@neat.is/core 0.7.4 → 0.7.5

package/dist/server.cjs

@@ -736,7 +736,7 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types59 = require("@neat.is/types");
+var import_types66 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -8947,6 +8947,55 @@ function columnsFromClassBody(body) {
   }
   return out;
 }
+function foreignKeyParentTable(call) {
+  const fn = call.childForFieldName("function");
+  const t = fn?.text;
+  if (!t) return null;
+  const base = t.includes(".") ? t.slice(t.lastIndexOf(".") + 1) : t;
+  if (base !== "ForeignKey") return null;
+  const target = firstPositionalString(call);
+  if (!target) return null;
+  const parts = target.split(".");
+  if (parts.length < 2) return null;
+  return parts[parts.length - 2];
+}
+function sqlalchemyForeignKeys(file, serviceDir) {
+  if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource6(makePyParser4(), file.content);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  walk3(tree.rootNode, (node) => {
+    if (node.type !== "class_definition") return;
+    const body = node.childForFieldName("body");
+    const nameNode = node.childForFieldName("name");
+    if (!body || !nameNode) return;
+    const explicit = explicitTablename(body);
+    if (explicit === "computed") return;
+    let childTable = null;
+    if (explicit) childTable = explicit.name;
+    else if (extendsFlaskModel(node)) childTable = flaskSqlalchemyTableName(nameNode.text);
+    if (!childTable) return;
+    walk3(body, (n) => {
+      if (n.type !== "call") return;
+      const parentTable = foreignKeyParentTable(n);
+      if (!parentTable) return;
+      const key = `${childTable}->${parentTable}`;
+      if (seen.has(key)) return;
+      seen.add(key);
+      const line = n.startPosition.row + 1;
+      out.push({
+        childTable,
+        parentTable,
+        evidence: {
+          file: import_node_path37.default.relative(serviceDir, file.path),
+          line,
+          snippet: snippet(file.content, line)
+        }
+      });
+    });
+  });
+  return out;
+}
 function sqlalchemyEndpointsFromFile(file, serviceDir) {
   if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource6(makePyParser4(), file.content);
@@ -9292,6 +9341,92 @@ function drizzleEndpointsFromFile(file, serviceDir) {
   walk6(tree.rootNode);
   return out;
 }
+function enclosingVarName(call) {
+  let node = call;
+  while (node?.parent) {
+    const parent = node.parent;
+    if (parent.type === "variable_declarator") {
+      const name = parent.childForFieldName("name");
+      return name?.type === "identifier" ? name.text : null;
+    }
+    if (parent.type === "call_expression" || parent.type === "member_expression") {
+      node = parent;
+      continue;
+    }
+    return null;
+  }
+  return null;
+}
+function collectDrizzleTables(root) {
+  const tables = [];
+  const varToTable = /* @__PURE__ */ new Map();
+  const walk6 = (node) => {
+    if (node.type === "call_expression") {
+      const fn = node.childForFieldName("function");
+      if (fn?.type === "identifier" && TABLE_BUILDERS.has(fn.text)) {
+        const args = node.childForFieldName("arguments");
+        const argNodes = args ? namedChildren3(args) : [];
+        const tableName = stringLiteralText2(argNodes[0] ?? null);
+        const obj = argNodes[1]?.type === "object" ? argNodes[1] : null;
+        if (tableName) {
+          tables.push({ tableName, object: obj });
+          const varName = enclosingVarName(node);
+          if (varName) varToTable.set(varName, tableName);
+        }
+      }
+    }
+    for (const c of namedChildren3(node)) walk6(c);
+  };
+  walk6(root);
+  return { tables, varToTable };
+}
+function referencesTargetVar(call) {
+  const fn = call.childForFieldName("function");
+  if (fn?.type !== "member_expression") return null;
+  if (fn.childForFieldName("property")?.text !== "references") return null;
+  const args = call.childForFieldName("arguments");
+  const first = args ? namedChildren3(args)[0] ?? null : null;
+  if (first?.type !== "arrow_function") return null;
+  const body = first.childForFieldName("body");
+  if (body?.type !== "member_expression") return null;
+  const obj = body.childForFieldName("object");
+  return obj?.type === "identifier" ? obj.text : null;
+}
+function drizzleForeignKeys(file, serviceDir) {
+  if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource3(parserForExt(import_node_path39.default.extname(file.path)), file.content);
+  const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const table of tables) {
+    if (!table.object) continue;
+    const walk6 = (node) => {
+      if (node.type === "call_expression") {
+        const targetVar = referencesTargetVar(node);
+        const parentTable = targetVar ? varToTable.get(targetVar) : void 0;
+        if (parentTable) {
+          const key = `${table.tableName}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            const line = node.startPosition.row + 1;
+            out.push({
+              childTable: table.tableName,
+              parentTable,
+              evidence: {
+                file: import_node_path39.default.relative(serviceDir, file.path),
+                line,
+                snippet: snippet(file.content, line)
+              }
+            });
+          }
+        }
+      }
+      for (const c of namedChildren3(node)) walk6(c);
+    };
+    walk6(table.object);
+  }
+  return out;
+}
 
 // src/extract/calls/prisma.ts
 init_cjs_shims();
@@ -9420,6 +9555,96 @@ async function prismaColumnEndpoints(serviceDir) {
   if (!content) return [];
   return prismaColumnsFromSchema({ path: schemaPath, content }, serviceDir);
 }
+function buildModelTableMap(lines) {
+  const map = /* @__PURE__ */ new Map();
+  let current = null;
+  let depth = 0;
+  for (const raw of lines) {
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { model: header[1], table: header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) {
+          map.set(current.model, current.table);
+          current = null;
+        }
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed.startsWith("@@")) {
+      const m = trimmed.match(/@@map\(\s*"([^"]+)"\s*\)/);
+      if (m) current.table = m[1];
+    }
+    if (depth <= 0) {
+      map.set(current.model, current.table);
+      current = null;
+    }
+  }
+  if (current) map.set(current.model, current.table);
+  return map;
+}
+function prismaForeignKeysFromSchema(file, serviceDir) {
+  const content = file.content;
+  if (!/\bmodel\s+[A-Za-z_]\w*\s*\{/.test(content)) return [];
+  const lines = content.split("\n");
+  const modelToTable = buildModelTableMap(lines);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  let current = null;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const lineNo = i + 1;
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { table: modelToTable.get(header[1]) ?? header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) current = null;
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const closing = depth <= 0;
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed && !trimmed.startsWith("@@") && !trimmed.startsWith("}")) {
+      const fm = trimmed.match(/^([A-Za-z_]\w*)\s+([A-Za-z_]\w*)/);
+      if (fm && /@relation\b[^)]*\bfields\s*:/.test(trimmed)) {
+        const parentTable = modelToTable.get(fm[2]);
+        if (parentTable) {
+          const key = `${current.table}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            out.push({
+              childTable: current.table,
+              parentTable,
+              evidence: {
+                file: import_node_path40.default.relative(serviceDir, file.path),
+                line: lineNo,
+                snippet: snippet(content, lineNo)
+              }
+            });
+          }
+        }
+      }
+    }
+    if (closing) current = null;
+  }
+  return out;
+}
+async function prismaForeignKeys(serviceDir) {
+  const schemaPath = await findFirst(serviceDir, [
+    import_node_path40.default.join("prisma", "schema.prisma"),
+    "schema.prisma"
+  ]);
+  if (!schemaPath) return [];
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  return prismaForeignKeysFromSchema({ path: schemaPath, content }, serviceDir);
+}
 
 // src/extract/calls/go.ts
 init_cjs_shims();
@@ -9596,21 +9821,79 @@ async function addCallEdges(graph, services) {
   };
 }
 
+// src/extract/table-edges.ts
+init_cjs_shims();
+var import_types32 = require("@neat.is/types");
+async function addTableEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const refs = [];
+    for (const file of files) {
+      try {
+        refs.push(...drizzleForeignKeys(file, service.dir));
+        refs.push(...sqlalchemyForeignKeys(file, service.dir));
+      } catch (err) {
+        recordExtractionError("foreign-key extraction", file.path, err);
+      }
+    }
+    try {
+      refs.push(...await prismaForeignKeys(service.dir));
+    } catch (err) {
+      recordExtractionError("prisma foreign-key extraction", service.dir, err);
+    }
+    for (const ref of refs) {
+      const childId = (0, import_types32.infraId)("sql-table", ref.childTable);
+      const parentId = (0, import_types32.infraId)("sql-table", ref.parentTable);
+      if (childId === parentId) continue;
+      nodesAdded += ensureTableNode(graph, childId, ref.childTable);
+      nodesAdded += ensureTableNode(graph, parentId, ref.parentTable);
+      const edgeId = (0, import_types32.extractedEdgeId)(childId, parentId, import_types32.EdgeType.REFERENCES);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: childId,
+        target: parentId,
+        type: import_types32.EdgeType.REFERENCES,
+        provenance: import_types32.Provenance.EXTRACTED,
+        confidence: (0, import_types32.confidenceForExtracted)("structural"),
+        evidence: ref.evidence
+      };
+      graph.addEdgeWithKey(edgeId, childId, parentId, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+function ensureTableNode(graph, id, name) {
+  if (graph.hasNode(id)) return 0;
+  const node = {
+    id,
+    type: import_types32.NodeType.InfraNode,
+    name,
+    provider: "self",
+    kind: "sql-table"
+  };
+  graph.addNode(id, node);
+  return 1;
+}
+
 // src/extract/infra/index.ts
 init_cjs_shims();
 
 // src/extract/infra/docker-compose.ts
 init_cjs_shims();
 var import_node_path44 = __toESM(require("path"), 1);
-var import_types33 = require("@neat.is/types");
+var import_types34 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
 init_cjs_shims();
-var import_types32 = require("@neat.is/types");
+var import_types33 = require("@neat.is/types");
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: (0, import_types32.infraId)(kind, name),
-    type: import_types32.NodeType.InfraNode,
+    id: (0, import_types33.infraId)(kind, name),
+    type: import_types33.NodeType.InfraNode,
     name,
     provider,
     kind,
@@ -9654,8 +9937,8 @@ function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provide
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types32.Provenance.EXTRACTED,
-      confidence: (0, import_types32.confidenceForExtracted)("structural"),
+      provenance: import_types33.Provenance.EXTRACTED,
+      confidence: (0, import_types33.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9722,15 +10005,15 @@ async function addComposeInfra(graph, scanPath, services) {
     for (const dep of dependsOnList(svc.depends_on)) {
       const targetId = composeNameToNodeId.get(dep);
       if (!targetId) continue;
-      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types33.EdgeType.DEPENDS_ON);
+      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types34.EdgeType.DEPENDS_ON);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: sourceId,
         target: targetId,
-        type: import_types33.EdgeType.DEPENDS_ON,
-        provenance: import_types33.Provenance.EXTRACTED,
-        confidence: (0, import_types33.confidenceForExtracted)("structural"),
+        type: import_types34.EdgeType.DEPENDS_ON,
+        provenance: import_types34.Provenance.EXTRACTED,
+        confidence: (0, import_types34.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9744,7 +10027,7 @@ async function addComposeInfra(graph, scanPath, services) {
 init_cjs_shims();
 var import_node_path45 = __toESM(require("path"), 1);
 var import_node_fs19 = require("fs");
-var import_types34 = require("@neat.is/types");
+var import_types35 = require("@neat.is/types");
 function readDockerfile(content) {
   let image = null;
   const ports = [];
@@ -9803,15 +10086,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     );
     nodesAdded += fn;
     edgesAdded += fe;
-    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types34.EdgeType.RUNS_ON);
+    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types35.EdgeType.RUNS_ON);
     if (!graph.hasEdge(edgeId)) {
       const edge = {
         id: edgeId,
         source: fileNodeId,
         target: node.id,
-        type: import_types34.EdgeType.RUNS_ON,
-        provenance: import_types34.Provenance.EXTRACTED,
-        confidence: (0, import_types34.confidenceForExtracted)("structural"),
+        type: import_types35.EdgeType.RUNS_ON,
+        provenance: import_types35.Provenance.EXTRACTED,
+        confidence: (0, import_types35.confidenceForExtracted)("structural"),
         evidence: {
           file: evidenceFile,
           ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
@@ -9826,15 +10109,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         graph.addNode(portNode.id, portNode);
         nodesAdded++;
       }
-      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types34.EdgeType.CONNECTS_TO);
+      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types35.EdgeType.CONNECTS_TO);
       if (graph.hasEdge(portEdgeId)) continue;
       const portEdge = {
         id: portEdgeId,
         source: fileNodeId,
         target: portNode.id,
-        type: import_types34.EdgeType.CONNECTS_TO,
-        provenance: import_types34.Provenance.EXTRACTED,
-        confidence: (0, import_types34.confidenceForExtracted)("structural"),
+        type: import_types35.EdgeType.CONNECTS_TO,
+        provenance: import_types35.Provenance.EXTRACTED,
+        confidence: (0, import_types35.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
       };
       graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
@@ -9848,7 +10131,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs20 = require("fs");
 var import_node_path46 = __toESM(require("path"), 1);
-var import_types35 = require("@neat.is/types");
+var import_types36 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
@@ -9929,16 +10212,16 @@ async function addTerraformResources(graph, scanPath) {
         if (!target) continue;
         if (seen.has(target.nodeId)) continue;
         seen.add(target.nodeId);
-        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types35.EdgeType.DEPENDS_ON);
+        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types36.EdgeType.DEPENDS_ON);
         if (graph.hasEdge(edgeId)) continue;
         const line = lineAt2(content, resource.bodyOffset + ref.index);
         const edge = {
           id: edgeId,
           source: resource.nodeId,
           target: target.nodeId,
-          type: import_types35.EdgeType.DEPENDS_ON,
-          provenance: import_types35.Provenance.EXTRACTED,
-          confidence: (0, import_types35.confidenceForExtracted)("structural"),
+          type: import_types36.EdgeType.DEPENDS_ON,
+          provenance: import_types36.Provenance.EXTRACTED,
+          confidence: (0, import_types36.confidenceForExtracted)("structural"),
           evidence: { file: evidenceFile, line, snippet: key }
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -10010,7 +10293,7 @@ init_cjs_shims();
 var import_node_fs22 = require("fs");
 var import_node_path48 = __toESM(require("path"), 1);
 var import_smol_toml2 = require("smol-toml");
-var import_types36 = require("@neat.is/types");
+var import_types37 = require("@neat.is/types");
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
@@ -10058,8 +10341,8 @@ function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, li
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types36.Provenance.EXTRACTED,
-      confidence: (0, import_types36.confidenceForExtracted)("structural"),
+      provenance: import_types37.Provenance.EXTRACTED,
+      confidence: (0, import_types37.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -10120,15 +10403,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       nodesAdded++;
     }
     if (runtimeNode.id !== anchorId) {
-      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types36.EdgeType.RUNS_ON);
+      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types37.EdgeType.RUNS_ON);
       if (!graph.hasEdge(runsOnId)) {
         const edge = {
           id: runsOnId,
           source: anchorId,
           target: runtimeNode.id,
-          type: import_types36.EdgeType.RUNS_ON,
-          provenance: import_types36.Provenance.EXTRACTED,
-          confidence: (0, import_types36.confidenceForExtracted)("structural"),
+          type: import_types37.EdgeType.RUNS_ON,
+          provenance: import_types37.Provenance.EXTRACTED,
+          confidence: (0, import_types37.confidenceForExtracted)("structural"),
           evidence: {
             file: evidenceFile,
             ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
@@ -10142,7 +10425,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types36.EdgeType.CONNECTS_TO,
+        import_types37.EdgeType.CONNECTS_TO,
         "cloudflare-route",
         route,
         evidenceFile,
@@ -10166,7 +10449,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         const result = addResourceEdge(
           graph,
           anchorId,
-          import_types36.EdgeType.DEPENDS_ON,
+          import_types37.EdgeType.DEPENDS_ON,
           group.kind,
           name,
           evidenceFile,
@@ -10180,7 +10463,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types36.EdgeType.DEPENDS_ON,
+        import_types37.EdgeType.DEPENDS_ON,
         "cloudflare-cron",
         cron,
         evidenceFile,
@@ -10193,7 +10476,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types36.EdgeType.DEPENDS_ON,
+        import_types37.EdgeType.DEPENDS_ON,
         "cloudflare-env-var",
         varName,
         evidenceFile,
@@ -10206,15 +10489,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       if (!svc.service) continue;
       const target = workerIndex.get(svc.service);
       if (target && target.anchorId !== anchorId) {
-        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types36.EdgeType.CALLS);
+        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types37.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: anchorId,
             target: target.anchorId,
-            type: import_types36.EdgeType.CALLS,
-            provenance: import_types36.Provenance.EXTRACTED,
-            confidence: (0, import_types36.confidenceForExtracted)("structural"),
+            type: import_types37.EdgeType.CALLS,
+            provenance: import_types37.Provenance.EXTRACTED,
+            confidence: (0, import_types37.confidenceForExtracted)("structural"),
             evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -10225,7 +10508,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types36.EdgeType.DEPENDS_ON,
+        import_types37.EdgeType.DEPENDS_ON,
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
@@ -10242,7 +10525,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs23 = require("fs");
 var import_node_path49 = __toESM(require("path"), 1);
-var import_types37 = require("@neat.is/types");
+var import_types38 = require("@neat.is/types");
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
@@ -10305,12 +10588,12 @@ async function addVercelServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types37.EdgeType.RUNS_ON, "vercel", "vercel");
-    for (const cron of config.crons ?? []) add(import_types37.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
-    for (const varName of Object.keys(config.env ?? {})) add(import_types37.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
-    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types37.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    add(import_types38.EdgeType.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(import_types38.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(import_types38.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types38.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
     for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
-      add(import_types37.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
+      add(import_types38.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
     }
   }
   return { nodesAdded, edgesAdded };
@@ -10321,7 +10604,7 @@ init_cjs_shims();
 var import_node_fs24 = require("fs");
 var import_node_path50 = __toESM(require("path"), 1);
 var import_smol_toml3 = require("smol-toml");
-var import_types38 = require("@neat.is/types");
+var import_types39 = require("@neat.is/types");
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
@@ -10367,9 +10650,9 @@ async function addRailwayServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types38.EdgeType.RUNS_ON, "railway", "railway");
-    add(import_types38.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
-    add(import_types38.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+    add(import_types39.EdgeType.RUNS_ON, "railway", "railway");
+    add(import_types39.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(import_types39.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
   }
   return { nodesAdded, edgesAdded };
 }
@@ -10379,7 +10662,7 @@ init_cjs_shims();
 var import_node_fs25 = require("fs");
 var import_node_path51 = __toESM(require("path"), 1);
 var import_smol_toml4 = require("smol-toml");
-var import_types39 = require("@neat.is/types");
+var import_types40 = require("@neat.is/types");
 async function readSupabaseConfig(dir) {
   const relFile = import_node_path51.default.join("supabase", "config.toml");
   const abs = import_node_path51.default.join(dir, relFile);
@@ -10427,10 +10710,10 @@ async function addSupabaseProjects(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types39.EdgeType.RUNS_ON, "supabase", "supabase");
-    for (const fn of Object.keys(config.functions ?? {})) add(import_types39.EdgeType.DEPENDS_ON, "supabase-function", fn);
-    if (config.storage) add(import_types39.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
-    if (config.auth) add(import_types39.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
+    add(import_types40.EdgeType.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(import_types40.EdgeType.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(import_types40.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(import_types40.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
   }
   return { nodesAdded, edgesAdded };
 }
@@ -10458,11 +10741,11 @@ var import_node_path53 = __toESM(require("path"), 1);
 init_cjs_shims();
 var import_node_fs26 = require("fs");
 var import_node_path52 = __toESM(require("path"), 1);
-var import_types40 = require("@neat.is/types");
+var import_types41 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types40.NodeType.FileNode) return;
+    if (attrs.type !== import_types41.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -10475,7 +10758,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types40.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types41.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (import_node_path52.default.isAbsolute(evidenceFile)) {
@@ -10506,6 +10789,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const routePhase = await addRoutes(graph, services);
   const grpcPhase = await addGrpcMethods(graph, services);
   const phase4 = await addCallEdges(graph, services);
+  const tableEdges = await addTableEdges(graph, services);
   const phase5 = await addInfra(graph, scanPath, services);
   const ghostsRetired = retireExtractedEdgesByMissingFile(
     graph,
@@ -10545,8 +10829,8 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
     }
   }
   const result = {
-    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
-    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + tableEdges.nodesAdded + phase5.nodesAdded,
+    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + tableEdges.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
@@ -10648,7 +10932,7 @@ function canonicalJson(value) {
 init_cjs_shims();
 var import_node_fs28 = require("fs");
 var import_node_path54 = __toESM(require("path"), 1);
-var import_types41 = require("@neat.is/types");
+var import_types42 = require("@neat.is/types");
 var SCHEMA_VERSION = 6;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -10672,7 +10956,7 @@ function migrateV5ToV6(payload) {
   if (Array.isArray(nodes)) {
     for (const node of nodes) {
       const attrs = node.attributes;
-      if (!attrs || attrs.type !== import_types41.NodeType.InfraNode) continue;
+      if (!attrs || attrs.type !== import_types42.NodeType.InfraNode) continue;
       if (attrs.kind !== "sql-table" && attrs.kind !== "supabase-table") continue;
       if (!Array.isArray(attrs.columns)) attrs.columns = [];
     }
@@ -10685,12 +10969,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types41.Provenance.OBSERVED;
+      attrs.provenance = import_types42.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types41.observedEdgeId)(source, target, type);
+        const newId = (0, import_types42.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -10845,7 +11129,7 @@ init_cjs_shims();
 var import_node_fs29 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path56 = __toESM(require("path"), 1);
-var import_types42 = require("@neat.is/types");
+var import_types43 = require("@neat.is/types");
 function neatHome() {
   const override = process.env.NEAT_HOME;
   if (override && override.length > 0) return import_node_path56.default.resolve(override);
@@ -10935,7 +11219,7 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types42.RegistryFileSchema.parse(parsed);
+  return import_types43.RegistryFileSchema.parse(parsed);
 }
 async function getProject(name) {
   const reg = await readRegistry();
@@ -11216,15 +11500,15 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 
 // src/connectors/index.ts
 init_cjs_shims();
-var import_types43 = require("@neat.is/types");
+var import_types44 = require("@neat.is/types");
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== import_types43.Provenance.EXTRACTED) continue;
-    const parsed = (0, import_types43.parseFileId)(edge.source);
+    if (edge.provenance !== import_types44.Provenance.EXTRACTED) continue;
+    const parsed = (0, import_types44.parseFileId)(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
     if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
@@ -11235,7 +11519,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== import_types43.NodeType.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== import_types44.NodeType.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -11378,7 +11662,11 @@ var JUNCTION_DEFAULT_RATE_LIMITS = {
   // connector add/remove/test` (provision/deprovision/validate), never a poll
   // loop, so this bucket is exercised a handful of times per command. Kept
   // conservative pending a documented Drains-API rate limit.
-  vercel: { capacity: 20, refillMs: 5e3 }
+  vercel: { capacity: 20, refillMs: 5e3 },
+  // Render's REST API (api-docs.render.com/reference/rate-limiting) isn't
+  // pinned here to a single confirmed number — this is a conservative
+  // placeholder pending a live project, matching the other pull providers.
+  render: { capacity: 30, refillMs: 1e4 }
 };
 var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
 function defaultRateLimitFor(provider) {
@@ -11785,23 +12073,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types45 = require("@neat.is/types");
+var import_types46 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types45.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types46.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types45.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
     }
-    const bareResourceId = (0, import_types45.infraId)(signal.targetKind, signal.targetName);
+    const bareResourceId = (0, import_types46.infraId)(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types45.EdgeType.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types45.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types46.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types45.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
     }
     return null;
   };
@@ -11894,7 +12182,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types49 = require("@neat.is/types");
+var import_types50 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -12045,7 +12333,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types49.NodeType.RouteNode) return;
+    if (node.type !== import_types50.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -12149,12 +12437,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types49.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types50.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types49.serviceId)(peerName), serviceName, edgeType: import_types49.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types50.serviceId)(peerName), serviceName, edgeType: import_types50.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -12342,7 +12630,7 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types50 = require("@neat.is/types");
+var import_types51 = require("@neat.is/types");
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -12357,7 +12645,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types50.NodeType.RouteNode) return;
+    if (node.type !== import_types51.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -12389,7 +12677,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types50.EdgeType.CALLS
+      edgeType: import_types51.EdgeType.CALLS
     };
   };
 }
@@ -12416,7 +12704,7 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types52 = require("@neat.is/types");
+var import_types53 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
@@ -12580,7 +12868,7 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types52.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types53.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
@@ -12592,7 +12880,7 @@ function findMatchingRouteNode(graph, serviceName, method, path60) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types52.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types53.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -12611,11 +12899,11 @@ function createCloudflareResolveTarget(config, graph) {
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types52.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types53.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types52.EdgeType.CALLS
+        edgeType: import_types53.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -12624,13 +12912,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types52.EdgeType.CALLS
+        edgeType: import_types53.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types52.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types53.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types52.EdgeType.CALLS,
+      edgeType: import_types53.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -12826,14 +13114,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 
 // src/connectors/neon/resolve.ts
 init_cjs_shims();
-var import_types56 = require("@neat.is/types");
+var import_types57 = require("@neat.is/types");
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: (0, import_types56.infraId)("sql-table", signal.targetName),
+      targetNodeId: (0, import_types57.infraId)("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: import_types56.EdgeType.CALLS,
+      edgeType: import_types57.EdgeType.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -12871,6 +13159,412 @@ function createNeonConnector(config, deps = {}) {
   };
 }
 
+// src/connectors/cloud-run/index.ts
+init_cjs_shims();
+
+// src/connectors/cloud-run/client.ts
+init_cjs_shims();
+function cloudRunRequestLogName(projectId) {
+  return `projects/${projectId}/logs/run.googleapis.com%2Frequests`;
+}
+function buildCloudRunEntriesFilter(projectId, sinceIso) {
+  return [
+    `logName = "${cloudRunRequestLogName(projectId)}"`,
+    `resource.type = "${CLOUD_RUN_RESOURCE_TYPE}"`,
+    'httpRequest.requestMethod != ""',
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var CLOUD_RUN_RESOURCE_TYPE = "cloud_run_revision";
+var DEFAULT_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL2 = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE2 = 1e3;
+var MAX_PAGES2 = 20;
+async function fetchCloudRunRequestLogEntries(creds, sinceIso, apiUrl = ENTRIES_LIST_URL2) {
+  const filter = buildCloudRunEntriesFilter(creds.projectId, sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES2; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE2,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      apiUrl,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id — one customer's Cloud Logging quota is
+      // scoped per GCP project (ADR-131's per-(provider, accountKey) rate-limit
+      // bucket), the same key Firebase's connector uses.
+      { provider: "cloud-run", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    if (Array.isArray(json.entries)) out.push(...json.entries);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/map.ts
+init_cjs_shims();
+
+// src/connectors/cloud-run/types.ts
+init_cjs_shims();
+function readCloudRunCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("cloud-run connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("cloud-run connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var CLOUD_RUN_TARGET_KIND = "cloud_run_revision";
+var FIELD_SEP2 = "\0";
+function packCloudRunTargetName(identity) {
+  return [identity.serviceName, identity.method, identity.path].join(FIELD_SEP2);
+}
+function parseCloudRunTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP2);
+  if (firstSep === -1) return null;
+  const serviceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP2);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path60 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path60) return null;
+  return { serviceName, method, path: path60 };
+}
+
+// src/connectors/cloud-run/map.ts
+var CLOUD_RUN_RESOURCE_TYPE2 = "cloud_run_revision";
+function pathFromRequestUrl2(requestUrl) {
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD4 = 500;
+function mapLogEntryToSignal2(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  if (entry.resource?.type !== CLOUD_RUN_RESOURCE_TYPE2) return null;
+  const serviceName = entry.resource?.labels?.["service_name"];
+  if (typeof serviceName !== "string" || serviceName.length === 0) return null;
+  const req = entry.httpRequest;
+  if (!req) return null;
+  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path60 = pathFromRequestUrl2(req.requestUrl);
+  if (path60 === null) return null;
+  const timestamp = entry.timestamp;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
+  return {
+    targetKind: CLOUD_RUN_TARGET_KIND,
+    targetName: packCloudRunTargetName({ serviceName, method, path: path60 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals2(entries) {
+  const out = [];
+  for (const entry of entries) {
+    const signal = mapLogEntryToSignal2(entry);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/resolve.ts
+init_cjs_shims();
+var import_types61 = require("@neat.is/types");
+var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
+function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
+  let found = null;
+  graph.forEachNode((_id, attrs) => {
+    if (found) return;
+    const node = attrs;
+    if (node.type !== import_types61.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName || !route.pathTemplate) return;
+    if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
+    const routeMethod = route.method.toUpperCase();
+    if (routeMethod !== "ALL" && routeMethod !== method) return;
+    found = route.id;
+  });
+  return found;
+}
+function createCloudRunResolveTarget(graph, config) {
+  return (signal) => {
+    if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
+    const identity = parseCloudRunTargetName(signal.targetName);
+    if (!identity) return null;
+    const { serviceName: gcpServiceName, method, path: path60 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName];
+    if (mappedService) {
+      const routeNodeId = findMatchingRouteNode2(
+        graph,
+        mappedService,
+        method,
+        normalizePathTemplate(path60)
+      );
+      if (routeNodeId) {
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types61.EdgeType.CALLS };
+      }
+    }
+    return {
+      targetNodeId: (0, import_types61.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      serviceName: mappedService ?? gcpServiceName,
+      edgeType: import_types61.EdgeType.CALLS,
+      ensureInfraNode: {
+        kind: CLOUD_RUN_SERVICE_INFRA_KIND,
+        name: gcpServiceName,
+        provider: "cloud-run"
+      }
+    };
+  };
+}
+
+// src/connectors/cloud-run/index.ts
+var CloudRunConnector = class {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  config;
+  provider = "cloud-run";
+  async poll(ctx) {
+    const creds = readCloudRunCredentials(ctx.credentials);
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_LOOKBACK_MS2;
+    const sinceIso = boundedSinceIso(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const entries = await fetchCloudRunRequestLogEntries(creds, sinceIso, this.config.apiUrl);
+    return mapLogEntriesToSignals2(entries);
+  }
+};
+function boundedSinceIso(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+function createCloudRunConnector(graph, config = {}) {
+  return {
+    connector: new CloudRunConnector(config),
+    resolveTarget: createCloudRunResolveTarget(graph, config)
+  };
+}
+
+// src/connectors/render/index.ts
+init_cjs_shims();
+var import_types64 = require("@neat.is/types");
+
+// src/connectors/render/types.ts
+init_cjs_shims();
+function readRenderToken(credentials) {
+  const token = credentials.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("Render connector requires ctx.credentials.token (a Render API key)");
+  }
+  return token;
+}
+function renderLabelValue(entry, name) {
+  if (!Array.isArray(entry.labels)) return void 0;
+  const label = entry.labels.find((l) => l && typeof l === "object" && l.name === name);
+  return label && typeof label.value === "string" ? label.value : void 0;
+}
+
+// src/connectors/render/client.ts
+init_cjs_shims();
+var DEFAULT_RENDER_API_URL = "https://api.render.com/v1";
+var DEFAULT_RENDER_LOG_LIMIT = 100;
+var RENDER_MAX_LOG_LIMIT = 100;
+var DEFAULT_RENDER_MAX_PAGES = 20;
+var DEFAULT_MAX_LOOKBACK_MS4 = 24 * 60 * 60 * 1e3;
+function clampLimit(limit) {
+  const raw = Math.trunc(limit ?? DEFAULT_RENDER_LOG_LIMIT);
+  if (!Number.isFinite(raw) || raw < 1) return DEFAULT_RENDER_LOG_LIMIT;
+  return Math.min(raw, RENDER_MAX_LOG_LIMIT);
+}
+function boundedRenderStartTime(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+async function fetchRenderLogPage(config, token, startTime, endTime, limit, fetchImpl) {
+  const url = new URL(`${config.apiUrl ?? DEFAULT_RENDER_API_URL}/logs`);
+  url.searchParams.set("ownerId", config.ownerId);
+  url.searchParams.set("resource", config.resourceId);
+  url.searchParams.set("type", "request");
+  url.searchParams.set("startTime", startTime);
+  url.searchParams.set("endTime", endTime);
+  url.searchParams.set("direction", "backward");
+  url.searchParams.set("limit", String(limit));
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: { ...bearerAuthHeader(token) } },
+    { provider: "render", accountKey: config.ownerId, ...fetchImpl ? { fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`Render logs request failed: ${res.status} ${res.statusText}`);
+  }
+  return await res.json();
+}
+async function fetchRenderRequestLogs(config, token, startTime, endTime, fetchImpl) {
+  const limit = clampLimit(config.limit);
+  const maxPages = Math.max(1, Math.trunc(config.maxPages ?? DEFAULT_RENDER_MAX_PAGES));
+  const out = [];
+  let pageStart = startTime;
+  let pageEnd = endTime;
+  for (let page = 0; page < maxPages; page++) {
+    const body = await fetchRenderLogPage(config, token, pageStart, pageEnd, limit, fetchImpl);
+    if (Array.isArray(body.logs)) out.push(...body.logs);
+    if (!body.hasMore || !body.nextStartTime || !body.nextEndTime) break;
+    pageStart = body.nextStartTime;
+    pageEnd = body.nextEndTime;
+  }
+  return out;
+}
+
+// src/connectors/render/index.ts
+var ROUTE_TARGET_KIND2 = "route";
+var UNMATCHED_ROUTE_TARGET_KIND2 = "unmatched-route";
+function buildRenderRouteIndex(graph, serviceName) {
+  const out = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== import_types64.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    out.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id,
+      path: route.path,
+      line: route.line
+    });
+  });
+  return out;
+}
+function findRenderRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function bucketKey3(method, normalizedPath) {
+  return `${method} ${normalizedPath}`;
+}
+function isHttpErrorStatus2(status2) {
+  return status2 >= 400;
+}
+function upsertBucket2(buckets2, key, isError, timestamp, build) {
+  const existing = buckets2.get(key);
+  if (existing) {
+    existing.callCount += 1;
+    if (isError) existing.errorCount += 1;
+    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
+    return;
+  }
+  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
+}
+function mapRenderRequestLogsToSignals(entries, routeIndex) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entries)) return [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object") continue;
+    if (typeof entry.timestamp !== "string") continue;
+    const method = renderLabelValue(entry, "method");
+    const rawPath = renderLabelValue(entry, "path");
+    if (typeof method !== "string" || method.length === 0) continue;
+    if (typeof rawPath !== "string" || rawPath.length === 0) continue;
+    const methodUpper = method.toUpperCase();
+    const pathOnly = rawPath.split("?")[0];
+    const normalizedPath = normalizePathTemplate(pathOnly);
+    const statusCode = Number.parseInt(renderLabelValue(entry, "statusCode") ?? "", 10);
+    const isError = Number.isFinite(statusCode) && isHttpErrorStatus2(statusCode);
+    const match = findRenderRoute(routeIndex, methodUpper, normalizedPath);
+    if (match) {
+      upsertBucket2(buckets2, `route:${match.routeNodeId}`, isError, entry.timestamp, () => ({
+        targetKind: ROUTE_TARGET_KIND2,
+        targetName: match.routeNodeId,
+        // RouteNode.line is optional in the schema (packages/types/src/
+        // nodes.ts) even though routes.ts always sets it today — skip the
+        // callSite rather than fabricate a line when it's ever absent
+        // (file-awareness.md §6).
+        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
+      }));
+    } else {
+      upsertBucket2(
+        buckets2,
+        `unmatched:${bucketKey3(methodUpper, normalizedPath)}`,
+        isError,
+        entry.timestamp,
+        () => ({
+          targetKind: UNMATCHED_ROUTE_TARGET_KIND2,
+          targetName: bucketKey3(methodUpper, normalizedPath)
+        })
+      );
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso,
+    ...b.callSite ? { callSite: b.callSite } : {}
+  }));
+}
+function createRenderResolveTarget(config) {
+  return (signal) => {
+    if (signal.targetKind === ROUTE_TARGET_KIND2) {
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types64.EdgeType.CALLS };
+    }
+    return null;
+  };
+}
+function createRenderConnector(graph, config) {
+  return {
+    provider: "render",
+    async poll(ctx) {
+      const token = readRenderToken(ctx.credentials);
+      const now = /* @__PURE__ */ new Date();
+      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS4;
+      const startTime = boundedRenderStartTime(ctx.since, now, maxLookbackMs);
+      const endTime = now.toISOString();
+      const logs = await fetchRenderRequestLogs(config, token, startTime, endTime);
+      const routeIndex = buildRenderRouteIndex(graph, config.serviceName);
+      return mapRenderRequestLogsToSignals(logs, routeIndex);
+    }
+  };
+}
+
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -13046,6 +13740,71 @@ var PROVIDER_DISPATCH = {
         return { ok: false, reason: `neon telemetry read failed: ${err.message}` };
       }
     }
+  },
+  "cloud-run": {
+    provider: "cloud-run",
+    // Cloud Run reads both projectId and accessToken from the credential; the
+    // single-string form maps to the secret (the token), and the required-fields
+    // check below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createCloudRunConnector(graph, options);
+    },
+    // POST entries:list with pageSize 1 — the exact surface poll() reads, so the
+    // probe checks the actual `logging.logEntries.list` permission the connector
+    // needs. A GET on the lighter logs.list endpoint (as Firebase probes) would
+    // instead check `logging.logs.list`, falsely rejecting a correctly-scoped
+    // custom role that carries only `logging.logEntries.list` (the narrowest
+    // grant docs/connectors/cloud-run.md documents) — the same false-negative
+    // trap Railway's validate avoids by probing its real query. A 2xx means the
+    // token can list log entries; 401/403 means the provider rejected it.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "cloud-run",
+        accountKey: projectId || "validate",
+        url: "https://logging.googleapis.com/v2/entries:list",
+        token: String(credentials.accessToken ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ resourceNames: [`projects/${projectId}`], pageSize: 1 })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  render: {
+    provider: "render",
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token"],
+    requiredOptionFields: ["ownerId", "resourceId", "serviceName"],
+    build(graph, options) {
+      const config = options;
+      return {
+        connector: createRenderConnector(graph, config),
+        resolveTarget: createRenderResolveTarget(config)
+      };
+    },
+    // GET /v1/services?limit=1 — the cheapest read the Render API key
+    // authenticates against (render.com/docs/api). Unlike Railway's GraphQL
+    // gateway, Render is a plain REST API: a live key returns 2xx, a bad one a
+    // 401/403, so authProbe's status-code check is a true verdict here. The
+    // logs query itself also needs an ownerId + resource; `services` needs
+    // neither and still fails 401 on a bad token, so it's the honest probe.
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.apiUrl ?? DEFAULT_RENDER_API_URL;
+      return authProbe({
+        provider: "render",
+        accountKey: cfg.ownerId ?? "validate",
+        url: `${baseUrl}/services?limit=1`,
+        token: String(credentials.token ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
   }
 };
 function vercelCredsFrom(credentials) {
@@ -13355,11 +14114,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types59.DivergenceTypeSchema.safeParse(c);
+        const r = import_types66.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types59.DivergenceTypeSchema.options
+            allowed: import_types66.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -13668,7 +14427,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types59.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types66.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -13707,7 +14466,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types59.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types66.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",