@neat.is/core 0.10.3-dev.20260930 → 0.10.4

package/dist/cli.cjs

@@ -51,6 +51,10 @@ function assertBindAuthority(host, token) {
   if (isLoopbackHost2(host)) return;
   throw new BindAuthorityError(host);
 }
+function isBearerDelegated(req) {
+  const config = req.routeOptions?.config;
+  return config?.bearerDelegated === true;
+}
 function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
@@ -66,6 +70,10 @@ function mountBearerAuth(app, opts) {
       done();
       return;
     }
+    if (isBearerDelegated(req)) {
+      done();
+      return;
+    }
     if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
       done();
       return;
@@ -99,7 +107,7 @@ function readAuthEnv(env = process.env) {
     publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN, BEARER_DELEGATED;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -129,6 +137,7 @@ var init_auth = __esm({
     PROJECT_SCOPED_UNAUTH_PATTERN = new RegExp(
       `^/projects/[^/]+/(?:${DEFAULT_UNAUTH_PATHS.map((p) => p.slice(1)).join("|")})$`
     );
+    BEARER_DELEGATED = { bearerDelegated: true };
   }
 });
 
@@ -24226,6 +24235,19 @@ function registerRoutes(scope, ctx) {
       });
     }
   });
+  scope.post("/repo-sync", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const syncNow = ctx.repoSync?.(proj.name);
+    if (!syncNow) {
+      return reply.code(404).send({
+        error: "repo-sync is not running for this project",
+        project: proj.name,
+        hint: "Only a hosted daemon syncs bound repos. On a local daemon, POST /graph/scan re-extracts the project path."
+      });
+    }
+    return reply.code(202).send({ project: proj.name, ...syncNow() });
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -24473,6 +24495,39 @@ function registerRoutes(scope, ctx) {
     }
   });
 }
+var OTLP_BODY_LIMIT = 16 * 1024 * 1024;
+function otlpOnRest(getReceiver) {
+  return async function plugin(scope) {
+    scope.removeAllContentTypeParsers();
+    scope.addContentTypeParser(
+      "*",
+      { parseAs: "buffer", bodyLimit: OTLP_BODY_LIMIT },
+      (_req, body, done) => done(null, body)
+    );
+    const relay = async (req, reply) => {
+      const receiver = getReceiver();
+      if (!receiver) {
+        return reply.code(503).header("retry-after", "1").send({ error: "OTLP receiver is starting" });
+      }
+      const headers = { ...req.headers };
+      delete headers["content-length"];
+      delete headers["transfer-encoding"];
+      delete headers.connection;
+      const res = await receiver.inject({
+        method: "POST",
+        url: req.url,
+        headers,
+        payload: req.body
+      });
+      const contentType = res.headers["content-type"];
+      if (contentType !== void 0) void reply.header("content-type", contentType);
+      return reply.code(res.statusCode).send(res.rawPayload);
+    };
+    const route = { config: BEARER_DELEGATED, bodyLimit: OTLP_BODY_LIMIT };
+    scope.post("/v1/traces", route, relay);
+    scope.post("/projects/:project/v1/traces", route, relay);
+  };
+}
 async function buildApi(opts) {
   const app = (0, import_fastify2.default)({ logger: false, routerOptions: { maxParamLength: 1024 } });
   await app.register(import_cors.default, { origin: true });
@@ -24491,6 +24546,7 @@ async function buildApi(opts) {
     authProxy: trustProxy === true,
     requiresAuth
   }));
+  if (opts.otlpReceiver) await app.register(otlpOnRest(opts.otlpReceiver));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -24521,6 +24577,7 @@ async function buildApi(opts) {
     bootstrap: opts.bootstrap,
     singleProject: opts.singleProject?.name,
     connectorsHome: opts.connectorsHome,
+    repoSync: opts.repoSync,
     runPoll: opts.runPoll ?? runConnectorPoll
   };
   app.get("/health", async () => {
@@ -30607,6 +30664,15 @@ function bindUrl(webUrl, projectId) {
 function onboardingUrl(webUrl) {
   return `${webUrl}/onboarding`;
 }
+async function offerLocalExtraction(input, d, out, readLine) {
+  const run = d.orchestrator;
+  if (!run || !readLine) return false;
+  const answer = (await readLine("Build it now? [Y/n] "))?.trim().toLowerCase();
+  if (answer === "n" || answer === "no") return false;
+  out("");
+  const code = await run(d.cwd ?? process.cwd(), {});
+  return code === 0;
+}
 async function runPostLoginConnect(input) {
   const d = input.deps;
   const out = d.out ?? ((line) => console.log(line));
@@ -30616,9 +30682,27 @@ async function runPostLoginConnect(input) {
   const readLine = d.readLine;
   const repo = await detect6(cwd);
   out("");
+  const cmd = commandPrefix();
+  const syncLine = `${cmd} sync --to ${input.project.name}`;
   if (!repo) {
     out("This directory has no GitHub remote, so it can't be bound to the project.");
-    out(`  Push its graph instead:      neat sync --to ${input.project.name}`);
+    const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
+    if (!hasGraph) {
+      out(`A graph of this directory has to be built first, then pushed to ${input.project.name}.`);
+      const built = await offerLocalExtraction(input, d, out, readLine);
+      out("");
+      if (built) {
+        out(`Now push it to ${input.project.name}:`);
+        out(`  ${syncLine}`);
+      } else {
+        out(`When you're ready, build it and push it to ${input.project.name}:`);
+        out(`  ${cmd}`);
+        out(`  ${syncLine}`);
+      }
+      out(`  Manage projects and repos:   ${input.webUrl}`);
+      return;
+    }
+    out(`  Push its graph instead:      ${syncLine}`);
     out(`  Manage projects and repos:   ${input.webUrl}`);
     return;
   }
@@ -30652,18 +30736,18 @@ async function runPostLoginConnect(input) {
     out("");
     if (!hasGraph) {
       out("There is no local graph to push yet. Build one, then push it:");
-      out("  neat");
-      out(`  neat sync --to ${input.project.name}`);
+      out(`  ${cmd}`);
+      out(`  ${syncLine}`);
       return;
     }
     out("Push the local graph with:");
-    out(`  neat sync --to ${input.project.name}`);
+    out(`  ${syncLine}`);
     return;
   }
   out("");
   out("No problem \u2014 when you want this repo in the graph:");
   out(`  Bind it:        ${bindUrl(input.webUrl, input.project.id)}`);
-  out(`  Or push it:     neat sync --to ${input.project.name}`);
+  out(`  Or push it:     ${syncLine}`);
 }
 
 // src/login-sso.ts
@@ -30842,7 +30926,7 @@ async function runSsoLogin(opts, deps) {
       ...deps.signal ? { signal: deps.signal } : {}
     });
     if (waited.kind === "aborted") {
-      out("Stopped. Run `neat login` again once your project is up.");
+      out(`Stopped. Run \`${commandPrefix()} login\` again once your project is up.`);
       return 130;
     }
     if (waited.kind === "timeout") {
@@ -30910,7 +30994,7 @@ async function runSsoLogin(opts, deps) {
       }
     });
     out("");
-    out("Run `neat logout` to switch back to your local daemon.");
+    out(`Run \`${commandPrefix()} logout\` to switch back to your local daemon.`);
   }
   return 0;
 }
@@ -34938,23 +35022,24 @@ async function tryOrchestrator(cmd, parsed, overrides = {}) {
   return result.exitCode;
 }
 async function runWelcomeFlow(parsed) {
+  const runLocal = async (cwd, opts) => await tryOrchestrator(
+    cwd,
+    {
+      ...parsed,
+      ...opts?.project !== void 0 ? { project: opts.project } : {},
+      ...opts?.noInstrument !== void 0 ? { noInstrument: opts.noInstrument } : {},
+      ...opts?.yes !== void 0 ? { yes: opts.yes } : {}
+    },
+    { skipBanner: opts?.headerShown === true }
+  ) ?? 0;
   return runWelcome({
-    login: (loginArgv) => runLoginCommand(loginArgv),
+    login: (loginArgv) => runLoginCommand(loginArgv, { connect: { orchestrator: runLocal } }),
     // What the person chose at the door reaches the orchestrator as the flags they
     // stand for: the name as `--project`, the instrument answer as `--no-instrument`
     // or as `yes` (which keeps the orchestrator's own prompt quiet, since the door
     // already asked). `headerShown` isn't a flag anyone can type — it says the
     // door's wordmark already opened this run, so the orchestrator's banner is skipped.
-    orchestrator: async (cwd, opts) => await tryOrchestrator(
-      cwd,
-      {
-        ...parsed,
-        ...opts?.project !== void 0 ? { project: opts.project } : {},
-        ...opts?.noInstrument !== void 0 ? { noInstrument: opts.noInstrument } : {},
-        ...opts?.yes !== void 0 ? { yes: opts.yes } : {}
-      },
-      { skipBanner: opts?.headerShown === true }
-    ) ?? 0,
+    orchestrator: runLocal,
     // An explicit flag is an answer; don't ask again.
     instrumentFlagGiven: parsed.noInstrument || parsed.dryRun
   });