@neat.is/core 0.7.4 → 0.7.5

package/dist/{chunk-UU4XKSTO.js → chunk-KB4HRB6N.js}

@@ -7662,6 +7662,55 @@ function columnsFromClassBody(body) {
   }
   return out;
 }
+function foreignKeyParentTable(call) {
+  const fn = call.childForFieldName("function");
+  const t = fn?.text;
+  if (!t) return null;
+  const base = t.includes(".") ? t.slice(t.lastIndexOf(".") + 1) : t;
+  if (base !== "ForeignKey") return null;
+  const target = firstPositionalString(call);
+  if (!target) return null;
+  const parts = target.split(".");
+  if (parts.length < 2) return null;
+  return parts[parts.length - 2];
+}
+function sqlalchemyForeignKeys(file, serviceDir) {
+  if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource6(makePyParser4(), file.content);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  walk3(tree.rootNode, (node) => {
+    if (node.type !== "class_definition") return;
+    const body = node.childForFieldName("body");
+    const nameNode = node.childForFieldName("name");
+    if (!body || !nameNode) return;
+    const explicit = explicitTablename(body);
+    if (explicit === "computed") return;
+    let childTable = null;
+    if (explicit) childTable = explicit.name;
+    else if (extendsFlaskModel(node)) childTable = flaskSqlalchemyTableName(nameNode.text);
+    if (!childTable) return;
+    walk3(body, (n) => {
+      if (n.type !== "call") return;
+      const parentTable = foreignKeyParentTable(n);
+      if (!parentTable) return;
+      const key = `${childTable}->${parentTable}`;
+      if (seen.has(key)) return;
+      seen.add(key);
+      const line = n.startPosition.row + 1;
+      out.push({
+        childTable,
+        parentTable,
+        evidence: {
+          file: path35.relative(serviceDir, file.path),
+          line,
+          snippet: snippet(file.content, line)
+        }
+      });
+    });
+  });
+  return out;
+}
 function sqlalchemyEndpointsFromFile(file, serviceDir) {
   if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource6(makePyParser4(), file.content);
@@ -8005,6 +8054,92 @@ function drizzleEndpointsFromFile(file, serviceDir) {
   walk6(tree.rootNode);
   return out;
 }
+function enclosingVarName(call) {
+  let node = call;
+  while (node?.parent) {
+    const parent = node.parent;
+    if (parent.type === "variable_declarator") {
+      const name = parent.childForFieldName("name");
+      return name?.type === "identifier" ? name.text : null;
+    }
+    if (parent.type === "call_expression" || parent.type === "member_expression") {
+      node = parent;
+      continue;
+    }
+    return null;
+  }
+  return null;
+}
+function collectDrizzleTables(root) {
+  const tables = [];
+  const varToTable = /* @__PURE__ */ new Map();
+  const walk6 = (node) => {
+    if (node.type === "call_expression") {
+      const fn = node.childForFieldName("function");
+      if (fn?.type === "identifier" && TABLE_BUILDERS.has(fn.text)) {
+        const args = node.childForFieldName("arguments");
+        const argNodes = args ? namedChildren3(args) : [];
+        const tableName = stringLiteralText2(argNodes[0] ?? null);
+        const obj = argNodes[1]?.type === "object" ? argNodes[1] : null;
+        if (tableName) {
+          tables.push({ tableName, object: obj });
+          const varName = enclosingVarName(node);
+          if (varName) varToTable.set(varName, tableName);
+        }
+      }
+    }
+    for (const c of namedChildren3(node)) walk6(c);
+  };
+  walk6(root);
+  return { tables, varToTable };
+}
+function referencesTargetVar(call) {
+  const fn = call.childForFieldName("function");
+  if (fn?.type !== "member_expression") return null;
+  if (fn.childForFieldName("property")?.text !== "references") return null;
+  const args = call.childForFieldName("arguments");
+  const first = args ? namedChildren3(args)[0] ?? null : null;
+  if (first?.type !== "arrow_function") return null;
+  const body = first.childForFieldName("body");
+  if (body?.type !== "member_expression") return null;
+  const obj = body.childForFieldName("object");
+  return obj?.type === "identifier" ? obj.text : null;
+}
+function drizzleForeignKeys(file, serviceDir) {
+  if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource3(parserForExt(path37.extname(file.path)), file.content);
+  const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const table of tables) {
+    if (!table.object) continue;
+    const walk6 = (node) => {
+      if (node.type === "call_expression") {
+        const targetVar = referencesTargetVar(node);
+        const parentTable = targetVar ? varToTable.get(targetVar) : void 0;
+        if (parentTable) {
+          const key = `${table.tableName}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            const line = node.startPosition.row + 1;
+            out.push({
+              childTable: table.tableName,
+              parentTable,
+              evidence: {
+                file: path37.relative(serviceDir, file.path),
+                line,
+                snippet: snippet(file.content, line)
+              }
+            });
+          }
+        }
+      }
+      for (const c of namedChildren3(node)) walk6(c);
+    };
+    walk6(table.object);
+  }
+  return out;
+}
 
 // src/extract/calls/prisma.ts
 import path38 from "path";
@@ -8132,6 +8267,96 @@ async function prismaColumnEndpoints(serviceDir) {
   if (!content) return [];
   return prismaColumnsFromSchema({ path: schemaPath, content }, serviceDir);
 }
+function buildModelTableMap(lines) {
+  const map = /* @__PURE__ */ new Map();
+  let current = null;
+  let depth = 0;
+  for (const raw of lines) {
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { model: header[1], table: header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) {
+          map.set(current.model, current.table);
+          current = null;
+        }
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed.startsWith("@@")) {
+      const m = trimmed.match(/@@map\(\s*"([^"]+)"\s*\)/);
+      if (m) current.table = m[1];
+    }
+    if (depth <= 0) {
+      map.set(current.model, current.table);
+      current = null;
+    }
+  }
+  if (current) map.set(current.model, current.table);
+  return map;
+}
+function prismaForeignKeysFromSchema(file, serviceDir) {
+  const content = file.content;
+  if (!/\bmodel\s+[A-Za-z_]\w*\s*\{/.test(content)) return [];
+  const lines = content.split("\n");
+  const modelToTable = buildModelTableMap(lines);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  let current = null;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const lineNo = i + 1;
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { table: modelToTable.get(header[1]) ?? header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) current = null;
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const closing = depth <= 0;
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed && !trimmed.startsWith("@@") && !trimmed.startsWith("}")) {
+      const fm = trimmed.match(/^([A-Za-z_]\w*)\s+([A-Za-z_]\w*)/);
+      if (fm && /@relation\b[^)]*\bfields\s*:/.test(trimmed)) {
+        const parentTable = modelToTable.get(fm[2]);
+        if (parentTable) {
+          const key = `${current.table}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            out.push({
+              childTable: current.table,
+              parentTable,
+              evidence: {
+                file: path38.relative(serviceDir, file.path),
+                line: lineNo,
+                snippet: snippet(content, lineNo)
+              }
+            });
+          }
+        }
+      }
+    }
+    if (closing) current = null;
+  }
+  return out;
+}
+async function prismaForeignKeys(serviceDir) {
+  const schemaPath = await findFirst(serviceDir, [
+    path38.join("prisma", "schema.prisma"),
+    "schema.prisma"
+  ]);
+  if (!schemaPath) return [];
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  return prismaForeignKeysFromSchema({ path: schemaPath, content }, serviceDir);
+}
 
 // src/extract/calls/go.ts
 import path39 from "path";
@@ -8306,16 +8531,80 @@ async function addCallEdges(graph, services) {
   };
 }
 
+// src/extract/table-edges.ts
+import {
+  EdgeType as EdgeType15,
+  NodeType as NodeType16,
+  Provenance as Provenance15,
+  confidenceForExtracted as confidenceForExtracted12,
+  extractedEdgeId as extractedEdgeId9,
+  infraId as infraId13
+} from "@neat.is/types";
+async function addTableEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const refs = [];
+    for (const file of files) {
+      try {
+        refs.push(...drizzleForeignKeys(file, service.dir));
+        refs.push(...sqlalchemyForeignKeys(file, service.dir));
+      } catch (err) {
+        recordExtractionError("foreign-key extraction", file.path, err);
+      }
+    }
+    try {
+      refs.push(...await prismaForeignKeys(service.dir));
+    } catch (err) {
+      recordExtractionError("prisma foreign-key extraction", service.dir, err);
+    }
+    for (const ref of refs) {
+      const childId = infraId13("sql-table", ref.childTable);
+      const parentId = infraId13("sql-table", ref.parentTable);
+      if (childId === parentId) continue;
+      nodesAdded += ensureTableNode(graph, childId, ref.childTable);
+      nodesAdded += ensureTableNode(graph, parentId, ref.parentTable);
+      const edgeId = extractedEdgeId9(childId, parentId, EdgeType15.REFERENCES);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: childId,
+        target: parentId,
+        type: EdgeType15.REFERENCES,
+        provenance: Provenance15.EXTRACTED,
+        confidence: confidenceForExtracted12("structural"),
+        evidence: ref.evidence
+      };
+      graph.addEdgeWithKey(edgeId, childId, parentId, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+function ensureTableNode(graph, id, name) {
+  if (graph.hasNode(id)) return 0;
+  const node = {
+    id,
+    type: NodeType16.InfraNode,
+    name,
+    provider: "self",
+    kind: "sql-table"
+  };
+  graph.addNode(id, node);
+  return 1;
+}
+
 // src/extract/infra/docker-compose.ts
 import path40 from "path";
-import { EdgeType as EdgeType15, Provenance as Provenance16, confidenceForExtracted as confidenceForExtracted13 } from "@neat.is/types";
+import { EdgeType as EdgeType16, Provenance as Provenance17, confidenceForExtracted as confidenceForExtracted14 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
-import { NodeType as NodeType16, Provenance as Provenance15, confidenceForExtracted as confidenceForExtracted12, infraId as infraId13 } from "@neat.is/types";
+import { NodeType as NodeType17, Provenance as Provenance16, confidenceForExtracted as confidenceForExtracted13, infraId as infraId14 } from "@neat.is/types";
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: infraId13(kind, name),
-    type: NodeType16.InfraNode,
+    id: infraId14(kind, name),
+    type: NodeType17.InfraNode,
     name,
     provider,
     kind,
@@ -8359,8 +8648,8 @@ function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provide
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: Provenance15.EXTRACTED,
-      confidence: confidenceForExtracted12("structural"),
+      provenance: Provenance16.EXTRACTED,
+      confidence: confidenceForExtracted13("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -8427,15 +8716,15 @@ async function addComposeInfra(graph, scanPath, services) {
     for (const dep of dependsOnList(svc.depends_on)) {
       const targetId = composeNameToNodeId.get(dep);
       if (!targetId) continue;
-      const edgeId = extractedEdgeId(sourceId, targetId, EdgeType15.DEPENDS_ON);
+      const edgeId = extractedEdgeId(sourceId, targetId, EdgeType16.DEPENDS_ON);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: sourceId,
         target: targetId,
-        type: EdgeType15.DEPENDS_ON,
-        provenance: Provenance16.EXTRACTED,
-        confidence: confidenceForExtracted13("structural"),
+        type: EdgeType16.DEPENDS_ON,
+        provenance: Provenance17.EXTRACTED,
+        confidence: confidenceForExtracted14("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -8448,7 +8737,7 @@ async function addComposeInfra(graph, scanPath, services) {
 // src/extract/infra/dockerfile.ts
 import path41 from "path";
 import { promises as fs17 } from "fs";
-import { EdgeType as EdgeType16, Provenance as Provenance17, confidenceForExtracted as confidenceForExtracted14 } from "@neat.is/types";
+import { EdgeType as EdgeType17, Provenance as Provenance18, confidenceForExtracted as confidenceForExtracted15 } from "@neat.is/types";
 function readDockerfile(content) {
   let image = null;
   const ports = [];
@@ -8507,15 +8796,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     );
     nodesAdded += fn;
     edgesAdded += fe;
-    const edgeId = extractedEdgeId(fileNodeId, node.id, EdgeType16.RUNS_ON);
+    const edgeId = extractedEdgeId(fileNodeId, node.id, EdgeType17.RUNS_ON);
     if (!graph.hasEdge(edgeId)) {
       const edge = {
         id: edgeId,
         source: fileNodeId,
         target: node.id,
-        type: EdgeType16.RUNS_ON,
-        provenance: Provenance17.EXTRACTED,
-        confidence: confidenceForExtracted14("structural"),
+        type: EdgeType17.RUNS_ON,
+        provenance: Provenance18.EXTRACTED,
+        confidence: confidenceForExtracted15("structural"),
         evidence: {
           file: evidenceFile,
           ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
@@ -8530,15 +8819,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         graph.addNode(portNode.id, portNode);
         nodesAdded++;
       }
-      const portEdgeId = extractedEdgeId(fileNodeId, portNode.id, EdgeType16.CONNECTS_TO);
+      const portEdgeId = extractedEdgeId(fileNodeId, portNode.id, EdgeType17.CONNECTS_TO);
       if (graph.hasEdge(portEdgeId)) continue;
       const portEdge = {
         id: portEdgeId,
         source: fileNodeId,
         target: portNode.id,
-        type: EdgeType16.CONNECTS_TO,
-        provenance: Provenance17.EXTRACTED,
-        confidence: confidenceForExtracted14("structural"),
+        type: EdgeType17.CONNECTS_TO,
+        provenance: Provenance18.EXTRACTED,
+        confidence: confidenceForExtracted15("structural"),
         evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
       };
       graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
@@ -8551,7 +8840,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 // src/extract/infra/terraform.ts
 import { promises as fs18 } from "fs";
 import path42 from "path";
-import { EdgeType as EdgeType17, Provenance as Provenance18, confidenceForExtracted as confidenceForExtracted15 } from "@neat.is/types";
+import { EdgeType as EdgeType18, Provenance as Provenance19, confidenceForExtracted as confidenceForExtracted16 } from "@neat.is/types";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
@@ -8632,16 +8921,16 @@ async function addTerraformResources(graph, scanPath) {
         if (!target) continue;
         if (seen.has(target.nodeId)) continue;
         seen.add(target.nodeId);
-        const edgeId = extractedEdgeId(resource.nodeId, target.nodeId, EdgeType17.DEPENDS_ON);
+        const edgeId = extractedEdgeId(resource.nodeId, target.nodeId, EdgeType18.DEPENDS_ON);
         if (graph.hasEdge(edgeId)) continue;
         const line = lineAt2(content, resource.bodyOffset + ref.index);
         const edge = {
           id: edgeId,
           source: resource.nodeId,
           target: target.nodeId,
-          type: EdgeType17.DEPENDS_ON,
-          provenance: Provenance18.EXTRACTED,
-          confidence: confidenceForExtracted15("structural"),
+          type: EdgeType18.DEPENDS_ON,
+          provenance: Provenance19.EXTRACTED,
+          confidence: confidenceForExtracted16("structural"),
           evidence: { file: evidenceFile, line, snippet: key }
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -8711,7 +9000,7 @@ async function addK8sResources(graph, scanPath) {
 import { promises as fs20 } from "fs";
 import path44 from "path";
 import { parse as parseToml2 } from "smol-toml";
-import { EdgeType as EdgeType18, Provenance as Provenance19, confidenceForExtracted as confidenceForExtracted16 } from "@neat.is/types";
+import { EdgeType as EdgeType19, Provenance as Provenance20, confidenceForExtracted as confidenceForExtracted17 } from "@neat.is/types";
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
@@ -8759,8 +9048,8 @@ function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, li
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: Provenance19.EXTRACTED,
-      confidence: confidenceForExtracted16("structural"),
+      provenance: Provenance20.EXTRACTED,
+      confidence: confidenceForExtracted17("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -8821,15 +9110,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       nodesAdded++;
     }
     if (runtimeNode.id !== anchorId) {
-      const runsOnId = extractedEdgeId(anchorId, runtimeNode.id, EdgeType18.RUNS_ON);
+      const runsOnId = extractedEdgeId(anchorId, runtimeNode.id, EdgeType19.RUNS_ON);
       if (!graph.hasEdge(runsOnId)) {
         const edge = {
           id: runsOnId,
           source: anchorId,
           target: runtimeNode.id,
-          type: EdgeType18.RUNS_ON,
-          provenance: Provenance19.EXTRACTED,
-          confidence: confidenceForExtracted16("structural"),
+          type: EdgeType19.RUNS_ON,
+          provenance: Provenance20.EXTRACTED,
+          confidence: confidenceForExtracted17("structural"),
           evidence: {
             file: evidenceFile,
             ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
@@ -8843,7 +9132,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        EdgeType18.CONNECTS_TO,
+        EdgeType19.CONNECTS_TO,
         "cloudflare-route",
         route,
         evidenceFile,
@@ -8867,7 +9156,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         const result = addResourceEdge(
           graph,
           anchorId,
-          EdgeType18.DEPENDS_ON,
+          EdgeType19.DEPENDS_ON,
           group.kind,
           name,
           evidenceFile,
@@ -8881,7 +9170,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        EdgeType18.DEPENDS_ON,
+        EdgeType19.DEPENDS_ON,
         "cloudflare-cron",
         cron,
         evidenceFile,
@@ -8894,7 +9183,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        EdgeType18.DEPENDS_ON,
+        EdgeType19.DEPENDS_ON,
         "cloudflare-env-var",
         varName,
         evidenceFile,
@@ -8907,15 +9196,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       if (!svc.service) continue;
       const target = workerIndex.get(svc.service);
       if (target && target.anchorId !== anchorId) {
-        const edgeId = extractedEdgeId(anchorId, target.anchorId, EdgeType18.CALLS);
+        const edgeId = extractedEdgeId(anchorId, target.anchorId, EdgeType19.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: anchorId,
             target: target.anchorId,
-            type: EdgeType18.CALLS,
-            provenance: Provenance19.EXTRACTED,
-            confidence: confidenceForExtracted16("structural"),
+            type: EdgeType19.CALLS,
+            provenance: Provenance20.EXTRACTED,
+            confidence: confidenceForExtracted17("structural"),
             evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -8926,7 +9215,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        EdgeType18.DEPENDS_ON,
+        EdgeType19.DEPENDS_ON,
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
@@ -8942,7 +9231,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 // src/extract/infra/vercel.ts
 import { promises as fs21 } from "fs";
 import path45 from "path";
-import { EdgeType as EdgeType19 } from "@neat.is/types";
+import { EdgeType as EdgeType20 } from "@neat.is/types";
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
@@ -9005,12 +9294,12 @@ async function addVercelServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(EdgeType19.RUNS_ON, "vercel", "vercel");
-    for (const cron of config.crons ?? []) add(EdgeType19.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
-    for (const varName of Object.keys(config.env ?? {})) add(EdgeType19.DEPENDS_ON, "vercel-env-var", varName);
-    for (const varName of Object.keys(config.build?.env ?? {})) add(EdgeType19.DEPENDS_ON, "vercel-env-var", varName);
+    add(EdgeType20.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(EdgeType20.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(EdgeType20.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(EdgeType20.DEPENDS_ON, "vercel-env-var", varName);
     for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
-      add(EdgeType19.CONNECTS_TO, "vercel-route", routeSource(route));
+      add(EdgeType20.CONNECTS_TO, "vercel-route", routeSource(route));
     }
   }
   return { nodesAdded, edgesAdded };
@@ -9020,7 +9309,7 @@ async function addVercelServices(graph, services, scanPath) {
 import { promises as fs22 } from "fs";
 import path46 from "path";
 import { parse as parseToml3 } from "smol-toml";
-import { EdgeType as EdgeType20 } from "@neat.is/types";
+import { EdgeType as EdgeType21 } from "@neat.is/types";
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
@@ -9066,9 +9355,9 @@ async function addRailwayServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(EdgeType20.RUNS_ON, "railway", "railway");
-    add(EdgeType20.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
-    add(EdgeType20.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+    add(EdgeType21.RUNS_ON, "railway", "railway");
+    add(EdgeType21.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(EdgeType21.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
   }
   return { nodesAdded, edgesAdded };
 }
@@ -9077,7 +9366,7 @@ async function addRailwayServices(graph, services, scanPath) {
 import { promises as fs23 } from "fs";
 import path47 from "path";
 import { parse as parseToml4 } from "smol-toml";
-import { EdgeType as EdgeType21 } from "@neat.is/types";
+import { EdgeType as EdgeType22 } from "@neat.is/types";
 async function readSupabaseConfig(dir) {
   const relFile = path47.join("supabase", "config.toml");
   const abs = path47.join(dir, relFile);
@@ -9125,10 +9414,10 @@ async function addSupabaseProjects(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(EdgeType21.RUNS_ON, "supabase", "supabase");
-    for (const fn of Object.keys(config.functions ?? {})) add(EdgeType21.DEPENDS_ON, "supabase-function", fn);
-    if (config.storage) add(EdgeType21.DEPENDS_ON, "supabase-storage", "storage");
-    if (config.auth) add(EdgeType21.DEPENDS_ON, "supabase-auth", "auth");
+    add(EdgeType22.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(EdgeType22.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(EdgeType22.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(EdgeType22.DEPENDS_ON, "supabase-auth", "auth");
   }
   return { nodesAdded, edgesAdded };
 }
@@ -9155,11 +9444,11 @@ import path49 from "path";
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
 import path48 from "path";
-import { NodeType as NodeType17, Provenance as Provenance20 } from "@neat.is/types";
+import { NodeType as NodeType18, Provenance as Provenance21 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== NodeType17.FileNode) return;
+    if (attrs.type !== NodeType18.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -9172,7 +9461,7 @@ function retireEdgesByFile(graph, file) {
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance20.EXTRACTED) return;
+    if (edge.provenance !== Provenance21.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -9185,7 +9474,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== Provenance20.EXTRACTED) return;
+    if (edge.provenance !== Provenance21.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (path48.isAbsolute(evidenceFile)) {
@@ -9216,6 +9505,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const routePhase = await addRoutes(graph, services);
   const grpcPhase = await addGrpcMethods(graph, services);
   const phase4 = await addCallEdges(graph, services);
+  const tableEdges = await addTableEdges(graph, services);
   const phase5 = await addInfra(graph, scanPath, services);
   const ghostsRetired = retireExtractedEdgesByMissingFile(
     graph,
@@ -9255,8 +9545,8 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
     }
   }
   const result = {
-    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
-    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + tableEdges.nodesAdded + phase5.nodesAdded,
+    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + tableEdges.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
@@ -9281,22 +9571,22 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 import {
   databaseId as databaseId3,
   DivergenceResultSchema,
-  EdgeType as EdgeType22,
-  NodeType as NodeType18,
+  EdgeType as EdgeType23,
+  NodeType as NodeType19,
   parseEdgeId,
   parseFileId,
-  Provenance as Provenance21,
+  Provenance as Provenance22,
   serviceId as serviceId5
 } from "@neat.is/types";
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
 function bucketSourceFor(graph, edge) {
-  if (edge.type !== EdgeType22.CONNECTS_TO) return edge.source;
+  if (edge.type !== EdgeType23.CONNECTS_TO) return edge.source;
   const parsed = parseFileId(edge.source);
   if (!parsed || !graph.hasNode(edge.target)) return edge.source;
   const target = graph.getNodeAttributes(edge.target);
-  if (target.type !== NodeType18.DatabaseNode) return edge.source;
+  if (target.type !== NodeType19.DatabaseNode) return edge.source;
   return serviceId5(parsed.service);
 }
 function bucketEdges(graph) {
@@ -9309,17 +9599,17 @@ function bucketEdges(graph) {
     const key = bucketKey(source, e.target, e.type);
     const cur = buckets2.get(key) ?? { source, target: e.target, type: e.type };
     switch (provenance) {
-      case Provenance21.EXTRACTED:
+      case Provenance22.EXTRACTED:
         cur.extracted = e;
         break;
-      case Provenance21.OBSERVED:
+      case Provenance22.OBSERVED:
         cur.observed = e;
         break;
-      case Provenance21.INFERRED:
+      case Provenance22.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === Provenance21.STALE) cur.stale = e;
+        if (e.provenance === Provenance22.STALE) cur.stale = e;
     }
     buckets2.set(key, cur);
   });
@@ -9328,17 +9618,17 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType18.FrontierNode;
+  return attrs.type === NodeType19.FrontierNode;
 }
 function nodeIsWebsocketChannel(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType18.WebSocketChannelNode;
+  return attrs.type === NodeType19.WebSocketChannelNode;
 }
 function nodeIsSymbol(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType18.SymbolNode;
+  return attrs.type === NodeType19.SymbolNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -9358,14 +9648,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  EdgeType22.CALLS,
-  EdgeType22.CONNECTS_TO,
-  EdgeType22.PUBLISHES_TO,
-  EdgeType22.CONSUMES_FROM
+  EdgeType23.CALLS,
+  EdgeType23.CONNECTS_TO,
+  EdgeType23.PUBLISHES_TO,
+  EdgeType23.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === EdgeType22.CONTAINS) return out;
+  if (bucket.type === EdgeType23.CONTAINS) return out;
   if (nodeIsSymbol(graph, bucket.source) || nodeIsSymbol(graph, bucket.target)) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
@@ -9407,7 +9697,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === EdgeType22.CONFIGURED_BY && e.provenance === Provenance21.EXTRACTED) {
+    if (e.type === EdgeType23.CONFIGURED_BY && e.provenance === Provenance22.EXTRACTED) {
       return true;
     }
   }
@@ -9420,10 +9710,10 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType22.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance21.OBSERVED) continue;
+    if (edge.type !== EdgeType23.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance22.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType18.DatabaseNode) continue;
+    if (target.type !== NodeType19.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -9445,10 +9735,10 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== EdgeType22.CONNECTS_TO) continue;
-    if (edge.provenance !== Provenance21.OBSERVED) continue;
+    if (edge.type !== EdgeType23.CONNECTS_TO) continue;
+    if (edge.provenance !== Provenance22.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType18.DatabaseNode) continue;
+    if (target.type !== NodeType19.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -9564,13 +9854,13 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type === NodeType18.ServiceNode) {
+    if (n.type === NodeType19.ServiceNode) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
       return;
     }
-    if (n.type === NodeType18.InfraNode && n.kind === "sql-table") {
+    if (n.type === NodeType19.InfraNode && n.kind === "sql-table") {
       for (const d of detectColumnDrift(n)) all.push(d);
     }
   });
@@ -9616,7 +9906,7 @@ function computeDivergences(graph, opts = {}) {
 // src/persist.ts
 import { promises as fs24 } from "fs";
 import path50 from "path";
-import { NodeType as NodeType19, Provenance as Provenance22, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+import { NodeType as NodeType20, Provenance as Provenance23, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 6;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -9640,7 +9930,7 @@ function migrateV5ToV6(payload) {
   if (Array.isArray(nodes)) {
     for (const node of nodes) {
       const attrs = node.attributes;
-      if (!attrs || attrs.type !== NodeType19.InfraNode) continue;
+      if (!attrs || attrs.type !== NodeType20.InfraNode) continue;
       if (attrs.kind !== "sql-table" && attrs.kind !== "supabase-table") continue;
       if (!Array.isArray(attrs.columns)) attrs.columns = [];
     }
@@ -9653,7 +9943,7 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = Provenance22.OBSERVED;
+      attrs.provenance = Provenance23.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
@@ -11051,14 +11341,14 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 }
 
 // src/connectors/index.ts
-import { NodeType as NodeType20, parseFileId as parseFileId2, Provenance as Provenance23 } from "@neat.is/types";
+import { NodeType as NodeType21, parseFileId as parseFileId2, Provenance as Provenance24 } from "@neat.is/types";
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== Provenance23.EXTRACTED) continue;
+    if (edge.provenance !== Provenance24.EXTRACTED) continue;
     const parsed = parseFileId2(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
@@ -11070,7 +11360,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== NodeType20.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== NodeType21.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -11250,7 +11540,11 @@ var JUNCTION_DEFAULT_RATE_LIMITS = {
   // connector add/remove/test` (provision/deprovision/validate), never a poll
   // loop, so this bucket is exercised a handful of times per command. Kept
   // conservative pending a documented Drains-API rate limit.
-  vercel: { capacity: 20, refillMs: 5e3 }
+  vercel: { capacity: 20, refillMs: 5e3 },
+  // Render's REST API (api-docs.render.com/reference/rate-limiting) isn't
+  // pinned here to a single confirmed number — this is a conservative
+  // placeholder pending a live project, matching the other pull providers.
+  render: { capacity: 30, refillMs: 1e4 }
 };
 var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
 function defaultRateLimitFor(provider) {
@@ -11646,23 +11940,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 }
 
 // src/connectors/supabase/resolve.ts
-import { EdgeType as EdgeType23, infraId as infraId14 } from "@neat.is/types";
+import { EdgeType as EdgeType24, infraId as infraId15 } from "@neat.is/types";
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = infraId14(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = infraId15(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: EdgeType23.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: EdgeType24.CALLS };
     }
-    const bareResourceId = infraId14(signal.targetKind, signal.targetName);
+    const bareResourceId = infraId15(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: EdgeType23.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: EdgeType24.CALLS };
     }
-    const projectLevelId = infraId14("supabase", config.nodeRef);
+    const projectLevelId = infraId15("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: EdgeType23.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: EdgeType24.CALLS };
     }
     return null;
   };
@@ -11754,7 +12048,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 }
 
 // src/connectors/railway/index.ts
-import { EdgeType as EdgeType24, NodeType as NodeType21, serviceId as serviceId6 } from "@neat.is/types";
+import { EdgeType as EdgeType25, NodeType as NodeType22, serviceId as serviceId6 } from "@neat.is/types";
 
 // src/connectors/railway/client.ts
 var DEFAULT_RAILWAY_API_URL = "https://backboard.railway.com/graphql/v2";
@@ -11904,7 +12198,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType21.RouteNode) return;
+    if (node.type !== NodeType22.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -12008,12 +12302,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: EdgeType24.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: EdgeType25.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: serviceId6(peerName), serviceName, edgeType: EdgeType24.CONNECTS_TO };
+      return { targetNodeId: serviceId6(peerName), serviceName, edgeType: EdgeType25.CONNECTS_TO };
     }
     return null;
   };
@@ -12195,7 +12489,7 @@ function mapLogEntriesToSignals(entries) {
 }
 
 // src/connectors/firebase/resolve.ts
-import { NodeType as NodeType22, EdgeType as EdgeType25 } from "@neat.is/types";
+import { NodeType as NodeType23, EdgeType as EdgeType26 } from "@neat.is/types";
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -12210,7 +12504,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType22.RouteNode) return;
+    if (node.type !== NodeType23.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -12242,7 +12536,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: EdgeType25.CALLS
+      edgeType: EdgeType26.CALLS
     };
   };
 }
@@ -12265,7 +12559,7 @@ function createFirebaseConnector(graph, serviceMap) {
 }
 
 // src/connectors/cloudflare/connector.ts
-import { EdgeType as EdgeType26, NodeType as NodeType23, fileId as fileId4, infraId as infraId15 } from "@neat.is/types";
+import { EdgeType as EdgeType27, NodeType as NodeType24, fileId as fileId4, infraId as infraId16 } from "@neat.is/types";
 
 // src/connectors/cloudflare/client.ts
 import { randomUUID } from "crypto";
@@ -12424,7 +12718,7 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === NodeType23.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === NodeType24.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
@@ -12436,7 +12730,7 @@ function findMatchingRouteNode(graph, serviceName, method, path56) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== NodeType23.RouteNode || a.service !== serviceName) return;
+    if (a.type !== NodeType24.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -12459,7 +12753,7 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: EdgeType26.CALLS
+        edgeType: EdgeType27.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -12468,13 +12762,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: EdgeType26.CALLS
+        edgeType: EdgeType27.CALLS
       };
     }
     return {
-      targetNodeId: infraId15("cloudflare-worker", scriptName),
+      targetNodeId: infraId16("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: EdgeType26.CALLS,
+      edgeType: EdgeType27.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -12656,14 +12950,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 }
 
 // src/connectors/neon/resolve.ts
-import { EdgeType as EdgeType27, infraId as infraId16 } from "@neat.is/types";
+import { EdgeType as EdgeType28, infraId as infraId17 } from "@neat.is/types";
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: infraId16("sql-table", signal.targetName),
+      targetNodeId: infraId17("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: EdgeType27.CALLS,
+      edgeType: EdgeType28.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -12701,6 +12995,400 @@ function createNeonConnector(config, deps = {}) {
   };
 }
 
+// src/connectors/cloud-run/client.ts
+function cloudRunRequestLogName(projectId) {
+  return `projects/${projectId}/logs/run.googleapis.com%2Frequests`;
+}
+function buildCloudRunEntriesFilter(projectId, sinceIso) {
+  return [
+    `logName = "${cloudRunRequestLogName(projectId)}"`,
+    `resource.type = "${CLOUD_RUN_RESOURCE_TYPE}"`,
+    'httpRequest.requestMethod != ""',
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var CLOUD_RUN_RESOURCE_TYPE = "cloud_run_revision";
+var DEFAULT_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL2 = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE2 = 1e3;
+var MAX_PAGES2 = 20;
+async function fetchCloudRunRequestLogEntries(creds, sinceIso, apiUrl = ENTRIES_LIST_URL2) {
+  const filter = buildCloudRunEntriesFilter(creds.projectId, sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES2; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE2,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      apiUrl,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id — one customer's Cloud Logging quota is
+      // scoped per GCP project (ADR-131's per-(provider, accountKey) rate-limit
+      // bucket), the same key Firebase's connector uses.
+      { provider: "cloud-run", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    if (Array.isArray(json.entries)) out.push(...json.entries);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/types.ts
+function readCloudRunCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("cloud-run connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("cloud-run connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var CLOUD_RUN_TARGET_KIND = "cloud_run_revision";
+var FIELD_SEP2 = "\0";
+function packCloudRunTargetName(identity) {
+  return [identity.serviceName, identity.method, identity.path].join(FIELD_SEP2);
+}
+function parseCloudRunTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP2);
+  if (firstSep === -1) return null;
+  const serviceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP2);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path56 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path56) return null;
+  return { serviceName, method, path: path56 };
+}
+
+// src/connectors/cloud-run/map.ts
+var CLOUD_RUN_RESOURCE_TYPE2 = "cloud_run_revision";
+function pathFromRequestUrl2(requestUrl) {
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD4 = 500;
+function mapLogEntryToSignal2(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  if (entry.resource?.type !== CLOUD_RUN_RESOURCE_TYPE2) return null;
+  const serviceName = entry.resource?.labels?.["service_name"];
+  if (typeof serviceName !== "string" || serviceName.length === 0) return null;
+  const req = entry.httpRequest;
+  if (!req) return null;
+  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path56 = pathFromRequestUrl2(req.requestUrl);
+  if (path56 === null) return null;
+  const timestamp = entry.timestamp;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
+  return {
+    targetKind: CLOUD_RUN_TARGET_KIND,
+    targetName: packCloudRunTargetName({ serviceName, method, path: path56 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals2(entries) {
+  const out = [];
+  for (const entry of entries) {
+    const signal = mapLogEntryToSignal2(entry);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/resolve.ts
+import { EdgeType as EdgeType29, NodeType as NodeType25, infraId as infraId18 } from "@neat.is/types";
+var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
+function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
+  let found = null;
+  graph.forEachNode((_id, attrs) => {
+    if (found) return;
+    const node = attrs;
+    if (node.type !== NodeType25.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName || !route.pathTemplate) return;
+    if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
+    const routeMethod = route.method.toUpperCase();
+    if (routeMethod !== "ALL" && routeMethod !== method) return;
+    found = route.id;
+  });
+  return found;
+}
+function createCloudRunResolveTarget(graph, config) {
+  return (signal) => {
+    if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
+    const identity = parseCloudRunTargetName(signal.targetName);
+    if (!identity) return null;
+    const { serviceName: gcpServiceName, method, path: path56 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName];
+    if (mappedService) {
+      const routeNodeId = findMatchingRouteNode2(
+        graph,
+        mappedService,
+        method,
+        normalizePathTemplate(path56)
+      );
+      if (routeNodeId) {
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: EdgeType29.CALLS };
+      }
+    }
+    return {
+      targetNodeId: infraId18(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      serviceName: mappedService ?? gcpServiceName,
+      edgeType: EdgeType29.CALLS,
+      ensureInfraNode: {
+        kind: CLOUD_RUN_SERVICE_INFRA_KIND,
+        name: gcpServiceName,
+        provider: "cloud-run"
+      }
+    };
+  };
+}
+
+// src/connectors/cloud-run/index.ts
+var CloudRunConnector = class {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  config;
+  provider = "cloud-run";
+  async poll(ctx) {
+    const creds = readCloudRunCredentials(ctx.credentials);
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_LOOKBACK_MS2;
+    const sinceIso = boundedSinceIso(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const entries = await fetchCloudRunRequestLogEntries(creds, sinceIso, this.config.apiUrl);
+    return mapLogEntriesToSignals2(entries);
+  }
+};
+function boundedSinceIso(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+function createCloudRunConnector(graph, config = {}) {
+  return {
+    connector: new CloudRunConnector(config),
+    resolveTarget: createCloudRunResolveTarget(graph, config)
+  };
+}
+
+// src/connectors/render/index.ts
+import { EdgeType as EdgeType30, NodeType as NodeType26 } from "@neat.is/types";
+
+// src/connectors/render/types.ts
+function readRenderToken(credentials) {
+  const token = credentials.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("Render connector requires ctx.credentials.token (a Render API key)");
+  }
+  return token;
+}
+function renderLabelValue(entry, name) {
+  if (!Array.isArray(entry.labels)) return void 0;
+  const label = entry.labels.find((l) => l && typeof l === "object" && l.name === name);
+  return label && typeof label.value === "string" ? label.value : void 0;
+}
+
+// src/connectors/render/client.ts
+var DEFAULT_RENDER_API_URL = "https://api.render.com/v1";
+var DEFAULT_RENDER_LOG_LIMIT = 100;
+var RENDER_MAX_LOG_LIMIT = 100;
+var DEFAULT_RENDER_MAX_PAGES = 20;
+var DEFAULT_MAX_LOOKBACK_MS4 = 24 * 60 * 60 * 1e3;
+function clampLimit(limit) {
+  const raw = Math.trunc(limit ?? DEFAULT_RENDER_LOG_LIMIT);
+  if (!Number.isFinite(raw) || raw < 1) return DEFAULT_RENDER_LOG_LIMIT;
+  return Math.min(raw, RENDER_MAX_LOG_LIMIT);
+}
+function boundedRenderStartTime(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+async function fetchRenderLogPage(config, token, startTime, endTime, limit, fetchImpl) {
+  const url = new URL(`${config.apiUrl ?? DEFAULT_RENDER_API_URL}/logs`);
+  url.searchParams.set("ownerId", config.ownerId);
+  url.searchParams.set("resource", config.resourceId);
+  url.searchParams.set("type", "request");
+  url.searchParams.set("startTime", startTime);
+  url.searchParams.set("endTime", endTime);
+  url.searchParams.set("direction", "backward");
+  url.searchParams.set("limit", String(limit));
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: { ...bearerAuthHeader(token) } },
+    { provider: "render", accountKey: config.ownerId, ...fetchImpl ? { fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`Render logs request failed: ${res.status} ${res.statusText}`);
+  }
+  return await res.json();
+}
+async function fetchRenderRequestLogs(config, token, startTime, endTime, fetchImpl) {
+  const limit = clampLimit(config.limit);
+  const maxPages = Math.max(1, Math.trunc(config.maxPages ?? DEFAULT_RENDER_MAX_PAGES));
+  const out = [];
+  let pageStart = startTime;
+  let pageEnd = endTime;
+  for (let page = 0; page < maxPages; page++) {
+    const body = await fetchRenderLogPage(config, token, pageStart, pageEnd, limit, fetchImpl);
+    if (Array.isArray(body.logs)) out.push(...body.logs);
+    if (!body.hasMore || !body.nextStartTime || !body.nextEndTime) break;
+    pageStart = body.nextStartTime;
+    pageEnd = body.nextEndTime;
+  }
+  return out;
+}
+
+// src/connectors/render/index.ts
+var ROUTE_TARGET_KIND2 = "route";
+var UNMATCHED_ROUTE_TARGET_KIND2 = "unmatched-route";
+function buildRenderRouteIndex(graph, serviceName) {
+  const out = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== NodeType26.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    out.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id,
+      path: route.path,
+      line: route.line
+    });
+  });
+  return out;
+}
+function findRenderRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function bucketKey3(method, normalizedPath) {
+  return `${method} ${normalizedPath}`;
+}
+function isHttpErrorStatus2(status) {
+  return status >= 400;
+}
+function upsertBucket2(buckets2, key, isError, timestamp, build) {
+  const existing = buckets2.get(key);
+  if (existing) {
+    existing.callCount += 1;
+    if (isError) existing.errorCount += 1;
+    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
+    return;
+  }
+  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
+}
+function mapRenderRequestLogsToSignals(entries, routeIndex) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entries)) return [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object") continue;
+    if (typeof entry.timestamp !== "string") continue;
+    const method = renderLabelValue(entry, "method");
+    const rawPath = renderLabelValue(entry, "path");
+    if (typeof method !== "string" || method.length === 0) continue;
+    if (typeof rawPath !== "string" || rawPath.length === 0) continue;
+    const methodUpper = method.toUpperCase();
+    const pathOnly = rawPath.split("?")[0];
+    const normalizedPath = normalizePathTemplate(pathOnly);
+    const statusCode = Number.parseInt(renderLabelValue(entry, "statusCode") ?? "", 10);
+    const isError = Number.isFinite(statusCode) && isHttpErrorStatus2(statusCode);
+    const match = findRenderRoute(routeIndex, methodUpper, normalizedPath);
+    if (match) {
+      upsertBucket2(buckets2, `route:${match.routeNodeId}`, isError, entry.timestamp, () => ({
+        targetKind: ROUTE_TARGET_KIND2,
+        targetName: match.routeNodeId,
+        // RouteNode.line is optional in the schema (packages/types/src/
+        // nodes.ts) even though routes.ts always sets it today — skip the
+        // callSite rather than fabricate a line when it's ever absent
+        // (file-awareness.md §6).
+        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
+      }));
+    } else {
+      upsertBucket2(
+        buckets2,
+        `unmatched:${bucketKey3(methodUpper, normalizedPath)}`,
+        isError,
+        entry.timestamp,
+        () => ({
+          targetKind: UNMATCHED_ROUTE_TARGET_KIND2,
+          targetName: bucketKey3(methodUpper, normalizedPath)
+        })
+      );
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso,
+    ...b.callSite ? { callSite: b.callSite } : {}
+  }));
+}
+function createRenderResolveTarget(config) {
+  return (signal) => {
+    if (signal.targetKind === ROUTE_TARGET_KIND2) {
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: EdgeType30.CALLS };
+    }
+    return null;
+  };
+}
+function createRenderConnector(graph, config) {
+  return {
+    provider: "render",
+    async poll(ctx) {
+      const token = readRenderToken(ctx.credentials);
+      const now = /* @__PURE__ */ new Date();
+      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS4;
+      const startTime = boundedRenderStartTime(ctx.since, now, maxLookbackMs);
+      const endTime = now.toISOString();
+      const logs = await fetchRenderRequestLogs(config, token, startTime, endTime);
+      const routeIndex = buildRenderRouteIndex(graph, config.serviceName);
+      return mapRenderRequestLogsToSignals(logs, routeIndex);
+    }
+  };
+}
+
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -12876,6 +13564,71 @@ var PROVIDER_DISPATCH = {
         return { ok: false, reason: `neon telemetry read failed: ${err.message}` };
       }
     }
+  },
+  "cloud-run": {
+    provider: "cloud-run",
+    // Cloud Run reads both projectId and accessToken from the credential; the
+    // single-string form maps to the secret (the token), and the required-fields
+    // check below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createCloudRunConnector(graph, options);
+    },
+    // POST entries:list with pageSize 1 — the exact surface poll() reads, so the
+    // probe checks the actual `logging.logEntries.list` permission the connector
+    // needs. A GET on the lighter logs.list endpoint (as Firebase probes) would
+    // instead check `logging.logs.list`, falsely rejecting a correctly-scoped
+    // custom role that carries only `logging.logEntries.list` (the narrowest
+    // grant docs/connectors/cloud-run.md documents) — the same false-negative
+    // trap Railway's validate avoids by probing its real query. A 2xx means the
+    // token can list log entries; 401/403 means the provider rejected it.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "cloud-run",
+        accountKey: projectId || "validate",
+        url: "https://logging.googleapis.com/v2/entries:list",
+        token: String(credentials.accessToken ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ resourceNames: [`projects/${projectId}`], pageSize: 1 })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  render: {
+    provider: "render",
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token"],
+    requiredOptionFields: ["ownerId", "resourceId", "serviceName"],
+    build(graph, options) {
+      const config = options;
+      return {
+        connector: createRenderConnector(graph, config),
+        resolveTarget: createRenderResolveTarget(config)
+      };
+    },
+    // GET /v1/services?limit=1 — the cheapest read the Render API key
+    // authenticates against (render.com/docs/api). Unlike Railway's GraphQL
+    // gateway, Render is a plain REST API: a live key returns 2xx, a bad one a
+    // 401/403, so authProbe's status-code check is a true verdict here. The
+    // logs query itself also needs an ownerId + resource; `services` needs
+    // neither and still fails 401 on a bad token, so it's the honest probe.
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.apiUrl ?? DEFAULT_RENDER_API_URL;
+      return authProbe({
+        provider: "render",
+        accountKey: cfg.ownerId ?? "validate",
+        url: `${baseUrl}/services?limit=1`,
+        token: String(credentials.token ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
   }
 };
 function vercelCredsFrom(credentials) {
@@ -14058,4 +14811,4 @@ export {
   deprovisionConnector,
   buildApi
 };
-//# sourceMappingURL=chunk-UU4XKSTO.js.map
+//# sourceMappingURL=chunk-KB4HRB6N.js.map