@neat.is/core 0.9.18-dev.20260917 → 0.9.18-dev.20260918

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   resolveNeatVersion,
   startK8sSubstratePolling,
   writeDaemonRecord
-} from "./chunk-NV4WWJSU.js";
+} from "./chunk-MGQSR6QZ.js";
 import {
   buildSearchIndex
 } from "./chunk-BC53SCT7.js";
@@ -77,7 +77,7 @@ import {
   startStalenessLoop,
   upsertConnectorEntry,
   validateConnectorEntry
-} from "./chunk-SSLPBQWY.js";
+} from "./chunk-KIV7OB2K.js";
 import {
   startOtelGrpcReceiver
 } from "./chunk-ERE47MCR.js";
@@ -4861,1139 +4861,1251 @@ async function runConnectorCommand(rawArgs, deps = {}) {
   }
 }
 
-// src/doctor-cli.ts
+// src/hosted-connect-cli.ts
+import { spawn as spawn4 } from "child_process";
+
+// src/login-sso.ts
+import { createServer } from "http";
+import { spawn as spawn3 } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+
+// src/profiles.ts
 import { promises as fs10 } from "fs";
+import os from "os";
 import path11 from "path";
-
-// src/cli-client.ts
-import { Provenance as Provenance2 } from "@neat.is/types";
-var HttpError = class extends Error {
-  constructor(status, message, responseBody = "") {
-    super(message);
-    this.status = status;
-    this.responseBody = responseBody;
-    this.name = "HttpError";
-  }
-  status;
-  responseBody;
-};
-var TransportError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TransportError";
-  }
-};
-function resolveAuthToken(env = process.env) {
-  const t = env.NEAT_AUTH_TOKEN;
-  return t && t.length > 0 ? t : void 0;
+var PROFILES_CONFIG_VERSION = 1;
+function neatHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return path11.resolve(override);
+  return path11.join(os.homedir(), ".neat");
 }
-function createHttpClient(baseUrl, bearerToken) {
-  const root = baseUrl.replace(/\/$/, "");
-  const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
-  return {
-    async get(path19) {
-      let res;
-      try {
-        res = await fetch(`${root}${path19}`, {
-          headers: { ...authHeader }
-        });
-      } catch (err) {
-        throw new TransportError(
-          `cannot reach neat-core at ${root}: ${err.message}`
-        );
-      }
-      if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        throw new HttpError(
-          res.status,
-          `${res.status} ${res.statusText} on GET ${path19}: ${body}`,
-          body
-        );
-      }
-      return await res.json();
-    },
-    async post(path19, body) {
-      let res;
-      try {
-        res = await fetch(`${root}${path19}`, {
-          method: "POST",
-          headers: { "content-type": "application/json", ...authHeader },
-          body: JSON.stringify(body)
-        });
-      } catch (err) {
-        throw new TransportError(
-          `cannot reach neat-core at ${root}: ${err.message}`
-        );
-      }
-      if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        throw new HttpError(
-          res.status,
-          `${res.status} ${res.statusText} on POST ${path19}: ${text}`,
-          text
-        );
-      }
-      return await res.json();
-    }
-  };
+function profilesConfigPath(home = neatHome()) {
+  return path11.join(home, "profiles.json");
 }
-function projectPath(project, suffix) {
-  if (!project) return suffix;
-  return `/projects/${encodeURIComponent(project)}${suffix}`;
+function profilesConfigLockPath(home = neatHome()) {
+  return path11.join(home, "profiles.json.lock");
 }
-async function runRootCause(client, input) {
-  const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path19 = projectPath(
-    input.project,
-    `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
-  );
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
   try {
-    const result = await client.get(path19);
-    const arrowPath = result.traversalPath.join(" \u2190 ");
-    const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
-    const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
-    const blockLines = [
-      `Traversal path: ${arrowPath}`,
-      `Edge provenances: ${provenances}`
-    ];
-    if (result.fixRecommendation) blockLines.push(`Recommended fix: ${result.fixRecommendation}`);
-    return {
-      summary,
-      block: blockLines.join("\n"),
-      confidence: result.confidence,
-      provenance: result.edgeProvenances.length ? result.edgeProvenances : void 0
-    };
-  } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return {
-        summary: `No root cause found for ${input.errorNode}. The node may be healthy, or it may not exist in the graph.`
-      };
+    const stat = await fs10.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's token calls for \u2014 run \`chmod 600 ${file}\``
+      );
     }
-    throw err;
+  } catch {
   }
 }
-async function runBlastRadius(client, input) {
-  const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path19 = projectPath(
-    input.project,
-    `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
-  );
+async function readProfilesConfig(home = neatHome()) {
+  const file = profilesConfigPath(home);
+  let raw;
   try {
-    const result = await client.get(path19);
-    if (result.totalAffected === 0) {
-      return {
-        summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
-      };
-    }
-    const sorted = [...result.affectedNodes].sort(
-      (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
-    );
-    const blockLines = sorted.map(formatBlastEntry);
-    const minConfidence = sorted.reduce(
-      (m, n) => Math.min(m, n.confidence),
-      Number.POSITIVE_INFINITY
-    );
-    const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
-    return {
-      summary: `Blast radius for ${result.origin}: ${result.totalAffected} dependent node${result.totalAffected === 1 ? "" : "s"} would break if it changed.`,
-      block: blockLines.join("\n"),
-      confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
-      provenance: provenances.length ? provenances : void 0
-    };
+    raw = await fs10.readFile(file, "utf8");
   } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId} not found in the graph.` };
+    if (err.code === "ENOENT") {
+      return { version: PROFILES_CONFIG_VERSION, profiles: [] };
     }
     throw err;
   }
-}
-function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === Provenance2.STALE ? " [STALE \u2014 last seen too long ago]" : "";
-  return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
-}
-async function runDependencies(client, input) {
-  const depth = input.depth ?? 3;
-  const path19 = projectPath(
-    input.project,
-    `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
-  );
+  await warnIfModeLooserThan0600(file);
+  let parsed;
   try {
-    const result = await client.get(path19);
-    if (result.total === 0) {
-      return {
-        summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
-      };
-    }
-    const byDistance = /* @__PURE__ */ new Map();
-    for (const dep of result.dependencies) {
-      const ring = byDistance.get(dep.distance) ?? [];
-      ring.push(dep);
-      byDistance.set(dep.distance, ring);
-    }
-    const blockLines = [];
-    for (const distance of [...byDistance.keys()].sort((a, b) => a - b)) {
-      const label = distance === 1 ? "Direct (distance 1)" : `Distance ${distance}`;
-      blockLines.push(`${label}:`);
-      for (const dep of byDistance.get(distance)) {
-        blockLines.push(`  \u2022 ${dep.nodeId} \u2014 ${dep.edgeType} (${dep.provenance})`);
-      }
-    }
-    const provenances = [...new Set(result.dependencies.map((d) => d.provenance))];
-    const directCount = byDistance.get(1)?.length ?? 0;
-    const summary = depth === 1 ? `${input.nodeId} has ${directCount} direct dependenc${directCount === 1 ? "y" : "ies"}.` : `${input.nodeId} has ${result.total} dependenc${result.total === 1 ? "y" : "ies"} reachable to depth ${depth} (${directCount} direct).`;
-    return { summary, block: blockLines.join("\n"), provenance: provenances };
+    parsed = JSON.parse(raw);
   } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId} not found in the graph.` };
-    }
-    throw err;
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
   }
+  return validateConfig(parsed, file);
 }
-function observedDepLine(nodeId, e) {
-  const via = e.source !== nodeId ? ` (via ${e.source})` : "";
-  return `  \u2022 ${e.target} \u2014 ${e.type}${via}${edgeMeta(e)}`;
-}
-async function runObservedDependencies(client, input) {
-  try {
-    const result = await client.get(
-      projectPath(
-        input.project,
-        `/graph/observed-dependencies/${encodeURIComponent(input.nodeId)}`
-      )
-    );
-    if (result.dependencies.length === 0) {
-      if (result.observed) {
-        return {
-          summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
-          provenance: Provenance2.OBSERVED
-        };
-      }
-      const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
-      return { summary: `No OBSERVED dependencies for ${input.nodeId}.${note}` };
-    }
-    const blockLines = result.dependencies.map((e) => observedDepLine(input.nodeId, e));
-    return {
-      summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
-      block: blockLines.join("\n"),
-      provenance: Provenance2.OBSERVED
-    };
-  } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId} not found in the graph.` };
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "profiles" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? PROFILES_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawProfiles = obj.profiles;
+  if (!Array.isArray(rawProfiles)) {
+    throw new Error(`${file}: "profiles" must be an array`);
+  }
+  const profiles = rawProfiles.map((entry2, i) => validateEntry(entry2, i, file));
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of profiles) {
+    if (seen.has(p.name)) throw new Error(`${file}: duplicate profile name "${p.name}"`);
+    seen.add(p.name);
+  }
+  let active;
+  if (obj.active !== void 0) {
+    if (typeof obj.active !== "string" || obj.active.length === 0) {
+      throw new Error(`${file}: "active" must be a non-empty string when present`);
     }
-    throw err;
+    active = seen.has(obj.active) ? obj.active : void 0;
   }
+  return { version, ...active ? { active } : {}, profiles };
 }
-function edgeMeta(e) {
-  const bits = [];
-  if (e.signal) {
-    bits.push(`spans=${e.signal.spanCount}`);
-    if (e.signal.errorCount > 0) bits.push(`errors=${e.signal.errorCount}`);
-    if (e.signal.lastObservedAgeMs !== void 0) {
-      bits.push(`age=${formatDuration(e.signal.lastObservedAgeMs)}`);
-    }
-  } else if (e.callCount !== void 0) {
-    bits.push(`callCount=${e.callCount}`);
+function validateEntry(entry2, index, file) {
+  const where = `${file}: profiles[${index}]`;
+  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
+    throw new Error(`${where} must be an object`);
   }
-  if (e.lastObserved) bits.push(`lastObserved=${e.lastObserved}`);
-  if (e.confidence !== void 0) bits.push(`confidence=${e.confidence}`);
-  return bits.length ? ` [${bits.join(", ")}]` : "";
-}
-function formatDuration(ms) {
-  if (ms < 1e3) return `${Math.round(ms)}ms`;
-  const s = Math.round(ms / 1e3);
-  if (s < 60) return `${s}s`;
-  const m = Math.round(s / 60);
-  if (m < 60) return `${m}m`;
-  const h = Math.round(m / 60);
-  if (h < 48) return `${h}h`;
-  return `${Math.round(h / 24)}d`;
-}
-async function runIncidents(client, input) {
-  const path19 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const e = entry2;
+  const name = e.name;
+  if (typeof name !== "string" || name.length === 0) {
+    throw new Error(`${where}.name must be a non-empty string`);
+  }
+  const endpoint = e.endpoint;
+  if (typeof endpoint !== "string" || endpoint.length === 0) {
+    throw new Error(`${where}.endpoint must be a non-empty string`);
+  }
+  let parsedUrl;
   try {
-    const body = await client.get(path19);
-    const events = body.events;
-    if (events.length === 0) {
-      return {
-        summary: input.nodeId ? `No incidents recorded against ${input.nodeId}.` : "No incidents recorded."
-      };
-    }
-    const ordered = [...events].reverse().slice(0, input.limit ?? 20);
-    const blockLines = [];
-    for (const ev of ordered) {
-      blockLines.push(`  ${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`);
-      blockLines.push(`    trace=${ev.traceId} span=${ev.spanId}`);
-    }
-    const target = input.nodeId ?? "the project";
-    return {
-      summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
-      block: blockLines.join("\n"),
-      provenance: Provenance2.OBSERVED
-    };
-  } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId ?? ""} not found in the graph.` };
-    }
-    throw err;
+    parsedUrl = new URL(endpoint);
+  } catch {
+    throw new Error(`${where}.endpoint must be an absolute URL (got "${endpoint}")`);
   }
-}
-async function runSearch(client, input) {
-  const result = await client.get(
-    projectPath(input.project, `/search?q=${encodeURIComponent(input.query)}`)
-  );
-  if (result.matches.length === 0) {
-    return { summary: `No matches for "${input.query}".` };
+  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    throw new Error(`${where}.endpoint must be an http(s) URL (got "${parsedUrl.protocol}")`);
   }
-  const provider = result.provider ?? "substring";
-  const blockLines = [];
-  let topScore;
-  for (const n of result.matches) {
-    const score = provider !== "substring" && typeof n.score === "number" ? n.score : void 0;
-    const scoreBit = score !== void 0 ? ` [score=${score.toFixed(2)}]` : "";
-    if (score !== void 0 && (topScore === void 0 || score > topScore)) topScore = score;
-    blockLines.push(
-      `  \u2022 ${n.id} (${n.type}) \u2014 ${n.name ?? n.id}${scoreBit}`
-    );
+  if (e.authToken !== void 0 && (typeof e.authToken !== "string" || e.authToken.length === 0)) {
+    throw new Error(`${where}.authToken must be a non-empty string when present`);
   }
   return {
-    summary: `Found ${result.matches.length} match${result.matches.length === 1 ? "" : "es"} for "${input.query}" via ${provider} provider.`,
-    block: blockLines.join("\n"),
-    confidence: topScore
+    name,
+    endpoint,
+    ...typeof e.authToken === "string" ? { authToken: e.authToken } : {}
   };
 }
-async function runDiff(client, input) {
-  const result = await client.get(
-    projectPath(
-      input.project,
-      `/graph/diff?against=${encodeURIComponent(input.againstSnapshot)}`
-    )
-  );
-  const total = result.added.nodes.length + result.added.edges.length + result.removed.nodes.length + result.removed.edges.length + result.changed.nodes.length + result.changed.edges.length;
-  const baseLabel = result.base.exportedAt ?? "unknown";
-  if (total === 0) {
-    return {
-      summary: `No differences between the current graph and ${input.againstSnapshot} (base exportedAt=${baseLabel}).`
-    };
-  }
-  const blockLines = [
-    `  base exportedAt:    ${baseLabel}`,
-    `  current exportedAt: ${result.current.exportedAt}`,
-    ""
-  ];
-  if (result.added.nodes.length || result.added.edges.length) {
-    blockLines.push("Added:");
-    for (const n of result.added.nodes) blockLines.push(`  + node ${n.id} (${n.type})`);
-    for (const e of result.added.edges)
-      blockLines.push(`  + edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
-    blockLines.push("");
-  }
-  if (result.removed.nodes.length || result.removed.edges.length) {
-    blockLines.push("Removed:");
-    for (const n of result.removed.nodes) blockLines.push(`  - node ${n.id} (${n.type})`);
-    for (const e of result.removed.edges)
-      blockLines.push(`  - edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
-    blockLines.push("");
+async function resolveProfile(name, home = neatHome()) {
+  const { profiles } = await readProfilesConfig(home);
+  return profiles.find((p) => p.name === name);
+}
+async function getActiveProfile(home = neatHome()) {
+  const { active, profiles } = await readProfilesConfig(home);
+  if (!active) return void 0;
+  return profiles.find((p) => p.name === active);
+}
+function serialize(config) {
+  const names = new Set(config.profiles.map((p) => p.name));
+  const active = config.active && names.has(config.active) ? config.active : void 0;
+  const out = {
+    version: config.version ?? PROFILES_CONFIG_VERSION,
+    ...active ? { active } : {},
+    profiles: config.profiles
+  };
+  return `${JSON.stringify(out, null, 2)}
+`;
+}
+async function writeConfigAtomic(config, home) {
+  const file = profilesConfigPath(home);
+  await fs10.mkdir(path11.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await fs10.open(tmp, "w", 384);
+  try {
+    await fd.writeFile(serialize(config), "utf8");
+    await fd.sync();
+  } finally {
+    await fd.close();
   }
-  if (result.changed.nodes.length || result.changed.edges.length) {
-    blockLines.push("Changed:");
-    for (const c of result.changed.nodes) {
-      blockLines.push(`  ~ node ${c.id} \u2014 ${summariseAttrDiff(c.before, c.after)}`);
-    }
-    for (const c of result.changed.edges) {
-      const provBit = c.before.provenance !== c.after.provenance ? `provenance ${c.before.provenance} \u2192 ${c.after.provenance}` : summariseAttrDiff(c.before, c.after);
-      blockLines.push(`  ~ edge ${c.id} \u2014 ${provBit}`);
+  await fs10.rename(tmp, file);
+}
+var LOCK_RETRY_MS = 50;
+var LOCK_TIMEOUT_MS = 5e3;
+async function acquireLock(lockPath) {
+  await fs10.mkdir(path11.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (; ; ) {
+    try {
+      const fd = await fs10.open(lockPath, "wx");
+      await fd.writeFile(`${process.pid}
+`, "utf8");
+      await fd.close();
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `timed out acquiring ${lockPath} after ${LOCK_TIMEOUT_MS}ms \u2014 if no other neat process is running, remove the stale lock file`
+        );
+      }
+      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
     }
   }
-  return {
-    summary: `Diff against ${input.againstSnapshot}: ${total} change${total === 1 ? "" : "s"} between the snapshot and the live graph.`,
-    block: blockLines.join("\n").trimEnd()
-  };
 }
-function summariseAttrDiff(before, after) {
-  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
-  const changed = [];
-  for (const k of keys) {
-    if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) changed.push(k);
+async function releaseLock(lockPath) {
+  await fs10.rm(lockPath, { force: true });
+}
+async function withProfilesLock(home, fn) {
+  const lockPath = profilesConfigLockPath(home);
+  await acquireLock(lockPath);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock(lockPath);
   }
-  return changed.length === 0 ? "attributes differ" : `fields changed: ${changed.sort().join(", ")}`;
 }
-async function runStaleEdges(client, input) {
-  const params = new URLSearchParams();
-  if (input.limit !== void 0) params.set("limit", String(input.limit));
-  if (input.edgeType) params.set("edgeType", input.edgeType);
-  const qs = params.size > 0 ? `?${params.toString()}` : "";
-  const body = await client.get(
-    projectPath(input.project, `/stale-events${qs}`)
-  );
-  const events = body.events;
-  if (events.length === 0) {
+async function upsertProfile(profile, opts = {}) {
+  const home = opts.home ?? neatHome();
+  const validated = validateEntry(profile, 0, profilesConfigPath(home));
+  await withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    const others = config.profiles.filter((p) => p.name !== validated.name);
+    const profiles = [...others, validated];
+    const makeActive = opts.makeActive ?? config.profiles.length === 0;
+    const active = makeActive ? validated.name : config.active;
+    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
+  });
+}
+async function removeProfile(name, home = neatHome()) {
+  return withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    const profiles = config.profiles.filter((p) => p.name !== name);
+    if (profiles.length === config.profiles.length) return false;
+    const active = config.active === name ? void 0 : config.active;
+    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
+    return true;
+  });
+}
+async function clearActiveProfile(home = neatHome()) {
+  return withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    if (!config.active) return false;
+    await writeConfigAtomic({ version: config.version, profiles: config.profiles }, home);
+    return true;
+  });
+}
+
+// src/login-sso.ts
+var DEFAULT_CP_URL = "https://neat-control-plane-bg5yqctn2q-nw.a.run.app";
+var DEFAULT_WEB_URL = "https://app.neat.is";
+var CALLBACK_TIMEOUT_MS = 5 * 6e4;
+function resolveCpUrl(env = process.env, override) {
+  const v = override ?? env.NEAT_CP_URL;
+  return (v && v.length > 0 ? v : DEFAULT_CP_URL).replace(/\/+$/, "");
+}
+function resolveWebUrl(env = process.env, override) {
+  const v = override ?? env.NEAT_WEB_URL;
+  return (v && v.length > 0 ? v : DEFAULT_WEB_URL).replace(/\/+$/, "");
+}
+function pickProject(projects, want) {
+  if (want) {
+    const p = projects.find((x) => x.id === want || x.name === want);
+    if (!p) return { error: { code: 1, message: `no project named or id'd "${want}" on this account` } };
+    return { project: p };
+  }
+  const running = projects.filter((p) => p.status === "running");
+  if (running.length === 1) return { project: running[0] };
+  if (running.length === 0) {
+    const listed = projects.length ? ` (have: ${projects.map((p) => `${p.name} [${p.status}]`).join(", ")})` : "";
     return {
-      summary: input.edgeType ? `No stale ${input.edgeType} edges recorded.` : "No stale-edge transitions recorded yet."
+      error: {
+        code: 1,
+        message: `no running project to connect to \u2014 create + provision one in the console first${listed}`
+      }
     };
   }
-  const blockLines = events.map(
-    (e) => `  ${e.transitionedAt} \u2014 ${e.source} -[${e.edgeType}]-> ${e.target} (last seen ${e.lastObserved}, threshold ${formatDuration(e.thresholdMs)})`
-  );
   return {
-    summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
-    block: blockLines.join("\n"),
-    provenance: Provenance2.STALE
+    error: {
+      code: 2,
+      message: `several running projects \u2014 pass --project <name>: ${running.map((p) => p.name).join(", ")}`
+    }
   };
 }
-async function runPolicies(client, input) {
-  let violations;
-  let allowed = true;
-  let hypothetical;
-  if (input.hypotheticalAction) {
-    if (typeof client.post !== "function") {
-      throw new Error("HttpClient does not support POST \u2014 required for policies dry-run");
-    }
-    const body = await client.post(
-      projectPath(input.project, "/policies/check"),
-      { hypotheticalAction: input.hypotheticalAction }
-    );
-    violations = body.violations;
-    allowed = body.allowed;
-    hypothetical = body.hypotheticalAction;
-  } else {
-    const params = new URLSearchParams();
-    if (input.policyId) params.set("policyId", input.policyId);
-    const qs = params.size > 0 ? `?${params.toString()}` : "";
-    const body = await client.get(
-      projectPath(input.project, `/policies/violations${qs}`)
-    );
-    violations = body.violations;
-    allowed = violations.every((v) => v.onViolation !== "block");
+async function exchangeCredential(cpUrl, accessToken, opts, deps) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const auth = { authorization: `Bearer ${accessToken}` };
+  let meRes;
+  try {
+    meRes = await fetchImpl(`${cpUrl}/me`, { headers: auth });
+  } catch (e) {
+    return { error: { code: 3, message: `can't reach the control plane at ${cpUrl} \u2014 ${e.message}` } };
   }
-  if (input.nodeId) {
-    violations = violations.filter(
-      (v) => v.subject.nodeId === input.nodeId || v.subject.path?.includes(input.nodeId)
-    );
+  if (meRes.status === 401) return { error: { code: 1, message: "your session is expired or invalid \u2014 log in again" } };
+  if (!meRes.ok) return { error: { code: 1, message: `the control plane returned HTTP ${meRes.status} on /me` } };
+  const me = await meRes.json().catch(() => ({}));
+  const projects = Array.isArray(me.projects) ? me.projects : [];
+  const picked = pickProject(projects, opts.project);
+  if ("error" in picked) return picked;
+  const project = picked.project;
+  let credRes;
+  try {
+    credRes = await fetchImpl(`${cpUrl}/me/projects/${encodeURIComponent(project.id)}/cli-credential`, {
+      headers: auth
+    });
+  } catch (e) {
+    return { error: { code: 3, message: `can't reach the control plane \u2014 ${e.message}` } };
   }
-  if (violations.length === 0) {
+  if (credRes.status === 409) {
     return {
-      summary: hypothetical ? `No violations would result from the hypothetical action (${hypothetical.kind}).` : "No policy violations recorded."
+      error: {
+        code: 1,
+        message: `project "${project.name}" isn't provisioned yet (status: ${project.status}) \u2014 provision it first`
+      }
     };
   }
-  const blockCount = violations.filter((v) => v.onViolation === "block").length;
-  const summaryParts = [];
-  if (hypothetical) {
-    summaryParts.push(
-      `Hypothetical ${hypothetical.kind} would surface ${violations.length} violation${violations.length === 1 ? "" : "s"}`
-    );
-  } else {
-    summaryParts.push(
-      `${violations.length} policy violation${violations.length === 1 ? "" : "s"} currently recorded`
-    );
+  if (credRes.status === 404) return { error: { code: 1, message: `project "${project.name}" was not found, or isn't yours` } };
+  if (credRes.status === 401) return { error: { code: 1, message: "your session is expired or invalid \u2014 log in again" } };
+  if (!credRes.ok) return { error: { code: 1, message: `the control plane returned HTTP ${credRes.status} for the credential` } };
+  const cred = await credRes.json().catch(() => ({}));
+  if (!cred.endpoint || !cred.authToken) {
+    return { error: { code: 1, message: "the credential response was missing endpoint/authToken" } };
   }
-  if (blockCount > 0) summaryParts.push(`${blockCount} of which block`);
-  if (!allowed && hypothetical) summaryParts.push("action denied");
-  const summary = summaryParts.join("; ") + ".";
-  const blockLines = violations.map((v) => {
-    const subject = v.subject.nodeId ?? v.subject.edgeId ?? v.subject.path?.[0] ?? "(global)";
-    return `  \u2022 [${v.severity}/${v.onViolation}] ${v.policyName}: ${v.message} \u2014 ${subject}`;
-  });
-  const severities = [...new Set(violations.map((v) => v.severity))];
-  return {
-    summary,
-    block: blockLines.join("\n"),
-    confidence: hypothetical ? 0.7 : 1,
-    provenance: severities.join(" ")
-  };
+  return { project, cred };
 }
-function formatDivergenceLine(d) {
-  switch (d.type) {
-    case "missing-observed":
-    case "missing-extracted":
-      if (d.column) {
-        return `  \u2022 [${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 confidence ${d.confidence.toFixed(2)}`;
+function defaultOpenBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn3(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loopbackReceiveToken(webUrl, deps, opts = {}) {
+  const out = deps.out ?? (() => {
+  });
+  const openFn = deps.openBrowser ?? defaultOpenBrowser;
+  const state = randomBytes2(16).toString("hex");
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    const done = (r) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        server.close();
+      } catch {
       }
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014 confidence ${d.confidence.toFixed(2)}`;
-    case "version-mismatch":
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared ${d.extractedVersion}, observed engine ${d.observedVersion} (${d.compatibility})`;
-    case "host-mismatch":
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared host ${d.extractedHost}, observed host ${d.observedHost}`;
-    case "compat-violation":
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 ${d.rule.kind}${d.rule.package ? ` (${d.rule.package})` : ""}`;
-    case "observed-symbol-mismatch": {
-      const at = d.location ? ` at ${d.location}` : "";
-      const member = d.symbol ? ` ${d.symbol}` : "";
-      return `  \u2022 [${d.type}] ${d.source}${member}${at} (${d.mismatchKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
-    }
-    case "observed-failing": {
-      if (d.edgeType) {
-        const rate = d.errorRate !== void 0 ? ` ${Math.round(d.errorRate * 100)}% errors` : "";
-        return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014${rate} (${d.failureKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+      resolve(r);
+    };
+    const server = createServer((req, res) => {
+      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (reqUrl.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
       }
-      const at = d.location ? ` at ${d.location}` : "";
-      return `  \u2022 [${d.type}] ${d.source}${at} (${d.failureKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
-    }
-    case "deploy-mismatch": {
-      if (d.kind === "image") {
-        return `  \u2022 [${d.type}] ${d.source} \u2014 declared image ${d.declaredImage ?? "?"}, running ${d.observedImage ?? "?"} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      const token = reqUrl.searchParams.get("token");
+      const gotState = reqUrl.searchParams.get("state");
+      if (!token || gotState !== state) {
+        res.writeHead(400, { "content-type": "text/html" });
+        res.end("<h1>NEAT login failed</h1><p>Invalid or mismatched token. You can close this tab.</p>");
+        done({ error: { code: 1, message: "the browser returned an invalid or mismatched token" } });
+        return;
       }
-      return `  \u2022 [${d.type}] ${d.source} \u2014 declared ${d.declaredReplicas ?? "?"} replicas, ${d.observedReplicas ?? "?"} ready \u2014 confidence ${d.confidence.toFixed(2)}`;
+      res.writeHead(200, { "content-type": "text/html" });
+      res.end("<h1>You're logged in to NEAT.</h1><p>You can close this tab and return to the terminal.</p>");
+      done({ token });
+    });
+    server.on("error", (e) => done({ error: { code: 3, message: `couldn't start the local login listener \u2014 ${e.message}` } }));
+    timer = setTimeout(
+      () => done({ error: { code: 1, message: "timed out waiting for the browser login" } }),
+      opts.timeoutMs ?? CALLBACK_TIMEOUT_MS
+    );
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      const callback = `http://127.0.0.1:${port}/callback`;
+      const authUrl = `${webUrl}/cli/auth?callback=${encodeURIComponent(callback)}&state=${state}`;
+      out("Opening your browser to log in to NEAT\u2026");
+      out(`If it doesn't open, visit:
+  ${authUrl}`);
+      openFn(authUrl);
+    });
+  });
+}
+async function runSsoLogin(opts, deps) {
+  const out = deps.out ?? ((l) => console.log(l));
+  const err = deps.err ?? ((l) => console.error(l));
+  let accessToken = opts.ssoToken;
+  if (!accessToken) {
+    const lb = await loopbackReceiveToken(opts.webUrl, deps, { timeoutMs: opts.timeoutMs ?? CALLBACK_TIMEOUT_MS });
+    if ("error" in lb) {
+      err(`neat login: ${lb.error.message}`);
+      return lb.error.code;
     }
+    accessToken = lb.token;
   }
-}
-async function runDivergences(client, input) {
-  const params = new URLSearchParams();
-  if (input.type && input.type.length > 0) params.set("type", input.type.join(","));
-  if (input.minConfidence !== void 0) {
-    params.set("minConfidence", String(input.minConfidence));
-  }
-  if (input.node) params.set("node", input.node);
-  const qs = params.size > 0 ? `?${params.toString()}` : "";
-  const result = await client.get(
-    projectPath(input.project, `/graph/divergences${qs}`)
-  );
-  if (result.totalAffected === 0) {
-    return {
-      summary: "No divergences found between the declared (EXTRACTED) and observed (OBSERVED) views of the graph."
-    };
-  }
-  const headline = result.divergences[0];
-  const summary = `Found ${result.totalAffected} divergence${result.totalAffected === 1 ? "" : "s"} between code and production. Highest-confidence: ${headline.type} on ${headline.source} \u2192 ${headline.target}. ${headline.reason}`;
-  const blockLines = [];
-  for (const d of result.divergences) {
-    blockLines.push(formatDivergenceLine(d));
-    blockLines.push(`    reason: ${d.reason}`);
-    blockLines.push(`    recommendation: ${d.recommendation}`);
+  const ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  if ("error" in ex) {
+    err(`neat login: ${ex.error.message}`);
+    return ex.error.code;
   }
-  const maxConfidence = result.divergences.reduce(
-    (m, d) => Math.max(m, d.confidence),
-    0
-  );
-  return {
-    summary,
-    block: blockLines.join("\n"),
-    confidence: maxConfidence,
-    provenance: "composite (EXTRACTED + OBSERVED)"
-  };
-}
-async function runAsk(client, input) {
-  const result = await client.get(
-    projectPath(input.project, `/graph/ask?q=${encodeURIComponent(input.question)}`)
+  const { project, cred } = ex;
+  await upsertProfile(
+    { name: opts.name, endpoint: cred.endpoint, authToken: cred.authToken },
+    { makeActive: true, ...deps.home ? { home: deps.home } : {} }
   );
-  const blockLines = [];
-  if (result.matched.length > 0) {
-    blockLines.push(
-      `Matched: ${result.matched.map((m) => `${m.nodeId} [${m.via} ${m.score.toFixed(2)}]`).join(", ")}`
+  if (opts.json) {
+    out(
+      JSON.stringify(
+        {
+          status: "logged-in",
+          profile: opts.name,
+          project: project.name,
+          endpoint: cred.endpoint,
+          ...cred.ingestEndpoint ? { ingestEndpoint: cred.ingestEndpoint } : {}
+        },
+        null,
+        2
+      )
     );
-    blockLines.push(`Intent: ${result.intent}`);
-  } else if (result.scope === "global") {
-    blockLines.push(`Graph-wide answer (${result.intent}) \u2014 no entity named.`);
-  }
-  for (const section of result.sections) {
-    blockLines.push("", section.heading + ":");
-    for (const fact of section.facts) {
-      const tag = fact.provenance ? ` [${fact.provenance}${fact.confidence !== void 0 ? ` ${fact.confidence.toFixed(2)}` : ""}]` : fact.confidence !== void 0 ? ` [confidence ${fact.confidence.toFixed(2)}]` : "";
-      blockLines.push(`  \u2022 ${fact.text}${tag}`);
+  } else {
+    out(`Logged in \u2014 profile "${opts.name}" \u2192 ${project.name} (${cred.endpoint})`);
+    out("The neat CLI and the MCP server now read this hosted graph by default.");
+    if (cred.ingestEndpoint && cred.otelToken) {
+      out("");
+      out("To fill the OBSERVED layer, instrument your app to send OpenTelemetry to the hosted daemon:");
+      out(`  OTEL_EXPORTER_OTLP_ENDPOINT=${cred.ingestEndpoint}`);
+      out(`  OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ${cred.otelToken}`);
     }
+    out("Run `neat logout` to switch back to your local daemon.");
   }
-  return {
-    summary: result.answer,
-    block: blockLines.join("\n").trim(),
-    ...result.confidence !== void 0 ? { confidence: result.confidence } : {},
-    ...result.provenance.length > 0 ? { provenance: result.provenance } : {}
-  };
-}
-function formatFooter(confidence, provenance) {
-  const c = confidence === void 0 ? "n/a" : confidence.toFixed(2);
-  const p = provenance === void 0 ? "n/a" : Array.isArray(provenance) ? [...new Set(provenance)].join(", ") : provenance;
-  return `confidence: ${c} \xB7 provenance: ${p}`;
-}
-function formatHuman(result) {
-  const sections = [result.summary.trim()];
-  if (result.block && result.block.trim().length > 0) sections.push(result.block.trimEnd());
-  sections.push(formatFooter(result.confidence, result.provenance));
-  return sections.join("\n\n");
-}
-function formatJson(result) {
-  return JSON.stringify(
-    {
-      summary: result.summary,
-      block: result.block ?? "",
-      confidence: result.confidence ?? null,
-      provenance: result.provenance ?? null
-    },
-    null,
-    2
-  );
+  return 0;
 }
-function exitCodeForError(err) {
-  if (err instanceof TransportError) return 3;
-  if (err instanceof HttpError) return 1;
-  return 1;
+
+// src/hosted-connect-cli.ts
+function defaultOpenBrowser2(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn4(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
 }
-function createSnapshotPushClient(baseUrl, token) {
-  return createHttpClient(baseUrl, token && token.length > 0 ? token : void 0);
+function resolveCreds(env) {
+  const apiKey = env.NEAT_API_KEY;
+  const projectId = env.NEAT_CP_PROJECT_ID;
+  if (!apiKey) return { error: "not logged in \u2014 run `neat login`, or set NEAT_API_KEY (a neat_pat_\u2026 key)" };
+  if (!projectId) return { error: "no hosted project \u2014 run `neat login`, or set NEAT_CP_PROJECT_ID" };
+  return { cpUrl: resolveCpUrl(env).replace(/\/+$/, ""), apiKey, projectId };
 }
-async function pushSnapshotToRemote(input) {
-  const client = createSnapshotPushClient(input.baseUrl, input.token);
-  if (typeof client.post !== "function") {
-    throw new Error("HttpClient does not support POST \u2014 required for snapshot push");
+async function runConnectCommand(rawArgs, deps = {}) {
+  const env = deps.env ?? process.env;
+  const out = deps.out ?? ((l) => console.log(l));
+  const err = deps.err ?? ((l) => console.error(l));
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const open = deps.openBrowser ?? defaultOpenBrowser2;
+  const pollMs = deps.pollMs ?? 2e3;
+  const timeoutMs = deps.timeoutMs ?? 18e4;
+  const sleep2 = deps.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const provider = rawArgs.find((a) => !a.startsWith("-"));
+  if (!provider || rawArgs.includes("-h") || rawArgs.includes("--help")) {
+    out("usage: neat connect <provider>   connect a provider to your hosted NEAT project over OAuth");
+    out("  Opens the provider's consent screen in your browser and waits for the connection to land.");
+    out("  Needs a hosted login (`neat login`) or NEAT_CP_URL + NEAT_API_KEY + NEAT_CP_PROJECT_ID.");
+    out("  For a local/self-hosted daemon, use `neat connector add` instead.");
+    return provider ? 0 : 2;
+  }
+  const creds = resolveCreds(env);
+  if ("error" in creds) {
+    err(`neat connect: ${creds.error}`);
+    return 2;
   }
-  return client.post(
-    `/projects/${encodeURIComponent(input.project)}/snapshot`,
-    { snapshot: input.snapshot }
+  const connectionsUrl = `${creds.cpUrl}/me/projects/${encodeURIComponent(creds.projectId)}/connections`;
+  let authorizeUrl;
+  try {
+    const res = await fetchImpl(`${connectionsUrl}/${encodeURIComponent(provider)}/authorize`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${creds.apiKey}` }
+    });
+    if (res.status === 401) {
+      err("neat connect: not authorized \u2014 run `neat login` (or check NEAT_API_KEY).");
+      return 1;
+    }
+    if (res.status === 404 || res.status === 501) {
+      err(`neat connect: ${provider} isn't available to connect over OAuth yet.`);
+      return 1;
+    }
+    if (!res.ok) {
+      err(`neat connect: couldn't start connecting ${provider} (HTTP ${res.status}).`);
+      return 1;
+    }
+    const body = await res.json().catch(() => ({}));
+    if (!body.authorizeUrl) {
+      err(`neat connect: the control plane returned no authorize URL for ${provider}.`);
+      return 1;
+    }
+    authorizeUrl = body.authorizeUrl;
+  } catch (e) {
+    err(`neat connect: couldn't reach the control plane at ${creds.cpUrl} \u2014 ${e.message}`);
+    return 1;
+  }
+  out(`Opening ${provider}'s consent screen in your browser\u2026`);
+  if (!open(authorizeUrl)) out("Could not open a browser automatically \u2014 open this URL to authorize:");
+  out(`  ${authorizeUrl}`);
+  out("Waiting for you to authorize\u2026");
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await sleep2(pollMs);
+    try {
+      const res = await fetchImpl(connectionsUrl, { headers: { authorization: `Bearer ${creds.apiKey}` } });
+      if (res.ok) {
+        const conns = await res.json().catch(() => []);
+        const hit = Array.isArray(conns) ? conns.find((c) => c.provider === provider) : void 0;
+        if (hit) {
+          out(`\u2713 ${provider} connected${hit.status ? ` (${hit.status})` : ""}.`);
+          return 0;
+        }
+      }
+    } catch {
+    }
+  }
+  err(
+    `neat connect: timed out waiting for ${provider}. If you authorized, run \`neat connect ${provider}\` again to re-check \u2014 the connection may still land.`
   );
+  return 1;
 }
 
 // src/doctor-cli.ts
-function resolveDeps2(deps) {
+import { promises as fs11 } from "fs";
+import path12 from "path";
+
+// src/cli-client.ts
+import { Provenance as Provenance2 } from "@neat.is/types";
+var HttpError = class extends Error {
+  constructor(status, message, responseBody = "") {
+    super(message);
+    this.status = status;
+    this.responseBody = responseBody;
+    this.name = "HttpError";
+  }
+  status;
+  responseBody;
+};
+var TransportError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TransportError";
+  }
+};
+function resolveAuthToken(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  return t && t.length > 0 ? t : void 0;
+}
+function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
+  const root = baseUrl.replace(/\/$/, "");
+  const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    cwd: deps.cwd ?? process.cwd(),
-    env: deps.env ?? process.env,
-    nodeVersion: deps.nodeVersion ?? process.versions.node,
-    fetchImpl: deps.fetchImpl ?? fetch,
-    readRecord: deps.readRecord ?? readDaemonRecord,
-    out: deps.out ?? ((line) => console.log(line))
+    async get(path19) {
+      let res;
+      try {
+        res = await fetchImpl(`${root}${path19}`, {
+          headers: { ...authHeader }
+        });
+      } catch (err) {
+        throw new TransportError(
+          `cannot reach neat-core at ${root}: ${err.message}`
+        );
+      }
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new HttpError(
+          res.status,
+          `${res.status} ${res.statusText} on GET ${path19}: ${body}`,
+          body
+        );
+      }
+      return await res.json();
+    },
+    async post(path19, body) {
+      let res;
+      try {
+        res = await fetchImpl(`${root}${path19}`, {
+          method: "POST",
+          headers: { "content-type": "application/json", ...authHeader },
+          body: JSON.stringify(body)
+        });
+      } catch (err) {
+        throw new TransportError(
+          `cannot reach neat-core at ${root}: ${err.message}`
+        );
+      }
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new HttpError(
+          res.status,
+          `${res.status} ${res.statusText} on POST ${path19}: ${text}`,
+          text
+        );
+      }
+      return await res.json();
+    }
   };
 }
-var NODE_FLOOR = 20;
-var HEALTH_TIMEOUT_MS = 3e3;
-function checkNode(nodeVersion) {
-  const major = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
-  const ok = Number.isFinite(major) && major >= NODE_FLOOR;
-  return ok ? { name: "node", ok, detail: `v${nodeVersion} (>= ${NODE_FLOOR} required)` } : {
-    name: "node",
-    ok,
-    detail: `v${nodeVersion} \u2014 NEAT needs Node ${NODE_FLOOR} or newer`,
-    fix: `install Node ${NODE_FLOOR}.x (e.g. \`nvm install ${NODE_FLOOR}\`) and re-run`
-  };
+function projectPath(project, suffix) {
+  if (!project) return suffix;
+  return `/projects/${encodeURIComponent(project)}${suffix}`;
 }
-async function neatOutExists(cwd) {
+async function runRootCause(client, input) {
+  const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
+  const path19 = projectPath(
+    input.project,
+    `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
+  );
   try {
-    const st = await fs10.stat(path11.join(cwd, "neat-out"));
-    return st.isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function checkProject(cwd, record) {
-  if (record) {
+    const result = await client.get(path19);
+    const arrowPath = result.traversalPath.join(" \u2190 ");
+    const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
+    const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
+    const blockLines = [
+      `Traversal path: ${arrowPath}`,
+      `Edge provenances: ${provenances}`
+    ];
+    if (result.fixRecommendation) blockLines.push(`Recommended fix: ${result.fixRecommendation}`);
     return {
-      name: "project",
-      ok: true,
-      detail: `"${record.project}" \u2014 set up in this directory (daemon record on REST ${record.ports.rest})`
+      summary,
+      block: blockLines.join("\n"),
+      confidence: result.confidence,
+      provenance: result.edgeProvenances.length ? result.edgeProvenances : void 0
     };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return {
+        summary: `No root cause found for ${input.errorNode}. The node may be healthy, or it may not exist in the graph.`
+      };
+    }
+    throw err;
   }
-  if (await neatOutExists(cwd)) {
+}
+async function runBlastRadius(client, input) {
+  const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
+  const path19 = projectPath(
+    input.project,
+    `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
+  );
+  try {
+    const result = await client.get(path19);
+    if (result.totalAffected === 0) {
+      return {
+        summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
+      };
+    }
+    const sorted = [...result.affectedNodes].sort(
+      (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+    );
+    const blockLines = sorted.map(formatBlastEntry);
+    const minConfidence = sorted.reduce(
+      (m, n) => Math.min(m, n.confidence),
+      Number.POSITIVE_INFINITY
+    );
+    const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
     return {
-      name: "project",
-      ok: true,
-      detail: "set up in this directory (no live daemon record \u2014 it may be stopped)"
+      summary: `Blast radius for ${result.origin}: ${result.totalAffected} dependent node${result.totalAffected === 1 ? "" : "s"} would break if it changed.`,
+      block: blockLines.join("\n"),
+      confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
+      provenance: provenances.length ? provenances : void 0
     };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId} not found in the graph.` };
+    }
+    throw err;
   }
-  return {
-    name: "project",
-    ok: false,
-    detail: "no NEAT project in this directory",
-    fix: "set one up: `neat .`"
-  };
 }
-function resolveHealthUrl(env, record) {
-  const explicit = env.NEAT_API_URL ?? env.NEAT_CORE_URL;
-  if (explicit && explicit.length > 0) return explicit.replace(/\/$/, "");
-  if (record) return `http://localhost:${record.ports.rest}`;
-  return "http://localhost:8080";
-}
-function summariseHealth(url, body) {
-  const projects = body.projects ?? [];
-  const nodes = projects.reduce((n, p) => n + (p.nodeCount ?? 0), 0);
-  const edges = projects.reduce((n, p) => n + (p.edgeCount ?? 0), 0);
-  const proj = body.project ?? projects[0]?.name;
-  const graph = projects.length > 0 ? ` \u2014 ${nodes} nodes / ${edges} edges` : "";
-  return `up at ${url}${proj ? ` (project "${proj}"${graph})` : ""}`;
+function formatBlastEntry(n) {
+  const tag = n.edgeProvenance === Provenance2.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
 }
-async function checkDaemon(deps, record) {
-  const url = resolveHealthUrl(deps.env, record);
-  const token = resolveAuthToken(deps.env);
-  const headers = token ? { authorization: `Bearer ${token}` } : {};
+async function runDependencies(client, input) {
+  const depth = input.depth ?? 3;
+  const path19 = projectPath(
+    input.project,
+    `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
+  );
   try {
-    const res = await deps.fetchImpl(`${url}/health`, {
-      headers,
-      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS)
-    });
-    if (res.status === 401 || res.status === 403) {
+    const result = await client.get(path19);
+    if (result.total === 0) {
       return {
-        name: "daemon",
-        ok: false,
-        detail: `up at ${url}, but rejected the request (${res.status})`,
-        fix: "set NEAT_AUTH_TOKEN to the daemon's token"
+        summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
       };
     }
-    if (!res.ok) {
-      return {
-        name: "daemon",
-        ok: false,
-        detail: `reachable at ${url} but /health returned ${res.status}`,
-        fix: "check the daemon logs"
-      };
+    const byDistance = /* @__PURE__ */ new Map();
+    for (const dep of result.dependencies) {
+      const ring = byDistance.get(dep.distance) ?? [];
+      ring.push(dep);
+      byDistance.set(dep.distance, ring);
     }
-    const body = await res.json().catch(() => ({}));
-    return { name: "daemon", ok: true, detail: summariseHealth(url, body) };
-  } catch {
-    return {
-      name: "daemon",
-      ok: false,
-      detail: `down \u2014 nothing answering at ${url}`,
-      fix: "start it: `neat .`  (or `neat watch`)"
-    };
+    const blockLines = [];
+    for (const distance of [...byDistance.keys()].sort((a, b) => a - b)) {
+      const label = distance === 1 ? "Direct (distance 1)" : `Distance ${distance}`;
+      blockLines.push(`${label}:`);
+      for (const dep of byDistance.get(distance)) {
+        blockLines.push(`  \u2022 ${dep.nodeId} \u2014 ${dep.edgeType} (${dep.provenance})`);
+      }
+    }
+    const provenances = [...new Set(result.dependencies.map((d) => d.provenance))];
+    const directCount = byDistance.get(1)?.length ?? 0;
+    const summary = depth === 1 ? `${input.nodeId} has ${directCount} direct dependenc${directCount === 1 ? "y" : "ies"}.` : `${input.nodeId} has ${result.total} dependenc${result.total === 1 ? "y" : "ies"} reachable to depth ${depth} (${directCount} direct).`;
+    return { summary, block: blockLines.join("\n"), provenance: provenances };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId} not found in the graph.` };
+    }
+    throw err;
   }
 }
-async function runDoctorChecks(deps = {}) {
-  const d = resolveDeps2(deps);
-  const record = await d.readRecord(d.cwd).catch(() => null);
-  return [checkNode(d.nodeVersion), await checkProject(d.cwd, record), await checkDaemon(d, record)];
+function observedDepLine(nodeId, e) {
+  const via = e.source !== nodeId ? ` (via ${e.source})` : "";
+  return `  \u2022 ${e.target} \u2014 ${e.type}${via}${edgeMeta(e)}`;
 }
-var NAME_COL = "project".length;
-function renderHuman(checks, out) {
-  out("neat doctor \u2014 checking this project's setup");
-  out("");
-  for (const c of checks) {
-    const mark = c.ok ? "\u2713" : "\u2717";
-    out(`  ${mark}  ${c.name.padEnd(NAME_COL)}  ${c.detail}`);
-    if (!c.ok && c.fix) out(`  ${" ".repeat(NAME_COL + 3)}fix: ${c.fix}`);
+async function runObservedDependencies(client, input) {
+  try {
+    const result = await client.get(
+      projectPath(
+        input.project,
+        `/graph/observed-dependencies/${encodeURIComponent(input.nodeId)}`
+      )
+    );
+    if (result.dependencies.length === 0) {
+      if (result.observed) {
+        return {
+          summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
+          provenance: Provenance2.OBSERVED
+        };
+      }
+      const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
+      return { summary: `No OBSERVED dependencies for ${input.nodeId}.${note}` };
+    }
+    const blockLines = result.dependencies.map((e) => observedDepLine(input.nodeId, e));
+    return {
+      summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
+      block: blockLines.join("\n"),
+      provenance: Provenance2.OBSERVED
+    };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId} not found in the graph.` };
+    }
+    throw err;
   }
-  out("");
-  const failed = checks.filter((c) => !c.ok).length;
-  out(failed === 0 ? "all good." : `${failed} check${failed === 1 ? "" : "s"} failed.`);
 }
-async function runDoctorCommand(argv, deps = {}) {
-  const out = deps.out ?? ((line) => console.log(line));
-  let json = false;
-  for (const arg of argv) {
-    if (arg === "--json") json = true;
-    else if (arg === "-h" || arg === "--help") {
-      out("usage: neat doctor [--json]");
-      out("  Probe this directory's NEAT setup: Node version, project, daemon.");
-      out("  Exit 0 when every check passes, 1 when any fails.");
-      return 0;
-    } else {
-      out(`neat doctor: unknown argument "${arg}"`);
-      return 2;
+function edgeMeta(e) {
+  const bits = [];
+  if (e.signal) {
+    bits.push(`spans=${e.signal.spanCount}`);
+    if (e.signal.errorCount > 0) bits.push(`errors=${e.signal.errorCount}`);
+    if (e.signal.lastObservedAgeMs !== void 0) {
+      bits.push(`age=${formatDuration(e.signal.lastObservedAgeMs)}`);
     }
+  } else if (e.callCount !== void 0) {
+    bits.push(`callCount=${e.callCount}`);
   }
-  const checks = await runDoctorChecks(deps);
-  if (json) out(JSON.stringify({ ok: checks.every((c) => c.ok), checks }, null, 2));
-  else renderHuman(checks, out);
-  return checks.every((c) => c.ok) ? 0 : 1;
-}
-
-// src/login-cli.ts
-import readline3 from "readline/promises";
-
-// src/profiles.ts
-import { promises as fs11 } from "fs";
-import os from "os";
-import path12 from "path";
-var PROFILES_CONFIG_VERSION = 1;
-function neatHome() {
-  const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path12.resolve(override);
-  return path12.join(os.homedir(), ".neat");
-}
-function profilesConfigPath(home = neatHome()) {
-  return path12.join(home, "profiles.json");
+  if (e.lastObserved) bits.push(`lastObserved=${e.lastObserved}`);
+  if (e.confidence !== void 0) bits.push(`confidence=${e.confidence}`);
+  return bits.length ? ` [${bits.join(", ")}]` : "";
 }
-function profilesConfigLockPath(home = neatHome()) {
-  return path12.join(home, "profiles.json.lock");
+function formatDuration(ms) {
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.round(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.round(m / 60);
+  if (h < 48) return `${h}h`;
+  return `${Math.round(h / 24)}d`;
 }
-var MODE_MASK_LOOSER_THAN_0600 = 63;
-async function warnIfModeLooserThan0600(file) {
-  if (process.platform === "win32") return;
+async function runIncidents(client, input) {
+  const path19 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const stat = await fs11.stat(file);
-    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
-      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
-      console.warn(
-        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's token calls for \u2014 run \`chmod 600 ${file}\``
-      );
+    const body = await client.get(path19);
+    const events = body.events;
+    if (events.length === 0) {
+      return {
+        summary: input.nodeId ? `No incidents recorded against ${input.nodeId}.` : "No incidents recorded."
+      };
     }
-  } catch {
-  }
-}
-async function readProfilesConfig(home = neatHome()) {
-  const file = profilesConfigPath(home);
-  let raw;
-  try {
-    raw = await fs11.readFile(file, "utf8");
+    const ordered = [...events].reverse().slice(0, input.limit ?? 20);
+    const blockLines = [];
+    for (const ev of ordered) {
+      blockLines.push(`  ${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`);
+      blockLines.push(`    trace=${ev.traceId} span=${ev.spanId}`);
+    }
+    const target = input.nodeId ?? "the project";
+    return {
+      summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
+      block: blockLines.join("\n"),
+      provenance: Provenance2.OBSERVED
+    };
   } catch (err) {
-    if (err.code === "ENOENT") {
-      return { version: PROFILES_CONFIG_VERSION, profiles: [] };
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId ?? ""} not found in the graph.` };
     }
     throw err;
   }
-  await warnIfModeLooserThan0600(file);
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`${file} is not valid JSON: ${err.message}`);
+}
+async function runSearch(client, input) {
+  const result = await client.get(
+    projectPath(input.project, `/search?q=${encodeURIComponent(input.query)}`)
+  );
+  if (result.matches.length === 0) {
+    return { summary: `No matches for "${input.query}".` };
   }
-  return validateConfig(parsed, file);
+  const provider = result.provider ?? "substring";
+  const blockLines = [];
+  let topScore;
+  for (const n of result.matches) {
+    const score = provider !== "substring" && typeof n.score === "number" ? n.score : void 0;
+    const scoreBit = score !== void 0 ? ` [score=${score.toFixed(2)}]` : "";
+    if (score !== void 0 && (topScore === void 0 || score > topScore)) topScore = score;
+    blockLines.push(
+      `  \u2022 ${n.id} (${n.type}) \u2014 ${n.name ?? n.id}${scoreBit}`
+    );
+  }
+  return {
+    summary: `Found ${result.matches.length} match${result.matches.length === 1 ? "" : "es"} for "${input.query}" via ${provider} provider.`,
+    block: blockLines.join("\n"),
+    confidence: topScore
+  };
 }
-function validateConfig(parsed, file) {
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new Error(`${file} must be a JSON object with a "profiles" array`);
+async function runDiff(client, input) {
+  const result = await client.get(
+    projectPath(
+      input.project,
+      `/graph/diff?against=${encodeURIComponent(input.againstSnapshot)}`
+    )
+  );
+  const total = result.added.nodes.length + result.added.edges.length + result.removed.nodes.length + result.removed.edges.length + result.changed.nodes.length + result.changed.edges.length;
+  const baseLabel = result.base.exportedAt ?? "unknown";
+  if (total === 0) {
+    return {
+      summary: `No differences between the current graph and ${input.againstSnapshot} (base exportedAt=${baseLabel}).`
+    };
   }
-  const obj = parsed;
-  const version = obj.version === void 0 ? PROFILES_CONFIG_VERSION : obj.version;
-  if (typeof version !== "number" || !Number.isInteger(version)) {
-    throw new Error(`${file}: "version" must be an integer`);
+  const blockLines = [
+    `  base exportedAt:    ${baseLabel}`,
+    `  current exportedAt: ${result.current.exportedAt}`,
+    ""
+  ];
+  if (result.added.nodes.length || result.added.edges.length) {
+    blockLines.push("Added:");
+    for (const n of result.added.nodes) blockLines.push(`  + node ${n.id} (${n.type})`);
+    for (const e of result.added.edges)
+      blockLines.push(`  + edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
+    blockLines.push("");
   }
-  const rawProfiles = obj.profiles;
-  if (!Array.isArray(rawProfiles)) {
-    throw new Error(`${file}: "profiles" must be an array`);
+  if (result.removed.nodes.length || result.removed.edges.length) {
+    blockLines.push("Removed:");
+    for (const n of result.removed.nodes) blockLines.push(`  - node ${n.id} (${n.type})`);
+    for (const e of result.removed.edges)
+      blockLines.push(`  - edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
+    blockLines.push("");
   }
-  const profiles = rawProfiles.map((entry2, i) => validateEntry(entry2, i, file));
-  const seen = /* @__PURE__ */ new Set();
-  for (const p of profiles) {
-    if (seen.has(p.name)) throw new Error(`${file}: duplicate profile name "${p.name}"`);
-    seen.add(p.name);
+  if (result.changed.nodes.length || result.changed.edges.length) {
+    blockLines.push("Changed:");
+    for (const c of result.changed.nodes) {
+      blockLines.push(`  ~ node ${c.id} \u2014 ${summariseAttrDiff(c.before, c.after)}`);
+    }
+    for (const c of result.changed.edges) {
+      const provBit = c.before.provenance !== c.after.provenance ? `provenance ${c.before.provenance} \u2192 ${c.after.provenance}` : summariseAttrDiff(c.before, c.after);
+      blockLines.push(`  ~ edge ${c.id} \u2014 ${provBit}`);
+    }
   }
-  let active;
-  if (obj.active !== void 0) {
-    if (typeof obj.active !== "string" || obj.active.length === 0) {
-      throw new Error(`${file}: "active" must be a non-empty string when present`);
+  return {
+    summary: `Diff against ${input.againstSnapshot}: ${total} change${total === 1 ? "" : "s"} between the snapshot and the live graph.`,
+    block: blockLines.join("\n").trimEnd()
+  };
+}
+function summariseAttrDiff(before, after) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+  const changed = [];
+  for (const k of keys) {
+    if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) changed.push(k);
+  }
+  return changed.length === 0 ? "attributes differ" : `fields changed: ${changed.sort().join(", ")}`;
+}
+async function runStaleEdges(client, input) {
+  const params = new URLSearchParams();
+  if (input.limit !== void 0) params.set("limit", String(input.limit));
+  if (input.edgeType) params.set("edgeType", input.edgeType);
+  const qs = params.size > 0 ? `?${params.toString()}` : "";
+  const body = await client.get(
+    projectPath(input.project, `/stale-events${qs}`)
+  );
+  const events = body.events;
+  if (events.length === 0) {
+    return {
+      summary: input.edgeType ? `No stale ${input.edgeType} edges recorded.` : "No stale-edge transitions recorded yet."
+    };
+  }
+  const blockLines = events.map(
+    (e) => `  ${e.transitionedAt} \u2014 ${e.source} -[${e.edgeType}]-> ${e.target} (last seen ${e.lastObserved}, threshold ${formatDuration(e.thresholdMs)})`
+  );
+  return {
+    summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
+    block: blockLines.join("\n"),
+    provenance: Provenance2.STALE
+  };
+}
+async function runPolicies(client, input) {
+  let violations;
+  let allowed = true;
+  let hypothetical;
+  if (input.hypotheticalAction) {
+    if (typeof client.post !== "function") {
+      throw new Error("HttpClient does not support POST \u2014 required for policies dry-run");
     }
-    active = seen.has(obj.active) ? obj.active : void 0;
+    const body = await client.post(
+      projectPath(input.project, "/policies/check"),
+      { hypotheticalAction: input.hypotheticalAction }
+    );
+    violations = body.violations;
+    allowed = body.allowed;
+    hypothetical = body.hypotheticalAction;
+  } else {
+    const params = new URLSearchParams();
+    if (input.policyId) params.set("policyId", input.policyId);
+    const qs = params.size > 0 ? `?${params.toString()}` : "";
+    const body = await client.get(
+      projectPath(input.project, `/policies/violations${qs}`)
+    );
+    violations = body.violations;
+    allowed = violations.every((v) => v.onViolation !== "block");
   }
-  return { version, ...active ? { active } : {}, profiles };
+  if (input.nodeId) {
+    violations = violations.filter(
+      (v) => v.subject.nodeId === input.nodeId || v.subject.path?.includes(input.nodeId)
+    );
+  }
+  if (violations.length === 0) {
+    return {
+      summary: hypothetical ? `No violations would result from the hypothetical action (${hypothetical.kind}).` : "No policy violations recorded."
+    };
+  }
+  const blockCount = violations.filter((v) => v.onViolation === "block").length;
+  const summaryParts = [];
+  if (hypothetical) {
+    summaryParts.push(
+      `Hypothetical ${hypothetical.kind} would surface ${violations.length} violation${violations.length === 1 ? "" : "s"}`
+    );
+  } else {
+    summaryParts.push(
+      `${violations.length} policy violation${violations.length === 1 ? "" : "s"} currently recorded`
+    );
+  }
+  if (blockCount > 0) summaryParts.push(`${blockCount} of which block`);
+  if (!allowed && hypothetical) summaryParts.push("action denied");
+  const summary = summaryParts.join("; ") + ".";
+  const blockLines = violations.map((v) => {
+    const subject = v.subject.nodeId ?? v.subject.edgeId ?? v.subject.path?.[0] ?? "(global)";
+    return `  \u2022 [${v.severity}/${v.onViolation}] ${v.policyName}: ${v.message} \u2014 ${subject}`;
+  });
+  const severities = [...new Set(violations.map((v) => v.severity))];
+  return {
+    summary,
+    block: blockLines.join("\n"),
+    confidence: hypothetical ? 0.7 : 1,
+    provenance: severities.join(" ")
+  };
 }
-function validateEntry(entry2, index, file) {
-  const where = `${file}: profiles[${index}]`;
-  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
-    throw new Error(`${where} must be an object`);
+function formatDivergenceLine(d) {
+  switch (d.type) {
+    case "missing-observed":
+    case "missing-extracted":
+      if (d.column) {
+        return `  \u2022 [${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+    case "version-mismatch":
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared ${d.extractedVersion}, observed engine ${d.observedVersion} (${d.compatibility})`;
+    case "host-mismatch":
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared host ${d.extractedHost}, observed host ${d.observedHost}`;
+    case "compat-violation":
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 ${d.rule.kind}${d.rule.package ? ` (${d.rule.package})` : ""}`;
+    case "observed-symbol-mismatch": {
+      const at = d.location ? ` at ${d.location}` : "";
+      const member = d.symbol ? ` ${d.symbol}` : "";
+      return `  \u2022 [${d.type}] ${d.source}${member}${at} (${d.mismatchKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+    }
+    case "observed-failing": {
+      if (d.edgeType) {
+        const rate = d.errorRate !== void 0 ? ` ${Math.round(d.errorRate * 100)}% errors` : "";
+        return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014${rate} (${d.failureKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
+      const at = d.location ? ` at ${d.location}` : "";
+      return `  \u2022 [${d.type}] ${d.source}${at} (${d.failureKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+    }
+    case "deploy-mismatch": {
+      if (d.kind === "image") {
+        return `  \u2022 [${d.type}] ${d.source} \u2014 declared image ${d.declaredImage ?? "?"}, running ${d.observedImage ?? "?"} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
+      return `  \u2022 [${d.type}] ${d.source} \u2014 declared ${d.declaredReplicas ?? "?"} replicas, ${d.observedReplicas ?? "?"} ready \u2014 confidence ${d.confidence.toFixed(2)}`;
+    }
   }
-  const e = entry2;
-  const name = e.name;
-  if (typeof name !== "string" || name.length === 0) {
-    throw new Error(`${where}.name must be a non-empty string`);
+}
+async function runDivergences(client, input) {
+  const params = new URLSearchParams();
+  if (input.type && input.type.length > 0) params.set("type", input.type.join(","));
+  if (input.minConfidence !== void 0) {
+    params.set("minConfidence", String(input.minConfidence));
   }
-  const endpoint = e.endpoint;
-  if (typeof endpoint !== "string" || endpoint.length === 0) {
-    throw new Error(`${where}.endpoint must be a non-empty string`);
+  if (input.node) params.set("node", input.node);
+  const qs = params.size > 0 ? `?${params.toString()}` : "";
+  const result = await client.get(
+    projectPath(input.project, `/graph/divergences${qs}`)
+  );
+  if (result.totalAffected === 0) {
+    return {
+      summary: "No divergences found between the declared (EXTRACTED) and observed (OBSERVED) views of the graph."
+    };
   }
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(endpoint);
-  } catch {
-    throw new Error(`${where}.endpoint must be an absolute URL (got "${endpoint}")`);
+  const headline = result.divergences[0];
+  const summary = `Found ${result.totalAffected} divergence${result.totalAffected === 1 ? "" : "s"} between code and production. Highest-confidence: ${headline.type} on ${headline.source} \u2192 ${headline.target}. ${headline.reason}`;
+  const blockLines = [];
+  for (const d of result.divergences) {
+    blockLines.push(formatDivergenceLine(d));
+    blockLines.push(`    reason: ${d.reason}`);
+    blockLines.push(`    recommendation: ${d.recommendation}`);
   }
-  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
-    throw new Error(`${where}.endpoint must be an http(s) URL (got "${parsedUrl.protocol}")`);
+  const maxConfidence = result.divergences.reduce(
+    (m, d) => Math.max(m, d.confidence),
+    0
+  );
+  return {
+    summary,
+    block: blockLines.join("\n"),
+    confidence: maxConfidence,
+    provenance: "composite (EXTRACTED + OBSERVED)"
+  };
+}
+async function runAsk(client, input) {
+  const result = await client.get(
+    projectPath(input.project, `/graph/ask?q=${encodeURIComponent(input.question)}`)
+  );
+  const blockLines = [];
+  if (result.matched.length > 0) {
+    blockLines.push(
+      `Matched: ${result.matched.map((m) => `${m.nodeId} [${m.via} ${m.score.toFixed(2)}]`).join(", ")}`
+    );
+    blockLines.push(`Intent: ${result.intent}`);
+  } else if (result.scope === "global") {
+    blockLines.push(`Graph-wide answer (${result.intent}) \u2014 no entity named.`);
   }
-  if (e.authToken !== void 0 && (typeof e.authToken !== "string" || e.authToken.length === 0)) {
-    throw new Error(`${where}.authToken must be a non-empty string when present`);
+  for (const section of result.sections) {
+    blockLines.push("", section.heading + ":");
+    for (const fact of section.facts) {
+      const tag = fact.provenance ? ` [${fact.provenance}${fact.confidence !== void 0 ? ` ${fact.confidence.toFixed(2)}` : ""}]` : fact.confidence !== void 0 ? ` [confidence ${fact.confidence.toFixed(2)}]` : "";
+      blockLines.push(`  \u2022 ${fact.text}${tag}`);
+    }
   }
   return {
-    name,
-    endpoint,
-    ...typeof e.authToken === "string" ? { authToken: e.authToken } : {}
+    summary: result.answer,
+    block: blockLines.join("\n").trim(),
+    ...result.confidence !== void 0 ? { confidence: result.confidence } : {},
+    ...result.provenance.length > 0 ? { provenance: result.provenance } : {}
   };
 }
-async function resolveProfile(name, home = neatHome()) {
-  const { profiles } = await readProfilesConfig(home);
-  return profiles.find((p) => p.name === name);
-}
-async function getActiveProfile(home = neatHome()) {
-  const { active, profiles } = await readProfilesConfig(home);
-  if (!active) return void 0;
-  return profiles.find((p) => p.name === active);
+function formatFooter(confidence, provenance) {
+  const c = confidence === void 0 ? "n/a" : confidence.toFixed(2);
+  const p = provenance === void 0 ? "n/a" : Array.isArray(provenance) ? [...new Set(provenance)].join(", ") : provenance;
+  return `confidence: ${c} \xB7 provenance: ${p}`;
 }
-function serialize(config) {
-  const names = new Set(config.profiles.map((p) => p.name));
-  const active = config.active && names.has(config.active) ? config.active : void 0;
-  const out = {
-    version: config.version ?? PROFILES_CONFIG_VERSION,
-    ...active ? { active } : {},
-    profiles: config.profiles
-  };
-  return `${JSON.stringify(out, null, 2)}
-`;
+function formatHuman(result) {
+  const sections = [result.summary.trim()];
+  if (result.block && result.block.trim().length > 0) sections.push(result.block.trimEnd());
+  sections.push(formatFooter(result.confidence, result.provenance));
+  return sections.join("\n\n");
 }
-async function writeConfigAtomic(config, home) {
-  const file = profilesConfigPath(home);
-  await fs11.mkdir(path12.dirname(file), { recursive: true });
-  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-  const fd = await fs11.open(tmp, "w", 384);
-  try {
-    await fd.writeFile(serialize(config), "utf8");
-    await fd.sync();
-  } finally {
-    await fd.close();
-  }
-  await fs11.rename(tmp, file);
+function formatJson(result) {
+  return JSON.stringify(
+    {
+      summary: result.summary,
+      block: result.block ?? "",
+      confidence: result.confidence ?? null,
+      provenance: result.provenance ?? null
+    },
+    null,
+    2
+  );
 }
-var LOCK_RETRY_MS = 50;
-var LOCK_TIMEOUT_MS = 5e3;
-async function acquireLock(lockPath) {
-  await fs11.mkdir(path12.dirname(lockPath), { recursive: true });
-  const deadline = Date.now() + LOCK_TIMEOUT_MS;
-  for (; ; ) {
-    try {
-      const fd = await fs11.open(lockPath, "wx");
-      await fd.writeFile(`${process.pid}
-`, "utf8");
-      await fd.close();
-      return;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      if (Date.now() >= deadline) {
-        throw new Error(
-          `timed out acquiring ${lockPath} after ${LOCK_TIMEOUT_MS}ms \u2014 if no other neat process is running, remove the stale lock file`
-        );
-      }
-      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
-    }
-  }
+function exitCodeForError(err) {
+  if (err instanceof TransportError) return 3;
+  if (err instanceof HttpError) return 1;
+  return 1;
 }
-async function releaseLock(lockPath) {
-  await fs11.rm(lockPath, { force: true });
+function createSnapshotPushClient(baseUrl, token, fetchImpl) {
+  return createHttpClient(baseUrl, token && token.length > 0 ? token : void 0, fetchImpl);
 }
-async function withProfilesLock(home, fn) {
-  const lockPath = profilesConfigLockPath(home);
-  await acquireLock(lockPath);
+async function resolveRemoteProjectName(input, fetchImpl) {
+  const client = createSnapshotPushClient(input.baseUrl, input.token, fetchImpl);
   try {
-    return await fn();
-  } finally {
-    await releaseLock(lockPath);
+    const projects = await client.get("/projects");
+    const hosted = Array.isArray(projects) ? projects.find((p) => p?.hostedHere) : void 0;
+    return hosted?.name ?? input.fallback;
+  } catch {
+    return input.fallback;
   }
 }
-async function upsertProfile(profile, opts = {}) {
-  const home = opts.home ?? neatHome();
-  const validated = validateEntry(profile, 0, profilesConfigPath(home));
-  await withProfilesLock(home, async () => {
-    const config = await readProfilesConfig(home);
-    const others = config.profiles.filter((p) => p.name !== validated.name);
-    const profiles = [...others, validated];
-    const makeActive = opts.makeActive ?? config.profiles.length === 0;
-    const active = makeActive ? validated.name : config.active;
-    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
-  });
-}
-async function removeProfile(name, home = neatHome()) {
-  return withProfilesLock(home, async () => {
-    const config = await readProfilesConfig(home);
-    const profiles = config.profiles.filter((p) => p.name !== name);
-    if (profiles.length === config.profiles.length) return false;
-    const active = config.active === name ? void 0 : config.active;
-    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
-    return true;
-  });
-}
-async function clearActiveProfile(home = neatHome()) {
-  return withProfilesLock(home, async () => {
-    const config = await readProfilesConfig(home);
-    if (!config.active) return false;
-    await writeConfigAtomic({ version: config.version, profiles: config.profiles }, home);
-    return true;
-  });
+async function pushSnapshotToRemote(input) {
+  const client = createSnapshotPushClient(input.baseUrl, input.token);
+  if (typeof client.post !== "function") {
+    throw new Error("HttpClient does not support POST \u2014 required for snapshot push");
+  }
+  return client.post(
+    `/projects/${encodeURIComponent(input.project)}/snapshot`,
+    { snapshot: input.snapshot }
+  );
 }
 
-// src/login-sso.ts
-import { createServer } from "http";
-import { spawn as spawn3 } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_CP_URL = "https://neat-control-plane-bg5yqctn2q-nw.a.run.app";
-var DEFAULT_WEB_URL = "https://app.neat.is";
-var CALLBACK_TIMEOUT_MS = 5 * 6e4;
-function resolveCpUrl(env = process.env, override) {
-  const v = override ?? env.NEAT_CP_URL;
-  return (v && v.length > 0 ? v : DEFAULT_CP_URL).replace(/\/+$/, "");
-}
-function resolveWebUrl(env = process.env, override) {
-  const v = override ?? env.NEAT_WEB_URL;
-  return (v && v.length > 0 ? v : DEFAULT_WEB_URL).replace(/\/+$/, "");
-}
-function pickProject(projects, want) {
-  if (want) {
-    const p = projects.find((x) => x.id === want || x.name === want);
-    if (!p) return { error: { code: 1, message: `no project named or id'd "${want}" on this account` } };
-    return { project: p };
-  }
-  const running = projects.filter((p) => p.status === "running");
-  if (running.length === 1) return { project: running[0] };
-  if (running.length === 0) {
-    const listed = projects.length ? ` (have: ${projects.map((p) => `${p.name} [${p.status}]`).join(", ")})` : "";
-    return {
-      error: {
-        code: 1,
-        message: `no running project to connect to \u2014 create + provision one in the console first${listed}`
-      }
-    };
-  }
+// src/doctor-cli.ts
+function resolveDeps2(deps) {
   return {
-    error: {
-      code: 2,
-      message: `several running projects \u2014 pass --project <name>: ${running.map((p) => p.name).join(", ")}`
-    }
-  };
-}
-async function exchangeCredential(cpUrl, accessToken, opts, deps) {
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const auth = { authorization: `Bearer ${accessToken}` };
-  let meRes;
-  try {
-    meRes = await fetchImpl(`${cpUrl}/me`, { headers: auth });
-  } catch (e) {
-    return { error: { code: 3, message: `can't reach the control plane at ${cpUrl} \u2014 ${e.message}` } };
-  }
-  if (meRes.status === 401) return { error: { code: 1, message: "your session is expired or invalid \u2014 log in again" } };
-  if (!meRes.ok) return { error: { code: 1, message: `the control plane returned HTTP ${meRes.status} on /me` } };
-  const me = await meRes.json().catch(() => ({}));
-  const projects = Array.isArray(me.projects) ? me.projects : [];
-  const picked = pickProject(projects, opts.project);
-  if ("error" in picked) return picked;
-  const project = picked.project;
-  let credRes;
+    cwd: deps.cwd ?? process.cwd(),
+    env: deps.env ?? process.env,
+    nodeVersion: deps.nodeVersion ?? process.versions.node,
+    fetchImpl: deps.fetchImpl ?? fetch,
+    readRecord: deps.readRecord ?? readDaemonRecord,
+    out: deps.out ?? ((line) => console.log(line))
+  };
+}
+var NODE_FLOOR = 20;
+var HEALTH_TIMEOUT_MS = 3e3;
+function checkNode(nodeVersion) {
+  const major = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
+  const ok = Number.isFinite(major) && major >= NODE_FLOOR;
+  return ok ? { name: "node", ok, detail: `v${nodeVersion} (>= ${NODE_FLOOR} required)` } : {
+    name: "node",
+    ok,
+    detail: `v${nodeVersion} \u2014 NEAT needs Node ${NODE_FLOOR} or newer`,
+    fix: `install Node ${NODE_FLOOR}.x (e.g. \`nvm install ${NODE_FLOOR}\`) and re-run`
+  };
+}
+async function neatOutExists(cwd) {
   try {
-    credRes = await fetchImpl(`${cpUrl}/me/projects/${encodeURIComponent(project.id)}/cli-credential`, {
-      headers: auth
-    });
-  } catch (e) {
-    return { error: { code: 3, message: `can't reach the control plane \u2014 ${e.message}` } };
+    const st = await fs11.stat(path12.join(cwd, "neat-out"));
+    return st.isDirectory();
+  } catch {
+    return false;
   }
-  if (credRes.status === 409) {
+}
+async function checkProject(cwd, record) {
+  if (record) {
     return {
-      error: {
-        code: 1,
-        message: `project "${project.name}" isn't provisioned yet (status: ${project.status}) \u2014 provision it first`
-      }
+      name: "project",
+      ok: true,
+      detail: `"${record.project}" \u2014 set up in this directory (daemon record on REST ${record.ports.rest})`
     };
   }
-  if (credRes.status === 404) return { error: { code: 1, message: `project "${project.name}" was not found, or isn't yours` } };
-  if (credRes.status === 401) return { error: { code: 1, message: "your session is expired or invalid \u2014 log in again" } };
-  if (!credRes.ok) return { error: { code: 1, message: `the control plane returned HTTP ${credRes.status} for the credential` } };
-  const cred = await credRes.json().catch(() => ({}));
-  if (!cred.endpoint || !cred.authToken) {
-    return { error: { code: 1, message: "the credential response was missing endpoint/authToken" } };
+  if (await neatOutExists(cwd)) {
+    return {
+      name: "project",
+      ok: true,
+      detail: "set up in this directory (no live daemon record \u2014 it may be stopped)"
+    };
   }
-  return { project, cred };
+  return {
+    name: "project",
+    ok: false,
+    detail: "no NEAT project in this directory",
+    fix: "set one up: `neat .`"
+  };
 }
-function defaultOpenBrowser(url) {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+function resolveHealthUrl(env, record) {
+  const explicit = env.NEAT_API_URL ?? env.NEAT_CORE_URL;
+  if (explicit && explicit.length > 0) return explicit.replace(/\/$/, "");
+  if (record) return `http://localhost:${record.ports.rest}`;
+  return "http://localhost:8080";
+}
+function summariseHealth(url, body) {
+  const projects = body.projects ?? [];
+  const nodes = projects.reduce((n, p) => n + (p.nodeCount ?? 0), 0);
+  const edges = projects.reduce((n, p) => n + (p.edgeCount ?? 0), 0);
+  const proj = body.project ?? projects[0]?.name;
+  const graph = projects.length > 0 ? ` \u2014 ${nodes} nodes / ${edges} edges` : "";
+  return `up at ${url}${proj ? ` (project "${proj}"${graph})` : ""}`;
+}
+async function checkDaemon(deps, record) {
+  const url = resolveHealthUrl(deps.env, record);
+  const token = resolveAuthToken(deps.env);
+  const headers = token ? { authorization: `Bearer ${token}` } : {};
   try {
-    const child = spawn3(cmd, args, { detached: true, stdio: "ignore" });
-    child.on("error", () => {
+    const res = await deps.fetchImpl(`${url}/health`, {
+      headers,
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS)
     });
-    child.unref();
-    return true;
+    if (res.status === 401 || res.status === 403) {
+      return {
+        name: "daemon",
+        ok: false,
+        detail: `up at ${url}, but rejected the request (${res.status})`,
+        fix: "set NEAT_AUTH_TOKEN to the daemon's token"
+      };
+    }
+    if (!res.ok) {
+      return {
+        name: "daemon",
+        ok: false,
+        detail: `reachable at ${url} but /health returned ${res.status}`,
+        fix: "check the daemon logs"
+      };
+    }
+    const body = await res.json().catch(() => ({}));
+    return { name: "daemon", ok: true, detail: summariseHealth(url, body) };
   } catch {
-    return false;
+    return {
+      name: "daemon",
+      ok: false,
+      detail: `down \u2014 nothing answering at ${url}`,
+      fix: "start it: `neat .`  (or `neat watch`)"
+    };
   }
 }
-async function loopbackReceiveToken(webUrl, deps, opts = {}) {
-  const out = deps.out ?? (() => {
-  });
-  const openFn = deps.openBrowser ?? defaultOpenBrowser;
-  const state = randomBytes2(16).toString("hex");
-  return new Promise((resolve) => {
-    let settled = false;
-    let timer;
-    const done = (r) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      try {
-        server.close();
-      } catch {
-      }
-      resolve(r);
-    };
-    const server = createServer((req, res) => {
-      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (reqUrl.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      const token = reqUrl.searchParams.get("token");
-      const gotState = reqUrl.searchParams.get("state");
-      if (!token || gotState !== state) {
-        res.writeHead(400, { "content-type": "text/html" });
-        res.end("<h1>NEAT login failed</h1><p>Invalid or mismatched token. You can close this tab.</p>");
-        done({ error: { code: 1, message: "the browser returned an invalid or mismatched token" } });
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html" });
-      res.end("<h1>You're logged in to NEAT.</h1><p>You can close this tab and return to the terminal.</p>");
-      done({ token });
-    });
-    server.on("error", (e) => done({ error: { code: 3, message: `couldn't start the local login listener \u2014 ${e.message}` } }));
-    timer = setTimeout(
-      () => done({ error: { code: 1, message: "timed out waiting for the browser login" } }),
-      opts.timeoutMs ?? CALLBACK_TIMEOUT_MS
-    );
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      const callback = `http://127.0.0.1:${port}/callback`;
-      const authUrl = `${webUrl}/cli/auth?callback=${encodeURIComponent(callback)}&state=${state}`;
-      out("Opening your browser to log in to NEAT\u2026");
-      out(`If it doesn't open, visit:
-  ${authUrl}`);
-      openFn(authUrl);
-    });
-  });
+async function runDoctorChecks(deps = {}) {
+  const d = resolveDeps2(deps);
+  const record = await d.readRecord(d.cwd).catch(() => null);
+  return [checkNode(d.nodeVersion), await checkProject(d.cwd, record), await checkDaemon(d, record)];
 }
-async function runSsoLogin(opts, deps) {
-  const out = deps.out ?? ((l) => console.log(l));
-  const err = deps.err ?? ((l) => console.error(l));
-  let accessToken = opts.ssoToken;
-  if (!accessToken) {
-    const lb = await loopbackReceiveToken(opts.webUrl, deps, { timeoutMs: opts.timeoutMs ?? CALLBACK_TIMEOUT_MS });
-    if ("error" in lb) {
-      err(`neat login: ${lb.error.message}`);
-      return lb.error.code;
-    }
-    accessToken = lb.token;
-  }
-  const ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
-  if ("error" in ex) {
-    err(`neat login: ${ex.error.message}`);
-    return ex.error.code;
+var NAME_COL = "project".length;
+function renderHuman(checks, out) {
+  out("neat doctor \u2014 checking this project's setup");
+  out("");
+  for (const c of checks) {
+    const mark = c.ok ? "\u2713" : "\u2717";
+    out(`  ${mark}  ${c.name.padEnd(NAME_COL)}  ${c.detail}`);
+    if (!c.ok && c.fix) out(`  ${" ".repeat(NAME_COL + 3)}fix: ${c.fix}`);
   }
-  const { project, cred } = ex;
-  await upsertProfile(
-    { name: opts.name, endpoint: cred.endpoint, authToken: cred.authToken },
-    { makeActive: true, ...deps.home ? { home: deps.home } : {} }
-  );
-  if (opts.json) {
-    out(
-      JSON.stringify(
-        {
-          status: "logged-in",
-          profile: opts.name,
-          project: project.name,
-          endpoint: cred.endpoint,
-          ...cred.ingestEndpoint ? { ingestEndpoint: cred.ingestEndpoint } : {}
-        },
-        null,
-        2
-      )
-    );
-  } else {
-    out(`Logged in \u2014 profile "${opts.name}" \u2192 ${project.name} (${cred.endpoint})`);
-    out("The neat CLI and the MCP server now read this hosted graph by default.");
-    if (cred.ingestEndpoint && cred.otelToken) {
-      out("");
-      out("To fill the OBSERVED layer, instrument your app to send OpenTelemetry to the hosted daemon:");
-      out(`  OTEL_EXPORTER_OTLP_ENDPOINT=${cred.ingestEndpoint}`);
-      out(`  OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ${cred.otelToken}`);
+  out("");
+  const failed = checks.filter((c) => !c.ok).length;
+  out(failed === 0 ? "all good." : `${failed} check${failed === 1 ? "" : "s"} failed.`);
+}
+async function runDoctorCommand(argv, deps = {}) {
+  const out = deps.out ?? ((line) => console.log(line));
+  let json = false;
+  for (const arg of argv) {
+    if (arg === "--json") json = true;
+    else if (arg === "-h" || arg === "--help") {
+      out("usage: neat doctor [--json]");
+      out("  Probe this directory's NEAT setup: Node version, project, daemon.");
+      out("  Exit 0 when every check passes, 1 when any fails.");
+      return 0;
+    } else {
+      out(`neat doctor: unknown argument "${arg}"`);
+      return 2;
     }
-    out("Run `neat logout` to switch back to your local daemon.");
   }
-  return 0;
+  const checks = await runDoctorChecks(deps);
+  if (json) out(JSON.stringify({ ok: checks.every((c) => c.ok), checks }, null, 2));
+  else renderHuman(checks, out);
+  return checks.every((c) => c.ok) ? 0 : 1;
 }
 
 // src/login-cli.ts
+import readline3 from "readline/promises";
 var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
 var PROBE_TOTAL_BUDGET_MS = 12e4;
 var PROBE_RETRY_PAUSE_MS = 2e3;
@@ -7781,6 +7893,14 @@ async function checkDaemonHealth(baseUrl) {
     return false;
   }
 }
+function daemonHint(body) {
+  try {
+    const parsed = JSON.parse(body);
+    return typeof parsed.hint === "string" ? parsed.hint : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function snapshotForGraph(persisted) {
   return {
     // Stamp the live schema version the daemon validates against on the
@@ -7848,21 +7968,34 @@ async function runSync(opts) {
   let daemonState = "skipped";
   let exitCode = 0;
   const mode = opts.dryRun ? "dry-run" : opts.to ? "remote" : "local";
+  let pushedProject = entry2.name;
   if (!opts.dryRun) {
     const snapshot = snapshotForGraph(persisted);
     if (opts.to) {
       const token = opts.token ?? process.env.NEAT_REMOTE_TOKEN;
+      pushedProject = await resolveRemoteProjectName({
+        baseUrl: opts.to,
+        token,
+        fallback: entry2.name
+      });
       try {
         await pushSnapshotToRemote({
           baseUrl: opts.to,
           token,
-          project: entry2.name,
+          project: pushedProject,
           snapshot
         });
         daemonState = "remote-ok";
       } catch (err) {
         if (err instanceof HttpError) {
-          console.error(`neat sync: ${err.message}`);
+          if (err.status === 404) {
+            const hint = daemonHint(err.responseBody);
+            console.error(
+              `neat sync: the daemon at ${opts.to} has no project "${pushedProject}" to receive this snapshot. ` + (hint ?? "GET /projects lists what it serves (see hostedHere).")
+            );
+          } else {
+            console.error(`neat sync: ${err.message}`);
+          }
           exitCode = 1;
         } else if (err instanceof TransportError) {
           console.error(`neat sync: ${err.message}`);
@@ -7903,7 +8036,7 @@ async function runSync(opts) {
   }
   const result = {
     exitCode,
-    project: entry2.name,
+    project: pushedProject,
     scanPath: entry2.path,
     nodesAdded: persisted.nodesAdded,
     edgesAdded: persisted.edgesAdded,
@@ -8518,6 +8651,11 @@ async function main() {
     if (code !== 0) process.exit(code);
     return;
   }
+  if (cmd0 === "connect") {
+    const code = await runConnectCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   if (cmd0 === "doctor") {
     const code = await runDoctorCommand(argv.slice(1));
     if (code !== 0) process.exit(code);