.keys(fields);
-    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
-    for (const key of keys) {
-      const v = fields[key];
-      if (typeof v !== "string" || v.length === 0) {
-        throw new Error(`${where}.${key} must be a non-empty string`);
-      }
-    }
-    return fields;
-  }
-  throw new Error(`${where} must be a string or an object of strings`);
-}
-function resolveCredential(ref, env = process.env) {
-  if (typeof ref === "string") {
-    return { kind: "single", value: resolveRef(ref, env) };
-  }
-  const fields = {};
-  for (const [key, value] of Object.entries(ref)) {
-    fields[key] = resolveRef(value, env);
-  }
-  return { kind: "fields", fields };
-}
-function resolveRef(value, env) {
-  if (value.length > 1 && value.startsWith("$")) {
-    const varName = value.slice(1);
-    const resolved = env[varName];
-    if (resolved === void 0 || resolved.length === 0) {
-      throw new EnvRefUnsetError(value, varName);
-    }
-    return resolved;
-  }
-  return value;
-}
-function connectorMatchesProject(entry, project) {
-  return entry.project === void 0 || entry.project === project;
-}
-var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
-var CONNECTORS_LOCK_RETRY_MS = 50;
-function connectorsConfigLockPath(home = neatHome()) {
-  return path.join(home, "connectors.json.lock");
-}
-function isEnvRef(value) {
-  return value.length > 1 && value.startsWith("$");
-}
-async function writeConfigAtomically0600(file, contents) {
-  await fs.mkdir(path.dirname(file), { recursive: true });
-  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs.open(tmp, "w", 384);
-  try {
-    await fd.writeFile(contents, "utf8");
-    await fd.chmod(384);
-    await fd.sync();
-  } finally {
-    await fd.close();
-  }
-  await fs.rename(tmp, file);
-}
-async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
-  const deadline = Date.now() + timeoutMs;
-  await fs.mkdir(path.dirname(lockPath), { recursive: true });
-  for (; ; ) {
-    try {
-      const fd = await fs.open(lockPath, "wx");
-      try {
-        await fd.writeFile(`${process.pid}
-`, "utf8");
-      } finally {
-        await fd.close();
-      }
-      return;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      if (Date.now() >= deadline) {
-        throw new Error(
-          `neat connector: timed out after ${timeoutMs}ms waiting for ${lockPath}. Another neat process may be writing the connector config; if none is, remove that file by hand.`
-        );
-      }
-      await new Promise((r) => setTimeout(r, CONNECTORS_LOCK_RETRY_MS));
-    }
-  }
-}
-async function releaseConnectorsLock(lockPath) {
-  await fs.unlink(lockPath).catch(() => {
-  });
-}
-async function withConnectorsLock(home, fn) {
-  const lock = connectorsConfigLockPath(home);
-  await acquireConnectorsLock(lock);
-  try {
-    return await fn();
-  } finally {
-    await releaseConnectorsLock(lock);
-  }
-}
-function serializeConfig(config) {
-  return JSON.stringify(
-    { version: config.version ?? CONNECTORS_CONFIG_VERSION, connectors: config.connectors },
-    null,
-    2
-  ) + "\n";
-}
-async function upsertConnectorEntry(entry, home = neatHome()) {
-  const file = connectorsConfigPath(home);
-  return withConnectorsLock(home, async () => {
-    const config = await readConnectorsConfig(home);
-    validateEntry(entry, config.connectors.length, file);
-    const idx = config.connectors.findIndex((c) => c.id === entry.id);
-    const replaced = idx >= 0;
-    if (replaced) config.connectors[idx] = entry;
-    else config.connectors.push(entry);
-    await writeConfigAtomically0600(file, serializeConfig(config));
-    return { replaced };
-  });
-}
-async function removeConnectorEntry(id, home = neatHome()) {
-  const file = connectorsConfigPath(home);
-  return withConnectorsLock(home, async () => {
-    const config = await readConnectorsConfig(home);
-    const idx = config.connectors.findIndex((c) => c.id === id);
-    if (idx < 0) return void 0;
-    const [removed] = config.connectors.splice(idx, 1);
-    await writeConfigAtomically0600(file, serializeConfig(config));
-    return removed;
-  });
-}
-function slugFragment(value) {
-  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function autoSlugConnectorId(provider, project, existingIds) {
-  const base = slugFragment(provider) || "connector";
-  if (!existingIds.has(base)) return base;
-  const projectFrag = project ? slugFragment(project) : "";
-  if (projectFrag) {
-    const withProject = `${base}-${projectFrag}`;
-    if (!existingIds.has(withProject)) return withProject;
-  }
-  const stem = projectFrag ? `${base}-${projectFrag}` : base;
-  for (let n = 2; ; n++) {
-    const candidate = `${stem}-${n}`;
-    if (!existingIds.has(candidate)) return candidate;
-  }
-}
-function describeCredential(ref, env = process.env) {
-  const one = (value, field) => {
-    if (isEnvRef(value)) {
-      const varName = value.slice(1);
-      const resolved = env[varName];
-      const set = typeof resolved === "string" && resolved.length > 0;
-      return {
-        ...field ? { field } : {},
-        kind: "env-ref",
-        display: value,
-        status: set ? "set" : "unset"
-      };
-    }
-    return { ...field ? { field } : {}, kind: "plaintext", display: "****" };
-  };
-  if (typeof ref === "string") return [one(ref)];
-  return Object.entries(ref).map(([k, v]) => one(v, k));
-}
-
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -1778,6 +1590,9 @@ function buildRegistration(entry, graph, env = process.env) {
   return {
     ok: true,
     registration: {
+      // Carry the entry id so the daemon can key this connector's poll-status
+      // records to it (ADR-136).
+      id: entry.id,
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
@@ -1833,8 +1648,8 @@ async function loadConnectorRegistrations(input) {
 }
 
 // src/unrouted.ts
-import { promises as fs2 } from "fs";
-import path2 from "path";
+import { promises as fs } from "fs";
+import path from "path";
 function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
   return {
     timestamp: now.toISOString(),
@@ -1843,39 +1658,39 @@ function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new
     traceId: traceId ?? null
   };
 }
-async function appendUnroutedSpan(neatHome2, record) {
-  const target = path2.join(neatHome2, "errors.ndjson");
-  await fs2.mkdir(neatHome2, { recursive: true });
-  await fs2.appendFile(target, JSON.stringify(record) + "\n", "utf8");
+async function appendUnroutedSpan(neatHome, record) {
+  const target = path.join(neatHome, "errors.ndjson");
+  await fs.mkdir(neatHome, { recursive: true });
+  await fs.appendFile(target, JSON.stringify(record) + "\n", "utf8");
 }
-function unroutedErrorsPath(neatHome2) {
-  return path2.join(neatHome2, "errors.ndjson");
+function unroutedErrorsPath(neatHome) {
+  return path.join(neatHome, "errors.ndjson");
 }
 
 // src/daemon.ts
 import { NodeType as NodeType4 } from "@neat.is/types";
 function daemonJsonPath(scanPath) {
-  return path3.join(scanPath, "neat-out", "daemon.json");
+  return path2.join(scanPath, "neat-out", "daemon.json");
 }
 function daemonsDiscoveryDir(home) {
   const base = home && home.length > 0 ? home : neatHomeFromEnv();
-  return path3.join(base, "daemons");
+  return path2.join(base, "daemons");
 }
 function daemonDiscoveryPath(project, home) {
-  return path3.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+  return path2.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
 }
 function sanitizeDiscoveryName(project) {
   return project.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function neatHomeFromEnv() {
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return path3.resolve(env);
+  if (env && env.length > 0) return path2.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path3.join(home, ".neat");
+  return path2.join(home, ".neat");
 }
 async function readDaemonRecord(scanPath) {
   try {
-    const raw = await fs3.readFile(daemonJsonPath(scanPath), "utf8");
+    const raw = await fs2.readFile(daemonJsonPath(scanPath), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
       return parsed;
@@ -1915,7 +1730,7 @@ async function clearDaemonRecord(record, home) {
   } catch {
   }
   try {
-    await fs3.unlink(daemonDiscoveryPath(record.project, home));
+    await fs2.unlink(daemonDiscoveryPath(record.project, home));
   } catch {
   }
 }
@@ -1952,11 +1767,11 @@ function teardownSlot(slot) {
   }
 }
 function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return path3.resolve(opts.neatHome);
+  if (opts.neatHome && opts.neatHome.length > 0) return path2.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return path3.resolve(env);
+  if (env && env.length > 0) return path2.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path3.join(home, ".neat");
+  return path2.join(home, ".neat");
 }
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
@@ -2003,10 +1818,10 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
     (_id, attrs) => attrs.type === NodeType4.ServiceNode && attrs.name === serviceName
   );
 }
-async function bootstrapProject(entry, connectors = [], neatHome2) {
-  const paths = pathsForProject(entry.name, path3.join(entry.path, "neat-out"));
+async function bootstrapProject(entry, connectors = [], neatHome) {
+  const paths = pathsForProject(entry.name, path2.join(entry.path, "neat-out"));
   try {
-    const stat = await fs3.stat(entry.path);
+    const stat = await fs2.stat(entry.path);
     if (!stat.isDirectory()) {
       throw new Error(`registered path ${entry.path} is not a directory`);
     }
@@ -2044,10 +1859,10 @@ async function bootstrapProject(entry, connectors = [], neatHome2) {
       staleEventsPath: paths.staleEventsPath,
       project: entry.name
     });
-    const fileConnectors = neatHome2 ? await loadConnectorRegistrations({
+    const fileConnectors = neatHome ? await loadConnectorRegistrations({
       project: entry.name,
       graph,
-      home: neatHome2,
+      home: neatHome,
       onSkip: (skipped, reason) => console.warn(
         `neatd: connector "${skipped.id}" (${skipped.provider}) skipped for project "${entry.name}" \u2014 ${reason}`
       )
@@ -2059,7 +1874,11 @@ async function bootstrapProject(entry, connectors = [], neatHome2) {
         { projectDir: entry.path, credentials: registration.credentials },
         graph,
         registration.resolveTarget,
-        { intervalMs: registration.intervalMs }
+        // `connectorId` is threaded through so every tick lands in the
+        // in-process status tracker the connector-status endpoint reads
+        // (ADR-136). Undefined for a programmatic registration, which records
+        // nothing.
+        { intervalMs: registration.intervalMs, connectorId: registration.id }
       )
     );
     const stopConnectors = () => {
@@ -2131,7 +1950,7 @@ async function startDaemon(opts = {}) {
   const projectArg = typeof opts.project === "string" && opts.project.length > 0 ? opts.project : process.env.NEAT_PROJECT && process.env.NEAT_PROJECT.length > 0 ? process.env.NEAT_PROJECT : null;
   const projectPathArg = opts.projectPath && opts.projectPath.length > 0 ? opts.projectPath : process.env.NEAT_PROJECT_PATH && process.env.NEAT_PROJECT_PATH.length > 0 ? process.env.NEAT_PROJECT_PATH : null;
   const singleProject = projectArg;
-  const singleProjectPath = singleProject && projectPathArg ? path3.resolve(projectPathArg) : null;
+  const singleProjectPath = singleProject && projectPathArg ? path2.resolve(projectPathArg) : null;
   if (singleProject && !singleProjectPath) {
     throw new Error(
       `neatd: project "${singleProject}" given without a projectPath; pass NEAT_PROJECT_PATH alongside NEAT_PROJECT.`
@@ -2139,14 +1958,14 @@ async function startDaemon(opts = {}) {
   }
   if (!singleProject) {
     try {
-      await fs3.access(regPath);
+      await fs2.access(regPath);
     } catch {
       throw new Error(
         `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
       );
     }
   }
-  const pidPath = path3.join(home, "neatd.pid");
+  const pidPath = path2.join(home, "neatd.pid");
   await writeAtomically(pidPath, `${process.pid}
 `);
   const slots = /* @__PURE__ */ new Map();
@@ -2328,7 +2147,12 @@ async function startDaemon(opts = {}) {
         // only this project (the dashboard pins to it), and the daemon-wide
         // `/health` carries it at the top level for the spawn-reuse identity
         // check. Absent for the legacy multi-project daemon.
-        singleProject: singleProject && singleProjectPath ? { name: singleProject, path: singleProjectPath } : void 0
+        singleProject: singleProject && singleProjectPath ? { name: singleProject, path: singleProjectPath } : void 0,
+        // ADR-136 — the connector-status endpoint reads ~/.neat/connectors.json
+        // through the same resolved home the slot bootstrap read it from, so a
+        // daemon given an explicit NEAT_HOME serves status for the same file it
+        // polls.
+        connectorsHome: home
       });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(
@@ -2340,7 +2164,7 @@ async function startDaemon(opts = {}) {
       }
       if (restApp) await restApp.close().catch(() => {
       });
-      await fs3.unlink(pidPath).catch(() => {
+      await fs2.unlink(pidPath).catch(() => {
       });
       throw new Error(
         `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
@@ -2466,7 +2290,7 @@ async function startDaemon(opts = {}) {
       });
       if (otlpApp) await otlpApp.close().catch(() => {
       });
-      await fs3.unlink(pidPath).catch(() => {
+      await fs2.unlink(pidPath).catch(() => {
       });
       throw new Error(
         `neatd: failed to bind OTLP on port ${otlpPort} \u2014 ${err.message}`
@@ -2501,7 +2325,7 @@ async function startDaemon(opts = {}) {
         });
         if (otlpApp) await otlpApp.close().catch(() => {
         });
-        await fs3.unlink(pidPath).catch(() => {
+        await fs2.unlink(pidPath).catch(() => {
         });
         throw new Error(
           `neatd: failed to write daemon.json for "${singleProject}" \u2014 ${err.message}`
@@ -2548,8 +2372,8 @@ async function startDaemon(opts = {}) {
   let registryWatcher = null;
   let reloadTimer = null;
   if (!singleProject) try {
-    const regDir = path3.dirname(regPath);
-    const regBase = path3.basename(regPath);
+    const regDir = path2.dirname(regPath);
+    const regBase = path2.basename(regPath);
     registryWatcher = watch(regDir, (_eventType, filename) => {
       if (filename !== null && filename !== regBase) return;
       if (reloadTimer) clearTimeout(reloadTimer);
@@ -2599,7 +2423,7 @@ async function startDaemon(opts = {}) {
     if (daemonRecord) {
       await clearDaemonRecord(daemonRecord, home);
     }
-    await fs3.unlink(pidPath).catch(() => {
+    await fs2.unlink(pidPath).catch(() => {
     });
   };
   return {
@@ -2617,12 +2441,6 @@ async function startDaemon(opts = {}) {
 }
 
 export {
-  readConnectorsConfig,
-  isEnvRef,
-  upsertConnectorEntry,
-  removeConnectorEntry,
-  autoSlugConnectorId,
-  describeCredential,
   PROVIDER_DISPATCH,
   getProviderDispatch,
   validateConnectorEntry,
@@ -2636,4 +2454,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-UJ6WBLIE.js.map
+//# sourceMappingURL=chunk-V2HUBS5J.js.map