@neat.is/core 0.4.28-dev.20260712 → 0.4.28-dev.20260714

package/dist/server.cjs

@@ -59,8 +59,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path47 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path47) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path47)) {
+    const path51 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path51) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path51)) {
       done();
       return;
     }
@@ -192,8 +192,8 @@ function reshapeGrpcRequest(req) {
   };
 }
 function resolveProtoRoot() {
-  const here = import_node_path43.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
-  return import_node_path43.default.resolve(here, "..", "proto");
+  const here = import_node_path47.default.dirname((0, import_node_url.fileURLToPath)(importMetaUrl));
+  return import_node_path47.default.resolve(here, "..", "proto");
 }
 function loadTraceService() {
   const protoRoot = resolveProtoRoot();
@@ -261,13 +261,13 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path43, import_node_crypto2, grpc, protoLoader;
+var import_node_url, import_node_path47, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
-    import_node_path43 = __toESM(require("path"), 1);
+    import_node_path47 = __toESM(require("path"), 1);
     import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
@@ -360,8 +360,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path47 = q === -1 ? v : v.slice(0, q);
-      if (path47.length > 0) return path47;
+      const path51 = q === -1 ? v : v.slice(0, q);
+      if (path51.length > 0) return path51;
     }
   }
   return void 0;
@@ -415,10 +415,10 @@ function parseOtlpRequest(body) {
   return out;
 }
 function loadProtoRoot() {
-  const here = import_node_path44.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
-  const protoRoot = import_node_path44.default.resolve(here, "..", "proto");
+  const here = import_node_path48.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
+  const protoRoot = import_node_path48.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
-  root.resolvePath = (_origin, target) => import_node_path44.default.resolve(protoRoot, target);
+  root.resolvePath = (_origin, target) => import_node_path48.default.resolve(protoRoot, target);
   root.loadSync(
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
@@ -630,12 +630,12 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path44, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
+var import_node_path48, import_node_url2, import_fastify2, import_protobufjs, ENV_ATTR_CANONICAL, ENV_ATTR_COMPAT, ENV_FALLBACK, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path44 = __toESM(require("path"), 1);
+    import_node_path48 = __toESM(require("path"), 1);
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
@@ -651,7 +651,7 @@ var init_otel = __esm({
 
 // src/server.ts
 init_cjs_shims();
-var import_node_path46 = __toESM(require("path"), 1);
+var import_node_path50 = __toESM(require("path"), 1);
 
 // src/graph.ts
 init_cjs_shims();
@@ -675,7 +675,7 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types30 = require("@neat.is/types");
+var import_types33 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -1418,19 +1418,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path47, edges) {
-    if (path47.length > best.path.length) {
-      best = { path: [...path47], edges: [...edges] };
+  function step(node, path51, edges) {
+    if (path51.length > best.path.length) {
+      best = { path: [...path51], edges: [...edges] };
     }
-    if (path47.length - 1 >= maxDepth) return;
+    if (path51.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path47.push(srcId);
+      path51.push(srcId);
       edges.push(edge);
-      step(srcId, path47, edges);
-      path47.pop();
+      step(srcId, path51, edges);
+      path51.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1624,26 +1624,26 @@ function dominantFailingCall(graph, serviceId4, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path47 = [originServiceId];
+  const path51 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path47.push(hop.nextService);
+    path51.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path47, edges, culprit: current };
+  return { path: path51, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path47 = [...chain.path];
+  const path51 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1651,14 +1651,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path47.push(loc.fileNode);
+      path51.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path47,
+      traversalPath: path51,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1670,7 +1670,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path47,
+    traversalPath: path51,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -6966,6 +6966,39 @@ function classifyImage(image) {
   if (last.startsWith("memcached")) return "memcached";
   return "container";
 }
+function lineContaining(raw, needle) {
+  if (!needle) return void 0;
+  const idx = raw.indexOf(needle);
+  if (idx === -1) return void 0;
+  let line = 1;
+  for (let i = 0; i < idx; i++) if (raw[i] === "\n") line++;
+  return line;
+}
+function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provider, evidenceFile, line) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  const node = makeInfraNode(kind, name, provider);
+  if (!graph.hasNode(node.id)) {
+    graph.addNode(node.id, node);
+    nodesAdded++;
+  }
+  if (node.id === anchorId) return { nodesAdded, edgesAdded };
+  const edgeId = (0, import_types5.extractedEdgeId)(anchorId, node.id, edgeType);
+  if (!graph.hasEdge(edgeId)) {
+    const edge = {
+      id: edgeId,
+      source: anchorId,
+      target: node.id,
+      type: edgeType,
+      provenance: import_types22.Provenance.EXTRACTED,
+      confidence: (0, import_types22.confidenceForExtracted)("structural"),
+      evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
+    };
+    graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
 
 // src/extract/infra/docker-compose.ts
 function dependsOnList(value) {
@@ -7325,7 +7358,7 @@ async function readWranglerConfig(dir) {
   }
   return null;
 }
-function lineContaining(raw, needle) {
+function lineContaining2(raw, needle) {
   if (!needle) return void 0;
   const idx = raw.indexOf(needle);
   if (idx === -1) return void 0;
@@ -7449,7 +7482,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-route",
         route,
         evidenceFile,
-        lineContaining(raw, route)
+        lineContaining2(raw, route)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -7473,7 +7506,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
           group.kind,
           name,
           evidenceFile,
-          lineContaining(raw, name)
+          lineContaining2(raw, name)
         );
         nodesAdded += result.nodesAdded;
         edgesAdded += result.edgesAdded;
@@ -7487,7 +7520,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-cron",
         cron,
         evidenceFile,
-        lineContaining(raw, cron)
+        lineContaining2(raw, cron)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -7500,7 +7533,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-env-var",
         varName,
         evidenceFile,
-        lineContaining(raw, varName)
+        lineContaining2(raw, varName)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -7518,7 +7551,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
             type: import_types26.EdgeType.CALLS,
             provenance: import_types26.Provenance.EXTRACTED,
             confidence: (0, import_types26.confidenceForExtracted)("structural"),
-            evidence: { file: evidenceFile, line: lineContaining(raw, svc.service) }
+            evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
           edgesAdded++;
@@ -7532,7 +7565,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
-        lineContaining(raw, svc.service)
+        lineContaining2(raw, svc.service)
       );
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
@@ -7541,6 +7574,203 @@ async function addCloudflareWorkers(graph, services, scanPath) {
   return { nodesAdded, edgesAdded };
 }
 
+// src/extract/infra/vercel.ts
+init_cjs_shims();
+var import_node_fs22 = require("fs");
+var import_node_path38 = __toESM(require("path"), 1);
+var import_types27 = require("@neat.is/types");
+var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
+async function readVercelConfig(dir) {
+  for (const filename of VERCEL_CONFIG_FILENAMES) {
+    const abs = import_node_path38.default.join(dir, filename);
+    if (!await exists2(abs)) continue;
+    const raw = await import_node_fs22.promises.readFile(abs, "utf8");
+    const config = JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+async function readLinkedProjectName(dir) {
+  const abs = import_node_path38.default.join(dir, ".vercel", "project.json");
+  if (!await exists2(abs)) return void 0;
+  const parsed = JSON.parse(await import_node_fs22.promises.readFile(abs, "utf8"));
+  return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
+}
+function routeSource(route) {
+  return route.source ?? route.src;
+}
+async function addVercelServices(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    let projectName;
+    try {
+      read = await readVercelConfig(service.dir);
+      projectName = await readLinkedProjectName(service.dir);
+    } catch (err) {
+      recordExtractionError("infra vercel", import_node_path38.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read && !projectName) continue;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "vercel" || projectName && serviceNode.platformName !== projectName) {
+      const updated = {
+        ...serviceNode,
+        platform: "vercel",
+        ...projectName ? { platformName: projectName } : {}
+      };
+      graph.replaceNodeAttributes(service.node.id, updated);
+    }
+    const anchorId = service.node.id;
+    if (!read) continue;
+    const { config, relFile, raw } = read;
+    const evidenceFile = toPosix2(import_node_path38.default.relative(scanPath, import_node_path38.default.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "vercel",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(import_types27.EdgeType.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(import_types27.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(import_types27.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types27.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
+      add(import_types27.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/railway.ts
+init_cjs_shims();
+var import_node_fs23 = require("fs");
+var import_node_path39 = __toESM(require("path"), 1);
+var import_smol_toml3 = require("smol-toml");
+var import_types28 = require("@neat.is/types");
+var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
+async function readRailwayConfig(dir) {
+  for (const filename of RAILWAY_FILENAMES) {
+    const abs = import_node_path39.default.join(dir, filename);
+    if (!await exists2(abs)) continue;
+    const raw = await import_node_fs23.promises.readFile(abs, "utf8");
+    const config = filename === "railway.toml" ? (0, import_smol_toml3.parse)(raw) : JSON.parse(maskCommentsInSource(raw));
+    return { config, relFile: filename, raw };
+  }
+  return null;
+}
+async function addRailwayServices(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    try {
+      read = await readRailwayConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra railway", import_node_path39.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read) continue;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "railway") {
+      graph.replaceNodeAttributes(service.node.id, { ...serviceNode, platform: "railway" });
+    }
+    const anchorId = service.node.id;
+    const { config, relFile, raw } = read;
+    const evidenceFile = toPosix2(import_node_path39.default.relative(scanPath, import_node_path39.default.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "railway",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(import_types28.EdgeType.RUNS_ON, "railway", "railway");
+    add(import_types28.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(import_types28.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/extract/infra/supabase.ts
+init_cjs_shims();
+var import_node_fs24 = require("fs");
+var import_node_path40 = __toESM(require("path"), 1);
+var import_smol_toml4 = require("smol-toml");
+var import_types29 = require("@neat.is/types");
+async function readSupabaseConfig(dir) {
+  const relFile = import_node_path40.default.join("supabase", "config.toml");
+  const abs = import_node_path40.default.join(dir, relFile);
+  if (!await exists2(abs)) return null;
+  const raw = await import_node_fs24.promises.readFile(abs, "utf8");
+  const config = (0, import_smol_toml4.parse)(raw);
+  return { config, relFile, raw };
+}
+async function addSupabaseProjects(graph, services, scanPath) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    let read = null;
+    try {
+      read = await readSupabaseConfig(service.dir);
+    } catch (err) {
+      recordExtractionError("infra supabase", import_node_path40.default.relative(scanPath, service.dir), err);
+      continue;
+    }
+    if (!read) continue;
+    const { config, relFile, raw } = read;
+    const projectId = typeof config.project_id === "string" ? config.project_id : void 0;
+    const serviceNode = graph.getNodeAttributes(service.node.id);
+    if (serviceNode.platform !== "supabase" || projectId && serviceNode.platformName !== projectId) {
+      graph.replaceNodeAttributes(service.node.id, {
+        ...serviceNode,
+        platform: "supabase",
+        ...projectId ? { platformName: projectId } : {}
+      });
+    }
+    const anchorId = service.node.id;
+    const evidenceFile = toPosix2(import_node_path40.default.relative(scanPath, import_node_path40.default.join(service.dir, relFile)));
+    const add = (edgeType, kind, name) => {
+      if (!name) return;
+      const result = emitPlatformResourceEdge(
+        graph,
+        anchorId,
+        edgeType,
+        kind,
+        name,
+        "supabase",
+        evidenceFile,
+        lineContaining(raw, name)
+      );
+      nodesAdded += result.nodesAdded;
+      edgesAdded += result.edgesAdded;
+    };
+    add(import_types29.EdgeType.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(import_types29.EdgeType.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(import_types29.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(import_types29.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
+  }
+  return { nodesAdded, edgesAdded };
+}
+
 // src/extract/infra/index.ts
 async function addInfra(graph, scanPath, services) {
   const compose = await addComposeInfra(graph, scanPath, services);
@@ -7548,24 +7778,27 @@ async function addInfra(graph, scanPath, services) {
   const terraform = await addTerraformResources(graph, scanPath);
   const k8s = await addK8sResources(graph, scanPath);
   const cloudflare = await addCloudflareWorkers(graph, services, scanPath);
+  const vercel = await addVercelServices(graph, services, scanPath);
+  const railway = await addRailwayServices(graph, services, scanPath);
+  const supabase = await addSupabaseProjects(graph, services, scanPath);
   return {
-    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded,
-    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded
+    nodesAdded: compose.nodesAdded + dockerfile.nodesAdded + terraform.nodesAdded + k8s.nodesAdded + cloudflare.nodesAdded + vercel.nodesAdded + railway.nodesAdded + supabase.nodesAdded,
+    edgesAdded: compose.edgesAdded + dockerfile.edgesAdded + terraform.edgesAdded + k8s.edgesAdded + cloudflare.edgesAdded + vercel.edgesAdded + railway.edgesAdded + supabase.edgesAdded
   };
 }
 
 // src/extract/index.ts
-var import_node_path39 = __toESM(require("path"), 1);
+var import_node_path42 = __toESM(require("path"), 1);
 
 // src/extract/retire.ts
 init_cjs_shims();
-var import_node_fs22 = require("fs");
-var import_node_path38 = __toESM(require("path"), 1);
-var import_types27 = require("@neat.is/types");
+var import_node_fs25 = require("fs");
+var import_node_path41 = __toESM(require("path"), 1);
+var import_types30 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types27.NodeType.FileNode) return;
+    if (attrs.type !== import_types30.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -7578,14 +7811,14 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types27.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types30.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (import_node_path38.default.isAbsolute(evidenceFile)) {
-      if (!(0, import_node_fs22.existsSync)(evidenceFile)) toDrop.push(id);
+    if (import_node_path41.default.isAbsolute(evidenceFile)) {
+      if (!(0, import_node_fs25.existsSync)(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => (0, import_node_fs22.existsSync)(import_node_path38.default.join(base, evidenceFile)));
+    const found = bases.some((base) => (0, import_node_fs25.existsSync)(import_node_path41.default.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -7627,7 +7860,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = import_node_path39.default.join(import_node_path39.default.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = import_node_path42.default.join(import_node_path42.default.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -7661,7 +7894,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/diff.ts
 init_cjs_shims();
-var import_node_fs23 = require("fs");
+var import_node_fs26 = require("fs");
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -7670,7 +7903,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await import_node_fs23.promises.readFile(target, "utf8");
+  const raw = await import_node_fs26.promises.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -7738,9 +7971,9 @@ function canonicalJson(value) {
 
 // src/persist.ts
 init_cjs_shims();
-var import_node_fs24 = require("fs");
-var import_node_path40 = __toESM(require("path"), 1);
-var import_types28 = require("@neat.is/types");
+var import_node_fs27 = require("fs");
+var import_node_path43 = __toESM(require("path"), 1);
+var import_types31 = require("@neat.is/types");
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -7762,12 +7995,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types28.Provenance.OBSERVED;
+      attrs.provenance = import_types31.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types28.observedEdgeId)(source, target, type);
+        const newId = (0, import_types31.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -7776,7 +8009,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await import_node_fs24.promises.mkdir(import_node_path40.default.dirname(filePath), { recursive: true });
+  await import_node_fs27.promises.mkdir(import_node_path43.default.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -7786,13 +8019,13 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  await import_node_fs24.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await import_node_fs24.promises.rename(tmp, outPath);
+  await import_node_fs27.promises.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await import_node_fs27.promises.rename(tmp, outPath);
 }
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await import_node_fs24.promises.readFile(outPath, "utf8");
+    raw = await import_node_fs27.promises.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -7857,23 +8090,23 @@ function startPersistLoop(graph, outPath, opts = {}) {
 
 // src/projects.ts
 init_cjs_shims();
-var import_node_path41 = __toESM(require("path"), 1);
+var import_node_path44 = __toESM(require("path"), 1);
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: import_node_path41.default.join(baseDir, "graph.json"),
-      errorsPath: import_node_path41.default.join(baseDir, "errors.ndjson"),
-      staleEventsPath: import_node_path41.default.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: import_node_path41.default.join(baseDir, "embeddings.json"),
-      policyViolationsPath: import_node_path41.default.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: import_node_path44.default.join(baseDir, "graph.json"),
+      errorsPath: import_node_path44.default.join(baseDir, "errors.ndjson"),
+      staleEventsPath: import_node_path44.default.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: import_node_path44.default.join(baseDir, "embeddings.json"),
+      policyViolationsPath: import_node_path44.default.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: import_node_path41.default.join(baseDir, `${project}.json`),
-    errorsPath: import_node_path41.default.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: import_node_path41.default.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: import_node_path41.default.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: import_node_path41.default.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: import_node_path44.default.join(baseDir, `${project}.json`),
+    errorsPath: import_node_path44.default.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: import_node_path44.default.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: import_node_path44.default.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: import_node_path44.default.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -7913,23 +8146,23 @@ function parseExtraProjects(raw) {
 
 // src/registry.ts
 init_cjs_shims();
-var import_node_fs25 = require("fs");
+var import_node_fs28 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
-var import_node_path42 = __toESM(require("path"), 1);
-var import_types29 = require("@neat.is/types");
+var import_node_path45 = __toESM(require("path"), 1);
+var import_types32 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path42.default.resolve(override);
-  return import_node_path42.default.join(import_node_os3.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path45.default.resolve(override);
+  return import_node_path45.default.join(import_node_os3.default.homedir(), ".neat");
 }
 function registryPath() {
-  return import_node_path42.default.join(neatHome(), "projects.json");
+  return import_node_path45.default.join(neatHome(), "projects.json");
 }
 async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await import_node_fs25.promises.readFile(file, "utf8");
+    raw = await import_node_fs28.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -7937,7 +8170,7 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types29.RegistryFileSchema.parse(parsed);
+  return import_types32.RegistryFileSchema.parse(parsed);
 }
 async function getProject(name) {
   const reg = await readRegistry();
@@ -8008,6 +8241,168 @@ data: ${JSON.stringify(envelope.payload)}
 
 // src/api.ts
 init_auth();
+
+// src/connectors-config.ts
+init_cjs_shims();
+var import_node_os4 = __toESM(require("os"), 1);
+var import_node_path46 = __toESM(require("path"), 1);
+var import_node_fs29 = require("fs");
+var CONNECTORS_CONFIG_VERSION = 1;
+function neatHome2() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path46.default.resolve(override);
+  return import_node_path46.default.join(import_node_os4.default.homedir(), ".neat");
+}
+function connectorsConfigPath(home = neatHome2()) {
+  return import_node_path46.default.join(home, "connectors.json");
+}
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await import_node_fs29.promises.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's secrets call for \u2014 run \`chmod 600 ${file}\``
+      );
+    }
+  } catch {
+  }
+}
+async function readConnectorsConfig(home = neatHome2()) {
+  const file = connectorsConfigPath(home);
+  let raw;
+  try {
+    raw = await import_node_fs29.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
+    }
+    throw err;
+  }
+  await warnIfModeLooserThan0600(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig(parsed, file);
+}
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "connectors" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? CONNECTORS_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawConnectors = obj.connectors;
+  if (!Array.isArray(rawConnectors)) {
+    throw new Error(`${file}: "connectors" must be an array`);
+  }
+  const connectors = rawConnectors.map((entry, i) => validateEntry(entry, i, file));
+  return { version, connectors };
+}
+function validateEntry(entry, index, file) {
+  const where = `${file}: connectors[${index}]`;
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry;
+  const id = e.id;
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error(`${where}.id must be a non-empty string`);
+  }
+  const provider = e.provider;
+  if (typeof provider !== "string" || provider.length === 0) {
+    throw new Error(`${where}.provider must be a non-empty string`);
+  }
+  if (e.project !== void 0 && typeof e.project !== "string") {
+    throw new Error(`${where}.project must be a string when present`);
+  }
+  const credential = validateCredentialRef(e.credential, `${where}.credential`);
+  let options;
+  if (e.options !== void 0) {
+    if (typeof e.options !== "object" || e.options === null || Array.isArray(e.options)) {
+      throw new Error(`${where}.options must be an object when present`);
+    }
+    options = e.options;
+  }
+  return {
+    id,
+    provider,
+    ...typeof e.project === "string" ? { project: e.project } : {},
+    credential,
+    ...options ? { options } : {}
+  };
+}
+function validateCredentialRef(raw, where) {
+  if (typeof raw === "string") {
+    if (raw.length === 0) throw new Error(`${where} must be a non-empty string`);
+    return raw;
+  }
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    const fields = raw;
+    const keys = Object.keys(fields);
+    if (keys.length === 0) throw new Error(`${where} object must have at least one field`);
+    for (const key of keys) {
+      const v = fields[key];
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`${where}.${key} must be a non-empty string`);
+      }
+    }
+    return fields;
+  }
+  throw new Error(`${where} must be a string or an object of strings`);
+}
+function connectorMatchesProject(entry, project) {
+  return entry.project === void 0 || entry.project === project;
+}
+function isEnvRef(value) {
+  return value.length > 1 && value.startsWith("$");
+}
+function redactCredentialRef(ref) {
+  const one = (value) => isEnvRef(value) ? value : "****";
+  if (typeof ref === "string") return one(ref);
+  const out = {};
+  for (const [key, value] of Object.entries(ref)) out[key] = one(value);
+  return out;
+}
+
+// src/connectors/status.ts
+init_cjs_shims();
+var CONNECTOR_STALE_THRESHOLD_MS = 5 * 6e4;
+var records = /* @__PURE__ */ new Map();
+function deriveState(rec, now, thresholdMs) {
+  if (rec.lastOutcome === "error") return "error";
+  const okAt = rec.lastOkAt ? Date.parse(rec.lastOkAt) : NaN;
+  if (!Number.isNaN(okAt) && now - okAt > thresholdMs) return "stale";
+  return "healthy";
+}
+function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_THRESHOLD_MS) {
+  const rec = records.get(id);
+  if (!rec) {
+    return {
+      state: "idle",
+      lastPollAt: null,
+      lastOutcome: null,
+      lastError: null,
+      signalsLastPoll: 0
+    };
+  }
+  return {
+    state: deriveState(rec, now, thresholdMs),
+    lastPollAt: rec.lastPollAt,
+    lastOutcome: rec.lastOutcome,
+    lastError: rec.lastError,
+    signalsLastPoll: rec.signalsLastPoll
+  };
+}
+
+// src/api.ts
 function serializeGraph(graph) {
   const nodes = [];
   graph.forEachNode((_id, attrs) => {
@@ -8158,11 +8553,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types30.DivergenceTypeSchema.safeParse(c);
+        const r = import_types33.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types30.DivergenceTypeSchema.options
+            allowed: import_types33.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -8227,6 +8622,26 @@ function registerRoutes(scope, ctx) {
     const sliced = filtered.slice(0, safeLimit);
     return { count: sliced.length, total, logs: sliced };
   });
+  scope.get("/connectors", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    let entries;
+    try {
+      entries = (await readConnectorsConfig(ctx.connectorsHome)).connectors;
+    } catch (err) {
+      return reply.code(500).send({
+        error: "connectors.json failed to read",
+        details: err.message
+      });
+    }
+    const connectors = entries.filter((entry) => connectorMatchesProject(entry, proj.name)).map((entry) => ({
+      id: entry.id,
+      provider: entry.provider,
+      credentialRef: redactCredentialRef(entry.credential),
+      status: getConnectorStatus(entry.id)
+    }));
+    return { connectors };
+  });
   const incidentHistoryHandler = async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -8413,7 +8828,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types30.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types33.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -8452,7 +8867,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types30.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types33.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -8597,9 +9012,11 @@ async function buildApi(opts) {
     trustProxy,
     publicRead
   });
+  const requiresAuth = authToken !== void 0 && authToken.length > 0 && trustProxy !== true;
   app.get("/api/config", async () => ({
     publicRead: publicRead === true,
-    authProxy: trustProxy === true
+    authProxy: trustProxy === true,
+    requiresAuth
   }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
@@ -8629,7 +9046,8 @@ async function buildApi(opts) {
     staleEventsPathFor,
     policyFilePathFor,
     bootstrap: opts.bootstrap,
-    singleProject: opts.singleProject?.name
+    singleProject: opts.singleProject?.name,
+    connectorsHome: opts.connectorsHome
   };
   app.get("/health", async () => {
     const uptimeMs = Date.now() - startedAt;
@@ -8714,8 +9132,8 @@ init_otel_grpc();
 
 // src/search.ts
 init_cjs_shims();
-var import_node_fs26 = require("fs");
-var import_node_path45 = __toESM(require("path"), 1);
+var import_node_fs30 = require("fs");
+var import_node_path49 = __toESM(require("path"), 1);
 var import_node_crypto3 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
@@ -8869,7 +9287,7 @@ async function pickEmbedder() {
 }
 async function readCache(cachePath) {
   try {
-    const raw = await import_node_fs26.promises.readFile(cachePath, "utf8");
+    const raw = await import_node_fs30.promises.readFile(cachePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return null;
     return parsed;
@@ -8878,8 +9296,8 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, cache) {
-  await import_node_fs26.promises.mkdir(import_node_path45.default.dirname(cachePath), { recursive: true });
-  await import_node_fs26.promises.writeFile(cachePath, JSON.stringify(cache));
+  await import_node_fs30.promises.mkdir(import_node_path49.default.dirname(cachePath), { recursive: true });
+  await import_node_fs30.promises.writeFile(cachePath, JSON.stringify(cache));
 }
 var VectorIndex = class {
   constructor(embedder, cachePath) {
@@ -9059,14 +9477,14 @@ async function bootProject(registry, name, scanPath, baseDir) {
 async function main() {
   const baseDirEnv = process.env.NEAT_OUT_DIR;
   const legacyOutPath = process.env.NEAT_OUT_PATH;
-  const baseDir = baseDirEnv ? import_node_path46.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path46.default.resolve(import_node_path46.default.dirname(legacyOutPath)) : import_node_path46.default.resolve("./neat-out");
-  const defaultScanPath = import_node_path46.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
+  const baseDir = baseDirEnv ? import_node_path50.default.resolve(baseDirEnv) : legacyOutPath ? import_node_path50.default.resolve(import_node_path50.default.dirname(legacyOutPath)) : import_node_path50.default.resolve("./neat-out");
+  const defaultScanPath = import_node_path50.default.resolve(process.env.NEAT_SCAN_PATH ?? "./demo");
   const registry = new Projects();
   await bootProject(registry, DEFAULT_PROJECT, defaultScanPath, baseDir);
   for (const name of parseExtraProjects(process.env.NEAT_PROJECTS)) {
     const envKey = `NEAT_PROJECT_SCAN_PATH_${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
     const projectScan = process.env[envKey];
-    await bootProject(registry, name, projectScan ? import_node_path46.default.resolve(projectScan) : void 0, baseDir);
+    await bootProject(registry, name, projectScan ? import_node_path50.default.resolve(projectScan) : void 0, baseDir);
   }
   const host = process.env.HOST ?? "0.0.0.0";
   const port = Number(process.env.PORT ?? 8080);