@neat.is/core 0.4.28-dev.20260707 → 0.4.28-dev.20260708

package/dist/neatd.js

@@ -2,15 +2,15 @@
 import {
   reconcileDaemonRecordSync,
   startDaemon
-} from "./chunk-XV4D7A3Z.js";
+} from "./chunk-NY5Q6NE2.js";
 import {
   listProjects,
   registryPath
-} from "./chunk-QM6BMPVJ.js";
+} from "./chunk-O4MRDWD7.js";
 import {
   BindAuthorityError,
   __require
-} from "./chunk-A3322JYS.js";
+} from "./chunk-CFDPIMRP.js";
 
 // src/neatd.ts
 import { promises as fs } from "fs";

package/dist/{otel-grpc-ET5Z6KI6.js → otel-grpc-IDMIH6ZY.js}

@@ -1,10 +1,10 @@
 import {
   reshapeGrpcRequest,
   startOtelGrpcReceiver
-} from "./chunk-UV5WSM7M.js";
-import "./chunk-A3322JYS.js";
+} from "./chunk-I72HTUOG.js";
+import "./chunk-CFDPIMRP.js";
 export {
   reshapeGrpcRequest,
   startOtelGrpcReceiver
 };
-//# sourceMappingURL=otel-grpc-ET5Z6KI6.js.map
+//# sourceMappingURL=otel-grpc-IDMIH6ZY.js.map

package/dist/server.cjs

@@ -53,15 +53,16 @@ function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
   const expected = Buffer.from(opts.token, "utf8");
-  const suffixes = [...DEFAULT_UNAUTH_SUFFIXES, ...opts.extraUnauthenticatedSuffixes ?? []];
+  const exactUnauthPaths = /* @__PURE__ */ new Set([
+    ...DEFAULT_UNAUTH_PATHS,
+    ...opts.extraUnauthenticatedSuffixes ?? []
+  ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
     const path46 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    for (const suffix of suffixes) {
-      if (path46 === suffix || path46.endsWith(suffix)) {
-        done();
-        return;
-      }
+    if (exactUnauthPaths.has(path46) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path46)) {
+      done();
+      return;
     }
     if (publicRead && PUBLIC_READ_METHODS.has(req.method)) {
       done();
@@ -96,7 +97,7 @@ function readAuthEnv(env = process.env) {
     publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
   };
 }
-var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_PATHS, PROJECT_SCOPED_UNAUTH_PATTERN;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
@@ -117,12 +118,15 @@ var init_auth = __esm({
       }
     };
     PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-    DEFAULT_UNAUTH_SUFFIXES = [
+    DEFAULT_UNAUTH_PATHS = [
       "/health",
       "/healthz",
       "/readyz",
       "/api/config"
     ];
+    PROJECT_SCOPED_UNAUTH_PATTERN = new RegExp(
+      `^/projects/[^/]+/(?:${DEFAULT_UNAUTH_PATHS.map((p) => p.slice(1)).join("|")})$`
+    );
   }
 });
 
@@ -2077,6 +2081,51 @@ function computeDivergences(graph, opts = {}) {
   });
 }
 
+// src/logs-store.ts
+init_cjs_shims();
+var LOGS_STORE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var LOGS_QUERY_DEFAULT_LIMIT = 100;
+var LOGS_QUERY_MAX_LIMIT = 1e3;
+var buffers = /* @__PURE__ */ new Map();
+var KEY_SEP = "::";
+function bufferKey(projectName, source) {
+  return `${projectName}${KEY_SEP}${source}`;
+}
+function sourcesForProject(projectName) {
+  const prefix = `${projectName}${KEY_SEP}`;
+  const sources = [];
+  for (const key of buffers.keys()) {
+    if (key.startsWith(prefix)) sources.push(key.slice(prefix.length));
+  }
+  return sources;
+}
+function queryLogEntries(opts) {
+  const { projectName, source, service, since, limit } = opts;
+  const sources = source && source.length > 0 ? source : sourcesForProject(projectName);
+  let merged = [];
+  for (const src of sources) {
+    const buf = buffers.get(bufferKey(projectName, src));
+    if (buf) merged = merged.concat(buf);
+  }
+  if (service) {
+    merged = merged.filter((e) => e.serviceName === service);
+  }
+  if (since) {
+    const sinceMs = Date.parse(since);
+    if (!Number.isNaN(sinceMs)) {
+      merged = merged.filter((e) => {
+        const t = Date.parse(e.timestamp);
+        return Number.isNaN(t) || t >= sinceMs;
+      });
+    }
+  }
+  merged.sort((a, b) => Date.parse(b.timestamp) - Date.parse(a.timestamp));
+  if (typeof limit === "number" && Number.isFinite(limit) && limit >= 0) {
+    return merged.slice(0, limit);
+  }
+  return merged;
+}
+
 // src/policy.ts
 init_cjs_shims();
 var import_node_fs4 = require("fs");
@@ -3663,24 +3712,58 @@ function dedupeIncidents(events) {
     return !hasRealFailure.has(groupKey(ev));
   });
 }
+var SnapshotValidationError = class extends Error {
+  constructor(issues) {
+    super(`snapshot failed validation (${issues.length} invalid ${issues.length === 1 ? "entry" : "entries"})`);
+    this.issues = issues;
+    this.name = "SnapshotValidationError";
+  }
+  issues;
+};
+function describeZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
 function mergeSnapshot(graph, snapshot) {
   const exported = snapshot.graph;
+  const incomingNodes = Array.isArray(exported.nodes) ? exported.nodes : [];
+  const incomingEdges = Array.isArray(exported.edges) ? exported.edges : [];
+  const issues = [];
+  const validNodes = [];
+  const validEdges = [];
+  for (const node of incomingNodes) {
+    if (node.attributes === void 0) continue;
+    const parsed = import_types4.GraphNodeSchema.safeParse(node.attributes);
+    if (!parsed.success) {
+      issues.push(`node "${node.key}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    validNodes.push({ key: node.key, attributes: parsed.data });
+  }
+  for (const edge of incomingEdges) {
+    if (edge.attributes === void 0) continue;
+    const parsed = import_types4.GraphEdgeSchema.safeParse(edge.attributes);
+    if (!parsed.success) {
+      const label = edge.key ?? `${edge.source}->${edge.target}`;
+      issues.push(`edge "${label}": ${describeZodIssues(parsed.error)}`);
+      continue;
+    }
+    const id = edge.key ?? parsed.data.id;
+    validEdges.push({ key: id, source: edge.source, target: edge.target, attributes: parsed.data });
+  }
+  if (issues.length > 0) {
+    throw new SnapshotValidationError(issues);
+  }
   let nodesAdded = 0;
   let edgesAdded = 0;
-  for (const node of exported.nodes ?? []) {
+  for (const node of validNodes) {
     if (graph.hasNode(node.key)) continue;
-    if (!node.attributes) continue;
     graph.addNode(node.key, node.attributes);
     nodesAdded++;
   }
-  for (const edge of exported.edges ?? []) {
-    const attrs = edge.attributes;
-    if (!attrs) continue;
-    const id = edge.key ?? attrs.id;
-    if (!id) continue;
-    if (graph.hasEdge(id)) continue;
+  for (const edge of validEdges) {
+    if (graph.hasEdge(edge.key)) continue;
     if (!graph.hasNode(edge.source) || !graph.hasNode(edge.target)) continue;
-    graph.addEdgeWithKey(id, edge.source, edge.target, attrs);
+    graph.addEdgeWithKey(edge.key, edge.source, edge.target, edge.attributes);
     edgesAdded++;
   }
   return { nodesAdded, edgesAdded };
@@ -7892,6 +7975,23 @@ function registerRoutes(scope, ctx) {
     const sliced = ordered.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 50);
     return { count: sliced.length, total, events: sliced };
   });
+  scope.get("/logs", async (req, reply) => {
+    const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
+    if (!proj) return;
+    const rawSource = req.query.source;
+    const sources = rawSource === void 0 ? void 0 : Array.isArray(rawSource) ? rawSource : [rawSource];
+    const filtered = queryLogEntries({
+      projectName: proj.name,
+      ...sources && sources.length > 0 ? { source: sources } : {},
+      ...req.query.service ? { service: req.query.service } : {},
+      ...req.query.since ? { since: req.query.since } : {}
+    });
+    const total = filtered.length;
+    const limit = req.query.limit ? Number(req.query.limit) : LOGS_QUERY_DEFAULT_LIMIT;
+    const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, LOGS_QUERY_MAX_LIMIT) : LOGS_QUERY_DEFAULT_LIMIT;
+    const sliced = filtered.slice(0, safeLimit);
+    return { count: sliced.length, total, logs: sliced };
+  });
   const incidentHistoryHandler = async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
@@ -7987,8 +8087,16 @@ function registerRoutes(scope, ctx) {
       if (!against) {
         return reply.code(400).send({ error: "query parameter `against` is required" });
       }
+      const targetProjectName = against === "self" ? proj.name : against;
+      const targetProject = registry.get(targetProjectName);
+      if (!targetProject) {
+        return reply.code(400).send({
+          error: "unknown snapshot id \u2014 `against` must be `self` or the name of a project this server has a snapshot for",
+          against
+        });
+      }
       try {
-        const snapshot = await loadSnapshotForDiff(against);
+        const snapshot = await loadSnapshotForDiff(targetProject.paths.snapshotPath);
         return computeGraphDiff(proj.graph, snapshot);
       } catch (err) {
         return reply.code(400).send({ error: "failed to load snapshot", against, detail: err.message });
@@ -8018,6 +8126,13 @@ function registerRoutes(scope, ctx) {
         edgeCount: proj.graph.size
       };
     } catch (err) {
+      if (err instanceof SnapshotValidationError) {
+        return reply.code(400).send({
+          error: "snapshot merge failed",
+          details: err.message,
+          issues: err.issues
+        });
+      }
       return reply.code(400).send({
         error: "snapshot merge failed",
         details: err.message