@neat.is/core 0.10.3 → 0.10.5-dev.20261001

package/dist/cli.cjs

@@ -51,6 +51,10 @@ function assertBindAuthority(host, token) {
   if (isLoopbackHost2(host)) return;
   throw new BindAuthorityError(host);
 }
+function isBearerDelegated(req) {
+  const config = req.routeOptions?.config;
+  return config?.bearerDelegated === true;
+}
 function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
@@ -66,6 +70,10 @@ function mountBearerAuth(app, opts) {
       done();
       return;
     }
+    if (isBearerDelegated(req)) {
+      done();
+      return;
+    }
     if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
       done();
       return;
@@ -99,7 +107,7 @@ function readAuthEnv(env = process.env) {
     publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN, BEARER_DELEGATED;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -129,6 +137,7 @@ var init_auth = __esm({
     PROJECT_SCOPED_UNAUTH_PATTERN = new RegExp(
       `^/projects/[^/]+/(?:${DEFAULT_UNAUTH_PATHS.map((p) => p.slice(1)).join("|")})$`
     );
+    BEARER_DELEGATED = { bearerDelegated: true };
   }
 });
 
@@ -3527,6 +3536,10 @@ function languageForPath(relPath) {
       return void 0;
   }
 }
+var currentSource;
+function setExtractionSource(source) {
+  currentSource = source;
+}
 function ensureFileNode(graph, serviceName, serviceNodeId, relPath) {
   let nodesAdded = 0;
   let edgesAdded = 0;
@@ -3539,10 +3552,16 @@ function ensureFileNode(graph, serviceName, serviceNodeId, relPath) {
       service: serviceName,
       path: relPath,
       ...language ? { language } : {},
+      ...currentSource ? { source: currentSource } : {},
       discoveredVia: "static"
     };
     graph.addNode(fileNodeId, node);
     nodesAdded++;
+  } else if (currentSource) {
+    const existing = graph.getNodeAttributes(fileNodeId);
+    if (existing.source !== currentSource) {
+      graph.replaceNodeAttributes(fileNodeId, { ...existing, source: currentSource });
+    }
   }
   const containsId = (0, import_types5.extractedEdgeId)(serviceNodeId, fileNodeId, import_types5.EdgeType.CONTAINS);
   if (!graph.hasEdge(containsId)) {
@@ -16603,10 +16622,12 @@ init_cjs_shims();
 var import_node_fs34 = require("fs");
 var import_node_path69 = __toESM(require("path"), 1);
 var import_types59 = require("@neat.is/types");
-function dropOrphanedFileNodes(graph) {
+function dropOrphanedFileNodes(graph, source) {
   const orphans = [];
   graph.forEachNode((id, attrs) => {
-    if (attrs.type !== import_types59.NodeType.FileNode) return;
+    const node = attrs;
+    if (node.type !== import_types59.NodeType.FileNode) return;
+    if (source && node.source !== source) return;
     if (graph.inboundEdges(id).length === 0 && graph.outboundEdges(id).length === 0) {
       orphans.push(id);
     }
@@ -16627,12 +16648,23 @@ function retireEdgesByFile(graph, file) {
   dropOrphanedFileNodes(graph);
   return toDrop.length;
 }
-function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
+function outOfScope(graph, edge, source) {
+  if (!source) return false;
+  for (const endpoint2 of [edge.source, edge.target]) {
+    if (!graph.hasNode(endpoint2)) continue;
+    const node = graph.getNodeAttributes(endpoint2);
+    if (node.type !== import_types59.NodeType.FileNode) continue;
+    return node.source !== source;
+  }
+  return false;
+}
+function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = [], source) {
   const toDrop = [];
   const bases = [scanPath, ...serviceDirs];
   graph.forEachEdge((id, attrs) => {
     const edge = attrs;
     if (edge.provenance !== import_types59.Provenance.EXTRACTED) return;
+    if (outOfScope(graph, edge, source)) return;
     const evidenceFile = edge.evidence?.file;
     if (!evidenceFile) return;
     if (import_node_path69.default.isAbsolute(evidenceFile)) {
@@ -16643,7 +16675,7 @@ function retireExtractedEdgesByMissingFile(graph, scanPath, serviceDirs = []) {
     if (!found) toDrop.push(id);
   });
   for (const id of toDrop) graph.dropEdge(id);
-  dropOrphanedFileNodes(graph);
+  dropOrphanedFileNodes(graph, source);
   return toDrop.length;
 }
 
@@ -16652,6 +16684,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   await ensureCompatLoaded();
   drainExtractionErrors();
   drainSkippedFiles();
+  setExtractionSource(opts.source);
   const services = await discoverServices(scanPath);
   const phase1Nodes = addServiceNodes(graph, services);
   await addServiceAliases(graph, scanPath, services);
@@ -16672,7 +16705,8 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
   const ghostsRetired = retireExtractedEdgesByMissingFile(
     graph,
     scanPath,
-    services.map((s) => s.dir)
+    services.map((s) => s.dir),
+    opts.source
   );
   const frontiersPromoted = promoteFrontierNodes(graph);
   if (opts.onPolicyTrigger) await opts.onPolicyTrigger(graph);
@@ -16707,6 +16741,7 @@ async function extractFromDirectory(graph, scanPath, opts = {}) {
       );
     }
   }
+  setExtractionSource(void 0);
   const result = {
     nodesAdded: phase1Nodes + fileEnum.nodesAdded + symbolEnum.nodesAdded + importGraph.nodesAdded + symbolEdges.nodesAdded + actionPhase.nodesAdded + phase2.nodesAdded + phase3.nodesAdded + routePhase.nodesAdded + grpcPhase.nodesAdded + phase4.nodesAdded + tableEdges.nodesAdded + phase5.nodesAdded + zodPhase.nodesAdded + firestoreRulesPhase.nodesAdded,
     edgesAdded: fileEnum.edgesAdded + symbolEnum.edgesAdded + importGraph.edgesAdded + symbolEdges.edgesAdded + actionPhase.edgesAdded + phase2.edgesAdded + phase3.edgesAdded + routePhase.edgesAdded + grpcPhase.edgesAdded + phase4.edgesAdded + tableEdges.edgesAdded + phase5.edgesAdded + zodPhase.edgesAdded + firestoreRulesPhase.edgesAdded,
@@ -24226,6 +24261,19 @@ function registerRoutes(scope, ctx) {
       });
     }
   });
+  scope.post("/repo-sync", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const syncNow = ctx.repoSync?.(proj.name);
+    if (!syncNow) {
+      return reply.code(404).send({
+        error: "repo-sync is not running for this project",
+        project: proj.name,
+        hint: "Only a hosted daemon syncs bound repos. On a local daemon, POST /graph/scan re-extracts the project path."
+      });
+    }
+    return reply.code(202).send({ project: proj.name, ...syncNow() });
+  });
   scope.post("/graph/scan", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -24473,6 +24521,39 @@ function registerRoutes(scope, ctx) {
     }
   });
 }
+var OTLP_BODY_LIMIT = 16 * 1024 * 1024;
+function otlpOnRest(getReceiver) {
+  return async function plugin(scope) {
+    scope.removeAllContentTypeParsers();
+    scope.addContentTypeParser(
+      "*",
+      { parseAs: "buffer", bodyLimit: OTLP_BODY_LIMIT },
+      (_req, body, done) => done(null, body)
+    );
+    const relay = async (req, reply) => {
+      const receiver = getReceiver();
+      if (!receiver) {
+        return reply.code(503).header("retry-after", "1").send({ error: "OTLP receiver is starting" });
+      }
+      const headers = { ...req.headers };
+      delete headers["content-length"];
+      delete headers["transfer-encoding"];
+      delete headers.connection;
+      const res = await receiver.inject({
+        method: "POST",
+        url: req.url,
+        headers,
+        payload: req.body
+      });
+      const contentType = res.headers["content-type"];
+      if (contentType !== void 0) void reply.header("content-type", contentType);
+      return reply.code(res.statusCode).send(res.rawPayload);
+    };
+    const route = { config: BEARER_DELEGATED, bodyLimit: OTLP_BODY_LIMIT };
+    scope.post("/v1/traces", route, relay);
+    scope.post("/projects/:project/v1/traces", route, relay);
+  };
+}
 async function buildApi(opts) {
   const app = (0, import_fastify2.default)({ logger: false, routerOptions: { maxParamLength: 1024 } });
   await app.register(import_cors.default, { origin: true });
@@ -24491,6 +24572,7 @@ async function buildApi(opts) {
     authProxy: trustProxy === true,
     requiresAuth
   }));
+  if (opts.otlpReceiver) await app.register(otlpOnRest(opts.otlpReceiver));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -24521,6 +24603,7 @@ async function buildApi(opts) {
     bootstrap: opts.bootstrap,
     singleProject: opts.singleProject?.name,
     connectorsHome: opts.connectorsHome,
+    repoSync: opts.repoSync,
     runPoll: opts.runPoll ?? runConnectorPoll
   };
   app.get("/health", async () => {
@@ -30601,6 +30684,52 @@ async function waitForFirstProject(fetchImpl, cpUrl, accessToken, deps) {
     if (deps.signal?.aborted) return { kind: "aborted" };
   }
 }
+function projectNameForRepo(repo) {
+  const slug = repo.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "repo";
+}
+async function detailOf(res) {
+  const body = await res.text().catch(() => "");
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed.error) return parsed.error;
+  } catch {
+  }
+  return body.trim() || `HTTP ${res.status}`;
+}
+async function createProjectForRepo(fetchImpl, cpUrl, accessToken, name) {
+  const headers = { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" };
+  let project;
+  try {
+    const res = await fetchImpl(`${cpUrl}/me/projects`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ name }),
+      signal: AbortSignal.timeout(CP_TIMEOUT_MS)
+    });
+    if (!res.ok) return { ok: false, reason: "not-created", detail: await detailOf(res) };
+    project = await res.json();
+  } catch (err) {
+    return { ok: false, reason: "not-created", detail: err instanceof Error ? err.message : String(err) };
+  }
+  try {
+    const res = await fetchImpl(`${cpUrl}/me/projects/${encodeURIComponent(project.id)}/provision`, {
+      method: "POST",
+      headers,
+      signal: AbortSignal.timeout(CP_TIMEOUT_MS)
+    });
+    if (res.status === 402) return { ok: false, reason: "needs-plan", project, detail: await detailOf(res) };
+    if (!res.ok) return { ok: false, reason: "not-provisioned", project, detail: await detailOf(res) };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: "not-provisioned",
+      project,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  return { ok: true, project };
+}
 function bindUrl(webUrl, projectId) {
   return `${webUrl}/config/repos?project=${encodeURIComponent(projectId)}`;
 }
@@ -30626,7 +30755,8 @@ async function runPostLoginConnect(input) {
   const repo = await detect6(cwd);
   out("");
   const cmd = commandPrefix();
-  const syncLine = `${cmd} sync --to ${input.project.name}`;
+  const pushCmd = input.endpoint ? `${cmd} sync --to ${input.endpoint}${input.pushToken ? ` --token ${input.pushToken}` : ""}` : null;
+  const pushInto = (label) => pushCmd ? [`  ${pushCmd}`] : [`  Its daemon URL and token are on ${label} in the console: ${input.webUrl}`];
   if (!repo) {
     out("This directory has no GitHub remote, so it can't be bound to the project.");
     const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
@@ -30636,16 +30766,17 @@ async function runPostLoginConnect(input) {
       out("");
       if (built) {
         out(`Now push it to ${input.project.name}:`);
-        out(`  ${syncLine}`);
+        for (const line of pushInto(input.project.name)) out(line);
       } else {
         out(`When you're ready, build it and push it to ${input.project.name}:`);
         out(`  ${cmd}`);
-        out(`  ${syncLine}`);
+        for (const line of pushInto(input.project.name)) out(line);
       }
       out(`  Manage projects and repos:   ${input.webUrl}`);
       return;
     }
-    out(`  Push its graph instead:      ${syncLine}`);
+    out(`  Push its graph to ${input.project.name}:`);
+    for (const line of pushInto(input.project.name)) out(line);
     out(`  Manage projects and repos:   ${input.webUrl}`);
     return;
   }
@@ -30658,39 +30789,87 @@ async function runPostLoginConnect(input) {
     out(`  See the graph:  ${input.webUrl}`);
     return;
   }
-  out(`${slug} isn't part of ${input.project.name} yet \u2014 logging in connected your account, not this repo.`);
+  out(`${slug} isn't in ${input.project.name} \u2014 logging in connected your account, not this repo.`);
+  out("");
+  const suggested = projectNameForRepo(repo);
+  out("Where should this repo go?");
   out("");
-  const installed = input.me?.github?.installed;
-  const bindLine = installed === false ? "1) Install the GitHub App and bind this repo \u2014 hosted NEAT keeps it in sync" : installed === true ? "1) Bind this repo \u2014 hosted NEAT clones and extracts it, and keeps it in sync" : "1) Bind this repo through the console \u2014 hosted NEAT keeps it in sync";
-  out(bindLine);
-  out(`2) Push the graph on this machine now \u2014 a snapshot, not a subscription`);
+  out(`1) A project of its own, called ${suggested}`);
+  out(`2) ${input.project.name} \u2014 the project this login connected to`);
+  for (const line of sharedProjectCaveat(bound)) out(`   ${line}`);
   out("3) Neither, for now");
+  out("");
   const answer = readLine ? (await readLine("Choose 1, 2 or 3 (Enter skips): "))?.trim() : void 0;
   if (answer === "1") {
-    const url = bindUrl(input.webUrl, input.project.id);
-    const opened = (d.openBrowser ?? (() => false))(url);
     out("");
-    out(opened ? `Opened ${url}` : `Open this to bind the repo:
-  ${url}`);
+    const outcome = await createProjectForRepo(fetchImpl, input.cpUrl, input.accessToken, suggested);
+    reportCreate(outcome, input.webUrl, cmd, input.project.name, out);
     return;
   }
   if (answer === "2") {
-    const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
     out("");
-    if (!hasGraph) {
-      out("There is no local graph to push yet. Build one, then push it:");
-      out(`  ${cmd}`);
-      out(`  ${syncLine}`);
-      return;
+    out(`Two ways into ${input.project.name} \u2014 either is fine, and you can do both:`);
+    out("");
+    const installed = input.me?.github?.installed;
+    out(
+      installed === false ? "  Bind it (install the GitHub App first) \u2014 hosted NEAT keeps it in sync:" : installed === true ? "  Bind it \u2014 hosted NEAT clones and extracts it, and keeps it in sync:" : "  Bind it through the console \u2014 hosted NEAT keeps it in sync:"
+    );
+    out(`    ${bindUrl(input.webUrl, input.project.id)}`);
+    out("");
+    const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
+    if (hasGraph) {
+      out("  Or push the graph on this machine now \u2014 a snapshot, not a subscription:");
+      for (const line of pushInto(input.project.name)) out(`  ${line}`);
+    } else {
+      out("  Or build a graph here and push it \u2014 a snapshot, not a subscription:");
+      out(`    ${cmd}`);
+      for (const line of pushInto(input.project.name)) out(`  ${line}`);
     }
-    out("Push the local graph with:");
-    out(`  ${syncLine}`);
     return;
   }
   out("");
   out("No problem \u2014 when you want this repo in the graph:");
-  out(`  Bind it:        ${bindUrl(input.webUrl, input.project.id)}`);
-  out(`  Or push it:     ${syncLine}`);
+  out(`  Its own project:   ${input.webUrl}`);
+  out(`  Or into ${input.project.name}: ${bindUrl(input.webUrl, input.project.id)}`);
+}
+function sharedProjectCaveat(bound) {
+  const hazard = "Two repos in one project can currently retire each other's files (#1294),";
+  if (!bound) return [hazard, "so a graph there may end up short of code until that is fixed."];
+  if (bound.length === 0) return ["Nothing else is bound there yet.", `Adding a second repo later would hit #1294 \u2014 ${hazard.toLowerCase()}`];
+  const names = bound.map((r) => `${r.owner}/${r.name}`).join(", ");
+  return [
+    `${bound.length} already there: ${names}.`,
+    hazard,
+    "so both graphs may end up short of code until that is fixed."
+  ];
+}
+function reportCreate(outcome, webUrl, cmd, connectedTo, out) {
+  if (outcome.ok) {
+    out(`Created ${outcome.project.name} and started its daemon.`);
+    out("");
+    out(`This CLI is still pointed at ${connectedTo}. Switch it to the new project with:`);
+    out(`  ${cmd} login --project ${outcome.project.name}`);
+    out("");
+    out("Then bind this repo to it:");
+    out(`  ${bindUrl(webUrl, outcome.project.id)}`);
+    return;
+  }
+  if (outcome.reason === "needs-plan") {
+    out(`Created ${outcome.project.name}, but starting a daemon for it needs a plan.`);
+    out(`  Choose one:  ${webUrl}/checkout`);
+    out("");
+    out("The project is made and keeps its name, so there's nothing to redo here afterwards.");
+    return;
+  }
+  if (outcome.reason === "not-provisioned") {
+    out(`Created ${outcome.project.name}, but its daemon didn't start: ${outcome.detail}`);
+    out("");
+    out("The project exists \u2014 start it from the console rather than making a second one:");
+    out(`  ${webUrl}`);
+    return;
+  }
+  out(`Couldn't create the project: ${outcome.detail}`);
+  out(`Nothing was made, so this is safe to retry, or do it in the console: ${webUrl}`);
 }
 
 // src/login-sso.ts
@@ -30927,6 +31106,10 @@ async function runSsoLogin(opts, deps) {
       webUrl: opts.webUrl,
       accessToken,
       project: { id: project.id, name: project.name },
+      // What a push actually needs: `sync --to` takes the daemon's URL, and its
+      // token comes from the flag rather than the profile (#1302).
+      endpoint: cred.endpoint,
+      pushToken: cred.authToken,
       me,
       deps: {
         fetchImpl,