@neat.is/core 0.4.27 → 0.4.28-dev.20260708

package/dist/cli.js

@@ -1,12 +1,21 @@
 #!/usr/bin/env node
 import {
+  PROVIDER_DISPATCH,
+  autoSlugConnectorId,
   clearDaemonRecord,
+  describeCredential,
+  getProviderDispatch,
+  isEnvRef,
   portFromListenAddress,
+  readConnectorsConfig,
   readDaemonRecord,
+  removeConnectorEntry,
   resolveHost,
   resolveNeatVersion,
+  upsertConnectorEntry,
+  validateConnectorEntry,
   writeDaemonRecord
-} from "./chunk-XV4D7A3Z.js";
+} from "./chunk-NY5Q6NE2.js";
 import {
   buildSearchIndex
 } from "./chunk-BIY46Q6U.js";
@@ -59,10 +68,10 @@ import {
   signalDaemonStop,
   startPersistLoop,
   startStalenessLoop
-} from "./chunk-QM6BMPVJ.js";
+} from "./chunk-O4MRDWD7.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-UV5WSM7M.js";
+} from "./chunk-I72HTUOG.js";
 import {
   __dirname,
   __require,
@@ -70,7 +79,7 @@ import {
   buildOtelReceiver,
   listenSteppingOtlp,
   readAuthEnv
-} from "./chunk-A3322JYS.js";
+} from "./chunk-CFDPIMRP.js";
 
 // src/cli.ts
 import path9 from "path";
@@ -3497,6 +3506,335 @@ function printSummary(result, graph, dashboardUrl, daemonLog) {
   }
 }
 
+// src/connector-cli.ts
+import readline2 from "readline";
+async function defaultPrompt(question) {
+  if (!process.stdin.isTTY) return "";
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await new Promise((resolve) => rl.question(`${question} `, resolve));
+  } finally {
+    rl.close();
+  }
+}
+function resolveDeps(deps) {
+  return {
+    home: deps.home,
+    env: deps.env ?? process.env,
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+    prompt: deps.prompt ?? defaultPrompt,
+    interactive: deps.interactive ?? Boolean(process.stdin.isTTY),
+    out: deps.out ?? ((l) => console.log(l)),
+    err: deps.err ?? ((l) => console.error(l))
+  };
+}
+function kebabToCamel(name) {
+  return name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function coerceFieldValue(name, raw) {
+  const t = raw.trim();
+  if (t.startsWith("{") || t.startsWith("[")) {
+    try {
+      return JSON.parse(t);
+    } catch {
+      return raw;
+    }
+  }
+  if (/Ms$/.test(name) && /^\d+$/.test(t)) return Number(t);
+  return raw;
+}
+function parseConnectorArgs(args) {
+  const out = {
+    subcommand: "",
+    positional: [],
+    skipValidate: false,
+    plaintext: false,
+    fields: {}
+  };
+  const positional = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--skip-validate") {
+      out.skipValidate = true;
+      continue;
+    }
+    if (arg === "--plaintext") {
+      out.plaintext = true;
+      continue;
+    }
+    if (arg.startsWith("--")) {
+      let flag = arg;
+      let value;
+      const eq = arg.indexOf("=");
+      if (eq >= 0) {
+        flag = arg.slice(0, eq);
+        value = arg.slice(eq + 1);
+      } else {
+        const next = args[i + 1];
+        if (next === void 0 || next.startsWith("--")) {
+          return { ok: false, error: `${flag} requires a value` };
+        }
+        value = next;
+        i++;
+      }
+      const name = flag.slice(2);
+      if (name === "project") {
+        out.project = value;
+        continue;
+      }
+      if (name === "credential" || name === "token") {
+        out.credential = value;
+        continue;
+      }
+      if (name === "id") {
+        out.id = value;
+        continue;
+      }
+      const field = kebabToCamel(name);
+      out.fields[field] = coerceFieldValue(field, value);
+      continue;
+    }
+    positional.push(arg);
+  }
+  out.subcommand = positional[0] ?? "";
+  out.positional = positional.slice(1);
+  return { ok: true, value: out };
+}
+async function buildCredentialRef(dispatch, args, deps) {
+  const hint = "an env-var reference like $PROVIDER_TOKEN is recommended (stored as a pointer, not the secret); a literal value is stored as-is";
+  if (dispatch.requiredCredentialFields.length <= 1) {
+    const key = dispatch.primaryCredentialKey;
+    let value = args.credential;
+    if (value === void 0 && typeof args.fields[key] === "string") {
+      value = args.fields[key];
+    }
+    if (value === void 0 && deps.interactive) {
+      value = await deps.prompt(`Credential for ${dispatch.provider} (${hint}):`);
+    }
+    return (value ?? "").trim();
+  }
+  const out = {};
+  for (const f of dispatch.requiredCredentialFields) {
+    let value;
+    if (typeof args.fields[f] === "string") value = args.fields[f];
+    else if (f === dispatch.primaryCredentialKey && args.credential !== void 0) value = args.credential;
+    if (value === void 0 && deps.interactive) {
+      value = await deps.prompt(`Credential field "${f}" for ${dispatch.provider} (${hint}):`);
+    }
+    out[f] = (value ?? "").trim();
+  }
+  return out;
+}
+function credentialComplete(dispatch, ref) {
+  if (typeof ref === "string") {
+    return ref.length > 0 ? [] : [dispatch.primaryCredentialKey];
+  }
+  return dispatch.requiredCredentialFields.filter((f) => !ref[f] || ref[f].length === 0);
+}
+function plaintextFields(ref) {
+  if (typeof ref === "string") return isEnvRef(ref) ? [] : ["credential"];
+  return Object.entries(ref).filter(([, v]) => !isEnvRef(v)).map(([k]) => k);
+}
+async function connectorAdd(args, deps) {
+  let provider = args.positional[0];
+  if (!provider && deps.interactive) {
+    provider = (await deps.prompt(`Provider (${Object.keys(PROVIDER_DISPATCH).sort().join(", ")}):`)).trim();
+  }
+  if (!provider) {
+    deps.err("neat connector add: a provider is required (e.g. `neat connector add supabase`)");
+    return 2;
+  }
+  const dispatch = getProviderDispatch(provider);
+  if (!dispatch) {
+    deps.err(
+      `neat connector add: unknown provider "${provider}". known providers: ${Object.keys(PROVIDER_DISPATCH).sort().join(", ")}`
+    );
+    return 2;
+  }
+  let project = args.project;
+  if (project === void 0 && deps.interactive) {
+    const answer = (await deps.prompt("Project (blank = the project the daemon is bootstrapping):")).trim();
+    if (answer.length > 0) project = answer;
+  }
+  const credential = await buildCredentialRef(dispatch, args, deps);
+  const options = { ...args.fields };
+  for (const k of dispatch.requiredCredentialFields) delete options[k];
+  for (const field of dispatch.requiredOptionFields) {
+    if (field in options) continue;
+    if (!deps.interactive) continue;
+    const answer = (await deps.prompt(`Option "${field}" for ${provider}:`)).trim();
+    if (answer.length > 0) options[field] = coerceFieldValue(field, answer);
+  }
+  const missingCred = credentialComplete(dispatch, credential);
+  if (missingCred.length > 0) {
+    deps.err(
+      `neat connector add: credential is incomplete \u2014 missing ${missingCred.join(", ")}. Pass it as a flag (e.g. \`--token $PROVIDER_TOKEN\`) or run interactively.`
+    );
+    return 2;
+  }
+  const missingOpts = dispatch.requiredOptionFields.filter((f) => !(f in options));
+  if (missingOpts.length > 0) {
+    deps.err(
+      `neat connector add: missing required option(s) for ${provider}: ${missingOpts.join(", ")}. Pass e.g. \`--${missingOpts[0].replace(/([A-Z])/g, "-$1").toLowerCase()} <value>\`.`
+    );
+    return 2;
+  }
+  const existing = await readConnectorsConfig(deps.home);
+  const existingIds = new Set(existing.connectors.map((c) => c.id));
+  const id = args.id ?? autoSlugConnectorId(provider, project, existingIds);
+  const entry2 = {
+    id,
+    provider,
+    ...project ? { project } : {},
+    credential,
+    ...Object.keys(options).length > 0 ? { options } : {}
+  };
+  if (!args.skipValidate) {
+    const outcome = await validateConnectorEntry(entry2, deps.env, deps.fetchImpl);
+    const code = reportPreWriteValidation(outcome, deps);
+    if (code !== 0) return code;
+  }
+  const plaintext = plaintextFields(credential);
+  if (plaintext.length > 0 && !args.plaintext) {
+    deps.err(
+      `neat connector add: storing a literal secret at rest for ${plaintext.join(", ")} \u2014 prefer an env-var reference like \`$PROVIDER_TOKEN\` (pass --plaintext to silence this).`
+    );
+  }
+  const { replaced } = await upsertConnectorEntry(entry2, deps.home);
+  const verb = replaced ? "updated" : "added";
+  const where = project ? `project "${project}"` : "the bootstrapping project";
+  deps.out(`${verb} connector "${id}" (${provider}) for ${where}.`);
+  if (args.skipValidate) {
+    deps.out("skipped validation (--skip-validate) \u2014 the credential is checked at the next daemon poll.");
+  }
+  deps.out("Restart the project's daemon (or start it) to begin polling this connector.");
+  return 0;
+}
+function reportPreWriteValidation(outcome, deps) {
+  switch (outcome.status) {
+    case "ok":
+      deps.out("credential validated against the provider.");
+      return 0;
+    case "unset-env":
+      deps.err(
+        `neat connector add: ${outcome.reason}. Export the variable before adding, or pass --skip-validate to add now and set it before the daemon runs.`
+      );
+      return 1;
+    case "rejected":
+      deps.err(
+        `neat connector add: the provider rejected the credential \u2014 ${outcome.reason}. Nothing was written. Fix the credential, or pass --skip-validate to store it anyway.`
+      );
+      return 1;
+    case "missing-field":
+      deps.err(`neat connector add: ${outcome.reason}.`);
+      return 2;
+    case "unknown-provider":
+      deps.err(`neat connector add: ${outcome.reason}.`);
+      return 2;
+  }
+}
+async function connectorList(deps, filterProject) {
+  const config = await readConnectorsConfig(deps.home);
+  let entries = config.connectors;
+  if (filterProject) entries = entries.filter((e) => e.project === filterProject);
+  if (entries.length === 0) {
+    deps.out(
+      filterProject ? `no connectors configured for project "${filterProject}".` : "no connectors configured. run `neat connector add <provider>` to add one."
+    );
+    return 0;
+  }
+  deps.out("id	provider	project	credential");
+  for (const e of entries) {
+    const project = e.project ?? "(bootstrapping project)";
+    const credential = describeCredential(e.credential, deps.env).map((c) => {
+      const status = c.status ? ` (${c.status})` : c.kind === "plaintext" ? " (plaintext)" : "";
+      return c.field ? `${c.field}=${c.display}${status}` : `${c.display}${status}`;
+    }).join(", ");
+    deps.out(`${e.id}	${e.provider}	${project}	${credential}`);
+  }
+  return 0;
+}
+async function connectorRemove(deps, id) {
+  if (!id) {
+    deps.err("neat connector remove: missing <id>. run `neat connector list` to see configured ids.");
+    return 2;
+  }
+  const removed = await removeConnectorEntry(id, deps.home);
+  if (!removed) {
+    deps.err(`neat connector remove: no connector with id "${id}". run \`neat connector list\` to see configured ids.`);
+    return 1;
+  }
+  deps.out(`removed connector "${id}" (${removed.provider}).`);
+  return 0;
+}
+async function connectorTest(deps, id) {
+  if (!id) {
+    deps.err("neat connector test: missing <id>. run `neat connector list` to see configured ids.");
+    return 2;
+  }
+  const config = await readConnectorsConfig(deps.home);
+  const entry2 = config.connectors.find((c) => c.id === id);
+  if (!entry2) {
+    deps.err(`neat connector test: no connector with id "${id}". run \`neat connector list\` to see configured ids.`);
+    return 1;
+  }
+  const outcome = await validateConnectorEntry(entry2, deps.env, deps.fetchImpl);
+  switch (outcome.status) {
+    case "ok":
+      deps.out(`ok: "${id}" (${entry2.provider}) authenticated against the provider.`);
+      return 0;
+    case "unset-env":
+      deps.err(`unset: "${id}" (${entry2.provider}) \u2014 ${outcome.reason}. Export the variable so the daemon can resolve it.`);
+      return 1;
+    case "rejected":
+      deps.err(`rejected: "${id}" (${entry2.provider}) \u2014 ${outcome.reason}.`);
+      return 1;
+    case "missing-field":
+      deps.err(`incomplete: "${id}" (${entry2.provider}) \u2014 ${outcome.reason}.`);
+      return 2;
+    case "unknown-provider":
+      deps.err(`unknown provider: "${id}" \u2014 ${outcome.reason}.`);
+      return 2;
+  }
+}
+function printConnectorUsage(write) {
+  write("usage: neat connector <add|list|remove|test> [args]");
+  write("  add <provider>    add a connector; validates the credential first (--skip-validate to skip)");
+  write("                    flags: --project <name>  --credential/--token <$VAR|value>  --id <id>");
+  write("                           --<option> <value> (provider-specific)  --plaintext  --skip-validate");
+  write("  list              list configured connectors (credentials shown redacted)");
+  write("                    flags: --project <name>");
+  write("  remove <id>       remove a connector by id");
+  write("  test <id>         re-run the credential validation for an existing connector");
+}
+async function runConnectorCommand(rawArgs, deps = {}) {
+  const resolved = resolveDeps(deps);
+  const parsed = parseConnectorArgs(rawArgs);
+  if (!parsed.ok) {
+    resolved.err(`neat connector: ${parsed.error}`);
+    return 2;
+  }
+  const a = parsed.value;
+  switch (a.subcommand) {
+    case "add":
+      return connectorAdd(a, resolved);
+    case "list":
+      return connectorList(resolved, a.project);
+    case "remove":
+      return connectorRemove(resolved, a.positional[0]);
+    case "test":
+      return connectorTest(resolved, a.positional[0]);
+    case "":
+      resolved.err("neat connector: missing subcommand.");
+      printConnectorUsage(resolved.err);
+      return 2;
+    default:
+      resolved.err(`neat connector: unknown subcommand "${a.subcommand}".`);
+      printConnectorUsage(resolved.err);
+      return 2;
+  }
+}
+
 // src/cli-verbs.ts
 import path8 from "path";
 
@@ -4251,6 +4589,17 @@ function usage() {
   console.log("                   --dry-run          run extraction in-memory; do not write");
   console.log("                   --no-instrument    skip the SDK install apply step");
   console.log("                   --json             emit the delta summary as JSON");
+  console.log("  connector      Configure pull-based OBSERVED connectors (supabase, railway,");
+  console.log("                 firebase, cloudflare). Subcommands:");
+  console.log("                   add <provider>   add a connector; validates the credential");
+  console.log("                                    against the provider first (--skip-validate to skip)");
+  console.log("                                    flags: --project <name>, --credential/--token <$VAR|value>,");
+  console.log("                                    --id <id>, --<option> <value>, --plaintext, --skip-validate");
+  console.log("                   list             list configured connectors (credentials redacted)");
+  console.log("                   remove <id>      remove a connector by id");
+  console.log("                   test <id>        re-check an existing connector's credential");
+  console.log("                 Credentials default to an env-var reference ($VAR) resolved at");
+  console.log("                 run time; the config file is written owner-only (0600).");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  root-cause <node-id>             Walk inbound edges to find what broke first.");
@@ -4674,6 +5023,11 @@ async function main() {
     printVersion();
     process.exit(0);
   }
+  if (cmd0 === "connector") {
+    const code = await runConnectorCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   const argvParsed = parseArgs(argv);
   if (argvParsed.positional.length === 0) {
     const orchestratorCode2 = await tryOrchestrator(process.cwd(), argvParsed);