@neat.is/core 0.4.28-dev.20260712 → 0.4.28-dev.20260714

package/dist/neatd.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req2, reply, done) => {
-    const path50 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path50) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path50)) {
+    const path53 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path53) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path53)) {
       done();
       return;
     }
@@ -194,8 +194,8 @@ function reshapeGrpcRequest(req2) {
   };
 }
 function resolveProtoRoot() {
-  const here = import_node_path43.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
-  return import_node_path43.default.resolve(here, "..", "proto");
+  const here = import_node_path47.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path47.default.resolve(here, "..", "proto");
 }
 function loadTraceService() {
   const protoRoot = resolveProtoRoot();
@@ -263,13 +263,13 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path43, import_node_crypto2, grpc, protoLoader;
+var import_node_url, import_node_path47, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
-    import_node_path43 = __toESM(require("path"), 1);
+    import_node_path47 = __toESM(require("path"), 1);
     import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
@@ -362,8 +362,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path50 = q === -1 ? v : v.slice(0, q);
-      if (path50.length > 0) return path50;
+      const path53 = q === -1 ? v : v.slice(0, q);
+      if (path53.length > 0) return path53;
     }
   }
   return void 0;
@@ -417,10 +417,10 @@ function parseOtlpRequest(body) {
   return out;
 }
 function loadProtoRoot() {
-  const here = import_node_path44.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
-  const protoRoot = import_node_path44.default.resolve(here, "..", "proto");
+  const here = import_node_path48.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path48.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
-  root.resolvePath = (_origin, target) => import_node_path44.default.resolve(protoRoot, target);
+  root.resolvePath = (_origin, target) => import_node_path48.default.resolve(protoRoot, target);
   root.loadSync(
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
@@ -648,12 +648,12 @@ async function listenSteppingOtlp(app, requestedPort, host) {
     }
   }
 }
-var import_node_path44, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody, OTLP_STEP_ATTEMPTS, OTLP_STEP_STRIDE;
+var import_node_path48, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody, OTLP_STEP_ATTEMPTS, OTLP_STEP_STRIDE;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path44 = __toESM(require("path"), 1);
+    import_node_path48 = __toESM(require("path"), 1);
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
@@ -676,14 +676,14 @@ __export(neatd_exports, {
 });
 module.exports = __toCommonJS(neatd_exports);
 init_cjs_shims();
-var import_node_fs30 = require("fs");
-var import_node_path49 = __toESM(require("path"), 1);
+var import_node_fs33 = require("fs");
+var import_node_path52 = __toESM(require("path"), 1);
 var import_node_module2 = require("module");
 
 // src/daemon.ts
 init_cjs_shims();
-var import_node_fs28 = require("fs");
-var import_node_path47 = __toESM(require("path"), 1);
+var import_node_fs31 = require("fs");
+var import_node_path50 = __toESM(require("path"), 1);
 var import_node_module = require("module");
 
 // src/graph.ts
@@ -1213,19 +1213,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path50, edges) {
-    if (path50.length > best.path.length) {
-      best = { path: [...path50], edges: [...edges] };
+  function step(node, path53, edges) {
+    if (path53.length > best.path.length) {
+      best = { path: [...path53], edges: [...edges] };
     }
-    if (path50.length - 1 >= maxDepth) return;
+    if (path53.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path50.push(srcId);
+      path53.push(srcId);
       edges.push(edge);
-      step(srcId, path50, edges);
-      path50.pop();
+      step(srcId, path53, edges);
+      path53.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1419,26 +1419,26 @@ function dominantFailingCall(graph, serviceId5, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path50 = [originServiceId];
+  const path53 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path50.push(hop.nextService);
+    path53.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path50, edges, culprit: current };
+  return { path: path53, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path50 = [...chain.path];
+  const path53 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1446,14 +1446,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path50.push(loc.fileNode);
+      path53.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path50,
+      traversalPath: path53,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1465,7 +1465,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path50,
+    traversalPath: path53,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -6458,6 +6458,39 @@ function classifyImage(image) {
   if (last.startsWith("memcached")) return "memcached";
   return "container";
 }
+function lineContaining(raw, needle) {
+  if (!needle) return void 0;
+  const idx = raw.indexOf(needle);
+  if (idx === -1) return void 0;
+  let line = 1;
+  for (let i = 0; i < idx; i++) if (raw[i] === "\n") line++;
+  return line;
+}
+function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provider, evidenceFile, line) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const node = makeInfraNode(kind, name, provider);
+  if (!graph.hasNode(node.id)) {
+    graph.addNode(node.id, node);
+    nodesAdded++;
+  }
+  if (node.id === anchorId) return { nodesAdded, edgesAdded };
+  const edgeId = (0, import_types4.extractedEdgeId)(anchorId, node.id, edgeType);
+  if (!graph.hasEdge(edgeId)) {
+    const edge = {
+      id: edgeId,
+      source: anchorId,
+      target: node.id,
+      type: edgeType,
+      provenance: import_types21.Provenance.EXTRACTED,
+      confidence: (0, import_types21.confidenceForExtracted)("structural"),
+      evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
+    };
+    graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/infra/docker-compose.ts
 function dependsOnList(value) {
@@ -6817,7 +6850,7 @@ async function readWranglerConfig(dir) {
   }
   return null;
 }
-function lineContaining(raw, needle) {
+function lineContaining2(raw, needle) {
   if (!needle) return void 0;
   const idx = raw.indexOf(needle);
   if (idx === -1) return void 0;
@@ -6941,7 +6974,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-route",
         route,
         evidenceFile,
-        lineContaining(raw, route)
+        lineContaining2(raw, route)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -6965,7 +6998,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
           group.kind,
           name,
           evidenceFile,
-          lineContaining(raw, name)
+          lineContaining2(raw, name)
         );
         nodesAdded += result.nodesAdded;
         edgesAdded += result.edgesAdded;
@@ -6979,7 +7012,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-cron",
         cron,
         evidenceFile,
-        lineContaining(raw, cron)
+        lineContaining2(raw, cron)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -6992,7 +7025,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-env-var",
         varName,
         evidenceFile,
-        lineContaining(raw, varName)
+        lineContaining2(raw, varName)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -7010,7 +7043,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
             type: import_types25.EdgeType.CALLS,
             provenance: import_types25.Provenance.EXTRACTED,
             confidence: (0, import_types25.confidenceForExtracted)("structural"),
-            evidence: { file: evidenceFile, line: lineContaining(raw, svc.service) }
+            evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
           edgesAdded++;
@@ -7024,11 +7057,208 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
-        lineContaining(raw, svc.service)
+        lineContaining2(raw, svc.service)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/vercel.ts
+init_cjs_shims();
+var import_node_fs20 = require("fs");
+var import_node_path36 = __toESM(require("path"), 1);
+var import_types26 = require("@neat.is/types");
+var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
+async function readVercelConfig(dir) {
+  for (const filename of VERCEL_CONFIG_FILENAMES) {
+    const abs = import_node_path36.default.join(dir, filename);
+    if (!await exists(abs)) continue;
+    const raw = await import_node_fs20.promises.readFile(abs, "utf8");
+    const config = JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+async function readLinkedProjectName(dir) {
+  const abs = import_node_path36.default.join(dir, ".vercel", "project.json");
+  if (!await exists(abs)) return void 0;
+  const parsed = JSON.parse(await import_node_fs20.promises.readFile(abs, "utf8"));
+  return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
+}
+function routeSource(route) {
+  return route.source ?? route.src;
+}
+async function addVercelServices(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    let projectName;
+    try {
+      read = await readVercelConfig(service.dir);
+      projectName = await readLinkedProjectName(service.dir);
+    } catch (err) {
+      recordExtractionError("infra vercel", import_node_path36.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read && !projectName) continue;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "vercel" || projectName && serviceNode.platformName !== projectName) {
+      const updated = {
+        ...serviceNode,
+        platform: "vercel",
+        ...projectName ? { platformName: projectName } : {}
+      };
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+    const anchorId = service.node.id;
+    if (!read) continue;
+    const { config, relFile, raw } = read;
+    const evidenceFile = toPosix2(import_node_path36.default.relative(scanPath, import_node_path36.default.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "vercel",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(import_types26.EdgeType.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(import_types26.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(import_types26.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types26.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
+      add(import_types26.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/railway.ts
+init_cjs_shims();
+var import_node_fs21 = require("fs");
+var import_node_path37 = __toESM(require("path"), 1);
+var import_smol_toml3 = require("smol-toml");
+var import_types27 = require("@neat.is/types");
+var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
+async function readRailwayConfig(dir) {
+  for (const filename of RAILWAY_FILENAMES) {
+    const abs = import_node_path37.default.join(dir, filename);
+    if (!await exists(abs)) continue;
+    const raw = await import_node_fs21.promises.readFile(abs, "utf8");
+    const config = filename === "railway.toml" ? (0, import_smol_toml3.parse)(raw) : JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+async function addRailwayServices(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    try {
+      read = await readRailwayConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra railway", import_node_path37.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read) continue;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "railway") {
+      graph.replaceNodeAttributes(service.node.id, { ...serviceNode, platform: "railway" });
+    }
+    const anchorId = service.node.id;
+    const { config, relFile, raw } = read;
+    const evidenceFile = toPosix2(import_node_path37.default.relative(scanPath, import_node_path37.default.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "railway",
+        evidenceFile,
+        lineContaining(raw, name)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
+    };
+    add(import_types27.EdgeType.RUNS_ON, "railway", "railway");
+    add(import_types27.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(import_types27.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/supabase.ts
+init_cjs_shims();
+var import_node_fs22 = require("fs");
+var import_node_path38 = __toESM(require("path"), 1);
+var import_smol_toml4 = require("smol-toml");
+var import_types28 = require("@neat.is/types");
+async function readSupabaseConfig(dir) {
+  const relFile = import_node_path38.default.join("supabase", "config.toml");
+  const abs = import_node_path38.default.join(dir, relFile);
+  if (!await exists(abs)) return null;
+  const raw = await import_node_fs22.promises.readFile(abs, "utf8");
+  const config = (0, import_smol_toml4.parse)(raw);
+  return { config, relFile, raw };
+}
+async function addSupabaseProjects(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    try {
+      read = await readSupabaseConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra supabase", import_node_path38.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read) continue;
+    const { config, relFile, raw } = read;
+    const projectId = typeof config.project_id === "string" ? config.project_id : void 0;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "supabase" || projectId && serviceNode.platformName !== projectId) {
+      graph.replaceNodeAttributes(service.node.id, {
+        ...serviceNode,
+        platform: "supabase",
+        ...projectId ? { platformName: projectId } : {}
+      });
     }
+    const anchorId = service.node.id;
+    const evidenceFile = toPosix2(import_node_path38.default.relative(scanPath, import_node_path38.default.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "supabase",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(import_types28.EdgeType.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(import_types28.EdgeType.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(import_types28.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(import_types28.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
   }
   return { nodesAdded, edgesAdded };
 }
@@ -7040,24 +7270,27 @@ async function addInfra(graph, scanPath, services) {
   const terraform = await addTerraformResources(graph, scanPath);
   const k8s = await addK8sResources(graph, scanPath);
   const cloudflare = await addCloudflareWorkers(graph, services, scanPath);
+  const vercel = await addVercelServices(graph, services, scanPath);
+  const railway = await addRailwayServices(graph, services, scanPath);
+  const supabase = await addSupabaseProjects(graph, services, scanPath);
   return {
-    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded,
-    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded + vercel.nodesAdded + railway.nodesAdded + supabase.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded + vercel.edgesAdded + railway.edgesAdded + supabase.edgesAdded
   };
 }
 
 // src/extract/index.ts
-var import_node_path37 = __toESM(require("path"), 1);
+var import_node_path40 = __toESM(require("path"), 1);
 
 // src/extract/retire.ts
 init_cjs_shims();
-var import_node_fs20 = require("fs");
-var import_node_path36 = __toESM(require("path"), 1);
-var import_types26 = require("@neat.is/types");
+var import_node_fs23 = require("fs");
+var import_node_path39 = __toESM(require("path"), 1);
+var import_types29 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types26.NodeType.FileNode) return;
+    if (attrs.type !== import_types29.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -7070,14 +7303,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types26.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types29.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (import_node_path36.default.isAbsolute(evidenceFile)) {
-      if (!(0, import_node_fs20.existsSync)(evidenceFile)) toDrop.push(id);
+    if (import_node_path39.default.isAbsolute(evidenceFile)) {
+      if (!(0, import_node_fs23.existsSync)(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => (0, import_node_fs20.existsSync)(import_node_path36.default.join(base, evidenceFile)));
+    const found = bases.some((base) => (0, import_node_fs23.existsSync)(import_node_path39.default.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -7119,7 +7352,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = import_node_path37.default.join(import_node_path37.default.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = import_node_path40.default.join(import_node_path40.default.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -7153,9 +7386,9 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/persist.ts
 init_cjs_shims();
-var import_node_fs21 = require("fs");
-var import_node_path38 = __toESM(require("path"), 1);
-var import_types27 = require("@neat.is/types");
+var import_node_fs24 = require("fs");
+var import_node_path41 = __toESM(require("path"), 1);
+var import_types30 = require("@neat.is/types");
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -7177,12 +7410,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types27.Provenance.OBSERVED;
+      attrs.provenance = import_types30.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types27.observedEdgeId)(source, target, type);
+        const newId = (0, import_types30.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -7191,7 +7424,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await import_node_fs21.promises.mkdir(import_node_path38.default.dirname(filePath), { recursive: true });
+  await import_node_fs24.promises.mkdir(import_node_path41.default.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -7201,13 +7434,13 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  await import_node_fs21.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await import_node_fs21.promises.rename(tmp, outPath);
+  await import_node_fs24.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await import_node_fs24.promises.rename(tmp, outPath);
 }
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await import_node_fs21.promises.readFile(outPath, "utf8");
+    raw = await import_node_fs24.promises.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -7272,23 +7505,23 @@ function startPersistLoop(graph, outPath, opts = {}) {
 
 // src/projects.ts
 init_cjs_shims();
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: import_node_path39.default.join(baseDir, "graph.json"),
-      errorsPath: import_node_path39.default.join(baseDir, "errors.ndjson"),
-      staleEventsPath: import_node_path39.default.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: import_node_path39.default.join(baseDir, "embeddings.json"),
-      policyViolationsPath: import_node_path39.default.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: import_node_path42.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path42.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path42.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path42.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path42.default.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: import_node_path39.default.join(baseDir, `${project}.json`),
-    errorsPath: import_node_path39.default.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: import_node_path39.default.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: import_node_path39.default.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: import_node_path39.default.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: import_node_path42.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path42.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path42.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path42.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path42.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -7326,19 +7559,19 @@ var Projects = class {
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types30 = require("@neat.is/types");
+var import_types33 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
-var import_node_fs23 = require("fs");
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_fs26 = require("fs");
+var import_node_path44 = __toESM(require("path"), 1);
 var import_node_os2 = __toESM(require("os"), 1);
 var import_instrumentation_registry = require("@neat.is/instrumentation-registry");
 
 // src/installers/package-manager.ts
 init_cjs_shims();
-var import_node_fs22 = require("fs");
-var import_node_path40 = __toESM(require("path"), 1);
+var import_node_fs25 = require("fs");
+var import_node_path43 = __toESM(require("path"), 1);
 var import_node_child_process = require("child_process");
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -7353,29 +7586,29 @@ var LOCKFILE_PRIORITY = [
 var NPM_FALLBACK_ARGS = ["install", "--no-audit", "--no-fund", "--prefer-offline"];
 async function exists2(p) {
   try {
-    await import_node_fs22.promises.access(p);
+    await import_node_fs25.promises.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = import_node_path40.default.resolve(serviceDir);
+  let dir = import_node_path43.default.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = import_node_path40.default.join(dir, candidate.lockfile);
+      const lockPath = import_node_path43.default.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = import_node_path40.default.dirname(dir);
+    const parent = import_node_path43.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: import_node_path40.default.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: import_node_path43.default.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -7417,30 +7650,30 @@ ${err.message}`
 // src/extend/index.ts
 async function fileExists2(p) {
   try {
-    await import_node_fs23.promises.access(p);
+    await import_node_fs26.promises.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = import_node_path41.default.join(scanPath, "package.json");
-  const raw = await import_node_fs23.promises.readFile(pkgPath, "utf8");
+  const pkgPath = import_node_path44.default.join(scanPath, "package.json");
+  const raw = await import_node_fs26.promises.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
 async function findHookFiles(scanPath) {
-  const entries = await import_node_fs23.promises.readdir(scanPath);
+  const entries = await import_node_fs26.promises.readdir(scanPath);
   return entries.filter(
     (e) => (e.startsWith("instrumentation") || e.startsWith("otel-init")) && /\.(ts|js)$/.test(e)
   ).sort();
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? import_node_path41.default.join(import_node_os2.default.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? import_node_path44.default.join(import_node_os2.default.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry2) {
   const logPath = extendLogPath();
-  await import_node_fs23.promises.mkdir(import_node_path41.default.dirname(logPath), { recursive: true });
-  await import_node_fs23.promises.appendFile(logPath, JSON.stringify(entry2) + "\n", "utf8");
+  await import_node_fs26.promises.mkdir(import_node_path44.default.dirname(logPath), { recursive: true });
+  await import_node_fs26.promises.appendFile(logPath, JSON.stringify(entry2) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
   if (fileContent.includes("__INSTRUMENTATION_BLOCK__")) {
@@ -7498,7 +7731,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(import_node_path41.default.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(import_node_path44.default.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     (0, import_instrumentation_registry.list)().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -7520,31 +7753,31 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await import_node_fs23.promises.readFile(import_node_path41.default.join(ctx.scanPath, file), "utf8");
+    const content = await import_node_fs26.promises.readFile(import_node_path44.default.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
   }
   const primaryFile = hookFiles[0];
-  const primaryPath = import_node_path41.default.join(ctx.scanPath, primaryFile);
+  const primaryPath = import_node_path44.default.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = import_node_path41.default.join(ctx.scanPath, "package.json");
+  const pkgPath = import_node_path44.default.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
-    await import_node_fs23.promises.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    await import_node_fs26.promises.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     filesTouched.push("package.json");
     depsAdded.push(`${args.instrumentation_package}@${args.version}`);
   }
-  const hookContent = await import_node_fs23.promises.readFile(primaryPath, "utf8");
+  const hookContent = await import_node_fs26.promises.readFile(primaryPath, "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (!patched) {
     throw new Error(
       `Could not find instrumentation insertion point in ${primaryFile}. Expected __INSTRUMENTATION_BLOCK__, instrumentations.push(, or new NodeSDK(.`
     );
   }
-  await import_node_fs23.promises.writeFile(primaryPath, patched, "utf8");
+  await import_node_fs26.promises.writeFile(primaryPath, patched, "utf8");
   filesTouched.push(primaryFile);
   const cmd = await detectPackageManager(ctx.scanPath);
   const installer = options?.runInstall ?? runPackageManagerInstall;
@@ -7575,7 +7808,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await import_node_fs23.promises.readFile(import_node_path41.default.join(ctx.scanPath, file), "utf8");
+    const content = await import_node_fs26.promises.readFile(import_node_path44.default.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -7597,7 +7830,7 @@ async function dryRunExtension(ctx, args) {
     depsToAdd.push(`${args.instrumentation_package}@${args.version}`);
     filesTouched.push("package.json");
   }
-  const hookContent = await import_node_fs23.promises.readFile(import_node_path41.default.join(ctx.scanPath, primaryFile), "utf8");
+  const hookContent = await import_node_fs26.promises.readFile(import_node_path44.default.join(ctx.scanPath, primaryFile), "utf8");
   const patched = splicedContent(hookContent, args.registration_snippet);
   if (patched) {
     filesTouched.push(primaryFile);
@@ -7612,28 +7845,28 @@ async function rollbackExtension(ctx, args) {
   if (!await fileExists2(logPath)) {
     return { undone: false, message: "no apply found for library" };
   }
-  const raw = await import_node_fs23.promises.readFile(logPath, "utf8");
+  const raw = await import_node_fs26.promises.readFile(logPath, "utf8");
   const entries = raw.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line));
   const match = [...entries].reverse().find((e) => e.project === ctx.project && e.library === args.library);
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = import_node_path41.default.join(ctx.scanPath, "package.json");
+  const pkgPath = import_node_path44.default.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
       const { [match.instrumentation_package]: _removed, ...rest } = pkg.dependencies;
       pkg.dependencies = rest;
-      await import_node_fs23.promises.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+      await import_node_fs26.promises.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     }
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = import_node_path41.default.join(ctx.scanPath, file);
-    const content = await import_node_fs23.promises.readFile(filePath, "utf8");
+    const filePath = import_node_path44.default.join(ctx.scanPath, file);
+    const content = await import_node_fs26.promises.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
-      await import_node_fs23.promises.writeFile(filePath, filtered, "utf8");
+      await import_node_fs26.promises.writeFile(filePath, filtered, "utf8");
       break;
     }
   }
@@ -7645,7 +7878,7 @@ async function rollbackExtension(ctx, args) {
 
 // src/divergences.ts
 init_cjs_shims();
-var import_types28 = require("@neat.is/types");
+var import_types31 = require("@neat.is/types");
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
@@ -7653,22 +7886,22 @@ function bucketEdges(graph) {
   const buckets2 = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    const parsed = (0, import_types28.parseEdgeId)(id);
+    const parsed = (0, import_types31.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
     const key = bucketKey(e.source, e.target, e.type);
     const cur = buckets2.get(key) ?? { source: e.source, target: e.target, type: e.type };
     switch (provenance) {
-      case import_types28.Provenance.EXTRACTED:
+      case import_types31.Provenance.EXTRACTED:
         cur.extracted = e;
         break;
-      case import_types28.Provenance.OBSERVED:
+      case import_types31.Provenance.OBSERVED:
         cur.observed = e;
         break;
-      case import_types28.Provenance.INFERRED:
+      case import_types31.Provenance.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === import_types28.Provenance.STALE) cur.stale = e;
+        if (e.provenance === import_types31.Provenance.STALE) cur.stale = e;
     }
     buckets2.set(key, cur);
   });
@@ -7677,12 +7910,12 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types28.NodeType.FrontierNode;
+  return attrs.type === import_types31.NodeType.FrontierNode;
 }
 function nodeIsWebsocketChannel(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types28.NodeType.WebSocketChannelNode;
+  return attrs.type === import_types31.NodeType.WebSocketChannelNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -7702,14 +7935,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types28.EdgeType.CALLS,
-  import_types28.EdgeType.CONNECTS_TO,
-  import_types28.EdgeType.PUBLISHES_TO,
-  import_types28.EdgeType.CONSUMES_FROM
+  import_types31.EdgeType.CALLS,
+  import_types31.EdgeType.CONNECTS_TO,
+  import_types31.EdgeType.PUBLISHES_TO,
+  import_types31.EdgeType.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === import_types28.EdgeType.CONTAINS) return out;
+  if (bucket.type === import_types31.EdgeType.CONTAINS) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
       out.push({
@@ -7750,7 +7983,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === import_types28.EdgeType.CONFIGURED_BY && e.provenance === import_types28.Provenance.EXTRACTED) {
+    if (e.type === import_types31.EdgeType.CONFIGURED_BY && e.provenance === import_types31.Provenance.EXTRACTED) {
       return true;
     }
   }
@@ -7763,10 +7996,10 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types28.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types28.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types31.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types31.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types28.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types31.NodeType.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -7788,10 +8021,10 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types28.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types28.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types31.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types31.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types28.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types31.NodeType.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -7850,7 +8083,7 @@ function suppressHostMismatchHalves(all) {
   for (const d of all) {
     if (d.type !== "host-mismatch") continue;
     observedHalf.add(`${d.source}->${d.target}`);
-    declaredHalf.add((0, import_types28.databaseId)(d.extractedHost));
+    declaredHalf.add((0, import_types31.databaseId)(d.extractedHost));
   }
   if (observedHalf.size === 0) return all;
   return all.filter((d) => {
@@ -7869,7 +8102,7 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type !== import_types28.NodeType.ServiceNode) return;
+    if (n.type !== import_types31.NodeType.ServiceNode) return;
     const svc = n;
     for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
     for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
@@ -7903,7 +8136,7 @@ function computeDivergences(graph, opts = {}) {
     if (a.source !== b.source) return a.source.localeCompare(b.source);
     return a.target.localeCompare(b.target);
   });
-  return import_types28.DivergenceResultSchema.parse({
+  return import_types31.DivergenceResultSchema.parse({
     divergences: filtered,
     totalAffected: filtered.length,
     computedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -7957,7 +8190,7 @@ function queryLogEntries(opts) {
 
 // src/diff.ts
 init_cjs_shims();
-var import_node_fs24 = require("fs");
+var import_node_fs27 = require("fs");
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -7966,7 +8199,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await import_node_fs24.promises.readFile(target, "utf8");
+  const raw = await import_node_fs27.promises.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -8034,25 +8267,25 @@ function canonicalJson(value) {
 
 // src/registry.ts
 init_cjs_shims();
-var import_node_fs25 = require("fs");
+var import_node_fs28 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
-var import_types29 = require("@neat.is/types");
+var import_node_path45 = __toESM(require("path"), 1);
+var import_types32 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path42.default.resolve(override);
-  return import_node_path42.default.join(import_node_os3.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path45.default.resolve(override);
+  return import_node_path45.default.join(import_node_os3.default.homedir(), ".neat");
 }
 function registryPath() {
-  return import_node_path42.default.join(neatHome(), "projects.json");
+  return import_node_path45.default.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return import_node_path42.default.join(neatHome(), "projects.json.lock");
+  return import_node_path45.default.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return import_node_path42.default.join(neatHome(), "neatd.pid");
+  return import_node_path45.default.join(neatHome(), "neatd.pid");
 }
 function isPidAliveDefault(pid) {
   try {
@@ -8064,7 +8297,7 @@ function isPidAliveDefault(pid) {
 }
 async function readPidFile(file) {
   try {
-    const raw = await import_node_fs25.promises.readFile(file, "utf8");
+    const raw = await import_node_fs28.promises.readFile(file, "utf8");
     const pid = Number.parseInt(raw.trim(), 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
   } catch {
@@ -8112,24 +8345,24 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function writeAtomically(target, contents) {
-  await import_node_fs25.promises.mkdir(import_node_path42.default.dirname(target), { recursive: true });
+  await import_node_fs28.promises.mkdir(import_node_path45.default.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await import_node_fs25.promises.open(tmp, "w");
+  const fd = await import_node_fs28.promises.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await import_node_fs25.promises.rename(tmp, target);
+  await import_node_fs28.promises.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await import_node_fs25.promises.mkdir(import_node_path42.default.dirname(lockPath), { recursive: true });
+  await import_node_fs28.promises.mkdir(import_node_path45.default.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
-      const fd = await import_node_fs25.promises.open(lockPath, "wx");
+      const fd = await import_node_fs28.promises.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -8154,7 +8387,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaul
   }
 }
 async function releaseLock(lockPath) {
-  await import_node_fs25.promises.unlink(lockPath).catch(() => {
+  await import_node_fs28.promises.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -8170,7 +8403,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await import_node_fs25.promises.readFile(file, "utf8");
+    raw = await import_node_fs28.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -8178,10 +8411,10 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types29.RegistryFileSchema.parse(parsed);
+  return import_types32.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types29.RegistryFileSchema.parse(reg);
+  const validated = import_types32.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
 async function getProject(name) {
@@ -8225,7 +8458,7 @@ function pruneTtlMs() {
 }
 async function statPathStatus(p) {
   try {
-    const stat = await import_node_fs25.promises.stat(p);
+    const stat = await import_node_fs28.promises.stat(p);
     return stat.isDirectory() ? "present" : "unknown";
   } catch (err) {
     return err.code === "ENOENT" ? "gone" : "unknown";
@@ -8322,65 +8555,274 @@ data: ${JSON.stringify(envelope.payload)}
 
 // src/api.ts
 init_auth();
-function serializeGraph(graph) {
-  const nodes = [];
-  graph.forEachNode((_id, attrs) => {
-    nodes.push(attrs);
-  });
-  const edges = [];
-  graph.forEachEdge((_id, attrs) => {
-    edges.push(attrs);
-  });
-  return { nodes, edges };
-}
-function projectFromReq(req2, singleProject) {
-  const params = req2.params;
-  const named = params.project;
-  if (singleProject) {
-    return named === void 0 || named === DEFAULT_PROJECT ? singleProject : named;
+
+// src/connectors-config.ts
+init_cjs_shims();
+var import_node_os4 = __toESM(require("os"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
+var import_node_fs29 = require("fs");
+var CONNECTORS_CONFIG_VERSION = 1;
+var EnvRefUnsetError = class extends Error {
+  ref;
+  varName;
+  constructor(ref, varName) {
+    super(`${ref} is unset`);
+    this.name = "EnvRefUnsetError";
+    this.ref = ref;
+    this.varName = varName;
   }
-  return named ?? DEFAULT_PROJECT;
+};
+function neatHome2() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path46.default.resolve(override);
+  return import_node_path46.default.join(import_node_os4.default.homedir(), ".neat");
 }
-function resolveProject(registry, req2, reply, bootstrap, singleProject) {
-  const name = projectFromReq(req2, singleProject);
-  const ctx = registry.get(name);
-  if (!ctx) {
-    const phase = bootstrap?.status(name);
-    if (phase === "bootstrapping") {
-      void reply.code(503).send({ ready: false, project: name, status: "bootstrapping" });
-      return null;
-    }
-    if (phase === "broken") {
-      void reply.code(503).send({ ready: false, project: name, status: "broken" });
-      return null;
+function connectorsConfigPath(home = neatHome2()) {
+  return import_node_path46.default.join(home, "connectors.json");
+}
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await import_node_fs29.promises.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
+      );
     }
-    void reply.code(404).send({ error: "project not found", project: name });
-    return null;
+  } catch {
   }
-  return ctx;
 }
-function buildLegacyRegistry(opts) {
-  if (opts.projects) return opts.projects;
-  if (!opts.graph) {
-    throw new Error("buildApi: either `projects` or `graph` must be provided");
+async function readConnectorsConfig(home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  let raw;
+  try {
+    raw = await import_node_fs29.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
+    }
+    throw err;
   }
-  const registry = new Projects();
-  const paths = pathsForProject(DEFAULT_PROJECT, "");
-  registry.set(DEFAULT_PROJECT, {
-    graph: opts.graph,
-    scanPath: opts.scanPath,
-    paths: {
-      snapshotPath: paths.snapshotPath,
-      errorsPath: opts.errorsPath ?? paths.errorsPath,
-      staleEventsPath: opts.staleEventsPath ?? paths.staleEventsPath,
-      embeddingsCachePath: paths.embeddingsCachePath,
-      policyViolationsPath: paths.policyViolationsPath
-    },
-    searchIndex: opts.searchIndex
-  });
-  return registry;
+  await warnIfModeLooserThan0600(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig(parsed, file);
 }
-function registerRoutes(scope, ctx) {
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "connectors" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawConnectors = obj.connectors;
+  if (!Array.isArray(rawConnectors)) {
+    throw new Error(`${file}: "connectors" must be an array`);
+  }
+  const connectors = rawConnectors.map((entry2, i) => validateEntry(entry2, i, file));
+  return { version, connectors };
+}
+function validateEntry(entry2, index, file) {
+  const where = `${file}: connectors[${index}]`;
+  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry2;
+  const id = e.id;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error(`${where}.id must be a non-empty string`);
+  }
+  const provider = e.provider;
+  if (typeof provider !== "string" || provider.length === 0) {
+    throw new Error(`${where}.provider must be a non-empty string`);
+  }
+  if (e.project !== void 0 && typeof e.project !== "string") {
+    throw new Error(`${where}.project must be a string when present`);
+  }
+  const credential = validateCredentialRef(e.credential, `${where}.credential`);
+  let options;
+  if (e.options !== void 0) {
+    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
+      throw new Error(`${where}.options must be an object when present`);
+    }
+    options = e.options;
+  }
+  return {
+    id,
+    provider,
+    ...typeof e.project === "string" ? { project: e.project } : {},
+    credential,
+    ...options ? { options } : {}
+  };
+}
+function validateCredentialRef(raw, where) {
+  if (typeof raw === "string") {
+    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
+    return raw;
+  }
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    const fields = raw;
+    const keys = Object.keys(fields);
+    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
+    for (const key of keys) {
+      const v = fields[key];
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`${where}.${key} must be a non-empty string`);
+      }
+    }
+    return fields;
+  }
+  throw new Error(`${where} must be a string or an object of strings`);
+}
+function resolveCredential(ref, env = process.env) {
+  if (typeof ref === "string") {
+    return { kind: "single", value: resolveRef(ref, env) };
+  }
+  const fields = {};
+  for (const [key, value] of Object.entries(ref)) {
+    fields[key] = resolveRef(value, env);
+  }
+  return { kind: "fields", fields };
+}
+function resolveRef(value, env) {
+  if (value.length > 1 && value.startsWith("$")) {
+    const varName = value.slice(1);
+    const resolved = env[varName];
+    if (resolved === void 0 || resolved.length === 0) {
+      throw new EnvRefUnsetError(value, varName);
+    }
+    return resolved;
+  }
+  return value;
+}
+function connectorMatchesProject(entry2, project) {
+  return entry2.project === void 0 || entry2.project === project;
+}
+function isEnvRef(value) {
+  return value.length > 1 && value.startsWith("$");
+}
+function redactCredentialRef(ref) {
+  const one = (value) => isEnvRef(value) ? value : "****";
+  if (typeof ref === "string") return one(ref);
+  const out = {};
+  for (const [key, value] of Object.entries(ref)) out[key] = one(value);
+  return out;
+}
+
+// src/connectors/status.ts
+init_cjs_shims();
+var CONNECTOR_STALE_THRESHOLD_MS = 5 * 6e4;
+var records = /* @__PURE__ */ new Map();
+var MAX_ERROR_LEN = 200;
+function sanitizePollError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  const collapsed = msg.replace(/\s+/g, " ").trim();
+  return collapsed.length > MAX_ERROR_LEN ? `${collapsed.slice(0, MAX_ERROR_LEN - 1)}\u2026` : collapsed;
+}
+function recordConnectorPoll(id, tick) {
+  const prev = records.get(id);
+  records.set(id, {
+    lastPollAt: tick.at,
+    lastOutcome: tick.outcome,
+    lastError: tick.outcome === "error" ? tick.error ?? null : null,
+    signalsLastPoll: tick.signalsLastPoll ?? 0,
+    lastOkAt: tick.outcome === "ok" ? tick.at : prev?.lastOkAt ?? null
+  });
+}
+function deriveState(rec, now, thresholdMs) {
+  if (rec.lastOutcome === "error") return "error";
+  const okAt = rec.lastOkAt ? Date.parse(rec.lastOkAt) : NaN;
+  if (!Number.isNaN(okAt) && now - okAt > thresholdMs) return "stale";
+  return "healthy";
+}
+function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_THRESHOLD_MS) {
+  const rec = records.get(id);
+  if (!rec) {
+    return {
+      state: "idle",
+      lastPollAt: null,
+      lastOutcome: null,
+      lastError: null,
+      signalsLastPoll: 0
+    };
+  }
+  return {
+    state: deriveState(rec, now, thresholdMs),
+    lastPollAt: rec.lastPollAt,
+    lastOutcome: rec.lastOutcome,
+    lastError: rec.lastError,
+    signalsLastPoll: rec.signalsLastPoll
+  };
+}
+
+// src/api.ts
+function serializeGraph(graph) {
+  const nodes = [];
+  graph.forEachNode((_id, attrs) => {
+    nodes.push(attrs);
+  });
+  const edges = [];
+  graph.forEachEdge((_id, attrs) => {
+    edges.push(attrs);
+  });
+  return { nodes, edges };
+}
+function projectFromReq(req2, singleProject) {
+  const params = req2.params;
+  const named = params.project;
+  if (singleProject) {
+    return named === void 0 || named === DEFAULT_PROJECT ? singleProject : named;
+  }
+  return named ?? DEFAULT_PROJECT;
+}
+function resolveProject(registry, req2, reply, bootstrap, singleProject) {
+  const name = projectFromReq(req2, singleProject);
+  const ctx = registry.get(name);
+  if (!ctx) {
+    const phase = bootstrap?.status(name);
+    if (phase === "bootstrapping") {
+      void reply.code(503).send({ ready: false, project: name, status: "bootstrapping" });
+      return null;
+    }
+    if (phase === "broken") {
+      void reply.code(503).send({ ready: false, project: name, status: "broken" });
+      return null;
+    }
+    void reply.code(404).send({ error: "project not found", project: name });
+    return null;
+  }
+  return ctx;
+}
+function buildLegacyRegistry(opts) {
+  if (opts.projects) return opts.projects;
+  if (!opts.graph) {
+    throw new Error("buildApi: either `projects` or `graph` must be provided");
+  }
+  const registry = new Projects();
+  const paths = pathsForProject(DEFAULT_PROJECT, "");
+  registry.set(DEFAULT_PROJECT, {
+    graph: opts.graph,
+    scanPath: opts.scanPath,
+    paths: {
+      snapshotPath: paths.snapshotPath,
+      errorsPath: opts.errorsPath ?? paths.errorsPath,
+      staleEventsPath: opts.staleEventsPath ?? paths.staleEventsPath,
+      embeddingsCachePath: paths.embeddingsCachePath,
+      policyViolationsPath: paths.policyViolationsPath
+    },
+    searchIndex: opts.searchIndex
+  });
+  return registry;
+}
+function registerRoutes(scope, ctx) {
   const { registry, startedAt, errorsPathFor, staleEventsPathFor } = ctx;
   scope.get("/events", (req2, reply) => {
     const proj = resolveProject(registry, req2, reply, ctx.bootstrap, ctx.singleProject);
@@ -8472,11 +8914,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req2.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types30.DivergenceTypeSchema.safeParse(c);
+        const r = import_types33.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types30.DivergenceTypeSchema.options
+            allowed: import_types33.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -8541,6 +8983,26 @@ function registerRoutes(scope, ctx) {
     const sliced = filtered.slice(0, safeLimit);
     return { count: sliced.length, total, logs: sliced };
   });
+  scope.get("/connectors", async (req2, reply) => {
+    const proj = resolveProject(registry, req2, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    let entries;
+    try {
+      entries = (await readConnectorsConfig(ctx.connectorsHome)).connectors;
+    } catch (err) {
+      return reply.code(500).send({
+        error: "connectors.json failed to read",
+        details: err.message
+      });
+    }
+    const connectors = entries.filter((entry2) => connectorMatchesProject(entry2, proj.name)).map((entry2) => ({
+      id: entry2.id,
+      provider: entry2.provider,
+      credentialRef: redactCredentialRef(entry2.credential),
+      status: getConnectorStatus(entry2.id)
+    }));
+    return { connectors };
+  });
   const incidentHistoryHandler = async (req2, reply) => {
     const proj = resolveProject(registry, req2, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -8727,7 +9189,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req2.query.severity) {
-      const sev = import_types30.PolicySeveritySchema.safeParse(req2.query.severity);
+      const sev = import_types33.PolicySeveritySchema.safeParse(req2.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -8766,7 +9228,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req2, reply) => {
     const proj = resolveProject(registry, req2, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types30.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
+    const parsed = import_types33.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -8911,9 +9373,11 @@ async function buildApi(opts) {
     trustProxy,
     publicRead
   });
+  const requiresAuth = authToken !== void 0 && authToken.length > 0 && trustProxy !== true;
   app.get("/api/config", async () => ({
     publicRead: publicRead === true,
-    authProxy: trustProxy === true
+    authProxy: trustProxy === true,
+    requiresAuth
   }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
@@ -8943,7 +9407,8 @@ async function buildApi(opts) {
     staleEventsPathFor,
     policyFilePathFor,
     bootstrap: opts.bootstrap,
-    singleProject: opts.singleProject?.name
+    singleProject: opts.singleProject?.name,
+    connectorsHome: opts.connectorsHome
   };
   app.get("/health", async () => {
     const uptimeMs = Date.now() - startedAt;
@@ -9085,16 +9550,31 @@ function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options =
   let stopped = false;
   let since = ctx.since;
   const intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const connectorId = options.connectorId;
   const onError = options.onError ?? ((err) => console.error(`[neatd] connector poll failed (${connector.provider})`, err));
   const tick = () => {
     if (stopped) return;
     void (async () => {
       const tickStartedAt = (/* @__PURE__ */ new Date()).toISOString();
       try {
-        await runConnectorPoll(connector, { ...ctx, since }, graph, resolveTarget);
+        const result = await runConnectorPoll(connector, { ...ctx, since }, graph, resolveTarget);
         since = tickStartedAt;
+        if (connectorId) {
+          recordConnectorPoll(connectorId, {
+            outcome: "ok",
+            at: tickStartedAt,
+            signalsLastPoll: result.signalCount
+          });
+        }
       } catch (err) {
         onError(err);
+        if (connectorId) {
+          recordConnectorPoll(connectorId, {
+            outcome: "error",
+            at: tickStartedAt,
+            error: sanitizePollError(err)
+          });
+        }
       }
     })();
   };
@@ -9393,6 +9873,30 @@ function buildEdgeLogsQuery(limit) {
     `limit ${safeLimit}`
   ].join("\n");
 }
+function logsAllHttpFailureMessage(status2) {
+  if (status2 === 401 || status2 === 403) {
+    return `supabase connector: logs.all request rejected (HTTP ${status2}). Check the Management API token, its analytics read scope, and --api-project-ref.`;
+  }
+  if (status2 === 404) {
+    return "supabase connector: logs.all project not found (HTTP 404). Check --api-project-ref.";
+  }
+  if (status2 === 429) {
+    return "supabase connector: logs.all rate-limited (HTTP 429). The connector will retry on the next poll; reduce poll cadence if this persists.";
+  }
+  if (status2 === 400) {
+    return "supabase connector: logs.all query rejected (HTTP 400). Provider details redacted; confirm the live log-query dialect before shipping this connector.";
+  }
+  return `supabase connector: logs.all request failed (HTTP ${status2}); provider details redacted.`;
+}
+function providerErrorDetails(error) {
+  if (!error || typeof error === "string") return "";
+  const parts = [];
+  if (typeof error.code === "number") parts.push(`code ${error.code}`);
+  if (typeof error.status === "string" && /^[A-Z0-9_.-]+$/.test(error.status)) {
+    parts.push(`status ${error.status}`);
+  }
+  return parts.length > 0 ? ` (${parts.join(", ")})` : "";
+}
 async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl = fetch) {
   const baseUrl = config.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
   const url = new URL(`${baseUrl}/v1/projects/${config.apiProjectRef}/analytics/endpoints/logs.all`);
@@ -9407,12 +9911,18 @@ async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl
     { provider: "supabase", accountKey: config.apiProjectRef, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`supabase connector: logs.all request failed (${res.status} ${res.statusText})`);
+    throw new Error(logsAllHttpFailureMessage(res.status));
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    throw new Error("supabase connector: logs.all returned invalid JSON; provider details redacted.");
   }
-  const body = await res.json();
   if (body.error) {
-    const message = typeof body.error === "string" ? body.error : body.error.message;
-    throw new Error(`supabase connector: logs.all returned an error (${message})`);
+    throw new Error(
+      `supabase connector: logs.all returned a provider error${providerErrorDetails(body.error)}; provider message redacted.`
+    );
   }
   return body.result ?? [];
 }
@@ -9444,10 +9954,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path50) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path50);
+function targetFromRestPath(path53) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path53);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path50);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path53);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -9550,19 +10060,19 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types32 = require("@neat.is/types");
+var import_types35 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types32.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types35.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types32.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types35.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types32.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types35.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types32.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types35.EdgeType.CALLS };
     }
     return null;
   };
@@ -9570,6 +10080,35 @@ function createSupabaseResolveTarget(graph, config) {
 
 // src/connectors/supabase/index.ts
 var DEFAULT_MAX_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
+function errorCode(err) {
+  const code = err?.code;
+  return typeof code === "string" && code.length > 0 ? code : void 0;
+}
+function describeSupabasePostgresSurfaceFailure(projectRef, err) {
+  const code = errorCode(err);
+  let reason;
+  switch (code) {
+    case "42501":
+      reason = "permission denied; grant pg_read_all_stats to the configured Postgres role";
+      break;
+    case "42P01":
+    case "42704":
+      reason = "pg_stat_statements is not enabled or visible to the configured Postgres role";
+      break;
+    case "28P01":
+    case "28000":
+      reason = "Postgres credential rejected";
+      break;
+    case "3D000":
+      reason = "database not found";
+      break;
+    default: {
+      const name = err instanceof Error && err.name ? err.name : "Error";
+      reason = code ? `${name} ${code}` : name;
+    }
+  }
+  return `supabase connector: pg_stat_statements surface unavailable for project ${projectRef} (${reason}); continuing with Management API log surface.`;
+}
 var SupabaseConnector = class {
   // `deps.fetchPgStatStatements` defaults to the real Postgres-backed
   // implementation; tests override it to exercise the "both surfaces
@@ -9601,12 +10140,18 @@ var SupabaseConnector = class {
     const signals = mapEdgeLogRowsToSignals(logRows);
     if (creds.postgresConnectionString) {
       const fetchStatements = this.deps.fetchPgStatStatements ?? fetchPgStatStatements;
-      const statementRows = await fetchStatements(
-        creds.postgresConnectionString,
-        this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
-        this.config.apiProjectRef
-      );
-      signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
+      try {
+        const statementRows = await fetchStatements(
+          creds.postgresConnectionString,
+          this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
+          this.config.apiProjectRef
+        );
+        signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
+      } catch (err) {
+        const summary = describeSupabasePostgresSurfaceFailure(this.config.apiProjectRef, err);
+        if (this.deps.onPostgresSurfaceError) this.deps.onPostgresSurfaceError(err, summary);
+        else console.warn(summary);
+      }
     }
     return signals;
   }
@@ -9620,7 +10165,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types36 = require("@neat.is/types");
+var import_types39 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -9765,7 +10310,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types36.NodeType.RouteNode) return;
+    if (node.type !== import_types39.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -9861,12 +10406,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types36.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types39.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types36.serviceId)(peerName), serviceName, edgeType: import_types36.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types39.serviceId)(peerName), serviceName, edgeType: import_types39.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -9981,9 +10526,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path50 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path50) return null;
-  return { resourceName, method, path: path50 };
+  const path53 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path53) return null;
+  return { resourceName, method, path: path53 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -10020,14 +10565,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req2) return null;
   if (!req2.requestMethod) return null;
   const method = req2.requestMethod.toUpperCase();
-  const path50 = pathFromRequestUrl(req2.requestUrl);
-  if (path50 === null) return null;
+  const path53 = pathFromRequestUrl(req2.requestUrl);
+  if (path53 === null) return null;
   const timestamp = entry2.timestamp;
   if (!timestamp) return null;
   const isError = typeof req2.status === "number" && req2.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path50 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path53 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -10044,7 +10589,7 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types37 = require("@neat.is/types");
+var import_types40 = require("@neat.is/types");
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -10059,7 +10604,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types37.NodeType.RouteNode) return;
+    if (node.type !== import_types40.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -10091,7 +10636,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types37.EdgeType.CALLS
+      edgeType: import_types40.EdgeType.CALLS
     };
   };
 }
@@ -10118,7 +10663,7 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types39 = require("@neat.is/types");
+var import_types42 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
@@ -10225,7 +10770,7 @@ function mapEventToSignal(event) {
   if (typeof timestampMs !== "number" || !Number.isFinite(timestampMs)) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path50 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path53 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -10233,7 +10778,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: new Date(timestampMs).toISOString(),
     method,
-    ...path50 ? { path: path50 } : {},
+    ...path53 ? { path: path53 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -10273,19 +10818,19 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types39.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types42.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path50) {
-  const normalizedPath = normalizePathTemplate(path50);
+function findMatchingRouteNode(graph, serviceName, method, path53) {
+  const normalizedPath = normalizePathTemplate(path53);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types39.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types42.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -10297,18 +10842,18 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path50 } = signal;
+    const { method, path: path53 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path50) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path50) ?? wholeFileId;
+      if (!method || !path53) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path53) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types39.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types42.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types39.EdgeType.CALLS
+        edgeType: import_types42.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -10317,169 +10862,18 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types39.EdgeType.CALLS
+        edgeType: import_types42.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types39.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types42.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types39.EdgeType.CALLS,
+      edgeType: import_types42.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
 }
 
-// src/connectors-config.ts
-init_cjs_shims();
-var import_node_os4 = __toESM(require("os"), 1);
-var import_node_path45 = __toESM(require("path"), 1);
-var import_node_fs26 = require("fs");
-var CONNECTORS_CONFIG_VERSION = 1;
-var EnvRefUnsetError = class extends Error {
-  ref;
-  varName;
-  constructor(ref, varName) {
-    super(`${ref} is unset`);
-    this.name = "EnvRefUnsetError";
-    this.ref = ref;
-    this.varName = varName;
-  }
-};
-function neatHome2() {
-  const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path45.default.resolve(override);
-  return import_node_path45.default.join(import_node_os4.default.homedir(), ".neat");
-}
-function connectorsConfigPath(home = neatHome2()) {
-  return import_node_path45.default.join(home, "connectors.json");
-}
-var MODE_MASK_LOOSER_THAN_0600 = 63;
-async function warnIfModeLooserThan0600(file) {
-  if (process.platform === "win32") return;
-  try {
-    const stat = await import_node_fs26.promises.stat(file);
-    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
-      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
-      console.warn(
-        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
-      );
-    }
-  } catch {
-  }
-}
-async function readConnectorsConfig(home = neatHome2()) {
-  const file = connectorsConfigPath(home);
-  let raw;
-  try {
-    raw = await import_node_fs26.promises.readFile(file, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
-    }
-    throw err;
-  }
-  await warnIfModeLooserThan0600(file);
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`${file} is not valid JSON: ${err.message}`);
-  }
-  return validateConfig(parsed, file);
-}
-function validateConfig(parsed, file) {
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${file} must be a JSON object with a "connectors" array`);
-  }
-  const obj = parsed;
-  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
-  if (typeof version !== "number" || !Number.isInteger(version)) {
-    throw new Error(`${file}: "version" must be an integer`);
-  }
-  const rawConnectors = obj.connectors;
-  if (!Array.isArray(rawConnectors)) {
-    throw new Error(`${file}: "connectors" must be an array`);
-  }
-  const connectors = rawConnectors.map((entry2, i) => validateEntry(entry2, i, file));
-  return { version, connectors };
-}
-function validateEntry(entry2, index, file) {
-  const where = `${file}: connectors[${index}]`;
-  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
-    throw new Error(`${where} must be an object`);
-  }
-  const e = entry2;
-  const id = e.id;
-  if (typeof id !== "string" || id.length === 0) {
-    throw new Error(`${where}.id must be a non-empty string`);
-  }
-  const provider = e.provider;
-  if (typeof provider !== "string" || provider.length === 0) {
-    throw new Error(`${where}.provider must be a non-empty string`);
-  }
-  if (e.project !== void 0 && typeof e.project !== "string") {
-    throw new Error(`${where}.project must be a string when present`);
-  }
-  const credential = validateCredentialRef(e.credential, `${where}.credential`);
-  let options;
-  if (e.options !== void 0) {
-    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
-      throw new Error(`${where}.options must be an object when present`);
-    }
-    options = e.options;
-  }
-  return {
-    id,
-    provider,
-    ...typeof e.project === "string" ? { project: e.project } : {},
-    credential,
-    ...options ? { options } : {}
-  };
-}
-function validateCredentialRef(raw, where) {
-  if (typeof raw === "string") {
-    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
-    return raw;
-  }
-  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
-    const fields = raw;
-    const keys = Object.keys(fields);
-    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
-    for (const key of keys) {
-      const v = fields[key];
-      if (typeof v !== "string" || v.length === 0) {
-        throw new Error(`${where}.${key} must be a non-empty string`);
-      }
-    }
-    return fields;
-  }
-  throw new Error(`${where} must be a string or an object of strings`);
-}
-function resolveCredential(ref, env = process.env) {
-  if (typeof ref === "string") {
-    return { kind: "single", value: resolveRef(ref, env) };
-  }
-  const fields = {};
-  for (const [key, value] of Object.entries(ref)) {
-    fields[key] = resolveRef(value, env);
-  }
-  return { kind: "fields", fields };
-}
-function resolveRef(value, env) {
-  if (value.length > 1 && value.startsWith("$")) {
-    const varName = value.slice(1);
-    const resolved = env[varName];
-    if (resolved === void 0 || resolved.length === 0) {
-      throw new EnvRefUnsetError(value, varName);
-    }
-    return resolved;
-  }
-  return value;
-}
-function connectorMatchesProject(entry2, project) {
-  return entry2.project === void 0 || entry2.project === project;
-}
-
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -10665,6 +11059,9 @@ function buildRegistration(entry2, graph, env = process.env) {
   return {
     ok: true,
     registration: {
+      // Carry the entry id so the daemon can key this connector's poll-status
+      // records to it (ADR-136).
+      id: entry2.id,
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
@@ -10699,8 +11096,8 @@ init_auth();
 
 // src/unrouted.ts
 init_cjs_shims();
-var import_node_fs27 = require("fs");
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_fs30 = require("fs");
+var import_node_path49 = __toESM(require("path"), 1);
 function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
   return {
     timestamp: now.toISOString(),
@@ -10710,34 +11107,34 @@ function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new
   };
 }
 async function appendUnroutedSpan(neatHome4, record) {
-  const target = import_node_path46.default.join(neatHome4, "errors.ndjson");
-  await import_node_fs27.promises.mkdir(neatHome4, { recursive: true });
-  await import_node_fs27.promises.appendFile(target, JSON.stringify(record) + "\n", "utf8");
+  const target = import_node_path49.default.join(neatHome4, "errors.ndjson");
+  await import_node_fs30.promises.mkdir(neatHome4, { recursive: true });
+  await import_node_fs30.promises.appendFile(target, JSON.stringify(record) + "\n", "utf8");
 }
 function unroutedErrorsPath(neatHome4) {
-  return import_node_path46.default.join(neatHome4, "errors.ndjson");
+  return import_node_path49.default.join(neatHome4, "errors.ndjson");
 }
 
 // src/daemon.ts
-var import_types42 = require("@neat.is/types");
+var import_types45 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
-  return import_node_path47.default.join(scanPath, "neat-out", "daemon.json");
+  return import_node_path50.default.join(scanPath, "neat-out", "daemon.json");
 }
 function daemonsDiscoveryDir(home) {
   const base = home && home.length > 0 ? home : neatHomeFromEnv();
-  return import_node_path47.default.join(base, "daemons");
+  return import_node_path50.default.join(base, "daemons");
 }
 function daemonDiscoveryPath(project, home) {
-  return import_node_path47.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+  return import_node_path50.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
 }
 function sanitizeDiscoveryName(project) {
   return project.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function neatHomeFromEnv() {
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path47.default.resolve(env);
+  if (env && env.length > 0) return import_node_path50.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path47.default.join(home, ".neat");
+  return import_node_path50.default.join(home, ".neat");
 }
 function resolveNeatVersion() {
   if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
@@ -10769,7 +11166,7 @@ async function clearDaemonRecord(record, home) {
   } catch {
   }
   try {
-    await import_node_fs28.promises.unlink(daemonDiscoveryPath(record.project, home));
+    await import_node_fs31.promises.unlink(daemonDiscoveryPath(record.project, home));
   } catch {
   }
 }
@@ -10778,12 +11175,12 @@ function reconcileDaemonRecordSync(record, home) {
     const stopped = { ...record, status: "stopped" };
     const target = daemonJsonPath(record.projectPath);
     const tmp = `${target}.${process.pid}.tmp`;
-    (0, import_node_fs28.writeFileSync)(tmp, JSON.stringify(stopped, null, 2) + "\n");
-    (0, import_node_fs28.renameSync)(tmp, target);
+    (0, import_node_fs31.writeFileSync)(tmp, JSON.stringify(stopped, null, 2) + "\n");
+    (0, import_node_fs31.renameSync)(tmp, target);
   } catch {
   }
   try {
-    (0, import_node_fs28.unlinkSync)(daemonDiscoveryPath(record.project, home));
+    (0, import_node_fs31.unlinkSync)(daemonDiscoveryPath(record.project, home));
   } catch {
   }
 }
@@ -10806,11 +11203,11 @@ function teardownSlot(slot) {
   }
 }
 function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path47.default.resolve(opts.neatHome);
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path50.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path47.default.resolve(env);
+  if (env && env.length > 0) return import_node_path50.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path47.default.join(home, ".neat");
+  return import_node_path50.default.join(home, ".neat");
 }
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
@@ -10854,13 +11251,13 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
   if (!serviceName) return true;
   if (serviceNameMatchesProject(serviceName, project)) return true;
   return graph.someNode(
-    (_id, attrs) => attrs.type === import_types42.NodeType.ServiceNode && attrs.name === serviceName
+    (_id, attrs) => attrs.type === import_types45.NodeType.ServiceNode && attrs.name === serviceName
   );
 }
 async function bootstrapProject(entry2, connectors = [], neatHome4) {
-  const paths = pathsForProject(entry2.name, import_node_path47.default.join(entry2.path, "neat-out"));
+  const paths = pathsForProject(entry2.name, import_node_path50.default.join(entry2.path, "neat-out"));
   try {
-    const stat = await import_node_fs28.promises.stat(entry2.path);
+    const stat = await import_node_fs31.promises.stat(entry2.path);
     if (!stat.isDirectory()) {
       throw new Error(`registered path ${entry2.path} is not a directory`);
     }
@@ -10913,7 +11310,11 @@ async function bootstrapProject(entry2, connectors = [], neatHome4) {
         { projectDir: entry2.path, credentials: registration.credentials },
         graph,
         registration.resolveTarget,
-        { intervalMs: registration.intervalMs }
+        // `connectorId` is threaded through so every tick lands in the
+        // in-process status tracker the connector-status endpoint reads
+        // (ADR-136). Undefined for a programmatic registration, which records
+        // nothing.
+        { intervalMs: registration.intervalMs, connectorId: registration.id }
       )
     );
     const stopConnectors = () => {
@@ -10985,7 +11386,7 @@ async function startDaemon(opts = {}) {
   const projectArg = typeof opts.project === "string" && opts.project.length > 0 ? opts.project : process.env.NEAT_PROJECT && process.env.NEAT_PROJECT.length > 0 ? process.env.NEAT_PROJECT : null;
   const projectPathArg = opts.projectPath && opts.projectPath.length > 0 ? opts.projectPath : process.env.NEAT_PROJECT_PATH && process.env.NEAT_PROJECT_PATH.length > 0 ? process.env.NEAT_PROJECT_PATH : null;
   const singleProject = projectArg;
-  const singleProjectPath = singleProject && projectPathArg ? import_node_path47.default.resolve(projectPathArg) : null;
+  const singleProjectPath = singleProject && projectPathArg ? import_node_path50.default.resolve(projectPathArg) : null;
   if (singleProject && !singleProjectPath) {
     throw new Error(
       `neatd: project "${singleProject}" given without a projectPath; pass NEAT_PROJECT_PATH alongside NEAT_PROJECT.`
@@ -10993,14 +11394,14 @@ async function startDaemon(opts = {}) {
   }
   if (!singleProject) {
     try {
-      await import_node_fs28.promises.access(regPath);
+      await import_node_fs31.promises.access(regPath);
     } catch {
       throw new Error(
         `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
       );
     }
   }
-  const pidPath = import_node_path47.default.join(home, "neatd.pid");
+  const pidPath = import_node_path50.default.join(home, "neatd.pid");
   await writeAtomically(pidPath, `${process.pid}
 `);
   const slots = /* @__PURE__ */ new Map();
@@ -11182,7 +11583,12 @@ async function startDaemon(opts = {}) {
         // only this project (the dashboard pins to it), and the daemon-wide
         // `/health` carries it at the top level for the spawn-reuse identity
         // check. Absent for the legacy multi-project daemon.
-        singleProject: singleProject && singleProjectPath ? { name: singleProject, path: singleProjectPath } : void 0
+        singleProject: singleProject && singleProjectPath ? { name: singleProject, path: singleProjectPath } : void 0,
+        // ADR-136 — the connector-status endpoint reads ~/.neat/connectors.json
+        // through the same resolved home the slot bootstrap read it from, so a
+        // daemon given an explicit NEAT_HOME serves status for the same file it
+        // polls.
+        connectorsHome: home
       });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(
@@ -11194,7 +11600,7 @@ async function startDaemon(opts = {}) {
       }
       if (restApp) await restApp.close().catch(() => {
       });
-      await import_node_fs28.promises.unlink(pidPath).catch(() => {
+      await import_node_fs31.promises.unlink(pidPath).catch(() => {
       });
       throw new Error(
         `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
@@ -11320,7 +11726,7 @@ async function startDaemon(opts = {}) {
       });
       if (otlpApp) await otlpApp.close().catch(() => {
       });
-      await import_node_fs28.promises.unlink(pidPath).catch(() => {
+      await import_node_fs31.promises.unlink(pidPath).catch(() => {
       });
       throw new Error(
         `neatd: failed to bind OTLP on port ${otlpPort} \u2014 ${err.message}`
@@ -11355,7 +11761,7 @@ async function startDaemon(opts = {}) {
         });
         if (otlpApp) await otlpApp.close().catch(() => {
         });
-        await import_node_fs28.promises.unlink(pidPath).catch(() => {
+        await import_node_fs31.promises.unlink(pidPath).catch(() => {
         });
         throw new Error(
           `neatd: failed to write daemon.json for "${singleProject}" \u2014 ${err.message}`
@@ -11402,9 +11808,9 @@ async function startDaemon(opts = {}) {
   let registryWatcher = null;
   let reloadTimer = null;
   if (!singleProject) try {
-    const regDir = import_node_path47.default.dirname(regPath);
-    const regBase = import_node_path47.default.basename(regPath);
-    registryWatcher = (0, import_node_fs28.watch)(regDir, (_eventType, filename) => {
+    const regDir = import_node_path50.default.dirname(regPath);
+    const regBase = import_node_path50.default.basename(regPath);
+    registryWatcher = (0, import_node_fs31.watch)(regDir, (_eventType, filename) => {
       if (filename !== null && filename !== regBase) return;
       if (reloadTimer) clearTimeout(reloadTimer);
       reloadTimer = setTimeout(() => {
@@ -11453,7 +11859,7 @@ async function startDaemon(opts = {}) {
     if (daemonRecord) {
       await clearDaemonRecord(daemonRecord, home);
     }
-    await import_node_fs28.promises.unlink(pidPath).catch(() => {
+    await import_node_fs31.promises.unlink(pidPath).catch(() => {
     });
   };
   return {
@@ -11476,9 +11882,9 @@ init_auth();
 // src/web-spawn.ts
 init_cjs_shims();
 var import_node_child_process2 = require("child_process");
-var import_node_fs29 = require("fs");
+var import_node_fs32 = require("fs");
 var import_node_net = __toESM(require("net"), 1);
-var import_node_path48 = __toESM(require("path"), 1);
+var import_node_path51 = __toESM(require("path"), 1);
 var DEFAULT_WEB_PORT = 6328;
 var DEFAULT_REST_PORT = 8080;
 function asValidPort(value) {
@@ -11487,11 +11893,11 @@ function asValidPort(value) {
 }
 function projectRoot() {
   const fromEnv = process.env.NEAT_SCAN_PATH;
-  return import_node_path48.default.resolve(fromEnv && fromEnv.length > 0 ? fromEnv : process.cwd());
+  return import_node_path51.default.resolve(fromEnv && fromEnv.length > 0 ? fromEnv : process.cwd());
 }
 async function readDaemonPorts(root) {
   try {
-    const raw = await import_node_fs29.promises.readFile(import_node_path48.default.join(root, "neat-out", "daemon.json"), "utf8");
+    const raw = await import_node_fs32.promises.readFile(import_node_path51.default.join(root, "neat-out", "daemon.json"), "utf8");
     const parsed = JSON.parse(raw);
     const ports = parsed?.ports ?? {};
     return { web: asValidPort(ports.web), rest: asValidPort(ports.rest) };
@@ -11536,10 +11942,10 @@ function resolveWebPackageDir() {
     eval("require")
   );
   const pkgJsonPath = req.resolve("@neat.is/web/package.json");
-  return import_node_path48.default.dirname(pkgJsonPath);
+  return import_node_path51.default.dirname(pkgJsonPath);
 }
 function resolveStandaloneServerEntry(webDir) {
-  return import_node_path48.default.join(webDir, ".next/standalone/packages/web/server.js");
+  return import_node_path51.default.join(webDir, ".next/standalone/packages/web/server.js");
 }
 async function pickInternalPort() {
   return new Promise((resolve, reject) => {
@@ -11592,7 +11998,7 @@ async function spawnWebUI(restPort, opts = {}) {
         NEAT_API_URL: apiUrl
       };
       child = (0, import_node_child_process2.spawn)(process.execPath, [serverEntry], {
-        cwd: import_node_path48.default.dirname(serverEntry),
+        cwd: import_node_path51.default.dirname(serverEntry),
         env,
         stdio: ["ignore", "inherit", "inherit"],
         detached: false
@@ -11768,14 +12174,14 @@ function localVersion() {
 }
 function neatHome3() {
   if (process.env.NEAT_HOME && process.env.NEAT_HOME.length > 0) {
-    return import_node_path49.default.resolve(process.env.NEAT_HOME);
+    return import_node_path52.default.resolve(process.env.NEAT_HOME);
   }
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path49.default.join(home, ".neat");
+  return import_node_path52.default.join(home, ".neat");
 }
 async function readPid() {
   try {
-    const raw = await import_node_fs30.promises.readFile(import_node_path49.default.join(neatHome3(), "neatd.pid"), "utf8");
+    const raw = await import_node_fs33.promises.readFile(import_node_path52.default.join(neatHome3(), "neatd.pid"), "utf8");
     const n = Number.parseInt(raw.trim(), 10);
     return Number.isFinite(n) ? n : null;
   } catch {