@neat.is/core 0.7.4 → 0.7.5

package/dist/neatd.cjs

@@ -8333,6 +8333,55 @@ function columnsFromClassBody(body) {
   }
   return out;
 }
+function foreignKeyParentTable(call) {
+  const fn = call.childForFieldName("function");
+  const t = fn?.text;
+  if (!t) return null;
+  const base = t.includes(".") ? t.slice(t.lastIndexOf(".") + 1) : t;
+  if (base !== "ForeignKey") return null;
+  const target = firstPositionalString(call);
+  if (!target) return null;
+  const parts = target.split(".");
+  if (parts.length < 2) return null;
+  return parts[parts.length - 2];
+}
+function sqlalchemyForeignKeys(file, serviceDir) {
+  if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource6(makePyParser4(), file.content);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  walk3(tree.rootNode, (node) => {
+    if (node.type !== "class_definition") return;
+    const body = node.childForFieldName("body");
+    const nameNode = node.childForFieldName("name");
+    if (!body || !nameNode) return;
+    const explicit = explicitTablename(body);
+    if (explicit === "computed") return;
+    let childTable = null;
+    if (explicit) childTable = explicit.name;
+    else if (extendsFlaskModel(node)) childTable = flaskSqlalchemyTableName(nameNode.text);
+    if (!childTable) return;
+    walk3(body, (n) => {
+      if (n.type !== "call") return;
+      const parentTable = foreignKeyParentTable(n);
+      if (!parentTable) return;
+      const key = `${childTable}->${parentTable}`;
+      if (seen.has(key)) return;
+      seen.add(key);
+      const line = n.startPosition.row + 1;
+      out.push({
+        childTable,
+        parentTable,
+        evidence: {
+          file: import_node_path35.default.relative(serviceDir, file.path),
+          line,
+          snippet: snippet(file.content, line)
+        }
+      });
+    });
+  });
+  return out;
+}
 function sqlalchemyEndpointsFromFile(file, serviceDir) {
   if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource6(makePyParser4(), file.content);
@@ -8678,6 +8727,92 @@ function drizzleEndpointsFromFile(file, serviceDir) {
   walk6(tree.rootNode);
   return out;
 }
+function enclosingVarName(call) {
+  let node = call;
+  while (node?.parent) {
+    const parent = node.parent;
+    if (parent.type === "variable_declarator") {
+      const name = parent.childForFieldName("name");
+      return name?.type === "identifier" ? name.text : null;
+    }
+    if (parent.type === "call_expression" || parent.type === "member_expression") {
+      node = parent;
+      continue;
+    }
+    return null;
+  }
+  return null;
+}
+function collectDrizzleTables(root) {
+  const tables = [];
+  const varToTable = /* @__PURE__ */ new Map();
+  const walk6 = (node) => {
+    if (node.type === "call_expression") {
+      const fn = node.childForFieldName("function");
+      if (fn?.type === "identifier" && TABLE_BUILDERS.has(fn.text)) {
+        const args = node.childForFieldName("arguments");
+        const argNodes = args ? namedChildren3(args) : [];
+        const tableName = stringLiteralText2(argNodes[0] ?? null);
+        const obj = argNodes[1]?.type === "object" ? argNodes[1] : null;
+        if (tableName) {
+          tables.push({ tableName, object: obj });
+          const varName = enclosingVarName(node);
+          if (varName) varToTable.set(varName, tableName);
+        }
+      }
+    }
+    for (const c of namedChildren3(node)) walk6(c);
+  };
+  walk6(root);
+  return { tables, varToTable };
+}
+function referencesTargetVar(call) {
+  const fn = call.childForFieldName("function");
+  if (fn?.type !== "member_expression") return null;
+  if (fn.childForFieldName("property")?.text !== "references") return null;
+  const args = call.childForFieldName("arguments");
+  const first = args ? namedChildren3(args)[0] ?? null : null;
+  if (first?.type !== "arrow_function") return null;
+  const body = first.childForFieldName("body");
+  if (body?.type !== "member_expression") return null;
+  const obj = body.childForFieldName("object");
+  return obj?.type === "identifier" ? obj.text : null;
+}
+function drizzleForeignKeys(file, serviceDir) {
+  if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource3(parserForExt(import_node_path37.default.extname(file.path)), file.content);
+  const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const table of tables) {
+    if (!table.object) continue;
+    const walk6 = (node) => {
+      if (node.type === "call_expression") {
+        const targetVar = referencesTargetVar(node);
+        const parentTable = targetVar ? varToTable.get(targetVar) : void 0;
+        if (parentTable) {
+          const key = `${table.tableName}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            const line = node.startPosition.row + 1;
+            out.push({
+              childTable: table.tableName,
+              parentTable,
+              evidence: {
+                file: import_node_path37.default.relative(serviceDir, file.path),
+                line,
+                snippet: snippet(file.content, line)
+              }
+            });
+          }
+        }
+      }
+      for (const c of namedChildren3(node)) walk6(c);
+    };
+    walk6(table.object);
+  }
+  return out;
+}
 
 // src/extract/calls/prisma.ts
 init_cjs_shims();
@@ -8806,6 +8941,96 @@ async function prismaColumnEndpoints(serviceDir) {
   if (!content) return [];
   return prismaColumnsFromSchema({ path: schemaPath, content }, serviceDir);
 }
+function buildModelTableMap(lines) {
+  const map = /* @__PURE__ */ new Map();
+  let current = null;
+  let depth = 0;
+  for (const raw of lines) {
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { model: header[1], table: header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) {
+          map.set(current.model, current.table);
+          current = null;
+        }
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed.startsWith("@@")) {
+      const m = trimmed.match(/@@map\(\s*"([^"]+)"\s*\)/);
+      if (m) current.table = m[1];
+    }
+    if (depth <= 0) {
+      map.set(current.model, current.table);
+      current = null;
+    }
+  }
+  if (current) map.set(current.model, current.table);
+  return map;
+}
+function prismaForeignKeysFromSchema(file, serviceDir) {
+  const content = file.content;
+  if (!/\bmodel\s+[A-Za-z_]\w*\s*\{/.test(content)) return [];
+  const lines = content.split("\n");
+  const modelToTable = buildModelTableMap(lines);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  let current = null;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const lineNo = i + 1;
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { table: modelToTable.get(header[1]) ?? header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) current = null;
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const closing = depth <= 0;
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed && !trimmed.startsWith("@@") && !trimmed.startsWith("}")) {
+      const fm = trimmed.match(/^([A-Za-z_]\w*)\s+([A-Za-z_]\w*)/);
+      if (fm && /@relation\b[^)]*\bfields\s*:/.test(trimmed)) {
+        const parentTable = modelToTable.get(fm[2]);
+        if (parentTable) {
+          const key = `${current.table}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            out.push({
+              childTable: current.table,
+              parentTable,
+              evidence: {
+                file: import_node_path38.default.relative(serviceDir, file.path),
+                line: lineNo,
+                snippet: snippet(content, lineNo)
+              }
+            });
+          }
+        }
+      }
+    }
+    if (closing) current = null;
+  }
+  return out;
+}
+async function prismaForeignKeys(serviceDir) {
+  const schemaPath = await findFirst(serviceDir, [
+    import_node_path38.default.join("prisma", "schema.prisma"),
+    "schema.prisma"
+  ]);
+  if (!schemaPath) return [];
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  return prismaForeignKeysFromSchema({ path: schemaPath, content }, serviceDir);
+}
 
 // src/extract/calls/go.ts
 init_cjs_shims();
@@ -8982,21 +9207,79 @@ async function addCallEdges(graph, services) {
   };
 }
 
+// src/extract/table-edges.ts
+init_cjs_shims();
+var import_types31 = require("@neat.is/types");
+async function addTableEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const refs = [];
+    for (const file of files) {
+      try {
+        refs.push(...drizzleForeignKeys(file, service.dir));
+        refs.push(...sqlalchemyForeignKeys(file, service.dir));
+      } catch (err) {
+        recordExtractionError("foreign-key extraction", file.path, err);
+      }
+    }
+    try {
+      refs.push(...await prismaForeignKeys(service.dir));
+    } catch (err) {
+      recordExtractionError("prisma foreign-key extraction", service.dir, err);
+    }
+    for (const ref of refs) {
+      const childId = (0, import_types31.infraId)("sql-table", ref.childTable);
+      const parentId = (0, import_types31.infraId)("sql-table", ref.parentTable);
+      if (childId === parentId) continue;
+      nodesAdded += ensureTableNode(graph, childId, ref.childTable);
+      nodesAdded += ensureTableNode(graph, parentId, ref.parentTable);
+      const edgeId = (0, import_types31.extractedEdgeId)(childId, parentId, import_types31.EdgeType.REFERENCES);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: childId,
+        target: parentId,
+        type: import_types31.EdgeType.REFERENCES,
+        provenance: import_types31.Provenance.EXTRACTED,
+        confidence: (0, import_types31.confidenceForExtracted)("structural"),
+        evidence: ref.evidence
+      };
+      graph.addEdgeWithKey(edgeId, childId, parentId, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+function ensureTableNode(graph, id, name) {
+  if (graph.hasNode(id)) return 0;
+  const node = {
+    id,
+    type: import_types31.NodeType.InfraNode,
+    name,
+    provider: "self",
+    kind: "sql-table"
+  };
+  graph.addNode(id, node);
+  return 1;
+}
+
 // src/extract/infra/index.ts
 init_cjs_shims();
 
 // src/extract/infra/docker-compose.ts
 init_cjs_shims();
 var import_node_path42 = __toESM(require("path"), 1);
-var import_types32 = require("@neat.is/types");
+var import_types33 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
 init_cjs_shims();
-var import_types31 = require("@neat.is/types");
+var import_types32 = require("@neat.is/types");
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: (0, import_types31.infraId)(kind, name),
-    type: import_types31.NodeType.InfraNode,
+    id: (0, import_types32.infraId)(kind, name),
+    type: import_types32.NodeType.InfraNode,
     name,
     provider,
     kind,
@@ -9040,8 +9323,8 @@ function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provide
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types31.Provenance.EXTRACTED,
-      confidence: (0, import_types31.confidenceForExtracted)("structural"),
+      provenance: import_types32.Provenance.EXTRACTED,
+      confidence: (0, import_types32.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9108,15 +9391,15 @@ async function addComposeInfra(graph, scanPath, services) {
     for (const dep of dependsOnList(svc.depends_on)) {
       const targetId = composeNameToNodeId.get(dep);
       if (!targetId) continue;
-      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types32.EdgeType.DEPENDS_ON);
+      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types33.EdgeType.DEPENDS_ON);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: sourceId,
         target: targetId,
-        type: import_types32.EdgeType.DEPENDS_ON,
-        provenance: import_types32.Provenance.EXTRACTED,
-        confidence: (0, import_types32.confidenceForExtracted)("structural"),
+        type: import_types33.EdgeType.DEPENDS_ON,
+        provenance: import_types33.Provenance.EXTRACTED,
+        confidence: (0, import_types33.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9130,7 +9413,7 @@ async function addComposeInfra(graph, scanPath, services) {
 init_cjs_shims();
 var import_node_path43 = __toESM(require("path"), 1);
 var import_node_fs17 = require("fs");
-var import_types33 = require("@neat.is/types");
+var import_types34 = require("@neat.is/types");
 function readDockerfile(content) {
   let image = null;
   const ports = [];
@@ -9189,15 +9472,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     );
     nodesAdded += fn;
     edgesAdded += fe;
-    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types33.EdgeType.RUNS_ON);
+    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types34.EdgeType.RUNS_ON);
     if (!graph.hasEdge(edgeId)) {
       const edge = {
         id: edgeId,
         source: fileNodeId,
         target: node.id,
-        type: import_types33.EdgeType.RUNS_ON,
-        provenance: import_types33.Provenance.EXTRACTED,
-        confidence: (0, import_types33.confidenceForExtracted)("structural"),
+        type: import_types34.EdgeType.RUNS_ON,
+        provenance: import_types34.Provenance.EXTRACTED,
+        confidence: (0, import_types34.confidenceForExtracted)("structural"),
         evidence: {
           file: evidenceFile,
           ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
@@ -9212,15 +9495,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         graph.addNode(portNode.id, portNode);
         nodesAdded++;
       }
-      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types33.EdgeType.CONNECTS_TO);
+      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types34.EdgeType.CONNECTS_TO);
       if (graph.hasEdge(portEdgeId)) continue;
       const portEdge = {
         id: portEdgeId,
         source: fileNodeId,
         target: portNode.id,
-        type: import_types33.EdgeType.CONNECTS_TO,
-        provenance: import_types33.Provenance.EXTRACTED,
-        confidence: (0, import_types33.confidenceForExtracted)("structural"),
+        type: import_types34.EdgeType.CONNECTS_TO,
+        provenance: import_types34.Provenance.EXTRACTED,
+        confidence: (0, import_types34.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
       };
       graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
@@ -9234,7 +9517,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs18 = require("fs");
 var import_node_path44 = __toESM(require("path"), 1);
-var import_types34 = require("@neat.is/types");
+var import_types35 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
@@ -9315,16 +9598,16 @@ async function addTerraformResources(graph, scanPath) {
         if (!target) continue;
         if (seen.has(target.nodeId)) continue;
         seen.add(target.nodeId);
-        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types34.EdgeType.DEPENDS_ON);
+        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types35.EdgeType.DEPENDS_ON);
         if (graph.hasEdge(edgeId)) continue;
         const line = lineAt2(content, resource.bodyOffset + ref.index);
         const edge = {
           id: edgeId,
           source: resource.nodeId,
           target: target.nodeId,
-          type: import_types34.EdgeType.DEPENDS_ON,
-          provenance: import_types34.Provenance.EXTRACTED,
-          confidence: (0, import_types34.confidenceForExtracted)("structural"),
+          type: import_types35.EdgeType.DEPENDS_ON,
+          provenance: import_types35.Provenance.EXTRACTED,
+          confidence: (0, import_types35.confidenceForExtracted)("structural"),
           evidence: { file: evidenceFile, line, snippet: key }
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9396,7 +9679,7 @@ init_cjs_shims();
 var import_node_fs20 = require("fs");
 var import_node_path46 = __toESM(require("path"), 1);
 var import_smol_toml2 = require("smol-toml");
-var import_types35 = require("@neat.is/types");
+var import_types36 = require("@neat.is/types");
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
@@ -9444,8 +9727,8 @@ function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, li
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types35.Provenance.EXTRACTED,
-      confidence: (0, import_types35.confidenceForExtracted)("structural"),
+      provenance: import_types36.Provenance.EXTRACTED,
+      confidence: (0, import_types36.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9506,15 +9789,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       nodesAdded++;
     }
     if (runtimeNode.id !== anchorId) {
-      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types35.EdgeType.RUNS_ON);
+      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types36.EdgeType.RUNS_ON);
       if (!graph.hasEdge(runsOnId)) {
         const edge = {
           id: runsOnId,
           source: anchorId,
           target: runtimeNode.id,
-          type: import_types35.EdgeType.RUNS_ON,
-          provenance: import_types35.Provenance.EXTRACTED,
-          confidence: (0, import_types35.confidenceForExtracted)("structural"),
+          type: import_types36.EdgeType.RUNS_ON,
+          provenance: import_types36.Provenance.EXTRACTED,
+          confidence: (0, import_types36.confidenceForExtracted)("structural"),
           evidence: {
             file: evidenceFile,
             ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
@@ -9528,7 +9811,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.CONNECTS_TO,
+        import_types36.EdgeType.CONNECTS_TO,
         "cloudflare-route",
         route,
         evidenceFile,
@@ -9552,7 +9835,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         const result = addResourceEdge(
           graph,
           anchorId,
-          import_types35.EdgeType.DEPENDS_ON,
+          import_types36.EdgeType.DEPENDS_ON,
           group.kind,
           name,
           evidenceFile,
@@ -9566,7 +9849,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.DEPENDS_ON,
+        import_types36.EdgeType.DEPENDS_ON,
         "cloudflare-cron",
         cron,
         evidenceFile,
@@ -9579,7 +9862,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.DEPENDS_ON,
+        import_types36.EdgeType.DEPENDS_ON,
         "cloudflare-env-var",
         varName,
         evidenceFile,
@@ -9592,15 +9875,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       if (!svc.service) continue;
       const target = workerIndex.get(svc.service);
       if (target && target.anchorId !== anchorId) {
-        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types35.EdgeType.CALLS);
+        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types36.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: anchorId,
             target: target.anchorId,
-            type: import_types35.EdgeType.CALLS,
-            provenance: import_types35.Provenance.EXTRACTED,
-            confidence: (0, import_types35.confidenceForExtracted)("structural"),
+            type: import_types36.EdgeType.CALLS,
+            provenance: import_types36.Provenance.EXTRACTED,
+            confidence: (0, import_types36.confidenceForExtracted)("structural"),
             evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9611,7 +9894,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.DEPENDS_ON,
+        import_types36.EdgeType.DEPENDS_ON,
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
@@ -9628,7 +9911,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs21 = require("fs");
 var import_node_path47 = __toESM(require("path"), 1);
-var import_types36 = require("@neat.is/types");
+var import_types37 = require("@neat.is/types");
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
@@ -9691,12 +9974,12 @@ async function addVercelServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types36.EdgeType.RUNS_ON, "vercel", "vercel");
-    for (const cron of config.crons ?? []) add(import_types36.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
-    for (const varName of Object.keys(config.env ?? {})) add(import_types36.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
-    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types36.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    add(import_types37.EdgeType.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(import_types37.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(import_types37.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types37.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
     for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
-      add(import_types36.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
+      add(import_types37.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
     }
   }
   return { nodesAdded, edgesAdded };
@@ -9707,7 +9990,7 @@ init_cjs_shims();
 var import_node_fs22 = require("fs");
 var import_node_path48 = __toESM(require("path"), 1);
 var import_smol_toml3 = require("smol-toml");
-var import_types37 = require("@neat.is/types");
+var import_types38 = require("@neat.is/types");
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
@@ -9753,9 +10036,9 @@ async function addRailwayServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types37.EdgeType.RUNS_ON, "railway", "railway");
-    add(import_types37.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
-    add(import_types37.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+    add(import_types38.EdgeType.RUNS_ON, "railway", "railway");
+    add(import_types38.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(import_types38.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
   }
   return { nodesAdded, edgesAdded };
 }
@@ -9765,7 +10048,7 @@ init_cjs_shims();
 var import_node_fs23 = require("fs");
 var import_node_path49 = __toESM(require("path"), 1);
 var import_smol_toml4 = require("smol-toml");
-var import_types38 = require("@neat.is/types");
+var import_types39 = require("@neat.is/types");
 async function readSupabaseConfig(dir) {
   const relFile = import_node_path49.default.join("supabase", "config.toml");
   const abs = import_node_path49.default.join(dir, relFile);
@@ -9813,10 +10096,10 @@ async function addSupabaseProjects(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types38.EdgeType.RUNS_ON, "supabase", "supabase");
-    for (const fn of Object.keys(config.functions ?? {})) add(import_types38.EdgeType.DEPENDS_ON, "supabase-function", fn);
-    if (config.storage) add(import_types38.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
-    if (config.auth) add(import_types38.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
+    add(import_types39.EdgeType.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(import_types39.EdgeType.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(import_types39.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(import_types39.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
   }
   return { nodesAdded, edgesAdded };
 }
@@ -9844,11 +10127,11 @@ var import_node_path51 = __toESM(require("path"), 1);
 init_cjs_shims();
 var import_node_fs24 = require("fs");
 var import_node_path50 = __toESM(require("path"), 1);
-var import_types39 = require("@neat.is/types");
+var import_types40 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types39.NodeType.FileNode) return;
+    if (attrs.type !== import_types40.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -9861,7 +10144,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types39.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types40.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (import_node_path50.default.isAbsolute(evidenceFile)) {
@@ -9892,6 +10175,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const routePhase = await addRoutes(graph, services);
   const grpcPhase = await addGrpcMethods(graph, services);
   const phase4 = await addCallEdges(graph, services);
+  const tableEdges = await addTableEdges(graph, services);
   const phase5 = await addInfra(graph, scanPath, services);
   const ghostsRetired = retireExtractedEdgesByMissingFile(
     graph,
@@ -9931,8 +10215,8 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
     }
   }
   const result = {
-    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
-    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + tableEdges.nodesAdded + phase5.nodesAdded,
+    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + tableEdges.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
@@ -9957,7 +10241,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 init_cjs_shims();
 var import_node_fs25 = require("fs");
 var import_node_path52 = __toESM(require("path"), 1);
-var import_types40 = require("@neat.is/types");
+var import_types41 = require("@neat.is/types");
 var SCHEMA_VERSION = 6;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -9981,7 +10265,7 @@ function migrateV5ToV6(payload) {
   if (Array.isArray(nodes)) {
     for (const node of nodes) {
       const attrs = node.attributes;
-      if (!attrs || attrs.type !== import_types40.NodeType.InfraNode) continue;
+      if (!attrs || attrs.type !== import_types41.NodeType.InfraNode) continue;
       if (attrs.kind !== "sql-table" && attrs.kind !== "supabase-table") continue;
       if (!Array.isArray(attrs.columns)) attrs.columns = [];
     }
@@ -9994,12 +10278,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types40.Provenance.OBSERVED;
+      attrs.provenance = import_types41.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types40.observedEdgeId)(source, target, type);
+        const newId = (0, import_types41.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -10149,7 +10433,7 @@ var Projects = class {
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types59 = require("@neat.is/types");
+var import_types66 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -10496,39 +10780,39 @@ async function rollbackExtension(ctx, args) {
 
 // src/divergences.ts
 init_cjs_shims();
-var import_types41 = require("@neat.is/types");
+var import_types42 = require("@neat.is/types");
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
 function bucketSourceFor(graph, edge) {
-  if (edge.type !== import_types41.EdgeType.CONNECTS_TO) return edge.source;
-  const parsed = (0, import_types41.parseFileId)(edge.source);
+  if (edge.type !== import_types42.EdgeType.CONNECTS_TO) return edge.source;
+  const parsed = (0, import_types42.parseFileId)(edge.source);
   if (!parsed || !graph.hasNode(edge.target)) return edge.source;
   const target = graph.getNodeAttributes(edge.target);
-  if (target.type !== import_types41.NodeType.DatabaseNode) return edge.source;
-  return (0, import_types41.serviceId)(parsed.service);
+  if (target.type !== import_types42.NodeType.DatabaseNode) return edge.source;
+  return (0, import_types42.serviceId)(parsed.service);
 }
 function bucketEdges(graph) {
   const buckets2 = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    const parsed = (0, import_types41.parseEdgeId)(id);
+    const parsed = (0, import_types42.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
     const source = bucketSourceFor(graph, e);
     const key = bucketKey(source, e.target, e.type);
     const cur = buckets2.get(key) ?? { source, target: e.target, type: e.type };
     switch (provenance) {
-      case import_types41.Provenance.EXTRACTED:
+      case import_types42.Provenance.EXTRACTED:
         cur.extracted = e;
         break;
-      case import_types41.Provenance.OBSERVED:
+      case import_types42.Provenance.OBSERVED:
         cur.observed = e;
         break;
-      case import_types41.Provenance.INFERRED:
+      case import_types42.Provenance.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === import_types41.Provenance.STALE) cur.stale = e;
+        if (e.provenance === import_types42.Provenance.STALE) cur.stale = e;
     }
     buckets2.set(key, cur);
   });
@@ -10537,17 +10821,17 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types41.NodeType.FrontierNode;
+  return attrs.type === import_types42.NodeType.FrontierNode;
 }
 function nodeIsWebsocketChannel(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types41.NodeType.WebSocketChannelNode;
+  return attrs.type === import_types42.NodeType.WebSocketChannelNode;
 }
 function nodeIsSymbol(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types41.NodeType.SymbolNode;
+  return attrs.type === import_types42.NodeType.SymbolNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -10567,14 +10851,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types41.EdgeType.CALLS,
-  import_types41.EdgeType.CONNECTS_TO,
-  import_types41.EdgeType.PUBLISHES_TO,
-  import_types41.EdgeType.CONSUMES_FROM
+  import_types42.EdgeType.CALLS,
+  import_types42.EdgeType.CONNECTS_TO,
+  import_types42.EdgeType.PUBLISHES_TO,
+  import_types42.EdgeType.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === import_types41.EdgeType.CONTAINS) return out;
+  if (bucket.type === import_types42.EdgeType.CONTAINS) return out;
   if (nodeIsSymbol(graph, bucket.source) || nodeIsSymbol(graph, bucket.target)) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
@@ -10616,7 +10900,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === import_types41.EdgeType.CONFIGURED_BY && e.provenance === import_types41.Provenance.EXTRACTED) {
+    if (e.type === import_types42.EdgeType.CONFIGURED_BY && e.provenance === import_types42.Provenance.EXTRACTED) {
       return true;
     }
   }
@@ -10629,10 +10913,10 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types41.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types41.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types42.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types42.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types41.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types42.NodeType.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -10654,10 +10938,10 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types41.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types41.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types42.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types42.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types41.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types42.NodeType.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -10754,7 +11038,7 @@ function suppressHostMismatchHalves(all) {
   for (const d of all) {
     if (d.type !== "host-mismatch") continue;
     observedHalf.add(`${d.source}->${d.target}`);
-    declaredHalf.add((0, import_types41.databaseId)(d.extractedHost));
+    declaredHalf.add((0, import_types42.databaseId)(d.extractedHost));
   }
   if (observedHalf.size === 0) return all;
   return all.filter((d) => {
@@ -10773,13 +11057,13 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type === import_types41.NodeType.ServiceNode) {
+    if (n.type === import_types42.NodeType.ServiceNode) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
       return;
     }
-    if (n.type === import_types41.NodeType.InfraNode && n.kind === "sql-table") {
+    if (n.type === import_types42.NodeType.InfraNode && n.kind === "sql-table") {
       for (const d of detectColumnDrift(n)) all.push(d);
     }
   });
@@ -10815,7 +11099,7 @@ function computeDivergences(graph, opts = {}) {
     const bc = "column" in b && b.column ? b.column : "";
     return ac.localeCompare(bc);
   });
-  return import_types41.DivergenceResultSchema.parse({
+  return import_types42.DivergenceResultSchema.parse({
     divergences: filtered,
     totalAffected: filtered.length,
     computedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -10949,7 +11233,7 @@ init_cjs_shims();
 var import_node_fs29 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path56 = __toESM(require("path"), 1);
-var import_types42 = require("@neat.is/types");
+var import_types43 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
@@ -11151,10 +11435,10 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types42.RegistryFileSchema.parse(parsed);
+  return import_types43.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types42.RegistryFileSchema.parse(reg);
+  const validated = import_types43.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
 async function getProject(name) {
@@ -11505,15 +11789,15 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 
 // src/connectors/index.ts
 init_cjs_shims();
-var import_types43 = require("@neat.is/types");
+var import_types44 = require("@neat.is/types");
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== import_types43.Provenance.EXTRACTED) continue;
-    const parsed = (0, import_types43.parseFileId)(edge.source);
+    if (edge.provenance !== import_types44.Provenance.EXTRACTED) continue;
+    const parsed = (0, import_types44.parseFileId)(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
     if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
@@ -11524,7 +11808,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== import_types43.NodeType.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== import_types44.NodeType.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -11708,7 +11992,11 @@ var JUNCTION_DEFAULT_RATE_LIMITS = {
   // connector add/remove/test` (provision/deprovision/validate), never a poll
   // loop, so this bucket is exercised a handful of times per command. Kept
   // conservative pending a documented Drains-API rate limit.
-  vercel: { capacity: 20, refillMs: 5e3 }
+  vercel: { capacity: 20, refillMs: 5e3 },
+  // Render's REST API (api-docs.render.com/reference/rate-limiting) isn't
+  // pinned here to a single confirmed number — this is a conservative
+  // placeholder pending a live project, matching the other pull providers.
+  render: { capacity: 30, refillMs: 1e4 }
 };
 var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
 function defaultRateLimitFor(provider) {
@@ -12115,23 +12403,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types45 = require("@neat.is/types");
+var import_types46 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types45.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types46.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types45.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
     }
-    const bareResourceId = (0, import_types45.infraId)(signal.targetKind, signal.targetName);
+    const bareResourceId = (0, import_types46.infraId)(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types45.EdgeType.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types45.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types46.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types45.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
     }
     return null;
   };
@@ -12224,7 +12512,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types49 = require("@neat.is/types");
+var import_types50 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -12375,7 +12663,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types49.NodeType.RouteNode) return;
+    if (node.type !== import_types50.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -12479,12 +12767,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types49.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types50.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types49.serviceId)(peerName), serviceName, edgeType: import_types49.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types50.serviceId)(peerName), serviceName, edgeType: import_types50.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -12672,7 +12960,7 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types50 = require("@neat.is/types");
+var import_types51 = require("@neat.is/types");
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -12687,7 +12975,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types50.NodeType.RouteNode) return;
+    if (node.type !== import_types51.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -12719,7 +13007,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types50.EdgeType.CALLS
+      edgeType: import_types51.EdgeType.CALLS
     };
   };
 }
@@ -12746,7 +13034,7 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types52 = require("@neat.is/types");
+var import_types53 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
@@ -12910,7 +13198,7 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types52.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types53.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
@@ -12922,7 +13210,7 @@ function findMatchingRouteNode(graph, serviceName, method, path62) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types52.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types53.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -12941,11 +13229,11 @@ function createCloudflareResolveTarget(config, graph) {
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types52.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types53.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types52.EdgeType.CALLS
+        edgeType: import_types53.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -12954,13 +13242,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types52.EdgeType.CALLS
+        edgeType: import_types53.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types52.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types53.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types52.EdgeType.CALLS,
+      edgeType: import_types53.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -13156,14 +13444,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 
 // src/connectors/neon/resolve.ts
 init_cjs_shims();
-var import_types56 = require("@neat.is/types");
+var import_types57 = require("@neat.is/types");
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: (0, import_types56.infraId)("sql-table", signal.targetName),
+      targetNodeId: (0, import_types57.infraId)("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: import_types56.EdgeType.CALLS,
+      edgeType: import_types57.EdgeType.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -13201,6 +13489,412 @@ function createNeonConnector(config, deps = {}) {
   };
 }
 
+// src/connectors/cloud-run/index.ts
+init_cjs_shims();
+
+// src/connectors/cloud-run/client.ts
+init_cjs_shims();
+function cloudRunRequestLogName(projectId) {
+  return `projects/${projectId}/logs/run.googleapis.com%2Frequests`;
+}
+function buildCloudRunEntriesFilter(projectId, sinceIso) {
+  return [
+    `logName = "${cloudRunRequestLogName(projectId)}"`,
+    `resource.type = "${CLOUD_RUN_RESOURCE_TYPE}"`,
+    'httpRequest.requestMethod != ""',
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var CLOUD_RUN_RESOURCE_TYPE = "cloud_run_revision";
+var DEFAULT_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL2 = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE2 = 1e3;
+var MAX_PAGES2 = 20;
+async function fetchCloudRunRequestLogEntries(creds, sinceIso, apiUrl = ENTRIES_LIST_URL2) {
+  const filter = buildCloudRunEntriesFilter(creds.projectId, sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES2; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE2,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      apiUrl,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id — one customer's Cloud Logging quota is
+      // scoped per GCP project (ADR-131's per-(provider, accountKey) rate-limit
+      // bucket), the same key Firebase's connector uses.
+      { provider: "cloud-run", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    if (Array.isArray(json.entries)) out.push(...json.entries);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/map.ts
+init_cjs_shims();
+
+// src/connectors/cloud-run/types.ts
+init_cjs_shims();
+function readCloudRunCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("cloud-run connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("cloud-run connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var CLOUD_RUN_TARGET_KIND = "cloud_run_revision";
+var FIELD_SEP2 = "\0";
+function packCloudRunTargetName(identity) {
+  return [identity.serviceName, identity.method, identity.path].join(FIELD_SEP2);
+}
+function parseCloudRunTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP2);
+  if (firstSep === -1) return null;
+  const serviceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP2);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path62 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path62) return null;
+  return { serviceName, method, path: path62 };
+}
+
+// src/connectors/cloud-run/map.ts
+var CLOUD_RUN_RESOURCE_TYPE2 = "cloud_run_revision";
+function pathFromRequestUrl2(requestUrl) {
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD4 = 500;
+function mapLogEntryToSignal2(entry2) {
+  if (!entry2 || typeof entry2 !== "object") return null;
+  if (entry2.resource?.type !== CLOUD_RUN_RESOURCE_TYPE2) return null;
+  const serviceName = entry2.resource?.labels?.["service_name"];
+  if (typeof serviceName !== "string" || serviceName.length === 0) return null;
+  const req2 = entry2.httpRequest;
+  if (!req2) return null;
+  if (typeof req2.requestMethod !== "string" || req2.requestMethod.length === 0) return null;
+  const method = req2.requestMethod.toUpperCase();
+  const path62 = pathFromRequestUrl2(req2.requestUrl);
+  if (path62 === null) return null;
+  const timestamp = entry2.timestamp;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
+  const isError = typeof req2.status === "number" && req2.status >= ERROR_STATUS_THRESHOLD4;
+  return {
+    targetKind: CLOUD_RUN_TARGET_KIND,
+    targetName: packCloudRunTargetName({ serviceName, method, path: path62 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals2(entries) {
+  const out = [];
+  for (const entry2 of entries) {
+    const signal = mapLogEntryToSignal2(entry2);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/resolve.ts
+init_cjs_shims();
+var import_types61 = require("@neat.is/types");
+var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
+function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
+  let found = null;
+  graph.forEachNode((_id, attrs) => {
+    if (found) return;
+    const node = attrs;
+    if (node.type !== import_types61.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName || !route.pathTemplate) return;
+    if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
+    const routeMethod = route.method.toUpperCase();
+    if (routeMethod !== "ALL" && routeMethod !== method) return;
+    found = route.id;
+  });
+  return found;
+}
+function createCloudRunResolveTarget(graph, config) {
+  return (signal) => {
+    if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
+    const identity = parseCloudRunTargetName(signal.targetName);
+    if (!identity) return null;
+    const { serviceName: gcpServiceName, method, path: path62 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName];
+    if (mappedService) {
+      const routeNodeId = findMatchingRouteNode2(
+        graph,
+        mappedService,
+        method,
+        normalizePathTemplate(path62)
+      );
+      if (routeNodeId) {
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types61.EdgeType.CALLS };
+      }
+    }
+    return {
+      targetNodeId: (0, import_types61.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      serviceName: mappedService ?? gcpServiceName,
+      edgeType: import_types61.EdgeType.CALLS,
+      ensureInfraNode: {
+        kind: CLOUD_RUN_SERVICE_INFRA_KIND,
+        name: gcpServiceName,
+        provider: "cloud-run"
+      }
+    };
+  };
+}
+
+// src/connectors/cloud-run/index.ts
+var CloudRunConnector = class {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  config;
+  provider = "cloud-run";
+  async poll(ctx) {
+    const creds = readCloudRunCredentials(ctx.credentials);
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_LOOKBACK_MS2;
+    const sinceIso = boundedSinceIso(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const entries = await fetchCloudRunRequestLogEntries(creds, sinceIso, this.config.apiUrl);
+    return mapLogEntriesToSignals2(entries);
+  }
+};
+function boundedSinceIso(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+function createCloudRunConnector(graph, config = {}) {
+  return {
+    connector: new CloudRunConnector(config),
+    resolveTarget: createCloudRunResolveTarget(graph, config)
+  };
+}
+
+// src/connectors/render/index.ts
+init_cjs_shims();
+var import_types64 = require("@neat.is/types");
+
+// src/connectors/render/types.ts
+init_cjs_shims();
+function readRenderToken(credentials) {
+  const token = credentials.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("Render connector requires ctx.credentials.token (a Render API key)");
+  }
+  return token;
+}
+function renderLabelValue(entry2, name) {
+  if (!Array.isArray(entry2.labels)) return void 0;
+  const label = entry2.labels.find((l) => l && typeof l === "object" && l.name === name);
+  return label && typeof label.value === "string" ? label.value : void 0;
+}
+
+// src/connectors/render/client.ts
+init_cjs_shims();
+var DEFAULT_RENDER_API_URL = "https://api.render.com/v1";
+var DEFAULT_RENDER_LOG_LIMIT = 100;
+var RENDER_MAX_LOG_LIMIT = 100;
+var DEFAULT_RENDER_MAX_PAGES = 20;
+var DEFAULT_MAX_LOOKBACK_MS4 = 24 * 60 * 60 * 1e3;
+function clampLimit(limit) {
+  const raw = Math.trunc(limit ?? DEFAULT_RENDER_LOG_LIMIT);
+  if (!Number.isFinite(raw) || raw < 1) return DEFAULT_RENDER_LOG_LIMIT;
+  return Math.min(raw, RENDER_MAX_LOG_LIMIT);
+}
+function boundedRenderStartTime(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+async function fetchRenderLogPage(config, token, startTime, endTime, limit, fetchImpl) {
+  const url = new URL(`${config.apiUrl ?? DEFAULT_RENDER_API_URL}/logs`);
+  url.searchParams.set("ownerId", config.ownerId);
+  url.searchParams.set("resource", config.resourceId);
+  url.searchParams.set("type", "request");
+  url.searchParams.set("startTime", startTime);
+  url.searchParams.set("endTime", endTime);
+  url.searchParams.set("direction", "backward");
+  url.searchParams.set("limit", String(limit));
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: { ...bearerAuthHeader(token) } },
+    { provider: "render", accountKey: config.ownerId, ...fetchImpl ? { fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`Render logs request failed: ${res.status} ${res.statusText}`);
+  }
+  return await res.json();
+}
+async function fetchRenderRequestLogs(config, token, startTime, endTime, fetchImpl) {
+  const limit = clampLimit(config.limit);
+  const maxPages = Math.max(1, Math.trunc(config.maxPages ?? DEFAULT_RENDER_MAX_PAGES));
+  const out = [];
+  let pageStart = startTime;
+  let pageEnd = endTime;
+  for (let page = 0; page < maxPages; page++) {
+    const body = await fetchRenderLogPage(config, token, pageStart, pageEnd, limit, fetchImpl);
+    if (Array.isArray(body.logs)) out.push(...body.logs);
+    if (!body.hasMore || !body.nextStartTime || !body.nextEndTime) break;
+    pageStart = body.nextStartTime;
+    pageEnd = body.nextEndTime;
+  }
+  return out;
+}
+
+// src/connectors/render/index.ts
+var ROUTE_TARGET_KIND2 = "route";
+var UNMATCHED_ROUTE_TARGET_KIND2 = "unmatched-route";
+function buildRenderRouteIndex(graph, serviceName) {
+  const out = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== import_types64.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    out.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id,
+      path: route.path,
+      line: route.line
+    });
+  });
+  return out;
+}
+function findRenderRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function bucketKey3(method, normalizedPath) {
+  return `${method} ${normalizedPath}`;
+}
+function isHttpErrorStatus2(status2) {
+  return status2 >= 400;
+}
+function upsertBucket2(buckets2, key, isError, timestamp, build) {
+  const existing = buckets2.get(key);
+  if (existing) {
+    existing.callCount += 1;
+    if (isError) existing.errorCount += 1;
+    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
+    return;
+  }
+  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
+}
+function mapRenderRequestLogsToSignals(entries, routeIndex) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entries)) return [];
+  for (const entry2 of entries) {
+    if (!entry2 || typeof entry2 !== "object") continue;
+    if (typeof entry2.timestamp !== "string") continue;
+    const method = renderLabelValue(entry2, "method");
+    const rawPath = renderLabelValue(entry2, "path");
+    if (typeof method !== "string" || method.length === 0) continue;
+    if (typeof rawPath !== "string" || rawPath.length === 0) continue;
+    const methodUpper = method.toUpperCase();
+    const pathOnly = rawPath.split("?")[0];
+    const normalizedPath = normalizePathTemplate(pathOnly);
+    const statusCode = Number.parseInt(renderLabelValue(entry2, "statusCode") ?? "", 10);
+    const isError = Number.isFinite(statusCode) && isHttpErrorStatus2(statusCode);
+    const match = findRenderRoute(routeIndex, methodUpper, normalizedPath);
+    if (match) {
+      upsertBucket2(buckets2, `route:${match.routeNodeId}`, isError, entry2.timestamp, () => ({
+        targetKind: ROUTE_TARGET_KIND2,
+        targetName: match.routeNodeId,
+        // RouteNode.line is optional in the schema (packages/types/src/
+        // nodes.ts) even though routes.ts always sets it today — skip the
+        // callSite rather than fabricate a line when it's ever absent
+        // (file-awareness.md §6).
+        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
+      }));
+    } else {
+      upsertBucket2(
+        buckets2,
+        `unmatched:${bucketKey3(methodUpper, normalizedPath)}`,
+        isError,
+        entry2.timestamp,
+        () => ({
+          targetKind: UNMATCHED_ROUTE_TARGET_KIND2,
+          targetName: bucketKey3(methodUpper, normalizedPath)
+        })
+      );
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso,
+    ...b.callSite ? { callSite: b.callSite } : {}
+  }));
+}
+function createRenderResolveTarget(config) {
+  return (signal) => {
+    if (signal.targetKind === ROUTE_TARGET_KIND2) {
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types64.EdgeType.CALLS };
+    }
+    return null;
+  };
+}
+function createRenderConnector(graph, config) {
+  return {
+    provider: "render",
+    async poll(ctx) {
+      const token = readRenderToken(ctx.credentials);
+      const now = /* @__PURE__ */ new Date();
+      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS4;
+      const startTime = boundedRenderStartTime(ctx.since, now, maxLookbackMs);
+      const endTime = now.toISOString();
+      const logs = await fetchRenderRequestLogs(config, token, startTime, endTime);
+      const routeIndex = buildRenderRouteIndex(graph, config.serviceName);
+      return mapRenderRequestLogsToSignals(logs, routeIndex);
+    }
+  };
+}
+
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -13376,6 +14070,71 @@ var PROVIDER_DISPATCH = {
         return { ok: false, reason: `neon telemetry read failed: ${err.message}` };
       }
     }
+  },
+  "cloud-run": {
+    provider: "cloud-run",
+    // Cloud Run reads both projectId and accessToken from the credential; the
+    // single-string form maps to the secret (the token), and the required-fields
+    // check below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createCloudRunConnector(graph, options);
+    },
+    // POST entries:list with pageSize 1 — the exact surface poll() reads, so the
+    // probe checks the actual `logging.logEntries.list` permission the connector
+    // needs. A GET on the lighter logs.list endpoint (as Firebase probes) would
+    // instead check `logging.logs.list`, falsely rejecting a correctly-scoped
+    // custom role that carries only `logging.logEntries.list` (the narrowest
+    // grant docs/connectors/cloud-run.md documents) — the same false-negative
+    // trap Railway's validate avoids by probing its real query. A 2xx means the
+    // token can list log entries; 401/403 means the provider rejected it.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "cloud-run",
+        accountKey: projectId || "validate",
+        url: "https://logging.googleapis.com/v2/entries:list",
+        token: String(credentials.accessToken ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ resourceNames: [`projects/${projectId}`], pageSize: 1 })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  render: {
+    provider: "render",
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token"],
+    requiredOptionFields: ["ownerId", "resourceId", "serviceName"],
+    build(graph, options) {
+      const config = options;
+      return {
+        connector: createRenderConnector(graph, config),
+        resolveTarget: createRenderResolveTarget(config)
+      };
+    },
+    // GET /v1/services?limit=1 — the cheapest read the Render API key
+    // authenticates against (render.com/docs/api). Unlike Railway's GraphQL
+    // gateway, Render is a plain REST API: a live key returns 2xx, a bad one a
+    // 401/403, so authProbe's status-code check is a true verdict here. The
+    // logs query itself also needs an ownerId + resource; `services` needs
+    // neither and still fails 401 on a bad token, so it's the honest probe.
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.apiUrl ?? DEFAULT_RENDER_API_URL;
+      return authProbe({
+        provider: "render",
+        accountKey: cfg.ownerId ?? "validate",
+        url: `${baseUrl}/services?limit=1`,
+        token: String(credentials.token ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
   }
 };
 function vercelCredsFrom(credentials) {
@@ -13727,11 +14486,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req2.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types59.DivergenceTypeSchema.safeParse(c);
+        const r = import_types66.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types59.DivergenceTypeSchema.options
+            allowed: import_types66.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -14040,7 +14799,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req2.query.severity) {
-      const sev = import_types59.PolicySeveritySchema.safeParse(req2.query.severity);
+      const sev = import_types66.PolicySeveritySchema.safeParse(req2.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -14079,7 +14838,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req2, reply) => {
     const proj = resolveProject(registry, req2, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types59.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
+    const parsed = import_types66.PoliciesCheckBodySchema.safeParse(req2.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -14420,7 +15179,7 @@ function unroutedErrorsPath(neatHome4) {
 }
 
 // src/daemon.ts
-var import_types60 = require("@neat.is/types");
+var import_types67 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path59.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -14559,7 +15318,7 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
   if (!serviceName) return true;
   if (serviceNameMatchesProject(serviceName, project)) return true;
   return graph.someNode(
-    (_id, attrs) => attrs.type === import_types60.NodeType.ServiceNode && attrs.name === serviceName
+    (_id, attrs) => attrs.type === import_types67.NodeType.ServiceNode && attrs.name === serviceName
   );
 }
 async function bootstrapProject(entry2, connectors = [], neatHome4) {