@neat.is/core 0.3.6 → 0.3.8

package/dist/index.d.cts

@@ -114,6 +114,8 @@ interface BuildApiOptions {
     errorsPath?: string;
     staleEventsPath?: string;
     searchIndex?: SearchIndex;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 declare function buildApi(opts: BuildApiOptions): Promise<FastifyInstance>;
 
@@ -145,6 +147,8 @@ interface BuildOtelReceiverOptions {
     onSpan: SpanHandler;
     onErrorSpanSync?: (span: ParsedSpan) => Promise<void>;
     bodyLimit?: number;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtlpKeyValue {
     key: string;
@@ -200,6 +204,8 @@ declare function logSpanHandler(span: ParsedSpan): void;
 
 interface BuildOtelGrpcReceiverOptions {
     onSpan: SpanHandler;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtelGrpcReceiver {
     address: string;
@@ -358,6 +364,29 @@ interface DaemonHandle {
  *
  * Pure function. Daemon callers pass a snapshot of the registry to avoid
  * per-span fs reads.
+ *
+ * Matching order (ADR-072 — real-world `service.name` rarely equals project
+ * name; monorepos publish per-package names like `brief-api` under a
+ * project named `brief`):
+ *
+ *   1. Exact: `entry.name === serviceName`.
+ *   2. Hyphen/underscore-separated prefix: `entry.name` is a leading token
+ *      of `serviceName` (`brief` matches `brief-api`, `brief_worker`).
+ *      Longest-match wins so `brief-api` beats `brief` when both are
+ *      registered.
+ *   3. Containment as a separator-delimited token (`api` inside
+ *      `brief-api-staging`).
+ *
+ * Routing eligibility (ADR-071):
+ * - `active` matches at every pass (the steady-state path).
+ * - `broken` also matches — the daemon needs the span to reach the broken
+ *   slot so the ingest-time auto-recover path can attempt a bootstrap and
+ *   lift the project back to `active`. The router only chooses the target;
+ *   whether the span actually lands is the ingest handler's decision.
+ * - `paused` is intentionally not routed; the operator paused it on
+ *   purpose, so the span falls through to the default-project flow.
+ *
+ * Falls back to `DEFAULT_PROJECT` when nothing matches.
  */
 declare function routeSpanToProject(serviceName: string | undefined, projects: ReadonlyArray<RegistryEntry>): string;
 declare function startDaemon(opts?: DaemonOptions): Promise<DaemonHandle>;

package/dist/index.d.ts

@@ -114,6 +114,8 @@ interface BuildApiOptions {
     errorsPath?: string;
     staleEventsPath?: string;
     searchIndex?: SearchIndex;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 declare function buildApi(opts: BuildApiOptions): Promise<FastifyInstance>;
 
@@ -145,6 +147,8 @@ interface BuildOtelReceiverOptions {
     onSpan: SpanHandler;
     onErrorSpanSync?: (span: ParsedSpan) => Promise<void>;
     bodyLimit?: number;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtlpKeyValue {
     key: string;
@@ -200,6 +204,8 @@ declare function logSpanHandler(span: ParsedSpan): void;
 
 interface BuildOtelGrpcReceiverOptions {
     onSpan: SpanHandler;
+    authToken?: string;
+    trustProxy?: boolean;
 }
 interface OtelGrpcReceiver {
     address: string;
@@ -358,6 +364,29 @@ interface DaemonHandle {
  *
  * Pure function. Daemon callers pass a snapshot of the registry to avoid
  * per-span fs reads.
+ *
+ * Matching order (ADR-072 — real-world `service.name` rarely equals project
+ * name; monorepos publish per-package names like `brief-api` under a
+ * project named `brief`):
+ *
+ *   1. Exact: `entry.name === serviceName`.
+ *   2. Hyphen/underscore-separated prefix: `entry.name` is a leading token
+ *      of `serviceName` (`brief` matches `brief-api`, `brief_worker`).
+ *      Longest-match wins so `brief-api` beats `brief` when both are
+ *      registered.
+ *   3. Containment as a separator-delimited token (`api` inside
+ *      `brief-api-staging`).
+ *
+ * Routing eligibility (ADR-071):
+ * - `active` matches at every pass (the steady-state path).
+ * - `broken` also matches — the daemon needs the span to reach the broken
+ *   slot so the ingest-time auto-recover path can attempt a bootstrap and
+ *   lift the project back to `active`. The router only chooses the target;
+ *   whether the span actually lands is the ingest handler's decision.
+ * - `paused` is intentionally not routed; the operator paused it on
+ *   purpose, so the span falls through to the default-project flow.
+ *
+ * Falls back to `DEFAULT_PROJECT` when nothing matches.
  */
 declare function routeSpanToProject(serviceName: string | undefined, projects: ReadonlyArray<RegistryEntry>): string;
 declare function startDaemon(opts?: DaemonOptions): Promise<DaemonHandle>;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-YHQYHFI3.js";
+} from "./chunk-LQ3JFBTX.js";
 import {
   ProjectNameCollisionError,
   addProject,
@@ -37,15 +37,15 @@ import {
   thresholdForEdgeType,
   touchLastSeen,
   writeAtomically
-} from "./chunk-ZU2RQRCN.js";
+} from "./chunk-CZ3T6TE2.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-G3PDTGOW.js";
+} from "./chunk-V4TU7OKZ.js";
 import {
   buildOtelReceiver,
   logSpanHandler,
   parseOtlpRequest
-} from "./chunk-4ASCXBZF.js";
+} from "./chunk-7TYESDAI.js";
 export {
   ProjectNameCollisionError,
   addProject,

package/dist/neatd.cjs

@@ -40,6 +40,75 @@ var init_cjs_shims = __esm({
   }
 });
 
+// src/auth.ts
+function isLoopbackHost(host) {
+  if (!host) return false;
+  return LOOPBACK_HOSTS.has(host);
+}
+function assertBindAuthority(host, token) {
+  if (token && token.length > 0) return;
+  if (isLoopbackHost(host)) return;
+  throw new BindAuthorityError(host);
+}
+function mountBearerAuth(app, opts) {
+  if (!opts.token || opts.token.length === 0) return;
+  if (opts.trustProxy) return;
+  const expected = Buffer.from(opts.token, "utf8");
+  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  app.addHook("preHandler", (req2, reply, done) => {
+    const path39 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    for (const suffix of suffixes) {
+      if (path39 === suffix || path39.endsWith(suffix)) {
+        done();
+        return;
+      }
+    }
+    const header = req2.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    const provided = Buffer.from(header.slice("Bearer ".length).trim(), "utf8");
+    if (provided.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(provided, expected)) {
+      void reply.code(401).send({ error: "unauthorized" });
+      return;
+    }
+    done();
+  });
+}
+function readAuthEnv(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  const ot = env.NEAT_OTEL_TOKEN;
+  return {
+    authToken: t && t.length > 0 ? t : void 0,
+    otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
+    trustProxy: env.NEAT_AUTH_PROXY === "true"
+  };
+}
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, DEFAULT_UNAUTH_SUFFIXES;
+var init_auth = __esm({
+  "src/auth.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto = require("crypto");
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+      "127.0.0.1",
+      "localhost",
+      "::1",
+      "::ffff:127.0.0.1"
+    ]);
+    BindAuthorityError = class extends Error {
+      constructor(host) {
+        super(
+          `NEAT refuses to bind on a public interface without \`NEAT_AUTH_TOKEN\` set (host="${host}"). Set the token or bind to loopback only.`
+        );
+        this.name = "BindAuthorityError";
+      }
+    };
+    DEFAULT_UNAUTH_SUFFIXES = ["/health", "/healthz", "/readyz"];
+  }
+});
+
 // src/otel-grpc.ts
 var otel_grpc_exports = {};
 __export(otel_grpc_exports, {
@@ -122,8 +191,21 @@ function loadTraceService() {
 async function startOtelGrpcReceiver(opts) {
   const server = new grpc.Server();
   const service = loadTraceService();
+  const requiresAuth = !opts.trustProxy && !!opts.authToken && opts.authToken.length > 0;
+  const expectedHeader = requiresAuth ? `Bearer ${opts.authToken}` : "";
   server.addService(service, {
     Export: (call, callback) => {
+      if (requiresAuth) {
+        const meta = call.metadata.get("authorization");
+        const got = meta.length > 0 ? String(meta[0]) : "";
+        const a = Buffer.from(got, "utf8");
+        const b = Buffer.from(expectedHeader, "utf8");
+        const ok = a.length === b.length && (0, import_node_crypto2.timingSafeEqual)(a, b);
+        if (!ok) {
+          callback({ code: grpc.status.UNAUTHENTICATED, message: "unauthorized" });
+          return;
+        }
+      }
       void (async () => {
         try {
           const reshaped = reshapeGrpcRequest(call.request ?? {});
@@ -156,13 +238,14 @@ async function startOtelGrpcReceiver(opts) {
     })
   };
 }
-var import_node_url, import_node_path34, grpc, protoLoader;
+var import_node_url, import_node_path34, import_node_crypto2, grpc, protoLoader;
 var init_otel_grpc = __esm({
   "src/otel-grpc.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_url = require("url");
     import_node_path34 = __toESM(require("path"), 1);
+    import_node_crypto2 = require("crypto");
     grpc = __toESM(require("@grpc/grpc-js"), 1);
     protoLoader = __toESM(require("@grpc/proto-loader"), 1);
     init_otel();
@@ -257,8 +340,7 @@ function parseOtlpRequest(body) {
   }
   return out;
 }
-function loadProtobufDecoder() {
-  if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
+function loadProtoRoot() {
   const here = import_node_path35.default.dirname((0, import_node_url2.fileURLToPath)(importMetaUrl));
   const protoRoot = import_node_path35.default.resolve(here, "..", "proto");
   const root = new import_protobufjs.default.Root();
@@ -267,11 +349,32 @@ function loadProtobufDecoder() {
     "opentelemetry/proto/collector/trace/v1/trace_service.proto",
     { keepCase: true }
   );
+  return root;
+}
+function loadProtobufDecoder() {
+  if (exportTraceServiceRequestType) return exportTraceServiceRequestType;
+  const root = loadProtoRoot();
   exportTraceServiceRequestType = root.lookupType(
     "opentelemetry.proto.collector.trace.v1.ExportTraceServiceRequest"
   );
   return exportTraceServiceRequestType;
 }
+function loadProtobufResponseEncoder() {
+  if (exportTraceServiceResponseType) return exportTraceServiceResponseType;
+  const root = loadProtoRoot();
+  exportTraceServiceResponseType = root.lookupType(
+    "opentelemetry.proto.collector.trace.v1.ExportTraceServiceResponse"
+  );
+  return exportTraceServiceResponseType;
+}
+function encodeProtobufResponseBody() {
+  if (cachedProtobufResponseBody) return cachedProtobufResponseBody;
+  const Type = loadProtobufResponseEncoder();
+  const msg = Type.create({});
+  const encoded = Type.encode(msg).finish();
+  cachedProtobufResponseBody = Buffer.from(encoded);
+  return cachedProtobufResponseBody;
+}
 async function decodeProtobufBody(buf) {
   const Type = loadProtobufDecoder();
   const decoded = Type.decode(buf).toJSON();
@@ -283,6 +386,7 @@ async function buildOtelReceiver(opts) {
     logger: false,
     bodyLimit: opts.bodyLimit ?? 16 * 1024 * 1024
   });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const queue = [];
   let draining = false;
   let drainPromise = Promise.resolve();
@@ -318,7 +422,9 @@ async function buildOtelReceiver(opts) {
   app.post("/v1/traces", async (req2, reply) => {
     const ct = (req2.headers["content-type"] ?? "").toString().split(";")[0].trim().toLowerCase();
     let body;
+    let responseFlavor;
     if (ct === "application/x-protobuf") {
+      responseFlavor = "protobuf";
       try {
         body = await decodeProtobufBody(req2.body);
       } catch (err) {
@@ -327,6 +433,7 @@ async function buildOtelReceiver(opts) {
         });
       }
     } else if (!ct || ct === "application/json") {
+      responseFlavor = "json";
       body = req2.body ?? {};
     } else {
       return reply.code(415).send({ error: `unsupported content-type: ${ct}` });
@@ -344,7 +451,11 @@ async function buildOtelReceiver(opts) {
       }
     }
     enqueue(spans);
-    return reply.code(200).send({ partialSuccess: {} });
+    if (responseFlavor === "protobuf") {
+      const buf = encodeProtobufResponseBody();
+      return reply.code(200).header("content-type", "application/x-protobuf").send(buf);
+    }
+    return reply.code(200).header("content-type", "application/json").send({ partialSuccess: {} });
   });
   const decorated = app;
   decorated.flushPending = async () => {
@@ -354,7 +465,7 @@ async function buildOtelReceiver(opts) {
   };
   return decorated;
 }
-var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType;
+var import_node_path35, import_node_url2, import_fastify2, import_protobufjs, exportTraceServiceRequestType, exportTraceServiceResponseType, cachedProtobufResponseBody;
 var init_otel = __esm({
   "src/otel.ts"() {
     "use strict";
@@ -363,7 +474,10 @@ var init_otel = __esm({
     import_node_url2 = require("url");
     import_fastify2 = __toESM(require("fastify"), 1);
     import_protobufjs = __toESM(require("protobufjs"), 1);
+    init_auth();
     exportTraceServiceRequestType = null;
+    exportTraceServiceResponseType = null;
+    cachedProtobufResponseBody = null;
   }
 });
 
@@ -4617,6 +4731,7 @@ data: ${JSON.stringify(envelope.payload)}
 }
 
 // src/api.ts
+init_auth();
 function serializeGraph(graph) {
   const nodes = [];
   graph.forEachNode((_id, attrs) => {
@@ -4982,6 +5097,7 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
+  mountBearerAuth(app, { token: opts.authToken, trustProxy: opts.trustProxy });
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
   const legacyErrorsExplicit = !opts.projects && opts.errorsPath !== void 0;
@@ -5045,6 +5161,7 @@ async function buildApi(opts) {
 
 // src/daemon.ts
 init_otel();
+init_auth();
 function neatHomeFor(opts) {
   if (opts.neatHome && opts.neatHome.length > 0) return import_node_path36.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
@@ -5055,13 +5172,35 @@ function neatHomeFor(opts) {
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
   for (const entry2 of projects) {
-    if (entry2.status !== "active") continue;
-    if (entry2.languages.length === 0) {
-    }
+    if (entry2.status === "paused") continue;
     if (entry2.name === serviceName) return entry2.name;
   }
+  const candidates = [];
+  for (const entry2 of projects) {
+    if (entry2.status === "paused") continue;
+    if (isTokenPrefix(entry2.name, serviceName)) candidates.push(entry2);
+  }
+  if (candidates.length > 0) {
+    candidates.sort((a, b) => b.name.length - a.name.length);
+    return candidates[0].name;
+  }
+  for (const entry2 of projects) {
+    if (entry2.status === "paused") continue;
+    if (isTokenContained(entry2.name, serviceName)) return entry2.name;
+  }
   return DEFAULT_PROJECT;
 }
+function isTokenPrefix(prefix, full) {
+  if (prefix.length >= full.length) return false;
+  if (!full.startsWith(prefix)) return false;
+  const sep = full.charAt(prefix.length);
+  return sep === "-" || sep === "_";
+}
+function isTokenContained(needle, haystack) {
+  if (!haystack.includes(needle)) return false;
+  const tokens = haystack.split(/[-_]/);
+  return tokens.includes(needle);
+}
 async function bootstrapProject(entry2) {
   const paths = pathsForProject(entry2.name, import_node_path36.default.join(entry2.path, "neat-out"));
   try {
@@ -5141,6 +5280,17 @@ async function startDaemon(opts = {}) {
 `);
   const slots = /* @__PURE__ */ new Map();
   const registry = new Projects();
+  const DROP_WARN_INTERVAL_MS = 6e4;
+  const lastDropWarnAt = /* @__PURE__ */ new Map();
+  function warnDroppedSpan(project, reason) {
+    const now = Date.now();
+    const prev = lastDropWarnAt.get(project) ?? 0;
+    if (now - prev < DROP_WARN_INTERVAL_MS) return;
+    lastDropWarnAt.set(project, now);
+    console.warn(
+      `[neatd] dropping span for project "${project}" \u2014 project status: broken (${reason}). Run \`neatd reload\` to retry bootstrap.`
+    );
+  }
   function upsertRegistryFromSlot(slot) {
     if (slot.status !== "active") return;
     registry.set(slot.entry.name, {
@@ -5149,12 +5299,38 @@ async function startDaemon(opts = {}) {
       graph: slot.graph
     });
   }
+  async function tryRecoverSlot(entry2) {
+    try {
+      const fresh = await bootstrapProject(entry2);
+      slots.set(entry2.name, fresh);
+      upsertRegistryFromSlot(fresh);
+      if (fresh.status === "active") {
+        await setStatus(entry2.name, "active").catch(() => {
+        });
+        console.log(
+          `neatd: project "${entry2.name}" recovered from broken \u2014 active`
+        );
+      }
+      return fresh;
+    } catch (err) {
+      console.warn(
+        `neatd: project "${entry2.name}" still broken after recovery attempt \u2014 ${err.message}`
+      );
+      return slots.get(entry2.name);
+    }
+  }
   async function loadAll() {
     const projects = await listProjects();
     const seen = /* @__PURE__ */ new Set();
     for (const entry2 of projects) {
       seen.add(entry2.name);
-      if (slots.has(entry2.name)) continue;
+      const existing = slots.get(entry2.name);
+      if (existing) {
+        if (existing.status === "broken") {
+          await tryRecoverSlot(entry2);
+        }
+        continue;
+      }
       try {
         const slot = await bootstrapProject(entry2);
         slots.set(entry2.name, slot);
@@ -5192,8 +5368,14 @@ async function startDaemon(opts = {}) {
     const host = resolveHost(opts);
     const restPort = resolveRestPort(opts);
     const otlpPort = resolveOtlpPort(opts);
+    const auth = readAuthEnv();
+    assertBindAuthority(host, auth.authToken);
     try {
-      restApp = await buildApi({ projects: registry });
+      restApp = await buildApi({
+        projects: registry,
+        authToken: auth.authToken,
+        trustProxy: auth.trustProxy
+      });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);
     } catch (err) {
@@ -5211,13 +5393,30 @@ async function startDaemon(opts = {}) {
         `neatd: failed to bind REST on port ${restPort} \u2014 ${err.message}`
       );
     }
+    async function resolveTargetSlot(serviceName) {
+      const liveEntries = await listProjects().catch(() => []);
+      const target = routeSpanToProject(serviceName, liveEntries);
+      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
+      if (!slot) return null;
+      if (slot.status === "broken") {
+        const entry2 = liveEntries.find((e) => e.name === slot.entry.name);
+        if (entry2) {
+          slot = await tryRecoverSlot(entry2);
+        }
+        if (slot.status !== "active") {
+          warnDroppedSpan(slot.entry.name, slot.errorReason ?? "unknown");
+          return null;
+        }
+      }
+      return slot.status === "active" ? slot : null;
+    }
     try {
       otlpApp = await buildOtelReceiver({
+        authToken: auth.otelToken,
+        trustProxy: auth.trustProxy,
         onSpan: async (span) => {
-          const liveEntries = await listProjects().catch(() => []);
-          const target = routeSpanToProject(span.service, liveEntries);
-          const slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
-          if (!slot || slot.status !== "active") return;
+          const slot = await resolveTargetSlot(span.service);
+          if (!slot) return;
           await handleSpan(
             {
               graph: slot.graph,
@@ -5230,10 +5429,8 @@ async function startDaemon(opts = {}) {
           );
         },
         onErrorSpanSync: async (span) => {
-          const liveEntries = await listProjects().catch(() => []);
-          const target = routeSpanToProject(span.service, liveEntries);
-          const slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT);
-          if (!slot || slot.status !== "active") return;
+          const slot = await resolveTargetSlot(span.service);
+          if (!slot) return;
           await makeErrorSpanWriter(slot.paths.errorsPath)(span);
         }
       });
@@ -5296,6 +5493,9 @@ async function startDaemon(opts = {}) {
   return { slots, reload, stop, pidPath, restAddress, otlpAddress };
 }
 
+// src/neatd.ts
+init_auth();
+
 // src/web-spawn.ts
 init_cjs_shims();
 var import_node_child_process = require("child_process");
@@ -5491,7 +5691,16 @@ function restPortFromEnv() {
   return raw && raw.length > 0 ? Number.parseInt(raw, 10) : 8080;
 }
 async function cmdStart() {
-  const handle = await startDaemon();
+  let handle;
+  try {
+    handle = await startDaemon();
+  } catch (err) {
+    if (err instanceof BindAuthorityError) {
+      console.error(`neatd: ${err.message}`);
+      process.exit(1);
+    }
+    throw err;
+  }
   console.log(`neatd: started, PID ${process.pid}, ${handle.slots.size} project(s)`);
   console.log(`neatd: registry at ${registryPath()}`);
   if (handle.restAddress) console.log(`neatd: REST  \u2192 ${handle.restAddress}`);