@neat.is/core 0.7.4 → 0.7.5

package/dist/cli.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path72 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path72) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path72)) {
+    const path74 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path74) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path74)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path72 = q === -1 ? v : v.slice(0, q);
-      if (path72.length > 0) return path72;
+      const path74 = q === -1 ? v : v.slice(0, q);
+      if (path74.length > 0) return path74;
     }
   }
   return void 0;
@@ -748,13 +748,13 @@ __export(cli_exports, {
   runMonitorVerb: () => runMonitorVerb,
   runQueryVerb: () => runQueryVerb,
   runSkill: () => runSkill,
-  usage: () => usage2
+  usage: () => usage4
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path71 = __toESM(require("path"), 1);
-var import_node_os6 = __toESM(require("os"), 1);
-var import_node_fs43 = require("fs");
+var import_node_path73 = __toESM(require("path"), 1);
+var import_node_os8 = __toESM(require("os"), 1);
+var import_node_fs45 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1322,19 +1322,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path72, edges) {
-    if (path72.length > best.path.length) {
-      best = { path: [...path72], edges: [...edges] };
+  function step(node, path74, edges) {
+    if (path74.length > best.path.length) {
+      best = { path: [...path74], edges: [...edges] };
     }
-    if (path72.length - 1 >= maxDepth) return;
+    if (path74.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path72.push(srcId);
+      path74.push(srcId);
       edges.push(edge);
-      step(srcId, path72, edges);
-      path72.pop();
+      step(srcId, path74, edges);
+      path74.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1541,26 +1541,26 @@ function dominantFailingCall(graph, serviceId7, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path72 = [originServiceId];
+  const path74 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path72.push(hop.nextService);
+    path74.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path72, edges, culprit: current };
+  return { path: path74, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path72 = [...chain.path];
+  const path74 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1568,14 +1568,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path72.push(loc.fileNode);
+      path74.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path72,
+      traversalPath: path74,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1587,7 +1587,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path72,
+    traversalPath: path74,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -8393,6 +8393,55 @@ function columnsFromClassBody(body) {
   }
   return out;
 }
+function foreignKeyParentTable(call) {
+  const fn = call.childForFieldName("function");
+  const t = fn?.text;
+  if (!t) return null;
+  const base = t.includes(".") ? t.slice(t.lastIndexOf(".") + 1) : t;
+  if (base !== "ForeignKey") return null;
+  const target = firstPositionalString(call);
+  if (!target) return null;
+  const parts = target.split(".");
+  if (parts.length < 2) return null;
+  return parts[parts.length - 2];
+}
+function sqlalchemyForeignKeys(file, serviceDir) {
+  if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource6(makePyParser4(), file.content);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  walk3(tree.rootNode, (node) => {
+    if (node.type !== "class_definition") return;
+    const body = node.childForFieldName("body");
+    const nameNode = node.childForFieldName("name");
+    if (!body || !nameNode) return;
+    const explicit = explicitTablename(body);
+    if (explicit === "computed") return;
+    let childTable = null;
+    if (explicit) childTable = explicit.name;
+    else if (extendsFlaskModel(node)) childTable = flaskSqlalchemyTableName(nameNode.text);
+    if (!childTable) return;
+    walk3(body, (n) => {
+      if (n.type !== "call") return;
+      const parentTable = foreignKeyParentTable(n);
+      if (!parentTable) return;
+      const key = `${childTable}->${parentTable}`;
+      if (seen.has(key)) return;
+      seen.add(key);
+      const line = n.startPosition.row + 1;
+      out.push({
+        childTable,
+        parentTable,
+        evidence: {
+          file: import_node_path36.default.relative(serviceDir, file.path),
+          line,
+          snippet: snippet(file.content, line)
+        }
+      });
+    });
+  });
+  return out;
+}
 function sqlalchemyEndpointsFromFile(file, serviceDir) {
   if (!SQLALCHEMY_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource6(makePyParser4(), file.content);
@@ -8711,15 +8760,15 @@ function drizzleEndpointsFromFile(file, serviceDir) {
       if (fn?.type === "identifier" && TABLE_BUILDERS.has(fn.text)) {
         const args = node.childForFieldName("arguments");
         const argNodes = args ? namedChildren3(args) : [];
-        const tableName = stringLiteralText2(argNodes[0] ?? null);
+        const tableName2 = stringLiteralText2(argNodes[0] ?? null);
         const obj = argNodes[1];
-        if (tableName && obj?.type === "object" && !seen.has(tableName)) {
-          seen.add(tableName);
+        if (tableName2 && obj?.type === "object" && !seen.has(tableName2)) {
+          seen.add(tableName2);
           const columns = columnsFromObject(obj);
           const line = node.startPosition.row + 1;
           out.push({
-            infraId: (0, import_types27.infraId)("sql-table", tableName),
-            name: tableName,
+            infraId: (0, import_types27.infraId)("sql-table", tableName2),
+            name: tableName2,
             kind: "sql-table",
             edgeType: "CALLS",
             confidenceKind: "structural",
@@ -8738,6 +8787,92 @@ function drizzleEndpointsFromFile(file, serviceDir) {
   walk6(tree.rootNode);
   return out;
 }
+function enclosingVarName(call) {
+  let node = call;
+  while (node?.parent) {
+    const parent = node.parent;
+    if (parent.type === "variable_declarator") {
+      const name = parent.childForFieldName("name");
+      return name?.type === "identifier" ? name.text : null;
+    }
+    if (parent.type === "call_expression" || parent.type === "member_expression") {
+      node = parent;
+      continue;
+    }
+    return null;
+  }
+  return null;
+}
+function collectDrizzleTables(root) {
+  const tables = [];
+  const varToTable = /* @__PURE__ */ new Map();
+  const walk6 = (node) => {
+    if (node.type === "call_expression") {
+      const fn = node.childForFieldName("function");
+      if (fn?.type === "identifier" && TABLE_BUILDERS.has(fn.text)) {
+        const args = node.childForFieldName("arguments");
+        const argNodes = args ? namedChildren3(args) : [];
+        const tableName2 = stringLiteralText2(argNodes[0] ?? null);
+        const obj = argNodes[1]?.type === "object" ? argNodes[1] : null;
+        if (tableName2) {
+          tables.push({ tableName: tableName2, object: obj });
+          const varName = enclosingVarName(node);
+          if (varName) varToTable.set(varName, tableName2);
+        }
+      }
+    }
+    for (const c of namedChildren3(node)) walk6(c);
+  };
+  walk6(root);
+  return { tables, varToTable };
+}
+function referencesTargetVar(call) {
+  const fn = call.childForFieldName("function");
+  if (fn?.type !== "member_expression") return null;
+  if (fn.childForFieldName("property")?.text !== "references") return null;
+  const args = call.childForFieldName("arguments");
+  const first = args ? namedChildren3(args)[0] ?? null : null;
+  if (first?.type !== "arrow_function") return null;
+  const body = first.childForFieldName("body");
+  if (body?.type !== "member_expression") return null;
+  const obj = body.childForFieldName("object");
+  return obj?.type === "identifier" ? obj.text : null;
+}
+function drizzleForeignKeys(file, serviceDir) {
+  if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
+  const tree = parseSource3(parserForExt(import_node_path38.default.extname(file.path)), file.content);
+  const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const table of tables) {
+    if (!table.object) continue;
+    const walk6 = (node) => {
+      if (node.type === "call_expression") {
+        const targetVar = referencesTargetVar(node);
+        const parentTable = targetVar ? varToTable.get(targetVar) : void 0;
+        if (parentTable) {
+          const key = `${table.tableName}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            const line = node.startPosition.row + 1;
+            out.push({
+              childTable: table.tableName,
+              parentTable,
+              evidence: {
+                file: import_node_path38.default.relative(serviceDir, file.path),
+                line,
+                snippet: snippet(file.content, line)
+              }
+            });
+          }
+        }
+      }
+      for (const c of namedChildren3(node)) walk6(c);
+    };
+    walk6(table.object);
+  }
+  return out;
+}
 
 // src/extract/calls/prisma.ts
 init_cjs_shims();
@@ -8866,6 +9001,96 @@ async function prismaColumnEndpoints(serviceDir) {
   if (!content) return [];
   return prismaColumnsFromSchema({ path: schemaPath, content }, serviceDir);
 }
+function buildModelTableMap(lines) {
+  const map = /* @__PURE__ */ new Map();
+  let current = null;
+  let depth = 0;
+  for (const raw of lines) {
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { model: header[1], table: header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) {
+          map.set(current.model, current.table);
+          current = null;
+        }
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed.startsWith("@@")) {
+      const m = trimmed.match(/@@map\(\s*"([^"]+)"\s*\)/);
+      if (m) current.table = m[1];
+    }
+    if (depth <= 0) {
+      map.set(current.model, current.table);
+      current = null;
+    }
+  }
+  if (current) map.set(current.model, current.table);
+  return map;
+}
+function prismaForeignKeysFromSchema(file, serviceDir) {
+  const content = file.content;
+  if (!/\bmodel\s+[A-Za-z_]\w*\s*\{/.test(content)) return [];
+  const lines = content.split("\n");
+  const modelToTable = buildModelTableMap(lines);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  let current = null;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const lineNo = i + 1;
+    if (current === null) {
+      const header = raw.match(/^\s*model\s+([A-Za-z_]\w*)\b/);
+      if (header && raw.includes("{")) {
+        current = { table: modelToTable.get(header[1]) ?? header[1] };
+        depth = netBraces(raw);
+        if (depth <= 0) current = null;
+      }
+      continue;
+    }
+    depth += netBraces(raw);
+    const closing = depth <= 0;
+    const trimmed = stripLineComment(raw).trim();
+    if (trimmed && !trimmed.startsWith("@@") && !trimmed.startsWith("}")) {
+      const fm = trimmed.match(/^([A-Za-z_]\w*)\s+([A-Za-z_]\w*)/);
+      if (fm && /@relation\b[^)]*\bfields\s*:/.test(trimmed)) {
+        const parentTable = modelToTable.get(fm[2]);
+        if (parentTable) {
+          const key = `${current.table}->${parentTable}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            out.push({
+              childTable: current.table,
+              parentTable,
+              evidence: {
+                file: import_node_path39.default.relative(serviceDir, file.path),
+                line: lineNo,
+                snippet: snippet(content, lineNo)
+              }
+            });
+          }
+        }
+      }
+    }
+    if (closing) current = null;
+  }
+  return out;
+}
+async function prismaForeignKeys(serviceDir) {
+  const schemaPath = await findFirst(serviceDir, [
+    import_node_path39.default.join("prisma", "schema.prisma"),
+    "schema.prisma"
+  ]);
+  if (!schemaPath) return [];
+  const content = await readIfExists(schemaPath);
+  if (!content) return [];
+  return prismaForeignKeysFromSchema({ path: schemaPath, content }, serviceDir);
+}
 
 // src/extract/calls/go.ts
 init_cjs_shims();
@@ -9042,21 +9267,79 @@ async function addCallEdges(graph, services) {
   };
 }
 
+// src/extract/table-edges.ts
+init_cjs_shims();
+var import_types31 = require("@neat.is/types");
+async function addTableEdges(graph, services) {
+  let nodesAdded = 0;
+  let edgesAdded = 0;
+  for (const service of services) {
+    const files = await loadSourceFiles(service.dir);
+    const refs = [];
+    for (const file of files) {
+      try {
+        refs.push(...drizzleForeignKeys(file, service.dir));
+        refs.push(...sqlalchemyForeignKeys(file, service.dir));
+      } catch (err) {
+        recordExtractionError("foreign-key extraction", file.path, err);
+      }
+    }
+    try {
+      refs.push(...await prismaForeignKeys(service.dir));
+    } catch (err) {
+      recordExtractionError("prisma foreign-key extraction", service.dir, err);
+    }
+    for (const ref of refs) {
+      const childId = (0, import_types31.infraId)("sql-table", ref.childTable);
+      const parentId = (0, import_types31.infraId)("sql-table", ref.parentTable);
+      if (childId === parentId) continue;
+      nodesAdded += ensureTableNode(graph, childId, ref.childTable);
+      nodesAdded += ensureTableNode(graph, parentId, ref.parentTable);
+      const edgeId = (0, import_types31.extractedEdgeId)(childId, parentId, import_types31.EdgeType.REFERENCES);
+      if (graph.hasEdge(edgeId)) continue;
+      const edge = {
+        id: edgeId,
+        source: childId,
+        target: parentId,
+        type: import_types31.EdgeType.REFERENCES,
+        provenance: import_types31.Provenance.EXTRACTED,
+        confidence: (0, import_types31.confidenceForExtracted)("structural"),
+        evidence: ref.evidence
+      };
+      graph.addEdgeWithKey(edgeId, childId, parentId, edge);
+      edgesAdded++;
+    }
+  }
+  return { nodesAdded, edgesAdded };
+}
+function ensureTableNode(graph, id, name) {
+  if (graph.hasNode(id)) return 0;
+  const node = {
+    id,
+    type: import_types31.NodeType.InfraNode,
+    name,
+    provider: "self",
+    kind: "sql-table"
+  };
+  graph.addNode(id, node);
+  return 1;
+}
+
 // src/extract/infra/index.ts
 init_cjs_shims();
 
 // src/extract/infra/docker-compose.ts
 init_cjs_shims();
 var import_node_path43 = __toESM(require("path"), 1);
-var import_types32 = require("@neat.is/types");
+var import_types33 = require("@neat.is/types");
 
 // src/extract/infra/shared.ts
 init_cjs_shims();
-var import_types31 = require("@neat.is/types");
+var import_types32 = require("@neat.is/types");
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
-    id: (0, import_types31.infraId)(kind, name),
-    type: import_types31.NodeType.InfraNode,
+    id: (0, import_types32.infraId)(kind, name),
+    type: import_types32.NodeType.InfraNode,
     name,
     provider,
     kind,
@@ -9100,8 +9383,8 @@ function emitPlatformResourceEdge(graph, anchorId, edgeType, kind, name, provide
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types31.Provenance.EXTRACTED,
-      confidence: (0, import_types31.confidenceForExtracted)("structural"),
+      provenance: import_types32.Provenance.EXTRACTED,
+      confidence: (0, import_types32.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9168,15 +9451,15 @@ async function addComposeInfra(graph, scanPath, services) {
     for (const dep of dependsOnList(svc.depends_on)) {
       const targetId = composeNameToNodeId.get(dep);
       if (!targetId) continue;
-      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types32.EdgeType.DEPENDS_ON);
+      const edgeId = (0, import_types3.extractedEdgeId)(sourceId, targetId, import_types33.EdgeType.DEPENDS_ON);
       if (graph.hasEdge(edgeId)) continue;
       const edge = {
         id: edgeId,
         source: sourceId,
         target: targetId,
-        type: import_types32.EdgeType.DEPENDS_ON,
-        provenance: import_types32.Provenance.EXTRACTED,
-        confidence: (0, import_types32.confidenceForExtracted)("structural"),
+        type: import_types33.EdgeType.DEPENDS_ON,
+        provenance: import_types33.Provenance.EXTRACTED,
+        confidence: (0, import_types33.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile }
       };
       graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9190,7 +9473,7 @@ async function addComposeInfra(graph, scanPath, services) {
 init_cjs_shims();
 var import_node_path44 = __toESM(require("path"), 1);
 var import_node_fs18 = require("fs");
-var import_types33 = require("@neat.is/types");
+var import_types34 = require("@neat.is/types");
 function readDockerfile(content) {
   let image = null;
   const ports = [];
@@ -9249,15 +9532,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
     );
     nodesAdded += fn;
     edgesAdded += fe;
-    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types33.EdgeType.RUNS_ON);
+    const edgeId = (0, import_types3.extractedEdgeId)(fileNodeId, node.id, import_types34.EdgeType.RUNS_ON);
     if (!graph.hasEdge(edgeId)) {
       const edge = {
         id: edgeId,
         source: fileNodeId,
         target: node.id,
-        type: import_types33.EdgeType.RUNS_ON,
-        provenance: import_types33.Provenance.EXTRACTED,
-        confidence: (0, import_types33.confidenceForExtracted)("structural"),
+        type: import_types34.EdgeType.RUNS_ON,
+        provenance: import_types34.Provenance.EXTRACTED,
+        confidence: (0, import_types34.confidenceForExtracted)("structural"),
         evidence: {
           file: evidenceFile,
           ...facts.entrypoint ? { snippet: facts.entrypoint.slice(0, 120) } : {}
@@ -9272,15 +9555,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
         graph.addNode(portNode.id, portNode);
         nodesAdded++;
       }
-      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types33.EdgeType.CONNECTS_TO);
+      const portEdgeId = (0, import_types3.extractedEdgeId)(fileNodeId, portNode.id, import_types34.EdgeType.CONNECTS_TO);
       if (graph.hasEdge(portEdgeId)) continue;
       const portEdge = {
         id: portEdgeId,
         source: fileNodeId,
         target: portNode.id,
-        type: import_types33.EdgeType.CONNECTS_TO,
-        provenance: import_types33.Provenance.EXTRACTED,
-        confidence: (0, import_types33.confidenceForExtracted)("structural"),
+        type: import_types34.EdgeType.CONNECTS_TO,
+        provenance: import_types34.Provenance.EXTRACTED,
+        confidence: (0, import_types34.confidenceForExtracted)("structural"),
         evidence: { file: evidenceFile, snippet: `EXPOSE ${port}` }
       };
       graph.addEdgeWithKey(portEdgeId, portEdge.source, portEdge.target, portEdge);
@@ -9294,7 +9577,7 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs19 = require("fs");
 var import_node_path45 = __toESM(require("path"), 1);
-var import_types34 = require("@neat.is/types");
+var import_types35 = require("@neat.is/types");
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
@@ -9375,16 +9658,16 @@ async function addTerraformResources(graph, scanPath) {
         if (!target) continue;
         if (seen.has(target.nodeId)) continue;
         seen.add(target.nodeId);
-        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types34.EdgeType.DEPENDS_ON);
+        const edgeId = (0, import_types3.extractedEdgeId)(resource.nodeId, target.nodeId, import_types35.EdgeType.DEPENDS_ON);
         if (graph.hasEdge(edgeId)) continue;
         const line = lineAt2(content, resource.bodyOffset + ref.index);
         const edge = {
           id: edgeId,
           source: resource.nodeId,
           target: target.nodeId,
-          type: import_types34.EdgeType.DEPENDS_ON,
-          provenance: import_types34.Provenance.EXTRACTED,
-          confidence: (0, import_types34.confidenceForExtracted)("structural"),
+          type: import_types35.EdgeType.DEPENDS_ON,
+          provenance: import_types35.Provenance.EXTRACTED,
+          confidence: (0, import_types35.confidenceForExtracted)("structural"),
           evidence: { file: evidenceFile, line, snippet: key }
         };
         graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9456,7 +9739,7 @@ init_cjs_shims();
 var import_node_fs21 = require("fs");
 var import_node_path47 = __toESM(require("path"), 1);
 var import_smol_toml2 = require("smol-toml");
-var import_types35 = require("@neat.is/types");
+var import_types36 = require("@neat.is/types");
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
@@ -9504,8 +9787,8 @@ function addResourceEdge(graph, anchorId, edgeType, kind, name, evidenceFile, li
       source: anchorId,
       target: node.id,
       type: edgeType,
-      provenance: import_types35.Provenance.EXTRACTED,
-      confidence: (0, import_types35.confidenceForExtracted)("structural"),
+      provenance: import_types36.Provenance.EXTRACTED,
+      confidence: (0, import_types36.confidenceForExtracted)("structural"),
       evidence: { file: evidenceFile, ...line !== void 0 ? { line } : {} }
     };
     graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9566,15 +9849,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       nodesAdded++;
     }
     if (runtimeNode.id !== anchorId) {
-      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types35.EdgeType.RUNS_ON);
+      const runsOnId = (0, import_types3.extractedEdgeId)(anchorId, runtimeNode.id, import_types36.EdgeType.RUNS_ON);
       if (!graph.hasEdge(runsOnId)) {
         const edge = {
           id: runsOnId,
           source: anchorId,
           target: runtimeNode.id,
-          type: import_types35.EdgeType.RUNS_ON,
-          provenance: import_types35.Provenance.EXTRACTED,
-          confidence: (0, import_types35.confidenceForExtracted)("structural"),
+          type: import_types36.EdgeType.RUNS_ON,
+          provenance: import_types36.Provenance.EXTRACTED,
+          confidence: (0, import_types36.confidenceForExtracted)("structural"),
           evidence: {
             file: evidenceFile,
             ...config.compatibility_date ? { snippet: `compatibility_date = ${config.compatibility_date}`.slice(0, 120) } : {}
@@ -9588,7 +9871,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.CONNECTS_TO,
+        import_types36.EdgeType.CONNECTS_TO,
         "cloudflare-route",
         route,
         evidenceFile,
@@ -9612,7 +9895,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
         const result = addResourceEdge(
           graph,
           anchorId,
-          import_types35.EdgeType.DEPENDS_ON,
+          import_types36.EdgeType.DEPENDS_ON,
           group.kind,
           name,
           evidenceFile,
@@ -9626,7 +9909,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.DEPENDS_ON,
+        import_types36.EdgeType.DEPENDS_ON,
         "cloudflare-cron",
         cron,
         evidenceFile,
@@ -9639,7 +9922,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.DEPENDS_ON,
+        import_types36.EdgeType.DEPENDS_ON,
         "cloudflare-env-var",
         varName,
         evidenceFile,
@@ -9652,15 +9935,15 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       if (!svc.service) continue;
       const target = workerIndex.get(svc.service);
       if (target && target.anchorId !== anchorId) {
-        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types35.EdgeType.CALLS);
+        const edgeId = (0, import_types3.extractedEdgeId)(anchorId, target.anchorId, import_types36.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
             id: edgeId,
             source: anchorId,
             target: target.anchorId,
-            type: import_types35.EdgeType.CALLS,
-            provenance: import_types35.Provenance.EXTRACTED,
-            confidence: (0, import_types35.confidenceForExtracted)("structural"),
+            type: import_types36.EdgeType.CALLS,
+            provenance: import_types36.Provenance.EXTRACTED,
+            confidence: (0, import_types36.confidenceForExtracted)("structural"),
             evidence: { file: evidenceFile, line: lineContaining2(raw, svc.service) }
           };
           graph.addEdgeWithKey(edgeId, edge.source, edge.target, edge);
@@ -9671,7 +9954,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
       const result = addResourceEdge(
         graph,
         anchorId,
-        import_types35.EdgeType.DEPENDS_ON,
+        import_types36.EdgeType.DEPENDS_ON,
         "cloudflare-service-binding",
         svc.service,
         evidenceFile,
@@ -9688,7 +9971,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 init_cjs_shims();
 var import_node_fs22 = require("fs");
 var import_node_path48 = __toESM(require("path"), 1);
-var import_types36 = require("@neat.is/types");
+var import_types37 = require("@neat.is/types");
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
@@ -9751,12 +10034,12 @@ async function addVercelServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types36.EdgeType.RUNS_ON, "vercel", "vercel");
-    for (const cron of config.crons ?? []) add(import_types36.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
-    for (const varName of Object.keys(config.env ?? {})) add(import_types36.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
-    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types36.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    add(import_types37.EdgeType.RUNS_ON, "vercel", "vercel");
+    for (const cron of config.crons ?? []) add(import_types37.EdgeType.DEPENDS_ON, "vercel-cron", cron.path ?? cron.schedule);
+    for (const varName of Object.keys(config.env ?? {})) add(import_types37.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
+    for (const varName of Object.keys(config.build?.env ?? {})) add(import_types37.EdgeType.DEPENDS_ON, "vercel-env-var", varName);
     for (const route of [...config.rewrites ?? [], ...config.redirects ?? [], ...config.routes ?? []]) {
-      add(import_types36.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
+      add(import_types37.EdgeType.CONNECTS_TO, "vercel-route", routeSource(route));
     }
   }
   return { nodesAdded, edgesAdded };
@@ -9767,7 +10050,7 @@ init_cjs_shims();
 var import_node_fs23 = require("fs");
 var import_node_path49 = __toESM(require("path"), 1);
 var import_smol_toml3 = require("smol-toml");
-var import_types37 = require("@neat.is/types");
+var import_types38 = require("@neat.is/types");
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
@@ -9813,9 +10096,9 @@ async function addRailwayServices(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types37.EdgeType.RUNS_ON, "railway", "railway");
-    add(import_types37.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
-    add(import_types37.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
+    add(import_types38.EdgeType.RUNS_ON, "railway", "railway");
+    add(import_types38.EdgeType.CONNECTS_TO, "railway-route", config.deploy?.healthcheckPath);
+    add(import_types38.EdgeType.DEPENDS_ON, "railway-cron", config.deploy?.cronSchedule);
   }
   return { nodesAdded, edgesAdded };
 }
@@ -9825,7 +10108,7 @@ init_cjs_shims();
 var import_node_fs24 = require("fs");
 var import_node_path50 = __toESM(require("path"), 1);
 var import_smol_toml4 = require("smol-toml");
-var import_types38 = require("@neat.is/types");
+var import_types39 = require("@neat.is/types");
 async function readSupabaseConfig(dir) {
   const relFile = import_node_path50.default.join("supabase", "config.toml");
   const abs = import_node_path50.default.join(dir, relFile);
@@ -9873,10 +10156,10 @@ async function addSupabaseProjects(graph, services, scanPath) {
       nodesAdded += result.nodesAdded;
       edgesAdded += result.edgesAdded;
     };
-    add(import_types38.EdgeType.RUNS_ON, "supabase", "supabase");
-    for (const fn of Object.keys(config.functions ?? {})) add(import_types38.EdgeType.DEPENDS_ON, "supabase-function", fn);
-    if (config.storage) add(import_types38.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
-    if (config.auth) add(import_types38.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
+    add(import_types39.EdgeType.RUNS_ON, "supabase", "supabase");
+    for (const fn of Object.keys(config.functions ?? {})) add(import_types39.EdgeType.DEPENDS_ON, "supabase-function", fn);
+    if (config.storage) add(import_types39.EdgeType.DEPENDS_ON, "supabase-storage", "storage");
+    if (config.auth) add(import_types39.EdgeType.DEPENDS_ON, "supabase-auth", "auth");
   }
   return { nodesAdded, edgesAdded };
 }
@@ -9904,11 +10187,11 @@ var import_node_path52 = __toESM(require("path"), 1);
 init_cjs_shims();
 var import_node_fs25 = require("fs");
 var import_node_path51 = __toESM(require("path"), 1);
-var import_types39 = require("@neat.is/types");
+var import_types40 = require("@neat.is/types");
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types39.NodeType.FileNode) return;
+    if (attrs.type !== import_types40.NodeType.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -9921,7 +10204,7 @@ function retireEdgesByFile(graph, file) {
   const toDrop = [];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types39.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types40.Provenance.EXTRACTED) return;
     if (!edge.evidence?.file) return;
     if (edge.evidence.file === normalized) toDrop.push(id);
   });
@@ -9934,7 +10217,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
-    if (edge.provenance !== import_types39.Provenance.EXTRACTED) return;
+    if (edge.provenance !== import_types40.Provenance.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (import_node_path51.default.isAbsolute(evidenceFile)) {
@@ -9965,6 +10248,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const routePhase = await addRoutes(graph, services);
   const grpcPhase = await addGrpcMethods(graph, services);
   const phase4 = await addCallEdges(graph, services);
+  const tableEdges = await addTableEdges(graph, services);
   const phase5 = await addInfra(graph, scanPath, services);
   const ghostsRetired = retireExtractedEdgesByMissingFile(
     graph,
@@ -10004,8 +10288,8 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
     }
   }
   const result = {
-    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + phase5.nodesAdded,
-    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + phase5.edgesAdded,
+    nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + tableEdges.nodesAdded + phase5.nodesAdded,
+    edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + tableEdges.edgesAdded + phase5.edgesAdded,
     frontiersPromoted,
     extractionErrors: errorEntries.length,
     errorEntries,
@@ -10028,39 +10312,39 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
 
 // src/divergences.ts
 init_cjs_shims();
-var import_types40 = require("@neat.is/types");
+var import_types41 = require("@neat.is/types");
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
 }
 function bucketSourceFor(graph, edge) {
-  if (edge.type !== import_types40.EdgeType.CONNECTS_TO) return edge.source;
-  const parsed = (0, import_types40.parseFileId)(edge.source);
+  if (edge.type !== import_types41.EdgeType.CONNECTS_TO) return edge.source;
+  const parsed = (0, import_types41.parseFileId)(edge.source);
   if (!parsed || !graph.hasNode(edge.target)) return edge.source;
   const target = graph.getNodeAttributes(edge.target);
-  if (target.type !== import_types40.NodeType.DatabaseNode) return edge.source;
-  return (0, import_types40.serviceId)(parsed.service);
+  if (target.type !== import_types41.NodeType.DatabaseNode) return edge.source;
+  return (0, import_types41.serviceId)(parsed.service);
 }
 function bucketEdges(graph) {
   const buckets2 = /* @__PURE__ */ new Map();
   graph.forEachEdge((id, attrs) => {
     const e = attrs;
-    const parsed = (0, import_types40.parseEdgeId)(id);
+    const parsed = (0, import_types41.parseEdgeId)(id);
     const provenance = parsed?.provenance ?? e.provenance;
     const source = bucketSourceFor(graph, e);
     const key = bucketKey(source, e.target, e.type);
     const cur = buckets2.get(key) ?? { source, target: e.target, type: e.type };
     switch (provenance) {
-      case import_types40.Provenance.EXTRACTED:
+      case import_types41.Provenance.EXTRACTED:
         cur.extracted = e;
         break;
-      case import_types40.Provenance.OBSERVED:
+      case import_types41.Provenance.OBSERVED:
         cur.observed = e;
         break;
-      case import_types40.Provenance.INFERRED:
+      case import_types41.Provenance.INFERRED:
         cur.inferred = e;
         break;
       default:
-        if (e.provenance === import_types40.Provenance.STALE) cur.stale = e;
+        if (e.provenance === import_types41.Provenance.STALE) cur.stale = e;
     }
     buckets2.set(key, cur);
   });
@@ -10069,17 +10353,17 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types40.NodeType.FrontierNode;
+  return attrs.type === import_types41.NodeType.FrontierNode;
 }
 function nodeIsWebsocketChannel(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types40.NodeType.WebSocketChannelNode;
+  return attrs.type === import_types41.NodeType.WebSocketChannelNode;
 }
 function nodeIsSymbol(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === import_types40.NodeType.SymbolNode;
+  return attrs.type === import_types41.NodeType.SymbolNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -10099,14 +10383,14 @@ function gradedConfidence(edge) {
   return clampConfidence(confidenceForEdge(edge));
 }
 var OBSERVABLE_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types40.EdgeType.CALLS,
-  import_types40.EdgeType.CONNECTS_TO,
-  import_types40.EdgeType.PUBLISHES_TO,
-  import_types40.EdgeType.CONSUMES_FROM
+  import_types41.EdgeType.CALLS,
+  import_types41.EdgeType.CONNECTS_TO,
+  import_types41.EdgeType.PUBLISHES_TO,
+  import_types41.EdgeType.CONSUMES_FROM
 ]);
 function detectMissingDivergences(graph, bucket) {
   const out = [];
-  if (bucket.type === import_types40.EdgeType.CONTAINS) return out;
+  if (bucket.type === import_types41.EdgeType.CONTAINS) return out;
   if (nodeIsSymbol(graph, bucket.source) || nodeIsSymbol(graph, bucket.target)) return out;
   if (bucket.extracted && !bucket.observed && OBSERVABLE_EDGE_TYPES.has(bucket.type)) {
     if (!nodeIsFrontier(graph, bucket.target)) {
@@ -10148,7 +10432,7 @@ function declaredHostFor(svc) {
 function hasExtractedConfiguredBy(graph, svcId) {
   for (const edgeId of graph.outboundEdges(svcId)) {
     const e = graph.getEdgeAttributes(edgeId);
-    if (e.type === import_types40.EdgeType.CONFIGURED_BY && e.provenance === import_types40.Provenance.EXTRACTED) {
+    if (e.type === import_types41.EdgeType.CONFIGURED_BY && e.provenance === import_types41.Provenance.EXTRACTED) {
       return true;
     }
   }
@@ -10161,10 +10445,10 @@ function detectHostMismatch(graph, svcId, svc) {
   const out = [];
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types40.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types40.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types41.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types41.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types40.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types41.NodeType.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -10186,10 +10470,10 @@ function detectCompatDivergences(graph, svcId, svc) {
   const deps = svc.dependencies ?? {};
   for (const edgeId of graph.outboundEdges(svcId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types40.EdgeType.CONNECTS_TO) continue;
-    if (edge.provenance !== import_types40.Provenance.OBSERVED) continue;
+    if (edge.type !== import_types41.EdgeType.CONNECTS_TO) continue;
+    if (edge.provenance !== import_types41.Provenance.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== import_types40.NodeType.DatabaseNode) continue;
+    if (target.type !== import_types41.NodeType.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -10286,7 +10570,7 @@ function suppressHostMismatchHalves(all) {
   for (const d of all) {
     if (d.type !== "host-mismatch") continue;
     observedHalf.add(`${d.source}->${d.target}`);
-    declaredHalf.add((0, import_types40.databaseId)(d.extractedHost));
+    declaredHalf.add((0, import_types41.databaseId)(d.extractedHost));
   }
   if (observedHalf.size === 0) return all;
   return all.filter((d) => {
@@ -10305,13 +10589,13 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type === import_types40.NodeType.ServiceNode) {
+    if (n.type === import_types41.NodeType.ServiceNode) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
       return;
     }
-    if (n.type === import_types40.NodeType.InfraNode && n.kind === "sql-table") {
+    if (n.type === import_types41.NodeType.InfraNode && n.kind === "sql-table") {
       for (const d of detectColumnDrift(n)) all.push(d);
     }
   });
@@ -10347,7 +10631,7 @@ function computeDivergences(graph, opts = {}) {
     const bc = "column" in b && b.column ? b.column : "";
     return ac.localeCompare(bc);
   });
-  return import_types40.DivergenceResultSchema.parse({
+  return import_types41.DivergenceResultSchema.parse({
     divergences: filtered,
     totalAffected: filtered.length,
     computedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -10358,7 +10642,7 @@ function computeDivergences(graph, opts = {}) {
 init_cjs_shims();
 var import_node_fs26 = require("fs");
 var import_node_path53 = __toESM(require("path"), 1);
-var import_types41 = require("@neat.is/types");
+var import_types42 = require("@neat.is/types");
 var SCHEMA_VERSION = 6;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -10382,7 +10666,7 @@ function migrateV5ToV6(payload) {
   if (Array.isArray(nodes)) {
     for (const node of nodes) {
       const attrs = node.attributes;
-      if (!attrs || attrs.type !== import_types41.NodeType.InfraNode) continue;
+      if (!attrs || attrs.type !== import_types42.NodeType.InfraNode) continue;
       if (attrs.kind !== "sql-table" && attrs.kind !== "supabase-table") continue;
       if (!Array.isArray(attrs.columns)) attrs.columns = [];
     }
@@ -10395,12 +10679,12 @@ function migrateV2ToV3(payload) {
     for (const edge of edges) {
       const attrs = edge.attributes;
       if (!attrs || attrs.provenance !== "FRONTIER") continue;
-      attrs.provenance = import_types41.Provenance.OBSERVED;
+      attrs.provenance = import_types42.Provenance.OBSERVED;
       const type = typeof attrs.type === "string" ? attrs.type : void 0;
       const source = typeof attrs.source === "string" ? attrs.source : void 0;
       const target = typeof attrs.target === "string" ? attrs.target : void 0;
       if (type && source && target) {
-        const newId = (0, import_types41.observedEdgeId)(source, target, type);
+        const newId = (0, import_types42.observedEdgeId)(source, target, type);
         attrs.id = newId;
         if (edge.key) edge.key = newId;
       }
@@ -10532,7 +10816,7 @@ ${NEAT_OUT_LINE}
 
 // src/summary.ts
 init_cjs_shims();
-var import_types42 = require("@neat.is/types");
+var import_types43 = require("@neat.is/types");
 function renderOtelEnvBlock() {
   return [
     "for prod OTel routing, set these in your deploy platform's env:",
@@ -10542,19 +10826,19 @@ function renderOtelEnvBlock() {
 }
 function findIncompatServices(nodes) {
   return nodes.filter(
-    (n) => n.type === import_types42.NodeType.ServiceNode && Array.isArray(n.incompatibilities) && (n.incompatibilities ?? []).length > 0
+    (n) => n.type === import_types43.NodeType.ServiceNode && Array.isArray(n.incompatibilities) && (n.incompatibilities ?? []).length > 0
   );
 }
 function servicesWithoutObserved(nodes, edges) {
   const seen = /* @__PURE__ */ new Set();
   for (const e of edges) {
-    if (e.provenance === import_types42.Provenance.OBSERVED) {
+    if (e.provenance === import_types43.Provenance.OBSERVED) {
       seen.add(e.source);
       seen.add(e.target);
     }
   }
   return nodes.filter(
-    (n) => n.type === import_types42.NodeType.ServiceNode && !seen.has(n.id)
+    (n) => n.type === import_types43.NodeType.ServiceNode && !seen.has(n.id)
   );
 }
 function formatDivergence(d) {
@@ -10636,7 +10920,7 @@ var import_chokidar = __toESM(require("chokidar"), 1);
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types60 = require("@neat.is/types");
+var import_types67 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -11160,7 +11444,7 @@ init_cjs_shims();
 var import_node_fs31 = require("fs");
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_path58 = __toESM(require("path"), 1);
-var import_types43 = require("@neat.is/types");
+var import_types44 = require("@neat.is/types");
 var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
@@ -11414,10 +11698,10 @@ async function readRegistry() {
     throw err;
   }
   const parsed = JSON.parse(raw);
-  return import_types43.RegistryFileSchema.parse(parsed);
+  return import_types44.RegistryFileSchema.parse(parsed);
 }
 async function writeRegistry(reg) {
-  const validated = import_types43.RegistryFileSchema.parse(reg);
+  const validated = import_types44.RegistryFileSchema.parse(reg);
   await writeAtomically(registryPath(), JSON.stringify(validated, null, 2) + "\n");
 }
 var ProjectNameCollisionError = class extends Error {
@@ -11930,15 +12214,15 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 
 // src/connectors/index.ts
 init_cjs_shims();
-var import_types44 = require("@neat.is/types");
+var import_types45 = require("@neat.is/types");
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const sites = [];
   for (const edgeId of graph.inboundEdges(targetNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.provenance !== import_types44.Provenance.EXTRACTED) continue;
-    const parsed = (0, import_types44.parseFileId)(edge.source);
+    if (edge.provenance !== import_types45.Provenance.EXTRACTED) continue;
+    const parsed = (0, import_types45.parseFileId)(edge.source);
     if (!parsed || parsed.service !== serviceName || !edge.evidence) continue;
     const site = { relPath: edge.evidence.file };
     if (edge.evidence.line !== void 0) site.line = edge.evidence.line;
@@ -11949,7 +12233,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== import_types44.NodeType.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== import_types45.NodeType.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -12133,7 +12417,11 @@ var JUNCTION_DEFAULT_RATE_LIMITS = {
   // connector add/remove/test` (provision/deprovision/validate), never a poll
   // loop, so this bucket is exercised a handful of times per command. Kept
   // conservative pending a documented Drains-API rate limit.
-  vercel: { capacity: 20, refillMs: 5e3 }
+  vercel: { capacity: 20, refillMs: 5e3 },
+  // Render's REST API (api-docs.render.com/reference/rate-limiting) isn't
+  // pinned here to a single confirmed number — this is a conservative
+  // placeholder pending a live project, matching the other pull providers.
+  render: { capacity: 30, refillMs: 1e4 }
 };
 var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
 function defaultRateLimitFor(provider) {
@@ -12426,10 +12714,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path72) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path72);
+function targetFromRestPath(path74) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path74);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path72);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path74);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -12540,23 +12828,23 @@ async function fetchPgStatStatements(connectionString, limit = DEFAULT_STATEMENT
 
 // src/connectors/supabase/resolve.ts
 init_cjs_shims();
-var import_types46 = require("@neat.is/types");
+var import_types47 = require("@neat.is/types");
 function createSupabaseResolveTarget(graph, config) {
   return (signal, _ctx) => {
     if (signal.targetKind !== SUPABASE_TABLE_TARGET_KIND && signal.targetKind !== SUPABASE_RPC_TARGET_KIND) {
       return null;
     }
-    const subResourceId = (0, import_types46.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
+    const subResourceId = (0, import_types47.infraId)(signal.targetKind, `${config.nodeRef}/${signal.targetName}`);
     if (graph.hasNode(subResourceId)) {
-      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
+      return { targetNodeId: subResourceId, serviceName: config.serviceName, edgeType: import_types47.EdgeType.CALLS };
     }
-    const bareResourceId = (0, import_types46.infraId)(signal.targetKind, signal.targetName);
+    const bareResourceId = (0, import_types47.infraId)(signal.targetKind, signal.targetName);
     if (graph.hasNode(bareResourceId)) {
-      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
+      return { targetNodeId: bareResourceId, serviceName: config.serviceName, edgeType: import_types47.EdgeType.CALLS };
     }
-    const projectLevelId = (0, import_types46.infraId)("supabase", config.nodeRef);
+    const projectLevelId = (0, import_types47.infraId)("supabase", config.nodeRef);
     if (graph.hasNode(projectLevelId)) {
-      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types46.EdgeType.CALLS };
+      return { targetNodeId: projectLevelId, serviceName: config.serviceName, edgeType: import_types47.EdgeType.CALLS };
     }
     return null;
   };
@@ -12649,7 +12937,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 
 // src/connectors/railway/index.ts
 init_cjs_shims();
-var import_types50 = require("@neat.is/types");
+var import_types51 = require("@neat.is/types");
 
 // src/connectors/railway/client.ts
 init_cjs_shims();
@@ -12800,7 +13088,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types50.NodeType.RouteNode) return;
+    if (node.type !== import_types51.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -12904,12 +13192,12 @@ function createRailwayResolveTarget(config) {
     const serviceName = config.serviceNameById[config.serviceId];
     if (!serviceName) return null;
     if (signal.targetKind === ROUTE_TARGET_KIND) {
-      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types50.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName, edgeType: import_types51.EdgeType.CALLS };
     }
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: (0, import_types50.serviceId)(peerName), serviceName, edgeType: import_types50.EdgeType.CONNECTS_TO };
+      return { targetNodeId: (0, import_types51.serviceId)(peerName), serviceName, edgeType: import_types51.EdgeType.CONNECTS_TO };
     }
     return null;
   };
@@ -13033,9 +13321,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path72 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path72) return null;
-  return { resourceName, method, path: path72 };
+  const path74 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path74) return null;
+  return { resourceName, method, path: path74 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -13073,14 +13361,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path72 = pathFromRequestUrl(req.requestUrl);
-  if (path72 === null) return null;
+  const path74 = pathFromRequestUrl(req.requestUrl);
+  if (path74 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path72 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path74 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -13097,7 +13385,7 @@ function mapLogEntriesToSignals(entries) {
 
 // src/connectors/firebase/resolve.ts
 init_cjs_shims();
-var import_types51 = require("@neat.is/types");
+var import_types52 = require("@neat.is/types");
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -13112,7 +13400,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types51.NodeType.RouteNode) return;
+    if (node.type !== import_types52.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -13144,7 +13432,7 @@ function createFirebaseResolveTarget(graph, serviceMap) {
     return {
       targetNodeId: match.routeNodeId,
       serviceName,
-      edgeType: import_types51.EdgeType.CALLS
+      edgeType: import_types52.EdgeType.CALLS
     };
   };
 }
@@ -13171,7 +13459,7 @@ init_cjs_shims();
 
 // src/connectors/cloudflare/connector.ts
 init_cjs_shims();
-var import_types53 = require("@neat.is/types");
+var import_types54 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
@@ -13287,7 +13575,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path72 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path74 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -13295,7 +13583,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path72 ? { path: path72 } : {},
+    ...path74 ? { path: path74 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -13335,19 +13623,19 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === import_types53.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === import_types54.NodeType.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path72) {
-  const normalizedPath = normalizePathTemplate(path72);
+function findMatchingRouteNode(graph, serviceName, method, path74) {
+  const normalizedPath = normalizePathTemplate(path74);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== import_types53.NodeType.RouteNode || a.service !== serviceName) return;
+    if (a.type !== import_types54.NodeType.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -13359,18 +13647,18 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path72 } = signal;
+    const { method, path: path74 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path72) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path72) ?? wholeFileId;
+      if (!method || !path74) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path74) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
-      const wholeFileId = (0, import_types53.fileId)(mapping.service, mapping.entryFile);
+      const wholeFileId = (0, import_types54.fileId)(mapping.service, mapping.entryFile);
       return {
         targetNodeId: resolveRouteGrain(mapping.service, wholeFileId),
         serviceName: mapping.service,
-        edgeType: import_types53.EdgeType.CALLS
+        edgeType: import_types54.EdgeType.CALLS
       };
     }
     const taggedFileId = findTaggedWorkerFileNode(graph, scriptName);
@@ -13379,13 +13667,13 @@ function createCloudflareResolveTarget(config, graph) {
       return {
         targetNodeId: resolveRouteGrain(fileNode.service, taggedFileId),
         serviceName: fileNode.service,
-        edgeType: import_types53.EdgeType.CALLS
+        edgeType: import_types54.EdgeType.CALLS
       };
     }
     return {
-      targetNodeId: (0, import_types53.infraId)("cloudflare-worker", scriptName),
+      targetNodeId: (0, import_types54.infraId)("cloudflare-worker", scriptName),
       serviceName: scriptName,
-      edgeType: import_types53.EdgeType.CALLS,
+      edgeType: import_types54.EdgeType.CALLS,
       ensureInfraNode: { kind: "cloudflare-worker", name: scriptName, provider: "cloudflare" }
     };
   };
@@ -13581,14 +13869,14 @@ function diffNeonStatementsToSignals(rows, previous, observedAtIso) {
 
 // src/connectors/neon/resolve.ts
 init_cjs_shims();
-var import_types57 = require("@neat.is/types");
+var import_types58 = require("@neat.is/types");
 function createNeonResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind !== NEON_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
     return {
-      targetNodeId: (0, import_types57.infraId)("sql-table", signal.targetName),
+      targetNodeId: (0, import_types58.infraId)("sql-table", signal.targetName),
       serviceName: config.serviceName,
-      edgeType: import_types57.EdgeType.CALLS,
+      edgeType: import_types58.EdgeType.CALLS,
       ensureInfraNode: { kind: "sql-table", name: signal.targetName, provider: "neon" }
     };
   };
@@ -13626,45 +13914,451 @@ function createNeonConnector(config, deps = {}) {
   };
 }
 
-// src/connectors/registry.ts
-var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
-async function authProbe(input) {
-  const { provider, accountKey, url, token, init, fetchImpl } = input;
-  try {
+// src/connectors/cloud-run/index.ts
+init_cjs_shims();
+
+// src/connectors/cloud-run/client.ts
+init_cjs_shims();
+function cloudRunRequestLogName(projectId) {
+  return `projects/${projectId}/logs/run.googleapis.com%2Frequests`;
+}
+function buildCloudRunEntriesFilter(projectId, sinceIso) {
+  return [
+    `logName = "${cloudRunRequestLogName(projectId)}"`,
+    `resource.type = "${CLOUD_RUN_RESOURCE_TYPE}"`,
+    'httpRequest.requestMethod != ""',
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var CLOUD_RUN_RESOURCE_TYPE = "cloud_run_revision";
+var DEFAULT_LOOKBACK_MS2 = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL2 = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE2 = 1e3;
+var MAX_PAGES2 = 20;
+async function fetchCloudRunRequestLogEntries(creds, sinceIso, apiUrl = ENTRIES_LIST_URL2) {
+  const filter = buildCloudRunEntriesFilter(creds.projectId, sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES2; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE2,
+      ...pageToken ? { pageToken } : {}
+    };
     const res = await junctionFetch(
-      url,
+      apiUrl,
       {
-        ...init ?? {},
-        headers: { ...bearerAuthHeader(token), ...init?.headers ?? {} }
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
       },
-      { provider, accountKey, ...fetchImpl ? { fetchImpl } : {} }
+      // accountKey: the GCP project id — one customer's Cloud Logging quota is
+      // scoped per GCP project (ADR-131's per-(provider, accountKey) rate-limit
+      // bucket), the same key Firebase's connector uses.
+      { provider: "cloud-run", accountKey: creds.projectId }
     );
-    if (res.ok) return { ok: true };
-    if (res.status === 401 || res.status === 403) {
-      return { ok: false, reason: `${provider} rejected the credential (HTTP ${res.status})` };
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
     }
-    return {
-      ok: false,
-      reason: `${provider} auth check returned HTTP ${res.status} ${res.statusText} \u2014 could not confirm the credential`
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      reason: `${provider} auth check could not reach the provider: ${err.message}`
-    };
+    const json = await res.json();
+    if (Array.isArray(json.entries)) out.push(...json.entries);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
   }
+  return out;
 }
-var PROVIDER_DISPATCH = {
-  supabase: {
-    provider: "supabase",
-    primaryCredentialKey: "managementToken",
-    requiredCredentialFields: ["managementToken"],
-    requiredOptionFields: ["apiProjectRef", "nodeRef", "serviceName"],
-    build(graph, options) {
-      return createSupabaseConnector(graph, options);
-    },
-    // GET /v1/projects — the Management API's own auth-gated list endpoint, the
-    // cheapest confirmation the management token is live (the same surface
+
+// src/connectors/cloud-run/map.ts
+init_cjs_shims();
+
+// src/connectors/cloud-run/types.ts
+init_cjs_shims();
+function readCloudRunCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("cloud-run connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("cloud-run connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var CLOUD_RUN_TARGET_KIND = "cloud_run_revision";
+var FIELD_SEP2 = "\0";
+function packCloudRunTargetName(identity) {
+  return [identity.serviceName, identity.method, identity.path].join(FIELD_SEP2);
+}
+function parseCloudRunTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP2);
+  if (firstSep === -1) return null;
+  const serviceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP2);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path74 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path74) return null;
+  return { serviceName, method, path: path74 };
+}
+
+// src/connectors/cloud-run/map.ts
+var CLOUD_RUN_RESOURCE_TYPE2 = "cloud_run_revision";
+function pathFromRequestUrl2(requestUrl) {
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD4 = 500;
+function mapLogEntryToSignal2(entry2) {
+  if (!entry2 || typeof entry2 !== "object") return null;
+  if (entry2.resource?.type !== CLOUD_RUN_RESOURCE_TYPE2) return null;
+  const serviceName = entry2.resource?.labels?.["service_name"];
+  if (typeof serviceName !== "string" || serviceName.length === 0) return null;
+  const req = entry2.httpRequest;
+  if (!req) return null;
+  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path74 = pathFromRequestUrl2(req.requestUrl);
+  if (path74 === null) return null;
+  const timestamp = entry2.timestamp;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
+  return {
+    targetKind: CLOUD_RUN_TARGET_KIND,
+    targetName: packCloudRunTargetName({ serviceName, method, path: path74 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals2(entries) {
+  const out = [];
+  for (const entry2 of entries) {
+    const signal = mapLogEntryToSignal2(entry2);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/cloud-run/resolve.ts
+init_cjs_shims();
+var import_types62 = require("@neat.is/types");
+var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
+function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
+  let found = null;
+  graph.forEachNode((_id, attrs) => {
+    if (found) return;
+    const node = attrs;
+    if (node.type !== import_types62.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName || !route.pathTemplate) return;
+    if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
+    const routeMethod = route.method.toUpperCase();
+    if (routeMethod !== "ALL" && routeMethod !== method) return;
+    found = route.id;
+  });
+  return found;
+}
+function createCloudRunResolveTarget(graph, config) {
+  return (signal) => {
+    if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
+    const identity = parseCloudRunTargetName(signal.targetName);
+    if (!identity) return null;
+    const { serviceName: gcpServiceName, method, path: path74 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName];
+    if (mappedService) {
+      const routeNodeId = findMatchingRouteNode2(
+        graph,
+        mappedService,
+        method,
+        normalizePathTemplate(path74)
+      );
+      if (routeNodeId) {
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types62.EdgeType.CALLS };
+      }
+    }
+    return {
+      targetNodeId: (0, import_types62.infraId)(CLOUD_RUN_SERVICE_INFRA_KIND, gcpServiceName),
+      serviceName: mappedService ?? gcpServiceName,
+      edgeType: import_types62.EdgeType.CALLS,
+      ensureInfraNode: {
+        kind: CLOUD_RUN_SERVICE_INFRA_KIND,
+        name: gcpServiceName,
+        provider: "cloud-run"
+      }
+    };
+  };
+}
+
+// src/connectors/cloud-run/index.ts
+var CloudRunConnector = class {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  config;
+  provider = "cloud-run";
+  async poll(ctx) {
+    const creds = readCloudRunCredentials(ctx.credentials);
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_LOOKBACK_MS2;
+    const sinceIso = boundedSinceIso(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const entries = await fetchCloudRunRequestLogEntries(creds, sinceIso, this.config.apiUrl);
+    return mapLogEntriesToSignals2(entries);
+  }
+};
+function boundedSinceIso(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+function createCloudRunConnector(graph, config = {}) {
+  return {
+    connector: new CloudRunConnector(config),
+    resolveTarget: createCloudRunResolveTarget(graph, config)
+  };
+}
+
+// src/connectors/render/index.ts
+init_cjs_shims();
+var import_types65 = require("@neat.is/types");
+
+// src/connectors/render/types.ts
+init_cjs_shims();
+function readRenderToken(credentials) {
+  const token = credentials.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw new Error("Render connector requires ctx.credentials.token (a Render API key)");
+  }
+  return token;
+}
+function renderLabelValue(entry2, name) {
+  if (!Array.isArray(entry2.labels)) return void 0;
+  const label = entry2.labels.find((l) => l && typeof l === "object" && l.name === name);
+  return label && typeof label.value === "string" ? label.value : void 0;
+}
+
+// src/connectors/render/client.ts
+init_cjs_shims();
+var DEFAULT_RENDER_API_URL = "https://api.render.com/v1";
+var DEFAULT_RENDER_LOG_LIMIT = 100;
+var RENDER_MAX_LOG_LIMIT = 100;
+var DEFAULT_RENDER_MAX_PAGES = 20;
+var DEFAULT_MAX_LOOKBACK_MS4 = 24 * 60 * 60 * 1e3;
+function clampLimit(limit) {
+  const raw = Math.trunc(limit ?? DEFAULT_RENDER_LOG_LIMIT);
+  if (!Number.isFinite(raw) || raw < 1) return DEFAULT_RENDER_LOG_LIMIT;
+  return Math.min(raw, RENDER_MAX_LOG_LIMIT);
+}
+function boundedRenderStartTime(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+async function fetchRenderLogPage(config, token, startTime, endTime, limit, fetchImpl) {
+  const url = new URL(`${config.apiUrl ?? DEFAULT_RENDER_API_URL}/logs`);
+  url.searchParams.set("ownerId", config.ownerId);
+  url.searchParams.set("resource", config.resourceId);
+  url.searchParams.set("type", "request");
+  url.searchParams.set("startTime", startTime);
+  url.searchParams.set("endTime", endTime);
+  url.searchParams.set("direction", "backward");
+  url.searchParams.set("limit", String(limit));
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: { ...bearerAuthHeader(token) } },
+    { provider: "render", accountKey: config.ownerId, ...fetchImpl ? { fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`Render logs request failed: ${res.status} ${res.statusText}`);
+  }
+  return await res.json();
+}
+async function fetchRenderRequestLogs(config, token, startTime, endTime, fetchImpl) {
+  const limit = clampLimit(config.limit);
+  const maxPages = Math.max(1, Math.trunc(config.maxPages ?? DEFAULT_RENDER_MAX_PAGES));
+  const out = [];
+  let pageStart = startTime;
+  let pageEnd = endTime;
+  for (let page = 0; page < maxPages; page++) {
+    const body = await fetchRenderLogPage(config, token, pageStart, pageEnd, limit, fetchImpl);
+    if (Array.isArray(body.logs)) out.push(...body.logs);
+    if (!body.hasMore || !body.nextStartTime || !body.nextEndTime) break;
+    pageStart = body.nextStartTime;
+    pageEnd = body.nextEndTime;
+  }
+  return out;
+}
+
+// src/connectors/render/index.ts
+var ROUTE_TARGET_KIND2 = "route";
+var UNMATCHED_ROUTE_TARGET_KIND2 = "unmatched-route";
+function buildRenderRouteIndex(graph, serviceName) {
+  const out = [];
+  graph.forEachNode((_id, attrs) => {
+    const node = attrs;
+    if (node.type !== import_types65.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName) return;
+    out.push({
+      method: route.method.toUpperCase(),
+      normalizedPath: normalizePathTemplate(route.pathTemplate),
+      routeNodeId: route.id,
+      path: route.path,
+      line: route.line
+    });
+  });
+  return out;
+}
+function findRenderRoute(entries, method, normalizedPath) {
+  return entries.find(
+    (e) => e.normalizedPath === normalizedPath && (e.method === "ALL" || e.method === method)
+  );
+}
+function bucketKey3(method, normalizedPath) {
+  return `${method} ${normalizedPath}`;
+}
+function isHttpErrorStatus2(status2) {
+  return status2 >= 400;
+}
+function upsertBucket2(buckets2, key, isError, timestamp, build) {
+  const existing = buckets2.get(key);
+  if (existing) {
+    existing.callCount += 1;
+    if (isError) existing.errorCount += 1;
+    if (timestamp > existing.lastObservedIso) existing.lastObservedIso = timestamp;
+    return;
+  }
+  buckets2.set(key, { callCount: 1, errorCount: isError ? 1 : 0, lastObservedIso: timestamp, ...build() });
+}
+function mapRenderRequestLogsToSignals(entries, routeIndex) {
+  const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entries)) return [];
+  for (const entry2 of entries) {
+    if (!entry2 || typeof entry2 !== "object") continue;
+    if (typeof entry2.timestamp !== "string") continue;
+    const method = renderLabelValue(entry2, "method");
+    const rawPath = renderLabelValue(entry2, "path");
+    if (typeof method !== "string" || method.length === 0) continue;
+    if (typeof rawPath !== "string" || rawPath.length === 0) continue;
+    const methodUpper = method.toUpperCase();
+    const pathOnly = rawPath.split("?")[0];
+    const normalizedPath = normalizePathTemplate(pathOnly);
+    const statusCode = Number.parseInt(renderLabelValue(entry2, "statusCode") ?? "", 10);
+    const isError = Number.isFinite(statusCode) && isHttpErrorStatus2(statusCode);
+    const match = findRenderRoute(routeIndex, methodUpper, normalizedPath);
+    if (match) {
+      upsertBucket2(buckets2, `route:${match.routeNodeId}`, isError, entry2.timestamp, () => ({
+        targetKind: ROUTE_TARGET_KIND2,
+        targetName: match.routeNodeId,
+        // RouteNode.line is optional in the schema (packages/types/src/
+        // nodes.ts) even though routes.ts always sets it today — skip the
+        // callSite rather than fabricate a line when it's ever absent
+        // (file-awareness.md §6).
+        ...match.line !== void 0 ? { callSite: { file: match.path, line: match.line } } : {}
+      }));
+    } else {
+      upsertBucket2(
+        buckets2,
+        `unmatched:${bucketKey3(methodUpper, normalizedPath)}`,
+        isError,
+        entry2.timestamp,
+        () => ({
+          targetKind: UNMATCHED_ROUTE_TARGET_KIND2,
+          targetName: bucketKey3(methodUpper, normalizedPath)
+        })
+      );
+    }
+  }
+  return [...buckets2.values()].map((b) => ({
+    targetKind: b.targetKind,
+    targetName: b.targetName,
+    callCount: b.callCount,
+    errorCount: b.errorCount,
+    lastObservedIso: b.lastObservedIso,
+    ...b.callSite ? { callSite: b.callSite } : {}
+  }));
+}
+function createRenderResolveTarget(config) {
+  return (signal) => {
+    if (signal.targetKind === ROUTE_TARGET_KIND2) {
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types65.EdgeType.CALLS };
+    }
+    return null;
+  };
+}
+function createRenderConnector(graph, config) {
+  return {
+    provider: "render",
+    async poll(ctx) {
+      const token = readRenderToken(ctx.credentials);
+      const now = /* @__PURE__ */ new Date();
+      const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS4;
+      const startTime = boundedRenderStartTime(ctx.since, now, maxLookbackMs);
+      const endTime = now.toISOString();
+      const logs = await fetchRenderRequestLogs(config, token, startTime, endTime);
+      const routeIndex = buildRenderRouteIndex(graph, config.serviceName);
+      return mapRenderRequestLogsToSignals(logs, routeIndex);
+    }
+  };
+}
+
+// src/connectors/registry.ts
+var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
+async function authProbe(input) {
+  const { provider, accountKey, url, token, init, fetchImpl } = input;
+  try {
+    const res = await junctionFetch(
+      url,
+      {
+        ...init ?? {},
+        headers: { ...bearerAuthHeader(token), ...init?.headers ?? {} }
+      },
+      { provider, accountKey, ...fetchImpl ? { fetchImpl } : {} }
+    );
+    if (res.ok) return { ok: true };
+    if (res.status === 401 || res.status === 403) {
+      return { ok: false, reason: `${provider} rejected the credential (HTTP ${res.status})` };
+    }
+    return {
+      ok: false,
+      reason: `${provider} auth check returned HTTP ${res.status} ${res.statusText} \u2014 could not confirm the credential`
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `${provider} auth check could not reach the provider: ${err.message}`
+    };
+  }
+}
+var PROVIDER_DISPATCH = {
+  supabase: {
+    provider: "supabase",
+    primaryCredentialKey: "managementToken",
+    requiredCredentialFields: ["managementToken"],
+    requiredOptionFields: ["apiProjectRef", "nodeRef", "serviceName"],
+    build(graph, options) {
+      return createSupabaseConnector(graph, options);
+    },
+    // GET /v1/projects — the Management API's own auth-gated list endpoint, the
+    // cheapest confirmation the management token is live (the same surface
     // client.ts polls, minus the heavy log query).
     validate({ credentials, options, fetchImpl }) {
       const cfg = options;
@@ -13801,6 +14495,71 @@ var PROVIDER_DISPATCH = {
         return { ok: false, reason: `neon telemetry read failed: ${err.message}` };
       }
     }
+  },
+  "cloud-run": {
+    provider: "cloud-run",
+    // Cloud Run reads both projectId and accessToken from the credential; the
+    // single-string form maps to the secret (the token), and the required-fields
+    // check below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createCloudRunConnector(graph, options);
+    },
+    // POST entries:list with pageSize 1 — the exact surface poll() reads, so the
+    // probe checks the actual `logging.logEntries.list` permission the connector
+    // needs. A GET on the lighter logs.list endpoint (as Firebase probes) would
+    // instead check `logging.logs.list`, falsely rejecting a correctly-scoped
+    // custom role that carries only `logging.logEntries.list` (the narrowest
+    // grant docs/connectors/cloud-run.md documents) — the same false-negative
+    // trap Railway's validate avoids by probing its real query. A 2xx means the
+    // token can list log entries; 401/403 means the provider rejected it.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "cloud-run",
+        accountKey: projectId || "validate",
+        url: "https://logging.googleapis.com/v2/entries:list",
+        token: String(credentials.accessToken ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ resourceNames: [`projects/${projectId}`], pageSize: 1 })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
+  render: {
+    provider: "render",
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token"],
+    requiredOptionFields: ["ownerId", "resourceId", "serviceName"],
+    build(graph, options) {
+      const config = options;
+      return {
+        connector: createRenderConnector(graph, config),
+        resolveTarget: createRenderResolveTarget(config)
+      };
+    },
+    // GET /v1/services?limit=1 — the cheapest read the Render API key
+    // authenticates against (render.com/docs/api). Unlike Railway's GraphQL
+    // gateway, Render is a plain REST API: a live key returns 2xx, a bad one a
+    // 401/403, so authProbe's status-code check is a true verdict here. The
+    // logs query itself also needs an ownerId + resource; `services` needs
+    // neither and still fails 401 on a bad token, so it's the honest probe.
+    validate({ credentials, options, fetchImpl }) {
+      const cfg = options;
+      const baseUrl = cfg.apiUrl ?? DEFAULT_RENDER_API_URL;
+      return authProbe({
+        provider: "render",
+        accountKey: cfg.ownerId ?? "validate",
+        url: `${baseUrl}/services?limit=1`,
+        token: String(credentials.token ?? ""),
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
   }
 };
 function vercelCredsFrom(credentials) {
@@ -14231,11 +14990,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types60.DivergenceTypeSchema.safeParse(c);
+        const r = import_types67.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types60.DivergenceTypeSchema.options
+            allowed: import_types67.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -14544,7 +15303,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types60.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types67.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -14583,7 +15342,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types60.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types67.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -14916,7 +15675,7 @@ var import_node_fs33 = require("fs");
 var import_node_path60 = __toESM(require("path"), 1);
 
 // src/daemon.ts
-var import_types61 = require("@neat.is/types");
+var import_types68 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path61.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -19536,13 +20295,462 @@ async function runHooksCommand(args) {
   }
 }
 
+// src/codex-cli.ts
+init_cjs_shims();
+var import_node_path70 = __toESM(require("path"), 1);
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_fs43 = require("fs");
+var import_node_util = require("util");
+var import_smol_toml5 = require("smol-toml");
+var CODEX_MCP_SERVER = {
+  command: "npx",
+  args: ["-y", "@neat.is/mcp"],
+  env: { NEAT_CORE_URL: "http://localhost:8080" }
+};
+var CODEX_NEAT_BLOCK = [
+  "[mcp_servers.neat]",
+  'command = "npx"',
+  'args = ["-y", "@neat.is/mcp"]',
+  'env = { NEAT_CORE_URL = "http://localhost:8080" }'
+].join("\n");
+var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
+var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
+function codexConfigPath() {
+  const override = process.env.NEAT_CODEX_CONFIG;
+  if (override && override.length > 0) return import_node_path70.default.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os6.default.homedir();
+  return import_node_path70.default.join(home, ".codex", "config.toml");
+}
+function agentsFilePath() {
+  const override = process.env.NEAT_CODEX_AGENTS;
+  if (override && override.length > 0) return import_node_path70.default.resolve(override);
+  return import_node_path70.default.join(process.cwd(), "AGENTS.md");
+}
+function isTableHeader(line) {
+  return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
+}
+function tableName(line) {
+  return line.trim().replace(/^\[\[?/, "").replace(/\]\]?$/, "").trim();
+}
+function isNeatHeader(line) {
+  return isTableHeader(line) && tableName(line) === "mcp_servers.neat";
+}
+function isNeatChildHeader(line) {
+  if (!isTableHeader(line)) return false;
+  const name = tableName(line);
+  return name === "mcp_servers.neat" || name.startsWith("mcp_servers.neat.");
+}
+function upsertCodexConfig(raw) {
+  const trimmed = raw.trim();
+  const parsed = trimmed.length > 0 ? (0, import_smol_toml5.parse)(raw) : {};
+  const existingServers = parsed.mcp_servers ?? {};
+  const spliced = spliceNeatBlock(raw);
+  let text;
+  if (verifyPreserved(raw, spliced, parsed)) {
+    text = spliced;
+  } else {
+    const merged = {
+      ...parsed,
+      mcp_servers: { ...existingServers, neat: CODEX_MCP_SERVER }
+    };
+    text = (0, import_smol_toml5.stringify)(merged);
+    if (!text.endsWith("\n")) text += "\n";
+  }
+  return { text, changed: text !== raw };
+}
+function spliceNeatBlock(raw) {
+  const block = CODEX_NEAT_BLOCK;
+  const lines = raw.length > 0 ? raw.split("\n") : [];
+  const start = lines.findIndex(isNeatHeader);
+  if (start === -1) {
+    const base = raw.replace(/\n+$/, "");
+    return base.length > 0 ? `${base}
+
+${block}
+` : `${block}
+`;
+  }
+  let end = start + 1;
+  for (; ; ) {
+    while (end < lines.length && !isTableHeader(lines[end])) end++;
+    if (end < lines.length && isNeatChildHeader(lines[end])) {
+      end++;
+      continue;
+    }
+    break;
+  }
+  const before = lines.slice(0, start).join("\n").replace(/\n*$/, "");
+  const after = lines.slice(end).join("\n").replace(/^\n*/, "");
+  let text = "";
+  if (before.length > 0) text += `${before}
+
+`;
+  text += `${block}
+`;
+  if (after.length > 0) text += `
+${after}`;
+  return `${text.replace(/\n*$/, "")}
+`;
+}
+function verifyPreserved(raw, spliced, original) {
+  let next;
+  try {
+    next = (0, import_smol_toml5.parse)(spliced);
+  } catch {
+    return false;
+  }
+  const origServers = original.mcp_servers ?? {};
+  const nextServers = next.mcp_servers ?? {};
+  if (!(0, import_node_util.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
+  for (const name of Object.keys(origServers)) {
+    if (name === "neat") continue;
+    if (!(0, import_node_util.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
+  }
+  for (const name of Object.keys(nextServers)) {
+    if (name !== "neat" && !(name in origServers)) return false;
+  }
+  for (const key of Object.keys(original)) {
+    if (key === "mcp_servers") continue;
+    if (!(0, import_node_util.isDeepStrictEqual)(next[key], original[key])) return false;
+  }
+  for (const key of Object.keys(next)) {
+    if (key !== "mcp_servers" && !(key in original)) return false;
+  }
+  return true;
+}
+function agentsBlock(guide) {
+  return `${NEAT_GRAPH_FIRST_START}
+${guide.replace(/\s+$/, "")}
+${NEAT_GRAPH_FIRST_END}
+`;
+}
+function upsertAgents(raw, guide) {
+  const block = agentsBlock(guide);
+  if (raw.length === 0) return { text: block, changed: true };
+  const startIdx = raw.indexOf(NEAT_GRAPH_FIRST_START);
+  const endIdx = raw.indexOf(NEAT_GRAPH_FIRST_END);
+  if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
+    const before = raw.slice(0, startIdx);
+    const after = raw.slice(endIdx + NEAT_GRAPH_FIRST_END.length);
+    const text2 = `${before}${block.replace(/\n+$/, "")}${after}`;
+    return { text: text2, changed: text2 !== raw };
+  }
+  const base = raw.replace(/\n+$/, "");
+  const text = base.length > 0 ? `${base}
+
+${block}` : block;
+  return { text, changed: text !== raw };
+}
+async function readGuide() {
+  return readSkillAsset(GUIDE_FILENAME);
+}
+async function runCodex(opts) {
+  if (opts.printConfig) {
+    process.stdout.write(`${CODEX_NEAT_BLOCK}
+`);
+    return { exitCode: 0 };
+  }
+  if (opts.printGuide) {
+    process.stdout.write(agentsBlock(await readGuide()));
+    return { exitCode: 0 };
+  }
+  const configPath = codexConfigPath();
+  const agentsPath = agentsFilePath();
+  let configRaw = "";
+  try {
+    configRaw = await import_node_fs43.promises.readFile(configPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
+      return { exitCode: 1 };
+    }
+  }
+  let agentsRaw = "";
+  try {
+    agentsRaw = await import_node_fs43.promises.readFile(agentsPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
+      return { exitCode: 1 };
+    }
+  }
+  let config;
+  try {
+    config = upsertCodexConfig(configRaw);
+  } catch (err) {
+    console.error(
+      `neat codex: ${configPath} is not valid TOML \u2014 ${err.message}`
+    );
+    console.error("neat codex: fix the file and re-run; nothing was written.");
+    return { exitCode: 1 };
+  }
+  const guide = await readGuide();
+  const agents = upsertAgents(agentsRaw, guide);
+  if (!opts.apply) {
+    console.log("neat codex \u2014 plan (nothing written; re-run with --apply to write)");
+    console.log("");
+    console.log(`  Codex MCP config: ${configPath}`);
+    console.log(
+      config.changed ? `    ${configRaw ? "update" : "create"} the [mcp_servers.neat] table:` : "    already up to date \u2014 [mcp_servers.neat] matches"
+    );
+    if (config.changed) {
+      for (const line of CODEX_NEAT_BLOCK.split("\n")) console.log(`      ${line}`);
+    }
+    console.log("");
+    console.log(`  Project instructions: ${agentsPath}`);
+    console.log(
+      agents.changed ? `    ${agentsRaw ? "update" : "create"} the graph-first block (between ${NEAT_GRAPH_FIRST_START} markers)` : "    already up to date \u2014 graph-first block matches"
+    );
+    console.log("");
+    console.log("The MCP server reads NEAT_CORE_URL for the daemon URL \u2014 edit that value in");
+    console.log("the generated table to point Codex at a non-default daemon.");
+    return { exitCode: 0 };
+  }
+  if (config.changed) {
+    await import_node_fs43.promises.mkdir(import_node_path70.default.dirname(configPath), { recursive: true });
+    await import_node_fs43.promises.writeFile(configPath, config.text, "utf8");
+    console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
+  } else {
+    console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
+  }
+  if (agents.changed) {
+    await import_node_fs43.promises.mkdir(import_node_path70.default.dirname(agentsPath), { recursive: true });
+    await import_node_fs43.promises.writeFile(agentsPath, agents.text, "utf8");
+    console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
+  } else {
+    console.log(`neat codex: ${agentsPath} already has the graph-first block`);
+  }
+  console.log("");
+  console.log("restart Codex to pick up the new MCP server. NEAT_CORE_URL in the table");
+  console.log("points the server at the local daemon \u2014 edit it for a non-default one.");
+  return { exitCode: 0 };
+}
+function usage2() {
+  console.log("neat codex \u2014 install NEAT into the OpenAI Codex CLI (MCP server + AGENTS.md)");
+  console.log("");
+  console.log("  (no flag)        plan: print what would change, write nothing");
+  console.log("  --apply          add [mcp_servers.neat] to ~/.codex/config.toml and write");
+  console.log("                   the graph-first block into ./AGENTS.md, merging into both");
+  console.log("                   without touching your other servers or instructions");
+  console.log("  --print-config   print the [mcp_servers.neat] TOML block to stdout");
+  console.log("  --print-guide    print the AGENTS.md graph-first block to stdout");
+  console.log("");
+  console.log("Existing config is preserved and a re-run is a no-op. A malformed");
+  console.log("config.toml is a clear error with no partial write.");
+}
+async function runCodexCommand(args) {
+  const opts = { apply: false, printConfig: false, printGuide: false };
+  for (const arg of args) {
+    switch (arg) {
+      case "--apply":
+        opts.apply = true;
+        break;
+      case "--print-config":
+        opts.printConfig = true;
+        break;
+      case "--print-guide":
+        opts.printGuide = true;
+        break;
+      case "-h":
+      case "--help":
+        usage2();
+        return 0;
+      default:
+        console.error(`neat codex: unknown flag "${arg}"`);
+        usage2();
+        return 2;
+    }
+  }
+  try {
+    const { exitCode } = await runCodex(opts);
+    return exitCode;
+  } catch (err) {
+    console.error(err.message);
+    return 1;
+  }
+}
+
+// src/editors-cli.ts
+init_cjs_shims();
+var import_node_path71 = __toESM(require("path"), 1);
+var import_node_os7 = __toESM(require("os"), 1);
+var import_node_fs44 = require("fs");
+var NEAT_MCP_SERVER = {
+  command: "npx",
+  args: ["-y", "@neat.is/mcp"]
+};
+var GRAPH_FIRST_MARKER_OPEN = "<!-- neat:graph-first -->";
+var GRAPH_FIRST_MARKER_CLOSE = "<!-- /neat:graph-first -->";
+function homeDir() {
+  return process.env.HOME ?? process.env.USERPROFILE ?? import_node_os7.default.homedir();
+}
+var CURSOR_CLIENT = {
+  id: "cursor",
+  label: "Cursor",
+  docsUrl: "https://docs.cursor.com/context/mcp",
+  mcpConfigPath: () => {
+    const override = process.env.NEAT_CURSOR_CONFIG;
+    if (override && override.length > 0) return import_node_path71.default.resolve(override);
+    return import_node_path71.default.join(homeDir(), ".cursor", "mcp.json");
+  },
+  // Cursor still reads a single `.cursorrules` at the project root (the modern
+  // `.cursor/rules/*.mdc` split is one-rule-per-file with frontmatter — a worse
+  // fit for a marker-fenced block). GRAPH_FIRST.md names this file directly.
+  rulesFileName: ".cursorrules"
+};
+var DEVIN_CLIENT = {
+  id: "devin",
+  label: "Devin Desktop (Cascade)",
+  docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
+  mcpConfigPath: () => {
+    const override = process.env.NEAT_DEVIN_CONFIG;
+    if (override && override.length > 0) return import_node_path71.default.resolve(override);
+    return import_node_path71.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json");
+  },
+  rulesFileName: ".windsurfrules"
+};
+function mergeMcpConfig(existing) {
+  const servers = existing.mcpServers ?? {};
+  const already = JSON.stringify(servers.neat) === JSON.stringify(NEAT_MCP_SERVER);
+  const merged = {
+    ...existing,
+    mcpServers: { ...servers, neat: NEAT_MCP_SERVER }
+  };
+  return { merged, changed: !already };
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function buildGuidanceBlock(guide) {
+  return `${GRAPH_FIRST_MARKER_OPEN}
+${guide.trim()}
+${GRAPH_FIRST_MARKER_CLOSE}
+`;
+}
+function mergeRulesFile(existing, block) {
+  const region = new RegExp(
+    `${escapeRegExp(GRAPH_FIRST_MARKER_OPEN)}[\\s\\S]*?${escapeRegExp(GRAPH_FIRST_MARKER_CLOSE)}\\n?`
+  );
+  if (region.test(existing)) return existing.replace(region, block);
+  if (existing.trim().length === 0) return block;
+  return `${existing.replace(/\s+$/, "")}
+
+${block}`;
+}
+async function runEditorInstall(client, opts) {
+  const mcpPath = client.mcpConfigPath();
+  const rulesPath = import_node_path71.default.join(opts.projectDir, client.rulesFileName);
+  let existingMcp = {};
+  try {
+    existingMcp = JSON.parse(await import_node_fs44.promises.readFile(mcpPath, "utf8"));
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      existingMcp = {};
+    } else if (err instanceof SyntaxError) {
+      console.error(
+        `neat ${client.id}: ${mcpPath} is not valid JSON \u2014 ${e.message}. Fix it (or move it aside) and re-run; nothing was written.`
+      );
+      return { exitCode: 1 };
+    } else {
+      console.error(`neat ${client.id}: failed to read ${mcpPath} \u2014 ${e.message}`);
+      return { exitCode: 1 };
+    }
+  }
+  let existingRules = "";
+  try {
+    existingRules = await import_node_fs44.promises.readFile(rulesPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
+      return { exitCode: 1 };
+    }
+  }
+  const guide = await readSkillAsset(GUIDE_FILENAME);
+  const block = buildGuidanceBlock(guide);
+  const { merged, changed: mcpChanged } = mergeMcpConfig(existingMcp);
+  const mcpJson = JSON.stringify(merged, null, 2) + "\n";
+  const newRules = mergeRulesFile(existingRules, block);
+  const rulesChanged = newRules !== existingRules;
+  if (!opts.apply) {
+    console.log(`neat ${client.id} \u2014 wire NEAT into ${client.label} (plan; nothing written)`);
+    console.log("");
+    console.log(`MCP server \u2192 ${mcpPath}`);
+    console.log(
+      mcpChanged ? "  would add mcpServers.neat:" : "  mcpServers.neat already present and current \u2014 no change:"
+    );
+    console.log(indent(JSON.stringify({ neat: NEAT_MCP_SERVER }, null, 2)));
+    console.log("");
+    console.log(`Graph-first guidance \u2192 ${rulesPath}`);
+    console.log(
+      rulesChanged ? existingRules.includes(GRAPH_FIRST_MARKER_OPEN) ? "  would refresh the neat:graph-first block:" : "  would add the neat:graph-first block:" : "  neat:graph-first block already present and current \u2014 no change."
+    );
+    if (rulesChanged) console.log(indent(block.trimEnd()));
+    console.log("");
+    console.log(`Re-run with --apply to write both files. Existing servers and rules are kept.`);
+    return { exitCode: 0 };
+  }
+  await import_node_fs44.promises.mkdir(import_node_path71.default.dirname(mcpPath), { recursive: true });
+  await import_node_fs44.promises.writeFile(mcpPath, mcpJson, "utf8");
+  await import_node_fs44.promises.mkdir(import_node_path71.default.dirname(rulesPath), { recursive: true });
+  await import_node_fs44.promises.writeFile(rulesPath, newRules, "utf8");
+  console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
+  console.log(`  MCP server: ${mcpPath} (mcpServers.neat \u2192 npx -y @neat.is/mcp)`);
+  console.log(`  guidance:   ${rulesPath} (neat:graph-first block)`);
+  console.log("");
+  console.log(`restart ${client.label} to pick up the MCP server. Point it at a non-default`);
+  console.log(`daemon by setting NEAT_CORE_URL in the neat server's env in that config.`);
+  return { exitCode: 0 };
+}
+function indent(text) {
+  return text.split("\n").map((line) => line.length > 0 ? `    ${line}` : line).join("\n");
+}
+function usage3(client) {
+  console.log(`neat ${client.id} \u2014 install NEAT's MCP server + graph-first guidance into ${client.label}`);
+  console.log("");
+  console.log("  --apply   write the MCP config and the rules file (default: plan only)");
+  console.log("");
+  console.log("Writes NEAT's stdio MCP server (npx -y @neat.is/mcp) into");
+  console.log(`  ${client.mcpConfigPath()}`);
+  console.log(`and the graph-first guidance block into ./${client.rulesFileName}, both`);
+  console.log("additively \u2014 existing servers and rules are preserved, a re-run is a no-op.");
+  console.log("");
+  console.log(`See ${client.docsUrl} for ${client.label}'s MCP config format.`);
+}
+async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
+  const client = clientId === "cursor" ? CURSOR_CLIENT : DEVIN_CLIENT;
+  let apply4 = false;
+  for (const arg of args) {
+    switch (arg) {
+      case "--apply":
+        apply4 = true;
+        break;
+      case "-h":
+      case "--help":
+        usage3(client);
+        return 0;
+      default:
+        console.error(`neat ${client.id}: unknown flag "${arg}"`);
+        usage3(client);
+        return 2;
+    }
+  }
+  try {
+    const { exitCode } = await runEditorInstall(client, { apply: apply4, projectDir });
+    return exitCode;
+  } catch (err) {
+    console.error(err.message);
+    return 1;
+  }
+}
+
 // src/monitor.ts
 init_cjs_shims();
-var import_types63 = require("@neat.is/types");
+var import_types70 = require("@neat.is/types");
 
 // src/cli-client.ts
 init_cjs_shims();
-var import_types62 = require("@neat.is/types");
+var import_types69 = require("@neat.is/types");
 var HttpError = class extends Error {
   constructor(status2, message, responseBody = "") {
     super(message);
@@ -19567,10 +20775,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path72) {
+    async get(path74) {
       let res;
       try {
-        res = await fetch(`${root}${path72}`, {
+        res = await fetch(`${root}${path74}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -19582,16 +20790,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path72}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path74}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path72, body) {
+    async post(path74, body) {
       let res;
       try {
-        res = await fetch(`${root}${path72}`, {
+        res = await fetch(`${root}${path74}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -19605,7 +20813,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path72}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path74}: ${text}`,
           text
         );
       }
@@ -19619,12 +20827,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path72 = projectPath(
+  const path74 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path72);
+    const result = await client.get(path74);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -19650,12 +20858,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path72 = projectPath(
+  const path74 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path72);
+    const result = await client.get(path74);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -19684,17 +20892,17 @@ async function runBlastRadius(client, input) {
   }
 }
 function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === import_types62.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  const tag = n.edgeProvenance === import_types69.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
   return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path72 = projectPath(
+  const path74 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path72);
+    const result = await client.get(path74);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -19741,7 +20949,7 @@ async function runObservedDependencies(client, input) {
       if (result.observed) {
         return {
           summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
-          provenance: import_types62.Provenance.OBSERVED
+          provenance: import_types69.Provenance.OBSERVED
         };
       }
       const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
@@ -19751,7 +20959,7 @@ async function runObservedDependencies(client, input) {
     return {
       summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
       block: blockLines.join("\n"),
-      provenance: import_types62.Provenance.OBSERVED
+      provenance: import_types69.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -19786,9 +20994,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path72 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path74 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path72);
+    const body = await client.get(path74);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -19805,7 +21013,7 @@ async function runIncidents(client, input) {
     return {
       summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
       block: blockLines.join("\n"),
-      provenance: import_types62.Provenance.OBSERVED
+      provenance: import_types69.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -19914,7 +21122,7 @@ async function runStaleEdges(client, input) {
   return {
     summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
     block: blockLines.join("\n"),
-    provenance: import_types62.Provenance.STALE
+    provenance: import_types69.Provenance.STALE
   };
 }
 async function runPolicies(client, input) {
@@ -20073,10 +21281,10 @@ async function pushSnapshotToRemote(input) {
 
 // src/monitor.ts
 var OBSERVED_DEP_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types63.EdgeType.CALLS,
-  import_types63.EdgeType.CONNECTS_TO,
-  import_types63.EdgeType.PUBLISHES_TO,
-  import_types63.EdgeType.CONSUMES_FROM
+  import_types70.EdgeType.CALLS,
+  import_types70.EdgeType.CONNECTS_TO,
+  import_types70.EdgeType.PUBLISHES_TO,
+  import_types70.EdgeType.CONSUMES_FROM
 ]);
 function divergenceKey(d) {
   const column = "column" in d && d.column ? d.column : "";
@@ -20121,7 +21329,7 @@ function formatDivergenceLine2(d) {
   }
 }
 function formatStaleLine(edgeId) {
-  const parsed = (0, import_types63.parseEdgeId)(edgeId);
+  const parsed = (0, import_types70.parseEdgeId)(edgeId);
   if (parsed) {
     return `\u22EF stale  ${parsed.source} \u2192 ${parsed.target}  (observed edge went quiet)`;
   }
@@ -20134,7 +21342,7 @@ function divergenceJson(d) {
   return JSON.stringify({ kind: "divergence", ...d });
 }
 function staleJson(edgeId) {
-  const parsed = (0, import_types63.parseEdgeId)(edgeId);
+  const parsed = (0, import_types70.parseEdgeId)(edgeId);
   return JSON.stringify({
     kind: "stale",
     edgeId,
@@ -20151,6 +21359,24 @@ function observedEdgeJson(edge) {
     provenance: edge.provenance
   });
 }
+function policyKey(v) {
+  return `policy|${v.id}`;
+}
+function policySubject(v) {
+  const s = v.subject;
+  if (s.nodeId) return s.nodeId;
+  if (s.edgeId) return s.edgeId;
+  if (s.path && s.path.length > 0) return s.path.join(" \u2192 ");
+  return "";
+}
+function formatPolicyLine(v) {
+  const subject = policySubject(v);
+  const where = subject ? `  (${subject})` : "";
+  return `\u26A0 policy [${v.severity}] ${v.policyName} \u2014 ${v.message}${where}`;
+}
+function policyJson(v) {
+  return JSON.stringify({ kind: "policy", ...v });
+}
 var MonitorEmitter = class {
   constructor(opts) {
     this.opts = opts;
@@ -20186,7 +21412,7 @@ var MonitorEmitter = class {
   // ignores non-OBSERVED edges and non-dependency edge types (structural
   // ownership), so only real runtime dependencies reach stdout.
   emitObservedEdge(edge) {
-    if (edge.provenance !== import_types63.Provenance.OBSERVED) return false;
+    if (edge.provenance !== import_types70.Provenance.OBSERVED) return false;
     if (!OBSERVED_DEP_EDGE_TYPES.has(edge.type)) return false;
     const key = `edge|${edge.id}`;
     if (this.seen.has(key)) return false;
@@ -20194,6 +21420,20 @@ var MonitorEmitter = class {
     this.out(this.opts.json ? observedEdgeJson(edge) : formatObservedEdgeLine(edge));
     return true;
   }
+  // Emit every not-yet-seen policy violation in a fresh /policies/violations
+  // read. Returns the count newly emitted (0 → nothing printed, the silent
+  // path). Idempotent across re-reads: the seen-set keys off the violation id.
+  emitPolicies(response) {
+    let emitted = 0;
+    for (const v of response.violations) {
+      const key = policyKey(v);
+      if (this.seen.has(key)) continue;
+      this.seen.add(key);
+      this.out(this.opts.json ? policyJson(v) : formatPolicyLine(v));
+      emitted++;
+    }
+    return emitted;
+  }
 };
 function parseFrame(raw) {
   let event = "message";
@@ -20248,65 +21488,97 @@ function projectPath2(project, suffix) {
 function backoffDelay(attempt, capMs) {
   return Math.min(capMs, 500 * 2 ** Math.min(attempt, 6));
 }
-async function runMonitor(opts) {
-  const write = opts.write ?? ((line) => process.stdout.write(line));
-  const debounceMs = opts.debounceMs ?? 400;
-  const backoffCapMs = opts.backoffCapMs ?? 1e4;
-  const maxReconnects = opts.maxReconnects ?? Number.POSITIVE_INFINITY;
-  const client = createHttpClient(opts.baseUrl, opts.authToken);
-  const emitter = new MonitorEmitter({ json: opts.json, write });
-  const divergencesPath = projectPath2(opts.project, "/graph/divergences");
-  const eventsUrl = `${opts.baseUrl.replace(/\/$/, "")}${projectPath2(opts.project, "/events")}`;
-  let readTimer = null;
-  let reading = false;
-  let readPending = false;
-  const doRead = async () => {
-    if (reading) {
-      readPending = true;
+var defaultOpenEvents = async (url, headers, signal) => {
+  const res = await fetch(url, { headers, signal });
+  return { ok: res.ok, status: res.status, body: res.body };
+};
+function makeDebouncedReader(read, debounceMs) {
+  let timer = null;
+  let running = false;
+  let pending = false;
+  const cancel = () => {
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+  };
+  const run = async () => {
+    if (running) {
+      pending = true;
       return;
     }
-    reading = true;
+    running = true;
     try {
-      const result = await client.get(divergencesPath);
-      emitter.emitDivergences(result);
+      await read();
     } catch {
     } finally {
-      reading = false;
-      if (readPending) {
-        readPending = false;
-        scheduleRead();
+      running = false;
+      if (pending) {
+        pending = false;
+        schedule();
       }
     }
   };
-  const scheduleRead = () => {
-    if (readTimer) clearTimeout(readTimer);
-    readTimer = setTimeout(() => {
-      readTimer = null;
-      void doRead();
+  const schedule = () => {
+    cancel();
+    timer = setTimeout(() => {
+      timer = null;
+      void run();
     }, debounceMs);
-    if (typeof readTimer.unref === "function") readTimer.unref();
+    if (typeof timer.unref === "function") timer.unref();
+  };
+  return {
+    schedule,
+    runNow: async () => {
+      cancel();
+      await run();
+    },
+    cancel
   };
+}
+async function runMonitor(opts) {
+  const write = opts.write ?? ((line) => process.stdout.write(line));
+  const debounceMs = opts.debounceMs ?? 400;
+  const backoffCapMs = opts.backoffCapMs ?? 1e4;
+  const maxReconnects = opts.maxReconnects ?? Number.POSITIVE_INFINITY;
+  const client = opts.httpClient ?? createHttpClient(opts.baseUrl, opts.authToken);
+  const openEvents = opts.openEvents ?? defaultOpenEvents;
+  const emitter = new MonitorEmitter({ json: opts.json, write });
+  const divergencesPath = projectPath2(opts.project, "/graph/divergences");
+  const policiesPath = projectPath2(opts.project, "/policies/violations");
+  const eventsUrl = `${opts.baseUrl.replace(/\/$/, "")}${projectPath2(opts.project, "/events")}`;
+  const divergences = makeDebouncedReader(async () => {
+    const result = await client.get(divergencesPath);
+    emitter.emitDivergences(result);
+  }, debounceMs);
+  const policies = makeDebouncedReader(async () => {
+    const result = await client.get(policiesPath);
+    emitter.emitPolicies(result);
+  }, debounceMs);
   const onFrame = (frame) => {
     switch (frame.event) {
       case "extraction-complete":
-        scheduleRead();
+        divergences.schedule();
         break;
       case "stale-transition": {
         const payload = safeParse(frame.data);
         const edgeId = payload && typeof payload.edgeId === "string" ? payload.edgeId : void 0;
         if (edgeId) emitter.emitStale(edgeId);
-        scheduleRead();
+        divergences.schedule();
         break;
       }
       case "edge-added": {
         const payload = safeParse(frame.data);
         const edge = payload?.edge;
-        if (edge && edge.provenance === import_types63.Provenance.OBSERVED) {
+        if (edge && edge.provenance === import_types70.Provenance.OBSERVED) {
           emitter.emitObservedEdge(edge);
-          scheduleRead();
+          divergences.schedule();
         }
         break;
       }
+      case "policy-violation":
+        policies.schedule();
+        break;
       default:
         break;
     }
@@ -20319,17 +21591,17 @@ async function runMonitor(opts) {
   let firstConnect = true;
   for (let attempt = 0; ; attempt++) {
     if (opts.signal?.aborted) break;
-    let res;
+    let conn;
     try {
-      res = await fetch(eventsUrl, { headers, signal: opts.signal });
+      conn = await openEvents(eventsUrl, headers, opts.signal);
     } catch (err) {
       if (err.name === "AbortError") break;
       if (!connectedOnce || attempt >= maxReconnects) break;
       await sleep(backoffDelay(attempt, backoffCapMs), opts.signal);
       continue;
     }
-    if (!res.ok || !res.body) {
-      await res.body?.cancel().catch(() => {
+    if (!conn.ok || !conn.body) {
+      await conn.body?.cancel().catch(() => {
       });
       if (!connectedOnce || attempt >= maxReconnects) break;
       await sleep(backoffDelay(attempt, backoffCapMs), opts.signal);
@@ -20339,19 +21611,22 @@ async function runMonitor(opts) {
     attempt = 0;
     if (firstConnect) {
       firstConnect = false;
-      await doRead();
+      await divergences.runNow();
+      await policies.runNow();
     } else {
-      scheduleRead();
+      divergences.schedule();
+      policies.schedule();
     }
     try {
-      await drainSse(res.body, onFrame);
+      await drainSse(conn.body, onFrame);
     } catch {
     }
     if (opts.signal?.aborted) break;
     if (attempt >= maxReconnects) break;
     await sleep(backoffDelay(attempt, backoffCapMs), opts.signal);
   }
-  if (readTimer) clearTimeout(readTimer);
+  divergences.cancel();
+  policies.cancel();
   return 0;
 }
 function sleep(ms, signal) {
@@ -20375,7 +21650,7 @@ function sleep(ms, signal) {
 
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path70 = __toESM(require("path"), 1);
+var import_node_path72 = __toESM(require("path"), 1);
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -20385,7 +21660,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path70.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path72.default.sep}`)) {
       return entry2;
     }
   }
@@ -20538,7 +21813,7 @@ async function runSync(opts) {
 }
 
 // src/cli.ts
-var import_types64 = require("@neat.is/types");
+var import_types71 = require("@neat.is/types");
 function isNpxInvocation() {
   if (process.env.npm_command === "exec") return true;
   const execpath = process.env.npm_execpath ?? "";
@@ -20550,7 +21825,7 @@ function isNpxInvocation() {
 function commandPrefix() {
   return isNpxInvocation() ? "npx neat.is" : "neat";
 }
-function usage2() {
+function usage4() {
   const neat = commandPrefix();
   console.log("Installed via npx? Prefix commands with `npx neat.is`, or install once: `npm i -g neat.is`.");
   console.log("");
@@ -20570,10 +21845,12 @@ function usage2() {
   console.log("                 PORT (default 8080), OTEL_PORT (4318), HOST (0.0.0.0)");
   console.log("                 control listeners. NEAT_OTLP_GRPC=true also opens 4317.");
   console.log("  monitor        Stream live graph facts to stdout \u2014 one line per new");
-  console.log("                 fact \u2014 as the daemon learns them: fresh divergences,");
-  console.log("                 integrations that just went stale, and new observed");
-  console.log("                 runtime dependencies. Silent when nothing is new; exits");
-  console.log("                 clean with no output when no daemon is reachable.");
+  console.log("                 fact \u2014 as the daemon learns them: fresh divergences");
+  console.log("                 (down to the drifting column), integrations that just");
+  console.log("                 went stale, new observed runtime dependencies, and");
+  console.log("                 freshly-tripped policy violations. Silent when nothing");
+  console.log("                 is new; exits clean with no output when no daemon is");
+  console.log("                 reachable.");
   console.log("                 Flags:");
   console.log("                   --project <name>   watch a registered project by name");
   console.log("                   --json             emit one JSON object per line");
@@ -20603,6 +21880,22 @@ function usage2() {
   console.log("                   --print-hook     print the hook script");
   console.log("                   --print-guide    print the graph-first guidance");
   console.log("                   --print-settings print the settings.json block --apply adds");
+  console.log("  codex          Install NEAT into the OpenAI Codex CLI: add [mcp_servers.neat]");
+  console.log("                 to ~/.codex/config.toml and the graph-first block to ./AGENTS.md.");
+  console.log("                 Plan by default; --apply to write.");
+  console.log("                 Flags:");
+  console.log("                   --apply          add the MCP server + AGENTS.md block");
+  console.log("                   --print-config   print the config.toml table");
+  console.log("                   --print-guide    print the AGENTS.md block");
+  console.log("  cursor         Wire NEAT into Cursor: add the MCP server to ~/.cursor/mcp.json");
+  console.log("                 and the graph-first guidance to ./.cursorrules. Plan by default.");
+  console.log("                 Flags:");
+  console.log("                   --apply   write the MCP config + rules file (default: plan)");
+  console.log("  devin          Wire NEAT into Devin Desktop (Cascade): add the MCP server to");
+  console.log("                 ~/.codeium/windsurf/mcp_config.json and the graph-first guidance");
+  console.log("                 to ./.windsurfrules. Plan by default.");
+  console.log("                 Flags:");
+  console.log("                   --apply   write the MCP config + rules file (default: plan)");
   console.log("  deploy         Detect the deploy substrate, generate NEAT_AUTH_TOKEN,");
   console.log("                 emit a docker-compose / systemd / docker run artifact, and");
   console.log("                 print the OTel env-vars block to paste into your platform.");
@@ -20616,7 +21909,8 @@ function usage2() {
   console.log("                   --no-instrument    skip the SDK install apply step");
   console.log("                   --json             emit the delta summary as JSON");
   console.log("  connector      Configure OBSERVED connectors \u2014 pull (supabase, railway,");
-  console.log("                 firebase, cloudflare) and push (vercel, via a trace Drain).");
+  console.log("                 firebase, cloudflare, neon, cloud-run) and push (vercel,");
+  console.log("                 via a trace Drain).");
   console.log("                 Subcommands:");
   console.log("                   add <provider>   add a connector; validates the credential");
   console.log("                                    against the provider first (--skip-validate to skip)");
@@ -20848,7 +22142,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs43.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs45.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -20857,13 +22151,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path71.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path73.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs43.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs45.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path71.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs43.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path73.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs45.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -20874,9 +22168,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path71.default.join(opts.scanPath, "neat-out")
+    import_node_path73.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path71.default.join(import_node_path71.default.dirname(opts.outPath), import_node_path71.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path73.default.join(import_node_path73.default.dirname(opts.outPath), import_node_path73.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -20955,7 +22249,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs43.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs45.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -20995,9 +22289,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path71.default.resolve(override);
+  if (override && override.length > 0) return import_node_path73.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path71.default.join(home, ".claude.json");
+  return import_node_path73.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -21009,7 +22303,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs43.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs45.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -21021,8 +22315,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs43.promises.mkdir(import_node_path71.default.dirname(target), { recursive: true });
-    await import_node_fs43.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs45.promises.mkdir(import_node_path73.default.dirname(target), { recursive: true });
+    await import_node_fs45.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -21049,7 +22343,7 @@ async function main() {
   const argv = process.argv.slice(2);
   const cmd0 = argv[0];
   if (cmd0 === "-h" || cmd0 === "--help") {
-    usage2();
+    usage4();
     process.exit(0);
   }
   if (cmd0 === "--version" || cmd0 === "-v" || cmd0 === "version") {
@@ -21066,6 +22360,16 @@ async function main() {
     if (code !== 0) process.exit(code);
     return;
   }
+  if (cmd0 === "codex") {
+    const code = await runCodexCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
+  if (cmd0 === "cursor" || cmd0 === "devin") {
+    const code = await runEditorCommand(cmd0, argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   const argvParsed = parseArgs(argv);
   if (argvParsed.positional.length === 0) {
     const orchestratorCode2 = await tryOrchestrator(process.cwd(), argvParsed);
@@ -21080,19 +22384,19 @@ async function main() {
     const target = positional[0];
     if (!target) {
       console.error("neat init: missing <path>");
-      usage2();
+      usage4();
       process.exit(2);
     }
     if (apply4 && dryRun) {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path71.default.resolve(target);
+    const scanPath = import_node_path73.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path71.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path73.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path71.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path71.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path73.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path73.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -21110,24 +22414,24 @@ async function main() {
     const target = positional[0];
     if (!target) {
       console.error("neat watch: missing <path>");
-      usage2();
+      usage4();
       process.exit(2);
     }
-    const scanPath = import_node_path71.default.resolve(target);
-    const stat = await import_node_fs43.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path73.default.resolve(target);
+    const stat = await import_node_fs45.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path71.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path71.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path71.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path71.default.join(import_node_path71.default.dirname(outPath), import_node_path71.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path73.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path73.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path73.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path73.default.join(import_node_path73.default.dirname(outPath), import_node_path73.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path71.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path71.default.join(import_node_path71.default.dirname(outPath), import_node_path71.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path73.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path73.default.join(import_node_path73.default.dirname(outPath), import_node_path73.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path71.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path73.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -21136,7 +22440,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? import_node_path71.default.resolve(process.env.NEAT_HOME) : import_node_path71.default.join(import_node_os6.default.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? import_node_path73.default.resolve(process.env.NEAT_HOME) : import_node_path73.default.join(import_node_os8.default.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -21172,7 +22476,7 @@ async function main() {
     const name = positional[0];
     if (!name) {
       console.error("neat pause: missing <name>");
-      usage2();
+      usage4();
       process.exit(2);
     }
     const daemon = await findDaemonByProject(name);
@@ -21197,7 +22501,7 @@ async function main() {
     const name = positional[0];
     if (!name) {
       console.error("neat resume: missing <name>");
-      usage2();
+      usage4();
       process.exit(2);
     }
     const daemon = await findDaemonByProject(name);
@@ -21227,7 +22531,7 @@ async function main() {
     const name = positional[0];
     if (!name) {
       console.error("neat uninstall: missing <name>");
-      usage2();
+      usage4();
       process.exit(2);
     }
     const daemon = await findDaemonByProject(name);
@@ -21314,15 +22618,15 @@ async function main() {
     return;
   }
   console.error(`neat: unknown command "${cmd}"`);
-  usage2();
+  usage4();
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path71.default.resolve(cmd);
-  const stat = await import_node_fs43.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path73.default.resolve(cmd);
+  const stat = await import_node_fs45.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path71.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path73.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -21511,10 +22815,10 @@ async function runQueryVerb(cmd, parsed) {
         const parts = parsed.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
         const out = [];
         for (const p of parts) {
-          const r = import_types64.DivergenceTypeSchema.safeParse(p);
+          const r = import_types71.DivergenceTypeSchema.safeParse(p);
           if (!r.success) {
             console.error(
-              `neat divergences: unknown --type "${p}". allowed: ${import_types64.DivergenceTypeSchema.options.join(", ")}`
+              `neat divergences: unknown --type "${p}". allowed: ${import_types71.DivergenceTypeSchema.options.join(", ")}`
             );
             return 2;
           }