@neat.is/core 0.9.15-dev.20260906 → 0.9.15-dev.20260908

package/dist/cli.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path96 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path96) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path96)) {
+    const path97 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path97) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path97)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path96 = q === -1 ? v : v.slice(0, q);
-      if (path96.length > 0) return path96;
+      const path97 = q === -1 ? v : v.slice(0, q);
+      if (path97.length > 0) return path97;
     }
   }
   return void 0;
@@ -787,12 +787,14 @@ __export(cli_exports, {
   CLAUDE_SKILL_CONFIG: () => CLAUDE_SKILL_CONFIG,
   ProjectResolutionError: () => ProjectResolutionError,
   QUERY_VERBS: () => QUERY_VERBS,
+  UnknownProfileError: () => UnknownProfileError,
   commandPrefix: () => commandPrefix,
   isNpxInvocation: () => isNpxInvocation,
   main: () => main,
   parseArgs: () => parseArgs,
   printBanner: () => printBanner,
   readPackageVersion: () => readPackageVersion,
+  resolveClientTarget: () => resolveClientTarget,
   resolveDaemonUrl: () => resolveDaemonUrl,
   resolveProjectForVerb: () => resolveProjectForVerb,
   runInit: () => runInit,
@@ -803,9 +805,9 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path95 = __toESM(require("path"), 1);
-var import_node_os9 = __toESM(require("os"), 1);
-var import_node_fs58 = require("fs");
+var import_node_path96 = __toESM(require("path"), 1);
+var import_node_os10 = __toESM(require("os"), 1);
+var import_node_fs59 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1382,19 +1384,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path96, edges) {
-    if (path96.length > best.path.length) {
-      best = { path: [...path96], edges: [...edges] };
+  function step(node, path97, edges) {
+    if (path97.length > best.path.length) {
+      best = { path: [...path97], edges: [...edges] };
     }
-    if (path96.length - 1 >= maxDepth) return;
+    if (path97.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path96.push(srcId);
+      path97.push(srcId);
       edges.push(edge);
-      step(srcId, path96, edges);
-      path96.pop();
+      step(srcId, path97, edges);
+      path97.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1609,20 +1611,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path96 = [originServiceId];
+  const path97 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path96.push(hop.nextService);
+    path97.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path96, edges, culprit: current };
+  return { path: path97, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && e.provenance === import_types.Provenance.STALE;
@@ -1658,26 +1660,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path96 = [originServiceId];
+  const path97 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path96.push(hop.nextService);
+    path97.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path96, edges, culprit: current };
+  return { path: path97, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path96 = [...chain.path];
+  const path97 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1685,14 +1687,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path96.push(loc.fileNode);
+      path97.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path96,
+      traversalPath: path97,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1704,7 +1706,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path96,
+    traversalPath: path97,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2357,10 +2359,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path96 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path96) {
-      traversalPath = path96.nodes;
-      edgeProvenances = path96.edges.map((e) => e.provenance);
+    const path97 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path97) {
+      traversalPath = path97.nodes;
+      edgeProvenances = path97.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types.Provenance.OBSERVED];
@@ -3811,8 +3813,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path96) {
-  return path96.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path97) {
+  return path97.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4484,9 +4486,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path96 = rubyLiteral(k);
-    if (path96 === null) continue;
-    return { path: path96, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path97 = rubyLiteral(k);
+    if (path97 === null) continue;
+    return { path: path97, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -19899,10 +19901,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path96) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path96);
+function targetFromRestPath(path97) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path97);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path96);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path97);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -20506,9 +20508,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path96 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path96) return null;
-  return { resourceName, method, path: path96 };
+  const path97 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path97) return null;
+  return { resourceName, method, path: path97 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -20546,14 +20548,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path96 = pathFromRequestUrl(req.requestUrl);
-  if (path96 === null) return null;
+  const path97 = pathFromRequestUrl(req.requestUrl);
+  if (path97 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path96 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path97 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20760,7 +20762,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path96 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path97 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -20768,7 +20770,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path96 ? { path: path96 } : {},
+    ...path97 ? { path: path97 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -20814,8 +20816,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path96) {
-  const normalizedPath = normalizePathTemplate(path96);
+function findMatchingRouteNode(graph, serviceName, method, path97) {
+  const normalizedPath = normalizePathTemplate(path97);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -20832,10 +20834,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path96 } = signal;
+    const { method, path: path97 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path96) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path96) ?? wholeFileId;
+      if (!method || !path97) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path97) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -21187,9 +21189,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path96 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path96) return null;
-  return { serviceName, method, path: path96 };
+  const path97 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path97) return null;
+  return { serviceName, method, path: path97 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -21218,14 +21220,14 @@ function mapLogEntryToSignal2(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path96 = pathFromRequestUrl2(req.requestUrl);
-  if (path96 === null) return null;
+  const path97 = pathFromRequestUrl2(req.requestUrl);
+  if (path97 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path96 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path97 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21264,14 +21266,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path96 } = identity;
+    const { serviceName: gcpServiceName, method, path: path97 } = identity;
     const mappedService = config.serviceMap?.[gcpServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path96)
+        normalizePathTemplate(path97)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types82.EdgeType.CALLS };
@@ -21407,9 +21409,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path96 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path96) return null;
-  return { backendServiceName, method, path: path96 };
+  const path97 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path97) return null;
+  return { backendServiceName, method, path: path97 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -21438,14 +21440,14 @@ function mapLogEntryToSignal3(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path96 = pathFromRequestUrl3(req.requestUrl);
-  if (path96 === null) return null;
+  const path97 = pathFromRequestUrl3(req.requestUrl);
+  if (path97 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path96 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path97 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21484,14 +21486,14 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path96 } = identity;
+    const { backendServiceName, method, path: path97 } = identity;
     const mappedService = config.backendServiceMap?.[backendServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path96)
+        normalizePathTemplate(path97)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types86.EdgeType.CALLS };
@@ -23856,9 +23858,9 @@ function makeK8sFetchImpl(transport) {
     req.end();
   }));
 }
-async function listResource(transport, namespace, path96, opts = {}) {
+async function listResource(transport, namespace, path97, opts = {}) {
   const base = opts.apiUrl ?? transport.server;
-  const url = `${base.replace(/\/$/, "")}${path96}`;
+  const url = `${base.replace(/\/$/, "")}${path97}`;
   const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
   const res = await junctionFetch(
     url,
@@ -23868,7 +23870,7 @@ async function listResource(transport, namespace, path96, opts = {}) {
     { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`kubernetes ${path96} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`kubernetes ${path97} failed: ${res.status} ${res.statusText}`);
   }
   const json = await res.json();
   return Array.isArray(json.items) ? json.items : [];
@@ -29341,10 +29343,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path96) {
+    async get(path97) {
       let res;
       try {
-        res = await fetch(`${root}${path96}`, {
+        res = await fetch(`${root}${path97}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -29356,16 +29358,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path96}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path97}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path96, body) {
+    async post(path97, body) {
       let res;
       try {
-        res = await fetch(`${root}${path96}`, {
+        res = await fetch(`${root}${path97}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -29379,7 +29381,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path96}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path97}: ${text}`,
           text
         );
       }
@@ -29393,12 +29395,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path96 = projectPath(
+  const path97 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path96);
+    const result = await client.get(path97);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -29424,12 +29426,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path96 = projectPath(
+  const path97 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path96);
+    const result = await client.get(path97);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -29463,12 +29465,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path96 = projectPath(
+  const path97 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path96);
+    const result = await client.get(path97);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -29560,9 +29562,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path96 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path97 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path96);
+    const body = await client.get(path97);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -30033,29 +30035,465 @@ async function runDoctorCommand(argv, deps = {}) {
   return checks.every((c) => c.ok) ? 0 : 1;
 }
 
-// src/hooks-cli.ts
+// src/login-cli.ts
+init_cjs_shims();
+var import_promises2 = __toESM(require("readline/promises"), 1);
+
+// src/profiles.ts
 init_cjs_shims();
-var import_node_path90 = __toESM(require("path"), 1);
-var import_node_os6 = __toESM(require("os"), 1);
 var import_node_fs54 = require("fs");
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_path90 = __toESM(require("path"), 1);
+var PROFILES_CONFIG_VERSION = 1;
+function neatHome3() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path90.default.resolve(override);
+  return import_node_path90.default.join(import_node_os6.default.homedir(), ".neat");
+}
+function profilesConfigPath(home = neatHome3()) {
+  return import_node_path90.default.join(home, "profiles.json");
+}
+function profilesConfigLockPath(home = neatHome3()) {
+  return import_node_path90.default.join(home, "profiles.json.lock");
+}
+var MODE_MASK_LOOSER_THAN_06002 = 63;
+async function warnIfModeLooserThan06002(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await import_node_fs54.promises.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_06002) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's token calls for \u2014 run \`chmod 600 ${file}\``
+      );
+    }
+  } catch {
+  }
+}
+async function readProfilesConfig(home = neatHome3()) {
+  const file = profilesConfigPath(home);
+  let raw;
+  try {
+    raw = await import_node_fs54.promises.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: PROFILES_CONFIG_VERSION, profiles: [] };
+    }
+    throw err;
+  }
+  await warnIfModeLooserThan06002(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig2(parsed, file);
+}
+function validateConfig2(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "profiles" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? PROFILES_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawProfiles = obj.profiles;
+  if (!Array.isArray(rawProfiles)) {
+    throw new Error(`${file}: "profiles" must be an array`);
+  }
+  const profiles = rawProfiles.map((entry2, i) => validateEntry2(entry2, i, file));
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of profiles) {
+    if (seen.has(p.name)) throw new Error(`${file}: duplicate profile name "${p.name}"`);
+    seen.add(p.name);
+  }
+  let active;
+  if (obj.active !== void 0) {
+    if (typeof obj.active !== "string" || obj.active.length === 0) {
+      throw new Error(`${file}: "active" must be a non-empty string when present`);
+    }
+    active = seen.has(obj.active) ? obj.active : void 0;
+  }
+  return { version, ...active ? { active } : {}, profiles };
+}
+function validateEntry2(entry2, index, file) {
+  const where = `${file}: profiles[${index}]`;
+  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry2;
+  const name = e.name;
+  if (typeof name !== "string" || name.length === 0) {
+    throw new Error(`${where}.name must be a non-empty string`);
+  }
+  const endpoint2 = e.endpoint;
+  if (typeof endpoint2 !== "string" || endpoint2.length === 0) {
+    throw new Error(`${where}.endpoint must be a non-empty string`);
+  }
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(endpoint2);
+  } catch {
+    throw new Error(`${where}.endpoint must be an absolute URL (got "${endpoint2}")`);
+  }
+  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    throw new Error(`${where}.endpoint must be an http(s) URL (got "${parsedUrl.protocol}")`);
+  }
+  if (e.authToken !== void 0 && (typeof e.authToken !== "string" || e.authToken.length === 0)) {
+    throw new Error(`${where}.authToken must be a non-empty string when present`);
+  }
+  return {
+    name,
+    endpoint: endpoint2,
+    ...typeof e.authToken === "string" ? { authToken: e.authToken } : {}
+  };
+}
+async function resolveProfile(name, home = neatHome3()) {
+  const { profiles } = await readProfilesConfig(home);
+  return profiles.find((p) => p.name === name);
+}
+async function getActiveProfile(home = neatHome3()) {
+  const { active, profiles } = await readProfilesConfig(home);
+  if (!active) return void 0;
+  return profiles.find((p) => p.name === active);
+}
+function serialize(config) {
+  const names = new Set(config.profiles.map((p) => p.name));
+  const active = config.active && names.has(config.active) ? config.active : void 0;
+  const out = {
+    version: config.version ?? PROFILES_CONFIG_VERSION,
+    ...active ? { active } : {},
+    profiles: config.profiles
+  };
+  return `${JSON.stringify(out, null, 2)}
+`;
+}
+async function writeConfigAtomic(config, home) {
+  const file = profilesConfigPath(home);
+  await import_node_fs54.promises.mkdir(import_node_path90.default.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await import_node_fs54.promises.open(tmp, "w", 384);
+  try {
+    await fd.writeFile(serialize(config), "utf8");
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await import_node_fs54.promises.rename(tmp, file);
+}
+var LOCK_RETRY_MS2 = 50;
+var LOCK_TIMEOUT_MS2 = 5e3;
+async function acquireLock2(lockPath) {
+  await import_node_fs54.promises.mkdir(import_node_path90.default.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + LOCK_TIMEOUT_MS2;
+  for (; ; ) {
+    try {
+      const fd = await import_node_fs54.promises.open(lockPath, "wx");
+      await fd.writeFile(`${process.pid}
+`, "utf8");
+      await fd.close();
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `timed out acquiring ${lockPath} after ${LOCK_TIMEOUT_MS2}ms \u2014 if no other neat process is running, remove the stale lock file`
+        );
+      }
+      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS2));
+    }
+  }
+}
+async function releaseLock2(lockPath) {
+  await import_node_fs54.promises.rm(lockPath, { force: true });
+}
+async function withProfilesLock(home, fn) {
+  const lockPath = profilesConfigLockPath(home);
+  await acquireLock2(lockPath);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock2(lockPath);
+  }
+}
+async function upsertProfile(profile, opts = {}) {
+  const home = opts.home ?? neatHome3();
+  const validated = validateEntry2(profile, 0, profilesConfigPath(home));
+  await withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    const others = config.profiles.filter((p) => p.name !== validated.name);
+    const profiles = [...others, validated];
+    const makeActive = opts.makeActive ?? config.profiles.length === 0;
+    const active = makeActive ? validated.name : config.active;
+    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
+  });
+}
+async function removeProfile(name, home = neatHome3()) {
+  return withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    const profiles = config.profiles.filter((p) => p.name !== name);
+    if (profiles.length === config.profiles.length) return false;
+    const active = config.active === name ? void 0 : config.active;
+    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
+    return true;
+  });
+}
+async function clearActiveProfile(home = neatHome3()) {
+  return withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    if (!config.active) return false;
+    await writeConfigAtomic({ version: config.version, profiles: config.profiles }, home);
+    return true;
+  });
+}
+
+// src/login-cli.ts
+var HEALTH_TIMEOUT_MS2 = 5e3;
+var DEFAULT_PROFILE_NAME = "hosted";
+function readFlagValue(argv, i) {
+  const arg = argv[i];
+  const eq = arg.indexOf("=");
+  if (eq !== -1) return { value: arg.slice(eq + 1), next: i };
+  return { value: argv[i + 1], next: i + 1 };
+}
+function parseLoginArgs(argv) {
+  const parsed = { name: DEFAULT_PROFILE_NAME, json: false, help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") parsed.help = true;
+    else if (arg === "--json") parsed.json = true;
+    else if (arg === "--endpoint" || arg.startsWith("--endpoint=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.endpoint = value;
+      i = next;
+    } else if (arg === "--token" || arg.startsWith("--token=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.token = value;
+      i = next;
+    } else if (arg === "--name" || arg.startsWith("--name=")) {
+      const { value, next } = readFlagValue(argv, i);
+      if (value && value.length > 0) parsed.name = value;
+      i = next;
+    } else {
+      parsed.error = `unknown argument "${arg}"`;
+      break;
+    }
+  }
+  return parsed;
+}
+function printLoginHelp(out) {
+  out("usage: neat login [--endpoint <url>] [--token <token>] [--name <name>] [--json]");
+  out("  Connect this machine to a hosted NEAT and make it the default for the");
+  out("  neat CLI and the MCP server. Omit --endpoint / --token to be prompted");
+  out("  (the token is read without echo). --name labels the profile (default");
+  out('  "hosted"). The token can also come from NEAT_LOGIN_TOKEN.');
+  out("  Exit 0 on success, 1 rejected token/endpoint, 2 misuse, 3 unreachable.");
+}
+async function probeDaemon(fetchImpl, endpoint2, token) {
+  const root = endpoint2.replace(/\/$/, "");
+  let res;
+  try {
+    res = await fetchImpl(`${root}/health`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS2)
+    });
+  } catch (err) {
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (!res.ok) return { kind: "not-neat", status: res.status };
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
+  return { kind: "ok" };
+}
+async function runLoginCommand(argv, deps = {}) {
+  const out = deps.out ?? ((line) => console.log(line));
+  const err = deps.err ?? ((line) => console.error(line));
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const readLine = deps.readLine ?? defaultReadLine;
+  const readSecret = deps.readSecret ?? defaultReadSecret;
+  const args = parseLoginArgs(argv);
+  if (args.help) {
+    printLoginHelp(out);
+    return 0;
+  }
+  if (args.error) {
+    err(`neat login: ${args.error}`);
+    return 2;
+  }
+  let endpoint2 = args.endpoint;
+  if (!endpoint2) endpoint2 = (await readLine("Hosted NEAT endpoint (https://\u2026): "))?.trim();
+  if (!endpoint2) {
+    err("neat login: an endpoint is required \u2014 pass --endpoint <url> or run interactively");
+    return 2;
+  }
+  let url;
+  try {
+    url = new URL(endpoint2);
+  } catch {
+    err(`neat login: --endpoint must be an absolute URL (got "${endpoint2}")`);
+    return 2;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    err(`neat login: --endpoint must be an http(s) URL (got "${url.protocol}")`);
+    return 2;
+  }
+  const envToken = env.NEAT_LOGIN_TOKEN;
+  let token = args.token ?? (envToken && envToken.length > 0 ? envToken : void 0);
+  if (!token) token = (await readSecret("Daemon token: "))?.trim();
+  if (!token) {
+    err("neat login: a token is required \u2014 pass --token, set NEAT_LOGIN_TOKEN, or run interactively");
+    return 2;
+  }
+  const probe = await probeDaemon(fetchImpl, endpoint2, token);
+  if (probe.kind === "unreachable") {
+    err(`neat login: can't reach ${endpoint2} \u2014 ${probe.detail}`);
+    return 3;
+  }
+  if (probe.kind === "unauthorized") {
+    err(`neat login: ${endpoint2} rejected the token (HTTP ${probe.status}). Check the token and try again.`);
+    return 1;
+  }
+  if (probe.kind === "not-neat") {
+    err(`neat login: ${endpoint2} answered but does not look like a NEAT daemon (HTTP ${probe.status}).`);
+    return 1;
+  }
+  await upsertProfile(
+    { name: args.name, endpoint: endpoint2, authToken: token },
+    { makeActive: true, ...deps.home ? { home: deps.home } : {} }
+  );
+  if (args.json) {
+    out(JSON.stringify({ status: "logged-in", profile: args.name, endpoint: endpoint2 }, null, 2));
+  } else {
+    out(`Logged in \u2014 profile "${args.name}" \u2192 ${endpoint2}`);
+    out("The neat CLI and the MCP server now read this hosted graph by default.");
+    out("Run `neat logout` to switch back to your local daemon.");
+  }
+  return 0;
+}
+function parseLogoutArgs(argv) {
+  const parsed = { help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") parsed.help = true;
+    else if (arg === "--name" || arg.startsWith("--name=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.name = value;
+      i = next;
+    } else {
+      parsed.error = `unknown argument "${arg}"`;
+      break;
+    }
+  }
+  return parsed;
+}
+async function runLogoutCommand(argv, deps = {}) {
+  const out = deps.out ?? ((line) => console.log(line));
+  const err = deps.err ?? ((line) => console.error(line));
+  const home = deps.home;
+  const args = parseLogoutArgs(argv);
+  if (args.help) {
+    out("usage: neat logout [--name <name>]");
+    out("  With no argument, clears the active hosted profile so the CLI and MCP");
+    out("  server go back to your local daemon (the stored profile is kept).");
+    out("  --name <name> removes that profile from ~/.neat/profiles.json entirely.");
+    return 0;
+  }
+  if (args.error) {
+    err(`neat logout: ${args.error}`);
+    return 2;
+  }
+  if (args.name !== void 0) {
+    if (args.name.length === 0) {
+      err("neat logout: --name needs a profile name");
+      return 2;
+    }
+    const removed = await removeProfile(args.name, home ?? void 0);
+    if (!removed) {
+      err(`neat logout: no profile named "${args.name}"`);
+      return 1;
+    }
+    out(`Removed profile "${args.name}".`);
+    return 0;
+  }
+  const active = await getActiveProfile(home ?? void 0);
+  if (!active) {
+    out("Not logged in to a hosted NEAT \u2014 the CLI is already using your local daemon.");
+    return 0;
+  }
+  await clearActiveProfile(home ?? void 0);
+  out(`Logged out of "${active.name}" (${active.endpoint}). The CLI is back on your local daemon.`);
+  return 0;
+}
+async function defaultReadLine(prompt) {
+  if (!process.stdin.isTTY) return void 0;
+  const rl = import_promises2.default.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(prompt);
+  } finally {
+    rl.close();
+  }
+}
+async function defaultReadSecret(prompt) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) return void 0;
+  process.stdout.write(prompt);
+  return new Promise((resolve) => {
+    const chars = [];
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const cleanup = () => {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.off("data", onData);
+    };
+    const onData = (ch) => {
+      const code = ch.charCodeAt(0);
+      if (ch === "\n" || ch === "\r" || code === 4) {
+        cleanup();
+        process.stdout.write("\n");
+        resolve(chars.join(""));
+      } else if (code === 3) {
+        cleanup();
+        process.stdout.write("\n");
+        process.exit(130);
+      } else if (code === 127 || ch === "\b") {
+        chars.pop();
+      } else {
+        chars.push(ch);
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+// src/hooks-cli.ts
+init_cjs_shims();
+var import_node_path91 = __toESM(require("path"), 1);
+var import_node_os7 = __toESM(require("os"), 1);
+var import_node_fs55 = require("fs");
 var import_node_url5 = require("url");
 var HOOK_FILENAME = "neat-search-nudge.mjs";
 var GUIDE_FILENAME = "GRAPH_FIRST.md";
 var GUIDE_INSTALL_NAME = "neat-graph-first.md";
 var HOOK_MATCHER = "Grep|Glob|Bash";
 function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : import_node_path90.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
+  return typeof __dirname !== "undefined" ? __dirname : import_node_path91.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
 }
 async function readSkillAsset(rel) {
   const here = moduleDir();
   const candidates = [
-    import_node_path90.default.resolve(here, "../../claude-skill", rel),
-    import_node_path90.default.resolve(here, "../../../claude-skill", rel),
-    import_node_path90.default.resolve(here, "../claude-skill", rel)
+    import_node_path91.default.resolve(here, "../../claude-skill", rel),
+    import_node_path91.default.resolve(here, "../../../claude-skill", rel),
+    import_node_path91.default.resolve(here, "../claude-skill", rel)
   ];
   for (const candidate of candidates) {
     try {
-      return await import_node_fs54.promises.readFile(candidate, "utf8");
+      return await import_node_fs55.promises.readFile(candidate, "utf8");
     } catch {
     }
   }
@@ -30063,22 +30501,22 @@ async function readSkillAsset(rel) {
     `neat hooks: could not find @neat.is/claude-skill/${rel} \u2014 is the package installed?`
   );
 }
-function neatHome3() {
+function neatHome4() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path90.default.resolve(override);
-  return import_node_path90.default.join(import_node_os6.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path91.default.resolve(override);
+  return import_node_path91.default.join(import_node_os7.default.homedir(), ".neat");
 }
 function claudeSettingsPath() {
   const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return import_node_path90.default.resolve(override);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os6.default.homedir();
-  return import_node_path90.default.join(home, ".claude", "settings.json");
+  if (override && override.length > 0) return import_node_path91.default.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os7.default.homedir();
+  return import_node_path91.default.join(home, ".claude", "settings.json");
 }
 function installedHookPath() {
-  return import_node_path90.default.join(neatHome3(), "hooks", HOOK_FILENAME);
+  return import_node_path91.default.join(neatHome4(), "hooks", HOOK_FILENAME);
 }
 function gateFlagPath() {
-  return import_node_path90.default.join(neatHome3(), "hooks", "gate-enabled");
+  return import_node_path91.default.join(neatHome4(), "hooks", "gate-enabled");
 }
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
@@ -30111,14 +30549,14 @@ async function runHooks(opts) {
     const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
     const guide = await readSkillAsset(GUIDE_FILENAME);
     const scriptPath = installedHookPath();
-    await import_node_fs54.promises.mkdir(import_node_path90.default.dirname(scriptPath), { recursive: true });
-    await import_node_fs54.promises.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = import_node_path90.default.join(neatHome3(), GUIDE_INSTALL_NAME);
-    await import_node_fs54.promises.writeFile(guidePath, guide, "utf8");
+    await import_node_fs55.promises.mkdir(import_node_path91.default.dirname(scriptPath), { recursive: true });
+    await import_node_fs55.promises.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = import_node_path91.default.join(neatHome4(), GUIDE_INSTALL_NAME);
+    await import_node_fs55.promises.writeFile(guidePath, guide, "utf8");
     const settingsFile = claudeSettingsPath();
     let settings = {};
     try {
-      settings = JSON.parse(await import_node_fs54.promises.readFile(settingsFile, "utf8"));
+      settings = JSON.parse(await import_node_fs55.promises.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(
@@ -30140,14 +30578,14 @@ async function runHooks(opts) {
       ...settings,
       hooks: { ...hooks, PreToolUse: preToolUse }
     };
-    await import_node_fs54.promises.mkdir(import_node_path90.default.dirname(settingsFile), { recursive: true });
-    await import_node_fs54.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs55.promises.mkdir(import_node_path91.default.dirname(settingsFile), { recursive: true });
+    await import_node_fs55.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
     const flag = gateFlagPath();
     if (opts.gate) {
-      await import_node_fs54.promises.mkdir(import_node_path90.default.dirname(flag), { recursive: true });
-      await import_node_fs54.promises.writeFile(flag, "1\n", "utf8");
+      await import_node_fs55.promises.mkdir(import_node_path91.default.dirname(flag), { recursive: true });
+      await import_node_fs55.promises.writeFile(flag, "1\n", "utf8");
     } else {
-      await import_node_fs54.promises.rm(flag, { force: true });
+      await import_node_fs55.promises.rm(flag, { force: true });
     }
     const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
     console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
@@ -30237,8 +30675,8 @@ async function runHooksCommand(args) {
 
 // src/claude-cli.ts
 init_cjs_shims();
-var import_node_path91 = __toESM(require("path"), 1);
-var import_node_fs55 = require("fs");
+var import_node_path92 = __toESM(require("path"), 1);
+var import_node_fs56 = require("fs");
 var NEAT_SECTION_HEADING = "## neat";
 var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
 code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
@@ -30272,8 +30710,8 @@ ${NEAT_DIRECTIVE_BODY}
 }
 function claudeMdPath() {
   const override = process.env.NEAT_CLAUDE_MD;
-  if (override && override.length > 0) return import_node_path91.default.resolve(override);
-  return import_node_path91.default.join(process.cwd(), "CLAUDE.md");
+  if (override && override.length > 0) return import_node_path92.default.resolve(override);
+  return import_node_path92.default.join(process.cwd(), "CLAUDE.md");
 }
 function splitAroundSection(raw) {
   const lines = raw.split("\n");
@@ -30301,7 +30739,7 @@ function compose(before, after) {
 }
 async function readIfExists2(file) {
   try {
-    return await import_node_fs55.promises.readFile(file, "utf8");
+    return await import_node_fs56.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -30312,8 +30750,8 @@ async function runInstall() {
   const raw = await readIfExists2(file) ?? "";
   const { before, after, found } = splitAroundSection(raw);
   const next = compose(before, after);
-  await import_node_fs55.promises.mkdir(import_node_path91.default.dirname(file), { recursive: true });
-  await import_node_fs55.promises.writeFile(file, next, "utf8");
+  await import_node_fs56.promises.mkdir(import_node_path92.default.dirname(file), { recursive: true });
+  await import_node_fs56.promises.writeFile(file, next, "utf8");
   const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
   console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
   console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
@@ -30334,7 +30772,7 @@ async function runUninstall() {
   }
   const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
   const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
-  await import_node_fs55.promises.writeFile(file, next, "utf8");
+  await import_node_fs56.promises.writeFile(file, next, "utf8");
   console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
   return { exitCode: 0 };
 }
@@ -30377,9 +30815,9 @@ async function runClaudeCommand(args) {
 
 // src/codex-cli.ts
 init_cjs_shims();
-var import_node_path92 = __toESM(require("path"), 1);
-var import_node_os7 = __toESM(require("os"), 1);
-var import_node_fs56 = require("fs");
+var import_node_path93 = __toESM(require("path"), 1);
+var import_node_os8 = __toESM(require("os"), 1);
+var import_node_fs57 = require("fs");
 var import_node_util = require("util");
 var import_smol_toml6 = require("smol-toml");
 var CODEX_MCP_SERVER = {
@@ -30397,14 +30835,14 @@ var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
 var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
 function codexConfigPath() {
   const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return import_node_path92.default.resolve(override);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os7.default.homedir();
-  return import_node_path92.default.join(home, ".codex", "config.toml");
+  if (override && override.length > 0) return import_node_path93.default.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os8.default.homedir();
+  return import_node_path93.default.join(home, ".codex", "config.toml");
 }
 function agentsFilePath() {
   const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return import_node_path92.default.resolve(override);
-  return import_node_path92.default.join(process.cwd(), "AGENTS.md");
+  if (override && override.length > 0) return import_node_path93.default.resolve(override);
+  return import_node_path93.default.join(process.cwd(), "AGENTS.md");
 }
 function isTableHeader(line) {
   return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
@@ -30538,7 +30976,7 @@ async function runCodex(opts) {
   const agentsPath = agentsFilePath();
   let configRaw = "";
   try {
-    configRaw = await import_node_fs56.promises.readFile(configPath, "utf8");
+    configRaw = await import_node_fs57.promises.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
@@ -30547,7 +30985,7 @@ async function runCodex(opts) {
   }
   let agentsRaw = "";
   try {
-    agentsRaw = await import_node_fs56.promises.readFile(agentsPath, "utf8");
+    agentsRaw = await import_node_fs57.promises.readFile(agentsPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
@@ -30587,15 +31025,15 @@ async function runCodex(opts) {
     return { exitCode: 0 };
   }
   if (config.changed) {
-    await import_node_fs56.promises.mkdir(import_node_path92.default.dirname(configPath), { recursive: true });
-    await import_node_fs56.promises.writeFile(configPath, config.text, "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path93.default.dirname(configPath), { recursive: true });
+    await import_node_fs57.promises.writeFile(configPath, config.text, "utf8");
     console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
   } else {
     console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
   if (agents.changed) {
-    await import_node_fs56.promises.mkdir(import_node_path92.default.dirname(agentsPath), { recursive: true });
-    await import_node_fs56.promises.writeFile(agentsPath, agents.text, "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path93.default.dirname(agentsPath), { recursive: true });
+    await import_node_fs57.promises.writeFile(agentsPath, agents.text, "utf8");
     console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
     console.log(`neat codex: ${agentsPath} already has the graph-first block`);
@@ -30652,9 +31090,9 @@ async function runCodexCommand(args) {
 
 // src/editors-cli.ts
 init_cjs_shims();
-var import_node_path93 = __toESM(require("path"), 1);
-var import_node_os8 = __toESM(require("os"), 1);
-var import_node_fs57 = require("fs");
+var import_node_path94 = __toESM(require("path"), 1);
+var import_node_os9 = __toESM(require("os"), 1);
+var import_node_fs58 = require("fs");
 var import_node_util2 = require("util");
 var jsonc = __toESM(require("jsonc-parser"), 1);
 var NEAT_MCP_SERVER = {
@@ -30674,21 +31112,21 @@ var NEAT_CRUSH_SERVER = {
 var GRAPH_FIRST_MARKER_OPEN = "<!-- neat:graph-first -->";
 var GRAPH_FIRST_MARKER_CLOSE = "<!-- /neat:graph-first -->";
 function homeDir() {
-  return process.env.HOME ?? process.env.USERPROFILE ?? import_node_os8.default.homedir();
+  return process.env.HOME ?? process.env.USERPROFILE ?? import_node_os9.default.homedir();
 }
 function xdgConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? import_node_path93.default.resolve(xdg) : import_node_path93.default.join(homeDir(), ".config");
+  return xdg && xdg.length > 0 ? import_node_path94.default.resolve(xdg) : import_node_path94.default.join(homeDir(), ".config");
 }
 function envOverride(name) {
   const v = process.env[name];
-  return v && v.length > 0 ? import_node_path93.default.resolve(v) : void 0;
+  return v && v.length > 0 ? import_node_path94.default.resolve(v) : void 0;
 }
 var CURSOR_CLIENT = {
   id: "cursor",
   label: "Cursor",
   docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path93.default.join(homeDir(), ".cursor", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path94.default.join(homeDir(), ".cursor", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   // Cursor still reads a single `.cursorrules` at the project root (the modern
@@ -30700,7 +31138,7 @@ var DEVIN_CLIENT = {
   id: "devin",
   label: "Devin Desktop (Cascade)",
   docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path93.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path94.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: ".windsurfrules"
@@ -30709,7 +31147,7 @@ var GEMINI_CLIENT = {
   id: "gemini",
   label: "Gemini CLI",
   docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path93.default.join(homeDir(), ".gemini", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path94.default.join(homeDir(), ".gemini", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "GEMINI.md"
@@ -30718,7 +31156,7 @@ var QWEN_CLIENT = {
   id: "qwen",
   label: "Qwen Code",
   docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path93.default.join(homeDir(), ".qwen", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path94.default.join(homeDir(), ".qwen", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "QWEN.md"
@@ -30727,7 +31165,7 @@ var AMAZONQ_CLIENT = {
   id: "amazonq",
   label: "Amazon Q Developer CLI",
   docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path93.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path94.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -30735,7 +31173,7 @@ var ROOCODE_CLIENT = {
   id: "roocode",
   label: "Roo Code",
   docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path93.default.join(process.cwd(), ".roo", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path94.default.join(process.cwd(), ".roo", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -30748,9 +31186,9 @@ var ZED_CLIENT = {
     if (override) return override;
     if (process.platform === "win32") {
       const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return import_node_path93.default.join(appData, "Zed", "settings.json");
+      if (appData && appData.length > 0) return import_node_path94.default.join(appData, "Zed", "settings.json");
     }
-    return import_node_path93.default.join(homeDir(), ".config", "zed", "settings.json");
+    return import_node_path94.default.join(homeDir(), ".config", "zed", "settings.json");
   },
   mcpContainerKey: "context_servers",
   format: "jsonc",
@@ -30760,7 +31198,7 @@ var OPENCODE_CLIENT = {
   id: "opencode",
   label: "OpenCode",
   docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path93.default.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path94.default.join(xdgConfigDir(), "opencode", "opencode.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_OPENCODE_SERVER,
@@ -30770,7 +31208,7 @@ var CRUSH_CLIENT = {
   id: "crush",
   label: "Crush",
   docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path93.default.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path94.default.join(xdgConfigDir(), "crush", "crush.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_CRUSH_SERVER,
@@ -30833,7 +31271,7 @@ async function planMcp(client, mcpPath) {
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   let raw = "";
   try {
-    raw = await import_node_fs57.promises.readFile(mcpPath, "utf8");
+    raw = await import_node_fs58.promises.readFile(mcpPath, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -30875,7 +31313,7 @@ async function runEditorInstall(client, opts) {
   const mcpPath = client.mcpConfigPath();
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? import_node_path93.default.join(opts.projectDir, client.rulesFileName) : "";
+  const rulesPath = hasRules ? import_node_path94.default.join(opts.projectDir, client.rulesFileName) : "";
   const mcp = await planMcp(client, mcpPath);
   if (mcp === null) return { exitCode: 1 };
   let existingRules = "";
@@ -30884,7 +31322,7 @@ async function runEditorInstall(client, opts) {
   let block = "";
   if (hasRules) {
     try {
-      existingRules = await import_node_fs57.promises.readFile(rulesPath, "utf8");
+      existingRules = await import_node_fs58.promises.readFile(rulesPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
@@ -30918,11 +31356,11 @@ async function runEditorInstall(client, opts) {
     );
     return { exitCode: 0 };
   }
-  await import_node_fs57.promises.mkdir(import_node_path93.default.dirname(mcpPath), { recursive: true });
-  await import_node_fs57.promises.writeFile(mcpPath, mcp.text, "utf8");
+  await import_node_fs58.promises.mkdir(import_node_path94.default.dirname(mcpPath), { recursive: true });
+  await import_node_fs58.promises.writeFile(mcpPath, mcp.text, "utf8");
   if (hasRules) {
-    await import_node_fs57.promises.mkdir(import_node_path93.default.dirname(rulesPath), { recursive: true });
-    await import_node_fs57.promises.writeFile(rulesPath, newRules, "utf8");
+    await import_node_fs58.promises.mkdir(import_node_path94.default.dirname(rulesPath), { recursive: true });
+    await import_node_fs58.promises.writeFile(rulesPath, newRules, "utf8");
   }
   console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
   console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
@@ -31415,7 +31853,7 @@ function sleep(ms, signal) {
 
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path94 = __toESM(require("path"), 1);
+var import_node_path95 = __toESM(require("path"), 1);
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -31425,7 +31863,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path94.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path95.default.sep}`)) {
       return entry2;
     }
   }
@@ -31730,6 +32168,12 @@ function usage5() {
   console.log("  doctor         Preflight this directory's setup \u2014 Node version, project,");
   console.log("                 and daemon reachability \u2014 and print a fix for anything down.");
   console.log("                 Flags: --json. Exits 0 when all pass, 1 when a check fails.");
+  console.log("  login          Connect this machine to a hosted NEAT and make it the default");
+  console.log("                 for the CLI and the MCP server. Paste the daemon endpoint +");
+  console.log("                 token, or run interactively (the token is read without echo).");
+  console.log("                 Flags: --endpoint <url>, --token <token>, --name <name>, --json.");
+  console.log("  logout         Clear the active hosted profile (back to your local daemon);");
+  console.log("                 --name <name> removes that profile entirely.");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  ask <question>                   Plain-language door: resolves the question to");
@@ -31780,6 +32224,7 @@ function usage5() {
 }
 var STRING_FLAGS = [
   ["--project", "project"],
+  ["--profile", "profile"],
   ["--depth", "depth"],
   ["--limit", "limit"],
   ["--edge-type", "edgeType"],
@@ -31797,6 +32242,7 @@ function parseArgs(rest) {
   const positional = [];
   const out = {
     project: null,
+    profile: null,
     apply: false,
     dryRun: false,
     noInstall: false,
@@ -31955,7 +32401,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs58.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs59.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -31964,13 +32410,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path95.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path96.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs58.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs59.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path95.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs58.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path96.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs59.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -31981,9 +32427,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path95.default.join(opts.scanPath, "neat-out")
+    import_node_path96.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path95.default.join(import_node_path95.default.dirname(opts.outPath), import_node_path95.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path96.default.join(import_node_path96.default.dirname(opts.outPath), import_node_path96.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -32062,7 +32508,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs58.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs59.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -32103,9 +32549,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path95.default.resolve(override);
+  if (override && override.length > 0) return import_node_path96.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path95.default.join(home, ".claude.json");
+  return import_node_path96.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -32117,7 +32563,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs58.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs59.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -32129,8 +32575,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs58.promises.mkdir(import_node_path95.default.dirname(target), { recursive: true });
-    await import_node_fs58.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs59.promises.mkdir(import_node_path96.default.dirname(target), { recursive: true });
+    await import_node_fs59.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -32174,6 +32620,16 @@ async function main() {
     if (code !== 0) process.exit(code);
     return;
   }
+  if (cmd0 === "login") {
+    const code = await runLoginCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
+  if (cmd0 === "logout") {
+    const code = await runLogoutCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   if (cmd0 === "hooks") {
     const code = await runHooksCommand(argv.slice(1));
     if (code !== 0) process.exit(code);
@@ -32226,12 +32682,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path95.default.resolve(target);
+    const scanPath = import_node_path96.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path95.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path96.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path95.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path95.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path96.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path96.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -32252,21 +32708,21 @@ async function main() {
       usage5();
       process.exit(2);
     }
-    const scanPath = import_node_path95.default.resolve(target);
-    const stat = await import_node_fs58.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path96.default.resolve(target);
+    const stat = await import_node_fs59.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path95.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path95.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path95.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path95.default.join(import_node_path95.default.dirname(outPath), import_node_path95.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path96.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path96.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path96.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path96.default.join(import_node_path96.default.dirname(outPath), import_node_path96.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path95.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path95.default.join(import_node_path95.default.dirname(outPath), import_node_path95.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path96.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path96.default.join(import_node_path96.default.dirname(outPath), import_node_path96.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path95.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path96.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -32275,7 +32731,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? import_node_path95.default.resolve(process.env.NEAT_HOME) : import_node_path95.default.join(import_node_os9.default.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? import_node_path96.default.resolve(process.env.NEAT_HOME) : import_node_path96.default.join(import_node_os10.default.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -32457,11 +32913,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path95.default.resolve(cmd);
-  const stat = await import_node_fs58.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path96.default.resolve(cmd);
+  const stat = await import_node_fs59.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path95.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path96.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -32524,19 +32980,50 @@ Pass --project <name> to choose:
 ${names}`
   );
 }
-async function resolveDaemonUrl(project) {
-  const explicit = process.env.NEAT_API_URL ?? process.env.NEAT_CORE_URL;
-  if (explicit) return explicit;
-  if (project) {
-    const daemon = await findDaemonByProject(project);
-    if (daemon) return `http://localhost:${daemon.record.ports.rest}`;
+var UnknownProfileError = class extends Error {
+  constructor(name) {
+    super(
+      `no profile named "${name}" in ~/.neat/profiles.json \u2014 run \`neat login\` first, or drop --profile / NEAT_PROFILE`
+    );
+    this.name = "UnknownProfileError";
   }
-  return "http://localhost:8080";
+};
+async function resolveClientTarget(opts = {}) {
+  const named2 = opts.profile ?? process.env.NEAT_PROFILE;
+  if (named2 && named2.length > 0) {
+    const profile = await resolveProfile(named2);
+    if (!profile) throw new UnknownProfileError(named2);
+    return { endpoint: profile.endpoint, authToken: profile.authToken, source: "profile" };
+  }
+  const pin = process.env.NEAT_API_URL ?? process.env.NEAT_CORE_URL;
+  if (pin) return { endpoint: pin, authToken: resolveAuthToken(), source: "env" };
+  const active = await getActiveProfile().catch(() => void 0);
+  if (active) return { endpoint: active.endpoint, authToken: active.authToken, source: "active" };
+  if (opts.project) {
+    const daemon = await findDaemonByProject(opts.project);
+    if (daemon) {
+      return { endpoint: `http://localhost:${daemon.record.ports.rest}`, source: "daemon-record" };
+    }
+  }
+  return { endpoint: "http://localhost:8080", source: "default" };
+}
+async function resolveDaemonUrl(project, profile) {
+  return (await resolveClientTarget({ project, profile })).endpoint;
 }
 async function runQueryVerb(cmd, parsed) {
   const requestedProject = resolveProjectFlag(parsed);
-  const baseUrl = await resolveDaemonUrl(requestedProject);
-  const client = createHttpClient(baseUrl, resolveAuthToken());
+  let target;
+  try {
+    target = await resolveClientTarget({ project: requestedProject, profile: parsed.profile ?? void 0 });
+  } catch (err) {
+    if (err instanceof UnknownProfileError) {
+      process.stderr.write(`${err.message}
+`);
+      return 2;
+    }
+    throw err;
+  }
+  const client = createHttpClient(target.endpoint, target.authToken);
   const positional = parsed.positional;
   let makeWork;
   switch (cmd) {
@@ -32700,7 +33187,7 @@ async function runQueryVerb(cmd, parsed) {
       const detail = err.responseBody.length > 0 ? err.responseBody : err.message;
       console.error(`neat ${cmd}: ${detail.trim()}`);
     } else if (err instanceof TransportError) {
-      console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${baseUrl})`);
+      console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${target.endpoint})`);
     } else {
       console.error(`neat ${cmd}: ${err.message}`);
     }
@@ -32709,9 +33196,14 @@ async function runQueryVerb(cmd, parsed) {
 }
 async function runMonitorVerb(parsed) {
   const requestedProject = resolveProjectFlag(parsed);
-  const baseUrl = await resolveDaemonUrl(requestedProject);
-  const token = resolveAuthToken();
-  const client = createHttpClient(baseUrl, token);
+  let target;
+  try {
+    target = await resolveClientTarget({ project: requestedProject, profile: parsed.profile ?? void 0 });
+  } catch (err) {
+    if (err instanceof UnknownProfileError) return 0;
+    throw err;
+  }
+  const client = createHttpClient(target.endpoint, target.authToken);
   let project;
   try {
     project = await resolveProjectForVerb(client, parsed);
@@ -32727,10 +33219,10 @@ async function runMonitorVerb(parsed) {
   process.once("SIGTERM", onSignal);
   try {
     return await runMonitor({
-      baseUrl,
+      baseUrl: target.endpoint,
       project,
       json: parsed.json,
-      authToken: token,
+      authToken: target.authToken,
       signal: controller.signal
     });
   } finally {
@@ -32750,12 +33242,14 @@ if (/[\\/](?:cli\.(?:cjs|js)|cli|neat|neat\.is)$/.test(entry)) {
   CLAUDE_SKILL_CONFIG,
   ProjectResolutionError,
   QUERY_VERBS,
+  UnknownProfileError,
   commandPrefix,
   isNpxInvocation,
   main,
   parseArgs,
   printBanner,
   readPackageVersion,
+  resolveClientTarget,
   resolveDaemonUrl,
   resolveProjectForVerb,
   runInit,