@neat.is/core 0.6.0 → 0.6.2-dev.20260722

package/dist/{chunk-CS4GHQO3.js → chunk-ZZ3VUCWL.js}

@@ -1,7 +1,7 @@
 import {
   mountBearerAuth,
   readAuthEnv
-} from "./chunk-BZ3AJVAC.js";
+} from "./chunk-2MAGU6RB.js";
 
 // src/graph.ts
 import GraphDefault from "graphology";
@@ -339,969 +339,454 @@ function deprecatedApis() {
   return currentMatrix().deprecatedApis ?? [];
 }
 
-// src/traverse.ts
+// src/ingest.ts
+import { promises as fs3, existsSync, readFileSync } from "fs";
+import path3 from "path";
+import * as sourceMapJs from "source-map-js";
+
+// src/policy.ts
+import { promises as fs2 } from "fs";
+import path2 from "path";
 import {
-  BlastRadiusResultSchema,
   EdgeType,
   NodeType,
-  ObservedDependenciesResultSchema,
-  PROV_RANK,
-  Provenance,
-  RootCauseResultSchema,
-  TransitiveDependenciesResultSchema
+  PolicyFileSchema
 } from "@neat.is/types";
-var ROOT_CAUSE_MAX_DEPTH = 5;
-var BLAST_RADIUS_DEFAULT_DEPTH = 10;
-function isFrontierNode(graph, nodeId) {
-  if (!graph.hasNode(nodeId)) return false;
-  const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType.FrontierNode;
-}
-function resolveOwningService(graph, nodeId) {
-  if (!graph.hasNode(nodeId)) return null;
-  const attrs = graph.getNodeAttributes(nodeId);
-  if (attrs.type === NodeType.ServiceNode) {
-    return { id: nodeId, svc: attrs };
-  }
-  if (attrs.type === NodeType.FileNode) {
-    for (const edgeId of graph.inboundEdges(nodeId)) {
-      const e = graph.getEdgeAttributes(edgeId);
-      if (e.type !== EdgeType.CONTAINS) continue;
-      const owner = graph.getNodeAttributes(e.source);
-      if (owner.type === NodeType.ServiceNode) {
-        return { id: e.source, svc: owner };
-      }
-    }
-  }
-  return null;
-}
-function bestEdgeBySource(graph, edgeIds) {
-  const best = /* @__PURE__ */ new Map();
-  for (const id of edgeIds) {
-    const e = graph.getEdgeAttributes(id);
-    if (isFrontierNode(graph, e.source)) continue;
-    const cur = best.get(e.source);
-    if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
-      best.set(e.source, e);
-    }
-  }
-  return best;
-}
-function bestEdgeByTarget(graph, edgeIds) {
-  const best = /* @__PURE__ */ new Map();
-  for (const id of edgeIds) {
-    const e = graph.getEdgeAttributes(id);
-    if (isFrontierNode(graph, e.target)) continue;
-    const cur = best.get(e.target);
-    if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
-      best.set(e.target, e);
-    }
-  }
-  return best;
-}
-var PROVENANCE_CEILING = {
-  OBSERVED: 1,
-  INFERRED: 0.7,
-  EXTRACTED: 0.5,
-  STALE: 0.3
+
+// src/events.ts
+import { EventEmitter } from "events";
+var EVENT_BUS_CHANNEL = "event";
+var NeatEventBus = class extends EventEmitter {
 };
-function volumeWeight(spanCount) {
-  if (!spanCount || spanCount <= 0) return 0.5;
-  const w = 0.5 + Math.log10(spanCount + 1) / 3;
-  return Math.min(1, w);
-}
-function recencyWeight(ageMs) {
-  if (ageMs === void 0) return 0.8;
-  const hour = 60 * 60 * 1e3;
-  if (ageMs <= hour) return 1;
-  if (ageMs <= 24 * hour) {
-    const t = (ageMs - hour) / (23 * hour);
-    return 1 - 0.5 * t;
-  }
-  return 0.3;
-}
-function cleanlinessWeight(spanCount, errorCount) {
-  if (!spanCount || spanCount <= 0) return 1;
-  const rate = (errorCount ?? 0) / spanCount;
-  if (rate <= 0.01) return 1;
-  if (rate >= 0.5) return 0.3;
-  return 1 - rate * 1.4;
-}
-function confidenceForEdge(edge, now = Date.now()) {
-  const ceiling = PROVENANCE_CEILING[edge.provenance] ?? 0.5;
-  const spanCount = edge.signal?.spanCount ?? edge.callCount;
-  const ageMs = edge.signal?.lastObservedAgeMs ?? lastObservedAge(edge, now);
-  if (spanCount === void 0 && ageMs === void 0 && edge.signal === void 0) {
-    return ceiling;
-  }
-  const v = volumeWeight(spanCount);
-  const r = recencyWeight(ageMs);
-  const c = cleanlinessWeight(spanCount, edge.signal?.errorCount);
-  return Math.max(0, Math.min(1, ceiling * v * r * c));
+var eventBus = new NeatEventBus();
+eventBus.setMaxListeners(0);
+function emitNeatEvent(envelope) {
+  eventBus.emit(EVENT_BUS_CHANNEL, envelope);
 }
-function lastObservedAge(edge, now) {
-  if (!edge.lastObserved) return void 0;
-  const t = Date.parse(edge.lastObserved);
-  if (!Number.isFinite(t)) return void 0;
-  return Math.max(0, now - t);
+function attachGraphToEventBus(graph, opts) {
+  const { project } = opts;
+  const onNodeAdded = (payload) => {
+    emitNeatEvent({
+      type: "node-added",
+      project,
+      payload: { node: payload.attributes }
+    });
+  };
+  const onNodeDropped = (payload) => {
+    emitNeatEvent({
+      type: "node-removed",
+      project,
+      payload: { id: payload.key }
+    });
+  };
+  const onEdgeAdded = (payload) => {
+    emitNeatEvent({
+      type: "edge-added",
+      project,
+      payload: { edge: payload.attributes }
+    });
+  };
+  const onEdgeDropped = (payload) => {
+    emitNeatEvent({
+      type: "edge-removed",
+      project,
+      payload: { id: payload.key }
+    });
+  };
+  const onNodeAttrsUpdated = (payload) => {
+    emitNeatEvent({
+      type: "node-updated",
+      project,
+      payload: { id: payload.key, changes: payload.attributes }
+    });
+  };
+  graph.on("nodeAdded", onNodeAdded);
+  graph.on("nodeDropped", onNodeDropped);
+  graph.on("edgeAdded", onEdgeAdded);
+  graph.on("edgeDropped", onEdgeDropped);
+  graph.on("nodeAttributesUpdated", onNodeAttrsUpdated);
+  return () => {
+    graph.off("nodeAdded", onNodeAdded);
+    graph.off("nodeDropped", onNodeDropped);
+    graph.off("edgeAdded", onEdgeAdded);
+    graph.off("edgeDropped", onEdgeDropped);
+    graph.off("nodeAttributesUpdated", onNodeAttrsUpdated);
+  };
 }
-function confidenceFromMix(edges, now = Date.now()) {
-  if (edges.length === 0) return 1;
-  let product = 1;
-  for (const e of edges) {
-    product *= confidenceForEdge(e, now);
-  }
-  return Math.max(0, Math.min(1, product));
+
+// src/policy.ts
+var DEFAULT_ACTION_BY_SEVERITY = {
+  info: "log",
+  warning: "alert",
+  error: "alert",
+  critical: "block"
+};
+function resolveOnViolation(policy) {
+  return policy.onViolation ?? DEFAULT_ACTION_BY_SEVERITY[policy.severity];
 }
-function longestIncomingWalk(graph, start, maxDepth) {
-  let best = { path: [start], edges: [] };
-  const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path48, edges) {
-    if (path48.length > best.path.length) {
-      best = { path: [...path48], edges: [...edges] };
-    }
-    if (path48.length - 1 >= maxDepth) return;
-    const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
-    for (const [srcId, edge] of incoming) {
-      if (visited.has(srcId)) continue;
-      visited.add(srcId);
-      path48.push(srcId);
-      edges.push(edge);
-      step(srcId, path48, edges);
-      path48.pop();
-      edges.pop();
-      visited.delete(srcId);
-    }
-  }
-  step(start, [start], []);
-  return best;
+function makeViolation(policy, rule, contextSuffix, message, subject, ctx) {
+  return {
+    id: `${policy.id}:${contextSuffix}`,
+    policyId: policy.id,
+    policyName: policy.name,
+    severity: policy.severity,
+    onViolation: resolveOnViolation(policy),
+    ruleType: rule.type,
+    subject,
+    message,
+    observedAt: new Date(ctx.now()).toISOString()
+  };
 }
-function databaseRootCauseShape(graph, origin, walk3) {
-  const targetDb = origin;
-  const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
-  if (candidatePairs.length === 0) return null;
-  for (const id of walk3.path) {
-    const owner = resolveOwningService(graph, id);
-    if (!owner) continue;
-    const { id: serviceId5, svc } = owner;
-    const deps = svc.dependencies ?? {};
-    for (const pair of candidatePairs) {
-      const declared = deps[pair.driver];
-      if (!declared) continue;
-      const result = checkCompatibility(
-        pair.driver,
-        declared,
-        targetDb.engine,
-        targetDb.engineVersion
-      );
-      if (!result.compatible) {
-        return {
-          rootCauseNode: serviceId5,
-          rootCauseReason: result.reason ?? "incompatible driver",
-          ...result.minDriverVersion ? {
-            fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
-          } : {}
-        };
+var evaluateStructural = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.fromNodeType) return;
+    let satisfied = false;
+    for (const edgeId of graph.outboundEdges(id)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== rule.edgeType) continue;
+      const target = graph.getNodeAttributes(e.target);
+      if (target.type === NodeType.FrontierNode) continue;
+      if (target.type === rule.toNodeType) {
+        satisfied = true;
+        break;
       }
     }
-  }
-  return null;
-}
-function serviceRootCauseShape(graph, _origin, walk3) {
-  for (const id of walk3.path) {
-    const owner = resolveOwningService(graph, id);
-    if (!owner) continue;
-    const { id: serviceId5, svc } = owner;
-    const deps = svc.dependencies ?? {};
-    const serviceNodeEngine = svc.nodeEngine;
-    for (const constraint of nodeEngineConstraints()) {
-      const declared = deps[constraint.package];
-      if (!declared) continue;
-      const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
-      if (!result.compatible && result.reason) {
-        return {
-          rootCauseNode: serviceId5,
-          rootCauseReason: result.reason,
-          ...result.requiredNodeVersion ? {
-            fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
-          } : {}
-        };
-      }
-    }
-    for (const conflict of packageConflicts()) {
-      const declared = deps[conflict.package];
-      if (!declared) continue;
-      const requiredDeclared = deps[conflict.requires.name];
-      const result = checkPackageConflict(conflict, declared, requiredDeclared);
-      if (!result.compatible && result.reason) {
-        return {
-          rootCauseNode: serviceId5,
-          rootCauseReason: result.reason,
-          fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
-        };
-      }
+    if (!satisfied) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.fromNodeType} ${id} has no ${rule.edgeType} edge to a ${rule.toNodeType}`,
+          { nodeId: id },
+          ctx
+        )
+      );
     }
-  }
-  return null;
-}
-function fileRootCauseShape(graph, origin, walk3) {
-  const owner = resolveOwningService(graph, origin.id);
-  if (!owner) return null;
-  return serviceRootCauseShape(graph, owner.svc, walk3);
-}
-var rootCauseShapes = {
-  [NodeType.DatabaseNode]: databaseRootCauseShape,
-  [NodeType.ServiceNode]: serviceRootCauseShape,
-  [NodeType.FileNode]: fileRootCauseShape
+  });
+  return violations;
 };
-function getRootCause(graph, errorNodeId, errorEvent, incidents) {
-  if (!graph.hasNode(errorNodeId)) return null;
-  const origin = graph.getNodeAttributes(errorNodeId);
-  const shape = rootCauseShapes[origin.type];
-  if (shape) {
-    const walk3 = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
-    const match = shape(graph, origin, walk3);
-    if (match) {
-      const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
-      return RootCauseResultSchema.parse({
-        rootCauseNode: match.rootCauseNode,
-        rootCauseReason: reason,
-        traversalPath: walk3.path,
-        edgeProvenances: walk3.edges.map((e) => e.provenance),
-        confidence: confidenceFromMix(walk3.edges),
-        fixRecommendation: match.fixRecommendation
-      });
+var evaluateOwnership = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const value = a[rule.field];
+    if (typeof value !== "string" || value.length === 0) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} is missing required field "${rule.field}"`,
+          { nodeId: id },
+          ctx
+        )
+      );
     }
-  }
-  if (origin.type === NodeType.ServiceNode) {
-    const crossService = crossServiceRootCause(graph, errorNodeId, incidents, errorEvent);
-    if (crossService) return crossService;
-  }
-  return rootCauseFromIncidents(errorNodeId, incidents, errorEvent);
-}
-var INCIDENT_ROOT_CAUSE_CONFIDENCE = 0.6;
-function incidentMatchesNode(ev, nodeId) {
-  return ev.affectedNode === nodeId || ev.service === nodeId.replace(/^service:/, "");
-}
-function localizeFromIncidents(nodeId, incidents, errorEvent) {
-  const pool = incidents && incidents.length > 0 ? incidents : errorEvent ? [errorEvent] : [];
-  const relevant = pool.filter((ev) => incidentMatchesNode(ev, nodeId));
-  if (relevant.length === 0) return null;
-  const latest = [...relevant].sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
-  const attrs = latest.attributes ?? {};
-  const filepath = typeof attrs["code.filepath"] === "string" ? attrs["code.filepath"] : void 0;
-  const lineno = typeof attrs["code.lineno"] === "number" ? attrs["code.lineno"] : void 0;
-  const route = typeof attrs["http.route"] === "string" ? attrs["http.route"] : void 0;
-  const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
-  const sameMode = relevant.filter((ev) => ev.errorMessage === latest.errorMessage);
-  const count = sameMode.length;
-  const tail = count > 1 ? ` (${count} recorded incidents)` : " (1 recorded incident)";
-  const reasonParts = [`${latest.service}: ${latest.errorMessage}`];
-  if (location) reasonParts.push(`surfaced at ${location}`);
-  const rootCauseReason = `${reasonParts.join(" \u2014 ")}${tail}`;
-  const localizesToFile = latest.affectedNode !== nodeId && latest.affectedNode.startsWith("file:");
-  const fileNode = localizesToFile ? latest.affectedNode : void 0;
-  const fixRecommendation = location ? `Inspect ${location}${route ? ` handling ${route}` : ""}` : route ? `Inspect ${latest.service}'s handler for ${route}` : void 0;
-  return {
-    rootCauseNode: fileNode ?? nodeId,
-    rootCauseReason,
-    ...fileNode ? { fileNode } : {},
-    ...fixRecommendation ? { fixRecommendation } : {}
-  };
-}
-function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
-  const loc = localizeFromIncidents(nodeId, incidents, errorEvent);
-  if (!loc) return null;
-  const traversalPath = loc.fileNode ? [nodeId, loc.fileNode] : [nodeId];
-  const edgeProvenances = loc.fileNode ? [Provenance.OBSERVED] : [];
-  return RootCauseResultSchema.parse({
-    rootCauseNode: loc.rootCauseNode,
-    rootCauseReason: loc.rootCauseReason,
-    traversalPath,
-    edgeProvenances,
-    confidence: INCIDENT_ROOT_CAUSE_CONFIDENCE,
-    ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
   });
-}
-function isFailingCallEdge(e) {
-  return e.type === EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
-}
-function callSourcesForService(graph, serviceId5) {
-  const ids = [serviceId5];
-  for (const edgeId of graph.outboundEdges(serviceId5)) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.type !== EdgeType.CONTAINS) continue;
-    const tgt = graph.getNodeAttributes(e.target);
-    if (tgt.type === NodeType.FileNode) ids.push(e.target);
-  }
-  return ids;
-}
-function failingCallDominates(e, id, curEdge, curId) {
-  const ec = e.signal?.errorCount ?? 0;
-  const cc = curEdge.signal?.errorCount ?? 0;
-  if (ec !== cc) return ec > cc;
-  if (PROV_RANK[e.provenance] !== PROV_RANK[curEdge.provenance]) {
-    return PROV_RANK[e.provenance] > PROV_RANK[curEdge.provenance];
-  }
-  return id < curId;
-}
-function dominantFailingCall(graph, serviceId5, visited) {
-  let best = null;
-  for (const src of callSourcesForService(graph, serviceId5)) {
-    for (const edgeId of graph.outboundEdges(src)) {
-      const e = graph.getEdgeAttributes(edgeId);
-      if (!isFailingCallEdge(e)) continue;
-      if (isFrontierNode(graph, e.target)) continue;
-      const owner = resolveOwningService(graph, e.target);
-      if (!owner || visited.has(owner.id)) continue;
-      if (!best || failingCallDominates(e, owner.id, best.edge, best.nextService)) {
-        best = { nextService: owner.id, edge: e };
-      }
+  return violations;
+};
+var evaluateProvenance = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const required = Array.isArray(rule.required) ? new Set(rule.required) : /* @__PURE__ */ new Set([rule.required]);
+  const violations = [];
+  graph.forEachEdge((edgeId, attrs) => {
+    const e = attrs;
+    if (e.type !== rule.edgeType) return;
+    if (rule.targetNodeId && e.target !== rule.targetNodeId) return;
+    if (!required.has(e.provenance)) {
+      const requiredList = [...required].join(" | ");
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          edgeId,
+          `${rule.edgeType} edge ${edgeId} has provenance ${e.provenance}; required ${requiredList}`,
+          { edgeId },
+          ctx
+        )
+      );
     }
-  }
-  return best;
-}
-function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path48 = [originServiceId];
-  const edges = [];
-  const visited = /* @__PURE__ */ new Set([originServiceId]);
-  let current = originServiceId;
-  for (let depth = 0; depth < maxDepth; depth++) {
-    const hop = dominantFailingCall(graph, current, visited);
-    if (!hop) break;
-    path48.push(hop.nextService);
-    edges.push(hop.edge);
-    visited.add(hop.nextService);
-    current = hop.nextService;
-  }
-  if (edges.length === 0) return null;
-  return { path: path48, edges, culprit: current };
-}
-function crossServiceRootCause(graph, originId, incidents, errorEvent) {
-  const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
-  if (!chain) return null;
-  const culprit = chain.culprit;
-  const path48 = [...chain.path];
-  const edgeProvenances = chain.edges.map((e) => e.provenance);
-  const baseConfidence = confidenceFromMix(chain.edges);
-  const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
-  const loc = localizeFromIncidents(culprit, incidents, errorEvent);
-  if (loc) {
-    let rootCauseNode = culprit;
-    if (loc.fileNode) {
-      path48.push(loc.fileNode);
-      edgeProvenances.push(Provenance.OBSERVED);
-      rootCauseNode = loc.fileNode;
+  });
+  return violations;
+};
+var evaluateBlastRadius = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const depth = rule.depth;
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== rule.nodeType) return;
+    const result = depth !== void 0 ? getBlastRadius(graph, id, depth) : getBlastRadius(graph, id);
+    if (result.totalAffected > rule.maxAffected) {
+      violations.push(
+        makeViolation(
+          policy,
+          rule,
+          id,
+          `${rule.nodeType} ${id} has blast radius ${result.totalAffected} > ${rule.maxAffected}`,
+          { nodeId: id, path: [id] },
+          ctx
+        )
+      );
     }
-    return RootCauseResultSchema.parse({
-      rootCauseNode,
-      rootCauseReason: loc.rootCauseReason,
-      traversalPath: path48,
-      edgeProvenances,
-      confidence,
-      ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
-    });
-  }
-  const lastEdge = chain.edges[chain.edges.length - 1];
-  const errs = lastEdge.signal?.errorCount ?? 0;
-  const culpritName = culprit.replace(/^service:/, "");
-  return RootCauseResultSchema.parse({
-    rootCauseNode: culprit,
-    rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path48,
-    edgeProvenances,
-    confidence,
-    fixRecommendation: `Inspect ${culpritName}'s failing handler`
   });
-}
-function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
-  if (!graph.hasNode(nodeId)) {
-    return BlastRadiusResultSchema.parse({ origin: nodeId, affectedNodes: [], totalAffected: 0 });
-  }
-  const seen = /* @__PURE__ */ new Map();
-  const queue = [{ nodeId, distance: 0, path: [nodeId], pathEdges: [] }];
-  const enqueued = /* @__PURE__ */ new Set([nodeId]);
-  while (queue.length > 0) {
-    const frame = queue.shift();
-    if (frame.distance > 0 && frame.pathEdges.length > 0) {
-      const lastEdge = frame.pathEdges[frame.pathEdges.length - 1];
-      seen.set(frame.nodeId, {
-        nodeId: frame.nodeId,
-        distance: frame.distance,
-        edgeProvenance: lastEdge.provenance,
-        path: frame.path,
-        confidence: confidenceFromMix(frame.pathEdges)
-      });
-    }
-    if (frame.distance >= maxDepth) continue;
-    const incoming = bestEdgeBySource(graph, graph.inboundEdges(frame.nodeId));
-    for (const [srcId, edge] of incoming) {
-      if (enqueued.has(srcId)) continue;
-      enqueued.add(srcId);
-      queue.push({
-        nodeId: srcId,
-        distance: frame.distance + 1,
-        path: [...frame.path, srcId],
-        pathEdges: [...frame.pathEdges, edge]
-      });
-    }
-  }
-  const affectedNodes = [...seen.values()].sort(
-    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
-  );
-  return BlastRadiusResultSchema.parse({
-    origin: nodeId,
-    affectedNodes,
-    totalAffected: affectedNodes.length
-  });
-}
-var TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH = 3;
-var TRANSITIVE_DEPENDENCIES_MAX_DEPTH = 10;
-function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH) {
-  if (!graph.hasNode(nodeId)) {
-    return TransitiveDependenciesResultSchema.parse({
-      origin: nodeId,
-      depth,
-      dependencies: [],
-      total: 0
-    });
-  }
-  const seen = /* @__PURE__ */ new Map();
-  const queue = [{ nodeId, distance: 0, edge: null }];
-  const enqueued = /* @__PURE__ */ new Set([nodeId]);
-  while (queue.length > 0) {
-    const frame = queue.shift();
-    if (frame.distance > 0 && frame.edge && frame.edge.type !== EdgeType.CONTAINS) {
-      seen.set(frame.nodeId, {
-        nodeId: frame.nodeId,
-        distance: frame.distance,
-        edgeType: frame.edge.type,
-        provenance: frame.edge.provenance
-      });
-    }
-    if (frame.distance >= depth) continue;
-    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
-    for (const [tgtId, edge] of outgoing) {
-      if (enqueued.has(tgtId)) continue;
-      enqueued.add(tgtId);
-      queue.push({ nodeId: tgtId, distance: frame.distance + 1, edge });
+  return violations;
+};
+var evaluateCompatibility = ({
+  graph,
+  policy,
+  rule,
+  ctx
+}) => {
+  const violations = [];
+  const wantsKind = (kind) => rule.kind === void 0 || rule.kind === kind;
+  graph.forEachNode((svcId, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType.ServiceNode) return;
+    const svc = a;
+    const deps = svc.dependencies ?? {};
+    if (wantsKind("driver-engine")) {
+      for (const edgeId of graph.outboundEdges(svcId)) {
+        const e = graph.getEdgeAttributes(edgeId);
+        if (e.type !== EdgeType.CONNECTS_TO) continue;
+        const dbAttrs = graph.getNodeAttributes(e.target);
+        if (dbAttrs.type === NodeType.FrontierNode) continue;
+        if (dbAttrs.type !== NodeType.DatabaseNode) continue;
+        const db = dbAttrs;
+        for (const pair of compatPairs()) {
+          if (pair.engine !== db.engine) continue;
+          const declared = deps[pair.driver];
+          if (!declared) continue;
+          const result = checkCompatibility(pair.driver, declared, db.engine, db.engineVersion);
+          if (!result.compatible && result.reason) {
+            violations.push(
+              makeViolation(
+                policy,
+                rule,
+                `${svcId}:driver-engine:${pair.driver}@${declared}:${db.engine}@${db.engineVersion}`,
+                result.reason,
+                { nodeId: svcId, edgeId },
+                ctx
+              )
+            );
+          }
+        }
+      }
     }
-  }
-  const dependencies = [...seen.values()].sort(
-    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
-  );
-  return TransitiveDependenciesResultSchema.parse({
-    origin: nodeId,
-    depth,
-    dependencies,
-    total: dependencies.length
-  });
-}
-function getObservedDependencies(graph, nodeId) {
-  if (!graph.hasNode(nodeId)) {
-    return ObservedDependenciesResultSchema.parse({
-      origin: nodeId,
-      dependencies: [],
-      observed: false,
-      inboundObservedCount: 0,
-      hasExtractedOutbound: false
-    });
-  }
-  const attrs = graph.getNodeAttributes(nodeId);
-  const scope = [nodeId];
-  if (attrs.type === NodeType.ServiceNode) {
-    for (const edgeId of graph.outboundEdges(nodeId)) {
-      const e = graph.getEdgeAttributes(edgeId);
-      if (e.type !== EdgeType.CONTAINS) continue;
-      const owned = graph.getNodeAttributes(e.target);
-      if (owned.type === NodeType.FileNode) scope.push(e.target);
+    if (wantsKind("node-engine")) {
+      const serviceNodeRange = svc.nodeEngine;
+      for (const constraint of nodeEngineConstraints()) {
+        const declared = deps[constraint.package];
+        if (!declared) continue;
+        const result = checkNodeEngineConstraint(constraint, declared, serviceNodeRange);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:node-engine:${constraint.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
     }
-  }
-  const dependencies = [];
-  const seenEdge = /* @__PURE__ */ new Set();
-  let hasExtractedOutbound = false;
-  for (const src of scope) {
-    for (const edgeId of graph.outboundEdges(src)) {
-      const e = graph.getEdgeAttributes(edgeId);
-      if (e.type === EdgeType.CONTAINS) continue;
-      if (e.provenance === Provenance.OBSERVED) {
-        if (!seenEdge.has(e.id)) {
-          seenEdge.add(e.id);
-          dependencies.push(e);
+    if (wantsKind("package-conflict")) {
+      for (const conflict of packageConflicts()) {
+        const declared = deps[conflict.package];
+        if (!declared) continue;
+        const requiredDeclared = deps[conflict.requires.name];
+        const result = checkPackageConflict(conflict, declared, requiredDeclared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:package-conflict:${conflict.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
         }
-      } else if (e.provenance === Provenance.EXTRACTED) {
-        hasExtractedOutbound = true;
       }
     }
-  }
-  let inboundObservedCount = 0;
-  for (const tgt of scope) {
-    for (const edgeId of graph.inboundEdges(tgt)) {
-      const e = graph.getEdgeAttributes(edgeId);
-      if (e.type === EdgeType.CONTAINS) continue;
-      if (e.provenance === Provenance.OBSERVED) inboundObservedCount += 1;
+    if (wantsKind("deprecated-api")) {
+      for (const dep of deprecatedApis()) {
+        const declared = deps[dep.package];
+        if (!declared) continue;
+        const result = checkDeprecatedApi(dep, declared);
+        if (!result.compatible && result.reason) {
+          violations.push(
+            makeViolation(
+              policy,
+              rule,
+              `${svcId}:deprecated-api:${dep.package}@${declared}`,
+              result.reason,
+              { nodeId: svcId },
+              ctx
+            )
+          );
+        }
+      }
     }
-  }
-  dependencies.sort(
-    (a, b) => a.target.localeCompare(b.target) || a.source.localeCompare(b.source) || a.id.localeCompare(b.id)
-  );
-  return ObservedDependenciesResultSchema.parse({
-    origin: nodeId,
-    dependencies,
-    observed: dependencies.length > 0 || inboundObservedCount > 0,
-    inboundObservedCount,
-    hasExtractedOutbound
   });
-}
-
-// src/ingest.ts
-import { promises as fs3, existsSync, readFileSync } from "fs";
-import path3 from "path";
-import * as sourceMapJs from "source-map-js";
-
-// src/policy.ts
-import { promises as fs2 } from "fs";
-import path2 from "path";
-import {
-  EdgeType as EdgeType2,
-  NodeType as NodeType2,
-  PolicyFileSchema
-} from "@neat.is/types";
-
-// src/events.ts
-import { EventEmitter } from "events";
-var EVENT_BUS_CHANNEL = "event";
-var NeatEventBus = class extends EventEmitter {
+  return violations;
 };
-var eventBus = new NeatEventBus();
-eventBus.setMaxListeners(0);
-function emitNeatEvent(envelope) {
-  eventBus.emit(EVENT_BUS_CHANNEL, envelope);
+var policyEvaluators = {
+  structural: evaluateStructural,
+  ownership: evaluateOwnership,
+  provenance: evaluateProvenance,
+  "blast-radius": evaluateBlastRadius,
+  compatibility: evaluateCompatibility
+};
+function canPromoteFrontier(graph, frontierId2, policies, ctx) {
+  if (policies.length === 0) return { allowed: true, violations: [] };
+  const all = evaluateAllPolicies(graph, policies, ctx);
+  const blocking = all.filter((v) => {
+    if (v.onViolation !== "block") return false;
+    return v.subject.nodeId === frontierId2 || v.subject.path?.includes(frontierId2) === true;
+  });
+  return { allowed: blocking.length === 0, violations: blocking };
 }
-function attachGraphToEventBus(graph, opts) {
-  const { project } = opts;
-  const onNodeAdded = (payload) => {
-    emitNeatEvent({
-      type: "node-added",
-      project,
-      payload: { node: payload.attributes }
-    });
-  };
-  const onNodeDropped = (payload) => {
-    emitNeatEvent({
-      type: "node-removed",
-      project,
-      payload: { id: payload.key }
-    });
-  };
-  const onEdgeAdded = (payload) => {
-    emitNeatEvent({
-      type: "edge-added",
-      project,
-      payload: { edge: payload.attributes }
-    });
-  };
-  const onEdgeDropped = (payload) => {
-    emitNeatEvent({
-      type: "edge-removed",
-      project,
-      payload: { id: payload.key }
-    });
-  };
-  const onNodeAttrsUpdated = (payload) => {
-    emitNeatEvent({
-      type: "node-updated",
-      project,
-      payload: { id: payload.key, changes: payload.attributes }
+function evaluateAllPolicies(graph, policies, ctx) {
+  const out = [];
+  for (const policy of policies) {
+    const evaluator = policyEvaluators[policy.rule.type];
+    const violations = evaluator({ graph, policy, rule: policy.rule, ctx });
+    for (const v of violations) out.push(v);
+  }
+  return out;
+}
+function selectApplicablePolicies(graph, policies, nodeId) {
+  if (!graph.hasNode(nodeId)) return [];
+  const node = graph.getNodeAttributes(nodeId);
+  const out = [];
+  for (const policy of policies) {
+    const m = matchPolicyToNode(graph, policy, nodeId, node);
+    if (!m) continue;
+    out.push({
+      policyId: policy.id,
+      policyName: policy.name,
+      ...policy.description !== void 0 ? { description: policy.description } : {},
+      severity: policy.severity,
+      onViolation: resolveOnViolation(policy),
+      ruleType: policy.rule.type,
+      match: m.match,
+      reason: m.reason
     });
-  };
-  graph.on("nodeAdded", onNodeAdded);
-  graph.on("nodeDropped", onNodeDropped);
-  graph.on("edgeAdded", onEdgeAdded);
-  graph.on("edgeDropped", onEdgeDropped);
-  graph.on("nodeAttributesUpdated", onNodeAttrsUpdated);
-  return () => {
-    graph.off("nodeAdded", onNodeAdded);
-    graph.off("nodeDropped", onNodeDropped);
-    graph.off("edgeAdded", onEdgeAdded);
-    graph.off("edgeDropped", onEdgeDropped);
-    graph.off("nodeAttributesUpdated", onNodeAttrsUpdated);
-  };
+  }
+  return out;
 }
-
-// src/policy.ts
-var DEFAULT_ACTION_BY_SEVERITY = {
-  info: "log",
-  warning: "alert",
-  error: "alert",
-  critical: "block"
-};
-function resolveOnViolation(policy) {
-  return policy.onViolation ?? DEFAULT_ACTION_BY_SEVERITY[policy.severity];
+function requiredProvenanceList(required) {
+  if (Array.isArray(required)) return required.join(" | ");
+  return String(required);
 }
-function makeViolation(policy, rule, contextSuffix, message, subject, ctx) {
-  return {
-    id: `${policy.id}:${contextSuffix}`,
-    policyId: policy.id,
-    policyName: policy.name,
-    severity: policy.severity,
-    onViolation: resolveOnViolation(policy),
-    ruleType: rule.type,
-    subject,
-    message,
-    observedAt: new Date(ctx.now()).toISOString()
-  };
+function nodeTouchesEdgeType(graph, nodeId, edgeType, requiredOtherEnd) {
+  const incident = [...graph.outboundEdges(nodeId), ...graph.inboundEdges(nodeId)];
+  for (const edgeId of incident) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== edgeType) continue;
+    if (requiredOtherEnd === void 0) return true;
+    if (e.source === requiredOtherEnd || e.target === requiredOtherEnd) return true;
+  }
+  return false;
 }
-var evaluateStructural = ({
-  graph,
-  policy,
-  rule,
-  ctx
-}) => {
-  const violations = [];
-  graph.forEachNode((id, attrs) => {
-    const a = attrs;
-    if (a.type !== rule.fromNodeType) return;
-    let satisfied = false;
-    for (const edgeId of graph.outboundEdges(id)) {
-      const e = graph.getEdgeAttributes(edgeId);
-      if (e.type !== rule.edgeType) continue;
-      const target = graph.getNodeAttributes(e.target);
-      if (target.type === NodeType2.FrontierNode) continue;
-      if (target.type === rule.toNodeType) {
-        satisfied = true;
-        break;
+function blastRadiusSubjectReaching(graph, rule, nodeId) {
+  let found = null;
+  graph.forEachNode((subjId, attrs) => {
+    if (found !== null) return;
+    if (subjId === nodeId) return;
+    if (attrs.type !== rule.nodeType) return;
+    const radius = rule.depth !== void 0 ? getBlastRadius(graph, subjId, rule.depth) : getBlastRadius(graph, subjId);
+    if (radius.affectedNodes.some((n) => n.nodeId === nodeId)) found = subjId;
+  });
+  return found;
+}
+function matchPolicyToNode(graph, policy, nodeId, node) {
+  const rule = policy.rule;
+  switch (rule.type) {
+    case "structural": {
+      if (node.type === rule.fromNodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.fromNodeType} must have a ${rule.edgeType} edge to a ${rule.toNodeType}`
+        };
+      }
+      if (node.type === rule.toNodeType) {
+        return {
+          match: "region",
+          reason: `${rule.fromNodeType} nodes must reach a ${rule.toNodeType} like this one via a ${rule.edgeType} edge`
+        };
       }
+      return null;
     }
-    if (!satisfied) {
-      violations.push(
-        makeViolation(
-          policy,
-          rule,
-          id,
-          `${rule.fromNodeType} ${id} has no ${rule.edgeType} edge to a ${rule.toNodeType}`,
-          { nodeId: id },
-          ctx
-        )
-      );
+    case "ownership": {
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `every ${rule.nodeType} must declare a non-empty "${rule.field}" field`
+        };
+      }
+      return null;
     }
-  });
-  return violations;
-};
-var evaluateOwnership = ({
-  graph,
-  policy,
-  rule,
-  ctx
-}) => {
-  const violations = [];
-  graph.forEachNode((id, attrs) => {
-    const a = attrs;
-    if (a.type !== rule.nodeType) return;
-    const value = a[rule.field];
-    if (typeof value !== "string" || value.length === 0) {
-      violations.push(
-        makeViolation(
-          policy,
-          rule,
-          id,
-          `${rule.nodeType} ${id} is missing required field "${rule.field}"`,
-          { nodeId: id },
-          ctx
-        )
-      );
+    case "blast-radius": {
+      const depthLabel = rule.depth !== void 0 ? ` at depth ${rule.depth}` : "";
+      if (node.type === rule.nodeType) {
+        return {
+          match: "subject",
+          reason: `no ${rule.nodeType} may exceed a blast radius of ${rule.maxAffected}${depthLabel}`
+        };
+      }
+      const subject = blastRadiusSubjectReaching(graph, rule, nodeId);
+      if (subject) {
+        return {
+          match: "region",
+          reason: `this node is in the blast radius of ${subject} (a ${rule.nodeType} held to a blast radius of ${rule.maxAffected}${depthLabel}) \u2014 it breaks if that ${rule.nodeType} changes`
+        };
+      }
+      return null;
     }
-  });
-  return violations;
-};
-var evaluateProvenance = ({
-  graph,
-  policy,
-  rule,
-  ctx
-}) => {
-  const required = Array.isArray(rule.required) ? new Set(rule.required) : /* @__PURE__ */ new Set([rule.required]);
-  const violations = [];
-  graph.forEachEdge((edgeId, attrs) => {
-    const e = attrs;
-    if (e.type !== rule.edgeType) return;
-    if (rule.targetNodeId && e.target !== rule.targetNodeId) return;
-    if (!required.has(e.provenance)) {
-      const requiredList = [...required].join(" | ");
-      violations.push(
-        makeViolation(
-          policy,
-          rule,
-          edgeId,
-          `${rule.edgeType} edge ${edgeId} has provenance ${e.provenance}; required ${requiredList}`,
-          { edgeId },
-          ctx
-        )
-      );
-    }
-  });
-  return violations;
-};
-var evaluateBlastRadius = ({
-  graph,
-  policy,
-  rule,
-  ctx
-}) => {
-  const violations = [];
-  const depth = rule.depth;
-  graph.forEachNode((id, attrs) => {
-    const a = attrs;
-    if (a.type !== rule.nodeType) return;
-    const result = depth !== void 0 ? getBlastRadius(graph, id, depth) : getBlastRadius(graph, id);
-    if (result.totalAffected > rule.maxAffected) {
-      violations.push(
-        makeViolation(
-          policy,
-          rule,
-          id,
-          `${rule.nodeType} ${id} has blast radius ${result.totalAffected} > ${rule.maxAffected}`,
-          { nodeId: id, path: [id] },
-          ctx
-        )
-      );
-    }
-  });
-  return violations;
-};
-var evaluateCompatibility = ({
-  graph,
-  policy,
-  rule,
-  ctx
-}) => {
-  const violations = [];
-  const wantsKind = (kind) => rule.kind === void 0 || rule.kind === kind;
-  graph.forEachNode((svcId, attrs) => {
-    const a = attrs;
-    if (a.type !== NodeType2.ServiceNode) return;
-    const svc = a;
-    const deps = svc.dependencies ?? {};
-    if (wantsKind("driver-engine")) {
-      for (const edgeId of graph.outboundEdges(svcId)) {
-        const e = graph.getEdgeAttributes(edgeId);
-        if (e.type !== EdgeType2.CONNECTS_TO) continue;
-        const dbAttrs = graph.getNodeAttributes(e.target);
-        if (dbAttrs.type === NodeType2.FrontierNode) continue;
-        if (dbAttrs.type !== NodeType2.DatabaseNode) continue;
-        const db = dbAttrs;
-        for (const pair of compatPairs()) {
-          if (pair.engine !== db.engine) continue;
-          const declared = deps[pair.driver];
-          if (!declared) continue;
-          const result = checkCompatibility(pair.driver, declared, db.engine, db.engineVersion);
-          if (!result.compatible && result.reason) {
-            violations.push(
-              makeViolation(
-                policy,
-                rule,
-                `${svcId}:driver-engine:${pair.driver}@${declared}:${db.engine}@${db.engineVersion}`,
-                result.reason,
-                { nodeId: svcId, edgeId },
-                ctx
-              )
-            );
-          }
-        }
-      }
-    }
-    if (wantsKind("node-engine")) {
-      const serviceNodeRange = svc.nodeEngine;
-      for (const constraint of nodeEngineConstraints()) {
-        const declared = deps[constraint.package];
-        if (!declared) continue;
-        const result = checkNodeEngineConstraint(constraint, declared, serviceNodeRange);
-        if (!result.compatible && result.reason) {
-          violations.push(
-            makeViolation(
-              policy,
-              rule,
-              `${svcId}:node-engine:${constraint.package}@${declared}`,
-              result.reason,
-              { nodeId: svcId },
-              ctx
-            )
-          );
-        }
-      }
-    }
-    if (wantsKind("package-conflict")) {
-      for (const conflict of packageConflicts()) {
-        const declared = deps[conflict.package];
-        if (!declared) continue;
-        const requiredDeclared = deps[conflict.requires.name];
-        const result = checkPackageConflict(conflict, declared, requiredDeclared);
-        if (!result.compatible && result.reason) {
-          violations.push(
-            makeViolation(
-              policy,
-              rule,
-              `${svcId}:package-conflict:${conflict.package}@${declared}`,
-              result.reason,
-              { nodeId: svcId },
-              ctx
-            )
-          );
-        }
-      }
-    }
-    if (wantsKind("deprecated-api")) {
-      for (const dep of deprecatedApis()) {
-        const declared = deps[dep.package];
-        if (!declared) continue;
-        const result = checkDeprecatedApi(dep, declared);
-        if (!result.compatible && result.reason) {
-          violations.push(
-            makeViolation(
-              policy,
-              rule,
-              `${svcId}:deprecated-api:${dep.package}@${declared}`,
-              result.reason,
-              { nodeId: svcId },
-              ctx
-            )
-          );
-        }
-      }
-    }
-  });
-  return violations;
-};
-var policyEvaluators = {
-  structural: evaluateStructural,
-  ownership: evaluateOwnership,
-  provenance: evaluateProvenance,
-  "blast-radius": evaluateBlastRadius,
-  compatibility: evaluateCompatibility
-};
-function canPromoteFrontier(graph, frontierId2, policies, ctx) {
-  if (policies.length === 0) return { allowed: true, violations: [] };
-  const all = evaluateAllPolicies(graph, policies, ctx);
-  const blocking = all.filter((v) => {
-    if (v.onViolation !== "block") return false;
-    return v.subject.nodeId === frontierId2 || v.subject.path?.includes(frontierId2) === true;
-  });
-  return { allowed: blocking.length === 0, violations: blocking };
-}
-function evaluateAllPolicies(graph, policies, ctx) {
-  const out = [];
-  for (const policy of policies) {
-    const evaluator = policyEvaluators[policy.rule.type];
-    const violations = evaluator({ graph, policy, rule: policy.rule, ctx });
-    for (const v of violations) out.push(v);
-  }
-  return out;
-}
-function selectApplicablePolicies(graph, policies, nodeId) {
-  if (!graph.hasNode(nodeId)) return [];
-  const node = graph.getNodeAttributes(nodeId);
-  const out = [];
-  for (const policy of policies) {
-    const m = matchPolicyToNode(graph, policy, nodeId, node);
-    if (!m) continue;
-    out.push({
-      policyId: policy.id,
-      policyName: policy.name,
-      ...policy.description !== void 0 ? { description: policy.description } : {},
-      severity: policy.severity,
-      onViolation: resolveOnViolation(policy),
-      ruleType: policy.rule.type,
-      match: m.match,
-      reason: m.reason
-    });
-  }
-  return out;
-}
-function requiredProvenanceList(required) {
-  if (Array.isArray(required)) return required.join(" | ");
-  return String(required);
-}
-function nodeTouchesEdgeType(graph, nodeId, edgeType, requiredOtherEnd) {
-  const incident = [...graph.outboundEdges(nodeId), ...graph.inboundEdges(nodeId)];
-  for (const edgeId of incident) {
-    const e = graph.getEdgeAttributes(edgeId);
-    if (e.type !== edgeType) continue;
-    if (requiredOtherEnd === void 0) return true;
-    if (e.source === requiredOtherEnd || e.target === requiredOtherEnd) return true;
-  }
-  return false;
-}
-function blastRadiusSubjectReaching(graph, rule, nodeId) {
-  let found = null;
-  graph.forEachNode((subjId, attrs) => {
-    if (found !== null) return;
-    if (subjId === nodeId) return;
-    if (attrs.type !== rule.nodeType) return;
-    const radius = rule.depth !== void 0 ? getBlastRadius(graph, subjId, rule.depth) : getBlastRadius(graph, subjId);
-    if (radius.affectedNodes.some((n) => n.nodeId === nodeId)) found = subjId;
-  });
-  return found;
-}
-function matchPolicyToNode(graph, policy, nodeId, node) {
-  const rule = policy.rule;
-  switch (rule.type) {
-    case "structural": {
-      if (node.type === rule.fromNodeType) {
-        return {
-          match: "subject",
-          reason: `every ${rule.fromNodeType} must have a ${rule.edgeType} edge to a ${rule.toNodeType}`
-        };
-      }
-      if (node.type === rule.toNodeType) {
-        return {
-          match: "region",
-          reason: `${rule.fromNodeType} nodes must reach a ${rule.toNodeType} like this one via a ${rule.edgeType} edge`
-        };
-      }
-      return null;
-    }
-    case "ownership": {
-      if (node.type === rule.nodeType) {
-        return {
-          match: "subject",
-          reason: `every ${rule.nodeType} must declare a non-empty "${rule.field}" field`
-        };
-      }
-      return null;
-    }
-    case "blast-radius": {
-      const depthLabel = rule.depth !== void 0 ? ` at depth ${rule.depth}` : "";
-      if (node.type === rule.nodeType) {
-        return {
-          match: "subject",
-          reason: `no ${rule.nodeType} may exceed a blast radius of ${rule.maxAffected}${depthLabel}`
-        };
-      }
-      const subject = blastRadiusSubjectReaching(graph, rule, nodeId);
-      if (subject) {
-        return {
-          match: "region",
-          reason: `this node is in the blast radius of ${subject} (a ${rule.nodeType} held to a blast radius of ${rule.maxAffected}${depthLabel}) \u2014 it breaks if that ${rule.nodeType} changes`
-        };
-      }
-      return null;
-    }
-    case "compatibility": {
-      const kindLabel = rule.kind ?? "all compat shapes";
-      if (node.type === NodeType2.ServiceNode) {
-        return {
-          match: "subject",
-          reason: `this service's dependencies are compatibility-checked (${kindLabel})`
-        };
-      }
-      const reachesDriverEngine = rule.kind === void 0 || rule.kind === "driver-engine";
-      if (reachesDriverEngine && node.type === NodeType2.DatabaseNode && nodeTouchesEdgeType(graph, nodeId, EdgeType2.CONNECTS_TO)) {
-        return {
-          match: "region",
-          reason: "services connecting to this database have their driver/engine compatibility checked against it"
-        };
-      }
-      return null;
+    case "compatibility": {
+      const kindLabel = rule.kind ?? "all compat shapes";
+      if (node.type === NodeType.ServiceNode) {
+        return {
+          match: "subject",
+          reason: `this service's dependencies are compatibility-checked (${kindLabel})`
+        };
+      }
+      const reachesDriverEngine = rule.kind === void 0 || rule.kind === "driver-engine";
+      if (reachesDriverEngine && node.type === NodeType.DatabaseNode && nodeTouchesEdgeType(graph, nodeId, EdgeType.CONNECTS_TO)) {
+        return {
+          match: "region",
+          reason: "services connecting to this database have their driver/engine compatibility checked against it"
+        };
+      }
+      return null;
     }
     case "provenance": {
       const requiredList = requiredProvenanceList(rule.required);
@@ -1372,11 +857,11 @@ var PolicyViolationsLog = class {
 
 // src/ingest.ts
 import {
-  EdgeType as EdgeType3,
+  EdgeType as EdgeType2,
   GraphEdgeSchema,
   GraphNodeSchema,
-  NodeType as NodeType3,
-  Provenance as Provenance2,
+  NodeType as NodeType2,
+  Provenance,
   confidenceForObservedSignal,
   databaseId,
   localDatabaseId,
@@ -1560,9 +1045,30 @@ function isLoopbackHost(host) {
   const h = host.toLowerCase();
   return h === "localhost" || h === "ip6-localhost" || h === "::1" || h === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(h);
 }
+var CODE_FILE_PATH_ATTR = "code.file.path";
 var CODE_FILEPATH_ATTR = "code.filepath";
+var CODE_LINE_NUMBER_ATTR = "code.line.number";
 var CODE_LINENO_ATTR = "code.lineno";
+var CODE_FUNCTION_NAME_ATTR = "code.function.name";
 var CODE_FUNCTION_ATTR = "code.function";
+function codeFilepathOf(attrs) {
+  const stable = attrs[CODE_FILE_PATH_ATTR];
+  if (typeof stable === "string" && stable.length > 0) return stable;
+  const prior = attrs[CODE_FILEPATH_ATTR];
+  return typeof prior === "string" && prior.length > 0 ? prior : void 0;
+}
+function codeLinenoOf(attrs) {
+  const stable = attrs[CODE_LINE_NUMBER_ATTR];
+  if (typeof stable === "number" && Number.isFinite(stable)) return stable;
+  const prior = attrs[CODE_LINENO_ATTR];
+  return typeof prior === "number" && Number.isFinite(prior) ? prior : void 0;
+}
+function codeFunctionOf(attrs) {
+  const stable = attrs[CODE_FUNCTION_NAME_ATTR];
+  if (typeof stable === "string" && stable.length > 0) return stable;
+  const prior = attrs[CODE_FUNCTION_ATTR];
+  return typeof prior === "string" && prior.length > 0 ? prior : void 0;
+}
 function toPosix(p) {
   return p.split("\\").join("/");
 }
@@ -1640,10 +1146,9 @@ function resolveDistToSrc(absFilepath, line) {
   }
 }
 function callSiteFromSpan(span, serviceNode, scanPath) {
-  const filepath = span.attributes[CODE_FILEPATH_ATTR];
-  if (typeof filepath !== "string" || filepath.length === 0) return null;
-  const linenoRaw = span.attributes[CODE_LINENO_ATTR];
-  let line = typeof linenoRaw === "number" && Number.isFinite(linenoRaw) ? linenoRaw : void 0;
+  const filepath = codeFilepathOf(span.attributes);
+  if (filepath === void 0) return null;
+  let line = codeLinenoOf(span.attributes);
   const abs = toPosix(filepath).replace(/^file:\/\//, "");
   const resolved = resolveDistToSrc(abs, line);
   let effectivePath = filepath;
@@ -1658,8 +1163,7 @@ function callSiteFromSpan(span, serviceNode, scanPath) {
   if (!resolved && abs.endsWith(".js") && relPath.startsWith("dist/") && serviceNode?.name) {
     warnNoSourceMaps(serviceNode.name);
   }
-  const fnRaw = span.attributes[CODE_FUNCTION_ATTR];
-  const fn = typeof fnRaw === "string" && fnRaw.length > 0 ? fnRaw : void 0;
+  const fn = codeFunctionOf(span.attributes);
   return {
     relPath,
     ...line !== void 0 ? { line } : {},
@@ -1672,7 +1176,7 @@ function reconcileObservedRelPath(graph, serviceName, relPath) {
   let best = null;
   graph.forEachNode((_id, attrs) => {
     const a = attrs;
-    if (a.type !== NodeType3.FileNode || a.service !== serviceName) return;
+    if (a.type !== NodeType2.FileNode || a.service !== serviceName) return;
     if (a.discoveredVia === "otel") return;
     const p = a.path;
     if (!p) return;
@@ -1689,7 +1193,7 @@ function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
     const language = languageForExt(relPath);
     const node = {
       id: fileNodeId,
-      type: NodeType3.FileNode,
+      type: NodeType2.FileNode,
       service: serviceName,
       path: relPath,
       ...language ? { language } : {},
@@ -1698,14 +1202,14 @@ function ensureObservedFileNode(graph, serviceName, serviceNodeId, callSite) {
     };
     graph.addNode(fileNodeId, node);
   }
-  const containsId = makeObservedEdgeId(EdgeType3.CONTAINS, serviceNodeId, fileNodeId);
+  const containsId = makeObservedEdgeId(EdgeType2.CONTAINS, serviceNodeId, fileNodeId);
   if (!graph.hasEdge(containsId)) {
     const edge = {
       id: containsId,
       source: serviceNodeId,
       target: fileNodeId,
-      type: EdgeType3.CONTAINS,
-      provenance: Provenance2.OBSERVED
+      type: EdgeType2.CONTAINS,
+      provenance: Provenance.OBSERVED
     };
     graph.addEdgeWithKey(containsId, serviceNodeId, fileNodeId, edge);
   }
@@ -1720,9 +1224,9 @@ function makeInferredEdgeId(type, source, target) {
 var INFERRED_CONFIDENCE = 0.6;
 var STITCH_MAX_DEPTH = 2;
 var STITCH_EDGE_TYPES = /* @__PURE__ */ new Set([
-  EdgeType3.CALLS,
-  EdgeType3.CONNECTS_TO,
-  EdgeType3.DEPENDS_ON
+  EdgeType2.CALLS,
+  EdgeType2.CONNECTS_TO,
+  EdgeType2.DEPENDS_ON
 ]);
 var WIRE_SPAN_KIND_CLIENT = 3;
 var WIRE_SPAN_KIND_PRODUCER = 4;
@@ -1742,7 +1246,7 @@ function ensureGraphqlOperationNode(graph, serviceName, operationType, operation
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.GraphQLOperationNode,
+    type: NodeType2.GraphQLOperationNode,
     name: operationName,
     service: serviceName,
     operationType: operationType.toLowerCase(),
@@ -1760,7 +1264,7 @@ function ensureGrpcMethodNode(graph, rpcService, rpcMethod) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.GrpcMethodNode,
+    type: NodeType2.GrpcMethodNode,
     name: `${rpcService}/${rpcMethod}`,
     rpcService,
     rpcMethod,
@@ -1777,7 +1281,7 @@ function ensureWebsocketChannelNode(graph, serviceName, channel) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.WebSocketChannelNode,
+    type: NodeType2.WebSocketChannelNode,
     name: channel,
     service: serviceName,
     channel,
@@ -1794,7 +1298,7 @@ function ensureMessagingDestinationNode(graph, system, destination) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.InfraNode,
+    type: NodeType2.InfraNode,
     name: destination,
     provider: "self",
     kind: messagingDestinationKind(system)
@@ -1848,7 +1352,7 @@ function resolveServiceId(graph, host, env) {
   graph.forEachNode((id, attrs) => {
     if (sameEnv) return;
     const a = attrs;
-    if (a.type !== NodeType3.ServiceNode) return;
+    if (a.type !== NodeType2.ServiceNode) return;
     const matchesByName = a.name === host;
     const matchesByAlias = a.aliases ? a.aliases.includes(host) : false;
     if (!matchesByName && !matchesByAlias) return;
@@ -1870,7 +1374,7 @@ function ensureServiceNode(graph, serviceName, env) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.ServiceNode,
+    type: NodeType2.ServiceNode,
     name: serviceName,
     language: "unknown",
     discoveredVia: "otel",
@@ -1884,7 +1388,7 @@ function ensureInfraNode(graph, kind, name, provider) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.InfraNode,
+    type: NodeType2.InfraNode,
     name,
     provider,
     kind
@@ -1897,7 +1401,7 @@ function ensureDatabaseNode(graph, host, engine) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.DatabaseNode,
+    type: NodeType2.DatabaseNode,
     name: host,
     engine,
     engineVersion: "unknown",
@@ -1913,7 +1417,7 @@ function ensureLocalDatabaseNode(graph, serviceName, name, engine) {
   if (graph.hasNode(id)) return id;
   const node = {
     id,
-    type: NodeType3.DatabaseNode,
+    type: NodeType2.DatabaseNode,
     name,
     engine,
     engineVersion: "unknown",
@@ -1928,17 +1432,17 @@ function findDeclaredDatabaseForService(graph, serviceNodeId, engine) {
   const sources = [serviceNodeId];
   for (const edgeId of graph.outboundEdges(serviceNodeId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType3.CONTAINS) sources.push(e.target);
+    if (e.type === EdgeType2.CONTAINS) sources.push(e.target);
   }
   const matches = /* @__PURE__ */ new Set();
   for (const src of sources) {
     if (!graph.hasNode(src)) continue;
     for (const edgeId of graph.outboundEdges(src)) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.type !== EdgeType3.CONNECTS_TO || edge.provenance !== Provenance2.EXTRACTED) continue;
+      if (edge.type !== EdgeType2.CONNECTS_TO || edge.provenance !== Provenance.EXTRACTED) continue;
       if (!graph.hasNode(edge.target)) continue;
       const target = graph.getNodeAttributes(edge.target);
-      if (target.type !== NodeType3.DatabaseNode || target.engine !== engine) continue;
+      if (target.type !== NodeType2.DatabaseNode || target.engine !== engine) continue;
       matches.add(edge.target);
     }
   }
@@ -1953,7 +1457,7 @@ function ensureFrontierNode(graph, host, ts) {
   }
   const node = {
     id,
-    type: NodeType3.FrontierNode,
+    type: NodeType2.FrontierNode,
     name: host,
     host,
     firstObserved: ts,
@@ -1977,7 +1481,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     };
     const updated = {
       ...existing,
-      provenance: Provenance2.OBSERVED,
+      provenance: Provenance.OBSERVED,
       lastObserved: ts,
       callCount: newSpanCount,
       signal: newSignal,
@@ -1998,7 +1502,7 @@ function upsertObservedEdge(graph, type, source, target, ts, isError = false, ev
     source,
     target,
     type,
-    provenance: Provenance2.OBSERVED,
+    provenance: Provenance.OBSERVED,
     confidence: confidenceForObservedSignal(signal),
     lastObserved: ts,
     callCount: 1,
@@ -2021,7 +1525,7 @@ function stitchTrace(graph, sourceServiceId, ts) {
     const outbound = graph.outboundEdges(nodeId);
     for (const edgeId of outbound) {
       const edge = graph.getEdgeAttributes(edgeId);
-      if (edge.provenance !== Provenance2.EXTRACTED) continue;
+      if (edge.provenance !== Provenance.EXTRACTED) continue;
       if (!STITCH_EDGE_TYPES.has(edge.type)) continue;
       if (graph.hasEdge(observedEdgeId(edge.source, edge.target, edge.type))) continue;
       upsertInferredEdge(graph, edge.type, edge.source, edge.target, ts);
@@ -2045,7 +1549,7 @@ function upsertInferredEdge(graph, type, source, target, ts) {
     source,
     target,
     type,
-    provenance: Provenance2.INFERRED,
+    provenance: Provenance.INFERRED,
     confidence: INFERRED_CONFIDENCE,
     lastObserved: ts
   };
@@ -2221,7 +1725,7 @@ async function handleSpan(ctx, span) {
       }
       const result = upsertObservedEdge(
         ctx.graph,
-        EdgeType3.CONNECTS_TO,
+        EdgeType2.CONNECTS_TO,
         observedSource(),
         targetId,
         ts,
@@ -2233,7 +1737,7 @@ async function handleSpan(ctx, span) {
         const collectionId = ensureInfraNode(ctx.graph, "mongodb-collection", span.dbCollection, "self");
         upsertObservedEdge(
           ctx.graph,
-          EdgeType3.CALLS,
+          EdgeType2.CALLS,
           observedSource(),
           collectionId,
           ts,
@@ -2241,6 +1745,18 @@ async function handleSpan(ctx, span) {
           callSiteEvidence
         );
       }
+      if (span.dbTable) {
+        const tableId = ensureInfraNode(ctx.graph, "sql-table", span.dbTable, "self");
+        upsertObservedEdge(
+          ctx.graph,
+          EdgeType2.CALLS,
+          observedSource(),
+          tableId,
+          ts,
+          isError,
+          callSiteEvidence
+        );
+      }
     }
   } else if (span.messagingSystem && span.messagingDestination && spanMintsMessagingEdge(span.kind)) {
     const targetId = ensureMessagingDestinationNode(
@@ -2248,7 +1764,7 @@ async function handleSpan(ctx, span) {
       span.messagingSystem,
       span.messagingDestination
     );
-    const edgeType = span.kind === WIRE_SPAN_KIND_CONSUMER ? EdgeType3.CONSUMES_FROM : EdgeType3.PUBLISHES_TO;
+    const edgeType = span.kind === WIRE_SPAN_KIND_CONSUMER ? EdgeType2.CONSUMES_FROM : EdgeType2.PUBLISHES_TO;
     const result = upsertObservedEdge(
       ctx.graph,
       edgeType,
@@ -2268,7 +1784,7 @@ async function handleSpan(ctx, span) {
     );
     const result = upsertObservedEdge(
       ctx.graph,
-      EdgeType3.CONTAINS,
+      EdgeType2.CONTAINS,
       observedSource(),
       targetId,
       ts,
@@ -2280,7 +1796,7 @@ async function handleSpan(ctx, span) {
     const targetId = ensureGrpcMethodNode(ctx.graph, span.rpcService, span.rpcMethod);
     const result = upsertObservedEdge(
       ctx.graph,
-      EdgeType3.CONTAINS,
+      EdgeType2.CONTAINS,
       observedSource(),
       targetId,
       ts,
@@ -2296,7 +1812,7 @@ async function handleSpan(ctx, span) {
     );
     const result = upsertObservedEdge(
       ctx.graph,
-      EdgeType3.CONNECTS_TO,
+      EdgeType2.CONNECTS_TO,
       observedSource(),
       targetId,
       ts,
@@ -2312,7 +1828,7 @@ async function handleSpan(ctx, span) {
       if (targetId && targetId !== sourceId) {
         upsertObservedEdge(
           ctx.graph,
-          EdgeType3.CALLS,
+          EdgeType2.CALLS,
           observedSource(),
           targetId,
           ts,
@@ -2325,7 +1841,7 @@ async function handleSpan(ctx, span) {
         const frontierNodeId = ensureFrontierNode(ctx.graph, host, ts);
         upsertObservedEdge(
           ctx.graph,
-          EdgeType3.CALLS,
+          EdgeType2.CALLS,
           observedSource(),
           frontierNodeId,
           ts,
@@ -2351,7 +1867,7 @@ async function handleSpan(ctx, span) {
         } : void 0;
         upsertObservedEdge(
           ctx.graph,
-          EdgeType3.CALLS,
+          EdgeType2.CALLS,
           fallbackSource,
           sourceId,
           ts,
@@ -2361,286 +1877,801 @@ async function handleSpan(ctx, span) {
       }
     }
   }
-  if (span.statusCode === 2) {
-    stitchTrace(ctx.graph, sourceId, ts);
-    if (ctx.writeErrorEventInline !== false) {
-      const attrs = sanitizeAttributes(span.attributes);
-      const ev = {
-        id: `${span.traceId}:${span.spanId}`,
-        timestamp: ts,
-        service: span.service,
-        traceId: span.traceId,
-        spanId: span.spanId,
-        errorMessage: incidentMessage(span),
-        ...span.exception?.type ? { exceptionType: span.exception.type } : {},
-        ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
-        ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
-        affectedNode
-      };
-      await appendErrorEvent(ctx, ev);
+  if (span.statusCode === 2) {
+    stitchTrace(ctx.graph, sourceId, ts);
+    if (ctx.writeErrorEventInline !== false) {
+      const attrs = sanitizeAttributes(span.attributes);
+      const ev = {
+        id: `${span.traceId}:${span.spanId}`,
+        timestamp: ts,
+        service: span.service,
+        traceId: span.traceId,
+        spanId: span.spanId,
+        errorMessage: incidentMessage(span),
+        ...span.exception?.type ? { exceptionType: span.exception.type } : {},
+        ...span.exception?.stacktrace ? { exceptionStacktrace: span.exception.stacktrace } : {},
+        ...Object.keys(attrs).length > 0 ? { attributes: attrs } : {},
+        affectedNode
+      };
+      await appendErrorEvent(ctx, ev);
+    }
+  }
+  if (span.statusCode !== 2) {
+    const status = httpResponseStatus(span);
+    if (span.exception) {
+      await recordExceptionIncident(ctx, span, ts);
+    } else if (status !== void 0 && status >= 500) {
+      await recordFailingResponseIncident(ctx, span, sourceId, ts, status, 1);
+    } else if (status !== void 0 && status >= 400 && spanMintsObservedEdge(span.kind)) {
+      await advance4xxBurst(ctx, span, sourceId, ts, nowMs, status);
+    }
+  }
+  void affectedNode;
+  if (ctx.onPolicyTrigger) await ctx.onPolicyTrigger(ctx.graph);
+}
+function promoteFrontierNodes(graph, opts = {}) {
+  const aliasIndex = /* @__PURE__ */ new Map();
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType2.ServiceNode) return;
+    aliasIndex.set(a.name, id);
+    if (a.aliases) {
+      for (const alias of a.aliases) aliasIndex.set(alias, id);
+    }
+  });
+  const toPromote = [];
+  graph.forEachNode((id, attrs) => {
+    const a = attrs;
+    if (a.type !== NodeType2.FrontierNode) return;
+    const target = aliasIndex.get(a.host);
+    if (!target) return;
+    if (target === id) return;
+    toPromote.push({ frontierId: id, serviceId: target });
+  });
+  let promoted = 0;
+  for (const { frontierId: frontierId2, serviceId: serviceId5 } of toPromote) {
+    if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
+      const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
+      if (!gate.allowed) {
+        continue;
+      }
+    }
+    rewireFrontierEdges(graph, frontierId2, serviceId5);
+    graph.dropNode(frontierId2);
+    promoted++;
+  }
+  return promoted;
+}
+function rewireFrontierEdges(graph, frontierId2, serviceId5) {
+  const inbound = [...graph.inboundEdges(frontierId2)];
+  const outbound = [...graph.outboundEdges(frontierId2)];
+  for (const edgeId of inbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId5, edgeId);
+  }
+  for (const edgeId of outbound) {
+    const edge = graph.getEdgeAttributes(edgeId);
+    rebuildEdge(graph, edge, serviceId5, edge.target, edgeId);
+  }
+}
+function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
+  graph.dropEdge(oldEdgeId);
+  const newId = edge.provenance === Provenance.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : edge.provenance === Provenance.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : extractedEdgeId(newSource, newTarget, edge.type);
+  if (graph.hasEdge(newId)) {
+    const existing = graph.getEdgeAttributes(newId);
+    const merged = {
+      ...existing,
+      callCount: (existing.callCount ?? 0) + (edge.callCount ?? 0),
+      lastObserved: pickLater(existing.lastObserved, edge.lastObserved)
+    };
+    graph.replaceEdgeAttributes(newId, merged);
+    return;
+  }
+  const rebuilt = {
+    ...edge,
+    id: newId,
+    source: newSource,
+    target: newTarget
+  };
+  graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
+}
+function pickLater(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return new Date(a).getTime() >= new Date(b).getTime() ? a : b;
+}
+function makeSpanHandler(ctx) {
+  return (span) => handleSpan(ctx, span);
+}
+async function markStaleEdges(graph, options = {}) {
+  const thresholds = options.thresholds ?? loadStaleThresholdsFromEnv();
+  const now = options.now ?? Date.now();
+  const events = [];
+  const project = options.project ?? DEFAULT_PROJECT;
+  graph.forEachEdge((id, attrs) => {
+    const e = attrs;
+    if (e.provenance !== Provenance.OBSERVED) return;
+    if (!e.lastObserved) return;
+    const threshold = thresholdForEdgeType(e.type, thresholds);
+    const age = now - new Date(e.lastObserved).getTime();
+    if (age > threshold) {
+      const updated = { ...e, provenance: Provenance.STALE, confidence: 0.3 };
+      graph.replaceEdgeAttributes(id, updated);
+      events.push({
+        edgeId: id,
+        source: e.source,
+        target: e.target,
+        edgeType: e.type,
+        thresholdMs: threshold,
+        ageMs: age,
+        lastObserved: e.lastObserved,
+        transitionedAt: new Date(now).toISOString()
+      });
+      emitNeatEvent({
+        type: "stale-transition",
+        project,
+        payload: {
+          edgeId: id,
+          from: Provenance.OBSERVED,
+          to: Provenance.STALE
+        }
+      });
+    }
+  });
+  if (options.staleEventsPath && events.length > 0) {
+    await appendStaleEvents(options.staleEventsPath, events);
+  }
+  return { count: events.length, events };
+}
+async function appendStaleEvents(staleEventsPath, events) {
+  await fs3.mkdir(path3.dirname(staleEventsPath), { recursive: true });
+  const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
+  await fs3.appendFile(staleEventsPath, lines, "utf8");
+}
+async function readStaleEvents(staleEventsPath) {
+  try {
+    const raw = await fs3.readFile(staleEventsPath, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+function startStalenessLoop(graph, options = {}) {
+  let stopped = false;
+  const intervalMs = options.intervalMs ?? 6e4;
+  const tick = () => {
+    if (stopped) return;
+    void (async () => {
+      try {
+        await markStaleEdges(graph, {
+          thresholds: options.thresholds,
+          staleEventsPath: options.staleEventsPath,
+          project: options.project
+        });
+        if (options.onPolicyTrigger) await options.onPolicyTrigger(graph);
+      } catch (err) {
+        console.error("staleness tick failed", err);
+      }
+    })();
+  };
+  const interval = setInterval(tick, intervalMs);
+  if (typeof interval.unref === "function") interval.unref();
+  return () => {
+    stopped = true;
+    clearInterval(interval);
+  };
+}
+async function readErrorEvents(errorsPath) {
+  try {
+    const raw = await fs3.readFile(errorsPath, "utf8");
+    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+    return dedupeIncidents(events);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+function isSynthesizedHttpIncident(ev) {
+  if (ev.exceptionType || ev.exceptionStacktrace) return false;
+  if (ev.errorType) return false;
+  if (!ev.attributes) return false;
+  const synth = httpFailureMessageFromAttrs(ev.attributes);
+  return synth !== void 0 && synth === ev.errorMessage;
+}
+function dedupeIncidents(events) {
+  const seen = /* @__PURE__ */ new Set();
+  const once = [];
+  for (const ev of events) {
+    const key = ev.id ?? (ev.traceId && ev.spanId ? `${ev.traceId}:${ev.spanId}` : void 0);
+    if (key === void 0) {
+      once.push(ev);
+      continue;
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    once.push(ev);
+  }
+  const groupKey = (ev) => `${ev.traceId}\0${ev.affectedNode}`;
+  const hasRealFailure = /* @__PURE__ */ new Set();
+  for (const ev of once) {
+    if (ev.traceId && !isSynthesizedHttpIncident(ev)) hasRealFailure.add(groupKey(ev));
+  }
+  return once.filter((ev) => {
+    if (!ev.traceId || !isSynthesizedHttpIncident(ev)) return true;
+    return !hasRealFailure.has(groupKey(ev));
+  });
+}
+var SnapshotValidationError = class extends Error {
+  constructor(issues) {
+    super(`snapshot failed validation (${issues.length} invalid ${issues.length === 1 ? "entry" : "entries"})`);
+    this.issues = issues;
+    this.name = "SnapshotValidationError";
+  }
+  issues;
+};
+function describeZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
+function mergeSnapshot(graph, snapshot) {
+  const exported = snapshot.graph;
+  const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
+  const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
+  const issues = [];
+  const validNodes = [];
+  const validEdges = [];
+  for (const node of incomingNodes) {
+    if (node.attributes === void 0) continue;
+    const parsed = GraphNodeSchema.safeParse(node.attributes);
+    if (!parsed.success) {
+      issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    validNodes.push({ key: node.key, attributes: parsed.data });
+  }
+  for (const edge of incomingEdges) {
+    if (edge.attributes === void 0) continue;
+    const parsed = GraphEdgeSchema.safeParse(edge.attributes);
+    if (!parsed.success) {
+      const label = edge.key ?? `${edge.source}->${edge.target}`;
+      issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    const id = edge.key ?? parsed.data.id;
+    validEdges.push({ key: id, source: edge.source, target: edge.target, attributes: parsed.data });
+  }
+  if (issues.length > 0) {
+    throw new SnapshotValidationError(issues);
+  }
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const node of validNodes) {
+    if (graph.hasNode(node.key)) continue;
+    graph.addNode(node.key, node.attributes);
+    nodesAdded++;
+  }
+  for (const edge of validEdges) {
+    if (graph.hasEdge(edge.key)) continue;
+    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
+    graph.addEdgeWithKey(edge.key, edge.source, edge.target, edge.attributes);
+    edgesAdded++;
+  }
+  return { nodesAdded, edgesAdded };
+}
+
+// src/traverse.ts
+import {
+  BlastRadiusResultSchema,
+  EdgeType as EdgeType3,
+  NodeType as NodeType3,
+  ObservedDependenciesResultSchema,
+  PROV_RANK,
+  Provenance as Provenance2,
+  RootCauseResultSchema,
+  TransitiveDependenciesResultSchema
+} from "@neat.is/types";
+var ROOT_CAUSE_MAX_DEPTH = 5;
+var BLAST_RADIUS_DEFAULT_DEPTH = 10;
+function isFrontierNode(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return false;
+  const attrs = graph.getNodeAttributes(nodeId);
+  return attrs.type === NodeType3.FrontierNode;
+}
+function resolveOwningService(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return null;
+  const attrs = graph.getNodeAttributes(nodeId);
+  if (attrs.type === NodeType3.ServiceNode) {
+    return { id: nodeId, svc: attrs };
+  }
+  if (attrs.type === NodeType3.FileNode) {
+    for (const edgeId of graph.inboundEdges(nodeId)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== EdgeType3.CONTAINS) continue;
+      const owner = graph.getNodeAttributes(e.source);
+      if (owner.type === NodeType3.ServiceNode) {
+        return { id: e.source, svc: owner };
+      }
+    }
+  }
+  return null;
+}
+function bestEdgeBySource(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (isFrontierNode(graph, e.source)) continue;
+    const cur = best.get(e.source);
+    if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
+      best.set(e.source, e);
     }
   }
-  if (span.statusCode !== 2) {
-    const status = httpResponseStatus(span);
-    if (span.exception) {
-      await recordExceptionIncident(ctx, span, ts);
-    } else if (status !== void 0 && status >= 500) {
-      await recordFailingResponseIncident(ctx, span, sourceId, ts, status, 1);
-    } else if (status !== void 0 && status >= 400 && spanMintsObservedEdge(span.kind)) {
-      await advance4xxBurst(ctx, span, sourceId, ts, nowMs, status);
+  return best;
+}
+function bestEdgeByTarget(graph, edgeIds) {
+  const best = /* @__PURE__ */ new Map();
+  for (const id of edgeIds) {
+    const e = graph.getEdgeAttributes(id);
+    if (isFrontierNode(graph, e.target)) continue;
+    const cur = best.get(e.target);
+    if (!cur || PROV_RANK[e.provenance] > PROV_RANK[cur.provenance]) {
+      best.set(e.target, e);
     }
   }
-  void affectedNode;
-  if (ctx.onPolicyTrigger) await ctx.onPolicyTrigger(ctx.graph);
+  return best;
 }
-function promoteFrontierNodes(graph, opts = {}) {
-  const aliasIndex = /* @__PURE__ */ new Map();
-  graph.forEachNode((id, attrs) => {
-    const a = attrs;
-    if (a.type !== NodeType3.ServiceNode) return;
-    aliasIndex.set(a.name, id);
-    if (a.aliases) {
-      for (const alias of a.aliases) aliasIndex.set(alias, id);
+var PROVENANCE_CEILING = {
+  OBSERVED: 1,
+  INFERRED: 0.7,
+  EXTRACTED: 0.5,
+  STALE: 0.3
+};
+function volumeWeight(spanCount) {
+  if (!spanCount || spanCount <= 0) return 0.5;
+  const w = 0.5 + Math.log10(spanCount + 1) / 3;
+  return Math.min(1, w);
+}
+function recencyWeight(ageMs) {
+  if (ageMs === void 0) return 0.8;
+  const hour = 60 * 60 * 1e3;
+  if (ageMs <= hour) return 1;
+  if (ageMs <= 24 * hour) {
+    const t = (ageMs - hour) / (23 * hour);
+    return 1 - 0.5 * t;
+  }
+  return 0.3;
+}
+function cleanlinessWeight(spanCount, errorCount) {
+  if (!spanCount || spanCount <= 0) return 1;
+  const rate = (errorCount ?? 0) / spanCount;
+  if (rate <= 0.01) return 1;
+  if (rate >= 0.5) return 0.3;
+  return 1 - rate * 1.4;
+}
+function confidenceForEdge(edge, now = Date.now()) {
+  const ceiling = PROVENANCE_CEILING[edge.provenance] ?? 0.5;
+  const spanCount = edge.signal?.spanCount ?? edge.callCount;
+  const ageMs = edge.signal?.lastObservedAgeMs ?? lastObservedAge(edge, now);
+  if (spanCount === void 0 && ageMs === void 0 && edge.signal === void 0) {
+    return ceiling;
+  }
+  const v = volumeWeight(spanCount);
+  const r = recencyWeight(ageMs);
+  const c = cleanlinessWeight(spanCount, edge.signal?.errorCount);
+  return Math.max(0, Math.min(1, ceiling * v * r * c));
+}
+function lastObservedAge(edge, now) {
+  if (!edge.lastObserved) return void 0;
+  const t = Date.parse(edge.lastObserved);
+  if (!Number.isFinite(t)) return void 0;
+  return Math.max(0, now - t);
+}
+function confidenceFromMix(edges, now = Date.now()) {
+  if (edges.length === 0) return 1;
+  let product = 1;
+  for (const e of edges) {
+    product *= confidenceForEdge(e, now);
+  }
+  return Math.max(0, Math.min(1, product));
+}
+function longestIncomingWalk(graph, start, maxDepth) {
+  let best = { path: [start], edges: [] };
+  const visited = /* @__PURE__ */ new Set([start]);
+  function step(node, path49, edges) {
+    if (path49.length > best.path.length) {
+      best = { path: [...path49], edges: [...edges] };
     }
-  });
-  const toPromote = [];
-  graph.forEachNode((id, attrs) => {
-    const a = attrs;
-    if (a.type !== NodeType3.FrontierNode) return;
-    const target = aliasIndex.get(a.host);
-    if (!target) return;
-    if (target === id) return;
-    toPromote.push({ frontierId: id, serviceId: target });
-  });
-  let promoted = 0;
-  for (const { frontierId: frontierId2, serviceId: serviceId5 } of toPromote) {
-    if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
-      const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
-      if (!gate.allowed) {
-        continue;
-      }
+    if (path49.length - 1 >= maxDepth) return;
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
+    for (const [srcId, edge] of incoming) {
+      if (visited.has(srcId)) continue;
+      visited.add(srcId);
+      path49.push(srcId);
+      edges.push(edge);
+      step(srcId, path49, edges);
+      path49.pop();
+      edges.pop();
+      visited.delete(srcId);
     }
-    rewireFrontierEdges(graph, frontierId2, serviceId5);
-    graph.dropNode(frontierId2);
-    promoted++;
   }
-  return promoted;
+  step(start, [start], []);
+  return best;
 }
-function rewireFrontierEdges(graph, frontierId2, serviceId5) {
-  const inbound = [...graph.inboundEdges(frontierId2)];
-  const outbound = [...graph.outboundEdges(frontierId2)];
-  for (const edgeId of inbound) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, edge.source, serviceId5, edgeId);
+function databaseRootCauseShape(graph, origin, walk4) {
+  const targetDb = origin;
+  const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
+  if (candidatePairs.length === 0) return null;
+  for (const id of walk4.path) {
+    const owner = resolveOwningService(graph, id);
+    if (!owner) continue;
+    const { id: serviceId5, svc } = owner;
+    const deps = svc.dependencies ?? {};
+    for (const pair of candidatePairs) {
+      const declared = deps[pair.driver];
+      if (!declared) continue;
+      const result = checkCompatibility(
+        pair.driver,
+        declared,
+        targetDb.engine,
+        targetDb.engineVersion
+      );
+      if (!result.compatible) {
+        return {
+          rootCauseNode: serviceId5,
+          rootCauseReason: result.reason ?? "incompatible driver",
+          ...result.minDriverVersion ? {
+            fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
+          } : {}
+        };
+      }
+    }
   }
-  for (const edgeId of outbound) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, serviceId5, edge.target, edgeId);
+  return null;
+}
+function serviceRootCauseShape(graph, _origin, walk4) {
+  for (const id of walk4.path) {
+    const owner = resolveOwningService(graph, id);
+    if (!owner) continue;
+    const { id: serviceId5, svc } = owner;
+    const deps = svc.dependencies ?? {};
+    const serviceNodeEngine = svc.nodeEngine;
+    for (const constraint of nodeEngineConstraints()) {
+      const declared = deps[constraint.package];
+      if (!declared) continue;
+      const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: serviceId5,
+          rootCauseReason: result.reason,
+          ...result.requiredNodeVersion ? {
+            fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
+          } : {}
+        };
+      }
+    }
+    for (const conflict of packageConflicts()) {
+      const declared = deps[conflict.package];
+      if (!declared) continue;
+      const requiredDeclared = deps[conflict.requires.name];
+      const result = checkPackageConflict(conflict, declared, requiredDeclared);
+      if (!result.compatible && result.reason) {
+        return {
+          rootCauseNode: serviceId5,
+          rootCauseReason: result.reason,
+          fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
+        };
+      }
+    }
   }
+  return null;
 }
-function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
-  graph.dropEdge(oldEdgeId);
-  const newId = edge.provenance === Provenance2.OBSERVED ? observedEdgeId(newSource, newTarget, edge.type) : edge.provenance === Provenance2.INFERRED ? inferredEdgeId(newSource, newTarget, edge.type) : extractedEdgeId(newSource, newTarget, edge.type);
-  if (graph.hasEdge(newId)) {
-    const existing = graph.getEdgeAttributes(newId);
-    const merged = {
-      ...existing,
-      callCount: (existing.callCount ?? 0) + (edge.callCount ?? 0),
-      lastObserved: pickLater(existing.lastObserved, edge.lastObserved)
-    };
-    graph.replaceEdgeAttributes(newId, merged);
-    return;
+function fileRootCauseShape(graph, origin, walk4) {
+  const owner = resolveOwningService(graph, origin.id);
+  if (!owner) return null;
+  return serviceRootCauseShape(graph, owner.svc, walk4);
+}
+var rootCauseShapes = {
+  [NodeType3.DatabaseNode]: databaseRootCauseShape,
+  [NodeType3.ServiceNode]: serviceRootCauseShape,
+  [NodeType3.FileNode]: fileRootCauseShape
+};
+function getRootCause(graph, errorNodeId, errorEvent, incidents) {
+  if (!graph.hasNode(errorNodeId)) return null;
+  const origin = graph.getNodeAttributes(errorNodeId);
+  const shape = rootCauseShapes[origin.type];
+  if (shape) {
+    const walk4 = longestIncomingWalk(graph, errorNodeId, ROOT_CAUSE_MAX_DEPTH);
+    const match = shape(graph, origin, walk4);
+    if (match) {
+      const reason = errorEvent ? `${match.rootCauseReason} (observed error: ${errorEvent.errorMessage})` : match.rootCauseReason;
+      return RootCauseResultSchema.parse({
+        rootCauseNode: match.rootCauseNode,
+        rootCauseReason: reason,
+        traversalPath: walk4.path,
+        edgeProvenances: walk4.edges.map((e) => e.provenance),
+        confidence: confidenceFromMix(walk4.edges),
+        fixRecommendation: match.fixRecommendation
+      });
+    }
   }
-  const rebuilt = {
-    ...edge,
-    id: newId,
-    source: newSource,
-    target: newTarget
-  };
-  graph.addEdgeWithKey(newId, newSource, newTarget, rebuilt);
+  if (origin.type === NodeType3.ServiceNode) {
+    const crossService = crossServiceRootCause(graph, errorNodeId, incidents, errorEvent);
+    if (crossService) return crossService;
+  }
+  return rootCauseFromIncidents(errorNodeId, incidents, errorEvent);
 }
-function pickLater(a, b) {
-  if (!a) return b;
-  if (!b) return a;
-  return new Date(a).getTime() >= new Date(b).getTime() ? a : b;
+var INCIDENT_ROOT_CAUSE_CONFIDENCE = 0.6;
+function incidentMatchesNode(ev, nodeId) {
+  return ev.affectedNode === nodeId || ev.service === nodeId.replace(/^service:/, "");
 }
-function makeSpanHandler(ctx) {
-  return (span) => handleSpan(ctx, span);
+function localizeFromIncidents(nodeId, incidents, errorEvent) {
+  const pool = incidents && incidents.length > 0 ? incidents : errorEvent ? [errorEvent] : [];
+  const relevant = pool.filter((ev) => incidentMatchesNode(ev, nodeId));
+  if (relevant.length === 0) return null;
+  const latest = [...relevant].sort((a, b) => b.timestamp.localeCompare(a.timestamp))[0];
+  const attrs = latest.attributes ?? {};
+  const filepath = codeFilepathOf(attrs);
+  const lineno = codeLinenoOf(attrs);
+  const route = typeof attrs["http.route"] === "string" ? attrs["http.route"] : void 0;
+  const location = filepath ? `${filepath}${lineno !== void 0 ? `:${lineno}` : ""}` : void 0;
+  const sameMode = relevant.filter((ev) => ev.errorMessage === latest.errorMessage);
+  const count = sameMode.length;
+  const tail = count > 1 ? ` (${count} recorded incidents)` : " (1 recorded incident)";
+  const reasonParts = [`${latest.service}: ${latest.errorMessage}`];
+  if (location) reasonParts.push(`surfaced at ${location}`);
+  const rootCauseReason = `${reasonParts.join(" \u2014 ")}${tail}`;
+  const localizesToFile = latest.affectedNode !== nodeId && latest.affectedNode.startsWith("file:");
+  const fileNode = localizesToFile ? latest.affectedNode : void 0;
+  const fixRecommendation = location ? `Inspect ${location}${route ? ` handling ${route}` : ""}` : route ? `Inspect ${latest.service}'s handler for ${route}` : void 0;
+  return {
+    rootCauseNode: fileNode ?? nodeId,
+    rootCauseReason,
+    ...fileNode ? { fileNode } : {},
+    ...fixRecommendation ? { fixRecommendation } : {}
+  };
 }
-async function markStaleEdges(graph, options = {}) {
-  const thresholds = options.thresholds ?? loadStaleThresholdsFromEnv();
-  const now = options.now ?? Date.now();
-  const events = [];
-  const project = options.project ?? DEFAULT_PROJECT;
-  graph.forEachEdge((id, attrs) => {
-    const e = attrs;
-    if (e.provenance !== Provenance2.OBSERVED) return;
-    if (!e.lastObserved) return;
-    const threshold = thresholdForEdgeType(e.type, thresholds);
-    const age = now - new Date(e.lastObserved).getTime();
-    if (age > threshold) {
-      const updated = { ...e, provenance: Provenance2.STALE, confidence: 0.3 };
-      graph.replaceEdgeAttributes(id, updated);
-      events.push({
-        edgeId: id,
-        source: e.source,
-        target: e.target,
-        edgeType: e.type,
-        thresholdMs: threshold,
-        ageMs: age,
-        lastObserved: e.lastObserved,
-        transitionedAt: new Date(now).toISOString()
-      });
-      emitNeatEvent({
-        type: "stale-transition",
-        project,
-        payload: {
-          edgeId: id,
-          from: Provenance2.OBSERVED,
-          to: Provenance2.STALE
-        }
-      });
-    }
+function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
+  const loc = localizeFromIncidents(nodeId, incidents, errorEvent);
+  if (!loc) return null;
+  const traversalPath = loc.fileNode ? [nodeId, loc.fileNode] : [nodeId];
+  const edgeProvenances = loc.fileNode ? [Provenance2.OBSERVED] : [];
+  return RootCauseResultSchema.parse({
+    rootCauseNode: loc.rootCauseNode,
+    rootCauseReason: loc.rootCauseReason,
+    traversalPath,
+    edgeProvenances,
+    confidence: INCIDENT_ROOT_CAUSE_CONFIDENCE,
+    ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
   });
-  if (options.staleEventsPath && events.length > 0) {
-    await appendStaleEvents(options.staleEventsPath, events);
-  }
-  return { count: events.length, events };
 }
-async function appendStaleEvents(staleEventsPath, events) {
-  await fs3.mkdir(path3.dirname(staleEventsPath), { recursive: true });
-  const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  await fs3.appendFile(staleEventsPath, lines, "utf8");
+function isFailingCallEdge(e) {
+  return e.type === EdgeType3.CALLS && (e.signal?.errorCount ?? 0) > 0;
 }
-async function readStaleEvents(staleEventsPath) {
-  try {
-    const raw = await fs3.readFile(staleEventsPath, "utf8");
-    return raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
+function callSourcesForService(graph, serviceId5) {
+  const ids = [serviceId5];
+  for (const edgeId of graph.outboundEdges(serviceId5)) {
+    const e = graph.getEdgeAttributes(edgeId);
+    if (e.type !== EdgeType3.CONTAINS) continue;
+    const tgt = graph.getNodeAttributes(e.target);
+    if (tgt.type === NodeType3.FileNode) ids.push(e.target);
   }
+  return ids;
 }
-function startStalenessLoop(graph, options = {}) {
-  let stopped = false;
-  const intervalMs = options.intervalMs ?? 6e4;
-  const tick = () => {
-    if (stopped) return;
-    void (async () => {
-      try {
-        await markStaleEdges(graph, {
-          thresholds: options.thresholds,
-          staleEventsPath: options.staleEventsPath,
-          project: options.project
-        });
-        if (options.onPolicyTrigger) await options.onPolicyTrigger(graph);
-      } catch (err) {
-        console.error("staleness tick failed", err);
+function failingCallDominates(e, id, curEdge, curId) {
+  const ec = e.signal?.errorCount ?? 0;
+  const cc = curEdge.signal?.errorCount ?? 0;
+  if (ec !== cc) return ec > cc;
+  if (PROV_RANK[e.provenance] !== PROV_RANK[curEdge.provenance]) {
+    return PROV_RANK[e.provenance] > PROV_RANK[curEdge.provenance];
+  }
+  return id < curId;
+}
+function dominantFailingCall(graph, serviceId5, visited) {
+  let best = null;
+  for (const src of callSourcesForService(graph, serviceId5)) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (!isFailingCallEdge(e)) continue;
+      if (isFrontierNode(graph, e.target)) continue;
+      const owner = resolveOwningService(graph, e.target);
+      if (!owner || visited.has(owner.id)) continue;
+      if (!best || failingCallDominates(e, owner.id, best.edge, best.nextService)) {
+        best = { nextService: owner.id, edge: e };
       }
-    })();
-  };
-  const interval = setInterval(tick, intervalMs);
-  if (typeof interval.unref === "function") interval.unref();
-  return () => {
-    stopped = true;
-    clearInterval(interval);
-  };
+    }
+  }
+  return best;
 }
-async function readErrorEvents(errorsPath) {
-  try {
-    const raw = await fs3.readFile(errorsPath, "utf8");
-    const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
-    return dedupeIncidents(events);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
+function followFailingCallChain(graph, originServiceId, maxDepth) {
+  const path49 = [originServiceId];
+  const edges = [];
+  const visited = /* @__PURE__ */ new Set([originServiceId]);
+  let current = originServiceId;
+  for (let depth = 0; depth < maxDepth; depth++) {
+    const hop = dominantFailingCall(graph, current, visited);
+    if (!hop) break;
+    path49.push(hop.nextService);
+    edges.push(hop.edge);
+    visited.add(hop.nextService);
+    current = hop.nextService;
   }
+  if (edges.length === 0) return null;
+  return { path: path49, edges, culprit: current };
 }
-function isSynthesizedHttpIncident(ev) {
-  if (ev.exceptionType || ev.exceptionStacktrace) return false;
-  if (ev.errorType) return false;
-  if (!ev.attributes) return false;
-  const synth = httpFailureMessageFromAttrs(ev.attributes);
-  return synth !== void 0 && synth === ev.errorMessage;
+function crossServiceRootCause(graph, originId, incidents, errorEvent) {
+  const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
+  if (!chain) return null;
+  const culprit = chain.culprit;
+  const path49 = [...chain.path];
+  const edgeProvenances = chain.edges.map((e) => e.provenance);
+  const baseConfidence = confidenceFromMix(chain.edges);
+  const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
+  const loc = localizeFromIncidents(culprit, incidents, errorEvent);
+  if (loc) {
+    let rootCauseNode = culprit;
+    if (loc.fileNode) {
+      path49.push(loc.fileNode);
+      edgeProvenances.push(Provenance2.OBSERVED);
+      rootCauseNode = loc.fileNode;
+    }
+    return RootCauseResultSchema.parse({
+      rootCauseNode,
+      rootCauseReason: loc.rootCauseReason,
+      traversalPath: path49,
+      edgeProvenances,
+      confidence,
+      ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
+    });
+  }
+  const lastEdge = chain.edges[chain.edges.length - 1];
+  const errs = lastEdge.signal?.errorCount ?? 0;
+  const culpritName = culprit.replace(/^service:/, "");
+  return RootCauseResultSchema.parse({
+    rootCauseNode: culprit,
+    rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
+    traversalPath: path49,
+    edgeProvenances,
+    confidence,
+    fixRecommendation: `Inspect ${culpritName}'s failing handler`
+  });
 }
-function dedupeIncidents(events) {
-  const seen = /* @__PURE__ */ new Set();
-  const once = [];
-  for (const ev of events) {
-    const key = ev.id ?? (ev.traceId && ev.spanId ? `${ev.traceId}:${ev.spanId}` : void 0);
-    if (key === void 0) {
-      once.push(ev);
-      continue;
+function getBlastRadius(graph, nodeId, maxDepth = BLAST_RADIUS_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return BlastRadiusResultSchema.parse({ origin: nodeId, affectedNodes: [], totalAffected: 0 });
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, path: [nodeId], pathEdges: [] }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.pathEdges.length > 0) {
+      const lastEdge = frame.pathEdges[frame.pathEdges.length - 1];
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeProvenance: lastEdge.provenance,
+        path: frame.path,
+        confidence: confidenceFromMix(frame.pathEdges)
+      });
     }
-    if (seen.has(key)) continue;
-    seen.add(key);
-    once.push(ev);
+    if (frame.distance >= maxDepth) continue;
+    const incoming = bestEdgeBySource(graph, graph.inboundEdges(frame.nodeId));
+    for (const [srcId, edge] of incoming) {
+      if (enqueued.has(srcId)) continue;
+      enqueued.add(srcId);
+      queue.push({
+        nodeId: srcId,
+        distance: frame.distance + 1,
+        path: [...frame.path, srcId],
+        pathEdges: [...frame.pathEdges, edge]
+      });
+    }
+  }
+  const affectedNodes = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return BlastRadiusResultSchema.parse({
+    origin: nodeId,
+    affectedNodes,
+    totalAffected: affectedNodes.length
+  });
+}
+var TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH = 3;
+var TRANSITIVE_DEPENDENCIES_MAX_DEPTH = 10;
+function getTransitiveDependencies(graph, nodeId, depth = TRANSITIVE_DEPENDENCIES_DEFAULT_DEPTH) {
+  if (!graph.hasNode(nodeId)) {
+    return TransitiveDependenciesResultSchema.parse({
+      origin: nodeId,
+      depth,
+      dependencies: [],
+      total: 0
+    });
   }
-  const groupKey = (ev) => `${ev.traceId}\0${ev.affectedNode}`;
-  const hasRealFailure = /* @__PURE__ */ new Set();
-  for (const ev of once) {
-    if (ev.traceId && !isSynthesizedHttpIncident(ev)) hasRealFailure.add(groupKey(ev));
+  const seen = /* @__PURE__ */ new Map();
+  const queue = [{ nodeId, distance: 0, edge: null }];
+  const enqueued = /* @__PURE__ */ new Set([nodeId]);
+  while (queue.length > 0) {
+    const frame = queue.shift();
+    if (frame.distance > 0 && frame.edge && frame.edge.type !== EdgeType3.CONTAINS) {
+      seen.set(frame.nodeId, {
+        nodeId: frame.nodeId,
+        distance: frame.distance,
+        edgeType: frame.edge.type,
+        provenance: frame.edge.provenance
+      });
+    }
+    if (frame.distance >= depth) continue;
+    const outgoing = bestEdgeByTarget(graph, graph.outboundEdges(frame.nodeId));
+    for (const [tgtId, edge] of outgoing) {
+      if (enqueued.has(tgtId)) continue;
+      enqueued.add(tgtId);
+      queue.push({ nodeId: tgtId, distance: frame.distance + 1, edge });
+    }
   }
-  return once.filter((ev) => {
-    if (!ev.traceId || !isSynthesizedHttpIncident(ev)) return true;
-    return !hasRealFailure.has(groupKey(ev));
+  const dependencies = [...seen.values()].sort(
+    (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+  );
+  return TransitiveDependenciesResultSchema.parse({
+    origin: nodeId,
+    depth,
+    dependencies,
+    total: dependencies.length
   });
 }
-var SnapshotValidationError = class extends Error {
-  constructor(issues) {
-    super(`snapshot failed validation (${issues.length} invalid ${issues.length === 1 ? "entry" : "entries"})`);
-    this.issues = issues;
-    this.name = "SnapshotValidationError";
+function getObservedDependencies(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) {
+    return ObservedDependenciesResultSchema.parse({
+      origin: nodeId,
+      dependencies: [],
+      observed: false,
+      inboundObservedCount: 0,
+      hasExtractedOutbound: false
+    });
   }
-  issues;
-};
-function describeZodIssues(error) {
-  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
-}
-function mergeSnapshot(graph, snapshot) {
-  const exported = snapshot.graph;
-  const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
-  const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
-  const issues = [];
-  const validNodes = [];
-  const validEdges = [];
-  for (const node of incomingNodes) {
-    if (node.attributes === void 0) continue;
-    const parsed = GraphNodeSchema.safeParse(node.attributes);
-    if (!parsed.success) {
-      issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
-      continue;
+  const attrs = graph.getNodeAttributes(nodeId);
+  const scope = [nodeId];
+  if (attrs.type === NodeType3.ServiceNode) {
+    for (const edgeId of graph.outboundEdges(nodeId)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== EdgeType3.CONTAINS) continue;
+      const owned = graph.getNodeAttributes(e.target);
+      if (owned.type === NodeType3.FileNode) scope.push(e.target);
     }
-    validNodes.push({ key: node.key, attributes: parsed.data });
   }
-  for (const edge of incomingEdges) {
-    if (edge.attributes === void 0) continue;
-    const parsed = GraphEdgeSchema.safeParse(edge.attributes);
-    if (!parsed.success) {
-      const label = edge.key ?? `${edge.source}->${edge.target}`;
-      issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
-      continue;
+  const dependencies = [];
+  const seenEdge = /* @__PURE__ */ new Set();
+  let hasExtractedOutbound = false;
+  for (const src of scope) {
+    for (const edgeId of graph.outboundEdges(src)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === EdgeType3.CONTAINS) continue;
+      if (e.provenance === Provenance2.OBSERVED) {
+        if (!seenEdge.has(e.id)) {
+          seenEdge.add(e.id);
+          dependencies.push(e);
+        }
+      } else if (e.provenance === Provenance2.EXTRACTED) {
+        hasExtractedOutbound = true;
+      }
     }
-    const id = edge.key ?? parsed.data.id;
-    validEdges.push({ key: id, source: edge.source, target: edge.target, attributes: parsed.data });
-  }
-  if (issues.length > 0) {
-    throw new SnapshotValidationError(issues);
-  }
-  let nodesAdded = 0;
-  let edgesAdded = 0;
-  for (const node of validNodes) {
-    if (graph.hasNode(node.key)) continue;
-    graph.addNode(node.key, node.attributes);
-    nodesAdded++;
   }
-  for (const edge of validEdges) {
-    if (graph.hasEdge(edge.key)) continue;
-    if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
-    graph.addEdgeWithKey(edge.key, edge.source, edge.target, edge.attributes);
-    edgesAdded++;
+  let inboundObservedCount = 0;
+  for (const tgt of scope) {
+    for (const edgeId of graph.inboundEdges(tgt)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type === EdgeType3.CONTAINS) continue;
+      if (e.provenance === Provenance2.OBSERVED) inboundObservedCount += 1;
+    }
   }
-  return { nodesAdded, edgesAdded };
+  dependencies.sort(
+    (a, b) => a.target.localeCompare(b.target) || a.source.localeCompare(b.source) || a.id.localeCompare(b.id)
+  );
+  return ObservedDependenciesResultSchema.parse({
+    origin: nodeId,
+    dependencies,
+    observed: dependencies.length > 0 || inboundObservedCount > 0,
+    inboundObservedCount,
+    hasExtractedOutbound
+  });
 }
 
 // src/extract/errors.ts
@@ -3417,14 +3448,14 @@ function buildServiceHostIndex(services) {
 }
 async function walkSourceFiles(dir) {
   const out = [];
-  async function walk3(current) {
+  async function walk4(current) {
     const entries = await fs10.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       const full = path10.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         if (await isPythonVenvDir(full)) continue;
-        await walk3(full);
+        await walk4(full);
       } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path10.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
       // would attribute our instrumentation imports to the user's service.
       !isNeatAuthoredSourceFile(entry.name)) {
@@ -3432,7 +3463,7 @@ async function walkSourceFiles(dir) {
       }
     }
   }
-  await walk3(dir);
+  await walk4(dir);
   return out;
 }
 async function loadSourceFiles(dir) {
@@ -4588,20 +4619,20 @@ import {
 } from "@neat.is/types";
 async function walkConfigFiles(dir) {
   const out = [];
-  async function walk3(current) {
+  async function walk4(current) {
     const entries = await fs14.readdir(current, { withFileTypes: true });
     for (const entry of entries) {
       const full = path21.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         if (await isPythonVenvDir(full)) continue;
-        await walk3(full);
+        await walk4(full);
       } else if (entry.isFile() && isConfigFile(entry.name).match) {
         out.push(full);
       }
     }
   }
-  await walk3(dir);
+  await walk4(dir);
   return out;
 }
 async function addConfigNodes(graph, services, scanPath) {
@@ -4653,6 +4684,7 @@ async function addConfigNodes(graph, services, scanPath) {
 import path22 from "path";
 import Parser2 from "tree-sitter";
 import JavaScript2 from "tree-sitter-javascript";
+import Python2 from "tree-sitter-python";
 import {
   EdgeType as EdgeType8,
   NodeType as NodeType9,
@@ -4672,6 +4704,11 @@ function makeJsParser2() {
   p.setLanguage(JavaScript2);
   return p;
 }
+function makePyParser2() {
+  const p = new Parser2();
+  p.setLanguage(Python2);
+  return p;
+}
 var ROUTER_METHODS = /* @__PURE__ */ new Set([
   "get",
   "post",
@@ -4684,6 +4721,7 @@ var ROUTER_METHODS = /* @__PURE__ */ new Set([
 ]);
 var NEXT_APP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var JS_ROUTE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx"]);
+var FASTAPI_METHODS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "options", "head", "trace"]);
 function canonicalizeTemplate(raw) {
   let p = raw.split("?")[0].split("#")[0];
   if (!p.startsWith("/")) p = "/" + p;
@@ -4911,8 +4949,102 @@ function nextRoutesFromFile(source, relFile, parser) {
   }
   return [];
 }
+function pyStaticStringText(node) {
+  if (node.type !== "string") return null;
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const child = node.namedChild(i);
+    if (child?.type === "interpolation") return null;
+    if (child?.type === "string_content") return child.text;
+  }
+  return "";
+}
+function keywordArrayStrings(argsNode, key) {
+  for (let i = 0; i < argsNode.namedChildCount; i++) {
+    const arg = argsNode.namedChild(i);
+    if (arg?.type !== "keyword_argument") continue;
+    if (arg.childForFieldName("name")?.text !== key) continue;
+    const val = arg.childForFieldName("value");
+    if (!val || val.type !== "list") return [];
+    const out = [];
+    for (let j = 0; j < val.namedChildCount; j++) {
+      const el = val.namedChild(j);
+      if (el?.type === "string") {
+        const s = pyStaticStringText(el);
+        if (s) out.push(s);
+      }
+    }
+    return out;
+  }
+  return [];
+}
+function collectApiRouterPrefixes(root) {
+  const prefixes = /* @__PURE__ */ new Map();
+  walk(root, (node) => {
+    if (node.type !== "assignment") return;
+    const right = node.childForFieldName("right");
+    if (!right || right.type !== "call") return;
+    const fn = right.childForFieldName("function");
+    if (!fn) return;
+    const ctor = fn.type === "attribute" ? fn.childForFieldName("attribute")?.text : fn.text;
+    if (ctor !== "APIRouter") return;
+    const left = node.childForFieldName("left");
+    if (!left || left.type !== "identifier") return;
+    const args = right.childForFieldName("arguments");
+    if (!args) return;
+    for (let i = 0; i < args.namedChildCount; i++) {
+      const arg = args.namedChild(i);
+      if (arg?.type !== "keyword_argument") continue;
+      if (arg.childForFieldName("name")?.text !== "prefix") continue;
+      const val = arg.childForFieldName("value");
+      const p = val ? pyStaticStringText(val) : null;
+      if (p !== null) prefixes.set(left.text, p);
+    }
+  });
+  return prefixes;
+}
+function fastapiRoutesFromSource(source, parser) {
+  const tree = parseSource2(parser, source);
+  const prefixes = collectApiRouterPrefixes(tree.rootNode);
+  const out = [];
+  walk(tree.rootNode, (node) => {
+    if (node.type !== "decorator") return;
+    const call = node.namedChild(0);
+    if (!call || call.type !== "call") return;
+    const fn = call.childForFieldName("function");
+    if (!fn || fn.type !== "attribute") return;
+    const method = fn.childForFieldName("attribute")?.text?.toLowerCase();
+    if (!method) return;
+    const isVerb = FASTAPI_METHODS.has(method);
+    if (!isVerb && method !== "api_route") return;
+    const args = call.childForFieldName("arguments");
+    const first = args?.namedChild(0);
+    if (!first || first.type !== "string") return;
+    const rawPath = pyStaticStringText(first);
+    if (rawPath === null || !rawPath.startsWith("/")) return;
+    const obj = fn.childForFieldName("object")?.text;
+    const prefix = obj ? prefixes.get(obj) ?? "" : "";
+    const pathTemplate = canonicalizeTemplate(prefix + rawPath);
+    const line = node.startPosition.row + 1;
+    if (isVerb) {
+      out.push({ method: method.toUpperCase(), pathTemplate, line, framework: "fastapi" });
+      return;
+    }
+    const methods = keywordArrayStrings(args, "methods");
+    const list = methods.length > 0 ? methods : ["ALL"];
+    for (const m of list) {
+      out.push({
+        method: m === "ALL" ? "ALL" : m.toUpperCase(),
+        pathTemplate,
+        line,
+        framework: "fastapi"
+      });
+    }
+  });
+  return out;
+}
 async function addRoutes(graph, services) {
   const jsParser = makeJsParser2();
+  const pyParser = makePyParser2();
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
@@ -4924,15 +5056,20 @@ async function addRoutes(graph, services) {
     const hasFastify = deps["fastify"] !== void 0;
     const hasHono = deps["hono"] !== void 0;
     const hasNext = deps["next"] !== void 0;
-    if (!hasExpress && !hasFastify && !hasHono && !hasNext) continue;
+    const hasFastapi = deps["fastapi"] !== void 0;
+    if (!hasExpress && !hasFastify && !hasHono && !hasNext && !hasFastapi) continue;
     const files = await loadSourceFiles(service.dir);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      if (!JS_ROUTE_EXTENSIONS.has(path22.extname(file.path))) continue;
+      const ext = path22.extname(file.path);
+      const isPy = ext === ".py";
+      if (!JS_ROUTE_EXTENSIONS.has(ext) && !isPy) continue;
       const relFile = toPosix2(path22.relative(service.dir, file.path));
       let routes;
       try {
-        if (hasNext && (isNextAppRouteFile(relFile) || isNextPagesApiFile(relFile))) {
+        if (isPy) {
+          routes = hasFastapi ? fastapiRoutesFromSource(file.content, pyParser) : [];
+        } else if (hasNext && (isNextAppRouteFile(relFile) || isNextPagesApiFile(relFile))) {
           routes = nextRoutesFromFile(file.content, relFile, jsParser);
         } else if (hasExpress || hasFastify || hasHono) {
           routes = serverRoutesFromSource(file.content, jsParser, hasExpress, hasFastify, hasHono);
@@ -5034,20 +5171,20 @@ function grpcMethodsFromProto(content, fqPackage) {
 }
 async function walkProtoFiles(dir) {
   const out = [];
-  async function walk3(current) {
+  async function walk4(current) {
     const entries = await fs15.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       const full = path23.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
         if (await isPythonVenvDir(full)) continue;
-        await walk3(full);
+        await walk4(full);
       } else if (entry.isFile() && path23.extname(entry.name) === PROTO_EXTENSION) {
         out.push(full);
       }
     }
   }
-  await walk3(dir);
+  await walk4(dir);
   return out;
 }
 async function addGrpcMethods(graph, services) {
@@ -5126,7 +5263,7 @@ import {
 import path24 from "path";
 import Parser3 from "tree-sitter";
 import JavaScript3 from "tree-sitter-javascript";
-import Python2 from "tree-sitter-python";
+import Python3 from "tree-sitter-python";
 import {
   EdgeType as EdgeType10,
   Provenance as Provenance9,
@@ -5186,14 +5323,14 @@ function makeJsParser3() {
   p.setLanguage(JavaScript3);
   return p;
 }
-function makePyParser2() {
+function makePyParser3() {
   const p = new Parser3();
-  p.setLanguage(Python2);
+  p.setLanguage(Python3);
   return p;
 }
 async function addHttpCallEdges(graph, services) {
   const jsParser = makeJsParser3();
-  const pyParser = makePyParser2();
+  const pyParser = makePyParser3();
   const { knownHosts, hostToNodeId } = buildServiceHostIndex(services);
   let nodesAdded = 0;
   let edgesAdded = 0;
@@ -6133,6 +6270,120 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
   return out;
 }
 
+// src/extract/calls/sqlalchemy.ts
+import path32 from "path";
+import Parser5 from "tree-sitter";
+import Python4 from "tree-sitter-python";
+import { infraId as infraId8 } from "@neat.is/types";
+var SQLALCHEMY_IMPORT_RE = /(?:from|import)\s+(?:flask_sqlalchemy|sqlalchemy)\b/;
+var PARSE_CHUNK5 = 16384;
+function makePyParser4() {
+  const p = new Parser5();
+  p.setLanguage(Python4);
+  return p;
+}
+function parseSource5(parser, source) {
+  return parser.parse(
+    (index) => index >= source.length ? "" : source.slice(index, index + PARSE_CHUNK5)
+  );
+}
+function flaskSqlalchemyTableName(className) {
+  return className.replace(/((?<=[a-z0-9])[A-Z]|(?!^)[A-Z](?=[a-z]))/g, "_$1").toLowerCase().replace(/^_+/, "");
+}
+function namedChildren(node) {
+  const out = [];
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const c = node.namedChild(i);
+    if (c) out.push(c);
+  }
+  return out;
+}
+function pyStaticStringText2(node) {
+  if (node.type !== "string") return null;
+  for (const child of namedChildren(node)) {
+    if (child.type === "interpolation") return null;
+    if (child.type === "string_content") return child.text;
+  }
+  return "";
+}
+function explicitTablename(body) {
+  for (const stmt of namedChildren(body)) {
+    if (stmt.type !== "expression_statement") continue;
+    const assign = stmt.namedChild(0);
+    if (assign?.type !== "assignment") continue;
+    if (assign.childForFieldName("left")?.text !== "__tablename__") continue;
+    const right = assign.childForFieldName("right");
+    if (right?.type === "string") {
+      const s = pyStaticStringText2(right);
+      return s ? { name: s } : "computed";
+    }
+    return "computed";
+  }
+  return null;
+}
+function extendsFlaskModel(cls) {
+  const supers = cls.childForFieldName("superclasses");
+  if (!supers) return false;
+  for (const a of namedChildren(supers)) {
+    const t = a.text;
+    if (t === "db.Model" || t === "Model" || t.endsWith(".Model")) return true;
+  }
+  return false;
+}
+function walk3(node, visit) {
+  visit(node);
+  for (const c of namedChildren(node)) walk3(c, visit);
+}
+function sqlalchemyEndpointsFromFile(file, serviceDir) {
+  if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource5(makePyParser4(), file.content);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (name, line) => {
+    if (seen.has(name)) return;
+    seen.add(name);
+    out.push({
+      infraId: infraId8("sql-table", name),
+      name,
+      kind: "sql-table",
+      edgeType: "CALLS",
+      confidenceKind: "verified-call-site",
+      evidence: {
+        file: path32.relative(serviceDir, file.path),
+        line,
+        snippet: snippet(file.content, line)
+      }
+    });
+  };
+  walk3(tree.rootNode, (node) => {
+    if (node.type === "class_definition") {
+      const body = node.childForFieldName("body");
+      const nameNode = node.childForFieldName("name");
+      if (!body || !nameNode) return;
+      const line = node.startPosition.row + 1;
+      const explicit = explicitTablename(body);
+      if (explicit === "computed") return;
+      if (explicit) {
+        push(explicit.name, line);
+        return;
+      }
+      if (extendsFlaskModel(node)) push(flaskSqlalchemyTableName(nameNode.text), line);
+      return;
+    }
+    if (node.type === "call") {
+      const fn = node.childForFieldName("function");
+      const fnText = fn?.text;
+      if (fnText !== "Table" && fnText !== "sa.Table" && fnText !== "sqlalchemy.Table") return;
+      const first = node.childForFieldName("arguments")?.namedChild(0);
+      if (first?.type === "string") {
+        const s = pyStaticStringText2(first);
+        if (s) push(s, node.startPosition.row + 1);
+      }
+    }
+  });
+  return out;
+}
+
 // src/extract/calls/index.ts
 function edgeTypeFromEndpoint(ep) {
   switch (ep.edgeType) {
@@ -6165,6 +6416,7 @@ async function addExternalEndpointEdges(graph, services) {
       endpoints.push(...grpcEndpointsFromFile(maskedFile, service.dir));
       endpoints.push(...supabaseEndpointsFromFile(maskedFile, service.dir));
       endpoints.push(...mongooseEndpointsFromFile(maskedFile, service.dir));
+      endpoints.push(...sqlalchemyEndpointsFromFile(maskedFile, service.dir));
     }
     endpoints.push(...await mongooseCrossFileEndpoints(maskedFiles, service.dir));
     if (endpoints.length === 0) continue;
@@ -6237,14 +6489,14 @@ async function addCallEdges(graph, services) {
 }
 
 // src/extract/infra/docker-compose.ts
-import path32 from "path";
+import path33 from "path";
 import { EdgeType as EdgeType13, Provenance as Provenance13, confidenceForExtracted as confidenceForExtracted11 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
-import { NodeType as NodeType13, Provenance as Provenance12, confidenceForExtracted as confidenceForExtracted10, infraId as infraId8 } from "@neat.is/types";
+import { NodeType as NodeType13, Provenance as Provenance12, confidenceForExtracted as confidenceForExtracted10, infraId as infraId9 } from "@neat.is/types";
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: infraId8(kind, name),
+    id: infraId9(kind, name),
     type: NodeType13.InfraNode,
     name,
     provider,
@@ -6307,7 +6559,7 @@ function dependsOnList(value) {
 }
 function serviceNameToServiceNode(name, services) {
   for (const s of services) {
-    if (s.node.name === name || path32.basename(s.dir) === name) return s.node.id;
+    if (s.node.name === name || path33.basename(s.dir) === name) return s.node.id;
   }
   return null;
 }
@@ -6316,7 +6568,7 @@ async function addComposeInfra(graph, scanPath, services) {
   let edgesAdded = 0;
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path32.join(scanPath, name);
+    const abs = path33.join(scanPath, name);
     if (await exists(abs)) {
       composePath = abs;
       break;
@@ -6329,13 +6581,13 @@ async function addComposeInfra(graph, scanPath, services) {
   } catch (err) {
     recordExtractionError(
       "infra docker-compose",
-      path32.relative(scanPath, composePath),
+      path33.relative(scanPath, composePath),
       err
     );
     return { nodesAdded, edgesAdded };
   }
   if (!compose?.services) return { nodesAdded, edgesAdded };
-  const evidenceFile = path32.relative(scanPath, composePath).split(path32.sep).join("/");
+  const evidenceFile = path33.relative(scanPath, composePath).split(path33.sep).join("/");
   const composeNameToNodeId = /* @__PURE__ */ new Map();
   for (const [composeName, svc] of Object.entries(compose.services)) {
     const matchedServiceId = serviceNameToServiceNode(composeName, services);
@@ -6376,7 +6628,7 @@ async function addComposeInfra(graph, scanPath, services) {
 }
 
 // src/extract/infra/dockerfile.ts
-import path33 from "path";
+import path34 from "path";
 import { promises as fs16 } from "fs";
 import { EdgeType as EdgeType14, Provenance as Provenance14, confidenceForExtracted as confidenceForExtracted12 } from "@neat.is/types";
 function readDockerfile(content) {
@@ -6407,7 +6659,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const dockerfilePath = path33.join(service.dir, "Dockerfile");
+    const dockerfilePath = path34.join(service.dir, "Dockerfile");
     if (!await exists(dockerfilePath)) continue;
     let content;
     try {
@@ -6415,7 +6667,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     } catch (err) {
       recordExtractionError(
         "infra dockerfile",
-        path33.relative(scanPath, dockerfilePath),
+        path34.relative(scanPath, dockerfilePath),
         err
       );
       continue;
@@ -6427,8 +6679,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
-    const relDockerfile = toPosix2(path33.relative(service.dir, dockerfilePath));
-    const evidenceFile = toPosix2(path33.relative(scanPath, dockerfilePath));
+    const relDockerfile = toPosix2(path34.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix2(path34.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -6480,7 +6732,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 
 // src/extract/infra/terraform.ts
 import { promises as fs17 } from "fs";
-import path34 from "path";
+import path35 from "path";
 import { EdgeType as EdgeType15, Provenance as Provenance15, confidenceForExtracted as confidenceForExtracted13 } from "@neat.is/types";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
@@ -6491,11 +6743,11 @@ async function walkTfFiles(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
-      const child = path34.join(start, entry.name);
+      const child = path35.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry.isFile() && entry.name.endsWith(".tf")) {
-      out.push(path34.join(start, entry.name));
+      out.push(path35.join(start, entry.name));
     }
   }
   return out;
@@ -6527,7 +6779,7 @@ async function addTerraformResources(graph, scanPath) {
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
     const content = await fs17.readFile(file, "utf8");
-    const evidenceFile = toPosix2(path34.relative(scanPath, file));
+    const evidenceFile = toPosix2(path35.relative(scanPath, file));
     const resources = [];
     const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
@@ -6584,7 +6836,7 @@ async function addTerraformResources(graph, scanPath) {
 
 // src/extract/infra/k8s.ts
 import { promises as fs18 } from "fs";
-import path35 from "path";
+import path36 from "path";
 import { parseAllDocuments as parseAllDocuments2 } from "yaml";
 var K8S_KIND_TO_INFRA_KIND = {
   Service: "k8s-service",
@@ -6602,11 +6854,11 @@ async function walkYamlFiles2(start, depth = 0, max = 5) {
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path35.join(start, entry.name);
+      const child = path36.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles2(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path35.extname(entry.name))) {
-      out.push(path35.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path36.extname(entry.name))) {
+      out.push(path36.join(start, entry.name));
     }
   }
   return out;
@@ -6639,13 +6891,13 @@ async function addK8sResources(graph, scanPath) {
 
 // src/extract/infra/cloudflare.ts
 import { promises as fs19 } from "fs";
-import path36 from "path";
+import path37 from "path";
 import { parse as parseToml2 } from "smol-toml";
 import { EdgeType as EdgeType16, Provenance as Provenance16, confidenceForExtracted as confidenceForExtracted14 } from "@neat.is/types";
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
-    const abs = path36.join(dir, filename);
+    const abs = path37.join(dir, filename);
     if (!await exists(abs)) continue;
     const raw = await fs19.readFile(abs, "utf8");
     const config = filename === "wrangler.toml" ? parseToml2(raw) : JSON.parse(maskCommentsInSource(raw));
@@ -6708,11 +6960,11 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     try {
       read = await readWranglerConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra cloudflare", path36.relative(scanPath, service.dir), err);
+      recordExtractionError("infra cloudflare", path37.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read || !read.config.name) continue;
-    const evidenceFile = toPosix2(path36.relative(scanPath, path36.join(service.dir, read.relFile)));
+    const evidenceFile = toPosix2(path37.relative(scanPath, path37.join(service.dir, read.relFile)));
     discovered.push({ service, config: read.config, relFile: read.relFile, raw: read.raw, evidenceFile });
   }
   for (const worker of discovered) {
@@ -6724,7 +6976,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     }
     let anchorId = service.node.id;
     if (config.main) {
-      const entryRelPath = toPosix2(path36.normalize(config.main));
+      const entryRelPath = toPosix2(path37.normalize(config.main));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -6871,12 +7123,12 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 
 // src/extract/infra/vercel.ts
 import { promises as fs20 } from "fs";
-import path37 from "path";
+import path38 from "path";
 import { EdgeType as EdgeType17 } from "@neat.is/types";
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
-    const abs = path37.join(dir, filename);
+    const abs = path38.join(dir, filename);
     if (!await exists(abs)) continue;
     const raw = await fs20.readFile(abs, "utf8");
     const config = JSON.parse(maskCommentsInSource(raw));
@@ -6885,7 +7137,7 @@ async function readVercelConfig(dir) {
   return null;
 }
 async function readLinkedProjectName(dir) {
-  const abs = path37.join(dir, ".vercel", "project.json");
+  const abs = path38.join(dir, ".vercel", "project.json");
   if (!await exists(abs)) return void 0;
   const parsed = JSON.parse(await fs20.readFile(abs, "utf8"));
   return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
@@ -6903,7 +7155,7 @@ async function addVercelServices(graph, services, scanPath) {
       read = await readVercelConfig(service.dir);
       projectName = await readLinkedProjectName(service.dir);
     } catch (err) {
-      recordExtractionError("infra vercel", path37.relative(scanPath, service.dir), err);
+      recordExtractionError("infra vercel", path38.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read && !projectName) continue;
@@ -6919,7 +7171,7 @@ async function addVercelServices(graph, services, scanPath) {
     const anchorId = service.node.id;
     if (!read) continue;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix2(path37.relative(scanPath, path37.join(service.dir, relFile)));
+    const evidenceFile = toPosix2(path38.relative(scanPath, path38.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -6948,13 +7200,13 @@ async function addVercelServices(graph, services, scanPath) {
 
 // src/extract/infra/railway.ts
 import { promises as fs21 } from "fs";
-import path38 from "path";
+import path39 from "path";
 import { parse as parseToml3 } from "smol-toml";
 import { EdgeType as EdgeType18 } from "@neat.is/types";
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
-    const abs = path38.join(dir, filename);
+    const abs = path39.join(dir, filename);
     if (!await exists(abs)) continue;
     const raw = await fs21.readFile(abs, "utf8");
     const config = filename === "railway.toml" ? parseToml3(raw) : JSON.parse(maskCommentsInSource(raw));
@@ -6970,7 +7222,7 @@ async function addRailwayServices(graph, services, scanPath) {
     try {
       read = await readRailwayConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra railway", path38.relative(scanPath, service.dir), err);
+      recordExtractionError("infra railway", path39.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -6980,7 +7232,7 @@ async function addRailwayServices(graph, services, scanPath) {
     }
     const anchorId = service.node.id;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix2(path38.relative(scanPath, path38.join(service.dir, relFile)));
+    const evidenceFile = toPosix2(path39.relative(scanPath, path39.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -7005,12 +7257,12 @@ async function addRailwayServices(graph, services, scanPath) {
 
 // src/extract/infra/supabase.ts
 import { promises as fs22 } from "fs";
-import path39 from "path";
+import path40 from "path";
 import { parse as parseToml4 } from "smol-toml";
 import { EdgeType as EdgeType19 } from "@neat.is/types";
 async function readSupabaseConfig(dir) {
-  const relFile = path39.join("supabase", "config.toml");
-  const abs = path39.join(dir, relFile);
+  const relFile = path40.join("supabase", "config.toml");
+  const abs = path40.join(dir, relFile);
   if (!await exists(abs)) return null;
   const raw = await fs22.readFile(abs, "utf8");
   const config = parseToml4(raw);
@@ -7024,7 +7276,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
     try {
       read = await readSupabaseConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra supabase", path39.relative(scanPath, service.dir), err);
+      recordExtractionError("infra supabase", path40.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -7039,7 +7291,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
       });
     }
     const anchorId = service.node.id;
-    const evidenceFile = toPosix2(path39.relative(scanPath, path39.join(service.dir, relFile)));
+    const evidenceFile = toPosix2(path40.relative(scanPath, path40.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -7080,11 +7332,11 @@ async function addInfra(graph, scanPath, services) {
 }
 
 // src/extract/index.ts
-import path41 from "path";
+import path42 from "path";
 
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
-import path40 from "path";
+import path41 from "path";
 import { NodeType as NodeType14, Provenance as Provenance17 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
@@ -7118,11 +7370,11 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
     if (edge.provenance !== Provenance17.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (path40.isAbsolute(evidenceFile)) {
+    if (path41.isAbsolute(evidenceFile)) {
       if (!existsSync2(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => existsSync2(path40.join(base, evidenceFile)));
+    const found = bases.some((base) => existsSync2(path41.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -7164,7 +7416,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = path41.join(path41.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = path42.join(path42.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -7482,7 +7734,7 @@ function computeDivergences(graph, opts = {}) {
 
 // src/persist.ts
 import { promises as fs23 } from "fs";
-import path42 from "path";
+import path43 from "path";
 import { Provenance as Provenance19, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 4;
 function migrateV1ToV2(payload) {
@@ -7519,7 +7771,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await fs23.mkdir(path42.dirname(filePath), { recursive: true });
+  await fs23.mkdir(path43.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -7675,23 +7927,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path43 from "path";
+import path44 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path43.join(baseDir, "graph.json"),
-      errorsPath: path43.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path43.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path43.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path43.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path44.join(baseDir, "graph.json"),
+      errorsPath: path44.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path44.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path44.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path44.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path43.join(baseDir, `${project}.json`),
-    errorsPath: path43.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path43.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path43.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path43.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path44.join(baseDir, `${project}.json`),
+    errorsPath: path44.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path44.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path44.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path44.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -7732,7 +7984,7 @@ function parseExtraProjects(raw) {
 // src/registry.ts
 import { promises as fs25 } from "fs";
 import os2 from "os";
-import path44 from "path";
+import path45 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -7740,20 +7992,20 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path44.resolve(override);
-  return path44.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path45.resolve(override);
+  return path45.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path44.join(neatHome(), "projects.json");
+  return path45.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path44.join(neatHome(), "projects.json.lock");
+  return path45.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return path44.join(neatHome(), "neatd.pid");
+  return path45.join(neatHome(), "neatd.pid");
 }
 function daemonsDir() {
-  return path44.join(neatHome(), "daemons");
+  return path45.join(neatHome(), "daemons");
 }
 function isFiniteInt(v) {
   return typeof v === "number" && Number.isFinite(v);
@@ -7794,7 +8046,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const out = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const file = path44.join(dir, name);
+    const file = path45.join(dir, name);
     let raw;
     try {
       raw = await fs25.readFile(file, "utf8");
@@ -7915,7 +8167,7 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function normalizeProjectPath(input) {
-  const resolved = path44.resolve(input);
+  const resolved = path45.resolve(input);
   try {
     return await fs25.realpath(resolved);
   } catch {
@@ -7923,7 +8175,7 @@ async function normalizeProjectPath(input) {
   }
 }
 async function writeAtomically(target, contents) {
-  await fs25.mkdir(path44.dirname(target), { recursive: true });
+  await fs25.mkdir(path45.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
   const fd = await fs25.open(tmp, "w");
   try {
@@ -7936,7 +8188,7 @@ async function writeAtomically(target, contents) {
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await fs25.mkdir(path44.dirname(lockPath), { recursive: true });
+  await fs25.mkdir(path45.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
@@ -8132,13 +8384,13 @@ import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } f
 
 // src/extend/index.ts
 import { promises as fs27 } from "fs";
-import path46 from "path";
+import path47 from "path";
 import os3 from "os";
 import { resolve as registryResolve, list as registryList } from "@neat.is/instrumentation-registry";
 
 // src/installers/package-manager.ts
 import { promises as fs26 } from "fs";
-import path45 from "path";
+import path46 from "path";
 import { spawn } from "child_process";
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -8160,22 +8412,22 @@ async function exists2(p) {
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = path45.resolve(serviceDir);
+  let dir = path46.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path45.join(dir, candidate.lockfile);
+      const lockPath = path46.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = path45.dirname(dir);
+    const parent = path46.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: path45.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: path46.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -8224,7 +8476,7 @@ async function fileExists2(p) {
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = path46.join(scanPath, "package.json");
+  const pkgPath = path47.join(scanPath, "package.json");
   const raw = await fs27.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
@@ -8238,27 +8490,27 @@ var HOOK_WALK_SKIP_DIRS = /* @__PURE__ */ new Set([
 ]);
 async function findHookFiles(scanPath) {
   const found = [];
-  const walk3 = async (dir) => {
+  const walk4 = async (dir) => {
     const entries = await fs27.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (entry.name.startsWith(".") || HOOK_WALK_SKIP_DIRS.has(entry.name)) continue;
-        await walk3(path46.join(dir, entry.name));
+        await walk4(path47.join(dir, entry.name));
       } else if (entry.isFile()) {
         if ((entry.name.startsWith("instrumentation") || entry.name.startsWith("otel-init")) && /\.(ts|js|cjs|mjs)$/.test(entry.name)) {
-          const rel = path46.relative(scanPath, path46.join(dir, entry.name));
-          found.push(rel.split(path46.sep).join("/"));
+          const rel = path47.relative(scanPath, path47.join(dir, entry.name));
+          found.push(rel.split(path47.sep).join("/"));
         }
       }
     }
   };
-  await walk3(scanPath);
+  await walk4(scanPath);
   return found.sort();
 }
 async function pickPrimaryHookFile(scanPath, hookFiles, snippet2) {
   let fallback = null;
   for (const file of hookFiles) {
-    const content = await fs27.readFile(path46.join(scanPath, file), "utf8");
+    const content = await fs27.readFile(path47.join(scanPath, file), "utf8");
     const patched = splicedContent(content, snippet2);
     if (patched !== null) return { file, content, patched };
     if (fallback === null) fallback = { file, content };
@@ -8266,11 +8518,11 @@ async function pickPrimaryHookFile(scanPath, hookFiles, snippet2) {
   return { file: fallback.file, content: fallback.content, patched: null };
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? path46.join(os3.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? path47.join(os3.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry) {
   const logPath = extendLogPath();
-  await fs27.mkdir(path46.dirname(logPath), { recursive: true });
+  await fs27.mkdir(path47.dirname(logPath), { recursive: true });
   await fs27.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
@@ -8329,7 +8581,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(path46.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(path47.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     registryList().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -8351,7 +8603,7 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await fs27.readFile(path46.join(ctx.scanPath, file), "utf8");
+    const content = await fs27.readFile(path47.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
@@ -8363,10 +8615,10 @@ async function applyExtension(ctx, args, options) {
     );
   }
   const primaryFile = primary.file;
-  const primaryPath = path46.join(ctx.scanPath, primaryFile);
+  const primaryPath = path47.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = path46.join(ctx.scanPath, "package.json");
+  const pkgPath = path47.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
@@ -8405,7 +8657,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await fs27.readFile(path46.join(ctx.scanPath, file), "utf8");
+    const content = await fs27.readFile(path47.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -8446,7 +8698,7 @@ async function rollbackExtension(ctx, args) {
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = path46.join(ctx.scanPath, "package.json");
+  const pkgPath = path47.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
@@ -8457,7 +8709,7 @@ async function rollbackExtension(ctx, args) {
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = path46.join(ctx.scanPath, file);
+    const filePath = path47.join(ctx.scanPath, file);
     const content = await fs27.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
@@ -8572,7 +8824,7 @@ data: ${JSON.stringify(envelope.payload)}
 
 // src/connectors-config.ts
 import os4 from "os";
-import path47 from "path";
+import path48 from "path";
 import { promises as fs28 } from "fs";
 var CONNECTORS_CONFIG_VERSION = 1;
 var EnvRefUnsetError = class extends Error {
@@ -8587,11 +8839,11 @@ var EnvRefUnsetError = class extends Error {
 };
 function neatHome2() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path47.resolve(override);
-  return path47.join(os4.homedir(), ".neat");
+  if (override && override.length > 0) return path48.resolve(override);
+  return path48.join(os4.homedir(), ".neat");
 }
 function connectorsConfigPath(home = neatHome2()) {
-  return path47.join(home, "connectors.json");
+  return path48.join(home, "connectors.json");
 }
 var MODE_MASK_LOOSER_THAN_0600 = 63;
 async function warnIfModeLooserThan0600(file) {
@@ -8722,7 +8974,7 @@ function connectorMatchesProject(entry, project) {
 var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
 var CONNECTORS_LOCK_RETRY_MS = 50;
 function connectorsConfigLockPath(home = neatHome2()) {
-  return path47.join(home, "connectors.json.lock");
+  return path48.join(home, "connectors.json.lock");
 }
 function isEnvRef(value) {
   return value.length > 1 && value.startsWith("$");
@@ -8735,7 +8987,7 @@ function redactCredentialRef(ref) {
   return out;
 }
 async function writeConfigAtomically0600(file, contents) {
-  await fs28.mkdir(path47.dirname(file), { recursive: true });
+  await fs28.mkdir(path48.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
   const fd = await fs28.open(tmp, "w", 384);
   try {
@@ -8749,7 +9001,7 @@ async function writeConfigAtomically0600(file, contents) {
 }
 async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await fs28.mkdir(path47.dirname(lockPath), { recursive: true });
+  await fs28.mkdir(path48.dirname(lockPath), { recursive: true });
   for (; ; ) {
     try {
       const fd = await fs28.open(lockPath, "wx");
@@ -9743,4 +9995,4 @@ export {
   recordConnectorPoll,
   buildApi
 };
-//# sourceMappingURL=chunk-CS4GHQO3.js.map
+//# sourceMappingURL=chunk-ZZ3VUCWL.js.map