@neat.is/core 0.3.7 → 0.3.8

package/dist/{chunk-EDHOCFOG.js → chunk-LQ3JFBTX.js}

@@ -15,10 +15,12 @@ import {
   startPersistLoop,
   touchLastSeen,
   writeAtomically
-} from "./chunk-ZU2RQRCN.js";
+} from "./chunk-CZ3T6TE2.js";
 import {
-  buildOtelReceiver
-} from "./chunk-75IBA4UL.js";
+  assertBindAuthority,
+  buildOtelReceiver,
+  readAuthEnv
+} from "./chunk-7TYESDAI.js";
 
 // src/daemon.ts
 import { promises as fs } from "fs";
@@ -229,8 +231,14 @@ async function startDaemon(opts = {}) {
     const host = resolveHost(opts);
     const restPort = resolveRestPort(opts);
     const otlpPort = resolveOtlpPort(opts);
+    const auth = readAuthEnv();
+    assertBindAuthority(host, auth.authToken);
     try {
-      restApp = await buildApi({ projects: registry });
+      restApp = await buildApi({
+        projects: registry,
+        authToken: auth.authToken,
+        trustProxy: auth.trustProxy
+      });
       restAddress = await restApp.listen({ port: restPort, host });
       console.log(`neatd: REST listening on ${restAddress}`);
     } catch (err) {
@@ -267,6 +275,8 @@ async function startDaemon(opts = {}) {
     }
     try {
       otlpApp = await buildOtelReceiver({
+        authToken: auth.otelToken,
+        trustProxy: auth.trustProxy,
         onSpan: async (span) => {
           const slot = await resolveTargetSlot(span.service);
           if (!slot) return;
@@ -350,4 +360,4 @@ export {
   routeSpanToProject,
   startDaemon
 };
-//# sourceMappingURL=chunk-EDHOCFOG.js.map
+//# sourceMappingURL=chunk-LQ3JFBTX.js.map

package/dist/chunk-LQ3JFBTX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/daemon.ts"],"sourcesContent":["/**\n * Multi-project daemon (ADR-049).\n *\n * Single long-lived process watching every project in the machine-level registry.\n * Per-project graph isolation: each registered project owns its own\n * `MultiDirectedGraph` slot keyed by name (ADR-026), and a failure during\n * one project's bootstrap is logged + marked `broken` without taking down\n * the rest of the daemon.\n *\n * MVP scope (v0.2.5):\n *  - Read registry; refuse to boot when it's missing.\n *  - Write PID at `~/.neat/neatd.pid` for external supervisors.\n *  - Per project: load any existing snapshot, run initial extraction,\n *    start a per-project persist loop.\n *  - SIGHUP triggers a reload — re-reads the registry, picks up new\n *    projects, drops removed ones, leaves untouched ones in place.\n *  - Provide `routeSpanToProject(serviceName, projects)` for OTel ingest\n *    to dispatch by `service.name` across registered projects, falling\n *    back to `default` for unknown services per ADR-033.\n *\n * Out of MVP scope (deferred):\n *  - Live OTel listener wiring per project — daemon exposes the routing\n *    primitive; the actual receiver attachment lands alongside v0.2.6.\n *  - Policy reload on `policy.json` mtime — `startWatch` already does this\n *    per-project; the daemon-level loop reuses that machinery in a follow-up.\n *  - Auto-restart on crash. PID file is the supervisor handoff.\n */\n\nimport { promises as fs } from 'node:fs'\nimport path from 'node:path'\nimport type { FastifyInstance } from 'fastify'\nimport { DEFAULT_PROJECT, getGraph, resetGraph, type NeatGraph } from './graph.js'\nimport { extractFromDirectory } from './extract.js'\nimport { loadGraphFromDisk, startPersistLoop } from './persist.js'\nimport { Projects, pathsForProject, type ProjectPaths } from './projects.js'\nimport { buildApi } from './api.js'\nimport { buildOtelReceiver } from './otel.js'\nimport { handleSpan, makeErrorSpanWriter } from './ingest.js'\nimport {\n  listProjects,\n  registryPath,\n  setStatus,\n  touchLastSeen,\n  writeAtomically,\n} from './registry.js'\nimport { assertBindAuthority, readAuthEnv } from './auth.js'\nimport type { RegistryEntry } from '@neat.is/types'\n\nexport interface DaemonOptions {\n  // Defaults to `~/.neat/`. Honors NEAT_HOME the same way registry.ts does.\n  // Tests override via NEAT_HOME and don't pass this directly.\n  neatHome?: string\n  // ADR-063 — bind targets. Defaults to PORT (8080) / OTEL_PORT (4318) env\n  // vars, matching server.ts. Tests pass 0 to get ephemeral ports.\n  restPort?: number\n  otlpPort?: number\n  // ADR-063 — bind host. Defaults to HOST env (0.0.0.0).\n  host?: string\n  // ADR-063 — opt out of binding entirely (e.g. integration tests that\n  // exercise daemon slots without needing the listeners). Production\n  // `neatd start` never sets this.\n  bindListeners?: boolean\n}\n\nexport interface ProjectSlot {\n  entry: RegistryEntry\n  graph: NeatGraph\n  outPath: string\n  paths: ProjectPaths\n  stopPersist: () => void\n  status: 'active' | 'broken'\n  errorReason?: string\n}\n\nexport interface DaemonHandle {\n  // The slots currently being managed, keyed by project name. Tests inspect\n  // this to assert isolation properties.\n  slots: Map<string, ProjectSlot>\n  // Re-read the registry. New entries get bootstrapped, removed ones get\n  // their persist loops stopped, existing ones stay running.\n  reload: () => Promise<void>\n  // Graceful shutdown — stop every project's persist loop and remove the\n  // PID file.\n  stop: () => Promise<void>\n  // Path to the PID file the daemon owns. Useful for test assertions.\n  pidPath: string\n  // ADR-063 — addresses where consumers reach the daemon. Empty string when\n  // bindListeners is false. REST is the Fastify app's listening address;\n  // OTLP is the receiver's.\n  restAddress: string\n  otlpAddress: string\n}\n\nfunction neatHomeFor(opts: DaemonOptions): string {\n  if (opts.neatHome && opts.neatHome.length > 0) return path.resolve(opts.neatHome)\n  const env = process.env.NEAT_HOME\n  if (env && env.length > 0) return path.resolve(env)\n  const home = process.env.HOME ?? process.env.USERPROFILE ?? ''\n  return path.join(home, '.neat')\n}\n\n/**\n * Resolve which project's graph an OTel span belongs to. Looks up the\n * `service.name` against the registry and returns the matching project's\n * name, or `DEFAULT_PROJECT` for unknown services so the FrontierNode\n * auto-creation flow keeps working per ADR-033.\n *\n * Pure function. Daemon callers pass a snapshot of the registry to avoid\n * per-span fs reads.\n *\n * Matching order (ADR-072 — real-world `service.name` rarely equals project\n * name; monorepos publish per-package names like `brief-api` under a\n * project named `brief`):\n *\n *   1. Exact: `entry.name === serviceName`.\n *   2. Hyphen/underscore-separated prefix: `entry.name` is a leading token\n *      of `serviceName` (`brief` matches `brief-api`, `brief_worker`).\n *      Longest-match wins so `brief-api` beats `brief` when both are\n *      registered.\n *   3. Containment as a separator-delimited token (`api` inside\n *      `brief-api-staging`).\n *\n * Routing eligibility (ADR-071):\n * - `active` matches at every pass (the steady-state path).\n * - `broken` also matches — the daemon needs the span to reach the broken\n *   slot so the ingest-time auto-recover path can attempt a bootstrap and\n *   lift the project back to `active`. The router only chooses the target;\n *   whether the span actually lands is the ingest handler's decision.\n * - `paused` is intentionally not routed; the operator paused it on\n *   purpose, so the span falls through to the default-project flow.\n *\n * Falls back to `DEFAULT_PROJECT` when nothing matches.\n */\nexport function routeSpanToProject(\n  serviceName: string | undefined,\n  projects: ReadonlyArray<RegistryEntry>,\n): string {\n  if (!serviceName) return DEFAULT_PROJECT\n  // Pass 1 — exact match.\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (entry.name === serviceName) return entry.name\n  }\n  // Pass 2 — hyphen/underscore-separated prefix. Longest project name wins\n  // so a registered `brief-api` outranks a registered `brief` when the\n  // span's service.name is `brief-api-staging`.\n  const candidates: RegistryEntry[] = []\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (isTokenPrefix(entry.name, serviceName)) candidates.push(entry)\n  }\n  if (candidates.length > 0) {\n    candidates.sort((a, b) => b.name.length - a.name.length)\n    return candidates[0]!.name\n  }\n  // Pass 3 — containment as a separator-delimited token. Last-resort match\n  // for `api` inside `brief-api-staging` when only `api` is registered.\n  for (const entry of projects) {\n    if (entry.status === 'paused') continue\n    if (isTokenContained(entry.name, serviceName)) return entry.name\n  }\n  return DEFAULT_PROJECT\n}\n\n// True when `prefix` matches the first hyphen/underscore-separated token(s)\n// of `full`. `brief` matches `brief-api`, `brief_worker`, but not `briefcase`.\nfunction isTokenPrefix(prefix: string, full: string): boolean {\n  if (prefix.length >= full.length) return false\n  if (!full.startsWith(prefix)) return false\n  const sep = full.charAt(prefix.length)\n  return sep === '-' || sep === '_'\n}\n\n// True when `needle` appears in `haystack` bordered by separators on both\n// sides (so it's a complete token, not a substring of a longer word).\nfunction isTokenContained(needle: string, haystack: string): boolean {\n  if (!haystack.includes(needle)) return false\n  const tokens = haystack.split(/[-_]/)\n  return tokens.includes(needle)\n}\n\nasync function bootstrapProject(entry: RegistryEntry): Promise<ProjectSlot> {\n  const paths = pathsForProject(entry.name, path.join(entry.path, 'neat-out'))\n\n  // Path missing on disk → mark broken and surface the reason. Daemon\n  // continues with the rest of the registry.\n  try {\n    const stat = await fs.stat(entry.path)\n    if (!stat.isDirectory()) {\n      throw new Error(`registered path ${entry.path} is not a directory`)\n    }\n  } catch (err) {\n    await setStatus(entry.name, 'broken').catch(() => {})\n    return {\n      entry,\n      // Empty graph is fine — `slots` keeps the entry visible in `status`\n      // output; nothing routes to it because it's not 'active'.\n      graph: getGraph(`__broken__:${entry.name}`),\n      outPath: '',\n      paths,\n      stopPersist: () => {},\n      status: 'broken',\n      errorReason: (err as Error).message,\n    }\n  }\n\n  // Use the project name as the in-memory graph key. Any prior contents\n  // are wiped because the daemon owns the slot for the lifetime of this\n  // bootstrap (ADR-030 — mutation authority).\n  resetGraph(entry.name)\n  const graph = getGraph(entry.name)\n  const outPath = paths.snapshotPath\n\n  await loadGraphFromDisk(graph, outPath)\n  await extractFromDirectory(graph, entry.path)\n  const stopPersist = startPersistLoop(graph, outPath)\n  await touchLastSeen(entry.name).catch(() => {})\n\n  return {\n    entry,\n    graph,\n    outPath,\n    paths,\n    stopPersist,\n    status: 'active',\n  }\n}\n\nfunction resolveRestPort(opts: DaemonOptions): number {\n  if (typeof opts.restPort === 'number') return opts.restPort\n  const env = process.env.PORT\n  if (env && env.length > 0) {\n    const n = Number.parseInt(env, 10)\n    if (Number.isFinite(n)) return n\n  }\n  return 8080\n}\n\nfunction resolveOtlpPort(opts: DaemonOptions): number {\n  if (typeof opts.otlpPort === 'number') return opts.otlpPort\n  const env = process.env.OTEL_PORT\n  if (env && env.length > 0) {\n    const n = Number.parseInt(env, 10)\n    if (Number.isFinite(n)) return n\n  }\n  return 4318\n}\n\nfunction resolveHost(opts: DaemonOptions): string {\n  if (opts.host && opts.host.length > 0) return opts.host\n  const env = process.env.HOST\n  if (env && env.length > 0) return env\n  return '0.0.0.0'\n}\n\nexport async function startDaemon(opts: DaemonOptions = {}): Promise<DaemonHandle> {\n  const home = neatHomeFor(opts)\n  const regPath = registryPath()\n  // Graceful degradation per ADR-049 #6: missing registry refuses to boot\n  // with a clear error rather than silently coming up empty.\n  try {\n    await fs.access(regPath)\n  } catch {\n    throw new Error(\n      `neatd: registry not found at ${regPath}. Run \\`neat init <path>\\` to register a project before starting the daemon.`,\n    )\n  }\n\n  const pidPath = path.join(home, 'neatd.pid')\n  await writeAtomically(pidPath, `${process.pid}\\n`)\n\n  const slots = new Map<string, ProjectSlot>()\n  // Projects registry mirrors slots for the REST listener (ADR-063). buildApi\n  // reads from this; we keep it in sync as slots come and go.\n  const registry = new Projects()\n\n  // Rate-limit the dropped-span warning to one log line per project per\n  // 60 seconds. OTel exporters retry on a tight cadence; without this we\n  // flood the console with the same line per batch when a broken project\n  // is sitting in the registry.\n  const DROP_WARN_INTERVAL_MS = 60_000\n  const lastDropWarnAt = new Map<string, number>()\n  function warnDroppedSpan(project: string, reason: string): void {\n    const now = Date.now()\n    const prev = lastDropWarnAt.get(project) ?? 0\n    if (now - prev < DROP_WARN_INTERVAL_MS) return\n    lastDropWarnAt.set(project, now)\n    console.warn(\n      `[neatd] dropping span for project \"${project}\" — project status: broken (${reason}). Run \\`neatd reload\\` to retry bootstrap.`,\n    )\n  }\n\n  function upsertRegistryFromSlot(slot: ProjectSlot): void {\n    if (slot.status !== 'active') return\n    registry.set(slot.entry.name, {\n      scanPath: slot.entry.path,\n      paths: slot.paths,\n      graph: slot.graph,\n    })\n  }\n\n  // Attempt to bring a broken slot back online. Used both on SIGHUP reload\n  // and inline on ingest when a span arrives for a broken project. Returns\n  // the new slot status so callers can decide whether to deliver the span.\n  async function tryRecoverSlot(entry: RegistryEntry): Promise<ProjectSlot> {\n    try {\n      const fresh = await bootstrapProject(entry)\n      slots.set(entry.name, fresh)\n      upsertRegistryFromSlot(fresh)\n      if (fresh.status === 'active') {\n        await setStatus(entry.name, 'active').catch(() => {})\n        console.log(\n          `neatd: project \"${entry.name}\" recovered from broken — active`,\n        )\n      }\n      return fresh\n    } catch (err) {\n      console.warn(\n        `neatd: project \"${entry.name}\" still broken after recovery attempt — ${(err as Error).message}`,\n      )\n      // Leave the existing broken slot in place; nothing changed.\n      return slots.get(entry.name)!\n    }\n  }\n\n  async function loadAll(): Promise<void> {\n    const projects = await listProjects()\n    const seen = new Set<string>()\n    for (const entry of projects) {\n      seen.add(entry.name)\n      const existing = slots.get(entry.name)\n      if (existing) {\n        // SIGHUP shortcut: re-bootstrap any slot currently in `broken`. The\n        // operator's mental model for `neatd reload` is \"look at the world\n        // again,\" so a broken slot that became reachable between boots gets\n        // a second chance.\n        if (existing.status === 'broken') {\n          await tryRecoverSlot(entry)\n        }\n        continue\n      }\n      try {\n        const slot = await bootstrapProject(entry)\n        slots.set(entry.name, slot)\n        upsertRegistryFromSlot(slot)\n        if (slot.status === 'broken') {\n          console.warn(`neatd: project \"${entry.name}\" broken — ${slot.errorReason}`)\n        } else {\n          console.log(`neatd: project \"${entry.name}\" active (${entry.path})`)\n        }\n      } catch (err) {\n        console.warn(\n          `neatd: project \"${entry.name}\" failed to bootstrap — ${(err as Error).message}`,\n        )\n        await setStatus(entry.name, 'broken').catch(() => {})\n      }\n    }\n    // Drop entries the registry no longer carries.\n    for (const [name, slot] of [...slots.entries()]) {\n      if (seen.has(name)) continue\n      try {\n        slot.stopPersist()\n      } catch {\n        // best-effort\n      }\n      slots.delete(name)\n      console.log(`neatd: project \"${name}\" removed from registry — stopped`)\n    }\n  }\n\n  await loadAll()\n\n  // ADR-063 — bind the REST host and the OTLP HTTP receiver. One listener\n  // each, multi-tenant by project name in the URL (REST) and by service.name\n  // dispatch (OTLP). Failure on either listen aborts startDaemon with a\n  // surfacing error rather than letting the supervisor sit half-up.\n  const bind = opts.bindListeners !== false\n  let restApp: FastifyInstance | null = null\n  let otlpApp:\n    | (FastifyInstance & { flushPending: () => Promise<void> })\n    | null = null\n  let restAddress = ''\n  let otlpAddress = ''\n\n  if (bind) {\n    const host = resolveHost(opts)\n    const restPort = resolveRestPort(opts)\n    const otlpPort = resolveOtlpPort(opts)\n\n    // ADR-073 §3 — fail-loud before binding. Loopback-only without a token is\n    // fine (laptop dev); a public bind without one is not.\n    const auth = readAuthEnv()\n    assertBindAuthority(host, auth.authToken)\n\n    try {\n      restApp = await buildApi({\n        projects: registry,\n        authToken: auth.authToken,\n        trustProxy: auth.trustProxy,\n      })\n      restAddress = await restApp.listen({ port: restPort, host })\n      console.log(`neatd: REST listening on ${restAddress}`)\n    } catch (err) {\n      // Roll back anything we started so far before surfacing the error.\n      for (const slot of slots.values()) {\n        try {\n          slot.stopPersist()\n        } catch {\n          // best-effort\n        }\n      }\n      if (restApp) await restApp.close().catch(() => {})\n      await fs.unlink(pidPath).catch(() => {})\n      throw new Error(\n        `neatd: failed to bind REST on port ${restPort} — ${(err as Error).message}`,\n      )\n    }\n\n    // Resolve a span's target slot — running the broken-state recovery\n    // when the routed slot is currently broken. Returns null when the span\n    // can't be delivered after the recovery attempt; the caller drops with\n    // a rate-limited warning.\n    async function resolveTargetSlot(\n      serviceName: string | undefined,\n    ): Promise<ProjectSlot | null> {\n      const liveEntries = await listProjects().catch(() => [])\n      const target = routeSpanToProject(serviceName, liveEntries)\n      let slot = slots.get(target) ?? slots.get(DEFAULT_PROJECT)\n      if (!slot) return null\n      if (slot.status === 'broken') {\n        const entry = liveEntries.find((e) => e.name === slot!.entry.name)\n        if (entry) {\n          slot = await tryRecoverSlot(entry)\n        }\n        if (slot.status !== 'active') {\n          warnDroppedSpan(slot.entry.name, slot.errorReason ?? 'unknown')\n          return null\n        }\n      }\n      return slot.status === 'active' ? slot : null\n    }\n\n    try {\n      otlpApp = await buildOtelReceiver({\n        authToken: auth.otelToken,\n        trustProxy: auth.trustProxy,\n        onSpan: async (span) => {\n          // ADR-049 OTel routing — dispatch by service.name. Broken slots\n          // get a single inline recovery attempt before the span is dropped\n          // with a rate-limited log line. Unknown services route to\n          // DEFAULT_PROJECT so the FrontierNode auto-creation flow keeps\n          // working (ADR-033).\n          const slot = await resolveTargetSlot(span.service)\n          if (!slot) return\n          await handleSpan(\n            {\n              graph: slot.graph,\n              errorsPath: slot.paths.errorsPath,\n              project: slot.entry.name,\n              // Receiver already wrote the error event synchronously below.\n              writeErrorEventInline: false,\n            },\n            span,\n          )\n        },\n        onErrorSpanSync: async (span) => {\n          const slot = await resolveTargetSlot(span.service)\n          if (!slot) return\n          await makeErrorSpanWriter(slot.paths.errorsPath)(span)\n        },\n      })\n      otlpAddress = await otlpApp.listen({ port: otlpPort, host })\n      console.log(`neatd: OTLP listening on ${otlpAddress}/v1/traces`)\n    } catch (err) {\n      for (const slot of slots.values()) {\n        try {\n          slot.stopPersist()\n        } catch {\n          // best-effort\n        }\n      }\n      if (restApp) await restApp.close().catch(() => {})\n      if (otlpApp) await otlpApp.close().catch(() => {})\n      await fs.unlink(pidPath).catch(() => {})\n      throw new Error(\n        `neatd: failed to bind OTLP on port ${otlpPort} — ${(err as Error).message}`,\n      )\n    }\n  }\n\n  let reloading: Promise<void> | null = null\n  const reload = async (): Promise<void> => {\n    if (reloading) return reloading\n    reloading = (async () => {\n      try {\n        await loadAll()\n      } finally {\n        reloading = null\n      }\n    })()\n    return reloading\n  }\n\n  // SIGHUP — external \"reload your config\" signal. ADR-049 #2.\n  const sighupHandler = (): void => {\n    void reload().catch((err) => {\n      console.warn(`neatd: SIGHUP reload failed — ${(err as Error).message}`)\n    })\n  }\n  process.on('SIGHUP', sighupHandler)\n\n  let stopped = false\n  const stop = async (): Promise<void> => {\n    if (stopped) return\n    stopped = true\n    process.off('SIGHUP', sighupHandler)\n    if (otlpApp) await otlpApp.close().catch(() => {})\n    if (restApp) await restApp.close().catch(() => {})\n    for (const slot of slots.values()) {\n      try {\n        slot.stopPersist()\n      } catch {\n        // best-effort\n      }\n    }\n    await fs.unlink(pidPath).catch(() => {})\n  }\n\n  return { slots, reload, stop, pidPath, restAddress, otlpAddress }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AAgEjB,SAAS,YAAY,MAA6B;AAChD,MAAI,KAAK,YAAY,KAAK,SAAS,SAAS,EAAG,QAAO,KAAK,QAAQ,KAAK,QAAQ;AAChF,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,EAAG,QAAO,KAAK,QAAQ,GAAG;AAClD,QAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,SAAO,KAAK,KAAK,MAAM,OAAO;AAChC;AAkCO,SAAS,mBACd,aACA,UACQ;AACR,MAAI,CAAC,YAAa,QAAO;AAEzB,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,MAAM,SAAS,YAAa,QAAO,MAAM;AAAA,EAC/C;AAIA,QAAM,aAA8B,CAAC;AACrC,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,cAAc,MAAM,MAAM,WAAW,EAAG,YAAW,KAAK,KAAK;AAAA,EACnE;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,eAAW,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,SAAS,EAAE,KAAK,MAAM;AACvD,WAAO,WAAW,CAAC,EAAG;AAAA,EACxB;AAGA,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,WAAW,SAAU;AAC/B,QAAI,iBAAiB,MAAM,MAAM,WAAW,EAAG,QAAO,MAAM;AAAA,EAC9D;AACA,SAAO;AACT;AAIA,SAAS,cAAc,QAAgB,MAAuB;AAC5D,MAAI,OAAO,UAAU,KAAK,OAAQ,QAAO;AACzC,MAAI,CAAC,KAAK,WAAW,MAAM,EAAG,QAAO;AACrC,QAAM,MAAM,KAAK,OAAO,OAAO,MAAM;AACrC,SAAO,QAAQ,OAAO,QAAQ;AAChC;AAIA,SAAS,iBAAiB,QAAgB,UAA2B;AACnE,MAAI,CAAC,SAAS,SAAS,MAAM,EAAG,QAAO;AACvC,QAAM,SAAS,SAAS,MAAM,MAAM;AACpC,SAAO,OAAO,SAAS,MAAM;AAC/B;AAEA,eAAe,iBAAiB,OAA4C;AAC1E,QAAM,QAAQ,gBAAgB,MAAM,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU,CAAC;AAI3E,MAAI;AACF,UAAM,OAAO,MAAM,GAAG,KAAK,MAAM,IAAI;AACrC,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,YAAM,IAAI,MAAM,mBAAmB,MAAM,IAAI,qBAAqB;AAAA,IACpE;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACpD,WAAO;AAAA,MACL;AAAA;AAAA;AAAA,MAGA,OAAO,SAAS,cAAc,MAAM,IAAI,EAAE;AAAA,MAC1C,SAAS;AAAA,MACT;AAAA,MACA,aAAa,MAAM;AAAA,MAAC;AAAA,MACpB,QAAQ;AAAA,MACR,aAAc,IAAc;AAAA,IAC9B;AAAA,EACF;AAKA,aAAW,MAAM,IAAI;AACrB,QAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,QAAM,UAAU,MAAM;AAEtB,QAAM,kBAAkB,OAAO,OAAO;AACtC,QAAM,qBAAqB,OAAO,MAAM,IAAI;AAC5C,QAAM,cAAc,iBAAiB,OAAO,OAAO;AACnD,QAAM,cAAc,MAAM,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAE9C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,gBAAgB,MAA6B;AACpD,MAAI,OAAO,KAAK,aAAa,SAAU,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,GAAG;AACzB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,QAAI,OAAO,SAAS,CAAC,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,MAA6B;AACpD,MAAI,OAAO,KAAK,aAAa,SAAU,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,GAAG;AACzB,UAAM,IAAI,OAAO,SAAS,KAAK,EAAE;AACjC,QAAI,OAAO,SAAS,CAAC,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA6B;AAChD,MAAI,KAAK,QAAQ,KAAK,KAAK,SAAS,EAAG,QAAO,KAAK;AACnD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,SAAS,EAAG,QAAO;AAClC,SAAO;AACT;AAEA,eAAsB,YAAY,OAAsB,CAAC,GAA0B;AACjF,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,UAAU,aAAa;AAG7B,MAAI;AACF,UAAM,GAAG,OAAO,OAAO;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI;AAAA,MACR,gCAAgC,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,UAAU,KAAK,KAAK,MAAM,WAAW;AAC3C,QAAM,gBAAgB,SAAS,GAAG,QAAQ,GAAG;AAAA,CAAI;AAEjD,QAAM,QAAQ,oBAAI,IAAyB;AAG3C,QAAM,WAAW,IAAI,SAAS;AAM9B,QAAM,wBAAwB;AAC9B,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,WAAS,gBAAgB,SAAiB,QAAsB;AAC9D,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO,eAAe,IAAI,OAAO,KAAK;AAC5C,QAAI,MAAM,OAAO,sBAAuB;AACxC,mBAAe,IAAI,SAAS,GAAG;AAC/B,YAAQ;AAAA,MACN,sCAAsC,OAAO,oCAA+B,MAAM;AAAA,IACpF;AAAA,EACF;AAEA,WAAS,uBAAuB,MAAyB;AACvD,QAAI,KAAK,WAAW,SAAU;AAC9B,aAAS,IAAI,KAAK,MAAM,MAAM;AAAA,MAC5B,UAAU,KAAK,MAAM;AAAA,MACrB,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAKA,iBAAe,eAAe,OAA4C;AACxE,QAAI;AACF,YAAM,QAAQ,MAAM,iBAAiB,KAAK;AAC1C,YAAM,IAAI,MAAM,MAAM,KAAK;AAC3B,6BAAuB,KAAK;AAC5B,UAAI,MAAM,WAAW,UAAU;AAC7B,cAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACpD,gBAAQ;AAAA,UACN,mBAAmB,MAAM,IAAI;AAAA,QAC/B;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,mBAAmB,MAAM,IAAI,gDAA4C,IAAc,OAAO;AAAA,MAChG;AAEA,aAAO,MAAM,IAAI,MAAM,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,iBAAe,UAAyB;AACtC,UAAM,WAAW,MAAM,aAAa;AACpC,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,SAAS,UAAU;AAC5B,WAAK,IAAI,MAAM,IAAI;AACnB,YAAM,WAAW,MAAM,IAAI,MAAM,IAAI;AACrC,UAAI,UAAU;AAKZ,YAAI,SAAS,WAAW,UAAU;AAChC,gBAAM,eAAe,KAAK;AAAA,QAC5B;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,OAAO,MAAM,iBAAiB,KAAK;AACzC,cAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,+BAAuB,IAAI;AAC3B,YAAI,KAAK,WAAW,UAAU;AAC5B,kBAAQ,KAAK,mBAAmB,MAAM,IAAI,mBAAc,KAAK,WAAW,EAAE;AAAA,QAC5E,OAAO;AACL,kBAAQ,IAAI,mBAAmB,MAAM,IAAI,aAAa,MAAM,IAAI,GAAG;AAAA,QACrE;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mBAAmB,MAAM,IAAI,gCAA4B,IAAc,OAAO;AAAA,QAChF;AACA,cAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACtD;AAAA,IACF;AAEA,eAAW,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG;AAC/C,UAAI,KAAK,IAAI,IAAI,EAAG;AACpB,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AACA,YAAM,OAAO,IAAI;AACjB,cAAQ,IAAI,mBAAmB,IAAI,wCAAmC;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,QAAQ;AAMd,QAAM,OAAO,KAAK,kBAAkB;AACpC,MAAI,UAAkC;AACtC,MAAI,UAEO;AACX,MAAI,cAAc;AAClB,MAAI,cAAc;AAElB,MAAI,MAAM;AACR,UAAM,OAAO,YAAY,IAAI;AAC7B,UAAM,WAAW,gBAAgB,IAAI;AACrC,UAAM,WAAW,gBAAgB,IAAI;AAIrC,UAAM,OAAO,YAAY;AACzB,wBAAoB,MAAM,KAAK,SAAS;AAExC,QAAI;AACF,gBAAU,MAAM,SAAS;AAAA,QACvB,UAAU;AAAA,QACV,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,MACnB,CAAC;AACD,oBAAc,MAAM,QAAQ,OAAO,EAAE,MAAM,UAAU,KAAK,CAAC;AAC3D,cAAQ,IAAI,4BAA4B,WAAW,EAAE;AAAA,IACvD,SAAS,KAAK;AAEZ,iBAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,YAAI;AACF,eAAK,YAAY;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,YAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACvC,YAAM,IAAI;AAAA,QACR,sCAAsC,QAAQ,WAAO,IAAc,OAAO;AAAA,MAC5E;AAAA,IACF;AAMA,mBAAe,kBACb,aAC6B;AAC7B,YAAM,cAAc,MAAM,aAAa,EAAE,MAAM,MAAM,CAAC,CAAC;AACvD,YAAM,SAAS,mBAAmB,aAAa,WAAW;AAC1D,UAAI,OAAO,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,eAAe;AACzD,UAAI,CAAC,KAAM,QAAO;AAClB,UAAI,KAAK,WAAW,UAAU;AAC5B,cAAM,QAAQ,YAAY,KAAK,CAAC,MAAM,EAAE,SAAS,KAAM,MAAM,IAAI;AACjE,YAAI,OAAO;AACT,iBAAO,MAAM,eAAe,KAAK;AAAA,QACnC;AACA,YAAI,KAAK,WAAW,UAAU;AAC5B,0BAAgB,KAAK,MAAM,MAAM,KAAK,eAAe,SAAS;AAC9D,iBAAO;AAAA,QACT;AAAA,MACF;AACA,aAAO,KAAK,WAAW,WAAW,OAAO;AAAA,IAC3C;AAEA,QAAI;AACF,gBAAU,MAAM,kBAAkB;AAAA,QAChC,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,QACjB,QAAQ,OAAO,SAAS;AAMtB,gBAAM,OAAO,MAAM,kBAAkB,KAAK,OAAO;AACjD,cAAI,CAAC,KAAM;AACX,gBAAM;AAAA,YACJ;AAAA,cACE,OAAO,KAAK;AAAA,cACZ,YAAY,KAAK,MAAM;AAAA,cACvB,SAAS,KAAK,MAAM;AAAA;AAAA,cAEpB,uBAAuB;AAAA,YACzB;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,iBAAiB,OAAO,SAAS;AAC/B,gBAAM,OAAO,MAAM,kBAAkB,KAAK,OAAO;AACjD,cAAI,CAAC,KAAM;AACX,gBAAM,oBAAoB,KAAK,MAAM,UAAU,EAAE,IAAI;AAAA,QACvD;AAAA,MACF,CAAC;AACD,oBAAc,MAAM,QAAQ,OAAO,EAAE,MAAM,UAAU,KAAK,CAAC;AAC3D,cAAQ,IAAI,4BAA4B,WAAW,YAAY;AAAA,IACjE,SAAS,KAAK;AACZ,iBAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,YAAI;AACF,eAAK,YAAY;AAAA,QACnB,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,UAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACjD,YAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AACvC,YAAM,IAAI;AAAA,QACR,sCAAsC,QAAQ,WAAO,IAAc,OAAO;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAkC;AACtC,QAAM,SAAS,YAA2B;AACxC,QAAI,UAAW,QAAO;AACtB,iBAAa,YAAY;AACvB,UAAI;AACF,cAAM,QAAQ;AAAA,MAChB,UAAE;AACA,oBAAY;AAAA,MACd;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,MAAY;AAChC,SAAK,OAAO,EAAE,MAAM,CAAC,QAAQ;AAC3B,cAAQ,KAAK,sCAAkC,IAAc,OAAO,EAAE;AAAA,IACxE,CAAC;AAAA,EACH;AACA,UAAQ,GAAG,UAAU,aAAa;AAElC,MAAI,UAAU;AACd,QAAM,OAAO,YAA2B;AACtC,QAAI,QAAS;AACb,cAAU;AACV,YAAQ,IAAI,UAAU,aAAa;AACnC,QAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,QAAI,QAAS,OAAM,QAAQ,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,eAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAI;AACF,aAAK,YAAY;AAAA,MACnB,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,GAAG,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACzC;AAEA,SAAO,EAAE,OAAO,QAAQ,MAAM,SAAS,aAAa,YAAY;AAClE;","names":[]}

package/dist/{chunk-CY67YKNO.js → chunk-V4TU7OKZ.js}

@@ -1,10 +1,11 @@
 import {
   parseOtlpRequest
-} from "./chunk-75IBA4UL.js";
+} from "./chunk-7TYESDAI.js";
 
 // src/otel-grpc.ts
 import { fileURLToPath } from "url";
 import path from "path";
+import { timingSafeEqual } from "crypto";
 import * as grpc from "@grpc/grpc-js";
 import * as protoLoader from "@grpc/proto-loader";
 function bytesToHex(buf) {
@@ -83,8 +84,21 @@ function loadTraceService() {
 async function startOtelGrpcReceiver(opts) {
   const server = new grpc.Server();
   const service = loadTraceService();
+  const requiresAuth = !opts.trustProxy && !!opts.authToken && opts.authToken.length > 0;
+  const expectedHeader = requiresAuth ? `Bearer ${opts.authToken}` : "";
   server.addService(service, {
     Export: (call, callback) => {
+      if (requiresAuth) {
+        const meta = call.metadata.get("authorization");
+        const got = meta.length > 0 ? String(meta[0]) : "";
+        const a = Buffer.from(got, "utf8");
+        const b = Buffer.from(expectedHeader, "utf8");
+        const ok = a.length === b.length && timingSafeEqual(a, b);
+        if (!ok) {
+          callback({ code: grpc.status.UNAUTHENTICATED, message: "unauthorized" });
+          return;
+        }
+      }
       void (async () => {
         try {
           const reshaped = reshapeGrpcRequest(call.request ?? {});
@@ -122,4 +136,4 @@ export {
   reshapeGrpcRequest,
   startOtelGrpcReceiver
 };
-//# sourceMappingURL=chunk-CY67YKNO.js.map
+//# sourceMappingURL=chunk-V4TU7OKZ.js.map

package/dist/chunk-V4TU7OKZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/otel-grpc.ts"],"sourcesContent":["import { fileURLToPath } from 'node:url'\nimport path from 'node:path'\nimport { timingSafeEqual } from 'node:crypto'\nimport * as grpc from '@grpc/grpc-js'\nimport * as protoLoader from '@grpc/proto-loader'\nimport {\n  parseOtlpRequest,\n  type OtlpTracesRequest,\n  type ParsedSpan,\n  type SpanHandler,\n} from './otel.js'\n\n// OTLP/gRPC receiver. Sits next to buildOtelReceiver (HTTP/JSON) in otel.ts;\n// shares the same parseOtlpRequest decoder so a span looks identical to the\n// downstream onSpan handler whether it came in over JSON or protobuf.\n//\n// Default OFF — opts.enabled (typically NEAT_OTLP_GRPC=true) decides whether\n// server.ts wires this up. We keep gRPC behind a flag so existing HTTP-only\n// deployments don't get a surprise port binding on upgrade.\n\nexport interface BuildOtelGrpcReceiverOptions {\n  onSpan: SpanHandler\n  // ADR-073 §4 — bearer required in the gRPC call's `authorization` metadata\n  // when set. Same precedence as the HTTP receiver: NEAT_OTEL_TOKEN ?? NEAT_AUTH_TOKEN.\n  authToken?: string\n  // Skip the request-side check when an upstream proxy already authenticated.\n  trustProxy?: boolean\n}\n\n// proto-loader output for the trace service has fields like resource_spans,\n// scope_spans, span_id, etc. (snake_case keys, since we leave keepCase: true\n// when loading). The HTTP path uses camelCase JSON, so we shape-shift the\n// gRPC payload onto the HTTP shape and let parseOtlpRequest do the rest.\n//\n// All `bytes` fields arrive as Buffers; the HTTP wire format encodes them as\n// hex strings, so we hex-encode for consistency.\n\ninterface GrpcAnyValue {\n  string_value?: string\n  bool_value?: boolean\n  int_value?: string | number\n  double_value?: number\n  array_value?: { values?: GrpcAnyValue[] }\n  // bytes/kvlist fields exist in the proto but the demo doesn't use them.\n}\n\ninterface GrpcKeyValue {\n  key?: string\n  value?: GrpcAnyValue\n}\n\ninterface GrpcStatus {\n  code?: number\n  message?: string\n}\n\ninterface GrpcEvent {\n  name?: string\n  time_unix_nano?: string | number\n  attributes?: GrpcKeyValue[]\n}\n\ninterface GrpcSpan {\n  trace_id?: Buffer\n  span_id?: Buffer\n  parent_span_id?: Buffer\n  name?: string\n  kind?: number\n  start_time_unix_nano?: string | number\n  end_time_unix_nano?: string | number\n  attributes?: GrpcKeyValue[]\n  events?: GrpcEvent[]\n  status?: GrpcStatus\n}\n\ninterface GrpcScopeSpans {\n  spans?: GrpcSpan[]\n}\n\ninterface GrpcResourceSpans {\n  resource?: { attributes?: GrpcKeyValue[] }\n  scope_spans?: GrpcScopeSpans[]\n}\n\ninterface GrpcExportRequest {\n  resource_spans?: GrpcResourceSpans[]\n}\n\nfunction bytesToHex(buf: Buffer | undefined): string {\n  if (!buf) return ''\n  return Buffer.isBuffer(buf) ? buf.toString('hex') : ''\n}\n\nfunction nanosToString(n: string | number | undefined): string {\n  if (n === undefined || n === null) return '0'\n  return typeof n === 'string' ? n : String(n)\n}\n\nfunction reshapeAttributes(\n  attrs: GrpcKeyValue[] | undefined,\n): OtlpTracesRequest['resourceSpans'] extends Array<infer R>\n  ? R extends { resource?: { attributes?: infer A } }\n    ? A\n    : never\n  : never {\n  // Map snake_case oneof fields to the camelCase the JSON path expects.\n  const out = (attrs ?? []).map((kv) => ({\n    key: kv.key ?? '',\n    value: kv.value\n      ? {\n          stringValue: kv.value.string_value,\n          boolValue: kv.value.bool_value,\n          intValue: kv.value.int_value,\n          doubleValue: kv.value.double_value,\n          arrayValue: kv.value.array_value\n            ? {\n                values: (kv.value.array_value.values ?? []).map((v) => ({\n                  stringValue: v.string_value,\n                  boolValue: v.bool_value,\n                  intValue: v.int_value,\n                  doubleValue: v.double_value,\n                })),\n              }\n            : undefined,\n        }\n      : undefined,\n  }))\n  return out as never\n}\n\nexport function reshapeGrpcRequest(req: GrpcExportRequest): OtlpTracesRequest {\n  return {\n    resourceSpans: (req.resource_spans ?? []).map((rs) => ({\n      resource: rs.resource ? { attributes: reshapeAttributes(rs.resource.attributes) } : undefined,\n      scopeSpans: (rs.scope_spans ?? []).map((ss) => ({\n        spans: (ss.spans ?? []).map((s) => ({\n          traceId: bytesToHex(s.trace_id),\n          spanId: bytesToHex(s.span_id),\n          parentSpanId: s.parent_span_id ? bytesToHex(s.parent_span_id) : undefined,\n          name: s.name,\n          kind: s.kind,\n          startTimeUnixNano: nanosToString(s.start_time_unix_nano),\n          endTimeUnixNano: nanosToString(s.end_time_unix_nano),\n          attributes: reshapeAttributes(s.attributes),\n          events: (s.events ?? []).map((e) => ({\n            name: e.name,\n            timeUnixNano: nanosToString(e.time_unix_nano),\n            attributes: reshapeAttributes(e.attributes),\n          })),\n          status: s.status ? { code: s.status.code, message: s.status.message } : undefined,\n        })),\n      })),\n    })),\n  }\n}\n\n// Find the bundled .proto tree at packages/core/proto/. The dev server runs\n// from the source tree (tsx); the built bundles run from dist/. tsup keeps\n// source layout, so __dirname-relative resolution works for both — we look two\n// levels up from this file.\nfunction resolveProtoRoot(): string {\n  // Built output (CJS) sets __dirname natively; ESM build is bundled by tsup\n  // and keeps a dirname injection. import.meta.url is the safe bet.\n  const here = path.dirname(fileURLToPath(import.meta.url))\n  // src/ → packages/core/proto/, dist/ → packages/core/proto/.\n  return path.resolve(here, '..', 'proto')\n}\n\nfunction loadTraceService(): grpc.ServiceDefinition {\n  const protoRoot = resolveProtoRoot()\n  const def = protoLoader.loadSync(\n    'opentelemetry/proto/collector/trace/v1/trace_service.proto',\n    {\n      keepCase: true,\n      longs: String,\n      enums: Number,\n      defaults: true,\n      oneofs: true,\n      includeDirs: [protoRoot],\n    },\n  )\n  const pkg = grpc.loadPackageDefinition(def) as unknown as {\n    opentelemetry: {\n      proto: {\n        collector: {\n          trace: {\n            v1: {\n              TraceService: { service: grpc.ServiceDefinition }\n            }\n          }\n        }\n      }\n    }\n  }\n  return pkg.opentelemetry.proto.collector.trace.v1.TraceService.service\n}\n\nexport interface OtelGrpcReceiver {\n  // Bound address (host:port) once .start() has resolved. Useful for tests.\n  address: string\n  // Stop accepting new requests, shut down the server.\n  stop: () => Promise<void>\n}\n\nexport async function startOtelGrpcReceiver(\n  opts: BuildOtelGrpcReceiverOptions & { host?: string; port?: number },\n): Promise<OtelGrpcReceiver> {\n  const server = new grpc.Server()\n  const service = loadTraceService()\n\n  const requiresAuth = !opts.trustProxy && !!opts.authToken && opts.authToken.length > 0\n  const expectedHeader = requiresAuth ? `Bearer ${opts.authToken}` : ''\n\n  server.addService(service, {\n    Export: (\n      call: grpc.ServerUnaryCall<GrpcExportRequest, unknown>,\n      callback: grpc.sendUnaryData<{ partial_success: object }>,\n    ) => {\n      // ADR-073 §4 — same bearer shape as the HTTP receiver, carried in the\n      // `authorization` gRPC metadata header. Constant-time comparison.\n      if (requiresAuth) {\n        const meta = call.metadata.get('authorization')\n        const got = meta.length > 0 ? String(meta[0]) : ''\n        const a = Buffer.from(got, 'utf8')\n        const b = Buffer.from(expectedHeader, 'utf8')\n        const ok = a.length === b.length && timingSafeEqual(a, b)\n        if (!ok) {\n          callback({ code: grpc.status.UNAUTHENTICATED, message: 'unauthorized' })\n          return\n        }\n      }\n      void (async () => {\n        try {\n          const reshaped = reshapeGrpcRequest(call.request ?? {})\n          const spans: ParsedSpan[] = parseOtlpRequest(reshaped)\n          for (const span of spans) {\n            await opts.onSpan(span)\n          }\n          callback(null, { partial_success: {} })\n        } catch (err) {\n          callback({\n            code: grpc.status.INTERNAL,\n            message: err instanceof Error ? err.message : String(err),\n          })\n        }\n      })()\n    },\n  })\n\n  const host = opts.host ?? '0.0.0.0'\n  const port = opts.port ?? 4317\n\n  const boundPort = await new Promise<number>((resolve, reject) => {\n    server.bindAsync(`${host}:${port}`, grpc.ServerCredentials.createInsecure(), (err, p) => {\n      if (err) return reject(err)\n      resolve(p)\n    })\n  })\n\n  return {\n    address: `${host}:${boundPort}`,\n    stop: () =>\n      new Promise<void>((resolve) => {\n        server.tryShutdown(() => resolve())\n      }),\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AACjB,SAAS,uBAAuB;AAChC,YAAY,UAAU;AACtB,YAAY,iBAAiB;AAoF7B,SAAS,WAAW,KAAiC;AACnD,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,OAAO,SAAS,GAAG,IAAI,IAAI,SAAS,KAAK,IAAI;AACtD;AAEA,SAAS,cAAc,GAAwC;AAC7D,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,SAAO,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AAC7C;AAEA,SAAS,kBACP,OAKQ;AAER,QAAM,OAAO,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ;AAAA,IACrC,KAAK,GAAG,OAAO;AAAA,IACf,OAAO,GAAG,QACN;AAAA,MACE,aAAa,GAAG,MAAM;AAAA,MACtB,WAAW,GAAG,MAAM;AAAA,MACpB,UAAU,GAAG,MAAM;AAAA,MACnB,aAAa,GAAG,MAAM;AAAA,MACtB,YAAY,GAAG,MAAM,cACjB;AAAA,QACE,SAAS,GAAG,MAAM,YAAY,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,UACtD,aAAa,EAAE;AAAA,UACf,WAAW,EAAE;AAAA,UACb,UAAU,EAAE;AAAA,UACZ,aAAa,EAAE;AAAA,QACjB,EAAE;AAAA,MACJ,IACA;AAAA,IACN,IACA;AAAA,EACN,EAAE;AACF,SAAO;AACT;AAEO,SAAS,mBAAmB,KAA2C;AAC5E,SAAO;AAAA,IACL,gBAAgB,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,QAAQ;AAAA,MACrD,UAAU,GAAG,WAAW,EAAE,YAAY,kBAAkB,GAAG,SAAS,UAAU,EAAE,IAAI;AAAA,MACpF,aAAa,GAAG,eAAe,CAAC,GAAG,IAAI,CAAC,QAAQ;AAAA,QAC9C,QAAQ,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,UAClC,SAAS,WAAW,EAAE,QAAQ;AAAA,UAC9B,QAAQ,WAAW,EAAE,OAAO;AAAA,UAC5B,cAAc,EAAE,iBAAiB,WAAW,EAAE,cAAc,IAAI;AAAA,UAChE,MAAM,EAAE;AAAA,UACR,MAAM,EAAE;AAAA,UACR,mBAAmB,cAAc,EAAE,oBAAoB;AAAA,UACvD,iBAAiB,cAAc,EAAE,kBAAkB;AAAA,UACnD,YAAY,kBAAkB,EAAE,UAAU;AAAA,UAC1C,SAAS,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,YACnC,MAAM,EAAE;AAAA,YACR,cAAc,cAAc,EAAE,cAAc;AAAA,YAC5C,YAAY,kBAAkB,EAAE,UAAU;AAAA,UAC5C,EAAE;AAAA,UACF,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,MAAM,SAAS,EAAE,OAAO,QAAQ,IAAI;AAAA,QAC1E,EAAE;AAAA,MACJ,EAAE;AAAA,IACJ,EAAE;AAAA,EACJ;AACF;AAMA,SAAS,mBAA2B;AAGlC,QAAM,OAAO,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AAExD,SAAO,KAAK,QAAQ,MAAM,MAAM,OAAO;AACzC;AAEA,SAAS,mBAA2C;AAClD,QAAM,YAAY,iBAAiB;AACnC,QAAM,MAAkB;AAAA,IACtB;AAAA,IACA;AAAA,MACE,UAAU;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,MACP,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa,CAAC,SAAS;AAAA,IACzB;AAAA,EACF;AACA,QAAM,MAAW,2BAAsB,GAAG;AAa1C,SAAO,IAAI,cAAc,MAAM,UAAU,MAAM,GAAG,aAAa;AACjE;AASA,eAAsB,sBACpB,MAC2B;AAC3B,QAAM,SAAS,IAAS,YAAO;AAC/B,QAAM,UAAU,iBAAiB;AAEjC,QAAM,eAAe,CAAC,KAAK,cAAc,CAAC,CAAC,KAAK,aAAa,KAAK,UAAU,SAAS;AACrF,QAAM,iBAAiB,eAAe,UAAU,KAAK,SAAS,KAAK;AAEnE,SAAO,WAAW,SAAS;AAAA,IACzB,QAAQ,CACN,MACA,aACG;AAGH,UAAI,cAAc;AAChB,cAAM,OAAO,KAAK,SAAS,IAAI,eAAe;AAC9C,cAAM,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI;AAChD,cAAM,IAAI,OAAO,KAAK,KAAK,MAAM;AACjC,cAAM,IAAI,OAAO,KAAK,gBAAgB,MAAM;AAC5C,cAAM,KAAK,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACxD,YAAI,CAAC,IAAI;AACP,mBAAS,EAAE,MAAW,YAAO,iBAAiB,SAAS,eAAe,CAAC;AACvE;AAAA,QACF;AAAA,MACF;AACA,YAAM,YAAY;AAChB,YAAI;AACF,gBAAM,WAAW,mBAAmB,KAAK,WAAW,CAAC,CAAC;AACtD,gBAAM,QAAsB,iBAAiB,QAAQ;AACrD,qBAAW,QAAQ,OAAO;AACxB,kBAAM,KAAK,OAAO,IAAI;AAAA,UACxB;AACA,mBAAS,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;AAAA,QACxC,SAAS,KAAK;AACZ,mBAAS;AAAA,YACP,MAAW,YAAO;AAAA,YAClB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,UAC1D,CAAC;AAAA,QACH;AAAA,MACF,GAAG;AAAA,IACL;AAAA,EACF,CAAC;AAED,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,YAAY,MAAM,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC/D,WAAO,UAAU,GAAG,IAAI,IAAI,IAAI,IAAS,uBAAkB,eAAe,GAAG,CAAC,KAAK,MAAM;AACvF,UAAI,IAAK,QAAO,OAAO,GAAG;AAC1B,cAAQ,CAAC;AAAA,IACX,CAAC;AAAA,EACH,CAAC;AAED,SAAO;AAAA,IACL,SAAS,GAAG,IAAI,IAAI,SAAS;AAAA,IAC7B,MAAM,MACJ,IAAI,QAAc,CAAC,YAAY;AAC7B,aAAO,YAAY,MAAM,QAAQ,CAAC;AAAA,IACpC,CAAC;AAAA,EACL;AACF;","names":[]}