@neat.is/core 0.6.4 → 0.7.1

package/dist/chunk-22X2YM5H.js

@@ -1,2810 +0,0 @@
-import {
-  DEFAULT_PROJECT,
-  EnvRefUnsetError,
-  Projects,
-  attachGraphToEventBus,
-  buildApi,
-  connectorMatchesProject,
-  ensureInfraNode,
-  ensureObservedFileNode,
-  ensureServiceNode,
-  extractFromDirectory,
-  getGraph,
-  handleSpan,
-  listProjects,
-  loadGraphFromDisk,
-  makeErrorSpanWriter,
-  normalizePathTemplate,
-  pathsForProject,
-  pruneRegistry,
-  readConnectorsConfig,
-  reconcileObservedRelPath,
-  recordConnectorPoll,
-  registryPath,
-  resetGraph,
-  resolveCredential,
-  sanitizePollError,
-  saveGraphToDisk,
-  setStatus,
-  startPersistLoop,
-  startStalenessLoop,
-  touchLastSeen,
-  upsertObservedEdge,
-  writeAtomically
-} from "./chunk-UCDXHLCJ.js";
-import {
-  assertBindAuthority,
-  buildOtelReceiver,
-  listenSteppingOtlp,
-  readAuthEnv
-} from "./chunk-ZLAZ7PLC.js";
-
-// src/daemon.ts
-import {
-  promises as fs2,
-  watch,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import path2 from "path";
-import { createRequire } from "module";
-
-// src/connectors/index.ts
-import { NodeType, parseFileId, Provenance } from "@neat.is/types";
-var NO_ENV = "unknown";
-function staticCallSiteFor(graph, serviceName, targetNodeId) {
-  if (!graph.hasNode(targetNodeId)) return void 0;
-  const sites = [];
-  for (const edgeId of graph.inboundEdges(targetNodeId)) {
-    const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== Provenance.EXTRACTED) continue;
-    const parsed = parseFileId(edge.source);
-    if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
-    const site = { relPath: edge.evidence.file };
-    if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
-    sites.push(site);
-  }
-  return sites.length === 1 ? sites[0] : void 0;
-}
-function routeCallSiteFor(graph, targetNodeId) {
-  if (!graph.hasNode(targetNodeId)) return void 0;
-  const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== NodeType.RouteNode || !attrs.path) return void 0;
-  const site = { relPath: attrs.path };
-  if (attrs.line !== void 0) site.line = attrs.line;
-  return site;
-}
-async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
-  const signals = await connector.poll(ctx);
-  let edgesCreated = 0;
-  let edgesUpdated = 0;
-  let unresolved = 0;
-  for (const signal of signals) {
-    const resolved = resolveTarget(signal, ctx);
-    if (!resolved) {
-      unresolved++;
-      continue;
-    }
-    if (resolved.ensureInfraNode) {
-      const { kind, name, provider } = resolved.ensureInfraNode;
-      ensureInfraNode(graph, kind, name, provider);
-    }
-    const serviceNodeId = ensureServiceNode(graph, resolved.serviceName, NO_ENV);
-    const callSite = signal.callSite ? { relPath: signal.callSite.file, line: signal.callSite.line } : routeCallSiteFor(graph, resolved.targetNodeId) ?? staticCallSiteFor(graph, resolved.serviceName, resolved.targetNodeId);
-    const sourceId = callSite ? ensureObservedFileNode(graph, resolved.serviceName, serviceNodeId, callSite) : serviceNodeId;
-    const evidence = callSite ? {
-      file: reconcileObservedRelPath(graph, resolved.serviceName, callSite.relPath),
-      line: callSite.line
-    } : void 0;
-    const calls = Math.trunc(signal.callCount);
-    if (!Number.isFinite(calls) || calls < 1) continue;
-    const errors = Number.isFinite(signal.errorCount) ? Math.min(Math.max(Math.trunc(signal.errorCount), 0), calls) : 0;
-    let created = false;
-    let ok = true;
-    for (let i = 0; i < calls; i++) {
-      const result = upsertObservedEdge(
-        graph,
-        resolved.edgeType,
-        sourceId,
-        resolved.targetNodeId,
-        signal.lastObservedIso,
-        i < errors,
-        evidence
-      );
-      if (!result) {
-        ok = false;
-        break;
-      }
-      if (i === 0) created = result.created;
-    }
-    if (!ok) {
-      unresolved++;
-      continue;
-    }
-    if (created) edgesCreated++;
-    else edgesUpdated++;
-  }
-  return { signalCount: signals.length, edgesCreated, edgesUpdated, unresolved };
-}
-var DEFAULT_POLL_INTERVAL_MS = 6e4;
-function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options = {}) {
-  let stopped = false;
-  let since = ctx.since;
-  const intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const connectorId = options.connectorId;
-  const onError = options.onError ?? ((err) => console.error(`[neatd] connector poll failed (${connector.provider})`, err));
-  const tick = () => {
-    if (stopped) return;
-    void (async () => {
-      const tickStartedAt = (/* @__PURE__ */ new Date()).toISOString();
-      try {
-        const result = await runConnectorPoll(connector, { ...ctx, since }, graph, resolveTarget);
-        since = tickStartedAt;
-        if (connectorId) {
-          recordConnectorPoll(connectorId, {
-            outcome: "ok",
-            at: tickStartedAt,
-            signalsLastPoll: result.signalCount
-          });
-        }
-      } catch (err) {
-        onError(err);
-        if (connectorId) {
-          recordConnectorPoll(connectorId, {
-            outcome: "error",
-            at: tickStartedAt,
-            error: sanitizePollError(err)
-          });
-        }
-      }
-    })();
-  };
-  tick();
-  const interval = setInterval(tick, intervalMs);
-  if (typeof interval.unref === "function") interval.unref();
-  return () => {
-    stopped = true;
-    clearInterval(interval);
-  };
-}
-
-// src/connectors/junction.ts
-var buckets = /* @__PURE__ */ new Map();
-function bucketMapKey(provider, accountKey) {
-  return `${provider}\0${accountKey}`;
-}
-function getBucket(provider, accountKey, config) {
-  const key = bucketMapKey(provider, accountKey);
-  const existing = buckets.get(key);
-  if (existing && existing.capacity === config.capacity && existing.refillMs === config.refillMs) {
-    return existing;
-  }
-  const fresh = { ...config, tokens: config.capacity, updatedAt: Date.now() };
-  buckets.set(key, fresh);
-  return fresh;
-}
-function refillBucket(bucket, now) {
-  if (now <= bucket.updatedAt) return;
-  const elapsed = now - bucket.updatedAt;
-  const grant = elapsed / bucket.refillMs;
-  if (grant <= 0) return;
-  bucket.tokens = Math.min(bucket.capacity, bucket.tokens + grant);
-  bucket.updatedAt = now;
-}
-var RateLimitExceededError = class extends Error {
-  constructor(provider, accountKey) {
-    super(
-      `junction: rate limit exceeded for ${provider}:${accountKey} \u2014 waiting for the next token would exceed this call's wall-clock budget`
-    );
-    this.name = "RateLimitExceededError";
-  }
-};
-function delay(ms) {
-  if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve) => {
-    const timer = setTimeout(resolve, ms);
-    if (typeof timer.unref === "function") timer.unref();
-  });
-}
-async function acquireToken(provider, accountKey, config, remainingBudgetMs) {
-  const bucket = getBucket(provider, accountKey, config);
-  refillBucket(bucket, Date.now());
-  if (bucket.tokens >= 1) {
-    bucket.tokens -= 1;
-    return 0;
-  }
-  const waitMs = Math.ceil((1 - bucket.tokens) * bucket.refillMs);
-  if (waitMs > remainingBudgetMs) {
-    throw new RateLimitExceededError(provider, accountKey);
-  }
-  await delay(waitMs);
-  refillBucket(bucket, Date.now());
-  bucket.tokens = Math.max(0, bucket.tokens - 1);
-  return waitMs;
-}
-var JUNCTION_DEFAULT_RATE_LIMITS = {
-  // ~300 requests / 5 minutes (ADR-131). Burst capacity holds a third of
-  // that ceiling; steady-state refill (1 token / 3s = 20/min = 100/5min)
-  // stays well clear of the documented limit even under sustained polling.
-  cloudflare: { capacity: 100, refillMs: 3e3 },
-  // Placeholder pending a live project confirming the real cap
-  // (docs/connectors/railway.md: "does not appear to publish one as of this
-  // writing").
-  railway: { capacity: 30, refillMs: 1e4 },
-  // Placeholder pending a live rate-limit check (docs/connectors/
-  // firebase.md: "needs-endpoint-testing against entries.list's live rate
-  // limits").
-  firebase: { capacity: 30, refillMs: 1e4 },
-  // Placeholder pending a live rate-limit check (docs/connectors/supabase.md:
-  // "the documented rate limit for this specific endpoint is unconfirmed").
-  supabase: { capacity: 30, refillMs: 1e4 },
-  // Not a documented API limit at all — a self-imposed ceiling on the raw
-  // pg_stat_statements connection (see module header above).
-  "supabase-postgres": { capacity: 20, refillMs: 3e3 },
-  // Push provider (ADR-146): the Drains REST API is touched only by `neat
-  // connector add/remove/test` (provision/deprovision/validate), never a poll
-  // loop, so this bucket is exercised a handful of times per command. Kept
-  // conservative pending a documented Drains-API rate limit.
-  vercel: { capacity: 20, refillMs: 5e3 }
-};
-var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
-function defaultRateLimitFor(provider) {
-  return JUNCTION_DEFAULT_RATE_LIMITS[provider] ?? JUNCTION_GENERIC_RATE_LIMIT;
-}
-var JUNCTION_DEFAULT_TIMEOUT_MS = 1e4;
-var JUNCTION_DEFAULT_MAX_ATTEMPTS = 3;
-var JUNCTION_DEFAULT_INITIAL_BACKOFF_MS = 200;
-var JUNCTION_DEFAULT_BACKOFF_MULTIPLIER = 4;
-var JUNCTION_DEFAULT_MAX_ELAPSED_MS = 3e4;
-var JUNCTION_DEFAULT_DB_TIMEOUT_MS = 1e4;
-async function backoff(attempt, initialBackoffMs, backoffMultiplier, remainingBudgetMs) {
-  const raw = initialBackoffMs * backoffMultiplier ** (attempt - 1);
-  const capped = Math.max(0, Math.min(raw, remainingBudgetMs));
-  await delay(capped);
-}
-function safeUrlLabel(url) {
-  try {
-    const u = typeof url === "string" ? new URL(url) : url;
-    return `${u.origin}${u.pathname}`;
-  } catch {
-    return String(url);
-  }
-}
-function logOutcome(provider, accountKey, outcome, method, label, attempt, startedAt) {
-  const elapsedMs = Date.now() - startedAt;
-  const line = `[neat connector] ${provider}:${accountKey} ${method} ${label} \u2014 ${outcome} (attempt ${attempt}, ${elapsedMs}ms)`;
-  if (outcome === "success" || outcome === "retried-then-succeeded") {
-    console.log(line);
-  } else if (outcome === "rate-limited") {
-    console.warn(line);
-  } else {
-    console.error(line);
-  }
-}
-function bearerAuthHeader(token) {
-  return { Authorization: `Bearer ${token}` };
-}
-async function junctionFetch(url, init = {}, policy) {
-  const {
-    provider,
-    accountKey,
-    timeoutMs = JUNCTION_DEFAULT_TIMEOUT_MS,
-    maxAttempts = JUNCTION_DEFAULT_MAX_ATTEMPTS,
-    maxElapsedMs = JUNCTION_DEFAULT_MAX_ELAPSED_MS,
-    initialBackoffMs = JUNCTION_DEFAULT_INITIAL_BACKOFF_MS,
-    backoffMultiplier = JUNCTION_DEFAULT_BACKOFF_MULTIPLIER,
-    rateLimit = defaultRateLimitFor(provider),
-    fetchImpl = fetch
-  } = policy;
-  const method = (init.method ?? "GET").toUpperCase();
-  const label = safeUrlLabel(url);
-  const startedAt = Date.now();
-  let attempt = 0;
-  let sawRetry = false;
-  for (; ; ) {
-    attempt++;
-    const remainingBudget = maxElapsedMs - (Date.now() - startedAt);
-    if (remainingBudget <= 0) {
-      logOutcome(provider, accountKey, "retried-then-failed", method, label, attempt - 1, startedAt);
-      throw new Error(
-        `junction: ${provider}:${accountKey} ${method} ${label} exceeded its wall-clock budget (${maxElapsedMs}ms) after ${attempt - 1} attempt(s)`
-      );
-    }
-    try {
-      await acquireToken(provider, accountKey, rateLimit, remainingBudget);
-    } catch (err) {
-      if (err instanceof RateLimitExceededError) {
-        logOutcome(provider, accountKey, "rate-limited", method, label, attempt, startedAt);
-      }
-      throw err;
-    }
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    if (typeof timer.unref === "function") timer.unref();
-    try {
-      const res = await fetchImpl(url, { ...init, signal: controller.signal });
-      clearTimeout(timer);
-      if (res.ok || res.status < 500) {
-        logOutcome(provider, accountKey, sawRetry ? "retried-then-succeeded" : "success", method, label, attempt, startedAt);
-        return res;
-      }
-      if (attempt >= maxAttempts) {
-        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", method, label, attempt, startedAt);
-        return res;
-      }
-      sawRetry = true;
-      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
-    } catch (err) {
-      clearTimeout(timer);
-      if (attempt >= maxAttempts) {
-        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", method, label, attempt, startedAt);
-        throw err;
-      }
-      sawRetry = true;
-      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
-    }
-  }
-}
-var DbJunctionTimeoutError = class extends Error {
-  constructor(ms) {
-    super(`junction: db query exceeded its ${ms}ms timeout`);
-    this.name = "DbJunctionTimeoutError";
-  }
-};
-function withTimeout(run, timeoutMs) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new DbJunctionTimeoutError(timeoutMs)), timeoutMs);
-    if (typeof timer.unref === "function") timer.unref();
-    run().then(
-      (value) => {
-        clearTimeout(timer);
-        resolve(value);
-      },
-      (err) => {
-        clearTimeout(timer);
-        reject(err);
-      }
-    );
-  });
-}
-var RETRYABLE_NODE_ERROR_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EHOSTUNREACH", "EAI_AGAIN", "EPIPE"]);
-function isRetryableDbError(err) {
-  if (err instanceof DbJunctionTimeoutError) return true;
-  const code = err?.code;
-  if (typeof code !== "string") return false;
-  if (code.startsWith("08") || code === "57P03") return true;
-  return RETRYABLE_NODE_ERROR_CODES.has(code);
-}
-async function dbJunction(run, policy) {
-  const {
-    provider,
-    accountKey,
-    timeoutMs = JUNCTION_DEFAULT_DB_TIMEOUT_MS,
-    maxAttempts = JUNCTION_DEFAULT_MAX_ATTEMPTS,
-    maxElapsedMs = JUNCTION_DEFAULT_MAX_ELAPSED_MS,
-    initialBackoffMs = JUNCTION_DEFAULT_INITIAL_BACKOFF_MS,
-    backoffMultiplier = JUNCTION_DEFAULT_BACKOFF_MULTIPLIER,
-    rateLimit = defaultRateLimitFor(provider)
-  } = policy;
-  const startedAt = Date.now();
-  let attempt = 0;
-  let sawRetry = false;
-  for (; ; ) {
-    attempt++;
-    const remainingBudget = maxElapsedMs - (Date.now() - startedAt);
-    if (remainingBudget <= 0) {
-      logOutcome(provider, accountKey, "retried-then-failed", "QUERY", "db", attempt - 1, startedAt);
-      throw new Error(
-        `junction: ${provider}:${accountKey} db query exceeded its wall-clock budget (${maxElapsedMs}ms) after ${attempt - 1} attempt(s)`
-      );
-    }
-    try {
-      await acquireToken(provider, accountKey, rateLimit, remainingBudget);
-    } catch (err) {
-      if (err instanceof RateLimitExceededError) {
-        logOutcome(provider, accountKey, "rate-limited", "QUERY", "db", attempt, startedAt);
-      }
-      throw err;
-    }
-    try {
-      const result = await withTimeout(run, timeoutMs);
-      logOutcome(provider, accountKey, sawRetry ? "retried-then-succeeded" : "success", "QUERY", "db", attempt, startedAt);
-      return result;
-    } catch (err) {
-      if (!isRetryableDbError(err) || attempt >= maxAttempts) {
-        logOutcome(provider, accountKey, sawRetry ? "retried-then-failed" : "failed", "QUERY", "db", attempt, startedAt);
-        throw err;
-      }
-      sawRetry = true;
-      await backoff(attempt, initialBackoffMs, backoffMultiplier, maxElapsedMs - (Date.now() - startedAt));
-    }
-  }
-}
-
-// src/connectors/supabase/client.ts
-var DEFAULT_SUPABASE_MANAGEMENT_API_URL = "https://api.supabase.com";
-var DEFAULT_LOG_LIMIT = 1e3;
-var SUPABASE_LOG_QUERY_MAX_WINDOW_MS = 24 * 60 * 60 * 1e3;
-function boundedSupabaseLogWindow(since, now, maxLookbackMs) {
-  const window = Math.min(maxLookbackMs, SUPABASE_LOG_QUERY_MAX_WINDOW_MS);
-  const floor = new Date(now.getTime() - window);
-  const endIso = now.toISOString();
-  if (!since) return { startIso: floor.toISOString(), endIso, truncated: false };
-  const sinceMs = new Date(since).getTime();
-  if (Number.isNaN(sinceMs)) return { startIso: floor.toISOString(), endIso, truncated: false };
-  if (sinceMs < floor.getTime()) return { startIso: floor.toISOString(), endIso, truncated: true };
-  return { startIso: new Date(sinceMs).toISOString(), endIso, truncated: false };
-}
-function buildEdgeLogsQuery(limit) {
-  const safeLimit = Math.max(1, Math.trunc(limit) || DEFAULT_LOG_LIMIT);
-  return [
-    "select",
-    "  format_timestamp('%Y-%m-%dT%H:%M:%E6SZ', timestamp) as timestamp,",
-    "  request.method as method,",
-    "  request.path as path,",
-    "  response.status_code as status_code",
-    "from edge_logs",
-    "cross join unnest(metadata) as metadata",
-    "cross join unnest(metadata.request) as request",
-    "cross join unnest(metadata.response) as response",
-    "where regexp_contains(request.path, '^/rest/v1/')",
-    "order by timestamp asc",
-    `limit ${safeLimit}`
-  ].join("\n");
-}
-function logsAllHttpFailureMessage(status) {
-  if (status === 401 || status === 403) {
-    return `supabase connector: logs.all request rejected (HTTP ${status}). Check the Management API token, its analytics read scope, and --api-project-ref.`;
-  }
-  if (status === 404) {
-    return "supabase connector: logs.all project not found (HTTP 404). Check --api-project-ref.";
-  }
-  if (status === 429) {
-    return "supabase connector: logs.all rate-limited (HTTP 429). The connector will retry on the next poll; reduce poll cadence if this persists.";
-  }
-  if (status === 400) {
-    return "supabase connector: logs.all query rejected (HTTP 400). Provider details redacted; confirm the live log-query dialect before shipping this connector.";
-  }
-  return `supabase connector: logs.all request failed (HTTP ${status}); provider details redacted.`;
-}
-function providerErrorDetails(error) {
-  if (!error || typeof error === "string") return "";
-  const parts = [];
-  if (typeof error.code === "number") parts.push(`code ${error.code}`);
-  if (typeof error.status === "string" && /^[A-Z0-9_.-]+$/.test(error.status)) {
-    parts.push(`status ${error.status}`);
-  }
-  return parts.length > 0 ? ` (${parts.join(", ")})` : "";
-}
-async function fetchSupabaseEdgeLogs(config, token, startIso, endIso, fetchImpl = fetch) {
-  const baseUrl = config.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
-  const url = new URL(`${baseUrl}/v1/projects/${config.apiProjectRef}/analytics/endpoints/logs.all`);
-  url.searchParams.set("sql", buildEdgeLogsQuery(config.logLimit ?? DEFAULT_LOG_LIMIT));
-  url.searchParams.set("iso_timestamp_start", startIso);
-  url.searchParams.set("iso_timestamp_end", endIso);
-  const res = await junctionFetch(
-    url,
-    { method: "GET", headers: bearerAuthHeader(token) },
-    // accountKey: the Supabase project ref (ADR-131's own worked example) —
-    // the Management API's rate limit is enforced per project.
-    { provider: "supabase", accountKey: config.apiProjectRef, fetchImpl }
-  );
-  if (!res.ok) {
-    throw new Error(logsAllHttpFailureMessage(res.status));
-  }
-  let body;
-  try {
-    body = await res.json();
-  } catch {
-    throw new Error("supabase connector: logs.all returned invalid JSON; provider details redacted.");
-  }
-  if (body.error) {
-    throw new Error(
-      `supabase connector: logs.all returned a provider error${providerErrorDetails(body.error)}; provider message redacted.`
-    );
-  }
-  return body.result ?? [];
-}
-
-// src/connectors/supabase/types.ts
-function readSupabaseCredentials(raw) {
-  const managementToken = raw["managementToken"];
-  if (typeof managementToken !== "string" || managementToken.length === 0) {
-    throw new Error("supabase connector: credentials.managementToken must be a non-empty string");
-  }
-  const postgresConnectionString = raw["postgresConnectionString"];
-  if (postgresConnectionString !== void 0 && (typeof postgresConnectionString !== "string" || postgresConnectionString.length === 0)) {
-    throw new Error(
-      "supabase connector: credentials.postgresConnectionString must be a non-empty string when present"
-    );
-  }
-  return {
-    managementToken,
-    ...postgresConnectionString ? { postgresConnectionString } : {}
-  };
-}
-var SUPABASE_TABLE_TARGET_KIND = "supabase-table";
-var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
-
-// src/connectors/supabase/map.ts
-var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
-var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path3) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path3);
-  if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path3);
-  if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
-  return null;
-}
-var ERROR_STATUS_THRESHOLD = 500;
-function mapEdgeLogRowsToSignals(rows) {
-  const buckets2 = /* @__PURE__ */ new Map();
-  if (!Array.isArray(rows)) return [];
-  for (const row of rows) {
-    if (!row || typeof row !== "object") continue;
-    if (typeof row.path !== "string" || typeof row.timestamp !== "string") continue;
-    const target = targetFromRestPath(row.path);
-    if (!target) continue;
-    const key = `${target.targetKind}:${target.name}`;
-    const isError = row.status_code >= ERROR_STATUS_THRESHOLD;
-    const existing = buckets2.get(key);
-    if (existing) {
-      existing.callCount += 1;
-      if (isError) existing.errorCount += 1;
-      if (row.timestamp > existing.lastObservedIso) existing.lastObservedIso = row.timestamp;
-    } else {
-      buckets2.set(key, {
-        targetKind: target.targetKind,
-        targetName: target.name,
-        callCount: 1,
-        errorCount: isError ? 1 : 0,
-        lastObservedIso: row.timestamp
-      });
-    }
-  }
-  return [...buckets2.values()].map((b) => ({
-    targetKind: b.targetKind,
-    targetName: b.targetName,
-    callCount: b.callCount,
-    errorCount: b.errorCount,
-    lastObservedIso: b.lastObservedIso
-  }));
-}
-var FROM_TABLE_RE = /\bfrom\s+"?(?:[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i;
-var SYSTEM_SCHEMA_PREFIXES = ["pg_", "information_schema"];
-function tableNameFromQueryText(query) {
-  const match = FROM_TABLE_RE.exec(query);
-  if (!match) return null;
-  const name = match[1];
-  const lower = name.toLowerCase();
-  if (SYSTEM_SCHEMA_PREFIXES.some((prefix) => lower.startsWith(prefix))) return null;
-  return name;
-}
-function diffPgStatStatementsToSignals(rows, previous, nowIso) {
-  const signals = [];
-  const seen = /* @__PURE__ */ new Set();
-  if (!Array.isArray(rows)) return signals;
-  for (const row of rows) {
-    if (!row || typeof row !== "object" || typeof row.queryid !== "string") continue;
-    const calls = Number(row.calls);
-    if (!Number.isFinite(calls)) continue;
-    seen.add(row.queryid);
-    const prior = previous.get(row.queryid);
-    previous.set(row.queryid, { calls });
-    if (!prior || calls < prior.calls) continue;
-    const delta = calls - prior.calls;
-    if (delta <= 0) continue;
-    const table = tableNameFromQueryText(row.query);
-    if (!table) continue;
-    signals.push({
-      targetKind: SUPABASE_TABLE_TARGET_KIND,
-      targetName: table,
-      callCount: delta,
-      errorCount: 0,
-      lastObservedIso: nowIso
-    });
-  }
-  for (const queryid of [...previous.keys()]) {
-    if (!seen.has(queryid)) previous.delete(queryid);
-  }
-  return signals;
-}
-
-// src/connectors/supabase/postgres-client.ts
-import pg from "pg";
-var { Client } = pg;
-var DEFAULT_STATEMENT_LIMIT = 500;
-var STATEMENTS_QUERY = `
-  select queryid, query, calls, total_exec_time, rows
-  from pg_stat_statements
-  where query ~* '^\\s*select\\b'
-  order by calls desc
-  limit $1
-`;
-async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT_LIMIT, accountKey = "unknown", clientFactory = (cs) => new Client({ connectionString: cs })) {
-  return dbJunction(
-    async () => {
-      const client = clientFactory(connectionString);
-      await client.connect();
-      try {
-        await client.query("SET default_transaction_read_only = on");
-        const result = await client.query(STATEMENTS_QUERY, [limit]);
-        return result.rows;
-      } finally {
-        await client.end();
-      }
-    },
-    { provider: "supabase-postgres", accountKey }
-  );
-}
-
-// src/connectors/supabase/resolve.ts
-import { EdgeType, infraId } from "@neat.is/types";
-function createSupabaseResolveTarget(graph, config) {
-  return (signal, _ctx) => {
-    if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
-      return null;
-    }
-    const subResourceId = infraId(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
-    if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: EdgeType.CALLS };
-    }
-    const bareResourceId = infraId(signal.targetKind, signal.targetName);
-    if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: EdgeType.CALLS };
-    }
-    const projectLevelId = infraId("supabase", config.nodeRef);
-    if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: EdgeType.CALLS };
-    }
-    return null;
-  };
-}
-
-// src/connectors/supabase/index.ts
-var DEFAULT_MAX_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
-function errorCode(err) {
-  const code = err?.code;
-  return typeof code === "string" && code.length > 0 ? code : void 0;
-}
-function describeSupabasePostgresSurfaceFailure(projectRef, err) {
-  const code = errorCode(err);
-  let reason;
-  switch (code) {
-    case "42501":
-      reason = "permission denied; grant pg_read_all_stats to the configured Postgres role";
-      break;
-    case "42P01":
-    case "42704":
-      reason = "pg_stat_statements is not enabled or visible to the configured Postgres role";
-      break;
-    case "28P01":
-    case "28000":
-      reason = "Postgres credential rejected";
-      break;
-    case "3D000":
-      reason = "database not found";
-      break;
-    default: {
-      const name = err instanceof Error && err.name ? err.name : "Error";
-      reason = code ? `${name} ${code}` : name;
-    }
-  }
-  return `supabase connector: pg_stat_statements surface unavailable for project ${projectRef} (${reason}); continuing with Management API log surface.`;
-}
-var SupabaseConnector = class {
-  // `deps.fetchPgStatStatements` defaults to the real Postgres-backed
-  // implementation; tests override it to exercise the "both surfaces
-  // combine" and "surface 2 only runs when a connection string is present"
-  // behavior without a live database — the same dependency-injection seam
-  // `fetchImpl` gives cloudflare/client.ts's tests for `fetch`.
-  constructor(config, deps = {}) {
-    this.config = config;
-    this.deps = deps;
-  }
-  config;
-  deps;
-  provider = "supabase";
-  // pg_stat_statements.calls is cumulative, not per-window (map.ts's
-  // diffPgStatStatementsToSignals doc comment) — this Map carries the
-  // previous poll's counts across ticks, the same way
-  // `startConnectorPollLoop` (connectors/index.ts) carries `since` across
-  // ticks for every connector. Lives on the instance, not `ConnectorContext`,
-  // because `ConnectorContext` is rebuilt fresh per tick (connectors/index.ts's
-  // `{ ...ctx, since }`) while this connector object is the one thing every
-  // tick shares.
-  statementBaselines = /* @__PURE__ */ new Map();
-  async poll(ctx) {
-    const creds = readSupabaseCredentials(ctx.credentials);
-    const now = /* @__PURE__ */ new Date();
-    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS;
-    const { startIso, endIso } = boundedSupabaseLogWindow(ctx.since, now, maxLookbackMs);
-    const logRows = await fetchSupabaseEdgeLogs(this.config, creds.managementToken, startIso, endIso);
-    const signals = mapEdgeLogRowsToSignals(logRows);
-    if (creds.postgresConnectionString) {
-      const fetchStatements = this.deps.fetchPgStatStatements ?? fetchPgStatStatements;
-      try {
-        const statementRows = await fetchStatements(
-          creds.postgresConnectionString,
-          this.config.statementLimit ?? DEFAULT_STATEMENT_LIMIT,
-          this.config.apiProjectRef
-        );
-        signals.push(...diffPgStatStatementsToSignals(statementRows, this.statementBaselines, now.toISOString()));
-      } catch (err) {
-        const summary = describeSupabasePostgresSurfaceFailure(this.config.apiProjectRef, err);
-        if (this.deps.onPostgresSurfaceError) this.deps.onPostgresSurfaceError(err, summary);
-        else console.warn(summary);
-      }
-    }
-    return signals;
-  }
-};
-function createSupabaseConnector(graph, config, deps = {}) {
-  return {
-    connector: new SupabaseConnector(config, deps),
-    resolveTarget: createSupabaseResolveTarget(graph, config)
-  };
-}
-
-// src/connectors/railway/index.ts
-import { EdgeType as EdgeType2, NodeType as NodeType2, serviceId } from "@neat.is/types";
-
-// src/connectors/railway/client.ts
-var DEFAULT_RAILWAY_API_URL = "https://backboard.railway.com/graphql/v2";
-var DEFAULT_MAX_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
-var DEFAULT_LOG_LIMIT2 = 1e3;
-function readRailwayToken(credentials) {
-  const token = credentials.token;
-  if (typeof token !== "string" || token.length === 0) {
-    throw new Error(
-      "Railway connector requires ctx.credentials.token (a Project-Access-Token or account Bearer token)"
-    );
-  }
-  return token;
-}
-var RAILWAY_AUTH_STYLES = ["bearer", "project-access-token"];
-function railwayAuthHeader(style, token) {
-  return style === "bearer" ? { Authorization: `Bearer ${token}` } : { "Project-Access-Token": token };
-}
-var resolvedRailwayAuthStyle = /* @__PURE__ */ new Map();
-function isRailwayNotAuthorized(err) {
-  return err instanceof Error && /not authorized/i.test(err.message);
-}
-async function railwayGraphQLOnce(apiUrl, style, token, query, variables, accountKey, fetchImpl) {
-  const res = await junctionFetch(
-    apiUrl,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...railwayAuthHeader(style, token)
-      },
-      body: JSON.stringify({ query, variables })
-    },
-    { provider: "railway", accountKey, ...fetchImpl ? { fetchImpl } : {} }
-  );
-  if (!res.ok) {
-    throw new Error(`Railway GraphQL request failed: ${res.status} ${res.statusText}`);
-  }
-  const body = await res.json();
-  if (body.errors && body.errors.length > 0) {
-    throw new Error(`Railway GraphQL errors: ${body.errors.map((e) => e.message).join("; ")}`);
-  }
-  if (!body.data) throw new Error("Railway GraphQL response carried no data");
-  return body.data;
-}
-async function railwayGraphQL(apiUrl, token, query, variables, accountKey, fetchImpl) {
-  const known = resolvedRailwayAuthStyle.get(token);
-  const styles = known ? [known] : RAILWAY_AUTH_STYLES;
-  let lastNotAuthorized;
-  for (let i = 0; i < styles.length; i++) {
-    const style = styles[i];
-    try {
-      const data = await railwayGraphQLOnce(apiUrl, style, token, query, variables, accountKey, fetchImpl);
-      resolvedRailwayAuthStyle.set(token, style);
-      return data;
-    } catch (err) {
-      if (isRailwayNotAuthorized(err) && i < styles.length - 1) {
-        lastNotAuthorized = err;
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw lastNotAuthorized ?? new Error("Railway GraphQL: no auth style resolved");
-}
-var HTTP_LOGS_QUERY = `
-  query HttpLogs($deploymentId: String!, $startDate: String, $endDate: String, $limit: Int) {
-    httpLogs(deploymentId: $deploymentId, startDate: $startDate, endDate: $endDate, limit: $limit) {
-      timestamp
-      method
-      path
-      httpStatus
-      totalDuration
-      requestId
-      deploymentId
-      edgeRegion
-    }
-  }
-`;
-var NETWORK_FLOW_LOGS_QUERY = `
-  query NetworkFlowLogs($environmentId: String!, $serviceId: String) {
-    networkFlowLogs(environmentId: $environmentId, serviceId: $serviceId) {
-      timestamp: captureStart
-      peerServiceId
-      peerKind
-      direction
-      byteCount
-      packetCount
-      dropCause
-    }
-  }
-`;
-var DEPLOYMENTS_QUERY = `
-  query LatestDeployment($environmentId: String!, $serviceId: String!) {
-    deployments(input: { environmentId: $environmentId, serviceId: $serviceId }, first: 5) {
-      edges { node { id status createdAt } }
-    }
-  }
-`;
-async function resolveLatestRailwayDeploymentId(config, token, fetchImpl) {
-  const data = await railwayGraphQL(
-    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
-    token,
-    DEPLOYMENTS_QUERY,
-    { environmentId: config.environmentId, serviceId: config.serviceId },
-    config.environmentId,
-    fetchImpl
-  );
-  const nodes = data.deployments.edges.map((e) => e.node);
-  const newestFirst = [...nodes].sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-  const success = newestFirst.find((n) => n.status === "SUCCESS");
-  return (success ?? newestFirst[0])?.id ?? null;
-}
-async function fetchRailwayHttpLogs(config, token, deploymentId, startDate, endDate) {
-  const data = await railwayGraphQL(
-    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
-    token,
-    HTTP_LOGS_QUERY,
-    { deploymentId, startDate, endDate, limit: config.limit ?? DEFAULT_LOG_LIMIT2 },
-    config.environmentId
-  );
-  return data.httpLogs;
-}
-async function fetchRailwayNetworkFlowLogs(config, token) {
-  const data = await railwayGraphQL(
-    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
-    token,
-    NETWORK_FLOW_LOGS_QUERY,
-    { environmentId: config.environmentId, serviceId: config.serviceId },
-    config.environmentId
-  );
-  return data.networkFlowLogs;
-}
-function boundedRailwayStartDate(since, now, maxLookbackMs) {
-  const floor = new Date(now.getTime() - maxLookbackMs);
-  if (!since) return floor.toISOString();
-  const sinceMs = new Date(since).getTime();
-  if (Number.isNaN(sinceMs)) return floor.toISOString();
-  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
-}
-
-// src/connectors/railway/index.ts
-var ROUTE_TARGET_KIND = "route";
-var UNMATCHED_ROUTE_TARGET_KIND = "unmatched-route";
-var PEER_SERVICE_TARGET_KIND = "peer-service";
-function buildRailwayRouteIndex(graph, serviceName) {
-  const out = [];
-  graph.forEachNode((_id, attrs) => {
-    const node = attrs;
-    if (node.type !== NodeType2.RouteNode) return;
-    const route = attrs;
-    if (route.service !== serviceName) return;
-    out.push({
-      method: route.method.toUpperCase(),
-      normalizedPath: normalizePathTemplate(route.pathTemplate),
-      routeNodeId: route.id,
-      path: route.path,
-      line: route.line
-    });
-  });
-  return out;
-}
-function findRailwayRoute(entries, method, normalizedPath) {
-  return entries.find(
-    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
-  );
-}
-function bucketKey(method, normalizedPath) {
-  return `${method} ${normalizedPath}`;
-}
-function isHttpErrorStatus(status) {
-  return status >= 400;
-}
-function upsertBucket(buckets2, key, isError, timestamp, build) {
-  const existing = buckets2.get(key);
-  if (existing) {
-    existing.callCount += 1;
-    if (isError) existing.errorCount += 1;
-    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
-    return;
-  }
-  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
-}
-function mapRailwayHttpLogsToSignals(entries, routeIndex) {
-  const buckets2 = /* @__PURE__ */ new Map();
-  if (!Array.isArray(entries)) return [];
-  for (const entry of entries) {
-    if (!entry || typeof entry !== "object") continue;
-    if (typeof entry.method !== "string" || typeof entry.path !== "string" || typeof entry.timestamp !== "string") {
-      continue;
-    }
-    const method = entry.method.toUpperCase();
-    const normalizedPath = normalizePathTemplate(entry.path);
-    const match = findRailwayRoute(routeIndex, method, normalizedPath);
-    const isError = isHttpErrorStatus(entry.httpStatus);
-    if (match) {
-      upsertBucket(buckets2, `route:${match.routeNodeId}`, isError, entry.timestamp, () => ({
-        targetKind: ROUTE_TARGET_KIND,
-        targetName: match.routeNodeId,
-        // RouteNode.line is optional in the schema (packages/types/src/
-        // nodes.ts) even though routes.ts always sets it today — skip the
-        // callSite rather than fabricate a line when it's ever absent
-        // (file-awareness.md §6).
-        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
-      }));
-    } else {
-      upsertBucket(
-        buckets2,
-        `unmatched:${bucketKey(method, normalizedPath)}`,
-        isError,
-        entry.timestamp,
-        () => ({
-          targetKind: UNMATCHED_ROUTE_TARGET_KIND,
-          targetName: bucketKey(method, normalizedPath)
-        })
-      );
-    }
-  }
-  return [...buckets2.values()].map((b) => ({
-    targetKind: b.targetKind,
-    targetName: b.targetName,
-    callCount: b.callCount,
-    errorCount: b.errorCount,
-    lastObservedIso: b.lastObservedIso,
-    ...b.callSite ? { callSite: b.callSite } : {}
-  }));
-}
-function mapRailwayNetworkFlowLogsToSignals(entries) {
-  const buckets2 = /* @__PURE__ */ new Map();
-  if (!Array.isArray(entries)) return [];
-  for (const entry of entries) {
-    if (!entry || typeof entry !== "object") continue;
-    if (typeof entry.peerServiceId !== "string" || entry.peerServiceId.length === 0) continue;
-    if (typeof entry.timestamp !== "string") continue;
-    const isError = entry.dropCause !== null && entry.dropCause !== "";
-    upsertBucket(buckets2, entry.peerServiceId, isError, entry.timestamp, () => ({
-      targetKind: PEER_SERVICE_TARGET_KIND,
-      targetName: entry.peerServiceId
-    }));
-  }
-  return [...buckets2.values()].map((b) => ({
-    targetKind: b.targetKind,
-    targetName: b.targetName,
-    callCount: b.callCount,
-    errorCount: b.errorCount,
-    lastObservedIso: b.lastObservedIso
-  }));
-}
-function createRailwayResolveTarget(config) {
-  return (signal) => {
-    const serviceName = config.serviceNameById[config.serviceId];
-    if (!serviceName) return null;
-    if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: EdgeType2.CALLS };
-    }
-    if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
-      const peerName = config.serviceNameById[signal.targetName];
-      if (!peerName) return null;
-      return { targetNodeId: serviceId(peerName), serviceName, edgeType: EdgeType2.CONNECTS_TO };
-    }
-    return null;
-  };
-}
-function createRailwayConnector(graph, config) {
-  return {
-    provider: "railway",
-    async poll(ctx) {
-      const token = readRailwayToken(ctx.credentials);
-      const now = /* @__PURE__ */ new Date();
-      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS2;
-      const startDate = boundedRailwayStartDate(ctx.since, now, maxLookbackMs);
-      const endDate = now.toISOString();
-      const deploymentId = await resolveLatestRailwayDeploymentId(config, token);
-      const [httpLogsResult, flowLogsResult] = await Promise.allSettled([
-        deploymentId ? fetchRailwayHttpLogs(config, token, deploymentId, startDate, endDate) : Promise.resolve([]),
-        fetchRailwayNetworkFlowLogs(config, token)
-      ]);
-      if (httpLogsResult.status === "rejected") {
-        console.error("[neat connector] railway httpLogs poll failed", httpLogsResult.reason);
-      }
-      if (flowLogsResult.status === "rejected") {
-        console.error("[neat connector] railway networkFlowLogs poll failed", flowLogsResult.reason);
-      }
-      const httpLogs = httpLogsResult.status === "fulfilled" ? httpLogsResult.value : [];
-      const flowLogs = flowLogsResult.status === "fulfilled" ? flowLogsResult.value : [];
-      const serviceName = config.serviceNameById[config.serviceId];
-      const routeIndex = serviceName ? buildRailwayRouteIndex(graph, serviceName) : [];
-      return [
-        ...mapRailwayHttpLogsToSignals(httpLogs, routeIndex),
-        ...mapRailwayNetworkFlowLogsToSignals(flowLogs)
-      ];
-    }
-  };
-}
-
-// src/connectors/firebase/logging-api.ts
-function readFirebaseCredentials(raw) {
-  const projectId = raw["projectId"];
-  const accessToken = raw["accessToken"];
-  if (typeof projectId !== "string" || projectId.length === 0) {
-    throw new Error("firebase connector: credentials.projectId must be a non-empty string");
-  }
-  if (typeof accessToken !== "string" || accessToken.length === 0) {
-    throw new Error("firebase connector: credentials.accessToken must be a non-empty string");
-  }
-  return { projectId, accessToken };
-}
-var RESOURCE_TYPES = [
-  "cloud_function",
-  "cloud_run_revision",
-  "firebase_domain"
-];
-function isFirebaseResourceType(value) {
-  return RESOURCE_TYPES.includes(value);
-}
-function buildEntriesFilter(sinceIso) {
-  return [
-    'resource.type = ("cloud_function" OR "cloud_run_revision" OR "firebase_domain")',
-    "httpRequest:*",
-    `timestamp >= "${sinceIso}"`
-  ].join(" AND ");
-}
-var DEFAULT_LOOKBACK_MS = 24 * 60 * 60 * 1e3;
-var ENTRIES_LIST_URL = "https://logging.googleapis.com/v2/entries:list";
-var PAGE_SIZE = 1e3;
-var MAX_PAGES = 20;
-async function fetchHttpRequestLogEntries(creds, sinceIso) {
-  const filter = buildEntriesFilter(sinceIso);
-  const out = [];
-  let pageToken;
-  for (let page = 0; page < MAX_PAGES; page++) {
-    const body = {
-      resourceNames: [`projects/${creds.projectId}`],
-      filter,
-      orderBy: "timestamp asc",
-      pageSize: PAGE_SIZE,
-      ...pageToken ? { pageToken } : {}
-    };
-    const res = await junctionFetch(
-      ENTRIES_LIST_URL,
-      {
-        method: "POST",
-        headers: {
-          ...bearerAuthHeader(creds.accessToken),
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      },
-      // accountKey: the GCP project id (ADR-131's own worked example for
-      // Firebase) — one customer's Cloud Logging quota is scoped per GCP
-      // project, not per Firebase site/function.
-      { provider: "firebase", accountKey: creds.projectId }
-    );
-    if (!res.ok) {
-      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
-    }
-    const json = await res.json();
-    if (Array.isArray(json.entries)) out.push(...json.entries);
-    if (!json.nextPageToken) break;
-    pageToken = json.nextPageToken;
-  }
-  return out;
-}
-
-// src/connectors/firebase/map.ts
-var FIELD_SEP = "\0";
-function packFirebaseTargetName(identity) {
-  return [identity.resourceName, identity.method, identity.path].join(FIELD_SEP);
-}
-function parseFirebaseTargetName(targetName) {
-  const firstSep = targetName.indexOf(FIELD_SEP);
-  if (firstSep === -1) return null;
-  const resourceName = targetName.slice(0, firstSep);
-  const rest = targetName.slice(firstSep + 1);
-  const secondSep = rest.indexOf(FIELD_SEP);
-  if (secondSep === -1) return null;
-  const method = rest.slice(0, secondSep);
-  const path3 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path3) return null;
-  return { resourceName, method, path: path3 };
-}
-function resourceNameFor(type, labels) {
-  if (!labels) return null;
-  switch (type) {
-    case "cloud_function":
-      return labels["function_name"] ?? null;
-    case "cloud_run_revision":
-      return labels["service_name"] ?? null;
-    case "firebase_domain":
-      return labels["site_name"] ?? null;
-  }
-}
-function pathFromRequestUrl(requestUrl) {
-  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
-  if (requestUrl.startsWith("/")) {
-    const withoutQuery = requestUrl.split("?")[0];
-    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
-  }
-  try {
-    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
-    const parsed = new URL(candidate);
-    return parsed.pathname || "/";
-  } catch {
-    return null;
-  }
-}
-var ERROR_STATUS_THRESHOLD2 = 500;
-function mapLogEntryToSignal(entry) {
-  if (!entry || typeof entry !== "object") return null;
-  const resourceType = entry.resource?.type;
-  if (!resourceType || !isFirebaseResourceType(resourceType)) return null;
-  const resourceName = resourceNameFor(resourceType, entry.resource?.labels);
-  if (!resourceName) return null;
-  const req = entry.httpRequest;
-  if (!req) return null;
-  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
-  const method = req.requestMethod.toUpperCase();
-  const path3 = pathFromRequestUrl(req.requestUrl);
-  if (path3 === null) return null;
-  const timestamp = entry.timestamp;
-  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
-  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
-  return {
-    targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path3 }),
-    callCount: 1,
-    errorCount: isError ? 1 : 0,
-    lastObservedIso: timestamp
-  };
-}
-function mapLogEntriesToSignals(entries) {
-  const out = [];
-  for (const entry of entries) {
-    const signal = mapLogEntryToSignal(entry);
-    if (signal) out.push(signal);
-  }
-  return out;
-}
-
-// src/connectors/firebase/resolve.ts
-import { NodeType as NodeType3, EdgeType as EdgeType3 } from "@neat.is/types";
-function neatServiceNameFor(resourceType, resourceName, serviceMap) {
-  switch (resourceType) {
-    case "cloud_function":
-      return serviceMap.functions?.[resourceName] ?? null;
-    case "cloud_run_revision":
-      return serviceMap.cloudRun?.[resourceName] ?? null;
-    case "firebase_domain":
-      return serviceMap.hosting?.[resourceName] ?? null;
-  }
-}
-function routeEntriesFor(graph, serviceName) {
-  const entries = [];
-  graph.forEachNode((_id, attrs) => {
-    const node = attrs;
-    if (node.type !== NodeType3.RouteNode) return;
-    const route = attrs;
-    if (route.service !== serviceName) return;
-    entries.push({
-      method: route.method.toUpperCase(),
-      normalizedPath: normalizePathTemplate(route.pathTemplate),
-      routeNodeId: route.id
-    });
-  });
-  return entries;
-}
-function findRoute(entries, method, normalizedPath) {
-  return entries.find(
-    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
-  );
-}
-function createFirebaseResolveTarget(graph, serviceMap) {
-  return (signal, _ctx) => {
-    const resourceType = signal.targetKind;
-    if (resourceType !== "cloud_function" && resourceType !== "cloud_run_revision" && resourceType !== "firebase_domain") {
-      return null;
-    }
-    const identity = parseFirebaseTargetName(signal.targetName);
-    if (!identity) return null;
-    const serviceName = neatServiceNameFor(resourceType, identity.resourceName, serviceMap);
-    if (!serviceName) return null;
-    const normalizedPath = normalizePathTemplate(identity.path);
-    const match = findRoute(routeEntriesFor(graph, serviceName), identity.method, normalizedPath);
-    if (!match) return null;
-    return {
-      targetNodeId: match.routeNodeId,
-      serviceName,
-      edgeType: EdgeType3.CALLS
-    };
-  };
-}
-
-// src/connectors/firebase/index.ts
-var FirebaseConnector = class {
-  provider = "firebase";
-  async poll(ctx) {
-    const creds = readFirebaseCredentials(ctx.credentials);
-    const sinceIso = ctx.since ?? new Date(Date.now() - DEFAULT_LOOKBACK_MS).toISOString();
-    const entries = await fetchHttpRequestLogEntries(creds, sinceIso);
-    return mapLogEntriesToSignals(entries);
-  }
-};
-function createFirebaseConnector(graph, serviceMap) {
-  return {
-    connector: new FirebaseConnector(),
-    resolveTarget: createFirebaseResolveTarget(graph, serviceMap)
-  };
-}
-
-// src/connectors/cloudflare/connector.ts
-import { EdgeType as EdgeType4, NodeType as NodeType4, fileId, infraId as infraId2 } from "@neat.is/types";
-
-// src/connectors/cloudflare/client.ts
-import { randomUUID } from "crypto";
-var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
-var DEFAULT_EVENT_LIMIT = 1e3;
-async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
-  const token = ctx.credentials.apiToken;
-  if (typeof token !== "string" || token.length === 0) {
-    throw new Error("cloudflare connector: ctx.credentials.apiToken must be a non-empty string");
-  }
-  const baseUrl = config.baseUrl ?? DEFAULT_BASE_URL;
-  const url = `${baseUrl}/accounts/${config.accountId}/workers/observability/telemetry/query`;
-  const body = {
-    // Cloudflare's schema requires an identifier per query even for an
-    // ad-hoc, unsaved one — a fresh id per tick, never reused.
-    queryId: `neat-connector-${randomUUID()}`,
-    timeframe: { from: window.fromMs, to: window.toMs },
-    view: "events",
-    limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
-    // The inline query definition. WITHOUT `parameters`, the API treats
-    // `queryId` as a reference to a previously *saved* query and answers 400
-    // "Query not found" (confirmed against the live endpoint) — omitting it was
-    // the reason the connector never worked against real Cloudflare. Naming the
-    // `cloudflare-workers` dataset runs the invocation-telemetry query ad-hoc.
-    parameters: { datasets: ["cloudflare-workers"] },
-    // Execute without persisting — this is a read, not a saved query
-    // (connectors.md §2's "never writes on the read path" applies to
-    // Cloudflare's own query-history state too).
-    dry: true
-  };
-  const res = await junctionFetch(
-    url,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...bearerAuthHeader(token)
-      },
-      body: JSON.stringify(body)
-    },
-    // accountKey: the Cloudflare account id (ADR-131's own worked example) —
-    // the Telemetry Query API's ~300/5min limit is enforced per account.
-    { provider: "cloudflare", accountKey: config.accountId, fetchImpl }
-  );
-  if (!res.ok) {
-    throw new Error(
-      `cloudflare connector: telemetry query failed (${res.status} ${res.statusText})`
-    );
-  }
-  const payload = await res.json();
-  if (!payload.success) {
-    const message = payload.errors?.map((e) => e.message).join("; ") || "unknown error";
-    throw new Error(`cloudflare connector: telemetry query returned an error (${message})`);
-  }
-  const events = payload.result?.events?.events;
-  if (!Array.isArray(events)) {
-    console.warn(
-      "[neat connector] cloudflare: telemetry query returned success:true but no result.events.events array \u2014 the response shape may have changed; treating as zero events this tick"
-    );
-    return [];
-  }
-  return events;
-}
-
-// src/connectors/cloudflare/types.ts
-var CLOUDFLARE_TARGET_KIND = "cloudflare-worker-invocation";
-
-// src/connectors/cloudflare/map.ts
-var HTTP_METHODS = /* @__PURE__ */ new Set([
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE",
-  "HEAD",
-  "OPTIONS",
-  "TRACE",
-  "CONNECT"
-]);
-var LEADING_TOKEN_RE = /^(\S+)\s+\S/;
-function parseHttpMethodFromTrigger(trigger) {
-  if (typeof trigger !== "string") return null;
-  const match = LEADING_TOKEN_RE.exec(trigger.trim());
-  const token = match?.[1];
-  if (!token) return null;
-  const method = token.toUpperCase();
-  return HTTP_METHODS.has(method) ? method : null;
-}
-function parsePathFromTrigger(trigger) {
-  const trimmed = trigger.trim();
-  const spaceIdx = trimmed.indexOf(" ");
-  if (spaceIdx === -1) return void 0;
-  const rest = trimmed.slice(spaceIdx + 1).trim();
-  return rest.length > 0 ? rest : void 0;
-}
-var ERROR_STATUS_THRESHOLD3 = 500;
-function mapEventToSignal(event) {
-  if (!event || typeof event !== "object") return null;
-  const metadata = event.$metadata;
-  const workers = event.$workers;
-  const method = parseHttpMethodFromTrigger(metadata?.trigger);
-  if (!method) return null;
-  const scriptName = workers?.scriptName ?? metadata?.service;
-  if (typeof scriptName !== "string" || scriptName.length === 0) return null;
-  const timestampMs = event.timestamp ?? metadata?.startTime;
-  if (typeof timestampMs !== "number" || !Number.isFinite(timestampMs)) return null;
-  const observedAt = new Date(timestampMs);
-  if (Number.isNaN(observedAt.getTime())) return null;
-  const statusCode = metadata?.statusCode;
-  const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path3 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
-  return {
-    targetKind: CLOUDFLARE_TARGET_KIND,
-    targetName: scriptName,
-    callCount: 1,
-    errorCount: isError ? 1 : 0,
-    lastObservedIso: observedAt.toISOString(),
-    method,
-    ...path3 ? { path: path3 } : {},
-    ...typeof statusCode === "number" ? { statusCode } : {},
-    ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
-  };
-}
-
-// src/connectors/cloudflare/connector.ts
-var DEFAULT_MAX_LOOKBACK_MS3 = 60 * 60 * 1e3;
-function resolveFromMs(since, maxLookbackMs) {
-  const cap = maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS3;
-  const now = Date.now();
-  const floor = now - cap;
-  if (!since) return floor;
-  const parsed = Date.parse(since);
-  if (Number.isNaN(parsed)) return floor;
-  return Math.max(parsed, floor);
-}
-var CloudflareConnector = class {
-  constructor(config) {
-    this.config = config;
-  }
-  config;
-  provider = "cloudflare";
-  async poll(ctx) {
-    const toMs = Date.now();
-    const fromMs = resolveFromMs(ctx.since, this.config.maxLookbackMs);
-    const events = await queryWorkerInvocations(ctx, this.config, { fromMs, toMs });
-    const signals = [];
-    for (const event of events) {
-      const signal = mapEventToSignal(event);
-      if (signal) signals.push(signal);
-    }
-    return signals;
-  }
-};
-function findTaggedWorkerFileNode(graph, workerName) {
-  let found = null;
-  graph.forEachNode((id, attrs) => {
-    if (found) return;
-    const a = attrs;
-    if (a.type === NodeType4.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
-      found = id;
-    }
-  });
-  return found;
-}
-function findMatchingRouteNode(graph, serviceName, method, path3) {
-  const normalizedPath = normalizePathTemplate(path3);
-  let found = null;
-  graph.forEachNode((id, attrs) => {
-    if (found) return;
-    const a = attrs;
-    if (a.type !== NodeType4.RouteNode || a.service !== serviceName) return;
-    if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
-    const routeMethod = (a.method ?? "").toUpperCase();
-    if (routeMethod !== "ALL" && routeMethod !== method) return;
-    found = id;
-  });
-  return found;
-}
-function createCloudflareResolveTarget(config, graph) {
-  return (signal) => {
-    if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
-    const scriptName = signal.targetName;
-    const { method, path: path3 } = signal;
-    const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path3) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path3) ?? wholeFileId;
-    };
-    const mapping = config.workers?.[scriptName];
-    if (mapping) {
-      const wholeFileId = fileId(mapping.service, mapping.entryFile);
-      return {
-        targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
-        serviceName: mapping.service,
-        edgeType: EdgeType4.CALLS
-      };
-    }
-    const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
-    if (taggedFileId) {
-      const fileNode = graph.getNodeAttributes(taggedFileId);
-      return {
-        targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
-        serviceName: fileNode.service,
-        edgeType: EdgeType4.CALLS
-      };
-    }
-    return {
-      targetNodeId: infraId2("cloudflare-worker", scriptName),
-      serviceName: scriptName,
-      edgeType: EdgeType4.CALLS,
-      ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
-    };
-  };
-}
-
-// src/connectors/vercel/client.ts
-var DEFAULT_API_BASE_URL = "https://api.vercel.com";
-var DEFAULT_DRAIN_NAME = "neat-otlp";
-var TRACE_SCHEMAS = { trace: { version: "v1" } };
-function apiBase(config) {
-  return config.apiBaseUrl ?? DEFAULT_API_BASE_URL;
-}
-function teamQuery(config) {
-  return `?teamId=${encodeURIComponent(config.teamId)}`;
-}
-function drainDelivery(config, otelToken) {
-  return {
-    type: "http",
-    endpoint: config.endpoint,
-    encoding: "json",
-    headers: bearerAuthHeader(otelToken),
-    ...config.secret ? { secret: config.secret } : {}
-  };
-}
-async function describeError(res) {
-  try {
-    const data = await res.json();
-    const message = data?.error?.message;
-    return typeof message === "string" && message.length > 0 ? ` \u2014 ${message}` : "";
-  } catch {
-    return "";
-  }
-}
-async function createVercelDrain(config, credentials, fetchImpl = fetch) {
-  const projectIds = config.projectIds ?? [];
-  const body = {
-    name: config.drainName ?? DEFAULT_DRAIN_NAME,
-    projects: projectIds.length > 0 ? "some" : "all",
-    ...projectIds.length > 0 ? { projectIds } : {},
-    schemas: TRACE_SCHEMAS,
-    delivery: drainDelivery(config, credentials.otelToken),
-    source: { kind: "self-served" }
-  };
-  const res = await junctionFetch(
-    `${apiBase(config)}/v1/drains${teamQuery(config)}`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json", ...bearerAuthHeader(credentials.token) },
-      body: JSON.stringify(body)
-    },
-    { provider: "vercel", accountKey: config.teamId, fetchImpl }
-  );
-  if (!res.ok) {
-    throw new Error(
-      `vercel connector: create drain failed (${res.status} ${res.statusText}${await describeError(res)})`
-    );
-  }
-  const payload = await res.json().catch(() => null);
-  if (!payload || typeof payload.id !== "string" || payload.id.length === 0) {
-    throw new Error(
-      "vercel connector: create drain returned no drain id \u2014 the Drains API response shape may have changed"
-    );
-  }
-  return {
-    id: payload.id,
-    ...payload.status ? { status: payload.status } : {},
-    ...payload.disabledReason ? { disabledReason: payload.disabledReason } : {}
-  };
-}
-async function deleteVercelDrain(config, drainId, credentials, fetchImpl = fetch) {
-  const res = await junctionFetch(
-    `${apiBase(config)}/v1/drains/${encodeURIComponent(drainId)}${teamQuery(config)}`,
-    { method: "DELETE", headers: { ...bearerAuthHeader(credentials.token) } },
-    { provider: "vercel", accountKey: config.teamId, fetchImpl }
-  );
-  if (res.ok || res.status === 404) return;
-  throw new Error(
-    `vercel connector: delete drain failed (${res.status} ${res.statusText}${await describeError(res)})`
-  );
-}
-async function testVercelDrainDelivery(config, credentials, fetchImpl = fetch) {
-  const res = await junctionFetch(
-    `${apiBase(config)}/v1/drains/test${teamQuery(config)}`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json", ...bearerAuthHeader(credentials.token) },
-      body: JSON.stringify({ schemas: TRACE_SCHEMAS, delivery: drainDelivery(config, credentials.otelToken) })
-    },
-    { provider: "vercel", accountKey: config.teamId, fetchImpl }
-  );
-  if (res.status === 401 || res.status === 403) {
-    return { status: "failure", error: `vercel rejected the API token (HTTP ${res.status})` };
-  }
-  if (!res.ok) {
-    return {
-      status: "failure",
-      error: `vercel drain validation failed (${res.status} ${res.statusText}${await describeError(res)})`
-    };
-  }
-  const payload = await res.json().catch(() => null);
-  return {
-    ...payload?.status ? { status: payload.status } : {},
-    ...payload?.error ? { error: payload.error } : {},
-    ...payload?.endpoint ? { endpoint: payload.endpoint } : {}
-  };
-}
-
-// src/connectors/registry.ts
-var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
-async function authProbe(input) {
-  const { provider, accountKey, url, token, init, fetchImpl } = input;
-  try {
-    const res = await junctionFetch(
-      url,
-      {
-        ...init ?? {},
-        headers: { ...bearerAuthHeader(token), ...init?.headers ?? {} }
-      },
-      { provider, accountKey, ...fetchImpl ? { fetchImpl } : {} }
-    );
-    if (res.ok) return { ok: true };
-    if (res.status === 401 || res.status === 403) {
-      return { ok: false, reason: `${provider} rejected the credential (HTTP ${res.status})` };
-    }
-    return {
-      ok: false,
-      reason: `${provider} auth check returned HTTP ${res.status} ${res.statusText} \u2014 could not confirm the credential`
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: `${provider} auth check could not reach the provider: ${err.message}`
-    };
-  }
-}
-var PROVIDER_DISPATCH = {
-  supabase: {
-    provider: "supabase",
-    primaryCredentialKey: "managementToken",
-    requiredCredentialFields: ["managementToken"],
-    requiredOptionFields: ["apiProjectRef", "nodeRef", "serviceName"],
-    build(graph, options) {
-      return createSupabaseConnector(graph, options);
-    },
-    // GET /v1/projects — the Management API's own auth-gated list endpoint, the
-    // cheapest confirmation the management token is live (the same surface
-    // client.ts polls, minus the heavy log query).
-    validate({ credentials, options, fetchImpl }) {
-      const cfg = options;
-      const baseUrl = cfg.managementApiUrl ?? DEFAULT_SUPABASE_MANAGEMENT_API_URL;
-      return authProbe({
-        provider: "supabase",
-        accountKey: cfg.apiProjectRef ?? "validate",
-        url: `${baseUrl}/v1/projects`,
-        token: String(credentials.managementToken ?? ""),
-        ...fetchImpl ? { fetchImpl } : {}
-      });
-    }
-  },
-  railway: {
-    provider: "railway",
-    primaryCredentialKey: "token",
-    requiredCredentialFields: ["token"],
-    requiredOptionFields: ["environmentId", "serviceId", "serviceNameById"],
-    build(graph, options) {
-      const config = options;
-      return {
-        connector: createRailwayConnector(graph, config),
-        resolveTarget: createRailwayResolveTarget(config)
-      };
-    },
-    // Runs the same `deployments` lookup the poller itself needs
-    // (railway/client.ts's resolveLatestRailwayDeploymentId) rather than a
-    // trivial `{ __typename }` probe. That trivial form is a false positive
-    // for this provider: `Authorization: Bearer <token>` authenticates at
-    // Railway's HTTP gateway (any well-formed token gets a 2xx on a query
-    // that touches no real data) but is not authorized for the connector's
-    // actual queries, which come back as an HTTP-200 response carrying a
-    // GraphQL-level "Not Authorized" error — invisible to authProbe's
-    // status-code-only check. Probing with the real lookup, through the same
-    // Project-Access-Token header client.ts sends, catches both failure
-    // modes: an HTTP-level rejection (thrown as a fetch/status error) and a
-    // GraphQL-level one (thrown by railwayGraphQL's own body.errors check).
-    async validate({ credentials, options, fetchImpl }) {
-      const cfg = options;
-      if (!cfg.environmentId || !cfg.serviceId) {
-        return { ok: false, reason: "railway: environmentId and serviceId are required to validate" };
-      }
-      const config = {
-        environmentId: cfg.environmentId,
-        serviceId: cfg.serviceId,
-        serviceNameById: cfg.serviceNameById ?? {},
-        ...cfg.apiUrl ? { apiUrl: cfg.apiUrl } : {}
-      };
-      try {
-        await resolveLatestRailwayDeploymentId(config, String(credentials.token ?? ""), fetchImpl);
-        return { ok: true };
-      } catch (err) {
-        return { ok: false, reason: `railway auth check failed: ${err.message}` };
-      }
-    }
-  },
-  firebase: {
-    provider: "firebase",
-    // Firebase reads both projectId and accessToken from the credential; the
-    // single-string form maps to the secret, and the required-fields check
-    // below catches a projectId that was never supplied.
-    primaryCredentialKey: "accessToken",
-    requiredCredentialFields: ["projectId", "accessToken"],
-    requiredOptionFields: [],
-    build(graph, options) {
-      return createFirebaseConnector(graph, options);
-    },
-    // GET the project's Cloud Logging log-name list (pageSize 1) — within the
-    // same `roles/logging.viewer` grant the connector polls under, and the
-    // lightest call that still fails 401/403 on a bad or wrong-scoped token.
-    validate({ credentials, fetchImpl }) {
-      const projectId = String(credentials.projectId ?? "");
-      return authProbe({
-        provider: "firebase",
-        accountKey: projectId || "validate",
-        url: `https://logging.googleapis.com/v2/projects/${projectId}/logs?pageSize=1`,
-        token: String(credentials.accessToken ?? ""),
-        ...fetchImpl ? { fetchImpl } : {}
-      });
-    }
-  },
-  cloudflare: {
-    provider: "cloudflare",
-    primaryCredentialKey: "apiToken",
-    requiredCredentialFields: ["apiToken"],
-    // `workers` dropped as a required field (ADR-133) — the mapping is now
-    // derived from the extracted graph's platform tag; an `options.workers`
-    // entry still works as an explicit override
-    // (CloudflareConnectorConfig.workers).
-    requiredOptionFields: ["accountId"],
-    build(graph, options) {
-      const config = options;
-      return {
-        connector: new CloudflareConnector(config),
-        resolveTarget: createCloudflareResolveTarget(config, graph)
-      };
-    },
-    // GET /accounts/{accountId}/tokens/verify — the *account-scoped* token-verify
-    // endpoint. A Workers connector token is scoped to the account, and the
-    // user-level `GET /user/tokens/verify` returns 401 "Invalid API Token" for
-    // such a token even though it authenticates fine against the account's own
-    // resources (confirmed live). Probing the account-scoped verify endpoint —
-    // `accountId` is already required for this provider — returns 200
-    // `{status:"active"}` for a working token and 401 for a bad one, so a valid
-    // Workers token is no longer falsely rejected at `neat connector add`.
-    validate({ credentials, options, fetchImpl }) {
-      const cfg = options;
-      const baseUrl = cfg.baseUrl ?? CLOUDFLARE_API_BASE_URL;
-      return authProbe({
-        provider: "cloudflare",
-        accountKey: cfg.accountId ?? "validate",
-        url: `${baseUrl}/accounts/${cfg.accountId ?? ""}/tokens/verify`,
-        token: String(credentials.apiToken ?? ""),
-        ...fetchImpl ? { fetchImpl } : {}
-      });
-    }
-  }
-};
-function vercelCredsFrom(credentials) {
-  return { token: String(credentials.token ?? ""), otelToken: String(credentials.otelToken ?? "") };
-}
-function vercelConfigFromOptions(options) {
-  const raw = options.projectIds;
-  let projectIds;
-  if (Array.isArray(raw)) projectIds = raw.filter((p) => typeof p === "string");
-  else if (typeof raw === "string" && raw.trim().length > 0) {
-    projectIds = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-  }
-  return {
-    teamId: String(options.teamId ?? ""),
-    endpoint: String(options.endpoint ?? ""),
-    ...projectIds && projectIds.length > 0 ? { projectIds } : {},
-    ...typeof options.drainId === "string" ? { drainId: options.drainId } : {},
-    ...typeof options.drainName === "string" ? { drainName: options.drainName } : {},
-    ...typeof options.apiBaseUrl === "string" ? { apiBaseUrl: options.apiBaseUrl } : {},
-    ...typeof options.secret === "string" ? { secret: options.secret } : {}
-  };
-}
-var PUSH_PROVIDER_DISPATCH = {
-  vercel: {
-    provider: "vercel",
-    // The Vercel access token is the "primary" secret a single `--token`
-    // populates; `otelToken` (the daemon's OTLP bearer) is the second field.
-    primaryCredentialKey: "token",
-    requiredCredentialFields: ["token", "otelToken"],
-    // teamId scopes every Drains call; endpoint is where the drain delivers.
-    // projectIds is optional (absent → the drain covers the whole team).
-    requiredOptionFields: ["teamId", "endpoint"],
-    // POST /v1/drains/test — authenticates the token and pings the endpoint
-    // with a sample event, so `success` means the credential is live *and* the
-    // daemon's OTLP endpoint is reachable and accepted the drain's bearer.
-    async validate({ credentials, options, fetchImpl }) {
-      const result = await testVercelDrainDelivery(
-        vercelConfigFromOptions(options),
-        vercelCredsFrom(credentials),
-        fetchImpl
-      );
-      if (result.status === "success") return { ok: true };
-      return {
-        ok: false,
-        reason: result.error ?? `vercel drain delivery test returned "${result.status ?? "no status"}"`
-      };
-    },
-    // POST /v1/drains — creates the trace drain, returns its id to store in
-    // `options.drainId`. A created-but-not-enabled drain is surfaced as a note,
-    // not a failure (the entry still points at a real drain).
-    async provision({ credentials, options, fetchImpl }) {
-      try {
-        const created = await createVercelDrain(
-          vercelConfigFromOptions(options),
-          vercelCredsFrom(credentials),
-          fetchImpl
-        );
-        const note = created.status && created.status !== "enabled" ? `the drain was created but its status is "${created.status}"${created.disabledReason ? ` (${created.disabledReason})` : ""} \u2014 check the Vercel dashboard` : void 0;
-        return { ok: true, options: { drainId: created.id }, ...note ? { note } : {} };
-      } catch (err) {
-        return { ok: false, reason: err.message };
-      }
-    },
-    // DELETE /v1/drains/{id} — idempotent (deleteVercelDrain treats 404 as
-    // success). No recorded drainId → nothing to delete, still a success.
-    async deprovision({ credentials, options, fetchImpl }) {
-      const drainId = typeof options.drainId === "string" ? options.drainId : "";
-      if (!drainId) {
-        return { ok: true, note: "no drain id was recorded \u2014 nothing to delete on the Vercel side" };
-      }
-      try {
-        await deleteVercelDrain(
-          vercelConfigFromOptions(options),
-          drainId,
-          vercelCredsFrom(credentials),
-          fetchImpl
-        );
-        return { ok: true };
-      } catch (err) {
-        return { ok: false, reason: err.message };
-      }
-    }
-  }
-};
-function isPushProvider(provider) {
-  return provider in PUSH_PROVIDER_DISPATCH;
-}
-function getProviderFieldSchema(provider) {
-  return PROVIDER_DISPATCH[provider] ?? PUSH_PROVIDER_DISPATCH[provider];
-}
-function knownProviderNames() {
-  return [...Object.keys(PROVIDER_DISPATCH), ...Object.keys(PUSH_PROVIDER_DISPATCH)].sort();
-}
-function resolveEntryCredentials(dispatch, entry, env) {
-  let credentials;
-  try {
-    const resolved = resolveCredential(entry.credential, env);
-    credentials = resolved.kind === "single" ? { [dispatch.primaryCredentialKey]: resolved.value } : { ...resolved.fields };
-  } catch (err) {
-    if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
-    return { ok: false, kind: "error", reason: err.message };
-  }
-  const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
-  if (missingCreds.length > 0) {
-    return {
-      ok: false,
-      kind: "missing-field",
-      reason: `credential missing required field(s): ${missingCreds.join(", ")}`
-    };
-  }
-  return { ok: true, credentials };
-}
-function buildRegistration(entry, graph, env = process.env) {
-  const dispatch = PROVIDER_DISPATCH[entry.provider];
-  if (!dispatch) {
-    if (isPushProvider(entry.provider)) {
-      return {
-        ok: false,
-        push: true,
-        reason: `push provider "${entry.provider}" ingests via the OTLP receiver \u2014 nothing to poll`
-      };
-    }
-    return { ok: false, reason: `unknown provider "${entry.provider}"` };
-  }
-  const creds = resolveEntryCredentials(dispatch, entry, env);
-  if (!creds.ok) return { ok: false, reason: creds.reason };
-  const credentials = creds.credentials;
-  const options = entry.options ?? {};
-  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
-  if (missingOpts.length > 0) {
-    return {
-      ok: false,
-      reason: `options missing required field(s): ${missingOpts.join(", ")}`
-    };
-  }
-  let built;
-  try {
-    built = dispatch.build(graph, options);
-  } catch (err) {
-    return { ok: false, reason: err.message };
-  }
-  const intervalMs = typeof options.intervalMs === "number" ? options.intervalMs : void 0;
-  return {
-    ok: true,
-    registration: {
-      // Carry the entry id so the daemon can key this connector's poll-status
-      // records to it (ADR-136).
-      id: entry.id,
-      connector: built.connector,
-      credentials,
-      resolveTarget: built.resolveTarget,
-      ...intervalMs !== void 0 ? { intervalMs } : {}
-    }
-  };
-}
-async function validateConnectorEntry(entry, env = process.env, fetchImpl) {
-  const dispatch = PROVIDER_DISPATCH[entry.provider] ?? PUSH_PROVIDER_DISPATCH[entry.provider];
-  if (!dispatch) {
-    return { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` };
-  }
-  const creds = resolveEntryCredentials(dispatch, entry, env);
-  if (!creds.ok) {
-    if (creds.kind === "unset-env") return { status: "unset-env", reason: creds.reason };
-    return { status: "missing-field", reason: creds.reason };
-  }
-  const options = entry.options ?? {};
-  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
-  if (missingOpts.length > 0) {
-    return {
-      status: "missing-field",
-      reason: `options missing required field(s): ${missingOpts.join(", ")}`
-    };
-  }
-  const result = await dispatch.validate({
-    credentials: creds.credentials,
-    options,
-    ...fetchImpl ? { fetchImpl } : {}
-  });
-  return result.ok ? { status: "ok" } : { status: "rejected", reason: result.reason };
-}
-async function loadConnectorRegistrations(input) {
-  const { project, graph, home, env = process.env, onSkip } = input;
-  let connectors;
-  try {
-    connectors = (await readConnectorsConfig(home)).connectors;
-  } catch (err) {
-    onSkip?.(
-      { id: "(file)", provider: "(all)", credential: "" },
-      `connectors.json unreadable \u2014 ${err.message}`
-    );
-    return [];
-  }
-  const registrations = [];
-  for (const entry of connectors) {
-    if (!connectorMatchesProject(entry, project)) continue;
-    const result = buildRegistration(entry, graph, env);
-    if (result.ok) registrations.push(result.registration);
-    else if (!result.push) onSkip?.(entry, result.reason);
-  }
-  return registrations;
-}
-async function startConnectorPolling(input) {
-  const fileConnectors = input.home ? await loadConnectorRegistrations({
-    project: input.project,
-    graph: input.graph,
-    home: input.home,
-    ...input.onSkip ? { onSkip: input.onSkip } : {}
-  }) : [];
-  const all = [...input.extra ?? [], ...fileConnectors];
-  const stopFns = all.map(
-    (registration) => startConnectorPollLoop(
-      registration.connector,
-      { projectDir: input.projectDir, credentials: registration.credentials },
-      input.graph,
-      registration.resolveTarget,
-      { intervalMs: registration.intervalMs, connectorId: registration.id }
-    )
-  );
-  return () => {
-    for (const stop of stopFns) stop();
-  };
-}
-function resolvePushEntry(entry, env) {
-  const dispatch = PUSH_PROVIDER_DISPATCH[entry.provider];
-  if (!dispatch) {
-    return PROVIDER_DISPATCH[entry.provider] ? {
-      ok: false,
-      outcome: {
-        status: "not-push",
-        reason: `provider "${entry.provider}" is polled, not provisioned \u2014 there is no drain to manage`
-      }
-    } : { ok: false, outcome: { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` } };
-  }
-  const creds = resolveEntryCredentials(dispatch, entry, env);
-  if (!creds.ok) {
-    const status = creds.kind === "unset-env" ? "unset-env" : creds.kind === "missing-field" ? "missing-field" : "failed";
-    return { ok: false, outcome: { status, reason: creds.reason } };
-  }
-  const options = entry.options ?? {};
-  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
-  if (missingOpts.length > 0) {
-    return {
-      ok: false,
-      outcome: { status: "missing-field", reason: `options missing required field(s): ${missingOpts.join(", ")}` }
-    };
-  }
-  return { ok: true, dispatch, credentials: creds.credentials, options };
-}
-async function provisionConnector(entry, env = process.env, fetchImpl) {
-  const resolved = resolvePushEntry(entry, env);
-  if (!resolved.ok) return resolved.outcome;
-  const result = await resolved.dispatch.provision({
-    credentials: resolved.credentials,
-    options: resolved.options,
-    ...fetchImpl ? { fetchImpl } : {}
-  });
-  if (!result.ok) return { status: "failed", reason: result.reason };
-  return { status: "ok", ...result.options ? { options: result.options } : {}, ...result.note ? { note: result.note } : {} };
-}
-async function deprovisionConnector(entry, env = process.env, fetchImpl) {
-  const resolved = resolvePushEntry(entry, env);
-  if (!resolved.ok) return resolved.outcome;
-  const result = await resolved.dispatch.deprovision({
-    credentials: resolved.credentials,
-    options: resolved.options,
-    ...fetchImpl ? { fetchImpl } : {}
-  });
-  if (!result.ok) return { status: "failed", reason: result.reason };
-  return { status: "ok", ...result.note ? { note: result.note } : {} };
-}
-
-// src/unrouted.ts
-import { promises as fs } from "fs";
-import path from "path";
-function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
-  return {
-    timestamp: now.toISOString(),
-    reason: "no-project-match",
-    service_name: serviceName ?? null,
-    traceId: traceId ?? null
-  };
-}
-async function appendUnroutedSpan(neatHome, record) {
-  const target = path.join(neatHome, "errors.ndjson");
-  await fs.mkdir(neatHome, { recursive: true });
-  await fs.appendFile(target, JSON.stringify(record) + "\n", "utf8");
-}
-function unroutedErrorsPath(neatHome) {
-  return path.join(neatHome, "errors.ndjson");
-}
-
-// src/daemon.ts
-import { NodeType as NodeType5 } from "@neat.is/types";
-function daemonJsonPath(scanPath) {
-  return path2.join(scanPath, "neat-out", "daemon.json");
-}
-function daemonsDiscoveryDir(home) {
-  const base = home && home.length > 0 ? home : neatHomeFromEnv();
-  return path2.join(base, "daemons");
-}
-function daemonDiscoveryPath(project, home) {
-  return path2.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
-}
-function sanitizeDiscoveryName(project) {
-  return project.replace(/[^A-Za-z0-9._-]/g, "_");
-}
-function neatHomeFromEnv() {
-  const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return path2.resolve(env);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path2.join(home, ".neat");
-}
-async function readDaemonRecord(scanPath) {
-  try {
-    const raw = await fs2.readFile(daemonJsonPath(scanPath), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.project === "string" && parsed.ports && typeof parsed.ports.rest === "number" && typeof parsed.ports.otlp === "number" && typeof parsed.ports.web === "number") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function resolveNeatVersion() {
-  if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
-    return process.env.NEAT_LOCAL_VERSION;
-  }
-  try {
-    const req = createRequire(import.meta.url);
-    const pkg = req("../package.json");
-    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
-async function writeDaemonRecord(record, home) {
-  const body = JSON.stringify(record, null, 2) + "\n";
-  await writeAtomically(daemonJsonPath(record.projectPath), body);
-  try {
-    await writeAtomically(daemonDiscoveryPath(record.project, home), body);
-  } catch (err) {
-    console.warn(
-      `neatd: could not write discovery copy for "${record.project}" \u2014 ${err.message}`
-    );
-  }
-}
-async function clearDaemonRecord(record, home) {
-  try {
-    const stopped = { ...record, status: "stopped" };
-    await writeAtomically(daemonJsonPath(record.projectPath), JSON.stringify(stopped, null, 2) + "\n");
-  } catch {
-  }
-  try {
-    await fs2.unlink(daemonDiscoveryPath(record.project, home));
-  } catch {
-  }
-}
-function reconcileDaemonRecordSync(record, home) {
-  try {
-    const stopped = { ...record, status: "stopped" };
-    const target = daemonJsonPath(record.projectPath);
-    const tmp = `${target}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(stopped, null, 2) + "\n");
-    renameSync(tmp, target);
-  } catch {
-  }
-  try {
-    unlinkSync(daemonDiscoveryPath(record.project, home));
-  } catch {
-  }
-}
-function teardownSlot(slot) {
-  try {
-    slot.stopPersist();
-  } catch {
-  }
-  try {
-    slot.stopStaleness();
-  } catch {
-  }
-  try {
-    slot.stopConnectors();
-  } catch {
-  }
-  try {
-    slot.detachEvents();
-  } catch {
-  }
-}
-function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return path2.resolve(opts.neatHome);
-  const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return path2.resolve(env);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path2.join(home, ".neat");
-}
-function routeSpanToProject(serviceName, projects) {
-  if (!serviceName) return DEFAULT_PROJECT;
-  for (const entry of projects) {
-    if (entry.status === "paused") continue;
-    if (entry.name.toLowerCase() === serviceName.toLowerCase()) return entry.name;
-  }
-  const candidates = [];
-  for (const entry of projects) {
-    if (entry.status === "paused") continue;
-    if (isTokenPrefix(entry.name, serviceName)) candidates.push(entry);
-  }
-  if (candidates.length > 0) {
-    candidates.sort((a, b) => b.name.length - a.name.length);
-    return candidates[0].name;
-  }
-  for (const entry of projects) {
-    if (entry.status === "paused") continue;
-    if (isTokenContained(entry.name, serviceName)) return entry.name;
-  }
-  return DEFAULT_PROJECT;
-}
-function isTokenPrefix(prefix, full) {
-  const p = prefix.toLowerCase();
-  const f = full.toLowerCase();
-  if (p.length >= f.length) return false;
-  if (!f.startsWith(p)) return false;
-  const sep = f.charAt(p.length);
-  return sep === "-" || sep === "_";
-}
-function isTokenContained(needle, haystack) {
-  const n = needle.toLowerCase();
-  const h = haystack.toLowerCase();
-  if (!h.includes(n)) return false;
-  const tokens = h.split(/[-_]/);
-  return tokens.includes(n);
-}
-function serviceNameMatchesProject(serviceName, project) {
-  if (serviceName.toLowerCase() === project.toLowerCase()) return true;
-  if (isTokenPrefix(project, serviceName)) return true;
-  if (isTokenContained(project, serviceName)) return true;
-  return false;
-}
-function spanBelongsToSingleProject(graph, project, serviceName) {
-  if (!serviceName) return true;
-  if (serviceNameMatchesProject(serviceName, project)) return true;
-  return graph.someNode(
-    (_id, attrs) => attrs.type === NodeType5.ServiceNode && attrs.name === serviceName
-  );
-}
-async function bootstrapProject(entry, connectors = [], neatHome) {
-  const paths = pathsForProject(entry.name, path2.join(entry.path, "neat-out"));
-  try {
-    const stat = await fs2.stat(entry.path);
-    if (!stat.isDirectory()) {
-      throw new Error(`registered path ${entry.path} is not a directory`);
-    }
-  } catch (err) {
-    await setStatus(entry.name, "broken").catch(() => {
-    });
-    return {
-      entry,
-      // Empty graph is fine — `slots` keeps the entry visible in `status`
-      // output; nothing routes to it because it's not 'active'.
-      graph: getGraph(`__broken__:${entry.name}`),
-      outPath: "",
-      paths,
-      stopPersist: () => {
-      },
-      stopStaleness: () => {
-      },
-      stopConnectors: () => {
-      },
-      detachEvents: () => {
-      },
-      status: "broken",
-      errorReason: err.message
-    };
-  }
-  resetGraph(entry.name);
-  const graph = getGraph(entry.name);
-  const outPath = paths.snapshotPath;
-  await loadGraphFromDisk(graph, outPath);
-  const detachEvents = attachGraphToEventBus(graph, { project: entry.name });
-  try {
-    await extractFromDirectory(graph, entry.path);
-    const stopPersist = startPersistLoop(graph, outPath, { exitOnSignal: false });
-    const stopStaleness = startStalenessLoop(graph, {
-      staleEventsPath: paths.staleEventsPath,
-      project: entry.name
-    });
-    const stopConnectors = await startConnectorPolling({
-      project: entry.name,
-      graph,
-      projectDir: entry.path,
-      ...neatHome ? { home: neatHome } : {},
-      extra: connectors,
-      onSkip: (skipped, reason) => console.warn(
-        `neatd: connector "${skipped.id}" (${skipped.provider}) skipped for project "${entry.name}" \u2014 ${reason}`
-      )
-    });
-    await touchLastSeen(entry.name).catch(() => {
-    });
-    return {
-      entry,
-      graph,
-      outPath,
-      paths,
-      stopPersist,
-      stopStaleness,
-      stopConnectors,
-      detachEvents,
-      status: "active"
-    };
-  } catch (err) {
-    detachEvents();
-    throw err;
-  }
-}
-function resolveRestPort(opts) {
-  if (typeof opts.restPort === "number") return opts.restPort;
-  const env = process.env.PORT;
-  if (env && env.length > 0) {
-    const n = Number.parseInt(env, 10);
-    if (Number.isFinite(n)) return n;
-  }
-  return 8080;
-}
-function resolveOtlpPort(opts) {
-  if (typeof opts.otlpPort === "number") return opts.otlpPort;
-  const env = process.env.OTEL_PORT;
-  if (env && env.length > 0) {
-    const n = Number.parseInt(env, 10);
-    if (Number.isFinite(n)) return n;
-  }
-  return 4318;
-}
-function resolveWebPort() {
-  const env = process.env.NEAT_WEB_PORT;
-  if (env && env.length > 0) {
-    const n = Number.parseInt(env, 10);
-    if (Number.isFinite(n)) return n;
-  }
-  return 6328;
-}
-function portFromListenAddress(address, fallback) {
-  try {
-    const port = new URL(address).port;
-    const n = Number.parseInt(port, 10);
-    if (Number.isFinite(n) && n > 0) return n;
-  } catch {
-  }
-  return fallback;
-}
-function resolveHost(opts, authTokenSet) {
-  if (opts.host && opts.host.length > 0) return opts.host;
-  const env = process.env.HOST;
-  if (env && env.length > 0) return env;
-  if (!authTokenSet) return "127.0.0.1";
-  return "0.0.0.0";
-}
-async function startDaemon(opts = {}) {
-  const home = neatHomeFor(opts);
-  const regPath = registryPath();
-  const projectArg = typeof opts.project === "string" && opts.project.length > 0 ? opts.project : process.env.NEAT_PROJECT && process.env.NEAT_PROJECT.length > 0 ? process.env.NEAT_PROJECT : null;
-  const projectPathArg = opts.projectPath && opts.projectPath.length > 0 ? opts.projectPath : process.env.NEAT_PROJECT_PATH && process.env.NEAT_PROJECT_PATH.length > 0 ? process.env.NEAT_PROJECT_PATH : null;
-  const singleProject = projectArg;
-  const singleProjectPath = singleProject && projectPathArg ? path2.resolve(projectPathArg) : null;
-  if (singleProject && !singleProjectPath) {
-    throw new Error(
-      `neatd: project "${singleProject}" given without a projectPath; pass NEAT_PROJECT_PATH alongside NEAT_PROJECT.`
-    );
-  }
-  if (!singleProject) {
-    try {
-      await fs2.access(regPath);
-    } catch {
-      throw new Error(
-        `neatd: registry not found at ${regPath}. Run \`neat init <path>\` to register a project before starting the daemon.`
-      );
-    }
-  }
-  const pidPath = path2.join(home, "neatd.pid");
-  await writeAtomically(pidPath, `${process.pid}
-`);
-  const slots = /* @__PURE__ */ new Map();
-  const registry = new Projects();
-  const bootstrapStatus = /* @__PURE__ */ new Map();
-  const bootstrapStartedAt = /* @__PURE__ */ new Map();
-  const DROP_WARN_INTERVAL_MS = 6e4;
-  const lastDropWarnAt = /* @__PURE__ */ new Map();
-  function warnDroppedSpan(project, reason) {
-    const now = Date.now();
-    const prev = lastDropWarnAt.get(project) ?? 0;
-    if (now - prev < DROP_WARN_INTERVAL_MS) return;
-    lastDropWarnAt.set(project, now);
-    console.warn(
-      `[neatd] dropping span for project "${project}" \u2014 project status: broken (${reason}). Run \`neatd reload\` to retry bootstrap.`
-    );
-  }
-  const unroutedPath = unroutedErrorsPath(home);
-  const lastUnroutedWarnAt = /* @__PURE__ */ new Map();
-  async function recordUnroutedSpan(serviceName, traceId) {
-    const key = serviceName ?? "<missing>";
-    const now = Date.now();
-    try {
-      await appendUnroutedSpan(home, buildUnroutedSpanRecord(serviceName, traceId, new Date(now)));
-    } catch {
-    }
-    const prev = lastUnroutedWarnAt.get(key) ?? 0;
-    if (now - prev < DROP_WARN_INTERVAL_MS) return;
-    lastUnroutedWarnAt.set(key, now);
-    console.warn(
-      `[neatd] dropping span \u2014 service.name "${key}" matches no registered project and no \`default\` project exists. See ${unroutedPath}.`
-    );
-  }
-  function upsertRegistryFromSlot(slot) {
-    if (slot.status !== "active") return;
-    registry.set(slot.entry.name, {
-      scanPath: slot.entry.path,
-      paths: slot.paths,
-      graph: slot.graph
-    });
-  }
-  async function tryRecoverSlot(entry) {
-    try {
-      const fresh = await bootstrapProject(entry, opts.connectors ?? [], home);
-      const prior = slots.get(entry.name);
-      if (prior) teardownSlot(prior);
-      slots.set(entry.name, fresh);
-      upsertRegistryFromSlot(fresh);
-      if (fresh.status === "active") {
-        await setStatus(entry.name, "active").catch(() => {
-        });
-        console.log(
-          `neatd: project "${entry.name}" recovered from broken \u2014 active`
-        );
-      }
-      return fresh;
-    } catch (err) {
-      console.warn(
-        `neatd: project "${entry.name}" still broken after recovery attempt \u2014 ${err.message}`
-      );
-      return slots.get(entry.name);
-    }
-  }
-  async function bootstrapOne(entry) {
-    bootstrapStatus.set(entry.name, "bootstrapping");
-    bootstrapStartedAt.set(entry.name, Date.now());
-    try {
-      const slot = await bootstrapProject(entry, opts.connectors ?? [], home);
-      const prior = slots.get(entry.name);
-      if (prior) teardownSlot(prior);
-      slots.set(entry.name, slot);
-      upsertRegistryFromSlot(slot);
-      bootstrapStatus.set(entry.name, slot.status === "broken" ? "broken" : "active");
-      if (slot.status === "broken") {
-        console.warn(`neatd: project "${entry.name}" broken \u2014 ${slot.errorReason}`);
-      } else {
-        console.log(`neatd: project "${entry.name}" active (${entry.path})`);
-      }
-    } catch (err) {
-      bootstrapStatus.set(entry.name, "broken");
-      console.warn(
-        `neatd: project "${entry.name}" failed to bootstrap \u2014 ${err.message}`
-      );
-      await setStatus(entry.name, "broken").catch(() => {
-      });
-    }
-  }
-  async function enumerateProjects() {
-    if (singleProject && singleProjectPath) {
-      return [
-        {
-          name: singleProject,
-          path: singleProjectPath,
-          registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-          languages: [],
-          status: "active"
-        }
-      ];
-    }
-    return listProjects();
-  }
-  async function loadAll() {
-    if (!singleProject) {
-      try {
-        const pruned = await pruneRegistry();
-        for (const entry of pruned) {
-          console.log(
-            `neatd: pruned project "${entry.name}" \u2014 registered path ${entry.path} is gone`
-          );
-          slots.delete(entry.name);
-          bootstrapStatus.delete(entry.name);
-          bootstrapStartedAt.delete(entry.name);
-        }
-      } catch (err) {
-        console.warn(`neatd: registry prune skipped \u2014 ${err.message}`);
-      }
-    }
-    const projects = await enumerateProjects();
-    const seen = /* @__PURE__ */ new Set();
-    const pending = [];
-    for (const entry of projects) {
-      seen.add(entry.name);
-      const existing = slots.get(entry.name);
-      if (existing) {
-        if (existing.status === "broken") {
-          pending.push(tryRecoverSlot(entry).then(() => {
-          }));
-        }
-        continue;
-      }
-      pending.push(bootstrapOne(entry));
-    }
-    for (const [name, slot] of [...slots.entries()]) {
-      if (seen.has(name)) continue;
-      teardownSlot(slot);
-      slots.delete(name);
-      bootstrapStatus.delete(name);
-      bootstrapStartedAt.delete(name);
-      console.log(`neatd: project "${name}" removed from registry \u2014 stopped`);
-    }
-    await Promise.allSettled(pending);
-  }
-  const initialEntries = await enumerateProjects().catch(() => []);
-  for (const entry of initialEntries) {
-    bootstrapStatus.set(entry.name, "bootstrapping");
-    bootstrapStartedAt.set(entry.name, Date.now());
-  }
-  const bind = opts.bindListeners !== false;
-  let restApp = null;
-  let otlpApp = null;
-  let restAddress = "";
-  let otlpAddress = "";
-  let daemonRecord = null;
-  if (bind) {
-    const auth = readAuthEnv();
-    const host = resolveHost(opts, Boolean(auth.authToken));
-    const restPort = resolveRestPort(opts);
-    const otlpPort = resolveOtlpPort(opts);
-    assertBindAuthority(host, auth.authToken);
-    try {
-      restApp = await buildApi({
-        projects: registry,
-        authToken: auth.authToken,
-        trustProxy: auth.trustProxy,
-        publicRead: auth.publicRead,
-        bootstrap: {
-          status: (name) => bootstrapStatus.get(name),
-          list: () => {
-            const now = Date.now();
-            return [...bootstrapStatus.entries()].map(([name, status]) => ({
-              name,
-              status,
-              elapsedMs: now - (bootstrapStartedAt.get(name) ?? now)
-            }));
-          }
-        },
-        // ADR-096 §4/§5/§7 — hand the daemon's identity to buildApi so the REST
-        // surface reflects "the daemon is the project": `GET /projects` reports
-        // only this project (the dashboard pins to it), and the daemon-wide
-        // `/health` carries it at the top level for the spawn-reuse identity
-        // check. Absent for the legacy multi-project daemon.
-        singleProject: singleProject && singleProjectPath ? { name: singleProject, path: singleProjectPath } : void 0,
-        // ADR-136 — the connector-status endpoint reads ~/.neat/connectors.json
-        // through the same resolved home the slot bootstrap read it from, so a
-        // daemon given an explicit NEAT_HOME serves status for the same file it
-        // polls.
-        connectorsHome: home
-      });
-      restAddress = await restApp.listen({ port: restPort, host });
-      console.log(
-        `neatd: REST listening on http://${host}:${portFromListenAddress(restAddress, restPort)}`
-      );
-    } catch (err) {
-      for (const slot of slots.values()) {
-        teardownSlot(slot);
-      }
-      if (restApp) await restApp.close().catch(() => {
-      });
-      await fs2.unlink(pidPath).catch(() => {
-      });
-      throw new Error(
-        `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
-      );
-    }
-    async function resolveTargetSlot(serviceName, traceId) {
-      if (singleProject) {
-        let slot2 = slots.get(singleProject);
-        if (!slot2) {
-          slot2 = await tryRecoverSlot({
-            name: singleProject,
-            path: singleProjectPath,
-            registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-            languages: [],
-            status: "active"
-          });
-        } else if (slot2.status === "broken") {
-          slot2 = await tryRecoverSlot(slot2.entry);
-        }
-        if (!slot2 || slot2.status !== "active") {
-          warnDroppedSpan(singleProject, slot2?.errorReason ?? "unknown");
-          return null;
-        }
-        if (!spanBelongsToSingleProject(slot2.graph, singleProject, serviceName)) {
-          await recordUnroutedSpan(serviceName, traceId);
-          return null;
-        }
-        return slot2;
-      }
-      const liveEntries = await listProjects().catch(() => []);
-      const target = routeSpanToProject(serviceName, liveEntries);
-      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
-      if (!slot) {
-        await recordUnroutedSpan(serviceName, traceId);
-        return null;
-      }
-      if (slot.status === "broken") {
-        const entry = liveEntries.find((e) => e.name === slot.entry.name);
-        if (entry) {
-          slot = await tryRecoverSlot(entry);
-        }
-        if (slot.status !== "active") {
-          warnDroppedSpan(slot.entry.name, slot.errorReason ?? "unknown");
-          return null;
-        }
-      }
-      return slot.status === "active" ? slot : null;
-    }
-    async function resolveSlotByName(project, serviceName, traceId) {
-      const liveEntries = await listProjects().catch(() => []);
-      let slot = slots.get(project);
-      if (!slot) {
-        await recordUnroutedSpan(serviceName, traceId);
-        return null;
-      }
-      if (slot.status === "broken") {
-        const entry = liveEntries.find((e) => e.name === slot.entry.name);
-        if (entry) {
-          slot = await tryRecoverSlot(entry);
-        }
-        if (slot.status !== "active") {
-          warnDroppedSpan(slot.entry.name, slot.errorReason ?? "unknown");
-          return null;
-        }
-      }
-      return slot.status === "active" ? slot : null;
-    }
-    try {
-      otlpApp = await buildOtelReceiver({
-        authToken: auth.otelToken,
-        trustProxy: auth.trustProxy,
-        onSpan: async (span) => {
-          const slot = await resolveTargetSlot(span.service, span.traceId);
-          if (!slot) return;
-          await handleSpan(
-            {
-              graph: slot.graph,
-              errorsPath: slot.paths.errorsPath,
-              scanPath: slot.entry.path,
-              project: slot.entry.name,
-              // Receiver already wrote the error event synchronously below.
-              writeErrorEventInline: false
-            },
-            span
-          );
-        },
-        onErrorSpanSync: async (span) => {
-          const slot = await resolveTargetSlot(span.service, span.traceId);
-          if (!slot) return;
-          await makeErrorSpanWriter(slot.paths.errorsPath, slot.graph, slot.entry.path)(span);
-        },
-        // Project-scoped route (issue #367) — the URL already named the
-        // project. Resolution is a direct slot lookup; service.name resolves
-        // the ServiceNode inside the slot's graph instead of which project
-        // owns the span.
-        onProjectSpan: async (project, span) => {
-          const slot = await resolveSlotByName(project, span.service, span.traceId);
-          if (!slot) return;
-          await handleSpan(
-            {
-              graph: slot.graph,
-              errorsPath: slot.paths.errorsPath,
-              scanPath: slot.entry.path,
-              project: slot.entry.name,
-              writeErrorEventInline: false
-            },
-            span
-          );
-        },
-        onProjectErrorSpanSync: async (project, span) => {
-          const slot = await resolveSlotByName(project, span.service, span.traceId);
-          if (!slot) return;
-          await makeErrorSpanWriter(slot.paths.errorsPath, slot.graph, slot.entry.path)(span);
-        },
-        // #881 — 404 a project-scoped POST for a project this daemon doesn't
-        // host, rather than accepting it and dropping the batch. `slots` covers
-        // active/recovering projects, `bootstrapStatus` the ones still
-        // extracting; a foreign or wrong-cased project name matches neither.
-        isProjectRegistered: (project) => slots.has(project) || bootstrapStatus.has(project)
-      });
-      otlpAddress = await listenSteppingOtlp(otlpApp, otlpPort, host);
-      console.log(`neatd: OTLP listening on ${otlpAddress}/v1/traces`);
-    } catch (err) {
-      for (const slot of slots.values()) {
-        teardownSlot(slot);
-      }
-      if (restApp) await restApp.close().catch(() => {
-      });
-      if (otlpApp) await otlpApp.close().catch(() => {
-      });
-      await fs2.unlink(pidPath).catch(() => {
-      });
-      throw new Error(
-        `neatd: failed to bind OTLP on port ${otlpPort} \u2014 ${err.message}`
-      );
-    }
-    if (singleProject && singleProjectPath) {
-      const ports = {
-        rest: portFromListenAddress(restAddress, restPort),
-        otlp: portFromListenAddress(otlpAddress, otlpPort),
-        // The daemon doesn't bind the web port itself (neatd spawns the web
-        // child); it records the allocated value passed through so the
-        // dashboard and `neat ps` agree on where to look.
-        web: typeof opts.webPort === "number" ? opts.webPort : resolveWebPort()
-      };
-      daemonRecord = {
-        project: singleProject,
-        projectPath: singleProjectPath,
-        pid: process.pid,
-        status: "running",
-        ports,
-        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        neatVersion: resolveNeatVersion()
-      };
-      try {
-        await writeDaemonRecord(daemonRecord, home);
-        console.log(
-          `neatd: project "${singleProject}" \u2192 REST ${ports.rest} / OTLP ${ports.otlp} / web ${ports.web} (daemon.json written)`
-        );
-      } catch (err) {
-        for (const slot of slots.values()) teardownSlot(slot);
-        if (restApp) await restApp.close().catch(() => {
-        });
-        if (otlpApp) await otlpApp.close().catch(() => {
-        });
-        await fs2.unlink(pidPath).catch(() => {
-        });
-        throw new Error(
-          `neatd: failed to write daemon.json for "${singleProject}" \u2014 ${err.message}`
-        );
-      }
-    }
-  }
-  const initialBootstrap = loadAll().catch((err) => {
-    console.warn(`neatd: initial bootstrap pass failed \u2014 ${err.message}`);
-  });
-  let reloading = initialBootstrap;
-  const reload = async () => {
-    if (reloading) return reloading;
-    reloading = (async () => {
-      try {
-        await loadAll();
-      } finally {
-        reloading = null;
-      }
-    })();
-    return reloading;
-  };
-  void initialBootstrap.finally(() => {
-    if (reloading === initialBootstrap) reloading = null;
-  });
-  const tracker = {
-    status: (name) => bootstrapStatus.get(name),
-    list: () => {
-      const now = Date.now();
-      return [...bootstrapStatus.entries()].map(([name, status]) => ({
-        name,
-        status,
-        elapsedMs: now - (bootstrapStartedAt.get(name) ?? now)
-      }));
-    }
-  };
-  const sighupHandler = () => {
-    void reload().catch((err) => {
-      console.warn(`neatd: SIGHUP reload failed \u2014 ${err.message}`);
-    });
-  };
-  process.on("SIGHUP", sighupHandler);
-  const REGISTRY_RELOAD_DEBOUNCE_MS = 500;
-  let registryWatcher = null;
-  let reloadTimer = null;
-  if (!singleProject) try {
-    const regDir = path2.dirname(regPath);
-    const regBase = path2.basename(regPath);
-    registryWatcher = watch(regDir, (_eventType, filename) => {
-      if (filename !== null && filename !== regBase) return;
-      if (reloadTimer) clearTimeout(reloadTimer);
-      reloadTimer = setTimeout(() => {
-        reloadTimer = null;
-        void reload().catch((err) => {
-          console.warn(
-            `neatd: registry-watch reload failed \u2014 ${err.message}`
-          );
-        });
-      }, REGISTRY_RELOAD_DEBOUNCE_MS);
-    });
-  } catch (err) {
-    console.warn(
-      `neatd: failed to watch registry at ${regPath} \u2014 ${err.message}. Run \`neatd reload\` (or send SIGHUP) after registering new projects.`
-    );
-  }
-  let stopped = false;
-  const stop = async () => {
-    if (stopped) return;
-    stopped = true;
-    process.off("SIGHUP", sighupHandler);
-    if (reloadTimer) {
-      clearTimeout(reloadTimer);
-      reloadTimer = null;
-    }
-    if (registryWatcher) {
-      try {
-        registryWatcher.close();
-      } catch {
-      }
-      registryWatcher = null;
-    }
-    if (otlpApp) await otlpApp.close().catch(() => {
-    });
-    if (restApp) await restApp.close().catch(() => {
-    });
-    for (const slot of slots.values()) {
-      if (slot.status === "active" && slot.outPath) {
-        await saveGraphToDisk(slot.graph, slot.outPath).catch(() => {
-        });
-      }
-    }
-    for (const slot of slots.values()) {
-      teardownSlot(slot);
-    }
-    if (daemonRecord) {
-      await clearDaemonRecord(daemonRecord, home);
-    }
-    await fs2.unlink(pidPath).catch(() => {
-    });
-  };
-  return {
-    slots,
-    reload,
-    stop,
-    pidPath,
-    restAddress,
-    otlpAddress,
-    bootstrap: tracker,
-    initialBootstrap,
-    daemonRecord,
-    neatHome: home
-  };
-}
-
-export {
-  isPushProvider,
-  getProviderFieldSchema,
-  knownProviderNames,
-  validateConnectorEntry,
-  startConnectorPolling,
-  provisionConnector,
-  deprovisionConnector,
-  readDaemonRecord,
-  resolveNeatVersion,
-  writeDaemonRecord,
-  clearDaemonRecord,
-  reconcileDaemonRecordSync,
-  routeSpanToProject,
-  portFromListenAddress,
-  resolveHost,
-  startDaemon
-};
-//# sourceMappingURL=chunk-22X2YM5H.js.map