@neat.is/core 0.6.4 → 0.7.1

package/dist/cli.js

@@ -1,19 +1,12 @@
 #!/usr/bin/env node
 import {
   clearDaemonRecord,
-  deprovisionConnector,
-  getProviderFieldSchema,
-  isPushProvider,
-  knownProviderNames,
   portFromListenAddress,
-  provisionConnector,
   readDaemonRecord,
   resolveHost,
   resolveNeatVersion,
-  startConnectorPolling,
-  validateConnectorEntry,
   writeDaemonRecord
-} from "./chunk-22X2YM5H.js";
+} from "./chunk-MDBE23Y3.js";
 import {
   buildSearchIndex
 } from "./chunk-BIY46Q6U.js";
@@ -36,6 +29,7 @@ import {
   autoSlugConnectorId,
   buildApi,
   computeDivergences,
+  deprovisionConnector,
   describeCredential,
   detectPackageManager,
   discoverServices,
@@ -47,8 +41,11 @@ import {
   formatExtractionBanner,
   formatPrecisionFloorBanner,
   getGraph,
+  getProviderFieldSchema,
   isEnvRef,
+  isPushProvider,
   isStrictExtractionEnabled,
+  knownProviderNames,
   listMachineProjects,
   listProjects,
   loadGraphFromDisk,
@@ -58,6 +55,7 @@ import {
   normalizeProjectPath,
   pathsForProject,
   promoteFrontierNodes,
+  provisionConnector,
   pruneRegistry,
   readConnectorsConfig,
   removeConnectorEntry,
@@ -69,13 +67,15 @@ import {
   saveGraphToDisk,
   setStatus,
   signalDaemonStop,
+  startConnectorPolling,
   startPersistLoop,
   startStalenessLoop,
-  upsertConnectorEntry
-} from "./chunk-UCDXHLCJ.js";
+  upsertConnectorEntry,
+  validateConnectorEntry
+} from "./chunk-RR4LWQQB.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-7QXN726V.js";
+} from "./chunk-6H757ZNM.js";
 import {
   __dirname,
   __require,
@@ -83,12 +83,12 @@ import {
   buildOtelReceiver,
   listenSteppingOtlp,
   readAuthEnv
-} from "./chunk-ZLAZ7PLC.js";
+} from "./chunk-P2ZEKJ35.js";
 
 // src/cli.ts
-import path10 from "path";
+import path11 from "path";
 import os2 from "os";
-import { promises as fs8 } from "fs";
+import { promises as fs9 } from "fs";
 
 // src/banner.ts
 import path from "path";
@@ -825,7 +825,7 @@ import semver from "semver";
 
 // src/installers/templates.ts
 var OTEL_INIT_HEADER = "// Generated by `neat init --apply` (ADR-069). OpenTelemetry auto-instrumentation hook.";
-var OTEL_INIT_STAMP = "// neat-template-version: 7 \u2014 OTel init degrades to no-OBSERVED instead of crashing the host app when @opentelemetry deps are absent (#820); daemon.json endpoint resolution (ADR-096) + layered file-first capture (ADR-090).";
+var OTEL_INIT_STAMP = "// neat-template-version: 8 \u2014 CommonJS TypeScript uses a synchronous bootstrap (#910); OTel init degrades to no-OBSERVED when dependencies are absent (#820); daemon.json endpoint resolution (ADR-096) + layered file-first capture (ADR-090).";
 var OTEL_OTLP_HEADERS_JS = "if (process.env.NEAT_OTEL_TOKEN) process.env.OTEL_EXPORTER_OTLP_HEADERS ||= 'Authorization=Bearer ' + process.env.NEAT_OTEL_TOKEN";
 var OTEL_OTLP_PROTOCOL_JS = "process.env.OTEL_EXPORTER_OTLP_PROTOCOL ||= 'http/json'";
 var OTEL_ENDPOINT_RESOLVER_CJS = `;(function () {
@@ -1189,6 +1189,13 @@ ${neatWireCaptureSource(false)}
   }
 }
 `;
+var OTEL_INIT_TS_CJS = OTEL_INIT_CJS.replace(
+  `${OTEL_INIT_HEADER}
+${OTEL_INIT_STAMP}`,
+  `${OTEL_INIT_HEADER}
+${OTEL_INIT_STAMP}
+// @ts-nocheck \u2014 generated CommonJS runtime shim.`
+);
 var OTEL_INIT_ESM = `${OTEL_INIT_HEADER}
 ${OTEL_INIT_STAMP}
 ${OTEL_ESM_NODE_IMPORTS}
@@ -1460,6 +1467,13 @@ function detectNonBundledInstrumentations(pkg) {
       registration: "instrumentations.push(new (require('@prisma/instrumentation').PrismaInstrumentation)())"
     });
   }
+  if (getMajor(deps["@nestjs/core"]) >= 11) {
+    out.push({
+      pkg: "@opentelemetry/instrumentation-nestjs-core",
+      version: "^0.67.0",
+      registration: "instrumentations.push(new (require('@opentelemetry/instrumentation-nestjs-core').NestInstrumentation)())"
+    });
+  }
   return out;
 }
 var OTEL_ENV = {
@@ -1772,18 +1786,19 @@ async function resolveEntry(serviceDir, pkg) {
 }
 function dispatchEntry(entryFile, pkg) {
   const ext = path5.extname(entryFile).toLowerCase();
-  if (ext === ".ts" || ext === ".tsx") return "ts";
+  if (ext === ".ts" || ext === ".tsx") return pkg.type === "module" ? "ts" : "ts-cjs";
   if (ext === ".mjs") return "esm";
   if (ext === ".cjs") return "cjs";
   return pkg.type === "module" ? "esm" : "cjs";
 }
 function otelInitFilename(flavor) {
-  if (flavor === "ts") return "otel-init.ts";
+  if (flavor === "ts" || flavor === "ts-cjs") return "otel-init.ts";
   if (flavor === "esm") return "otel-init.mjs";
   return "otel-init.cjs";
 }
 function otelInitContents(flavor) {
   if (flavor === "ts") return OTEL_INIT_TS;
+  if (flavor === "ts-cjs") return OTEL_INIT_TS_CJS;
   if (flavor === "esm") return OTEL_INIT_ESM;
   return OTEL_INIT_CJS;
 }
@@ -2949,9 +2964,137 @@ var pythonInstaller = {
   apply: apply2
 };
 
+// src/installers/go.ts
+import { promises as fs6 } from "fs";
+import path7 from "path";
+var GO_DEPS = [
+  { name: "go.opentelemetry.io/otel", version: "v1.38.0" },
+  { name: "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", version: "v1.38.0" },
+  { name: "go.opentelemetry.io/otel/sdk", version: "v1.38.0" }
+];
+async function exists3(file) {
+  return fs6.stat(file).then(() => true, () => false);
+}
+async function findMain(serviceDir) {
+  const root = path7.join(serviceDir, "main.go");
+  if (await exists3(root)) return root;
+  const cmd = path7.join(serviceDir, "cmd");
+  const entries = await fs6.readdir(cmd, { withFileTypes: true }).catch(() => []);
+  for (const entry2 of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry2.isDirectory()) continue;
+    const candidate = path7.join(cmd, entry2.name, "main.go");
+    if (await exists3(candidate)) return candidate;
+  }
+  return null;
+}
+function neatOtelGo(packageName = "main") {
+  return `// neat-otel-init v1 \u2014 generated by NEAT. Safe to re-generate; do not edit.
+package ${packageName}
+
+import (
+  "context"
+  "os"
+  "path/filepath"
+  "runtime"
+  "strings"
+
+  "go.opentelemetry.io/otel"
+  "go.opentelemetry.io/otel/attribute"
+  "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+  sdktrace "go.opentelemetry.io/otel/sdk/trace"
+  "go.opentelemetry.io/otel/trace"
+)
+
+type neatCallSiteSpanProcessor struct { root string }
+
+func (p neatCallSiteSpanProcessor) OnStart(_ context.Context, span sdktrace.ReadWriteSpan) {
+  if span.SpanKind() != trace.SpanKindClient && span.SpanKind() != trace.SpanKindProducer { return }
+  pcs := make([]uintptr, 32)
+  n := runtime.Callers(2, pcs)
+  frames := runtime.CallersFrames(pcs[:n])
+  for {
+    frame, more := frames.Next()
+    clean := filepath.Clean(frame.File)
+    slash := filepath.ToSlash(clean)
+    if clean != "" && strings.HasPrefix(clean, p.root+string(os.PathSeparator)) && !strings.Contains(slash, "/vendor/") && !strings.HasSuffix(slash, "/neat_otel.go") {
+      span.SetAttributes(
+        attribute.String("code.file.path", clean),
+        attribute.Int("code.line.number", frame.Line),
+        attribute.String("code.function.name", frame.Function),
+      )
+      return
+    }
+    if !more { return }
+  }
+}
+func (neatCallSiteSpanProcessor) OnEnd(sdktrace.ReadOnlySpan) {}
+func (neatCallSiteSpanProcessor) Shutdown(context.Context) error { return nil }
+func (neatCallSiteSpanProcessor) ForceFlush(context.Context) error { return nil }
+
+func init() {
+  root := os.Getenv("NEAT_SERVICE_ROOT")
+  if root == "" {
+    _, self, _, ok := runtime.Caller(0)
+    if !ok { return }
+    root = filepath.Dir(self)
+    for {
+      if _, err := os.Stat(filepath.Join(root, "go.mod")); err == nil { break }
+      parent := filepath.Dir(root)
+      if parent == root { return }
+      root = parent
+    }
+  }
+  root, _ = filepath.Abs(root)
+  if canonical, err := filepath.EvalSymlinks(root); err == nil { root = canonical }
+  exporter, err := otlptracehttp.New(context.Background())
+  if err != nil { return }
+  provider := sdktrace.NewTracerProvider(
+    sdktrace.WithBatcher(exporter),
+    sdktrace.WithSpanProcessor(neatCallSiteSpanProcessor{root: filepath.Clean(root)}),
+  )
+  otel.SetTracerProvider(provider)
+}
+`;
+}
+async function detect3(serviceDir) {
+  return exists3(path7.join(serviceDir, "go.mod"));
+}
+async function plan3(serviceDir) {
+  const manifest = path7.join(serviceDir, "go.mod");
+  const raw = await fs6.readFile(manifest, "utf8");
+  const main2 = await findMain(serviceDir);
+  const dependencyEdits = GO_DEPS.filter((dep) => !raw.includes(dep.name)).map((dep) => ({ file: manifest, kind: "add", ...dep }));
+  if (!main2) return { language: "go", serviceDir, dependencyEdits: [], entrypointEdits: [], envEdits: [], libOnly: true };
+  const source = await fs6.readFile(main2, "utf8");
+  const packageName = source.match(/^\s*package\s+(\w+)\s*$/m)?.[1] ?? "main";
+  const generated = path7.join(path7.dirname(main2), "neat_otel.go");
+  const generatedFiles = await exists3(generated) ? [] : [{ file: generated, contents: neatOtelGo(packageName) }];
+  return { language: "go", serviceDir, dependencyEdits, entrypointEdits: [], envEdits: [], generatedFiles, entryFile: main2 };
+}
+async function apply3(installPlan) {
+  if (installPlan.libOnly) return { serviceDir: installPlan.serviceDir, outcome: "lib-only", writtenFiles: [] };
+  const writtenFiles = [];
+  const byManifest = /* @__PURE__ */ new Map();
+  for (const edit of installPlan.dependencyEdits) byManifest.set(edit.file, [...byManifest.get(edit.file) ?? [], edit]);
+  for (const [manifest, edits] of byManifest) {
+    const raw = await fs6.readFile(manifest, "utf8");
+    const suffix = raw.endsWith("\n") ? "" : "\n";
+    await fs6.writeFile(manifest, `${raw}${suffix}${edits.map((e) => `require ${e.name} ${e.version}`).join("\n")}
+`, "utf8");
+    writtenFiles.push(manifest);
+  }
+  for (const generated of installPlan.generatedFiles ?? []) {
+    if (await exists3(generated.file)) continue;
+    await fs6.writeFile(generated.file, generated.contents, "utf8");
+    writtenFiles.push(generated.file);
+  }
+  return { serviceDir: installPlan.serviceDir, outcome: writtenFiles.length ? "instrumented" : "already-instrumented", writtenFiles };
+}
+var goInstaller = { name: "go", detect: detect3, plan: plan3, apply: apply3 };
+
 // src/installers/shared.ts
-function isEmptyPlan(plan3) {
-  return plan3.dependencyEdits.length === 0 && plan3.entrypointEdits.length === 0 && plan3.envEdits.length === 0 && (plan3.generatedFiles?.length ?? 0) === 0 && plan3.nextConfigEdit === void 0;
+function isEmptyPlan(plan4) {
+  return plan4.dependencyEdits.length === 0 && plan4.entrypointEdits.length === 0 && plan4.envEdits.length === 0 && (plan4.generatedFiles?.length ?? 0) === 0 && plan4.nextConfigEdit === void 0;
 }
 
 // src/installers/index.ts
@@ -2965,7 +3108,7 @@ var FORBIDDEN_LOCKFILES = /* @__PURE__ */ new Set([
   "Cargo.lock",
   "go.sum"
 ]);
-var INSTALLERS = [javascriptInstaller, pythonInstaller];
+var INSTALLERS = [javascriptInstaller, pythonInstaller, goInstaller];
 async function pickInstaller(serviceDir) {
   for (const inst of INSTALLERS) {
     if (await inst.detect(serviceDir)) return inst;
@@ -2980,7 +3123,7 @@ function renderPatch(sections) {
       "No SDK installers matched the discovered services. Two reasons this",
       "normally happens:",
       "  - the project uses a language NEAT does not yet instrument",
-      "    (Java / Ruby / .NET / Go / Rust are out of MVP scope per ADR-047);",
+      "    (Java / Ruby / .NET / Rust are out of MVP scope per ADR-047);",
       "  - the SDK is already installed, so the installer returned an empty",
       "    plan.",
       "",
@@ -2990,22 +3133,22 @@ function renderPatch(sections) {
   }
   const lines = ["# neat install plan", ""];
   for (const section of sections) {
-    const { installer, plan: plan3 } = section;
-    lines.push(`## ${installer} (${plan3.language}) \u2014 ${plan3.serviceDir}`);
+    const { installer, plan: plan4 } = section;
+    lines.push(`## ${installer} (${plan4.language}) \u2014 ${plan4.serviceDir}`);
     lines.push("");
-    if (plan3.libOnly) {
+    if (plan4.libOnly) {
       lines.push("### skipped \u2014 no resolvable entry point (lib-only)");
       lines.push("");
       continue;
     }
-    if (plan3.entryFile) {
-      lines.push(`entry: ${plan3.entryFile}`);
+    if (plan4.entryFile) {
+      lines.push(`entry: ${plan4.entryFile}`);
       lines.push("");
     }
-    if (plan3.dependencyEdits.length > 0) {
+    if (plan4.dependencyEdits.length > 0) {
       lines.push("### dependencies");
       const byFile = /* @__PURE__ */ new Map();
-      for (const dep of plan3.dependencyEdits) {
+      for (const dep of plan4.dependencyEdits) {
         const base = dep.file.split(/[\\/]/).pop() ?? dep.file;
         if (FORBIDDEN_LOCKFILES.has(base)) {
           throw new Error(
@@ -3024,9 +3167,9 @@ function renderPatch(sections) {
       }
       lines.push("");
     }
-    if (plan3.generatedFiles && plan3.generatedFiles.length > 0) {
+    if (plan4.generatedFiles && plan4.generatedFiles.length > 0) {
       lines.push("### generated files");
-      for (const gen of plan3.generatedFiles) {
+      for (const gen of plan4.generatedFiles) {
         lines.push(`--- (new file) ${gen.file}`);
         for (const ln of gen.contents.split(/\r?\n/)) {
           lines.push(`+ ${ln}`);
@@ -3034,26 +3177,26 @@ function renderPatch(sections) {
       }
       lines.push("");
     }
-    if (plan3.entrypointEdits.length > 0) {
+    if (plan4.entrypointEdits.length > 0) {
       lines.push("### entry-point injection");
-      for (const e of plan3.entrypointEdits) {
+      for (const e of plan4.entrypointEdits) {
         lines.push(`--- ${e.file}`);
         lines.push(`+ ${e.after}`);
         lines.push(`  ${e.before}`);
       }
       lines.push("");
     }
-    if (plan3.envEdits.length > 0) {
+    if (plan4.envEdits.length > 0) {
       lines.push("### env (written to <package-dir>/.env.neat)");
-      for (const env of plan3.envEdits) {
+      for (const env of plan4.envEdits) {
         lines.push(`- ${env.key}=${env.value}`);
       }
       lines.push("");
     }
-    if (plan3.nextConfigEdit) {
+    if (plan4.nextConfigEdit) {
       lines.push("### next.config (framework flag)");
-      lines.push(`--- ${plan3.nextConfigEdit.file}`);
-      lines.push(`+ experimental: { instrumentationHook: true }, // ${plan3.nextConfigEdit.reason}`);
+      lines.push(`--- ${plan4.nextConfigEdit.file}`);
+      lines.push(`+ experimental: { instrumentationHook: true }, // ${plan4.nextConfigEdit.reason}`);
       lines.push("");
     }
   }
@@ -3061,10 +3204,10 @@ function renderPatch(sections) {
 }
 
 // src/orchestrator.ts
-import { promises as fs6 } from "fs";
+import { promises as fs7 } from "fs";
 import http from "http";
 import net from "net";
-import path7 from "path";
+import path8 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { spawn as spawn2 } from "child_process";
 import readline from "readline";
@@ -3074,7 +3217,7 @@ async function extractAndPersist(opts) {
   const graphKey = opts.projectExplicit ? opts.project : DEFAULT_PROJECT;
   resetGraph(graphKey);
   const graph = getGraph(graphKey);
-  const projectPaths = pathsForProject(graphKey, path7.join(opts.scanPath, "neat-out"));
+  const projectPaths = pathsForProject(graphKey, path8.join(opts.scanPath, "neat-out"));
   const extraction = await extractFromDirectory(graph, opts.scanPath, {
     errorsPath: projectPaths.errorsPath
   });
@@ -3108,15 +3251,15 @@ async function applyInstallersOver(services, project, options = {}) {
   for (const svc of services) {
     const installer = await pickInstaller(svc.dir);
     if (!installer) continue;
-    const plan3 = await installer.plan(svc.dir, { project });
-    if (isEmptyPlan(plan3) && !plan3.libOnly && plan3.runtimeKind === void 0) {
+    const plan4 = await installer.plan(svc.dir, { project });
+    if (isEmptyPlan(plan4) && !plan4.libOnly && plan4.runtimeKind === void 0) {
       already++;
       continue;
     }
-    const outcome = await installer.apply(plan3);
+    const outcome = await installer.apply(plan4);
     if (outcome.outcome === "instrumented") {
       instrumented++;
-      if (plan3.dependencyEdits.length > 0) {
+      if (plan4.dependencyEdits.length > 0) {
         const cmd = await resolveManager(svc.dir);
         const key = `${cmd.pm}:${cmd.cwd}`;
         if (!installPlans.has(key)) installPlans.set(key, cmd);
@@ -3126,7 +3269,7 @@ async function applyInstallersOver(services, project, options = {}) {
       libOnly++;
       const appDeps = svc.pkg ? appFrameworkDependencies(svc.pkg) : [];
       if (appDeps.length > 0) {
-        const svcName = path7.basename(svc.dir);
+        const svcName = path8.basename(svc.dir);
         const list = appDeps.join(", ");
         console.warn(
           `neat: runtime layer won't engage for ${svcName}: no entry point found.
@@ -3139,7 +3282,7 @@ async function applyInstallersOver(services, project, options = {}) {
       console.log(`skipping ${svc.dir}: browser bundle; browser-OTel support lands in a future release.`);
     } else if (outcome.outcome === "react-native") {
       reactNative++;
-      const svcName = path7.basename(svc.dir);
+      const svcName = path8.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as React Native / Expo
   The installer doesn't cover this runtime deterministically.
@@ -3150,7 +3293,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "bun") {
       bun++;
-      const svcName = path7.basename(svc.dir);
+      const svcName = path8.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Bun
   The installer doesn't cover this runtime deterministically.
@@ -3161,7 +3304,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "deno") {
       deno++;
-      const svcName = path7.basename(svc.dir);
+      const svcName = path8.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Deno
   The installer doesn't cover this runtime deterministically.
@@ -3172,7 +3315,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "cloudflare-workers") {
       cloudflareWorkers++;
-      const svcName = path7.basename(svc.dir);
+      const svcName = path8.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Cloudflare Workers
   The installer doesn't cover this runtime deterministically.
@@ -3183,7 +3326,7 @@ async function applyInstallersOver(services, project, options = {}) {
       );
     } else if (outcome.outcome === "electron") {
       electron++;
-      const svcName = path7.basename(svc.dir);
+      const svcName = path8.basename(svc.dir);
       console.log(
         `neat: ${svc.dir} detected as Electron
   The installer doesn't cover this runtime deterministically.
@@ -3196,7 +3339,7 @@ async function applyInstallersOver(services, project, options = {}) {
     if (svc.pkg && (outcome.outcome === "instrumented" || outcome.outcome === "already-instrumented")) {
       const gaps = uninstrumentedLibraries(svc.pkg);
       if (gaps.length > 0) {
-        const svcName = path7.basename(svc.dir);
+        const svcName = path8.basename(svc.dir);
         const list = gaps.join(", ");
         const subject = gaps.length === 1 ? "this library" : "these libraries";
         const aux = gaps.length === 1 ? "isn't" : "aren't";
@@ -3402,24 +3545,24 @@ async function persistedPortsFor(scanPath) {
   return { rest: record.ports.rest, otlp: record.ports.otlp, web: record.ports.web };
 }
 async function acquireSpawnLock(scanPath) {
-  const lockPath = path7.join(scanPath, "neat-out", "daemon.spawn.lock");
-  await fs6.mkdir(path7.dirname(lockPath), { recursive: true });
+  const lockPath = path8.join(scanPath, "neat-out", "daemon.spawn.lock");
+  await fs7.mkdir(path8.dirname(lockPath), { recursive: true });
   const STALE_LOCK_MS = 6e4;
   try {
-    const fd = await fs6.open(lockPath, "wx");
+    const fd = await fs7.open(lockPath, "wx");
     await fd.writeFile(`${process.pid}
 `, "utf8");
     await fd.close();
     return async () => {
-      await fs6.unlink(lockPath).catch(() => {
+      await fs7.unlink(lockPath).catch(() => {
       });
     };
   } catch (err) {
     if (err.code !== "EEXIST") return null;
     try {
-      const stat = await fs6.stat(lockPath);
+      const stat = await fs7.stat(lockPath);
       if (Date.now() - stat.mtimeMs > STALE_LOCK_MS) {
-        await fs6.unlink(lockPath).catch(() => {
+        await fs7.unlink(lockPath).catch(() => {
         });
         return acquireSpawnLock(scanPath);
       }
@@ -3448,13 +3591,13 @@ async function healthIsForProject(restPort, project) {
   return false;
 }
 function daemonLogPath(projectPath2) {
-  return path7.join(projectPath2, "neat-out", "daemon.log");
+  return path8.join(projectPath2, "neat-out", "daemon.log");
 }
 function spawnDaemonDetached(spec) {
-  const here = path7.dirname(fileURLToPath2(import.meta.url));
+  const here = path8.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path7.join(here, "neatd.cjs"),
-    path7.join(here, "neatd.js")
+    path8.join(here, "neatd.cjs"),
+    path8.join(here, "neatd.js")
   ];
   let entry2 = null;
   const fsSync = __require("fs");
@@ -3484,7 +3627,7 @@ function spawnDaemonDetached(spec) {
   let logFd = null;
   if (spec) {
     const logPath = daemonLogPath(spec.projectPath);
-    fsSync.mkdirSync(path7.dirname(logPath), { recursive: true });
+    fsSync.mkdirSync(path8.dirname(logPath), { recursive: true });
     logFd = fsSync.openSync(logPath, "a");
   }
   const child = spawn2(process.execPath, [entry2, "start"], {
@@ -3523,7 +3666,7 @@ async function runOrchestrator(opts) {
       browser: "skipped"
     }
   };
-  const stat = await fs6.stat(opts.scanPath).catch(() => null);
+  const stat = await fs7.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat: ${opts.scanPath} is not a directory`);
     result.exitCode = 2;
@@ -3683,7 +3826,7 @@ async function runOrchestrator(opts) {
     result.steps.browser = openBrowser(dashboardUrl);
   }
   const daemonRunning = result.steps.daemon === "spawned" || result.steps.daemon === "already-running";
-  const daemonLog = daemonRunning ? path7.relative(opts.scanPath, daemonLogPath(opts.scanPath)) : null;
+  const daemonLog = daemonRunning ? path8.relative(opts.scanPath, daemonLogPath(opts.scanPath)) : null;
   printSummary(result, graph, dashboardUrl, daemonLog);
   return result;
 }
@@ -4091,7 +4234,7 @@ async function connectorTest(deps, id) {
 function printConnectorUsage(write) {
   write("usage: neat connector <add|list|remove|test> [args]");
   write(`  providers:        ${knownProviderNames().join(", ")}`);
-  write("                    pull (polled): supabase, railway, firebase, cloudflare");
+  write("                    pull (polled): supabase, railway, firebase, cloudflare, neon");
   write("                    push (drains): vercel \u2014 provisions a Vercel trace Drain that forwards");
   write("                                   traces to the daemon's OTLP receiver; no app instrumentation");
   write("  add <provider>    add a connector; validates the credential first (--skip-validate to skip)");
@@ -4100,6 +4243,8 @@ function printConnectorUsage(write) {
   write("                    vercel: neat connector add vercel --token $VERCEL_TOKEN \\");
   write("                              --otel-token $NEAT_OTEL_TOKEN --team-id <teamId> \\");
   write("                              --endpoint https://<public-host>/v1/traces [--project-ids <id,id>]");
+  write("                    neon: neat connector add neon --credential $NEON_OBSERVER_URL \\");
+  write("                            --project-id <projectId> --service-name <serviceName>");
   write("  list              list configured connectors (credentials shown redacted)");
   write("                    flags: --project <name>");
   write("  remove <id>       remove a connector by id (a push provider also has its drain deleted)");
@@ -4138,27 +4283,27 @@ async function runConnectorCommand(rawArgs, deps = {}) {
 }
 
 // src/hooks-cli.ts
-import path8 from "path";
+import path9 from "path";
 import os from "os";
-import { promises as fs7 } from "fs";
+import { promises as fs8 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var HOOK_FILENAME = "neat-search-nudge.mjs";
 var GUIDE_FILENAME = "GRAPH_FIRST.md";
 var GUIDE_INSTALL_NAME = "neat-graph-first.md";
 var HOOK_MATCHER = "Grep|Glob|Bash";
 function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : path8.dirname(fileURLToPath3(import.meta.url));
+  return typeof __dirname !== "undefined" ? __dirname : path9.dirname(fileURLToPath3(import.meta.url));
 }
 async function readSkillAsset(rel) {
   const here = moduleDir();
   const candidates = [
-    path8.resolve(here, "../../claude-skill", rel),
-    path8.resolve(here, "../../../claude-skill", rel),
-    path8.resolve(here, "../claude-skill", rel)
+    path9.resolve(here, "../../claude-skill", rel),
+    path9.resolve(here, "../../../claude-skill", rel),
+    path9.resolve(here, "../claude-skill", rel)
   ];
   for (const candidate of candidates) {
     try {
-      return await fs7.readFile(candidate, "utf8");
+      return await fs8.readFile(candidate, "utf8");
     } catch {
     }
   }
@@ -4168,17 +4313,17 @@ async function readSkillAsset(rel) {
 }
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path8.resolve(override);
-  return path8.join(os.homedir(), ".neat");
+  if (override && override.length > 0) return path9.resolve(override);
+  return path9.join(os.homedir(), ".neat");
 }
 function claudeSettingsPath() {
   const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return path8.resolve(override);
+  if (override && override.length > 0) return path9.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? os.homedir();
-  return path8.join(home, ".claude", "settings.json");
+  return path9.join(home, ".claude", "settings.json");
 }
 function installedHookPath() {
-  return path8.join(neatHome(), "hooks", HOOK_FILENAME);
+  return path9.join(neatHome(), "hooks", HOOK_FILENAME);
 }
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
@@ -4211,14 +4356,14 @@ async function runHooks(opts) {
     const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
     const guide = await readSkillAsset(GUIDE_FILENAME);
     const scriptPath = installedHookPath();
-    await fs7.mkdir(path8.dirname(scriptPath), { recursive: true });
-    await fs7.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = path8.join(neatHome(), GUIDE_INSTALL_NAME);
-    await fs7.writeFile(guidePath, guide, "utf8");
+    await fs8.mkdir(path9.dirname(scriptPath), { recursive: true });
+    await fs8.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = path9.join(neatHome(), GUIDE_INSTALL_NAME);
+    await fs8.writeFile(guidePath, guide, "utf8");
     const settingsFile = claudeSettingsPath();
     let settings = {};
     try {
-      settings = JSON.parse(await fs7.readFile(settingsFile, "utf8"));
+      settings = JSON.parse(await fs8.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(
@@ -4240,8 +4385,8 @@ async function runHooks(opts) {
       ...settings,
       hooks: { ...hooks, PreToolUse: preToolUse }
     };
-    await fs7.mkdir(path8.dirname(settingsFile), { recursive: true });
-    await fs7.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs8.mkdir(path9.dirname(settingsFile), { recursive: true });
+    await fs8.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat hooks: installed the search-nudge hook`);
     console.log(`  script:   ${scriptPath}`);
     console.log(`  settings: ${settingsFile} (PreToolUse \u2192 ${HOOK_MATCHER})`);
@@ -4311,7 +4456,7 @@ async function runHooksCommand(args) {
 }
 
 // src/cli-verbs.ts
-import path9 from "path";
+import path10 from "path";
 
 // src/cli-client.ts
 import { Provenance as Provenance2 } from "@neat.is/types";
@@ -4339,10 +4484,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path11) {
+    async get(path12) {
       let res;
       try {
-        res = await fetch(`${root}${path11}`, {
+        res = await fetch(`${root}${path12}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -4354,16 +4499,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path11}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path12}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path11, body) {
+    async post(path12, body) {
       let res;
       try {
-        res = await fetch(`${root}${path11}`, {
+        res = await fetch(`${root}${path12}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -4377,7 +4522,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path11}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path12}: ${text}`,
           text
         );
       }
@@ -4391,12 +4536,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path11 = projectPath(
+  const path12 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path11);
+    const result = await client.get(path12);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -4422,12 +4567,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path11 = projectPath(
+  const path12 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path11);
+    const result = await client.get(path12);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -4461,12 +4606,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path11 = projectPath(
+  const path12 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path11);
+    const result = await client.get(path12);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -4558,9 +4703,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path11 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path12 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path11);
+    const body = await client.get(path12);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -4754,6 +4899,9 @@ function formatDivergenceLine(d) {
   switch (d.type) {
     case "missing-observed":
     case "missing-extracted":
+      if (d.column) {
+        return `  \u2022 [${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
       return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014 confidence ${d.confidence.toFixed(2)}`;
     case "version-mismatch":
       return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared ${d.extractedVersion}, observed engine ${d.observedVersion} (${d.compatibility})`;
@@ -4850,7 +4998,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path9.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path10.sep}`)) {
       return entry2;
     }
   }
@@ -5297,15 +5445,15 @@ async function buildPatchSections(services, project) {
   for (const svc of services) {
     const installer = await pickInstaller(svc.dir);
     if (!installer) continue;
-    const plan3 = await installer.plan(svc.dir, { project });
-    if (isEmptyPlan(plan3) && !plan3.libOnly && plan3.runtimeKind === void 0) continue;
-    sections.push({ installer: installer.name, plan: plan3 });
+    const plan4 = await installer.plan(svc.dir, { project });
+    if (isEmptyPlan(plan4) && !plan4.libOnly && plan4.runtimeKind === void 0) continue;
+    sections.push({ installer: installer.name, plan: plan4 });
   }
   return sections;
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await fs8.stat(opts.scanPath).catch(() => null);
+  const stat = await fs9.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -5314,13 +5462,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = path10.join(opts.scanPath, "neat.patch");
+  const patchPath = path11.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await fs8.writeFile(patchPath, patch, "utf8");
+    await fs9.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = path10.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await fs8.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = path11.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await fs9.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -5331,9 +5479,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    path10.join(opts.scanPath, "neat-out")
+    path11.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = path10.join(path10.dirname(opts.outPath), path10.basename(projectPaths.errorsPath));
+  const errorsPath = path11.join(path11.dirname(opts.outPath), path11.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -5412,7 +5560,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await fs8.writeFile(patchPath, patch, "utf8");
+      await fs9.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -5452,9 +5600,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return path10.resolve(override);
+  if (override && override.length > 0) return path11.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path10.join(home, ".claude.json");
+  return path11.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -5466,7 +5614,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await fs8.readFile(target, "utf8"));
+      existing = JSON.parse(await fs9.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -5478,8 +5626,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await fs8.mkdir(path10.dirname(target), { recursive: true });
-    await fs8.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs9.mkdir(path11.dirname(target), { recursive: true });
+    await fs9.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -5531,7 +5679,7 @@ async function main() {
   }
   const cmd = argvParsed.positional[0];
   const parsed = { ...argvParsed, positional: argvParsed.positional.slice(1) };
-  const { positional, apply: apply3, dryRun, noInstall } = parsed;
+  const { positional, apply: apply4, dryRun, noInstall } = parsed;
   const project = parsed.project ?? DEFAULT_PROJECT;
   if (cmd === "init") {
     const target = positional[0];
@@ -5540,22 +5688,22 @@ async function main() {
       usage2();
       process.exit(2);
     }
-    if (apply3 && dryRun) {
+    if (apply4 && dryRun) {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = path10.resolve(target);
+    const scanPath = path11.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : path10.basename(scanPath);
+    const projectName = projectExplicit ? project : path11.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, path10.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = path10.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, path11.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = path11.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
       project: projectName,
       projectExplicit,
-      apply: apply3,
+      apply: apply4,
       dryRun,
       noInstall,
       verbose: parsed.verbose
@@ -5570,21 +5718,21 @@ async function main() {
       usage2();
       process.exit(2);
     }
-    const scanPath = path10.resolve(target);
-    const stat = await fs8.stat(scanPath).catch(() => null);
+    const scanPath = path11.resolve(target);
+    const stat = await fs9.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, path10.join(scanPath, "neat-out"));
-    const outPath = path10.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = path10.resolve(
-      process.env.NEAT_ERRORS_PATH ?? path10.join(path10.dirname(outPath), path10.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, path11.join(scanPath, "neat-out"));
+    const outPath = path11.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = path11.resolve(
+      process.env.NEAT_ERRORS_PATH ?? path11.join(path11.dirname(outPath), path11.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = path10.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? path10.join(path10.dirname(outPath), path10.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = path11.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? path11.join(path11.dirname(outPath), path11.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path10.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path11.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -5593,7 +5741,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? path10.resolve(process.env.NEAT_HOME) : path10.join(os2.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? path11.resolve(process.env.NEAT_HOME) : path11.join(os2.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -5770,11 +5918,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = path10.resolve(cmd);
-  const stat = await fs8.stat(scanPath).catch(() => null);
+  const scanPath = path11.resolve(cmd);
+  const stat = await fs9.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : path10.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : path11.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,