@neat.is/core 0.10.3-dev.20260930 → 0.10.4

package/dist/neatd.js

@@ -2,15 +2,15 @@
 import {
   reconcileDaemonRecordSync,
   startDaemon
-} from "./chunk-DLQNMU3R.js";
+} from "./chunk-2OQVIBZZ.js";
 import {
   listProjects,
   registryPath
-} from "./chunk-LNIVRE4L.js";
+} from "./chunk-TUGYIRUT.js";
 import {
   BindAuthorityError,
   __require
-} from "./chunk-M7CGATVC.js";
+} from "./chunk-EFBWQIKG.js";
 
 // src/neatd.ts
 import { promises as fs } from "fs";

package/dist/{otel-grpc-CU73Y5WT.js → otel-grpc-B7ABHLV7.js}

@@ -1,10 +1,10 @@
 import {
   reshapeGrpcRequest,
   startOtelGrpcReceiver
-} from "./chunk-5SJHA5ZH.js";
-import "./chunk-M7CGATVC.js";
+} from "./chunk-LXQCL4MP.js";
+import "./chunk-EFBWQIKG.js";
 export {
   reshapeGrpcRequest,
   startOtelGrpcReceiver
 };
-//# sourceMappingURL=otel-grpc-CU73Y5WT.js.map
+//# sourceMappingURL=otel-grpc-B7ABHLV7.js.map

package/dist/server.cjs

@@ -49,6 +49,10 @@ function assertBindAuthority(host, token) {
   if (isLoopbackHost2(host)) return;
   throw new BindAuthorityError(host);
 }
+function isBearerDelegated(req) {
+  const config = req.routeOptions?.config;
+  return config?.bearerDelegated === true;
+}
 function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
@@ -64,6 +68,10 @@ function mountBearerAuth(app, opts) {
       done();
       return;
     }
+    if (isBearerDelegated(req)) {
+      done();
+      return;
+    }
     if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
       done();
       return;
@@ -97,7 +105,7 @@ function readAuthEnv(env = process.env) {
     publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN, BEARER_DELEGATED;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -127,6 +135,7 @@ var init_auth = __esm({
     PROJECT_SCOPED_UNAUTH_PATTERN = new RegExp(
       `^/projects/[^/]+/(?:${DEFAULT_UNAUTH_PATHS.map((p) => p.slice(1)).join("|")})$`
     );
+    BEARER_DELEGATED = { bearerDelegated: true };
   }
 });
 
@@ -23093,6 +23102,19 @@ function registerRoutes(scope, ctx) {
       });
     }
   });
+  scope.post("/repo-sync", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const syncNow = ctx.repoSync?.(proj.name);
+    if (!syncNow) {
+      return reply.code(404).send({
+        error: "repo-sync is not running for this project",
+        project: proj.name,
+        hint: "Only a hosted daemon syncs bound repos. On a local daemon, POST /graph/scan re-extracts the project path."
+      });
+    }
+    return reply.code(202).send({ project: proj.name, ...syncNow() });
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -23340,6 +23362,39 @@ function registerRoutes(scope, ctx) {
     }
   });
 }
+var OTLP_BODY_LIMIT = 16 * 1024 * 1024;
+function otlpOnRest(getReceiver) {
+  return async function plugin(scope) {
+    scope.removeAllContentTypeParsers();
+    scope.addContentTypeParser(
+      "*",
+      { parseAs: "buffer", bodyLimit: OTLP_BODY_LIMIT },
+      (_req, body, done) => done(null, body)
+    );
+    const relay = async (req, reply) => {
+      const receiver = getReceiver();
+      if (!receiver) {
+        return reply.code(503).header("retry-after", "1").send({ error: "OTLP receiver is starting" });
+      }
+      const headers = { ...req.headers };
+      delete headers["content-length"];
+      delete headers["transfer-encoding"];
+      delete headers.connection;
+      const res = await receiver.inject({
+        method: "POST",
+        url: req.url,
+        headers,
+        payload: req.body
+      });
+      const contentType = res.headers["content-type"];
+      if (contentType !== void 0) void reply.header("content-type", contentType);
+      return reply.code(res.statusCode).send(res.rawPayload);
+    };
+    const route = { config: BEARER_DELEGATED, bodyLimit: OTLP_BODY_LIMIT };
+    scope.post("/v1/traces", route, relay);
+    scope.post("/projects/:project/v1/traces", route, relay);
+  };
+}
 async function buildApi(opts) {
   const app = (0, import_fastify2.default)({ logger: false, routerOptions: { maxParamLength: 1024 } });
   await app.register(import_cors.default, { origin: true });
@@ -23358,6 +23413,7 @@ async function buildApi(opts) {
     authProxy: trustProxy === true,
     requiresAuth
   }));
+  if (opts.otlpReceiver) await app.register(otlpOnRest(opts.otlpReceiver));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -23388,6 +23444,7 @@ async function buildApi(opts) {
     bootstrap: opts.bootstrap,
     singleProject: opts.singleProject?.name,
     connectorsHome: opts.connectorsHome,
+    repoSync: opts.repoSync,
     runPoll: opts.runPoll ?? runConnectorPoll
   };
   app.get("/health", async () => {
@@ -23885,11 +23942,13 @@ async function main() {
   const otelPort = Number(process.env.OTEL_PORT ?? 4318);
   const auth = readAuthEnv();
   assertBindAuthority(host, auth.authToken);
+  let otelReceiver;
   const app = await buildApi({
     projects: registry,
     authToken: auth.authToken,
     trustProxy: auth.trustProxy,
-    publicRead: auth.publicRead
+    publicRead: auth.publicRead,
+    otlpReceiver: () => otelReceiver
   });
   await app.listen({ port, host });
   console.log(`neat-core listening on http://${host}:${port}`);
@@ -23906,6 +23965,7 @@ async function main() {
       authToken: auth.otelToken,
       trustProxy: auth.trustProxy
     });
+    otelReceiver = otelApp;
     await otelApp.listen({ port: otelPort, host });
     console.log(`neat-core OTLP receiver on http://${host}:${otelPort}/v1/traces`);
     if (process.env.NEAT_OTLP_GRPC === "true") {