@neat.is/core 0.4.30-dev.20260716 → 0.4.30

package/dist/{chunk-AOLXZWRU.js → chunk-2AJHEZIB.js}

@@ -31,7 +31,7 @@ import {
   touchLastSeen,
   upsertObservedEdge,
   writeAtomically
-} from "./chunk-6HPRD53A.js";
+} from "./chunk-4M2YMGUM.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
@@ -724,25 +724,21 @@ function readRailwayToken(credentials) {
   }
   return token;
 }
-async function railwayGraphQL(apiUrl, token, query, variables, accountKey) {
+function projectAccessTokenHeader(token) {
+  return { "Project-Access-Token": token };
+}
+async function railwayGraphQL(apiUrl, token, query, variables, accountKey, fetchImpl) {
   const res = await junctionFetch(
     apiUrl,
     {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        // docs.railway.com/integrations/api/graphql-overview confirms
-        // `Authorization: Bearer <token>` for an account/workspace token;
-        // Railway also documents a dedicated `Project-Access-Token: <token>`
-        // header for the project-scoped token ADR-127 targets specifically.
-        // This connector sends the Bearer form — needs-endpoint-testing
-        // whether a live Project-Access-Token requires the dedicated header
-        // instead once this poller runs against a real project.
-        ...bearerAuthHeader(token)
+        ...projectAccessTokenHeader(token)
       },
       body: JSON.stringify({ query, variables })
     },
-    { provider: "railway", accountKey }
+    { provider: "railway", accountKey, ...fetchImpl ? { fetchImpl } : {} }
   );
   if (!res.ok) {
     throw new Error(`Railway GraphQL request failed: ${res.status} ${res.statusText}`);
@@ -755,20 +751,8 @@ async function railwayGraphQL(apiUrl, token, query, variables, accountKey) {
   return body.data;
 }
 var HTTP_LOGS_QUERY = `
-  query HttpLogs(
-    $environmentId: String!
-    $serviceId: String!
-    $startDate: String!
-    $endDate: String!
-    $limit: Int
-  ) {
-    httpLogs(
-      environmentId: $environmentId
-      serviceId: $serviceId
-      startDate: $startDate
-      endDate: $endDate
-      limit: $limit
-    ) {
+  query HttpLogs($deploymentId: String!, $startDate: String, $endDate: String, $limit: Int) {
+    httpLogs(deploymentId: $deploymentId, startDate: $startDate, endDate: $endDate, limit: $limit) {
       timestamp
       method
       path
@@ -781,21 +765,9 @@ var HTTP_LOGS_QUERY = `
   }
 `;
 var NETWORK_FLOW_LOGS_QUERY = `
-  query NetworkFlowLogs(
-    $environmentId: String!
-    $serviceId: String!
-    $startDate: String!
-    $endDate: String!
-    $limit: Int
-  ) {
-    networkFlowLogs(
-      environmentId: $environmentId
-      serviceId: $serviceId
-      startDate: $startDate
-      endDate: $endDate
-      limit: $limit
-    ) {
-      timestamp
+  query NetworkFlowLogs($environmentId: String!, $serviceId: String) {
+    networkFlowLogs(environmentId: $environmentId, serviceId: $serviceId) {
+      timestamp: captureStart
       peerServiceId
       peerKind
       direction
@@ -805,34 +777,43 @@ var NETWORK_FLOW_LOGS_QUERY = `
     }
   }
 `;
-async function fetchRailwayHttpLogs(config, token, startDate, endDate) {
+var DEPLOYMENTS_QUERY = `
+  query LatestDeployment($environmentId: String!, $serviceId: String!) {
+    deployments(input: { environmentId: $environmentId, serviceId: $serviceId }, first: 5) {
+      edges { node { id status createdAt } }
+    }
+  }
+`;
+async function resolveLatestRailwayDeploymentId(config, token, fetchImpl) {
+  const data = await railwayGraphQL(
+    config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
+    token,
+    DEPLOYMENTS_QUERY,
+    { environmentId: config.environmentId, serviceId: config.serviceId },
+    config.environmentId,
+    fetchImpl
+  );
+  const nodes = data.deployments.edges.map((e) => e.node);
+  const newestFirst = [...nodes].sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  const success = newestFirst.find((n) => n.status === "SUCCESS");
+  return (success ?? newestFirst[0])?.id ?? null;
+}
+async function fetchRailwayHttpLogs(config, token, deploymentId, startDate, endDate) {
   const data = await railwayGraphQL(
     config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
     token,
     HTTP_LOGS_QUERY,
-    {
-      environmentId: config.environmentId,
-      serviceId: config.serviceId,
-      startDate,
-      endDate,
-      limit: config.limit ?? DEFAULT_LOG_LIMIT2
-    },
+    { deploymentId, startDate, endDate, limit: config.limit ?? DEFAULT_LOG_LIMIT2 },
     config.environmentId
   );
   return data.httpLogs;
 }
-async function fetchRailwayNetworkFlowLogs(config, token, startDate, endDate) {
+async function fetchRailwayNetworkFlowLogs(config, token) {
   const data = await railwayGraphQL(
     config.apiUrl ?? DEFAULT_RAILWAY_API_URL,
     token,
     NETWORK_FLOW_LOGS_QUERY,
-    {
-      environmentId: config.environmentId,
-      serviceId: config.serviceId,
-      startDate,
-      endDate,
-      limit: config.limit ?? DEFAULT_LOG_LIMIT2
-    },
+    { environmentId: config.environmentId, serviceId: config.serviceId },
     config.environmentId
   );
   return data.networkFlowLogs;
@@ -968,10 +949,19 @@ function createRailwayConnector(graph, config) {
       const maxLookbackMs = config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS2;
       const startDate = boundedRailwayStartDate(ctx.since, now, maxLookbackMs);
       const endDate = now.toISOString();
-      const [httpLogs, flowLogs] = await Promise.all([
-        fetchRailwayHttpLogs(config, token, startDate, endDate),
-        fetchRailwayNetworkFlowLogs(config, token, startDate, endDate)
+      const deploymentId = await resolveLatestRailwayDeploymentId(config, token);
+      const [httpLogsResult, flowLogsResult] = await Promise.allSettled([
+        deploymentId ? fetchRailwayHttpLogs(config, token, deploymentId, startDate, endDate) : Promise.resolve([]),
+        fetchRailwayNetworkFlowLogs(config, token)
       ]);
+      if (httpLogsResult.status === "rejected") {
+        console.error("[neat connector] railway httpLogs poll failed", httpLogsResult.reason);
+      }
+      if (flowLogsResult.status === "rejected") {
+        console.error("[neat connector] railway networkFlowLogs poll failed", flowLogsResult.reason);
+      }
+      const httpLogs = httpLogsResult.status === "fulfilled" ? httpLogsResult.value : [];
+      const flowLogs = flowLogsResult.status === "fulfilled" ? flowLogsResult.value : [];
       const serviceName = config.serviceNameById[config.serviceId];
       const routeIndex = serviceName ? buildRailwayRouteIndex(graph, serviceName) : [];
       return [
@@ -1216,6 +1206,12 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
     timeframe: { from: window.fromMs, to: window.toMs },
     view: "events",
     limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
+    // The inline query definition. WITHOUT `parameters`, the API treats
+    // `queryId` as a reference to a previously *saved* query and answers 400
+    // "Query not found" (confirmed against the live endpoint) — omitting it was
+    // the reason the connector never worked against real Cloudflare. Naming the
+    // `cloudflare-workers` dataset runs the invocation-telemetry query ad-hoc.
+    parameters: { datasets: ["cloudflare-workers"] },
     // Execute without persisting — this is a read, not a saved query
     // (connectors.md §2's "never writes on the read path" applies to
     // Cloudflare's own query-history state too).
@@ -1466,24 +1462,35 @@ var PROVIDER_DISPATCH = {
         resolveTarget: createRailwayResolveTarget(config)
       };
     },
-    // A minimal GraphQL POST — Railway's gateway 401s an unauthenticated call
-    // at the HTTP layer, so a 2xx confirms the token was accepted regardless of
-    // the query's own shape (the connector's real queries are still
-    // needs-endpoint-testing per railway/types.ts — auth is what we check).
-    validate({ credentials, options, fetchImpl }) {
+    // Runs the same `deployments` lookup the poller itself needs
+    // (railway/client.ts's resolveLatestRailwayDeploymentId) rather than a
+    // trivial `{ __typename }` probe. That trivial form is a false positive
+    // for this provider: `Authorization: Bearer <token>` authenticates at
+    // Railway's HTTP gateway (any well-formed token gets a 2xx on a query
+    // that touches no real data) but is not authorized for the connector's
+    // actual queries, which come back as an HTTP-200 response carrying a
+    // GraphQL-level "Not Authorized" error — invisible to authProbe's
+    // status-code-only check. Probing with the real lookup, through the same
+    // Project-Access-Token header client.ts sends, catches both failure
+    // modes: an HTTP-level rejection (thrown as a fetch/status error) and a
+    // GraphQL-level one (thrown by railwayGraphQL's own body.errors check).
+    async validate({ credentials, options, fetchImpl }) {
       const cfg = options;
-      return authProbe({
-        provider: "railway",
-        accountKey: cfg.environmentId ?? "validate",
-        url: cfg.apiUrl ?? DEFAULT_RAILWAY_API_URL,
-        token: String(credentials.token ?? ""),
-        init: {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ query: "{ __typename }" })
-        },
-        ...fetchImpl ? { fetchImpl } : {}
-      });
+      if (!cfg.environmentId || !cfg.serviceId) {
+        return { ok: false, reason: "railway: environmentId and serviceId are required to validate" };
+      }
+      const config = {
+        environmentId: cfg.environmentId,
+        serviceId: cfg.serviceId,
+        serviceNameById: cfg.serviceNameById ?? {},
+        ...cfg.apiUrl ? { apiUrl: cfg.apiUrl } : {}
+      };
+      try {
+        await resolveLatestRailwayDeploymentId(config, String(credentials.token ?? ""), fetchImpl);
+        return { ok: true };
+      } catch (err) {
+        return { ok: false, reason: `railway auth check failed: ${err.message}` };
+      }
     }
   },
   firebase: {
@@ -2454,4 +2461,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-AOLXZWRU.js.map
+//# sourceMappingURL=chunk-2AJHEZIB.js.map