@neat.is/core 0.8.2-dev.20260818 → 0.9.0

package/dist/{chunk-T4UGEMWN.js → chunk-RDLDSIEY.js}

@@ -961,7 +961,7 @@ import { promises as fs3 } from "fs";
 import path3 from "path";
 import { parse as parseYaml } from "yaml";
 import { extractedEdgeId } from "@neat.is/types";
-var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".go", ".rb", ".php", ".cs", ".java"]);
+var SERVICE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".py", ".go", ".rb", ".php", ".cs", ".java", ".kt", ".rs", ".cpp", ".cc", ".cxx", ".c++", ".hpp", ".hh", ".hxx", ".h++"]);
 var CONFIG_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".yaml", ".yml"]);
 var JSON_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["app.json", "app.config.json", "eas.json"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
@@ -1247,7 +1247,8 @@ function buildServiceHostIndex(services) {
   }
   return { knownHosts, hostToNodeId };
 }
-async function walkSourceFiles(dir) {
+async function walkSourceFiles(dir, excludeDirs = []) {
+  const excluded = new Set(excludeDirs.map((d) => path5.resolve(d)));
   const out = [];
   async function walk9(current) {
     const entries = await fs5.readdir(current, { withFileTypes: true }).catch(() => []);
@@ -1255,6 +1256,7 @@ async function walkSourceFiles(dir) {
       const full = path5.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
+        if (excluded.has(path5.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk9(full);
       } else if (entry.isFile() && SERVICE_FILE_EXTENSIONS.has(path5.extname(entry.name)) && // Skip NEAT's own generated `otel-init.*` bootstrap — extracting it
@@ -1267,8 +1269,8 @@ async function walkSourceFiles(dir) {
   await walk9(dir);
   return out;
 }
-async function loadSourceFiles(dir) {
-  const paths = await walkSourceFiles(dir);
+async function loadSourceFiles(dir, excludeDirs = []) {
+  const paths = await walkSourceFiles(dir, excludeDirs);
   const out = [];
   for (const p of paths) {
     try {
@@ -1305,6 +1307,19 @@ function languageForPath(relPath) {
       return "csharp";
     case ".java":
       return "java";
+    case ".kt":
+      return "kotlin";
+    case ".rs":
+      return "rust";
+    case ".cpp":
+    case ".cc":
+    case ".cxx":
+    case ".c++":
+    case ".hpp":
+    case ".hh":
+    case ".hxx":
+    case ".h++":
+      return "cpp";
     case ".ts":
     case ".tsx":
       return "typescript";
@@ -1643,6 +1658,7 @@ async function resolveGoImport(specifier, modulePath, serviceDir) {
 function emitImportEdge(graph, serviceName, importerFileId, importerRelPath, importeeRelPath, line, snippet2) {
   const importeeFileId = fileId2(serviceName, importeeRelPath);
   if (!graph.hasNode(importeeFileId)) return 0;
+  if (importerFileId === importeeFileId) return 0;
   const edgeId = extractedEdgeId3(importerFileId, importeeFileId, EdgeType3.IMPORTS);
   if (graph.hasEdge(edgeId)) return 0;
   const edge = {
@@ -1664,7 +1680,7 @@ async function addImports(graph, services) {
   let edgesAdded = 0;
   for (const service of services) {
     const tsPaths = await loadTsPathConfig(service.dir);
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
       const relFile = toPosix(path6.relative(service.dir, file.path));
@@ -1846,8 +1862,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path67) {
-  return path67.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path70) {
+  return path70.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -2519,9 +2535,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path67 = rubyLiteral(k);
-    if (path67 === null) continue;
-    return { path: path67, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path70 = rubyLiteral(k);
+    if (path70 === null) continue;
+    return { path: path70, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -3206,7 +3222,7 @@ async function addRoutes(graph, services) {
     const hasLaravel = deps["laravel/framework"] !== void 0;
     if (!hasExpress && !hasFastify && !hasHono && !hasNext && !hasNestjs && !hasFastapi && !hasFlask && !hasDjango && !hasGin && !hasEcho && !hasFiber && !hasChi && !isGoService && !hasRails && !hasLaravel)
       continue;
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     const mountPrefixes = hasExpress ? await expressMountPrefixes(files, service.dir, await loadTsPathConfig(service.dir)) : /* @__PURE__ */ new Map();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
@@ -4638,29 +4654,29 @@ function promoteFrontierNodes(graph, opts = {}) {
     toPromote.push({ frontierId: id, serviceId: target });
   });
   let promoted = 0;
-  for (const { frontierId: frontierId2, serviceId: serviceId12 } of toPromote) {
+  for (const { frontierId: frontierId2, serviceId: serviceId15 } of toPromote) {
     if (opts.policies && opts.policies.length > 0 && opts.policyCtx) {
       const gate = canPromoteFrontier(graph, frontierId2, opts.policies, opts.policyCtx);
       if (!gate.allowed) {
         continue;
       }
     }
-    rewireFrontierEdges(graph, frontierId2, serviceId12);
+    rewireFrontierEdges(graph, frontierId2, serviceId15);
     graph.dropNode(frontierId2);
     promoted++;
   }
   return promoted;
 }
-function rewireFrontierEdges(graph, frontierId2, serviceId12) {
+function rewireFrontierEdges(graph, frontierId2, serviceId15) {
   const inbound = [...graph.inboundEdges(frontierId2)];
   const outbound = [...graph.outboundEdges(frontierId2)];
   for (const edgeId of inbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, edge.source, serviceId12, edgeId);
+    rebuildEdge(graph, edge, edge.source, serviceId15, edgeId);
   }
   for (const edgeId of outbound) {
     const edge = graph.getEdgeAttributes(edgeId);
-    rebuildEdge(graph, edge, serviceId12, edge.target, edgeId);
+    rebuildEdge(graph, edge, serviceId15, edge.target, edgeId);
   }
 }
 function rebuildEdge(graph, edge, newSource, newTarget, oldEdgeId) {
@@ -4992,19 +5008,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path67, edges) {
-    if (path67.length > best.path.length) {
-      best = { path: [...path67], edges: [...edges] };
+  function step(node, path70, edges) {
+    if (path70.length > best.path.length) {
+      best = { path: [...path70], edges: [...edges] };
     }
-    if (path67.length - 1 >= maxDepth) return;
+    if (path70.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path67.push(srcId);
+      path70.push(srcId);
       edges.push(edge);
-      step(srcId, path67, edges);
-      path67.pop();
+      step(srcId, path70, edges);
+      path70.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -5019,7 +5035,7 @@ function databaseRootCauseShape(graph, origin, walk9) {
   for (const id of walk9.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId12, svc } = owner;
+    const { id: serviceId15, svc } = owner;
     const deps = svc.dependencies ?? {};
     for (const pair of candidatePairs) {
       const declared = deps[pair.driver];
@@ -5032,7 +5048,7 @@ function databaseRootCauseShape(graph, origin, walk9) {
       );
       if (!result.compatible) {
         return {
-          rootCauseNode: serviceId12,
+          rootCauseNode: serviceId15,
           rootCauseReason: result.reason ?? "incompatible driver",
           ...result.minDriverVersion ? {
             fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
@@ -5047,7 +5063,7 @@ function serviceRootCauseShape(graph, _origin, walk9) {
   for (const id of walk9.path) {
     const owner = resolveOwningService(graph, id);
     if (!owner) continue;
-    const { id: serviceId12, svc } = owner;
+    const { id: serviceId15, svc } = owner;
     const deps = svc.dependencies ?? {};
     const serviceNodeEngine = svc.nodeEngine;
     for (const constraint of nodeEngineConstraints()) {
@@ -5056,7 +5072,7 @@ function serviceRootCauseShape(graph, _origin, walk9) {
       const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId12,
+          rootCauseNode: serviceId15,
           rootCauseReason: result.reason,
           ...result.requiredNodeVersion ? {
             fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
@@ -5071,7 +5087,7 @@ function serviceRootCauseShape(graph, _origin, walk9) {
       const result = checkPackageConflict(conflict, declared, requiredDeclared);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: serviceId12,
+          rootCauseNode: serviceId15,
           rootCauseReason: result.reason,
           fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
         };
@@ -5172,9 +5188,9 @@ function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
 function isFailingCallEdge(e) {
   return e.type === EdgeType6.CALLS && (e.signal?.errorCount ?? 0) > 0;
 }
-function callSourcesForService(graph, serviceId12) {
-  const ids = [serviceId12];
-  for (const edgeId of graph.outboundEdges(serviceId12)) {
+function callSourcesForService(graph, serviceId15) {
+  const ids = [serviceId15];
+  for (const edgeId of graph.outboundEdges(serviceId15)) {
     const e = graph.getEdgeAttributes(edgeId);
     if (e.type !== EdgeType6.CONTAINS) continue;
     const tgt = graph.getNodeAttributes(e.target);
@@ -5198,9 +5214,9 @@ function failingCallDominates(e, id, curEdge, curId) {
   }
   return id < curId;
 }
-function dominantFailingCall(graph, serviceId12, visited) {
+function dominantFailingCall(graph, serviceId15, visited) {
   let best = null;
-  for (const src of callSourcesForService(graph, serviceId12)) {
+  for (const src of callSourcesForService(graph, serviceId15)) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (!isFailingCallEdge(e)) continue;
@@ -5215,26 +5231,26 @@ function dominantFailingCall(graph, serviceId12, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path67 = [originServiceId];
+  const path70 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path67.push(hop.nextService);
+    path70.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path67, edges, culprit: current };
+  return { path: path70, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path67 = [...chain.path];
+  const path70 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -5242,14 +5258,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path67.push(loc.fileNode);
+      path70.push(loc.fileNode);
       edgeProvenances.push(Provenance6.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path67,
+      traversalPath: path70,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -5261,7 +5277,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path67,
+    traversalPath: path70,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -5697,10 +5713,10 @@ function enrichWithNavigation(graph, errorNodeId, legacy, incidents, now) {
   let traversalPath = legacy.traversalPath;
   let edgeProvenances = legacy.edgeProvenances;
   if (top.node !== seedNode) {
-    const path67 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path67) {
-      traversalPath = path67.nodes;
-      edgeProvenances = path67.edges.map((e) => e.provenance);
+    const path70 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path70) {
+      traversalPath = path70.nodes;
+      edgeProvenances = path70.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? Provenance6.OBSERVED];
@@ -5729,11 +5745,11 @@ function fixRecommendationForTop(top, seedNode, legacy) {
 }
 
 // src/extract/services.ts
-import { promises as fs15 } from "fs";
-import path17 from "path";
+import { promises as fs18 } from "fs";
+import path20 from "path";
 import ignore from "ignore";
 import { minimatch as minimatch2 } from "minimatch";
-import { NodeType as NodeType12, serviceId as serviceId8 } from "@neat.is/types";
+import { NodeType as NodeType15, serviceId as serviceId11 } from "@neat.is/types";
 
 // src/extract/python.ts
 import { promises as fs8 } from "fs";
@@ -6052,10 +6068,154 @@ async function discoverJavaService(scanPath, dir) {
   return { pkg, dir, node };
 }
 
-// src/extract/dockerfile-service.ts
+// src/extract/kotlin.ts
 import { promises as fs13 } from "fs";
 import path15 from "path";
 import { NodeType as NodeType11, serviceId as serviceId7 } from "@neat.is/types";
+var KOTLIN_SOURCE_EXT = ".kt";
+var JAVA_SOURCE_EXT = ".java";
+var SOURCE_PROBE_MAX_DEPTH = 8;
+async function dominantJvmSourceLanguage(dir) {
+  let kt = 0;
+  let java = 0;
+  async function recurse(current, depth) {
+    if (depth > SOURCE_PROBE_MAX_DEPTH) return;
+    const entries = await fs13.readdir(current, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (IGNORED_DIRS.has(entry.name)) continue;
+        await recurse(path15.join(current, entry.name), depth + 1);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const ext = path15.extname(entry.name).toLowerCase();
+      if (ext === KOTLIN_SOURCE_EXT) kt++;
+      else if (ext === JAVA_SOURCE_EXT) java++;
+    }
+  }
+  await recurse(dir, 0);
+  if (kt > 0 && kt >= java) return "kotlin";
+  if (java > 0) return "java";
+  return void 0;
+}
+async function readJvmManifest(dir) {
+  const pomPath = path15.join(dir, JAVA_MANIFESTS[0]);
+  const gradlePath = path15.join(dir, JAVA_MANIFESTS[1]);
+  const gradleKtsPath = path15.join(dir, JAVA_MANIFESTS[2]);
+  if (await exists(pomPath)) {
+    return parsePomXml(await fs13.readFile(pomPath, "utf8").catch(() => ""));
+  }
+  if (await exists(gradlePath)) {
+    return parseGradle(await fs13.readFile(gradlePath, "utf8").catch(() => ""));
+  }
+  if (await exists(gradleKtsPath)) {
+    return parseGradle(await fs13.readFile(gradleKtsPath, "utf8").catch(() => ""));
+  }
+  return null;
+}
+async function discoverKotlinService(scanPath, dir) {
+  if (!await hasJavaManifest(dir)) return null;
+  if (await dominantJvmSourceLanguage(dir) !== "kotlin") return null;
+  const manifest = await readJvmManifest(dir);
+  if (!manifest) return null;
+  const name = manifest.name?.trim() || path15.basename(dir);
+  const dependencies = manifest.dependencies;
+  const pkg = { name, dependencies };
+  const node = {
+    id: serviceId7(name),
+    type: NodeType11.ServiceNode,
+    name,
+    language: "kotlin",
+    dependencies,
+    repoPath: path15.relative(scanPath, dir)
+  };
+  return { pkg, dir, node };
+}
+
+// src/extract/rust.ts
+import { promises as fs14 } from "fs";
+import path16 from "path";
+import { parse as parseToml2 } from "smol-toml";
+import { NodeType as NodeType12, serviceId as serviceId8 } from "@neat.is/types";
+var CARGO_MANIFEST = "Cargo.toml";
+async function hasRustManifest(dir) {
+  return exists(path16.join(dir, CARGO_MANIFEST));
+}
+function parseCargoToml(source) {
+  const dependencies = {};
+  let name;
+  let parsed;
+  try {
+    parsed = parseToml2(source);
+  } catch {
+    return { dependencies };
+  }
+  if (typeof parsed.package?.name === "string") name = parsed.package.name;
+  for (const [crate, spec] of Object.entries(parsed.dependencies ?? {})) {
+    if (typeof spec === "string") {
+      dependencies[crate] = spec;
+    } else if (spec && typeof spec === "object") {
+      const version = spec.version;
+      dependencies[crate] = typeof version === "string" ? version : "";
+    } else {
+      dependencies[crate] = "";
+    }
+  }
+  return { name, dependencies };
+}
+async function discoverRustService(scanPath, dir) {
+  const cargoPath = path16.join(dir, CARGO_MANIFEST);
+  if (!await exists(cargoPath)) return null;
+  const manifest = parseCargoToml(await fs14.readFile(cargoPath, "utf8").catch(() => ""));
+  const name = manifest.name?.trim() || path16.basename(dir);
+  const dependencies = manifest.dependencies;
+  const pkg = { name, dependencies };
+  const node = {
+    id: serviceId8(name),
+    type: NodeType12.ServiceNode,
+    name,
+    language: "rust",
+    dependencies,
+    repoPath: path16.relative(scanPath, dir)
+  };
+  return { pkg, dir, node };
+}
+
+// src/extract/cpp.ts
+import { promises as fs15 } from "fs";
+import path17 from "path";
+import { NodeType as NodeType13, serviceId as serviceId9 } from "@neat.is/types";
+var CMAKE_MANIFEST = "CMakeLists.txt";
+async function hasCppManifest(dir) {
+  return exists(path17.join(dir, CMAKE_MANIFEST));
+}
+function parseCMakeProjectName(source) {
+  const withoutComments = source.replace(/#.*$/gm, "");
+  const m = withoutComments.match(/\bproject\s*\(\s*"?([A-Za-z0-9_.+-]+)"?/i);
+  return m?.[1];
+}
+async function discoverCppService(scanPath, dir) {
+  const cmakePath = path17.join(dir, CMAKE_MANIFEST);
+  if (!await exists(cmakePath)) return null;
+  const source = await fs15.readFile(cmakePath, "utf8").catch(() => "");
+  const name = parseCMakeProjectName(source)?.trim() || path17.basename(dir);
+  const dependencies = {};
+  const pkg = { name, dependencies };
+  const node = {
+    id: serviceId9(name),
+    type: NodeType13.ServiceNode,
+    name,
+    language: "cpp",
+    dependencies,
+    repoPath: path17.relative(scanPath, dir)
+  };
+  return { pkg, dir, node };
+}
+
+// src/extract/dockerfile-service.ts
+import { promises as fs16 } from "fs";
+import path18 from "path";
+import { NodeType as NodeType14, serviceId as serviceId10 } from "@neat.is/types";
 function languageForSourceExt(ext) {
   switch (ext) {
     case ".py":
@@ -6070,6 +6230,19 @@ function languageForSourceExt(ext) {
       return "csharp";
     case ".java":
       return "java";
+    case ".kt":
+      return "kotlin";
+    case ".rs":
+      return "rust";
+    case ".cpp":
+    case ".cc":
+    case ".cxx":
+    case ".c++":
+    case ".hpp":
+    case ".hh":
+    case ".hxx":
+    case ".h++":
+      return "cpp";
     case ".ts":
     case ".tsx":
       return "typescript";
@@ -6081,14 +6254,14 @@ function languageForSourceExt(ext) {
       return null;
   }
 }
-var LANGUAGE_PRECEDENCE = ["typescript", "javascript", "python", "go", "ruby", "php", "csharp", "java"];
+var LANGUAGE_PRECEDENCE = ["typescript", "javascript", "python", "go", "ruby", "php", "csharp", "java", "kotlin", "rust", "cpp"];
 async function inferServiceLanguage(dir) {
-  const entries = await fs13.readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs16.readdir(dir, { withFileTypes: true }).catch(() => []);
   const counts = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     if (isNeatAuthoredSourceFile(entry.name)) continue;
-    const ext = path15.extname(entry.name).toLowerCase();
+    const ext = path18.extname(entry.name).toLowerCase();
     if (!SERVICE_FILE_EXTENSIONS.has(ext)) continue;
     const lang = languageForSourceExt(ext);
     if (!lang) continue;
@@ -6107,45 +6280,49 @@ async function inferServiceLanguage(dir) {
   return best;
 }
 async function hasLanguageManifest(dir) {
-  return await exists(path15.join(dir, "package.json")) || await exists(path15.join(dir, "pyproject.toml")) || await exists(path15.join(dir, "requirements.txt")) || await exists(path15.join(dir, "setup.py")) || await exists(path15.join(dir, "go.mod")) || await exists(path15.join(dir, "Gemfile")) || await exists(path15.join(dir, "composer.json")) || // C#'s marker is a glob (`*.csproj` / `*.sln`), so it reads the directory
+  return await exists(path18.join(dir, "package.json")) || await exists(path18.join(dir, "pyproject.toml")) || await exists(path18.join(dir, "requirements.txt")) || await exists(path18.join(dir, "setup.py")) || await exists(path18.join(dir, "go.mod")) || await exists(path18.join(dir, "Gemfile")) || await exists(path18.join(dir, "composer.json")) || // C#'s marker is a glob (`*.csproj` / `*.sln`), so it reads the directory
   // rather than probing a fixed filename (ADR-196).
-  await hasCsharpProject(dir) || // Java keys on a Maven / Gradle build manifest (ADR-197).
-  await hasJavaManifest(dir);
+  await hasCsharpProject(dir) || // Java (and its JVM sibling Kotlin, ADR-199) key on the same Maven / Gradle
+  // build manifest (ADR-197), so this one check stands the Dockerfile fallback
+  // down for both.
+  await hasJavaManifest(dir) || // Rust's marker is a fixed `Cargo.toml` (ADR-201).
+  await hasRustManifest(dir) || // C++'s marker is a fixed `CMakeLists.txt` (ADR-202).
+  await hasCppManifest(dir);
 }
 async function hasDockerfileDeclaredService(dir) {
-  if (!await exists(path15.join(dir, "Dockerfile"))) return false;
+  if (!await exists(path18.join(dir, "Dockerfile"))) return false;
   return await inferServiceLanguage(dir) !== null;
 }
 async function discoverDockerfileService(scanPath, dir) {
-  if (!await exists(path15.join(dir, "Dockerfile"))) return null;
+  if (!await exists(path18.join(dir, "Dockerfile"))) return null;
   if (await hasLanguageManifest(dir)) return null;
   const language = await inferServiceLanguage(dir);
   if (!language) return null;
-  const name = path15.basename(dir);
+  const name = path18.basename(dir);
   const pkg = { name, dependencies: {} };
   const node = {
-    id: serviceId7(name),
-    type: NodeType11.ServiceNode,
+    id: serviceId10(name),
+    type: NodeType14.ServiceNode,
     name,
     language,
     dependencies: {},
-    repoPath: path15.relative(scanPath, dir)
+    repoPath: path18.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 
 // src/extract/owners.ts
-import { promises as fs14 } from "fs";
-import path16 from "path";
+import { promises as fs17 } from "fs";
+import path19 from "path";
 import { minimatch } from "minimatch";
 async function loadCodeowners(scanPath) {
   const candidates = [
-    path16.join(scanPath, "CODEOWNERS"),
-    path16.join(scanPath, ".github", "CODEOWNERS")
+    path19.join(scanPath, "CODEOWNERS"),
+    path19.join(scanPath, ".github", "CODEOWNERS")
   ];
   for (const file of candidates) {
     if (await exists(file)) {
-      const raw = await fs14.readFile(file, "utf8");
+      const raw = await fs17.readFile(file, "utf8");
       return parseCodeowners(raw);
     }
   }
@@ -6163,7 +6340,7 @@ function parseCodeowners(raw) {
   return { rules };
 }
 function matchOwner(file, repoPath) {
-  const normalized = repoPath.split(path16.sep).join("/");
+  const normalized = repoPath.split(path19.sep).join("/");
   for (const rule of file.rules) {
     if (matchesPattern(rule.pattern, normalized)) return rule.owners;
   }
@@ -6179,7 +6356,7 @@ function matchesPattern(rawPattern, repoPath) {
   return false;
 }
 async function readPackageJsonAuthor(serviceDir) {
-  const pkgPath = path16.join(serviceDir, "package.json");
+  const pkgPath = path19.join(serviceDir, "package.json");
   if (!await exists(pkgPath)) return null;
   try {
     const pkg = await readJson(pkgPath);
@@ -6216,36 +6393,36 @@ function workspaceGlobs(pkg) {
   return null;
 }
 async function hasPythonManifest(dir) {
-  return await exists(path17.join(dir, "pyproject.toml")) || await exists(path17.join(dir, "requirements.txt")) || await exists(path17.join(dir, "setup.py"));
+  return await exists(path20.join(dir, "pyproject.toml")) || await exists(path20.join(dir, "requirements.txt")) || await exists(path20.join(dir, "setup.py"));
 }
 async function hasGoManifest(dir) {
-  return exists(path17.join(dir, "go.mod"));
+  return exists(path20.join(dir, "go.mod"));
 }
 async function hasRubyManifest(dir) {
-  return exists(path17.join(dir, "Gemfile"));
+  return exists(path20.join(dir, "Gemfile"));
 }
 async function hasPhpManifest(dir) {
-  return exists(path17.join(dir, "composer.json"));
+  return exists(path20.join(dir, "composer.json"));
 }
 async function hasCsharpManifest(dir) {
   return hasCsharpProject(dir);
 }
 async function loadGitignore(scanPath) {
-  const gitignorePath = path17.join(scanPath, ".gitignore");
+  const gitignorePath = path20.join(scanPath, ".gitignore");
   if (!await exists(gitignorePath)) return null;
-  const raw = await fs15.readFile(gitignorePath, "utf8");
+  const raw = await fs18.readFile(gitignorePath, "utf8");
   return ignore().add(raw);
 }
 async function walkDirs(start, scanPath, options, visit) {
   async function recurse(current, depth) {
     if (depth > options.maxDepth) return;
-    const entries = await fs15.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await fs18.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path17.join(current, entry.name);
+      const child = path20.join(current, entry.name);
       if (options.ig) {
-        const rel = path17.relative(scanPath, child).split(path17.sep).join("/");
+        const rel = path20.relative(scanPath, child).split(path20.sep).join("/");
         if (rel && options.ig.ignores(rel + "/")) continue;
       }
       if (await isPythonVenvDir(child)) continue;
@@ -6261,8 +6438,8 @@ async function expandWorkspaceGlobs(scanPath, globs) {
   for (const raw of globs) {
     const pattern = raw.replace(/^\.\//, "");
     if (!pattern.includes("*")) {
-      const candidate = path17.join(scanPath, pattern);
-      if (await exists(path17.join(candidate, "package.json"))) found.add(candidate);
+      const candidate = path20.join(scanPath, pattern);
+      if (await exists(path20.join(candidate, "package.json"))) found.add(candidate);
       continue;
     }
     const segments = pattern.split("/");
@@ -6271,13 +6448,13 @@ async function expandWorkspaceGlobs(scanPath, globs) {
       if (seg.includes("*")) break;
       staticSegments.push(seg);
     }
-    const start = path17.join(scanPath, ...staticSegments);
+    const start = path20.join(scanPath, ...staticSegments);
     if (!await exists(start)) continue;
     const hasDoubleStar = pattern.includes("**");
     const walkDepth = hasDoubleStar ? scanDepth : Math.max(0, segments.length - staticSegments.length - 1);
     await walkDirs(start, scanPath, { maxDepth: walkDepth, ig: null }, async (dir) => {
-      const rel = path17.relative(scanPath, dir).split(path17.sep).join("/");
-      if (minimatch2(rel, pattern) && await exists(path17.join(dir, "package.json"))) {
+      const rel = path20.relative(scanPath, dir).split(path20.sep).join("/");
+      if (minimatch2(rel, pattern) && await exists(path20.join(dir, "package.json"))) {
         found.add(dir);
       }
     });
@@ -6300,31 +6477,31 @@ function detectJsFramework(pkg) {
 async function detectJsServiceLanguage(dir, pkg) {
   const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
   if (deps["typescript"] !== void 0) return "typescript";
-  const entries = await fs15.readdir(dir).catch(() => []);
+  const entries = await fs18.readdir(dir).catch(() => []);
   if (entries.some((name) => /^tsconfig(\..+)?\.json$/.test(name))) return "typescript";
   return "javascript";
 }
 async function discoverNodeService(scanPath, dir) {
-  const pkgPath = path17.join(dir, "package.json");
+  const pkgPath = path20.join(dir, "package.json");
   if (!await exists(pkgPath)) return null;
   let pkg;
   try {
     pkg = await readJson(pkgPath);
   } catch (err) {
-    recordExtractionError("services", path17.relative(scanPath, pkgPath), err);
+    recordExtractionError("services", path20.relative(scanPath, pkgPath), err);
     return null;
   }
   if (!pkg.name) return null;
   const framework = detectJsFramework(pkg);
   const language = await detectJsServiceLanguage(dir, pkg);
   const node = {
-    id: serviceId8(pkg.name),
-    type: NodeType12.ServiceNode,
+    id: serviceId11(pkg.name),
+    type: NodeType15.ServiceNode,
     name: pkg.name,
     language,
     version: pkg.version,
     dependencies: pkg.dependencies ?? {},
-    repoPath: path17.relative(scanPath, dir),
+    repoPath: path20.relative(scanPath, dir),
     ...pkg.engines?.node ? { nodeEngine: pkg.engines.node } : {},
     ...framework ? { framework } : {}
   };
@@ -6335,18 +6512,18 @@ async function discoverPyService(scanPath, dir) {
   if (!py) return null;
   const pkg = pythonToPackage(py);
   const node = {
-    id: serviceId8(py.name),
-    type: NodeType12.ServiceNode,
+    id: serviceId11(py.name),
+    type: NodeType15.ServiceNode,
     name: py.name,
     language: "python",
     version: py.version,
     dependencies: py.dependencies,
-    repoPath: path17.relative(scanPath, dir)
+    repoPath: path20.relative(scanPath, dir)
   };
   return { pkg, dir, node };
 }
 async function discoverServices(scanPath) {
-  const rootPkgPath = path17.join(scanPath, "package.json");
+  const rootPkgPath = path20.join(scanPath, "package.json");
   let rootPkg = null;
   if (await exists(rootPkgPath)) {
     try {
@@ -6354,7 +6531,7 @@ async function discoverServices(scanPath) {
     } catch (err) {
       recordExtractionError(
         "services workspaces",
-        path17.relative(scanPath, rootPkgPath),
+        path20.relative(scanPath, rootPkgPath),
         err
       );
     }
@@ -6366,7 +6543,7 @@ async function discoverServices(scanPath) {
   } else {
     if (rootPkg && rootPkg.name) {
       candidateDirs.push(scanPath);
-    } else if (await hasPythonManifest(scanPath) || await hasGoManifest(scanPath) || await hasRubyManifest(scanPath) || await hasPhpManifest(scanPath) || await hasCsharpManifest(scanPath) || await hasJavaManifest(scanPath)) {
+    } else if (await hasPythonManifest(scanPath) || await hasGoManifest(scanPath) || await hasRubyManifest(scanPath) || await hasPhpManifest(scanPath) || await hasCsharpManifest(scanPath) || await hasJavaManifest(scanPath) || await hasRustManifest(scanPath) || await hasCppManifest(scanPath)) {
       candidateDirs.push(scanPath);
     }
     const ig = await loadGitignore(scanPath);
@@ -6375,9 +6552,9 @@ async function discoverServices(scanPath) {
       scanPath,
       { maxDepth: parseScanDepth(), ig },
       async (dir) => {
-        if (await exists(path17.join(dir, "package.json"))) {
+        if (await exists(path20.join(dir, "package.json"))) {
           candidateDirs.push(dir);
-        } else if (await hasPythonManifest(dir) || await hasGoManifest(dir) || await hasRubyManifest(dir) || await hasPhpManifest(dir) || await hasCsharpManifest(dir) || await hasJavaManifest(dir)) {
+        } else if (await hasPythonManifest(dir) || await hasGoManifest(dir) || await hasRubyManifest(dir) || await hasPhpManifest(dir) || await hasCsharpManifest(dir) || await hasJavaManifest(dir) || await hasRustManifest(dir) || await hasCppManifest(dir)) {
           candidateDirs.push(dir);
         } else if (await hasDockerfileDeclaredService(dir)) {
           candidateDirs.push(dir);
@@ -6390,14 +6567,21 @@ async function discoverServices(scanPath) {
   const seenDirs = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of candidateDirs) {
-    const service = await discoverNodeService(scanPath, dir) ?? await discoverPyService(scanPath, dir) ?? await discoverGoService(scanPath, dir) ?? await discoverRubyService(scanPath, dir) ?? await discoverPhpService(scanPath, dir) ?? await discoverCsharpService(scanPath, dir) ?? await discoverJavaService(scanPath, dir) ?? await discoverDockerfileService(scanPath, dir);
+    const service = await discoverNodeService(scanPath, dir) ?? await discoverPyService(scanPath, dir) ?? await discoverGoService(scanPath, dir) ?? await discoverRubyService(scanPath, dir) ?? await discoverPhpService(scanPath, dir) ?? await discoverCsharpService(scanPath, dir) ?? // Kotlin runs ahead of Java: both mark a service with the same Maven/Gradle
+    // manifest, so Kotlin claims a JVM-manifest dir whose source is `.kt` (ADR-199)
+    // and a `.java`-dominant one falls through to the Java reader unchanged.
+    await discoverKotlinService(scanPath, dir) ?? await discoverJavaService(scanPath, dir) ?? // Rust keys on a `Cargo.toml`, a manifest no other language shares (ADR-201),
+    // so its order among the distinct-manifest discoverers doesn't matter.
+    await discoverRustService(scanPath, dir) ?? // C++ keys on a `CMakeLists.txt`, likewise a manifest no other language shares
+    // (ADR-202), so it too sits anywhere among the distinct-manifest discoverers.
+    await discoverCppService(scanPath, dir) ?? await discoverDockerfileService(scanPath, dir);
     if (!service) continue;
     if (seenDirs.has(service.dir)) continue;
     seenDirs.add(service.dir);
     const existingDir = seen.get(service.node.name);
     if (existingDir !== void 0) {
-      const a = path17.relative(scanPath, existingDir) || ".";
-      const b = path17.relative(scanPath, dir) || ".";
+      const a = path20.relative(scanPath, existingDir) || ".";
+      const b = path20.relative(scanPath, dir) || ".";
       console.warn(
         `[neat] duplicate package name "${service.node.name}" \u2014 keeping ${a}, ignoring ${b}`
       );
@@ -6411,6 +6595,17 @@ async function discoverServices(scanPath) {
     const owner = await computeServiceOwner(codeowners, service.node.repoPath, service.dir);
     if (owner !== void 0) service.node.owner = owner;
   }
+  const resolvedDirs = out.map((s) => path20.resolve(s.dir));
+  for (let i = 0; i < out.length; i++) {
+    const self = resolvedDirs[i];
+    const nested = [];
+    for (let j = 0; j < out.length; j++) {
+      if (i === j) continue;
+      const other = resolvedDirs[j];
+      if (other.startsWith(self + path20.sep)) nested.push(other);
+    }
+    out[i].excludeDirs = nested;
+  }
   return out;
 }
 function addServiceNodes(graph, services) {
@@ -6433,20 +6628,20 @@ function addServiceNodes(graph, services) {
 }
 
 // src/extract/aliases.ts
-import path18 from "path";
-import { promises as fs16 } from "fs";
+import path21 from "path";
+import { promises as fs19 } from "fs";
 import { parseAllDocuments } from "yaml";
-import { NodeType as NodeType13 } from "@neat.is/types";
+import { NodeType as NodeType16 } from "@neat.is/types";
 var K8S_KINDS_WITH_HOSTNAMES = /* @__PURE__ */ new Set([
   "Service",
   "Deployment",
   "StatefulSet",
   "DaemonSet"
 ]);
-function addAliases(graph, serviceId12, candidates) {
-  if (!graph.hasNode(serviceId12)) return;
-  const node = graph.getNodeAttributes(serviceId12);
-  if (node.type !== NodeType13.ServiceNode) return;
+function addAliases(graph, serviceId15, candidates) {
+  if (!graph.hasNode(serviceId15)) return;
+  const node = graph.getNodeAttributes(serviceId15);
+  if (node.type !== NodeType16.ServiceNode) return;
   const set = new Set(node.aliases ?? []);
   for (const c of candidates) {
     if (!c) continue;
@@ -6455,20 +6650,20 @@ function addAliases(graph, serviceId12, candidates) {
   }
   if (set.size === 0) return;
   const updated = { ...node, aliases: [...set].sort() };
-  graph.replaceNodeAttributes(serviceId12, updated);
+  graph.replaceNodeAttributes(serviceId15, updated);
 }
 function indexServicesByName(services) {
   const map = /* @__PURE__ */ new Map();
   for (const s of services) {
     map.set(s.node.name, s.node.id);
-    map.set(path18.basename(s.dir), s.node.id);
+    map.set(path21.basename(s.dir), s.node.id);
   }
   return map;
 }
 async function collectComposeAliases(graph, scanPath, serviceIndex) {
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path18.join(scanPath, name);
+    const abs = path21.join(scanPath, name);
     if (await exists(abs)) {
       composePath = abs;
       break;
@@ -6481,19 +6676,19 @@ async function collectComposeAliases(graph, scanPath, serviceIndex) {
   } catch (err) {
     recordExtractionError(
       "aliases compose",
-      path18.relative(scanPath, composePath),
+      path21.relative(scanPath, composePath),
       err
     );
     return;
   }
   if (!compose?.services) return;
   for (const [composeName, svc] of Object.entries(compose.services)) {
-    const serviceId12 = serviceIndex.get(composeName);
-    if (!serviceId12) continue;
+    const serviceId15 = serviceIndex.get(composeName);
+    if (!serviceId15) continue;
     const aliases = /* @__PURE__ */ new Set([composeName]);
     if (svc.container_name) aliases.add(svc.container_name);
     if (svc.hostname) aliases.add(svc.hostname);
-    addAliases(graph, serviceId12, aliases);
+    addAliases(graph, serviceId15, aliases);
   }
 }
 var LABEL_KEYS = /* @__PURE__ */ new Set([
@@ -6524,11 +6719,11 @@ function parseDockerfileLabels(content) {
 }
 async function collectDockerfileAliases(graph, services) {
   for (const service of services) {
-    const dockerfilePath = path18.join(service.dir, "Dockerfile");
+    const dockerfilePath = path21.join(service.dir, "Dockerfile");
     if (!await exists(dockerfilePath)) continue;
     let content;
     try {
-      content = await fs16.readFile(dockerfilePath, "utf8");
+      content = await fs19.readFile(dockerfilePath, "utf8");
     } catch (err) {
       recordExtractionError("aliases dockerfile", dockerfilePath, err);
       continue;
@@ -6540,15 +6735,15 @@ async function collectDockerfileAliases(graph, services) {
 async function walkYamlFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await fs16.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await fs19.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path18.join(start, entry.name);
+      const child = path21.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path18.extname(entry.name))) {
-      out.push(path18.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path21.extname(entry.name))) {
+      out.push(path21.join(start, entry.name));
     }
   }
   return out;
@@ -6575,7 +6770,7 @@ function k8sServiceTarget(doc, byName) {
 async function collectK8sAliases(graph, scanPath, serviceIndex) {
   const files = await walkYamlFiles(scanPath);
   for (const file of files) {
-    const content = await fs16.readFile(file, "utf8");
+    const content = await fs19.readFile(file, "utf8");
     let docs;
     try {
       docs = parseAllDocuments(content).map((d) => d.toJSON());
@@ -6599,14 +6794,14 @@ async function addServiceAliases(graph, scanPath, services) {
 }
 
 // src/extract/files.ts
-import path19 from "path";
+import path22 from "path";
 async function addFiles(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const filePaths = await walkSourceFiles(service.dir);
+    const filePaths = await walkSourceFiles(service.dir, service.excludeDirs);
     for (const filePath of filePaths) {
-      const relPath = toPosix(path19.relative(service.dir, filePath));
+      const relPath = toPosix(path22.relative(service.dir, filePath));
       const { nodesAdded: n, edgesAdded: e } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -6621,7 +6816,7 @@ async function addFiles(graph, services) {
 }
 
 // src/extract/symbols.ts
-import path20 from "path";
+import path23 from "path";
 import Parser3 from "tree-sitter";
 import JavaScript3 from "tree-sitter-javascript";
 import TypeScript from "tree-sitter-typescript";
@@ -6631,9 +6826,12 @@ import Ruby2 from "tree-sitter-ruby";
 import Php2 from "tree-sitter-php";
 import CSharp from "tree-sitter-c-sharp";
 import Java from "tree-sitter-java";
+import Kotlin from "tree-sitter-kotlin";
+import Rust from "tree-sitter-rust";
+import Cpp from "tree-sitter-cpp";
 import {
   EdgeType as EdgeType7,
-  NodeType as NodeType14,
+  NodeType as NodeType17,
   Provenance as Provenance7,
   confidenceForExtracted as confidenceForExtracted4,
   extractedEdgeId as extractedEdgeId6,
@@ -6655,7 +6853,25 @@ var SYMBOL_GRAMMAR_BY_EXT = {
   ".rb": Ruby2,
   ".php": Php2.php_only,
   ".cs": CSharp,
-  ".java": Java
+  ".java": Java,
+  ".kt": Kotlin,
+  ".rs": Rust,
+  // C++ (ADR-202) — only the UNAMBIGUOUS extensions. `.cpp` / `.cc` / `.cxx` /
+  // `.c++` are implementation files; `.hpp` / `.hh` / `.hxx` / `.h++` are C++-only
+  // headers. `.h` and `.c` are deliberately absent: they are shared with C (a
+  // language NEAT does not add), and this map is global — the symbol grain
+  // dispatches on extension, not on the owning service's language — so claiming
+  // `.h` would parse every pure-C header in any repo with the C++ grammar and
+  // mislabel it. The otel-demo `currency` target's executable code lives in a
+  // `.cpp`, so nothing is lost.
+  ".cpp": Cpp,
+  ".cc": Cpp,
+  ".cxx": Cpp,
+  ".c++": Cpp,
+  ".hpp": Cpp,
+  ".hh": Cpp,
+  ".hxx": Cpp,
+  ".h++": Cpp
 };
 function parseSource3(parser, source) {
   return parser.parse(
@@ -7068,6 +7284,237 @@ function collectJavaSymbolDefs(root) {
   walkChildren(root, void 0);
   return out;
 }
+function collectKotlinSymbolDefs(root) {
+  const out = [];
+  const push = (kind, qualname, node) => {
+    out.push({
+      kind,
+      qualname,
+      startLine: node.startPosition.row + 1,
+      endLine: node.endPosition.row + 1
+    });
+  };
+  const join = (prefix, name) => prefix ? `${prefix}.${name}` : name;
+  const firstChildOfType = (node, types) => {
+    for (let i = 0; i < node.namedChildCount; i++) {
+      const child = node.namedChild(i);
+      if (child && types.includes(child.type)) return child;
+    }
+    return void 0;
+  };
+  const nameOf = (node, ...types) => firstChildOfType(node, types)?.text;
+  const bodyOf = (node) => firstChildOfType(node, ["class_body", "enum_class_body"]);
+  let pkg;
+  for (let i = 0; i < root.namedChildCount; i++) {
+    const child = root.namedChild(i);
+    if (child?.type === "package_header") {
+      pkg = child.namedChild(0)?.text;
+      break;
+    }
+  }
+  const walkChildren = (container, classCtx) => {
+    for (let i = 0; i < container.namedChildCount; i++) {
+      const child = container.namedChild(i);
+      if (child) visit(child, classCtx);
+    }
+  };
+  const visit = (node, classCtx) => {
+    switch (node.type) {
+      case "class_declaration":
+      case "object_declaration": {
+        const name = nameOf(node, "type_identifier");
+        const full = name ? join(classCtx ?? pkg, name) : classCtx;
+        if (name) push("class", full, node);
+        const body = bodyOf(node);
+        if (body) walkChildren(body, full);
+        return;
+      }
+      case "companion_object": {
+        const name = nameOf(node, "type_identifier");
+        const full = name ? join(classCtx ?? pkg, name) : classCtx ?? pkg;
+        const body = bodyOf(node);
+        if (body) walkChildren(body, full);
+        return;
+      }
+      case "function_declaration": {
+        const name = nameOf(node, "simple_identifier");
+        if (name) push(classCtx ? "method" : "function", join(classCtx ?? pkg, name), node);
+        return;
+      }
+      case "secondary_constructor": {
+        if (classCtx) {
+          const typeName = classCtx.slice(classCtx.lastIndexOf(".") + 1);
+          push("constructor", join(classCtx, typeName), node);
+        }
+        return;
+      }
+    }
+    walkChildren(node, classCtx);
+  };
+  walkChildren(root, void 0);
+  return out;
+}
+function collectRustSymbolDefs(root) {
+  const out = [];
+  const push = (kind, qualname, node) => {
+    out.push({
+      kind,
+      qualname,
+      startLine: node.startPosition.row + 1,
+      endLine: node.endPosition.row + 1
+    });
+  };
+  const join = (prefix, name) => prefix ? `${prefix}::${name}` : name;
+  const walkTypeBody = (body, typeCtx) => {
+    for (let i = 0; i < body.namedChildCount; i++) {
+      const child = body.namedChild(i);
+      if (!child) continue;
+      if (child.type === "function_item" || child.type === "function_signature_item") {
+        const name = child.childForFieldName("name")?.text;
+        if (name) push("method", join(typeCtx, name), child);
+      }
+    }
+  };
+  const walkChildren = (container, modCtx) => {
+    for (let i = 0; i < container.namedChildCount; i++) {
+      const child = container.namedChild(i);
+      if (child) visit(child, modCtx);
+    }
+  };
+  const visit = (node, modCtx) => {
+    switch (node.type) {
+      case "mod_item": {
+        const name = node.childForFieldName("name")?.text;
+        const full = name ? join(modCtx, name) : modCtx;
+        const body = node.childForFieldName("body");
+        if (body) walkChildren(body, full);
+        return;
+      }
+      case "struct_item":
+      case "enum_item": {
+        const name = node.childForFieldName("name")?.text;
+        if (name) push("class", join(modCtx, name), node);
+        return;
+      }
+      case "trait_item": {
+        const name = node.childForFieldName("name")?.text;
+        const full = name ? join(modCtx, name) : modCtx;
+        if (name) push("class", full, node);
+        const body = node.childForFieldName("body");
+        if (body && full) walkTypeBody(body, full);
+        return;
+      }
+      case "impl_item": {
+        const typeName = node.childForFieldName("type")?.text;
+        const full = typeName ? join(modCtx, typeName) : modCtx;
+        const body = node.childForFieldName("body");
+        if (body && full) walkTypeBody(body, full);
+        return;
+      }
+      case "function_item": {
+        const name = node.childForFieldName("name")?.text;
+        if (name) push("function", join(modCtx, name), node);
+        return;
+      }
+    }
+    walkChildren(node, modCtx);
+  };
+  walkChildren(root, void 0);
+  return out;
+}
+function collectCppSymbolDefs(root) {
+  const out = [];
+  const push = (kind, qualname, node) => {
+    out.push({
+      kind,
+      qualname,
+      startLine: node.startPosition.row + 1,
+      endLine: node.endPosition.row + 1
+    });
+  };
+  const join = (prefix, name) => prefix ? `${prefix}::${name}` : name;
+  const DECLARATOR_WRAPPERS = /* @__PURE__ */ new Set([
+    "function_declarator",
+    "pointer_declarator",
+    "reference_declarator",
+    "parenthesized_declarator"
+  ]);
+  const functionNameNode = (node) => {
+    let decl = node.childForFieldName("declarator");
+    for (let guard = 0; decl && guard < 8; guard++) {
+      if (decl.type === "function_declarator") {
+        return decl.childForFieldName("declarator") ?? void 0;
+      }
+      let next;
+      for (let i = 0; i < decl.namedChildCount; i++) {
+        const child = decl.namedChild(i);
+        if (child && DECLARATOR_WRAPPERS.has(child.type)) {
+          next = child;
+          break;
+        }
+      }
+      decl = next;
+    }
+    return void 0;
+  };
+  const classify = (nameText, prefix, enclosingClass) => {
+    const qualname = join(prefix, nameText);
+    let className;
+    let memberName;
+    const idx = nameText.lastIndexOf("::");
+    if (idx >= 0) {
+      memberName = nameText.slice(idx + 2);
+      const before = nameText.slice(0, idx);
+      const j = before.lastIndexOf("::");
+      className = j >= 0 ? before.slice(j + 2) : before;
+    } else {
+      memberName = nameText;
+      className = enclosingClass;
+    }
+    let kind;
+    if (className && memberName === className) kind = "constructor";
+    else if (className) kind = "method";
+    else kind = "function";
+    return { kind, qualname };
+  };
+  const walkChildren = (container, prefix, enclosingClass) => {
+    for (let i = 0; i < container.namedChildCount; i++) {
+      const child = container.namedChild(i);
+      if (child) visit(child, prefix, enclosingClass);
+    }
+  };
+  const visit = (node, prefix, enclosingClass) => {
+    switch (node.type) {
+      case "namespace_definition": {
+        const name = node.childForFieldName("name")?.text;
+        const newPrefix = name ? join(prefix, name) : prefix;
+        const body = node.childForFieldName("body");
+        if (body) walkChildren(body, newPrefix, void 0);
+        return;
+      }
+      case "class_specifier":
+      case "struct_specifier": {
+        const name = node.childForFieldName("name")?.text;
+        const full = name ? join(prefix, name) : prefix;
+        if (name) push("class", full, node);
+        const body = node.childForFieldName("body");
+        if (body && name) walkChildren(body, full, name);
+        return;
+      }
+      case "function_definition": {
+        const nameNode = functionNameNode(node);
+        if (nameNode) {
+          const { kind, qualname } = classify(nameNode.text, prefix, enclosingClass);
+          push(kind, qualname, node);
+        }
+        return;
+      }
+    }
+    walkChildren(node, prefix, enclosingClass);
+  };
+  walkChildren(root, void 0, void 0);
+  return out;
+}
 function collectSymbolDefsForExt(ext, root) {
   switch (ext) {
     case ".py":
@@ -7082,6 +7529,19 @@ function collectSymbolDefsForExt(ext, root) {
       return collectCsharpSymbolDefs(root);
     case ".java":
       return collectJavaSymbolDefs(root);
+    case ".kt":
+      return collectKotlinSymbolDefs(root);
+    case ".rs":
+      return collectRustSymbolDefs(root);
+    case ".cpp":
+    case ".cc":
+    case ".cxx":
+    case ".c++":
+    case ".hpp":
+    case ".hh":
+    case ".hxx":
+    case ".h++":
+      return collectCppSymbolDefs(root);
     default:
       return collectSymbolDefs(root);
   }
@@ -7113,12 +7573,12 @@ async function addSymbols(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
-      const ext = path20.extname(file.path);
+      const ext = path23.extname(file.path);
       const parser = parserForExt5(ext);
       if (!parser) continue;
-      const relPath = toPosix(path20.relative(service.dir, file.path));
+      const relPath = toPosix(path23.relative(service.dir, file.path));
       let defs;
       try {
         const tree = parseSource3(parser, file.content);
@@ -7141,7 +7601,7 @@ async function addSymbols(graph, services) {
         if (!graph.hasNode(sid)) {
           const node = {
             id: sid,
-            type: NodeType14.SymbolNode,
+            type: NodeType17.SymbolNode,
             kind: def.kind,
             qualname: def.qualname,
             span: { startLine: def.startLine, endLine: def.endLine },
@@ -7177,11 +7637,11 @@ async function addSymbols(graph, services) {
 }
 
 // src/extract/symbol-edges.ts
-import path21 from "path";
+import path24 from "path";
 import Parser4 from "tree-sitter";
 import {
   EdgeType as EdgeType8,
-  NodeType as NodeType15,
+  NodeType as NodeType18,
   Provenance as Provenance8,
   confidenceForExtracted as confidenceForExtracted5,
   extractedEdgeId as extractedEdgeId7,
@@ -7289,12 +7749,12 @@ async function addSymbolEdges(graph, services) {
   for (const service of services) {
     const serviceName = service.pkg.name;
     const tsPaths = await loadTsPathConfig(service.dir);
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
-      const parser = parserForExt5(path21.extname(file.path));
+      const parser = parserForExt5(path24.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(path21.relative(service.dir, file.path));
-      const fileDir = path21.dirname(file.path);
+      const relPath = toPosix(path24.relative(service.dir, file.path));
+      const fileDir = path24.dirname(file.path);
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -7336,7 +7796,7 @@ async function addSymbolEdges(graph, services) {
           const candidate = symbolId3(serviceName, imp.targetRelPath, imp.importedName);
           if (graph.hasNode(candidate)) {
             const node = graph.getNodeAttributes(candidate);
-            if (node.type === NodeType15.SymbolNode && node.kind === wantKind) return candidate;
+            if (node.type === NodeType18.SymbolNode && node.kind === wantKind) return candidate;
           }
         }
         return null;
@@ -7428,11 +7888,11 @@ async function addSymbolEdges(graph, services) {
 }
 
 // src/extract/actions.ts
-import path22 from "path";
+import path25 from "path";
 import Parser5 from "tree-sitter";
 import {
   EdgeType as EdgeType9,
-  NodeType as NodeType16,
+  NodeType as NodeType19,
   Provenance as Provenance9,
   confidenceForExtracted as confidenceForExtracted6,
   extractedEdgeId as extractedEdgeId8,
@@ -7579,12 +8039,12 @@ async function addServerActions(graph, services) {
     };
     if (deps["next"] === void 0) continue;
     const tsPaths = await loadTsPathConfig(service.dir);
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt5(path22.extname(file.path));
+      const parser = parserForExt5(path25.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(path22.relative(service.dir, file.path));
+      const relPath = toPosix(path25.relative(service.dir, file.path));
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -7611,7 +8071,7 @@ async function addServerActions(graph, services) {
         if (!graph.hasNode(aid)) {
           const node = {
             id: aid,
-            type: NodeType16.ServerActionNode,
+            type: NodeType19.ServerActionNode,
             name: action.exportName,
             service: service.pkg.name,
             module: relPath,
@@ -7645,10 +8105,10 @@ async function addServerActions(graph, services) {
     }
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt5(path22.extname(file.path));
+      const parser = parserForExt5(path25.extname(file.path));
       if (!parser) continue;
-      const relPath = toPosix(path22.relative(service.dir, file.path));
-      const fileDir = path22.dirname(file.path);
+      const relPath = toPosix(path25.relative(service.dir, file.path));
+      const fileDir = path25.dirname(file.path);
       let root;
       try {
         root = parseSource3(parser, file.content).rootNode;
@@ -7700,10 +8160,10 @@ async function addServerActions(graph, services) {
 }
 
 // src/extract/databases/index.ts
-import path30 from "path";
+import path33 from "path";
 import {
   EdgeType as EdgeType10,
-  NodeType as NodeType17,
+  NodeType as NodeType20,
   Provenance as Provenance10,
   configId,
   databaseId as databaseId2,
@@ -7711,9 +8171,9 @@ import {
 } from "@neat.is/types";
 
 // src/extract/databases/db-config-yaml.ts
-import path23 from "path";
+import path26 from "path";
 async function parse(serviceDir) {
-  const yamlPath = path23.join(serviceDir, "db-config.yaml");
+  const yamlPath = path26.join(serviceDir, "db-config.yaml");
   if (!await exists(yamlPath)) return [];
   const raw = await readYaml(yamlPath);
   return [
@@ -7730,12 +8190,12 @@ async function parse(serviceDir) {
 var dbConfigYamlParser = { name: "db-config.yaml", parse };
 
 // src/extract/databases/dotenv.ts
-import { promises as fs18 } from "fs";
-import path25 from "path";
+import { promises as fs21 } from "fs";
+import path28 from "path";
 
 // src/extract/databases/shared.ts
-import { promises as fs17 } from "fs";
-import path24 from "path";
+import { promises as fs20 } from "fs";
+import path27 from "path";
 function schemeToEngine(scheme) {
   const s = scheme.toLowerCase().split("+")[0];
   switch (s) {
@@ -7774,18 +8234,18 @@ function parseConnectionString(url) {
 }
 async function readIfExists(filePath) {
   try {
-    return await fs17.readFile(filePath, "utf8");
+    return await fs20.readFile(filePath, "utf8");
   } catch {
     return null;
   }
 }
 async function resolveEnvVar(serviceDir, name) {
-  const entries = await fs17.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs20.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
   const envNames = entries.filter((e) => e.isFile() && (e.name === ".env" || e.name.startsWith(".env."))).map((e) => e.name);
   const rank = (n) => n === ".env.local" ? 0 : n === ".env" ? 1 : 2;
   envNames.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
   for (const fileName of envNames) {
-    const content = await readIfExists(path24.join(serviceDir, fileName));
+    const content = await readIfExists(path27.join(serviceDir, fileName));
     if (!content) continue;
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -7804,7 +8264,7 @@ async function resolveEnvVar(serviceDir, name) {
 }
 async function findFirst(serviceDir, candidates) {
   for (const rel of candidates) {
-    const abs = path24.join(serviceDir, rel);
+    const abs = path27.join(serviceDir, rel);
     const content = await readIfExists(abs);
     if (content !== null) return abs;
   }
@@ -7862,15 +8322,15 @@ function parseDotenvLine(line) {
   return { key, value };
 }
 async function parse2(serviceDir) {
-  const entries = await fs18.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
+  const entries = await fs21.readdir(serviceDir, { withFileTypes: true }).catch(() => []);
   const configs = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
     const match = isConfigFile(entry.name);
     if (!match.match || match.fileType !== "env") continue;
-    const filePath = path25.join(serviceDir, entry.name);
-    const content = await fs18.readFile(filePath, "utf8");
+    const filePath = path28.join(serviceDir, entry.name);
+    const content = await fs21.readFile(filePath, "utf8");
     for (const line of content.split("\n")) {
       const parsed = parseDotenvLine(line);
       if (!parsed) continue;
@@ -7888,9 +8348,9 @@ async function parse2(serviceDir) {
 var dotenvParser = { name: ".env", parse: parse2 };
 
 // src/extract/databases/prisma.ts
-import path26 from "path";
+import path29 from "path";
 async function parse3(serviceDir) {
-  const schemaPath = path26.join(serviceDir, "prisma", "schema.prisma");
+  const schemaPath = path29.join(serviceDir, "prisma", "schema.prisma");
   const content = await readIfExists(schemaPath);
   if (!content) return [];
   const block = content.match(/datasource\s+\w+\s*\{([^}]*)\}/s);
@@ -8045,10 +8505,10 @@ async function parse5(serviceDir) {
 var knexParser = { name: "knex", parse: parse5 };
 
 // src/extract/databases/ormconfig.ts
-import path27 from "path";
+import path30 from "path";
 async function parse6(serviceDir) {
   for (const candidate of ["ormconfig.json", "ormconfig.yaml", "ormconfig.yml"]) {
-    const abs = path27.join(serviceDir, candidate);
+    const abs = path30.join(serviceDir, candidate);
     if (!await exists(abs)) continue;
     const raw = candidate.endsWith(".json") ? await readJson(abs) : await readYaml(abs);
     const entries = Array.isArray(raw) ? raw : [raw];
@@ -8106,9 +8566,9 @@ async function parse7(serviceDir) {
 var typeormParser = { name: "typeorm", parse: parse7 };
 
 // src/extract/databases/sequelize.ts
-import path28 from "path";
+import path31 from "path";
 async function parse8(serviceDir) {
-  const configPath = path28.join(serviceDir, "config", "config.json");
+  const configPath = path31.join(serviceDir, "config", "config.json");
   if (!await exists(configPath)) return [];
   const raw = await readJson(configPath);
   const out = [];
@@ -8134,7 +8594,7 @@ async function parse8(serviceDir) {
 var sequelizeParser = { name: "sequelize", parse: parse8 };
 
 // src/extract/databases/docker-compose.ts
-import path29 from "path";
+import path32 from "path";
 function portFromService(svc) {
   for (const raw of svc.ports ?? []) {
     const str = String(raw);
@@ -8161,7 +8621,7 @@ function databaseFromEnv(svc) {
 }
 async function parse9(serviceDir) {
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path29.join(serviceDir, name);
+    const abs = path32.join(serviceDir, name);
     if (!await exists(abs)) continue;
     const raw = await readYaml(abs);
     if (!raw?.services) return [];
@@ -8203,7 +8663,7 @@ function compatibleDriversFor(engine) {
 function toDatabaseNode(config) {
   return {
     id: databaseId2(config.host),
-    type: NodeType17.DatabaseNode,
+    type: NodeType20.DatabaseNode,
     name: config.database || config.host,
     engine: config.engine,
     engineVersion: config.engineVersion,
@@ -8333,7 +8793,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
           discoveredVia: mergedDiscoveredVia
         });
       }
-      const relConfigFile = toPosix(path30.relative(service.dir, config.sourceFile));
+      const relConfigFile = toPosix(path33.relative(service.dir, config.sourceFile));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -8342,7 +8802,7 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
       );
       nodesAdded += fn;
       edgesAdded += fe;
-      const evidenceFile = toPosix(path30.relative(scanPath, config.sourceFile));
+      const evidenceFile = toPosix(path33.relative(scanPath, config.sourceFile));
       const edge = {
         id: extractedEdgeId(fileNodeId, dbNode.id, EdgeType10.CONNECTS_TO),
         source: fileNodeId,
@@ -8360,15 +8820,15 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
     if (allConfigs.length === 1) {
       const primary = allConfigs[0];
       service.node.dbConnectionTarget = primary.port ? `${primary.host}:${primary.port}` : primary.host;
-      const relPath = path30.relative(scanPath, primary.sourceFile);
+      const relPath = path33.relative(scanPath, primary.sourceFile);
       const cfgId = configId(relPath);
       if (!graph.hasNode(cfgId)) {
         const cfgNode = {
           id: cfgId,
-          type: NodeType17.ConfigNode,
-          name: path30.basename(primary.sourceFile),
+          type: NodeType20.ConfigNode,
+          name: path33.basename(primary.sourceFile),
           path: relPath,
-          fileType: isConfigFile(path30.basename(primary.sourceFile)).fileType || "config"
+          fileType: isConfigFile(path33.basename(primary.sourceFile)).fileType || "config"
         };
         graph.addNode(cfgId, cfgNode);
         nodesAdded++;
@@ -8408,23 +8868,25 @@ async function addDatabasesAndCompat(graph, services, scanPath) {
 }
 
 // src/extract/configs.ts
-import { promises as fs19 } from "fs";
-import path31 from "path";
+import { promises as fs22 } from "fs";
+import path34 from "path";
 import {
   EdgeType as EdgeType11,
-  NodeType as NodeType18,
+  NodeType as NodeType21,
   Provenance as Provenance11,
   configId as configId2,
   confidenceForExtracted as confidenceForExtracted8
 } from "@neat.is/types";
-async function walkConfigFiles(dir) {
+async function walkConfigFiles(dir, excludeDirs = []) {
+  const excluded = new Set(excludeDirs.map((d) => path34.resolve(d)));
   const out = [];
   async function walk9(current) {
-    const entries = await fs19.readdir(current, { withFileTypes: true });
+    const entries = await fs22.readdir(current, { withFileTypes: true });
     for (const entry of entries) {
-      const full = path31.join(current, entry.name);
+      const full = path34.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
+        if (excluded.has(path34.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk9(full);
       } else if (entry.isFile() && isConfigFile(entry.name).match) {
@@ -8439,21 +8901,21 @@ async function addConfigNodes(graph, services, scanPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const configFiles = await walkConfigFiles(service.dir);
+    const configFiles = await walkConfigFiles(service.dir, service.excludeDirs);
     for (const file of configFiles) {
-      const relPath = path31.relative(scanPath, file);
+      const relPath = path34.relative(scanPath, file);
       const node = {
         id: configId2(relPath),
-        type: NodeType18.ConfigNode,
-        name: path31.basename(file),
+        type: NodeType21.ConfigNode,
+        name: path34.basename(file),
         path: relPath,
-        fileType: isConfigFile(path31.basename(file)).fileType
+        fileType: isConfigFile(path34.basename(file)).fileType
       };
       if (!graph.hasNode(node.id)) {
         graph.addNode(node.id, node);
         nodesAdded++;
       }
-      const relToService = toPosix(path31.relative(service.dir, file));
+      const relToService = toPosix(path34.relative(service.dir, file));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -8469,7 +8931,7 @@ async function addConfigNodes(graph, services, scanPath) {
         type: EdgeType11.CONFIGURED_BY,
         provenance: Provenance11.EXTRACTED,
         confidence: confidenceForExtracted8("structural"),
-        evidence: { file: relPath.split(path31.sep).join("/") }
+        evidence: { file: relPath.split(path34.sep).join("/") }
       };
       if (!graph.hasEdge(edge.id)) {
         graph.addEdgeWithKey(edge.id, edge.source, edge.target, edge);
@@ -8481,11 +8943,11 @@ async function addConfigNodes(graph, services, scanPath) {
 }
 
 // src/extract/proto.ts
-import { promises as fs20 } from "fs";
-import path32 from "path";
+import { promises as fs23 } from "fs";
+import path35 from "path";
 import {
   EdgeType as EdgeType12,
-  NodeType as NodeType19,
+  NodeType as NodeType22,
   Provenance as Provenance12,
   confidenceForExtracted as confidenceForExtracted9,
   extractedEdgeId as extractedEdgeId9,
@@ -8526,17 +8988,19 @@ function grpcMethodsFromProto(content, fqPackage) {
   }
   return out;
 }
-async function walkProtoFiles(dir) {
+async function walkProtoFiles(dir, excludeDirs = []) {
+  const excluded = new Set(excludeDirs.map((d) => path35.resolve(d)));
   const out = [];
   async function walk9(current) {
-    const entries = await fs20.readdir(current, { withFileTypes: true }).catch(() => []);
+    const entries = await fs23.readdir(current, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
-      const full = path32.join(current, entry.name);
+      const full = path35.join(current, entry.name);
       if (entry.isDirectory()) {
         if (IGNORED_DIRS.has(entry.name)) continue;
+        if (excluded.has(path35.resolve(full))) continue;
         if (await isPythonVenvDir(full)) continue;
         await walk9(full);
-      } else if (entry.isFile() && path32.extname(entry.name) === PROTO_EXTENSION) {
+      } else if (entry.isFile() && path35.extname(entry.name) === PROTO_EXTENSION) {
         out.push(full);
       }
     }
@@ -8548,13 +9012,13 @@ async function addGrpcMethods(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const protoPaths = await walkProtoFiles(service.dir);
+    const protoPaths = await walkProtoFiles(service.dir, service.excludeDirs);
     for (const protoPath of protoPaths) {
       if (isTestPath(protoPath)) continue;
-      const relFile = toPosix(path32.relative(service.dir, protoPath));
+      const relFile = toPosix(path35.relative(service.dir, protoPath));
       let content;
       try {
-        content = await fs20.readFile(protoPath, "utf8");
+        content = await fs23.readFile(protoPath, "utf8");
       } catch (err) {
         recordExtractionError("proto extraction", protoPath, err);
         continue;
@@ -8572,7 +9036,7 @@ async function addGrpcMethods(graph, services) {
         if (!graph.hasNode(mid)) {
           const node = {
             id: mid,
-            type: NodeType19.GrpcMethodNode,
+            type: NodeType22.GrpcMethodNode,
             name: `${method.rpcService}/${method.rpcMethod}`,
             rpcService: method.rpcService,
             rpcMethod: method.rpcMethod,
@@ -8610,14 +9074,14 @@ async function addGrpcMethods(graph, services) {
 // src/extract/calls/index.ts
 import {
   EdgeType as EdgeType15,
-  NodeType as NodeType21,
+  NodeType as NodeType24,
   Provenance as Provenance15,
   confidenceForExtracted as confidenceForExtracted12,
   passesExtractedFloor as passesExtractedFloor3
 } from "@neat.is/types";
 
 // src/extract/calls/http.ts
-import path33 from "path";
+import path36 from "path";
 import Parser6 from "tree-sitter";
 import JavaScript4 from "tree-sitter-javascript";
 import TypeScript2 from "tree-sitter-typescript";
@@ -8701,11 +9165,11 @@ async function addHttpCallEdges(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     const seen = /* @__PURE__ */ new Set();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      const parser = parserForExt(path33.extname(file.path), parserCache);
+      const parser = parserForExt(path36.extname(file.path), parserCache);
       let sites;
       try {
         sites = callsFromSource(file.content, parser, knownHosts);
@@ -8714,7 +9178,7 @@ async function addHttpCallEdges(graph, services) {
         continue;
       }
       if (sites.length === 0) continue;
-      const relFile = toPosix(path33.relative(service.dir, file.path));
+      const relFile = toPosix(path36.relative(service.dir, file.path));
       for (const site of sites) {
         const targetId = hostToNodeId.get(site.host);
         if (!targetId || targetId === service.node.id) continue;
@@ -8767,16 +9231,16 @@ async function addHttpCallEdges(graph, services) {
 }
 
 // src/extract/calls/route-match.ts
-import path34 from "path";
+import path37 from "path";
 import Parser7 from "tree-sitter";
 import JavaScript5 from "tree-sitter-javascript";
 import {
   EdgeType as EdgeType14,
-  NodeType as NodeType20,
+  NodeType as NodeType23,
   Provenance as Provenance14,
   confidenceForExtracted as confidenceForExtracted11,
   passesExtractedFloor as passesExtractedFloor2,
-  serviceId as serviceId9
+  serviceId as serviceId12
 } from "@neat.is/types";
 var PARSE_CHUNK5 = 16384;
 function parseSource5(parser, source) {
@@ -8942,9 +9406,9 @@ function buildRouteIndex(graph) {
   const index = /* @__PURE__ */ new Map();
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType20.RouteNode) return;
+    if (node.type !== NodeType23.RouteNode) return;
     const route = attrs;
-    const owner = serviceId9(route.service);
+    const owner = serviceId12(route.service);
     const entry = {
       method: route.method.toUpperCase(),
       normalizedPath: normalizePathTemplate(route.pathTemplate),
@@ -8969,11 +9433,11 @@ async function addRouteCallEdges(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     const seen = /* @__PURE__ */ new Set();
     for (const file of files) {
       if (isTestPath(file.path)) continue;
-      if (!JS_CLIENT_EXTENSIONS.has(path34.extname(file.path))) continue;
+      if (!JS_CLIENT_EXTENSIONS.has(path37.extname(file.path))) continue;
       let sites;
       try {
         sites = clientCallSitesFromSource(file.content, jsParser, knownHosts);
@@ -8982,7 +9446,7 @@ async function addRouteCallEdges(graph, services) {
         continue;
       }
       if (sites.length === 0) continue;
-      const relFile = toPosix(path34.relative(service.dir, file.path));
+      const relFile = toPosix(path37.relative(service.dir, file.path));
       for (const site of sites) {
         const serverServiceId = hostToNodeId.get(site.host);
         if (!serverServiceId || serverServiceId === service.node.id) continue;
@@ -9042,7 +9506,7 @@ async function addRouteCallEdges(graph, services) {
 }
 
 // src/extract/calls/kafka.ts
-import path35 from "path";
+import path38 from "path";
 import { infraId as infraId2 } from "@neat.is/types";
 var PRODUCER_TOPIC_RE = /(?:producer|kafkaProducer)[\s\S]{0,40}?\.send\s*\(\s*\{[\s\S]{0,200}?topic\s*:\s*['"`]([^'"`]+)['"`]/g;
 var CONSUMER_TOPIC_RE = /(?:consumer|kafkaConsumer)[\s\S]{0,40}?\.(?:subscribe|run)\s*\(\s*\{[\s\S]{0,200}?topic[s]?\s*:\s*(?:\[\s*)?['"`]([^'"`]+)['"`]/g;
@@ -9073,7 +9537,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path35.relative(serviceDir, file.path),
+        file: path38.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -9085,7 +9549,7 @@ function kafkaEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/redis.ts
-import path36 from "path";
+import path39 from "path";
 import { infraId as infraId3 } from "@neat.is/types";
 var REDIS_URL_RE = /redis(?:s)?:\/\/(?:[^@'"`\s]+@)?([^:/'"`\s]+)(?::(\d+))?/g;
 function redisEndpointsFromFile(file, serviceDir) {
@@ -9108,7 +9572,7 @@ function redisEndpointsFromFile(file, serviceDir) {
       // support tier (ADR-066).
       confidenceKind: "url-with-structural-support",
       evidence: {
-        file: path36.relative(serviceDir, file.path),
+        file: path39.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -9118,7 +9582,7 @@ function redisEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/aws.ts
-import path37 from "path";
+import path40 from "path";
 import { infraId as infraId4 } from "@neat.is/types";
 var S3_BUCKET_RE = /Bucket\s*:\s*['"`]([^'"`]+)['"`]/g;
 var DYNAMO_TABLE_RE = /TableName\s*:\s*['"`]([^'"`]+)['"`]/g;
@@ -9152,7 +9616,7 @@ function awsEndpointsFromFile(file, serviceDir) {
       // (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path37.relative(serviceDir, file.path),
+        file: path40.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -9176,7 +9640,7 @@ function awsEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/grpc.ts
-import path38 from "path";
+import path41 from "path";
 import { infraId as infraId5 } from "@neat.is/types";
 var GRPC_CLIENT_RE = /new\s+([A-Z][A-Za-z0-9_]*)Client\s*\(\s*['"`]?([^,'"`)]+)?/g;
 var AWS_SDK_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@aws-sdk\/client-([a-z0-9-]+)['"`]/g;
@@ -9235,7 +9699,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066).
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path38.relative(serviceDir, file.path),
+        file: path41.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -9245,7 +9709,7 @@ function grpcEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/supabase.ts
-import path39 from "path";
+import path42 from "path";
 import { infraId as infraId6 } from "@neat.is/types";
 var SUPABASE_JS_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/supabase-js['"`]/;
 var SUPABASE_SSR_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])@supabase\/ssr['"`]/;
@@ -9304,7 +9768,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
       // tier (ADR-066), the same grade aws.ts / grpc.ts emit at.
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path39.relative(serviceDir, file.path),
+        file: path42.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -9331,7 +9795,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
         edgeType: "CALLS",
         confidenceKind: "verified-call-site",
         evidence: {
-          file: path39.relative(serviceDir, file.path),
+          file: path42.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -9342,7 +9806,7 @@ function supabaseEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/firestore.ts
-import path40 from "path";
+import path43 from "path";
 import Parser8 from "tree-sitter";
 import JavaScript6 from "tree-sitter-javascript";
 import { infraId as infraId7 } from "@neat.is/types";
@@ -9513,7 +9977,7 @@ function firestoreEndpointsFromFile(file, serviceDir) {
   const hasAdmin = FIRESTORE_ADMIN_IMPORT_RE.test(file.content);
   if (!hasClient && !hasAdmin) return [];
   const fileSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
-  const tree = parseSource3(parserForExt2(path40.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt2(path43.extname(file.path)), file.content);
   const clientVars = firestoreClientVars(tree.rootNode);
   const collLine = /* @__PURE__ */ new Map();
   const writes = /* @__PURE__ */ new Map();
@@ -9617,7 +10081,7 @@ function firestoreEndpointsFromFile(file, serviceDir) {
       ...columnSet.size > 0 ? { columns: [...columnSet] } : {},
       ...sdkWrites ? { sdkWrites } : {},
       evidence: {
-        file: path40.relative(serviceDir, file.path),
+        file: path43.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -9627,7 +10091,7 @@ function firestoreEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/mongoose.ts
-import path41 from "path";
+import path44 from "path";
 import { infraId as infraId8 } from "@neat.is/types";
 var MONGOOSE_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongoose['"`]/;
 var MONGODB_IMPORT_RE = /(?:from\s+['"`]|require\(\s*['"`])mongodb['"`]/;
@@ -9778,7 +10242,7 @@ function endpoint(r, file, serviceDir, matchText) {
     kind: r.kind,
     edgeType: "CALLS",
     confidenceKind: "verified-call-site",
-    evidence: { file: path41.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
+    evidence: { file: path44.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
   };
 }
 function mongooseEndpointsFromFile(file, serviceDir) {
@@ -9868,7 +10332,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
   const registry = /* @__PURE__ */ new Map();
   for (const f of mongooseFiles) {
     const fx = fileExportsOf(f.content, pluralizeOn);
-    if (fx) registry.set(toPosix(path41.relative(serviceDir, f.path)), fx);
+    if (fx) registry.set(toPosix(path44.relative(serviceDir, f.path)), fx);
   }
   if (registry.size === 0) return [];
   const out = [];
@@ -9879,7 +10343,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
     const directColl = /* @__PURE__ */ new Map();
     const nsExports = /* @__PURE__ */ new Map();
     for (const b of bindings) {
-      const resolvedRel = await resolveJsImport(b.specifier, path41.dirname(f.path), serviceDir, null);
+      const resolvedRel = await resolveJsImport(b.specifier, path44.dirname(f.path), serviceDir, null);
       if (!resolvedRel) continue;
       const fx = registry.get(resolvedRel);
       if (!fx) continue;
@@ -9922,7 +10386,7 @@ async function mongooseCrossFileEndpoints(files, serviceDir) {
 }
 
 // src/extract/calls/sqlalchemy.ts
-import path42 from "path";
+import path45 from "path";
 import Parser9 from "tree-sitter";
 import Python5 from "tree-sitter-python";
 import { infraId as infraId9 } from "@neat.is/types";
@@ -10061,7 +10525,7 @@ function sqlalchemyForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: path42.relative(serviceDir, file.path),
+          file: path45.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -10086,7 +10550,7 @@ function sqlalchemyEndpointsFromFile(file, serviceDir) {
       confidenceKind: "verified-call-site",
       ...columns && columns.length > 0 ? { columns } : {},
       evidence: {
-        file: path42.relative(serviceDir, file.path),
+        file: path45.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -10193,7 +10657,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
         edgeType: "CALLS",
         confidenceKind: "verified-call-site",
         evidence: {
-          file: path42.relative(serviceDir, file.path),
+          file: path45.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -10204,7 +10668,7 @@ function pythonOrmCrossFileEndpoints(files, serviceDir) {
 }
 
 // src/extract/calls/django-orm.ts
-import path43 from "path";
+import path46 from "path";
 import Parser10 from "tree-sitter";
 import Python6 from "tree-sitter-python";
 import { infraId as infraId10 } from "@neat.is/types";
@@ -10274,7 +10738,7 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
   const tree = parseSource7(makePyParser4(), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const defaultAppLabel = path43.basename(path43.dirname(file.path));
+  const defaultAppLabel = path46.basename(path46.dirname(file.path));
   walk4(tree.rootNode, (node) => {
     if (node.type !== "class_definition") return;
     if (!extendsDjangoModel(node)) return;
@@ -10292,14 +10756,14 @@ function djangoOrmEndpointsFromFile(file, serviceDir) {
       kind: "sql-table",
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
-      evidence: { file: path43.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
+      evidence: { file: path46.relative(serviceDir, file.path), line, snippet: snippet(file.content, line) }
     });
   });
   return out;
 }
 
 // src/extract/calls/drizzle.ts
-import path44 from "path";
+import path47 from "path";
 import Parser11 from "tree-sitter";
 import JavaScript7 from "tree-sitter-javascript";
 import { infraId as infraId11 } from "@neat.is/types";
@@ -10377,7 +10841,7 @@ function columnsFromObject(obj) {
 }
 function drizzleEndpointsFromFile(file, serviceDir) {
   if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt3(path44.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt3(path47.extname(file.path)), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const walk9 = (node) => {
@@ -10400,7 +10864,7 @@ function drizzleEndpointsFromFile(file, serviceDir) {
             confidenceKind: "structural",
             columns,
             evidence: {
-              file: path44.relative(serviceDir, file.path),
+              file: path47.relative(serviceDir, file.path),
               line,
               snippet: snippet(file.content, line)
             }
@@ -10466,7 +10930,7 @@ function referencesTargetVar(call) {
 }
 function drizzleForeignKeys(file, serviceDir) {
   if (!DRIZZLE_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt3(path44.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt3(path47.extname(file.path)), file.content);
   const { tables, varToTable } = collectDrizzleTables(tree.rootNode);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -10485,7 +10949,7 @@ function drizzleForeignKeys(file, serviceDir) {
               childTable: table.tableName,
               parentTable,
               evidence: {
-                file: path44.relative(serviceDir, file.path),
+                file: path47.relative(serviceDir, file.path),
                 line,
                 snippet: snippet(file.content, line)
               }
@@ -10501,7 +10965,7 @@ function drizzleForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/prisma.ts
-import path45 from "path";
+import path48 from "path";
 import { infraId as infraId12 } from "@neat.is/types";
 var SCALAR_TYPES = /* @__PURE__ */ new Set([
   "Int",
@@ -10557,7 +11021,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
       confidenceKind: "structural",
       columns: b.columns,
       evidence: {
-        file: path45.relative(serviceDir, file.path),
+        file: path48.relative(serviceDir, file.path),
         line: b.startLine,
         snippet: snippet(content, b.startLine)
       }
@@ -10618,7 +11082,7 @@ function prismaColumnsFromSchema(file, serviceDir) {
 }
 async function prismaColumnEndpoints(serviceDir) {
   const schemaPath = await findFirst(serviceDir, [
-    path45.join("prisma", "schema.prisma"),
+    path48.join("prisma", "schema.prisma"),
     "schema.prisma"
   ]);
   if (!schemaPath) return [];
@@ -10693,7 +11157,7 @@ function prismaForeignKeysFromSchema(file, serviceDir) {
               childTable: current.table,
               parentTable,
               evidence: {
-                file: path45.relative(serviceDir, file.path),
+                file: path48.relative(serviceDir, file.path),
                 line: lineNo,
                 snippet: snippet(content, lineNo)
               }
@@ -10708,7 +11172,7 @@ function prismaForeignKeysFromSchema(file, serviceDir) {
 }
 async function prismaForeignKeys(serviceDir) {
   const schemaPath = await findFirst(serviceDir, [
-    path45.join("prisma", "schema.prisma"),
+    path48.join("prisma", "schema.prisma"),
     "schema.prisma"
   ]);
   if (!schemaPath) return [];
@@ -10718,7 +11182,7 @@ async function prismaForeignKeys(serviceDir) {
 }
 
 // src/extract/calls/activerecord.ts
-import path46 from "path";
+import path49 from "path";
 import Parser12 from "tree-sitter";
 import Ruby3 from "tree-sitter-ruby";
 import { infraId as infraId13 } from "@neat.is/types";
@@ -10926,7 +11390,7 @@ function railsSchemaEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...table.columns.length > 0 ? { columns: table.columns } : {},
       evidence: {
-        file: path46.relative(serviceDir, file.path),
+        file: path49.relative(serviceDir, file.path),
         line: table.line,
         snippet: snippet(file.content, table.line)
       }
@@ -10948,7 +11412,7 @@ function railsSchemaForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: path46.relative(serviceDir, file.path),
+        file: path49.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11031,7 +11495,7 @@ function railsModelEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path46.relative(serviceDir, file.path),
+        file: path49.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11068,7 +11532,7 @@ function railsModelForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: path46.relative(serviceDir, file.path),
+          file: path49.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -11079,7 +11543,7 @@ function railsModelForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/eloquent.ts
-import path47 from "path";
+import path50 from "path";
 import Parser13 from "tree-sitter";
 import Php3 from "tree-sitter-php";
 import { infraId as infraId14 } from "@neat.is/types";
@@ -11336,7 +11800,7 @@ function laravelMigrationEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: path47.relative(serviceDir, file.path),
+        file: path50.relative(serviceDir, file.path),
         line: bp.line,
         snippet: snippet(file.content, bp.line)
       }
@@ -11358,7 +11822,7 @@ function laravelMigrationForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: path47.relative(serviceDir, file.path),
+        file: path50.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11478,7 +11942,7 @@ function laravelModelEndpointsFromFile(file, serviceDir) {
       edgeType: "CALLS",
       confidenceKind: "verified-call-site",
       evidence: {
-        file: path47.relative(serviceDir, file.path),
+        file: path50.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11514,7 +11978,7 @@ function laravelModelForeignKeys(file, serviceDir) {
         childTable,
         parentTable,
         evidence: {
-          file: path47.relative(serviceDir, file.path),
+          file: path50.relative(serviceDir, file.path),
           line,
           snippet: snippet(file.content, line)
         }
@@ -11525,7 +11989,7 @@ function laravelModelForeignKeys(file, serviceDir) {
 }
 
 // src/extract/calls/go.ts
-import path48 from "path";
+import path51 from "path";
 import Parser14 from "tree-sitter";
 import Go4 from "tree-sitter-go";
 import { infraId as infraId15 } from "@neat.is/types";
@@ -11599,7 +12063,7 @@ function firstStringLiteralArg(argsNode) {
   return null;
 }
 function goSqlEndpointsFromFile(file, serviceDir) {
-  if (path48.extname(file.path) !== ".go") return [];
+  if (path51.extname(file.path) !== ".go") return [];
   if (!file.content.includes(DATABASE_SQL_IMPORT) && !file.content.includes(SQLX_IMPORT)) return [];
   const tree = parseSource10(makeGoParser3(), file.content);
   const importsDatabaseSql = goImportsAny(tree.rootNode, /* @__PURE__ */ new Set([DATABASE_SQL_IMPORT]));
@@ -11628,7 +12092,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
       confidenceKind: "verified-call-site",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: toPosix(path48.relative(serviceDir, file.path)),
+        file: toPosix(path51.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -11638,7 +12102,7 @@ function goSqlEndpointsFromFile(file, serviceDir) {
 }
 
 // src/extract/calls/gorm.ts
-import path49 from "path";
+import path52 from "path";
 import Parser15 from "tree-sitter";
 import Go5 from "tree-sitter-go";
 import { infraId as infraId16 } from "@neat.is/types";
@@ -12071,7 +12535,7 @@ function collectColumns(struct, structs, seen, prefix, out, emitted) {
   seen.delete(struct.name);
 }
 function gormEndpointsFromFile(file, serviceDir) {
-  if (path49.extname(file.path) !== ".go") return [];
+  if (path52.extname(file.path) !== ".go") return [];
   if (!GORM_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource11(makeGoParser4(), file.content);
   const { structs, models, tableFor } = analyze(tree);
@@ -12093,7 +12557,7 @@ function gormEndpointsFromFile(file, serviceDir) {
       confidenceKind: "structural",
       ...columns.length > 0 ? { columns } : {},
       evidence: {
-        file: toPosix(path49.relative(serviceDir, file.path)),
+        file: toPosix(path52.relative(serviceDir, file.path)),
         line: struct.line,
         snippet: snippet(file.content, struct.line)
       }
@@ -12102,7 +12566,7 @@ function gormEndpointsFromFile(file, serviceDir) {
   return out;
 }
 function gormForeignKeys(file, serviceDir) {
-  if (path49.extname(file.path) !== ".go") return [];
+  if (path52.extname(file.path) !== ".go") return [];
   if (!GORM_IMPORT_RE.test(file.content)) return [];
   const tree = parseSource11(makeGoParser4(), file.content);
   const { structs, models, tableFor } = analyze(tree);
@@ -12117,7 +12581,7 @@ function gormForeignKeys(file, serviceDir) {
       childTable,
       parentTable,
       evidence: {
-        file: toPosix(path49.relative(serviceDir, file.path)),
+        file: toPosix(path52.relative(serviceDir, file.path)),
         line,
         snippet: snippet(file.content, line)
       }
@@ -12170,7 +12634,7 @@ async function addExternalEndpointEdges(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     const endpoints = [];
     const maskedFiles = [];
     for (const file of files) {
@@ -12220,7 +12684,7 @@ async function addExternalEndpointEdges(graph, services) {
       if (!graph.hasNode(ep.infraId)) {
         const node = {
           id: ep.infraId,
-          type: NodeType21.InfraNode,
+          type: NodeType24.InfraNode,
           name: ep.name,
           // #238 — `aws-*` covers AWS-SDK client kinds (aws-s3, aws-dynamodb,
           // aws-cognito-identity-provider, …); `s3-` / `dynamodb-` cover the
@@ -12233,7 +12697,7 @@ async function addExternalEndpointEdges(graph, services) {
       }
       if (ep.columns && ep.columns.length > 0) {
         const node = graph.getNodeAttributes(ep.infraId);
-        if (node.type === NodeType21.InfraNode) {
+        if (node.type === NodeType24.InfraNode) {
           graph.replaceNodeAttributes(ep.infraId, {
             ...node,
             columns: foldColumns(
@@ -12247,7 +12711,7 @@ async function addExternalEndpointEdges(graph, services) {
       }
       if (ep.sdkWrites && Object.keys(ep.sdkWrites).length > 0) {
         const node = graph.getNodeAttributes(ep.infraId);
-        if (node.type === NodeType21.InfraNode) {
+        if (node.type === NodeType24.InfraNode) {
           graph.replaceNodeAttributes(ep.infraId, {
             ...node,
             columns: foldSdkWrites(node.columns, ep.sdkWrites)
@@ -12309,7 +12773,7 @@ async function addCallEdges(graph, services) {
 // src/extract/table-edges.ts
 import {
   EdgeType as EdgeType16,
-  NodeType as NodeType22,
+  NodeType as NodeType25,
   Provenance as Provenance16,
   confidenceForExtracted as confidenceForExtracted13,
   extractedEdgeId as extractedEdgeId10,
@@ -12319,7 +12783,7 @@ async function addTableEdges(graph, services) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     const refs = [];
     const modelRefs = [];
     for (const file of files) {
@@ -12368,7 +12832,7 @@ function ensureTableNode(graph, id, name) {
   if (graph.hasNode(id)) return 0;
   const node = {
     id,
-    type: NodeType22.InfraNode,
+    type: NodeType25.InfraNode,
     name,
     provider: "self",
     kind: "sql-table"
@@ -12378,15 +12842,15 @@ function ensureTableNode(graph, id, name) {
 }
 
 // src/extract/infra/docker-compose.ts
-import path50 from "path";
+import path53 from "path";
 import { EdgeType as EdgeType17, Provenance as Provenance18, confidenceForExtracted as confidenceForExtracted15 } from "@neat.is/types";
 
 // src/extract/infra/shared.ts
-import { NodeType as NodeType23, Provenance as Provenance17, confidenceForExtracted as confidenceForExtracted14, infraId as infraId18 } from "@neat.is/types";
+import { NodeType as NodeType26, Provenance as Provenance17, confidenceForExtracted as confidenceForExtracted14, infraId as infraId18 } from "@neat.is/types";
 function makeInfraNode(kind, name, provider = "self", extras) {
   return {
     id: infraId18(kind, name),
-    type: NodeType23.InfraNode,
+    type: NodeType26.InfraNode,
     name,
     provider,
     kind,
@@ -12448,7 +12912,7 @@ function dependsOnList(value) {
 }
 function serviceNameToServiceNode(name, services) {
   for (const s of services) {
-    if (s.node.name === name || path50.basename(s.dir) === name) return s.node.id;
+    if (s.node.name === name || path53.basename(s.dir) === name) return s.node.id;
   }
   return null;
 }
@@ -12457,7 +12921,7 @@ async function addComposeInfra(graph, scanPath, services) {
   let edgesAdded = 0;
   let composePath = null;
   for (const name of ["docker-compose.yml", "docker-compose.yaml"]) {
-    const abs = path50.join(scanPath, name);
+    const abs = path53.join(scanPath, name);
     if (await exists(abs)) {
       composePath = abs;
       break;
@@ -12470,13 +12934,13 @@ async function addComposeInfra(graph, scanPath, services) {
   } catch (err) {
     recordExtractionError(
       "infra docker-compose",
-      path50.relative(scanPath, composePath),
+      path53.relative(scanPath, composePath),
       err
     );
     return { nodesAdded, edgesAdded };
   }
   if (!compose?.services) return { nodesAdded, edgesAdded };
-  const evidenceFile = path50.relative(scanPath, composePath).split(path50.sep).join("/");
+  const evidenceFile = path53.relative(scanPath, composePath).split(path53.sep).join("/");
   const composeNameToNodeId = /* @__PURE__ */ new Map();
   for (const [composeName, svc] of Object.entries(compose.services)) {
     const matchedServiceId = serviceNameToServiceNode(composeName, services);
@@ -12517,8 +12981,8 @@ async function addComposeInfra(graph, scanPath, services) {
 }
 
 // src/extract/infra/dockerfile.ts
-import path51 from "path";
-import { promises as fs21 } from "fs";
+import path54 from "path";
+import { promises as fs24 } from "fs";
 import { EdgeType as EdgeType18, Provenance as Provenance19, confidenceForExtracted as confidenceForExtracted16 } from "@neat.is/types";
 function readDockerfile(content) {
   let image = null;
@@ -12548,15 +13012,15 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
   for (const service of services) {
-    const dockerfilePath = path51.join(service.dir, "Dockerfile");
+    const dockerfilePath = path54.join(service.dir, "Dockerfile");
     if (!await exists(dockerfilePath)) continue;
     let content;
     try {
-      content = await fs21.readFile(dockerfilePath, "utf8");
+      content = await fs24.readFile(dockerfilePath, "utf8");
     } catch (err) {
       recordExtractionError(
         "infra dockerfile",
-        path51.relative(scanPath, dockerfilePath),
+        path54.relative(scanPath, dockerfilePath),
         err
       );
       continue;
@@ -12568,8 +13032,8 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
       graph.addNode(node.id, node);
       nodesAdded++;
     }
-    const relDockerfile = toPosix(path51.relative(service.dir, dockerfilePath));
-    const evidenceFile = toPosix(path51.relative(scanPath, dockerfilePath));
+    const relDockerfile = toPosix(path54.relative(service.dir, dockerfilePath));
+    const evidenceFile = toPosix(path54.relative(scanPath, dockerfilePath));
     const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
       graph,
       service.pkg.name,
@@ -12620,23 +13084,23 @@ async function addDockerfileRuntimes(graph, services, scanPath) {
 }
 
 // src/extract/infra/terraform.ts
-import { promises as fs22 } from "fs";
-import path52 from "path";
+import { promises as fs25 } from "fs";
+import path55 from "path";
 import { EdgeType as EdgeType19, Provenance as Provenance20, confidenceForExtracted as confidenceForExtracted17 } from "@neat.is/types";
 var RESOURCE_RE = /resource\s+"(aws_[A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
 var REFERENCE_RE = /(?<![\w.])(aws_[A-Za-z0-9_]+)\.([A-Za-z0-9_-]+)/g;
 async function walkTfFiles(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await fs22.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await fs25.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name) || entry.name === ".terraform") continue;
-      const child = path52.join(start, entry.name);
+      const child = path55.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkTfFiles(child, depth + 1, max));
     } else if (entry.isFile() && entry.name.endsWith(".tf")) {
-      out.push(path52.join(start, entry.name));
+      out.push(path55.join(start, entry.name));
     }
   }
   return out;
@@ -12667,8 +13131,8 @@ async function addTerraformResources(graph, scanPath) {
   let edgesAdded = 0;
   const files = await walkTfFiles(scanPath);
   for (const file of files) {
-    const content = await fs22.readFile(file, "utf8");
-    const evidenceFile = toPosix(path52.relative(scanPath, file));
+    const content = await fs25.readFile(file, "utf8");
+    const evidenceFile = toPosix(path55.relative(scanPath, file));
     const resources = [];
     const byKey = /* @__PURE__ */ new Map();
     RESOURCE_RE.lastIndex = 0;
@@ -12724,8 +13188,8 @@ async function addTerraformResources(graph, scanPath) {
 }
 
 // src/extract/infra/k8s.ts
-import { promises as fs23 } from "fs";
-import path53 from "path";
+import { promises as fs26 } from "fs";
+import path56 from "path";
 import { parseAllDocuments as parseAllDocuments2 } from "yaml";
 var K8S_KIND_TO_INFRA_KIND = {
   Service: "k8s-service",
@@ -12739,15 +13203,15 @@ var K8S_KIND_TO_INFRA_KIND = {
 async function walkYamlFiles2(start, depth = 0, max = 5) {
   if (depth > max) return [];
   const out = [];
-  const entries = await fs23.readdir(start, { withFileTypes: true }).catch(() => []);
+  const entries = await fs26.readdir(start, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
     if (entry.isDirectory()) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const child = path53.join(start, entry.name);
+      const child = path56.join(start, entry.name);
       if (await isPythonVenvDir(child)) continue;
       out.push(...await walkYamlFiles2(child, depth + 1, max));
-    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path53.extname(entry.name))) {
-      out.push(path53.join(start, entry.name));
+    } else if (entry.isFile() && CONFIG_FILE_EXTENSIONS.has(path56.extname(entry.name))) {
+      out.push(path56.join(start, entry.name));
     }
   }
   return out;
@@ -12756,7 +13220,7 @@ async function addK8sResources(graph, scanPath) {
   let nodesAdded = 0;
   const files = await walkYamlFiles2(scanPath);
   for (const file of files) {
-    const content = await fs23.readFile(file, "utf8");
+    const content = await fs26.readFile(file, "utf8");
     let docs;
     try {
       docs = parseAllDocuments2(content).map((d) => d.toJSON());
@@ -12779,17 +13243,17 @@ async function addK8sResources(graph, scanPath) {
 }
 
 // src/extract/infra/cloudflare.ts
-import { promises as fs24 } from "fs";
-import path54 from "path";
-import { parse as parseToml2 } from "smol-toml";
+import { promises as fs27 } from "fs";
+import path57 from "path";
+import { parse as parseToml3 } from "smol-toml";
 import { EdgeType as EdgeType20, Provenance as Provenance21, confidenceForExtracted as confidenceForExtracted18 } from "@neat.is/types";
 var WRANGLER_FILENAMES = ["wrangler.toml", "wrangler.jsonc", "wrangler.json"];
 async function readWranglerConfig(dir) {
   for (const filename of WRANGLER_FILENAMES) {
-    const abs = path54.join(dir, filename);
+    const abs = path57.join(dir, filename);
     if (!await exists(abs)) continue;
-    const raw = await fs24.readFile(abs, "utf8");
-    const config = filename === "wrangler.toml" ? parseToml2(raw) : JSON.parse(maskCommentsInSource(raw));
+    const raw = await fs27.readFile(abs, "utf8");
+    const config = filename === "wrangler.toml" ? parseToml3(raw) : JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
   return null;
@@ -12849,11 +13313,11 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     try {
       read = await readWranglerConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra cloudflare", path54.relative(scanPath, service.dir), err);
+      recordExtractionError("infra cloudflare", path57.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read || !read.config.name) continue;
-    const evidenceFile = toPosix(path54.relative(scanPath, path54.join(service.dir, read.relFile)));
+    const evidenceFile = toPosix(path57.relative(scanPath, path57.join(service.dir, read.relFile)));
     discovered.push({ service, config: read.config, relFile: read.relFile, raw: read.raw, evidenceFile });
   }
   for (const worker of discovered) {
@@ -12865,7 +13329,7 @@ async function addCloudflareWorkers(graph, services, scanPath) {
     }
     let anchorId = service.node.id;
     if (config.main) {
-      const entryRelPath = toPosix(path54.normalize(config.main));
+      const entryRelPath = toPosix(path57.normalize(config.main));
       const { fileNodeId, nodesAdded: fn, edgesAdded: fe } = ensureFileNode(
         graph,
         service.pkg.name,
@@ -13011,24 +13475,24 @@ async function addCloudflareWorkers(graph, services, scanPath) {
 }
 
 // src/extract/infra/vercel.ts
-import { promises as fs25 } from "fs";
-import path55 from "path";
+import { promises as fs28 } from "fs";
+import path58 from "path";
 import { EdgeType as EdgeType21 } from "@neat.is/types";
 var VERCEL_CONFIG_FILENAMES = ["vercel.json", "vercel.jsonc"];
 async function readVercelConfig(dir) {
   for (const filename of VERCEL_CONFIG_FILENAMES) {
-    const abs = path55.join(dir, filename);
+    const abs = path58.join(dir, filename);
     if (!await exists(abs)) continue;
-    const raw = await fs25.readFile(abs, "utf8");
+    const raw = await fs28.readFile(abs, "utf8");
     const config = JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
   return null;
 }
 async function readLinkedProjectName(dir) {
-  const abs = path55.join(dir, ".vercel", "project.json");
+  const abs = path58.join(dir, ".vercel", "project.json");
   if (!await exists(abs)) return void 0;
-  const parsed = JSON.parse(await fs25.readFile(abs, "utf8"));
+  const parsed = JSON.parse(await fs28.readFile(abs, "utf8"));
   return typeof parsed.projectName === "string" ? parsed.projectName : void 0;
 }
 function routeSource(route) {
@@ -13044,7 +13508,7 @@ async function addVercelServices(graph, services, scanPath) {
       read = await readVercelConfig(service.dir);
       projectName = await readLinkedProjectName(service.dir);
     } catch (err) {
-      recordExtractionError("infra vercel", path55.relative(scanPath, service.dir), err);
+      recordExtractionError("infra vercel", path58.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read && !projectName) continue;
@@ -13060,7 +13524,7 @@ async function addVercelServices(graph, services, scanPath) {
     const anchorId = service.node.id;
     if (!read) continue;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix(path55.relative(scanPath, path55.join(service.dir, relFile)));
+    const evidenceFile = toPosix(path58.relative(scanPath, path58.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -13088,17 +13552,17 @@ async function addVercelServices(graph, services, scanPath) {
 }
 
 // src/extract/infra/railway.ts
-import { promises as fs26 } from "fs";
-import path56 from "path";
-import { parse as parseToml3 } from "smol-toml";
+import { promises as fs29 } from "fs";
+import path59 from "path";
+import { parse as parseToml4 } from "smol-toml";
 import { EdgeType as EdgeType22 } from "@neat.is/types";
 var RAILWAY_FILENAMES = ["railway.toml", "railway.json", "railway.jsonc"];
 async function readRailwayConfig(dir) {
   for (const filename of RAILWAY_FILENAMES) {
-    const abs = path56.join(dir, filename);
+    const abs = path59.join(dir, filename);
     if (!await exists(abs)) continue;
-    const raw = await fs26.readFile(abs, "utf8");
-    const config = filename === "railway.toml" ? parseToml3(raw) : JSON.parse(maskCommentsInSource(raw));
+    const raw = await fs29.readFile(abs, "utf8");
+    const config = filename === "railway.toml" ? parseToml4(raw) : JSON.parse(maskCommentsInSource(raw));
     return { config, relFile: filename, raw };
   }
   return null;
@@ -13111,7 +13575,7 @@ async function addRailwayServices(graph, services, scanPath) {
     try {
       read = await readRailwayConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra railway", path56.relative(scanPath, service.dir), err);
+      recordExtractionError("infra railway", path59.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -13121,7 +13585,7 @@ async function addRailwayServices(graph, services, scanPath) {
     }
     const anchorId = service.node.id;
     const { config, relFile, raw } = read;
-    const evidenceFile = toPosix(path56.relative(scanPath, path56.join(service.dir, relFile)));
+    const evidenceFile = toPosix(path59.relative(scanPath, path59.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -13145,16 +13609,16 @@ async function addRailwayServices(graph, services, scanPath) {
 }
 
 // src/extract/infra/supabase.ts
-import { promises as fs27 } from "fs";
-import path57 from "path";
-import { parse as parseToml4 } from "smol-toml";
+import { promises as fs30 } from "fs";
+import path60 from "path";
+import { parse as parseToml5 } from "smol-toml";
 import { EdgeType as EdgeType23 } from "@neat.is/types";
 async function readSupabaseConfig(dir) {
-  const relFile = path57.join("supabase", "config.toml");
-  const abs = path57.join(dir, relFile);
+  const relFile = path60.join("supabase", "config.toml");
+  const abs = path60.join(dir, relFile);
   if (!await exists(abs)) return null;
-  const raw = await fs27.readFile(abs, "utf8");
-  const config = parseToml4(raw);
+  const raw = await fs30.readFile(abs, "utf8");
+  const config = parseToml5(raw);
   return { config, relFile, raw };
 }
 async function addSupabaseProjects(graph, services, scanPath) {
@@ -13165,7 +13629,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
     try {
       read = await readSupabaseConfig(service.dir);
     } catch (err) {
-      recordExtractionError("infra supabase", path57.relative(scanPath, service.dir), err);
+      recordExtractionError("infra supabase", path60.relative(scanPath, service.dir), err);
       continue;
     }
     if (!read) continue;
@@ -13180,7 +13644,7 @@ async function addSupabaseProjects(graph, services, scanPath) {
       });
     }
     const anchorId = service.node.id;
-    const evidenceFile = toPosix(path57.relative(scanPath, path57.join(service.dir, relFile)));
+    const evidenceFile = toPosix(path60.relative(scanPath, path60.join(service.dir, relFile)));
     const add = (edgeType, kind, name) => {
       if (!name) return;
       const result = emitPlatformResourceEdge(
@@ -13221,12 +13685,12 @@ async function addInfra(graph, scanPath, services) {
 }
 
 // src/extract/zod-shapes.ts
-import path58 from "path";
+import path61 from "path";
 import Parser16 from "tree-sitter";
 import JavaScript8 from "tree-sitter-javascript";
 import {
   EdgeType as EdgeType24,
-  NodeType as NodeType24,
+  NodeType as NodeType27,
   Provenance as Provenance22,
   confidenceForExtracted as confidenceForExtracted19,
   extractedEdgeId as extractedEdgeId11,
@@ -13323,7 +13787,7 @@ function topLevelSchemas(root) {
 }
 function zodShapesFromFile(file, serviceDir) {
   if (!ZOD_IMPORT_RE.test(file.content)) return [];
-  const tree = parseSource3(parserForExt4(path58.extname(file.path)), file.content);
+  const tree = parseSource3(parserForExt4(path61.extname(file.path)), file.content);
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   for (const { name, call } of topLevelSchemas(tree.rootNode)) {
@@ -13341,7 +13805,7 @@ function zodShapesFromFile(file, serviceDir) {
       name,
       fields,
       evidence: {
-        file: path58.relative(serviceDir, file.path),
+        file: path61.relative(serviceDir, file.path),
         line,
         snippet: snippet(file.content, line)
       }
@@ -13358,7 +13822,7 @@ async function addZodShapes(graph, services) {
       ...service.pkg.devDependencies ?? {}
     };
     if (deps["zod"] === void 0) continue;
-    const files = await loadSourceFiles(service.dir);
+    const files = await loadSourceFiles(service.dir, service.excludeDirs);
     for (const file of files) {
       if (isTestPath(file.path)) continue;
       let shapes;
@@ -13372,7 +13836,7 @@ async function addZodShapes(graph, services) {
         if (!graph.hasNode(shape.infraId)) {
           const node = {
             id: shape.infraId,
-            type: NodeType24.InfraNode,
+            type: NodeType27.InfraNode,
             name: shape.name,
             provider: "self",
             kind: "zod-schema"
@@ -13382,7 +13846,7 @@ async function addZodShapes(graph, services) {
         }
         if (shape.fields.length > 0) {
           const node = graph.getNodeAttributes(shape.infraId);
-          if (node.type === NodeType24.InfraNode) {
+          if (node.type === NodeType27.InfraNode) {
             graph.replaceNodeAttributes(shape.infraId, {
               ...node,
               columns: foldColumns(
@@ -13424,7 +13888,7 @@ async function addZodShapes(graph, services) {
 }
 
 // src/extract/firestore-rules.ts
-import { NodeType as NodeType25 } from "@neat.is/types";
+import { NodeType as NodeType28 } from "@neat.is/types";
 var FIRESTORE_COLLECTION_KIND = "firestore-collection";
 var WRITE_METHODS = /* @__PURE__ */ new Set(["write", "create", "update"]);
 function stripComments(src) {
@@ -13564,7 +14028,7 @@ async function addFirestoreRules(graph, services) {
   if (guards.size === 0) return { nodesAdded: 0, edgesAdded: 0 };
   graph.forEachNode((id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType25.InfraNode) return;
+    if (node.type !== NodeType28.InfraNode) return;
     if (node.kind !== FIRESTORE_COLLECTION_KIND) return;
     const fields = guards.get(collectionKeyFromName(node.name));
     if (!fields || fields.size === 0) return;
@@ -13577,16 +14041,16 @@ async function addFirestoreRules(graph, services) {
 }
 
 // src/extract/index.ts
-import path60 from "path";
+import path63 from "path";
 
 // src/extract/retire.ts
 import { existsSync as existsSync2 } from "fs";
-import path59 from "path";
-import { NodeType as NodeType26, Provenance as Provenance23 } from "@neat.is/types";
+import path62 from "path";
+import { NodeType as NodeType29, Provenance as Provenance23 } from "@neat.is/types";
 function dropOrphanedFileNodes(graph) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== NodeType26.FileNode) return;
+    if (attrs.type !== NodeType29.FileNode) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -13615,11 +14079,11 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
     if (edge.provenance !== Provenance23.EXTRACTED) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
-    if (path59.isAbsolute(evidenceFile)) {
+    if (path62.isAbsolute(evidenceFile)) {
       if (!existsSync2(evidenceFile)) toDrop.push(id);
       return;
     }
-    const found = bases.some((base) => existsSync2(path59.join(base, evidenceFile)));
+    const found = bases.some((base) => existsSync2(path62.join(base, evidenceFile)));
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
@@ -13676,7 +14140,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   }
   const droppedEntries = drainDroppedExtracted();
   if (isRejectedLogEnabled() && opts.errorsPath && droppedEntries.length > 0) {
-    const rejectedPath = path60.join(path60.dirname(opts.errorsPath), "rejected.ndjson");
+    const rejectedPath = path63.join(path63.dirname(opts.errorsPath), "rejected.ndjson");
     try {
       await writeRejectedExtracted(droppedEntries, rejectedPath);
     } catch (err) {
@@ -13713,11 +14177,11 @@ import {
   databaseId as databaseId3,
   DivergenceResultSchema,
   EdgeType as EdgeType25,
-  NodeType as NodeType27,
+  NodeType as NodeType30,
   parseEdgeId,
   parseFileId,
   Provenance as Provenance24,
-  serviceId as serviceId10
+  serviceId as serviceId13
 } from "@neat.is/types";
 function bucketKey(source, target, type) {
   return `${type}|${source}|${target}`;
@@ -13727,8 +14191,8 @@ function bucketSourceFor(graph, edge) {
   const parsed = parseFileId(edge.source);
   if (!parsed || !graph.hasNode(edge.target)) return edge.source;
   const target = graph.getNodeAttributes(edge.target);
-  if (target.type !== NodeType27.DatabaseNode) return edge.source;
-  return serviceId10(parsed.service);
+  if (target.type !== NodeType30.DatabaseNode) return edge.source;
+  return serviceId13(parsed.service);
 }
 function bucketEdges(graph) {
   const buckets2 = /* @__PURE__ */ new Map();
@@ -13759,22 +14223,22 @@ function bucketEdges(graph) {
 function nodeIsFrontier(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType27.FrontierNode;
+  return attrs.type === NodeType30.FrontierNode;
 }
 function nodeIsWebsocketChannel(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType27.WebSocketChannelNode;
+  return attrs.type === NodeType30.WebSocketChannelNode;
 }
 function nodeIsServerAction(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType27.ServerActionNode;
+  return attrs.type === NodeType30.ServerActionNode;
 }
 function nodeIsSymbol(graph, nodeId) {
   if (!graph.hasNode(nodeId)) return false;
   const attrs = graph.getNodeAttributes(nodeId);
-  return attrs.type === NodeType27.SymbolNode;
+  return attrs.type === NodeType30.SymbolNode;
 }
 function clampConfidence(n) {
   if (!Number.isFinite(n)) return 0;
@@ -13859,7 +14323,7 @@ function detectHostMismatch(graph, svcId, svc) {
     if (edge.type !== EdgeType25.CONNECTS_TO) continue;
     if (edge.provenance !== Provenance24.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType27.DatabaseNode) continue;
+    if (target.type !== NodeType30.DatabaseNode) continue;
     const observedHost = target.host?.trim();
     if (!observedHost) continue;
     if (observedHost === declaredHost) continue;
@@ -13884,7 +14348,7 @@ function detectCompatDivergences(graph, svcId, svc) {
     if (edge.type !== EdgeType25.CONNECTS_TO) continue;
     if (edge.provenance !== Provenance24.OBSERVED) continue;
     const target = graph.getNodeAttributes(edge.target);
-    if (target.type !== NodeType27.DatabaseNode) continue;
+    if (target.type !== NodeType30.DatabaseNode) continue;
     for (const pair of compatPairs()) {
       if (pair.engine !== target.engine) continue;
       const declared = deps[pair.driver];
@@ -14000,13 +14464,13 @@ function computeDivergences(graph, opts = {}) {
   }
   graph.forEachNode((nodeId, attrs) => {
     const n = attrs;
-    if (n.type === NodeType27.ServiceNode) {
+    if (n.type === NodeType30.ServiceNode) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
       return;
     }
-    if (n.type === NodeType27.InfraNode && n.kind === "sql-table") {
+    if (n.type === NodeType30.InfraNode && n.kind === "sql-table") {
       for (const d of detectColumnDrift(n)) all.push(d);
     }
   });
@@ -14050,9 +14514,9 @@ function computeDivergences(graph, opts = {}) {
 }
 
 // src/persist.ts
-import { promises as fs28 } from "fs";
-import path61 from "path";
-import { NodeType as NodeType28, Provenance as Provenance25, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
+import { promises as fs31 } from "fs";
+import path64 from "path";
+import { NodeType as NodeType31, Provenance as Provenance25, observedEdgeId as observedEdgeId2 } from "@neat.is/types";
 var SCHEMA_VERSION = 7;
 function migrateV1ToV2(payload) {
   const nodes = payload.graph.nodes;
@@ -14076,7 +14540,7 @@ function migrateV5ToV6(payload) {
   if (Array.isArray(nodes)) {
     for (const node of nodes) {
       const attrs = node.attributes;
-      if (!attrs || attrs.type !== NodeType28.InfraNode) continue;
+      if (!attrs || attrs.type !== NodeType31.InfraNode) continue;
       if (attrs.kind !== "sql-table" && attrs.kind !== "supabase-table") continue;
       if (!Array.isArray(attrs.columns)) attrs.columns = [];
     }
@@ -14106,7 +14570,7 @@ function migrateV2ToV3(payload) {
   return { ...payload, schemaVersion: 3 };
 }
 async function ensureDir(filePath) {
-  await fs28.mkdir(path61.dirname(filePath), { recursive: true });
+  await fs31.mkdir(path64.dirname(filePath), { recursive: true });
 }
 async function saveGraphToDisk(graph, outPath) {
   await ensureDir(outPath);
@@ -14116,13 +14580,13 @@ async function saveGraphToDisk(graph, outPath) {
     graph: graph.export()
   };
   const tmp = `${outPath}.tmp`;
-  await fs28.writeFile(tmp, JSON.stringify(payload), "utf8");
-  await fs28.rename(tmp, outPath);
+  await fs31.writeFile(tmp, JSON.stringify(payload), "utf8");
+  await fs31.rename(tmp, outPath);
 }
 async function loadGraphFromDisk(graph, outPath) {
   let raw;
   try {
-    raw = await fs28.readFile(outPath, "utf8");
+    raw = await fs31.readFile(outPath, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -14195,7 +14659,7 @@ function startPersistLoop(graph, outPath, opts = {}) {
 }
 
 // src/diff.ts
-import { promises as fs29 } from "fs";
+import { promises as fs32 } from "fs";
 async function loadSnapshotForDiff(target) {
   if (/^https?:\/\//i.test(target)) {
     const res = await fetch(target);
@@ -14204,7 +14668,7 @@ async function loadSnapshotForDiff(target) {
     }
     return await res.json();
   }
-  const raw = await fs29.readFile(target, "utf8");
+  const raw = await fs32.readFile(target, "utf8");
   return JSON.parse(raw);
 }
 function indexEntries(entries) {
@@ -14271,23 +14735,23 @@ function canonicalJson(value) {
 }
 
 // src/projects.ts
-import path62 from "path";
+import path65 from "path";
 function pathsForProject(project, baseDir) {
   if (project === DEFAULT_PROJECT) {
     return {
-      snapshotPath: path62.join(baseDir, "graph.json"),
-      errorsPath: path62.join(baseDir, "errors.ndjson"),
-      staleEventsPath: path62.join(baseDir, "stale-events.ndjson"),
-      embeddingsCachePath: path62.join(baseDir, "embeddings.json"),
-      policyViolationsPath: path62.join(baseDir, "policy-violations.ndjson")
+      snapshotPath: path65.join(baseDir, "graph.json"),
+      errorsPath: path65.join(baseDir, "errors.ndjson"),
+      staleEventsPath: path65.join(baseDir, "stale-events.ndjson"),
+      embeddingsCachePath: path65.join(baseDir, "embeddings.json"),
+      policyViolationsPath: path65.join(baseDir, "policy-violations.ndjson")
     };
   }
   return {
-    snapshotPath: path62.join(baseDir, `${project}.json`),
-    errorsPath: path62.join(baseDir, `errors.${project}.ndjson`),
-    staleEventsPath: path62.join(baseDir, `stale-events.${project}.ndjson`),
-    embeddingsCachePath: path62.join(baseDir, `embeddings.${project}.json`),
-    policyViolationsPath: path62.join(baseDir, `policy-violations.${project}.ndjson`)
+    snapshotPath: path65.join(baseDir, `${project}.json`),
+    errorsPath: path65.join(baseDir, `errors.${project}.ndjson`),
+    staleEventsPath: path65.join(baseDir, `stale-events.${project}.ndjson`),
+    embeddingsCachePath: path65.join(baseDir, `embeddings.${project}.json`),
+    policyViolationsPath: path65.join(baseDir, `policy-violations.${project}.ndjson`)
   };
 }
 var Projects = class {
@@ -14326,9 +14790,9 @@ function parseExtraProjects(raw) {
 }
 
 // src/registry.ts
-import { promises as fs30 } from "fs";
+import { promises as fs33 } from "fs";
 import os2 from "os";
-import path63 from "path";
+import path66 from "path";
 import {
   RegistryFileSchema
 } from "@neat.is/types";
@@ -14336,20 +14800,20 @@ var LOCK_TIMEOUT_MS = 5e3;
 var LOCK_RETRY_MS = 50;
 function neatHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path63.resolve(override);
-  return path63.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path66.resolve(override);
+  return path66.join(os2.homedir(), ".neat");
 }
 function registryPath() {
-  return path63.join(neatHome(), "projects.json");
+  return path66.join(neatHome(), "projects.json");
 }
 function registryLockPath() {
-  return path63.join(neatHome(), "projects.json.lock");
+  return path66.join(neatHome(), "projects.json.lock");
 }
 function daemonPidPath() {
-  return path63.join(neatHome(), "neatd.pid");
+  return path66.join(neatHome(), "neatd.pid");
 }
 function daemonsDir() {
-  return path63.join(neatHome(), "daemons");
+  return path66.join(neatHome(), "daemons");
 }
 function isFiniteInt(v) {
   return typeof v === "number" && Number.isFinite(v);
@@ -14382,7 +14846,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const dir = daemonsDir();
   let names;
   try {
-    names = await fs30.readdir(dir);
+    names = await fs33.readdir(dir);
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -14390,10 +14854,10 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   const out = [];
   for (const name of names) {
     if (!name.endsWith(".json")) continue;
-    const file = path63.join(dir, name);
+    const file = path66.join(dir, name);
     let raw;
     try {
-      raw = await fs30.readFile(file, "utf8");
+      raw = await fs33.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -14406,7 +14870,7 @@ async function discoverDaemons(probe = defaultDiscoveryProbe) {
   return out;
 }
 async function removeDaemonRecord(source) {
-  await fs30.unlink(source).catch(() => {
+  await fs33.unlink(source).catch(() => {
   });
 }
 async function listMachineProjects(probe = defaultDiscoveryProbe) {
@@ -14463,7 +14927,7 @@ function isPidAliveDefault(pid) {
 }
 async function readPidFile(file) {
   try {
-    const raw = await fs30.readFile(file, "utf8");
+    const raw = await fs33.readFile(file, "utf8");
     const pid = Number.parseInt(raw.trim(), 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
   } catch {
@@ -14511,32 +14975,32 @@ function lockHolderMessage(holder, lockPath, timeoutMs) {
   }
 }
 async function normalizeProjectPath(input) {
-  const resolved = path63.resolve(input);
+  const resolved = path66.resolve(input);
   try {
-    return await fs30.realpath(resolved);
+    return await fs33.realpath(resolved);
   } catch {
     return resolved;
   }
 }
 async function writeAtomically(target, contents) {
-  await fs30.mkdir(path63.dirname(target), { recursive: true });
+  await fs33.mkdir(path66.dirname(target), { recursive: true });
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs30.open(tmp, "w");
+  const fd = await fs33.open(tmp, "w");
   try {
     await fd.writeFile(contents, "utf8");
     await fd.sync();
   } finally {
     await fd.close();
   }
-  await fs30.rename(tmp, target);
+  await fs33.rename(tmp, target);
 }
 async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaultLockHolderProbe) {
   const deadline = Date.now() + timeoutMs;
-  await fs30.mkdir(path63.dirname(lockPath), { recursive: true });
+  await fs33.mkdir(path66.dirname(lockPath), { recursive: true });
   let probedHolder = false;
   while (true) {
     try {
-      const fd = await fs30.open(lockPath, "wx");
+      const fd = await fs33.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -14561,7 +15025,7 @@ async function acquireLock(lockPath, timeoutMs = LOCK_TIMEOUT_MS, probe = defaul
   }
 }
 async function releaseLock(lockPath) {
-  await fs30.unlink(lockPath).catch(() => {
+  await fs33.unlink(lockPath).catch(() => {
   });
 }
 async function withLock(fn) {
@@ -14577,7 +15041,7 @@ async function readRegistry() {
   const file = registryPath();
   let raw;
   try {
-    raw = await fs30.readFile(file, "utf8");
+    raw = await fs33.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: 1, projects: [] };
@@ -14682,7 +15146,7 @@ function pruneTtlMs() {
 }
 async function statPathStatus(p) {
   try {
-    const stat = await fs30.stat(p);
+    const stat = await fs33.stat(p);
     return stat.isDirectory() ? "present" : "unknown";
   } catch (err) {
     return err.code === "ENOENT" ? "gone" : "unknown";
@@ -14727,14 +15191,14 @@ import cors from "@fastify/cors";
 import { DivergenceTypeSchema, PoliciesCheckBodySchema, PolicySeveritySchema } from "@neat.is/types";
 
 // src/extend/index.ts
-import { promises as fs32 } from "fs";
-import path65 from "path";
+import { promises as fs35 } from "fs";
+import path68 from "path";
 import os3 from "os";
 import { resolve as registryResolve, list as registryList } from "@neat.is/instrumentation-registry";
 
 // src/installers/package-manager.ts
-import { promises as fs31 } from "fs";
-import path64 from "path";
+import { promises as fs34 } from "fs";
+import path67 from "path";
 import { spawn } from "child_process";
 var LOCKFILE_PRIORITY = [
   { lockfile: "bun.lockb", pm: "bun", args: ["install", "--no-summary"] },
@@ -14749,29 +15213,29 @@ var LOCKFILE_PRIORITY = [
 var NPM_FALLBACK_ARGS = ["install", "--no-audit", "--no-fund", "--prefer-offline"];
 async function exists2(p) {
   try {
-    await fs31.access(p);
+    await fs34.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function detectPackageManager(serviceDir) {
-  let dir = path64.resolve(serviceDir);
+  let dir = path67.resolve(serviceDir);
   const stops = /* @__PURE__ */ new Set();
   for (let i = 0; i < 64; i++) {
     if (stops.has(dir)) break;
     stops.add(dir);
     for (const candidate of LOCKFILE_PRIORITY) {
-      const lockPath = path64.join(dir, candidate.lockfile);
+      const lockPath = path67.join(dir, candidate.lockfile);
       if (await exists2(lockPath)) {
         return { pm: candidate.pm, cwd: dir, args: [...candidate.args] };
       }
     }
-    const parent = path64.dirname(dir);
+    const parent = path67.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return { pm: "npm", cwd: path64.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
+  return { pm: "npm", cwd: path67.resolve(serviceDir), args: [...NPM_FALLBACK_ARGS] };
 }
 async function runPackageManagerInstall(cmd) {
   return new Promise((resolve) => {
@@ -14813,15 +15277,15 @@ ${err.message}`
 // src/extend/index.ts
 async function fileExists2(p) {
   try {
-    await fs32.access(p);
+    await fs35.access(p);
     return true;
   } catch {
     return false;
   }
 }
 async function readPackageJson(scanPath) {
-  const pkgPath = path65.join(scanPath, "package.json");
-  const raw = await fs32.readFile(pkgPath, "utf8");
+  const pkgPath = path68.join(scanPath, "package.json");
+  const raw = await fs35.readFile(pkgPath, "utf8");
   return JSON.parse(raw);
 }
 var HOOK_WALK_SKIP_DIRS = /* @__PURE__ */ new Set([
@@ -14835,15 +15299,15 @@ var HOOK_WALK_SKIP_DIRS = /* @__PURE__ */ new Set([
 async function findHookFiles(scanPath) {
   const found = [];
   const walk9 = async (dir) => {
-    const entries = await fs32.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await fs35.readdir(dir, { withFileTypes: true }).catch(() => []);
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (entry.name.startsWith(".") || HOOK_WALK_SKIP_DIRS.has(entry.name)) continue;
-        await walk9(path65.join(dir, entry.name));
+        await walk9(path68.join(dir, entry.name));
       } else if (entry.isFile()) {
         if ((entry.name.startsWith("instrumentation") || entry.name.startsWith("otel-init")) && /\.(ts|js|cjs|mjs)$/.test(entry.name)) {
-          const rel = path65.relative(scanPath, path65.join(dir, entry.name));
-          found.push(rel.split(path65.sep).join("/"));
+          const rel = path68.relative(scanPath, path68.join(dir, entry.name));
+          found.push(rel.split(path68.sep).join("/"));
         }
       }
     }
@@ -14854,7 +15318,7 @@ async function findHookFiles(scanPath) {
 async function pickPrimaryHookFile(scanPath, hookFiles, snippet2) {
   let fallback = null;
   for (const file of hookFiles) {
-    const content = await fs32.readFile(path65.join(scanPath, file), "utf8");
+    const content = await fs35.readFile(path68.join(scanPath, file), "utf8");
     const patched = splicedContent(content, snippet2);
     if (patched !== null) return { file, content, patched };
     if (fallback === null) fallback = { file, content };
@@ -14862,12 +15326,12 @@ async function pickPrimaryHookFile(scanPath, hookFiles, snippet2) {
   return { file: fallback.file, content: fallback.content, patched: null };
 }
 function extendLogPath() {
-  return process.env.NEAT_EXTEND_LOG ?? path65.join(os3.homedir(), ".neat", "extend-log.ndjson");
+  return process.env.NEAT_EXTEND_LOG ?? path68.join(os3.homedir(), ".neat", "extend-log.ndjson");
 }
 async function appendExtendLog(entry) {
   const logPath = extendLogPath();
-  await fs32.mkdir(path65.dirname(logPath), { recursive: true });
-  await fs32.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
+  await fs35.mkdir(path68.dirname(logPath), { recursive: true });
+  await fs35.appendFile(logPath, JSON.stringify(entry) + "\n", "utf8");
 }
 function splicedContent(fileContent, snippet2) {
   if (fileContent.includes("__INSTRUMENTATION_BLOCK__")) {
@@ -14925,7 +15389,7 @@ function lookupInstrumentation(library, installedVersion) {
 }
 async function describeProjectInstrumentation(ctx) {
   const hookFiles = await findHookFiles(ctx.scanPath);
-  const envNeat = await fileExists2(path65.join(ctx.scanPath, ".env.neat"));
+  const envNeat = await fileExists2(path68.join(ctx.scanPath, ".env.neat"));
   const registryInstrPackages = new Set(
     registryList().map((e) => e.instrumentation_package).filter((p) => !!p)
   );
@@ -14947,7 +15411,7 @@ async function applyExtension(ctx, args, options) {
     );
   }
   for (const file of hookFiles) {
-    const content = await fs32.readFile(path65.join(ctx.scanPath, file), "utf8");
+    const content = await fs35.readFile(path68.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return { library: args.library, filesTouched: [], depsAdded: [], installOutput: "", alreadyApplied: true };
     }
@@ -14959,18 +15423,18 @@ async function applyExtension(ctx, args, options) {
     );
   }
   const primaryFile = primary.file;
-  const primaryPath = path65.join(ctx.scanPath, primaryFile);
+  const primaryPath = path68.join(ctx.scanPath, primaryFile);
   const filesTouched = [];
   const depsAdded = [];
-  const pkgPath = path65.join(ctx.scanPath, "package.json");
+  const pkgPath = path68.join(ctx.scanPath, "package.json");
   const pkg = await readPackageJson(ctx.scanPath);
   if (!(pkg.dependencies ?? {})[args.instrumentation_package]) {
     pkg.dependencies = { ...pkg.dependencies ?? {}, [args.instrumentation_package]: args.version };
-    await fs32.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+    await fs35.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     filesTouched.push("package.json");
     depsAdded.push(`${args.instrumentation_package}@${args.version}`);
   }
-  await fs32.writeFile(primaryPath, primary.patched, "utf8");
+  await fs35.writeFile(primaryPath, primary.patched, "utf8");
   filesTouched.push(primaryFile);
   const cmd = await detectPackageManager(ctx.scanPath);
   const installer = options?.runInstall ?? runPackageManagerInstall;
@@ -15001,7 +15465,7 @@ async function dryRunExtension(ctx, args) {
     };
   }
   for (const file of hookFiles) {
-    const content = await fs32.readFile(path65.join(ctx.scanPath, file), "utf8");
+    const content = await fs35.readFile(path68.join(ctx.scanPath, file), "utf8");
     if (content.includes(args.registration_snippet)) {
       return {
         library: args.library,
@@ -15036,28 +15500,28 @@ async function rollbackExtension(ctx, args) {
   if (!await fileExists2(logPath)) {
     return { undone: false, message: "no apply found for library" };
   }
-  const raw = await fs32.readFile(logPath, "utf8");
+  const raw = await fs35.readFile(logPath, "utf8");
   const entries = raw.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line));
   const match = [...entries].reverse().find((e) => e.project === ctx.project && e.library === args.library);
   if (!match) {
     return { undone: false, message: "no apply found for library" };
   }
-  const pkgPath = path65.join(ctx.scanPath, "package.json");
+  const pkgPath = path68.join(ctx.scanPath, "package.json");
   if (await fileExists2(pkgPath)) {
     const pkg = await readPackageJson(ctx.scanPath);
     if (pkg.dependencies?.[match.instrumentation_package]) {
       const { [match.instrumentation_package]: _removed, ...rest } = pkg.dependencies;
       pkg.dependencies = rest;
-      await fs32.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+      await fs35.writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
     }
   }
   const hookFiles = await findHookFiles(ctx.scanPath);
   for (const file of hookFiles) {
-    const filePath = path65.join(ctx.scanPath, file);
-    const content = await fs32.readFile(filePath, "utf8");
+    const filePath = path68.join(ctx.scanPath, file);
+    const content = await fs35.readFile(filePath, "utf8");
     if (content.includes(match.registration_snippet)) {
       const filtered = content.split("\n").filter((line) => !line.includes(match.registration_snippet)).join("\n");
-      await fs32.writeFile(filePath, filtered, "utf8");
+      await fs35.writeFile(filePath, filtered, "utf8");
       break;
     }
   }
@@ -15168,8 +15632,8 @@ data: ${JSON.stringify(envelope.payload)}
 
 // src/connectors-config.ts
 import os4 from "os";
-import path66 from "path";
-import { promises as fs33 } from "fs";
+import path69 from "path";
+import { promises as fs36 } from "fs";
 var CONNECTORS_CONFIG_VERSION = 1;
 var EnvRefUnsetError = class extends Error {
   ref;
@@ -15183,17 +15647,17 @@ var EnvRefUnsetError = class extends Error {
 };
 function neatHome2() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path66.resolve(override);
-  return path66.join(os4.homedir(), ".neat");
+  if (override && override.length > 0) return path69.resolve(override);
+  return path69.join(os4.homedir(), ".neat");
 }
 function connectorsConfigPath(home = neatHome2()) {
-  return path66.join(home, "connectors.json");
+  return path69.join(home, "connectors.json");
 }
 var MODE_MASK_LOOSER_THAN_0600 = 63;
 async function warnIfModeLooserThan0600(file) {
   if (process.platform === "win32") return;
   try {
-    const stat = await fs33.stat(file);
+    const stat = await fs36.stat(file);
     if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
       const mode = (stat.mode & 511).toString(8).padStart(3, "0");
       console.warn(
@@ -15207,7 +15671,7 @@ async function readConnectorsConfig(home = neatHome2()) {
   const file = connectorsConfigPath(home);
   let raw;
   try {
-    raw = await fs33.readFile(file, "utf8");
+    raw = await fs36.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { version: CONNECTORS_CONFIG_VERSION, connectors: [] };
@@ -15318,7 +15782,7 @@ function connectorMatchesProject(entry, project) {
 var CONNECTORS_LOCK_TIMEOUT_MS = 5e3;
 var CONNECTORS_LOCK_RETRY_MS = 50;
 function connectorsConfigLockPath(home = neatHome2()) {
-  return path66.join(home, "connectors.json.lock");
+  return path69.join(home, "connectors.json.lock");
 }
 function isEnvRef(value) {
   return value.length > 1 && value.startsWith("$");
@@ -15331,9 +15795,9 @@ function redactCredentialRef(ref) {
   return out;
 }
 async function writeConfigAtomically0600(file, contents) {
-  await fs33.mkdir(path66.dirname(file), { recursive: true });
+  await fs36.mkdir(path69.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs33.open(tmp, "w", 384);
+  const fd = await fs36.open(tmp, "w", 384);
   try {
     await fd.writeFile(contents, "utf8");
     await fd.chmod(384);
@@ -15341,14 +15805,14 @@ async function writeConfigAtomically0600(file, contents) {
   } finally {
     await fd.close();
   }
-  await fs33.rename(tmp, file);
+  await fs36.rename(tmp, file);
 }
 async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEOUT_MS) {
   const deadline = Date.now() + timeoutMs;
-  await fs33.mkdir(path66.dirname(lockPath), { recursive: true });
+  await fs36.mkdir(path69.dirname(lockPath), { recursive: true });
   for (; ; ) {
     try {
-      const fd = await fs33.open(lockPath, "wx");
+      const fd = await fs36.open(lockPath, "wx");
       try {
         await fd.writeFile(`${process.pid}
 `, "utf8");
@@ -15368,7 +15832,7 @@ async function acquireConnectorsLock(lockPath, timeoutMs = CONNECTORS_LOCK_TIMEO
   }
 }
 async function releaseConnectorsLock(lockPath) {
-  await fs33.unlink(lockPath).catch(() => {
+  await fs36.unlink(lockPath).catch(() => {
   });
 }
 async function withConnectorsLock(home, fn) {
@@ -15493,7 +15957,7 @@ function getConnectorStatus(id, now = Date.now(), thresholdMs = CONNECTOR_STALE_
 }
 
 // src/connectors/index.ts
-import { NodeType as NodeType29, parseFileId as parseFileId2, Provenance as Provenance26 } from "@neat.is/types";
+import { NodeType as NodeType32, parseFileId as parseFileId2, Provenance as Provenance26 } from "@neat.is/types";
 var NO_ENV = "unknown";
 function staticCallSiteFor(graph, serviceName, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
@@ -15512,7 +15976,7 @@ function staticCallSiteFor(graph, serviceName, targetNodeId) {
 function routeCallSiteFor(graph, targetNodeId) {
   if (!graph.hasNode(targetNodeId)) return void 0;
   const attrs = graph.getNodeAttributes(targetNodeId);
-  if (attrs.type !== NodeType29.RouteNode || !attrs.path) return void 0;
+  if (attrs.type !== NodeType32.RouteNode || !attrs.path) return void 0;
   const site = { relPath: attrs.path };
   if (attrs.line !== void 0) site.line = attrs.line;
   return site;
@@ -15997,10 +16461,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path67) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path67);
+function targetFromRestPath(path70) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path70);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path67);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path70);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -16217,7 +16681,7 @@ function createSupabaseConnector(graph, config, deps = {}) {
 }
 
 // src/connectors/railway/index.ts
-import { EdgeType as EdgeType27, NodeType as NodeType30, serviceId as serviceId11 } from "@neat.is/types";
+import { EdgeType as EdgeType27, NodeType as NodeType33, serviceId as serviceId14 } from "@neat.is/types";
 
 // src/connectors/railway/client.ts
 var DEFAULT_RAILWAY_API_URL = "https://backboard.railway.com/graphql/v2";
@@ -16367,7 +16831,7 @@ function buildRailwayRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType30.RouteNode) return;
+    if (node.type !== NodeType33.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -16476,7 +16940,7 @@ function createRailwayResolveTarget(config) {
     if (signal.targetKind === PEER_SERVICE_TARGET_KIND) {
       const peerName = config.serviceNameById[signal.targetName];
       if (!peerName) return null;
-      return { targetNodeId: serviceId11(peerName), serviceName, edgeType: EdgeType27.CONNECTS_TO };
+      return { targetNodeId: serviceId14(peerName), serviceName, edgeType: EdgeType27.CONNECTS_TO };
     }
     return null;
   };
@@ -16595,9 +17059,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path67 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path67) return null;
-  return { resourceName, method, path: path67 };
+  const path70 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path70) return null;
+  return { resourceName, method, path: path70 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -16635,14 +17099,14 @@ function mapLogEntryToSignal(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path67 = pathFromRequestUrl(req.requestUrl);
-  if (path67 === null) return null;
+  const path70 = pathFromRequestUrl(req.requestUrl);
+  if (path70 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path67 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path70 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -16658,7 +17122,7 @@ function mapLogEntriesToSignals(entries) {
 }
 
 // src/connectors/firebase/resolve.ts
-import { NodeType as NodeType31, EdgeType as EdgeType28 } from "@neat.is/types";
+import { NodeType as NodeType34, EdgeType as EdgeType28 } from "@neat.is/types";
 function neatServiceNameFor(resourceType, resourceName, serviceMap) {
   switch (resourceType) {
     case "cloud_function":
@@ -16673,7 +17137,7 @@ function routeEntriesFor(graph, serviceName) {
   const entries = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType31.RouteNode) return;
+    if (node.type !== NodeType34.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     entries.push({
@@ -16728,7 +17192,7 @@ function createFirebaseConnector(graph, serviceMap) {
 }
 
 // src/connectors/cloudflare/connector.ts
-import { EdgeType as EdgeType29, NodeType as NodeType32, fileId as fileId5, infraId as infraId21 } from "@neat.is/types";
+import { EdgeType as EdgeType29, NodeType as NodeType35, fileId as fileId5, infraId as infraId21 } from "@neat.is/types";
 
 // src/connectors/cloudflare/client.ts
 import { randomUUID } from "crypto";
@@ -16839,7 +17303,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path67 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path70 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -16847,7 +17311,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path67 ? { path: path67 } : {},
+    ...path70 ? { path: path70 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -16887,19 +17351,19 @@ function findTaggedWorkerFileNode(graph, workerName) {
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type === NodeType32.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
+    if (a.type === NodeType35.FileNode && a.platform === "cloudflare" && a.platformName === workerName) {
       found = id;
     }
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path67) {
-  const normalizedPath = normalizePathTemplate(path67);
+function findMatchingRouteNode(graph, serviceName, method, path70) {
+  const normalizedPath = normalizePathTemplate(path70);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
     const a = attrs;
-    if (a.type !== NodeType32.RouteNode || a.service !== serviceName) return;
+    if (a.type !== NodeType35.RouteNode || a.service !== serviceName) return;
     if (!a.pathTemplate || normalizePathTemplate(a.pathTemplate) !== normalizedPath) return;
     const routeMethod = (a.method ?? "").toUpperCase();
     if (routeMethod !== "ALL" && routeMethod !== method) return;
@@ -16911,10 +17375,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path67 } = signal;
+    const { method, path: path70 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path67) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path67) ?? wholeFileId;
+      if (!method || !path70) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path70) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -17244,9 +17708,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path67 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path67) return null;
-  return { serviceName, method, path: path67 };
+  const path70 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path70) return null;
+  return { serviceName, method, path: path70 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -17275,14 +17739,14 @@ function mapLogEntryToSignal2(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path67 = pathFromRequestUrl2(req.requestUrl);
-  if (path67 === null) return null;
+  const path70 = pathFromRequestUrl2(req.requestUrl);
+  if (path70 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path67 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path70 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -17298,14 +17762,14 @@ function mapLogEntriesToSignals2(entries) {
 }
 
 // src/connectors/cloud-run/resolve.ts
-import { EdgeType as EdgeType31, NodeType as NodeType33, infraId as infraId23 } from "@neat.is/types";
+import { EdgeType as EdgeType31, NodeType as NodeType36, infraId as infraId23 } from "@neat.is/types";
 var CLOUD_RUN_SERVICE_INFRA_KIND = "cloud-run-service";
 function findMatchingRouteNode2(graph, serviceName, method, normalizedPath) {
   let found = null;
   graph.forEachNode((_id, attrs) => {
     if (found) return;
     const node = attrs;
-    if (node.type !== NodeType33.RouteNode) return;
+    if (node.type !== NodeType36.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName || !route.pathTemplate) return;
     if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
@@ -17320,14 +17784,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path67 } = identity;
+    const { serviceName: gcpServiceName, method, path: path70 } = identity;
     const mappedService = config.serviceMap?.[gcpServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path67)
+        normalizePathTemplate(path70)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: EdgeType31.CALLS };
@@ -17376,7 +17840,7 @@ function createCloudRunConnector(graph, config = {}) {
 }
 
 // src/connectors/render/index.ts
-import { EdgeType as EdgeType32, NodeType as NodeType34 } from "@neat.is/types";
+import { EdgeType as EdgeType32, NodeType as NodeType37 } from "@neat.is/types";
 
 // src/connectors/render/types.ts
 function readRenderToken(credentials) {
@@ -17452,7 +17916,7 @@ function buildRenderRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== NodeType34.RouteNode) return;
+    if (node.type !== NodeType37.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -17936,7 +18400,7 @@ function mapBuildsToSignals(builds, serviceName) {
 }
 
 // src/connectors/eas/resolve.ts
-import { EdgeType as EdgeType34, NodeType as NodeType35, parseFileId as parseFileId3 } from "@neat.is/types";
+import { EdgeType as EdgeType34, NodeType as NodeType38, parseFileId as parseFileId3 } from "@neat.is/types";
 var NO_ENV2 = "unknown";
 var EAS_JSON_PHASES = /* @__PURE__ */ new Set(["READ_EAS_JSON"]);
 var APP_CONFIG_PHASES = /* @__PURE__ */ new Set([
@@ -17964,7 +18428,7 @@ function findConfigNode(graph, basenames, serviceName) {
   graph.forEachNode((id, attrs) => {
     if (scoped) return;
     const node = attrs;
-    if (node.type !== NodeType35.ConfigNode) return;
+    if (node.type !== NodeType38.ConfigNode) return;
     if (typeof node.name !== "string" || !basenames.includes(node.name)) return;
     if (anyMatch === null) anyMatch = id;
     if (configNodeService(graph, id) === serviceName) scoped = id;
@@ -19576,4 +20040,4 @@ export {
   deprovisionConnector,
   buildApi
 };
-//# sourceMappingURL=chunk-T4UGEMWN.js.map
+//# sourceMappingURL=chunk-RDLDSIEY.js.map