@neat.is/core 0.10.1-dev.20260926 → 0.10.1-dev.20260928

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-EJPNEEJA.js";
+} from "./chunk-HVBD4ULO.js";
 import {
   ProjectNameCollisionError,
   addProject,
@@ -37,7 +37,7 @@ import {
   thresholdForEdgeType,
   touchLastSeen,
   writeAtomically
-} from "./chunk-J3VVEB45.js";
+} from "./chunk-CNOJ4T6I.js";
 import {
   startOtelGrpcReceiver
 } from "./chunk-ERE47MCR.js";

package/dist/neatd.cjs

@@ -11834,13 +11834,16 @@ function objectKeys(obj) {
 var MODULAR_WRITES = /* @__PURE__ */ new Set(["addDoc", "setDoc", "updateDoc"]);
 var NAMESPACED_WRITES = /* @__PURE__ */ new Set(["add", "set", "update"]);
 var READ_CLAUSES = /* @__PURE__ */ new Set(["where", "orderBy"]);
-function firestoreEndpointsFromFile(file, serviceDir) {
+function firestoreEndpointsFromFile(file, serviceDir, imported) {
   const hasClient = FIRESTORE_CLIENT_IMPORT_RE.test(file.content);
   const hasAdmin = FIRESTORE_ADMIN_IMPORT_RE.test(file.content);
-  if (!hasClient && !hasAdmin) return [];
-  const fileSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
+  const importedNames = imported?.names ?? /* @__PURE__ */ new Set();
+  if (!hasClient && !hasAdmin && importedNames.size === 0) return [];
+  const ownSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
+  const fileSdk = !hasClient && !hasAdmin ? imported?.sdk ?? null : ownSdk;
   const tree = parseSource3(parserForExt2(import_node_path44.default.extname(file.path)), file.content);
   const clientVars = firestoreClientVars(tree.rootNode);
+  for (const n of importedNames) clientVars.add(n);
   const collLine = /* @__PURE__ */ new Map();
   const writes = /* @__PURE__ */ new Map();
   const reads = /* @__PURE__ */ new Map();
@@ -11951,6 +11954,99 @@ function firestoreEndpointsFromFile(file, serviceDir) {
   }
   return out;
 }
+function exportedFirestoreClients(root) {
+  const out = /* @__PURE__ */ new Set();
+  const collect = (node) => {
+    if (node.type === "variable_declarator") {
+      const name = node.childForFieldName("name");
+      let value = node.childForFieldName("value");
+      if (value?.type === "await_expression") value = namedChildren(value)[0] ?? null;
+      if (name?.type === "identifier" && isFirestoreClientFactory(value)) out.add(name.text);
+    }
+    for (const c of namedChildren(node)) collect(c);
+  };
+  const walk11 = (node) => {
+    if (node.type === "export_statement") collect(node);
+    else for (const c of namedChildren(node)) walk11(c);
+  };
+  walk11(root);
+  return out;
+}
+function namedImportBindings(root) {
+  const out = [];
+  const walk11 = (node) => {
+    if (node.type === "import_statement") {
+      const src = node.childForFieldName("source");
+      const specifier = src ? src.text.slice(1, -1) : "";
+      if (specifier.length > 0) {
+        const stack = [node];
+        while (stack.length > 0) {
+          const n = stack.pop();
+          if (n.type === "import_specifier") {
+            const nameNode = n.childForFieldName("name");
+            const aliasNode = n.childForFieldName("alias");
+            const importedName = nameNode?.text;
+            if (importedName) {
+              out.push({ local: aliasNode?.text ?? importedName, imported: importedName, specifier });
+            }
+            continue;
+          }
+          for (const c of namedChildren(n)) stack.push(c);
+        }
+      }
+    }
+    for (const c of namedChildren(node)) walk11(c);
+  };
+  walk11(root);
+  return out;
+}
+function sdkOf(content) {
+  const hasClient = FIRESTORE_CLIENT_IMPORT_RE.test(content);
+  const hasAdmin = FIRESTORE_ADMIN_IMPORT_RE.test(content);
+  return hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
+}
+function parseOrNull(file) {
+  const ext = import_node_path44.default.extname(file.path);
+  if (!(ext in GRAMMAR_BY_EXT)) return null;
+  try {
+    return parseSource3(parserForExt2(ext), file.content).rootNode;
+  } catch {
+    return null;
+  }
+}
+async function firestoreCrossFileEndpoints(files, serviceDir) {
+  const registry = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (sdkOf(f.content) === null && !FIRESTORE_CLIENT_IMPORT_RE.test(f.content)) continue;
+    const root = parseOrNull(f);
+    if (!root) continue;
+    const names = exportedFirestoreClients(root);
+    if (names.size === 0) continue;
+    registry.set(toPosix(import_node_path44.default.relative(serviceDir, f.path)), { names, sdk: sdkOf(f.content) });
+  }
+  if (registry.size === 0) return [];
+  const out = [];
+  for (const f of files) {
+    const root = parseOrNull(f);
+    if (!root) continue;
+    if (firestoreClientVars(root).size > 0) continue;
+    const bindings = namedImportBindings(root);
+    if (bindings.length === 0) continue;
+    const names = /* @__PURE__ */ new Set();
+    let sdk = null;
+    for (const b of bindings) {
+      const rel = await resolveJsImport(b.specifier, import_node_path44.default.dirname(f.path), serviceDir, null);
+      if (!rel) continue;
+      const entry2 = registry.get(rel);
+      if (!entry2 || !entry2.names.has(b.imported)) continue;
+      names.add(b.local);
+      sdk ??= entry2.sdk;
+    }
+    if (names.size === 0) continue;
+    out.push(...firestoreEndpointsFromFile(f, serviceDir, { names, sdk }));
+  }
+  return out;
+}
 
 // src/extract/calls/mongoose.ts
 init_cjs_shims();
@@ -14760,6 +14856,7 @@ async function addExternalEndpointEdges(graph, services) {
         recordExtractionError("python socket call extraction", file.path, err);
       }
     }
+    endpoints.push(...await firestoreCrossFileEndpoints(maskedFiles, service.dir));
     endpoints.push(...await mongooseCrossFileEndpoints(maskedFiles, service.dir));
     endpoints.push(...pythonOrmCrossFileEndpoints(maskedFiles, service.dir));
     endpoints.push(...await prismaColumnEndpoints(service.dir));
@@ -16055,6 +16152,9 @@ function stripComments(src) {
 function segmentsFromMatchPath(pathToken) {
   return pathToken.split("/").filter((s) => s.length > 0);
 }
+function isRecursiveWildcard(seg) {
+  return /^\{[^}]*=\s*\*\*\}$/.test(seg);
+}
 function collectionKeyFromSegments(segments) {
   let segs = segments;
   if (segs.length >= 3 && segs[0] === "databases" && /^\{.*\}$/.test(segs[1]) && segs[2] === "documents") {
@@ -16067,10 +16167,11 @@ function collectionKeyFromName(name) {
 }
 function fieldsFromCondition(cond) {
   const out = [];
-  const callRe = /\b(?:hasAll|hasOnly|hasAny)\s*\(\s*\[([^\]]*)\]\s*\)/g;
+  const callRe = /(!\s*)?\b(?:hasAll|hasOnly|hasAny)\s*\(\s*\[([^\]]*)\]\s*\)/g;
   let m;
   while ((m = callRe.exec(cond)) !== null) {
-    const inner = m[1];
+    if (m[1] !== void 0 || isNegatedAt(cond, m.index)) continue;
+    const inner = m[2];
     const litRe = /'([^']*)'|"([^"]*)"/g;
     let lm;
     while ((lm = litRe.exec(inner)) !== null) {
@@ -16080,6 +16181,28 @@ function fieldsFromCondition(cond) {
   }
   return out;
 }
+function isNegatedAt(cond, idx) {
+  let i = idx - 1;
+  while (i >= 0) {
+    const ch = cond[i];
+    if (ch === ")") {
+      let depth = 1;
+      i--;
+      while (i >= 0 && depth > 0) {
+        if (cond[i] === ")") depth++;
+        else if (cond[i] === "(") depth--;
+        i--;
+      }
+      continue;
+    }
+    if (/[A-Za-z0-9_$.\]['"]/.test(ch) || ch === " ") {
+      i--;
+      continue;
+    }
+    return ch === "!";
+  }
+  return false;
+}
 function parseFirestoreRules(content) {
   const src = stripComments(content);
   const tokenRe = /match\s+((?:\/(?:\{[^}]*\}|[^\s/{}]+))+)\s*\{|allow\b([^;{}]*);|(\{)|(\})/g;
@@ -16092,7 +16215,8 @@ function parseFirestoreRules(content) {
   while ((m = tokenRe.exec(src)) !== null) {
     if (m[1] !== void 0) {
       depth++;
-      matchStack.push({ depth, segs: segmentsFromMatchPath(m[1]) });
+      const segs = segmentsFromMatchPath(m[1]);
+      matchStack.push({ depth, segs, recursive: segs.some(isRecursiveWildcard) });
       continue;
     }
     if (m[2] !== void 0) {
@@ -16103,6 +16227,10 @@ function parseFirestoreRules(content) {
       if (!methods.some((mm) => WRITE_METHODS.has(mm))) continue;
       const key = currentKey();
       if (key.length === 0) continue;
+      if (matchStack.some((f) => f.recursive)) {
+        indeterminate.add(key);
+        continue;
+      }
       const cond = colon === -1 ? "" : body.slice(colon + 1);
       const fields = fieldsFromCondition(cond);
       if (fields.length > 0) {
@@ -23638,6 +23766,7 @@ function decodeRailwayTargetRef(ref) {
 // src/connectors/hosted.ts
 var CREDENTIAL_REFRESH_SKEW_MS = 6e4;
 var CP_REQUEST_TIMEOUT_MS = 1e4;
+var DEFAULT_RELIST_INTERVAL_MS = 6e4;
 async function cpGet(path81, deps) {
   const f = deps.fetchImpl ?? fetch;
   const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${path81}`, {
@@ -23808,67 +23937,111 @@ function createHostedCredentialSource(provider, deps) {
     return record;
   };
 }
-async function startHostedConnectors(input) {
+function connectionSignature(c) {
+  return `${c.projectRef ?? ""}|${c.needsProjectSelection ? 1 : 0}`;
+}
+function startConnectionLoops(c, input, startLoop) {
   const { deps, graph, projectDir, project, errorsPath, onSkip } = input;
-  const startLoop = input.startLoop ?? startConnectorPollLoop;
+  const stops = [];
+  const credentialSource = createHostedCredentialSource(c.provider, deps);
+  for (const name of HOSTED_CONNECTORS_FOR[c.provider] ?? [c.provider]) {
+    const dispatch = PROVIDER_DISPATCH[name];
+    if (!dispatch) {
+      onSkip?.(name, "no pull connector for this provider");
+      continue;
+    }
+    if (c.needsProjectSelection || !c.projectRef) {
+      onSkip?.(name, "no project selected yet \u2014 not pullable");
+      continue;
+    }
+    const options = hostedOptions(name, c, project, input.firebaseServiceMap);
+    if (!options) {
+      onSkip?.(name, "no hosted option mapping for this provider");
+      continue;
+    }
+    let built;
+    try {
+      built = dispatch.build(graph, options);
+    } catch (err) {
+      onSkip?.(name, err.message);
+      continue;
+    }
+    stops.push(
+      startLoop(
+        built.connector,
+        { projectDir, project, credentials: {}, ...errorsPath ? { errorsPath } : {} },
+        graph,
+        built.resolveTarget,
+        {
+          connectorId: `hosted:${name}`,
+          // The credential is fetched by the CONNECTION's provider (`gcp`), not the connector's name.
+          refreshCredentials: credentialSource
+        }
+      )
+    );
+  }
+  return () => {
+    for (const stop of stops) stop();
+  };
+}
+async function runHostedConnectorsPass(input, startLoop, running) {
+  const { deps, onSkip } = input;
   let connections;
   try {
     connections = await cpGet(`/internal/projects/${deps.projectId}/connections`, deps);
   } catch (err) {
     onSkip?.("(all)", `control plane connection list unreadable \u2014 ${err.message}`);
-    return () => {
-    };
+    return;
   }
-  if (!Array.isArray(connections)) return () => {
-  };
-  const stops = [];
+  if (!Array.isArray(connections)) return;
   const lookupPush = input.pushDispatch ?? getPushProviderDispatch;
+  const seen = /* @__PURE__ */ new Set();
   for (const c of connections) {
+    seen.add(c.provider);
+    const signature = connectionSignature(c);
+    const existing = running.get(c.provider);
+    if (existing && existing.signature === signature) continue;
+    if (existing) existing.stop();
     const push = lookupPush(c.provider);
     if (push) {
       await provisionHostedPushProvider(c, push, input);
+      running.set(c.provider, { signature, stop: () => {
+      } });
       continue;
     }
-    const credentialSource = createHostedCredentialSource(c.provider, deps);
-    for (const name of HOSTED_CONNECTORS_FOR[c.provider] ?? [c.provider]) {
-      const dispatch = PROVIDER_DISPATCH[name];
-      if (!dispatch) {
-        onSkip?.(name, "no pull connector for this provider");
-        continue;
-      }
-      if (c.needsProjectSelection || !c.projectRef) {
-        onSkip?.(name, "no project selected yet \u2014 not pullable");
-        continue;
-      }
-      const options = hostedOptions(name, c, project, input.firebaseServiceMap);
-      if (!options) {
-        onSkip?.(name, "no hosted option mapping for this provider");
-        continue;
-      }
-      let built;
-      try {
-        built = dispatch.build(graph, options);
-      } catch (err) {
-        onSkip?.(name, err.message);
-        continue;
-      }
-      stops.push(
-        startLoop(
-          built.connector,
-          { projectDir, project, credentials: {}, ...errorsPath ? { errorsPath } : {} },
-          graph,
-          built.resolveTarget,
-          {
-            connectorId: `hosted:${name}`,
-            // The credential is fetched by the CONNECTION's provider (`gcp`), not the connector's name.
-            refreshCredentials: credentialSource
-          }
-        )
-      );
-    }
+    running.set(c.provider, { signature, stop: startConnectionLoops(c, input, startLoop) });
   }
+  for (const [provider, rc] of running) {
+    if (seen.has(provider)) continue;
+    rc.stop();
+    running.delete(provider);
+  }
+}
+async function startHostedConnectors(input) {
+  const startLoop = input.startLoop ?? startConnectorPollLoop;
+  const intervalMs = input.intervalMs ?? DEFAULT_RELIST_INTERVAL_MS;
+  const running = /* @__PURE__ */ new Map();
+  let stopped = false;
+  let inPass = false;
+  const tick = async () => {
+    if (stopped || inPass) return;
+    inPass = true;
+    try {
+      await runHostedConnectorsPass(input, startLoop, running);
+    } finally {
+      inPass = false;
+    }
+  };
+  await tick();
+  const timer = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
   return () => {
-    for (const stop of stops) stop();
+    stopped = true;
+    clearInterval(timer);
+    for (const rc of running.values()) rc.stop();
+    running.clear();
   };
 }
 async function maybeStartHostedConnectors(input) {
@@ -23892,7 +24065,8 @@ async function maybeStartHostedConnectors(input) {
     project: input.project,
     ...parseFirebaseServiceMap(env.NEAT_FIREBASE_SERVICE_MAP) ? { firebaseServiceMap: parseFirebaseServiceMap(env.NEAT_FIREBASE_SERVICE_MAP) } : {},
     ...input.errorsPath ? { errorsPath: input.errorsPath } : {},
-    ...input.onSkip ? { onSkip: input.onSkip } : {}
+    ...input.onSkip ? { onSkip: input.onSkip } : {},
+    ...input.intervalMs !== void 0 ? { intervalMs: input.intervalMs } : {}
   });
 }