@neat.is/core 0.4.7 → 0.4.8

package/dist/{chunk-LS6NS72S.js → chunk-RC3CIDZO.js}

@@ -15,7 +15,7 @@ import {
   startPersistLoop,
   touchLastSeen,
   writeAtomically
-} from "./chunk-7FTK47JQ.js";
+} from "./chunk-J5CEKCTR.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
@@ -533,4 +533,4 @@ export {
   routeSpanToProject,
   startDaemon
 };
-//# sourceMappingURL=chunk-LS6NS72S.js.map
+//# sourceMappingURL=chunk-RC3CIDZO.js.map

package/dist/cli.cjs

@@ -42,6 +42,15 @@ var init_cjs_shims = __esm({
 });
 
 // src/auth.ts
+function isLoopbackHost(host) {
+  if (!host) return false;
+  return LOOPBACK_HOSTS.has(host);
+}
+function assertBindAuthority(host, token) {
+  if (token && token.length > 0) return;
+  if (isLoopbackHost(host)) return;
+  throw new BindAuthorityError(host);
+}
 function mountBearerAuth(app, opts) {
   if (!opts.token || opts.token.length === 0) return;
   if (opts.trustProxy) return;
@@ -73,12 +82,40 @@ function mountBearerAuth(app, opts) {
     done();
   });
 }
-var import_node_crypto, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
+function parseBoolEnv(v) {
+  if (!v) return false;
+  return v === "true" || v === "1";
+}
+function readAuthEnv(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  const ot = env.NEAT_OTEL_TOKEN;
+  return {
+    authToken: t && t.length > 0 ? t : void 0,
+    otelToken: ot && ot.length > 0 ? ot : t && t.length > 0 ? t : void 0,
+    trustProxy: env.NEAT_AUTH_PROXY === "true",
+    publicRead: parseBoolEnv(env.NEAT_PUBLIC_READ)
+  };
+}
+var import_node_crypto, LOOPBACK_HOSTS, BindAuthorityError, PUBLIC_READ_METHODS, DEFAULT_UNAUTH_SUFFIXES;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_crypto = require("crypto");
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+      "127.0.0.1",
+      "localhost",
+      "::1",
+      "::ffff:127.0.0.1"
+    ]);
+    BindAuthorityError = class extends Error {
+      constructor(host) {
+        super(
+          `NEAT refuses to bind on a public interface without \`NEAT_AUTH_TOKEN\` set (host="${host}"). Set the token or bind to loopback only.`
+        );
+        this.name = "BindAuthorityError";
+      }
+    };
     PUBLIC_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     DEFAULT_UNAUTH_SUFFIXES = [
       "/health",
@@ -555,6 +592,7 @@ __export(cli_exports, {
   CLAUDE_SKILL_CONFIG: () => CLAUDE_SKILL_CONFIG,
   QUERY_VERBS: () => QUERY_VERBS,
   parseArgs: () => parseArgs,
+  printBanner: () => printBanner,
   readPackageVersion: () => readPackageVersion,
   runInit: () => runInit,
   runQueryVerb: () => runQueryVerb,
@@ -993,6 +1031,24 @@ function isFrontierNode(graph, nodeId) {
   const attrs = graph.getNodeAttributes(nodeId);
   return attrs.type === import_types.NodeType.FrontierNode;
 }
+function resolveOwningService(graph, nodeId) {
+  if (!graph.hasNode(nodeId)) return null;
+  const attrs = graph.getNodeAttributes(nodeId);
+  if (attrs.type === import_types.NodeType.ServiceNode) {
+    return { id: nodeId, svc: attrs };
+  }
+  if (attrs.type === import_types.NodeType.FileNode) {
+    for (const edgeId of graph.inboundEdges(nodeId)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (e.type !== import_types.EdgeType.CONTAINS) continue;
+      const owner = graph.getNodeAttributes(e.source);
+      if (owner.type === import_types.NodeType.ServiceNode) {
+        return { id: e.source, svc: owner };
+      }
+    }
+  }
+  return null;
+}
 function bestEdgeBySource(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
@@ -1099,9 +1155,9 @@ function databaseRootCauseShape(graph, origin, walk) {
   const candidatePairs = compatPairs().filter((p) => p.engine === targetDb.engine);
   if (candidatePairs.length === 0) return null;
   for (const id of walk.path) {
-    const attrs = graph.getNodeAttributes(id);
-    if (attrs.type !== import_types.NodeType.ServiceNode) continue;
-    const svc = attrs;
+    const owner = resolveOwningService(graph, id);
+    if (!owner) continue;
+    const { id: serviceId3, svc } = owner;
     const deps = svc.dependencies ?? {};
     for (const pair of candidatePairs) {
       const declared = deps[pair.driver];
@@ -1114,7 +1170,7 @@ function databaseRootCauseShape(graph, origin, walk) {
       );
       if (!result.compatible) {
         return {
-          rootCauseNode: id,
+          rootCauseNode: serviceId3,
           rootCauseReason: result.reason ?? "incompatible driver",
           ...result.minDriverVersion ? {
             fixRecommendation: `Upgrade ${svc.name} ${pair.driver} driver to >= ${result.minDriverVersion}`
@@ -1127,9 +1183,9 @@ function databaseRootCauseShape(graph, origin, walk) {
 }
 function serviceRootCauseShape(graph, _origin, walk) {
   for (const id of walk.path) {
-    const attrs = graph.getNodeAttributes(id);
-    if (attrs.type !== import_types.NodeType.ServiceNode) continue;
-    const svc = attrs;
+    const owner = resolveOwningService(graph, id);
+    if (!owner) continue;
+    const { id: serviceId3, svc } = owner;
     const deps = svc.dependencies ?? {};
     const serviceNodeEngine = svc.nodeEngine;
     for (const constraint of nodeEngineConstraints()) {
@@ -1138,7 +1194,7 @@ function serviceRootCauseShape(graph, _origin, walk) {
       const result = checkNodeEngineConstraint(constraint, declared, serviceNodeEngine);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: id,
+          rootCauseNode: serviceId3,
           rootCauseReason: result.reason,
           ...result.requiredNodeVersion ? {
             fixRecommendation: `Bump ${svc.name}'s engines.node to >= ${result.requiredNodeVersion}`
@@ -1153,7 +1209,7 @@ function serviceRootCauseShape(graph, _origin, walk) {
       const result = checkPackageConflict(conflict, declared, requiredDeclared);
       if (!result.compatible && result.reason) {
         return {
-          rootCauseNode: id,
+          rootCauseNode: serviceId3,
           rootCauseReason: result.reason,
           fixRecommendation: `Upgrade ${svc.name}'s ${conflict.requires.name} to >= ${conflict.requires.minVersion}`
         };
@@ -1162,9 +1218,15 @@ function serviceRootCauseShape(graph, _origin, walk) {
   }
   return null;
 }
+function fileRootCauseShape(graph, origin, walk) {
+  const owner = resolveOwningService(graph, origin.id);
+  if (!owner) return null;
+  return serviceRootCauseShape(graph, owner.svc, walk);
+}
 var rootCauseShapes = {
   [import_types.NodeType.DatabaseNode]: databaseRootCauseShape,
-  [import_types.NodeType.ServiceNode]: serviceRootCauseShape
+  [import_types.NodeType.ServiceNode]: serviceRootCauseShape,
+  [import_types.NodeType.FileNode]: fileRootCauseShape
 };
 function getRootCause(graph, errorNodeId, errorEvent) {
   if (!graph.hasNode(errorNodeId)) return null;
@@ -3854,9 +3916,17 @@ async function addHttpCallEdges(graph, services) {
           line: site.line,
           snippet: snippet(file.content, site.line)
         };
+        const { fileNodeId, nodesAdded: n, edgesAdded: e } = ensureFileNode(
+          graph,
+          service.pkg.name,
+          service.node.id,
+          relFile
+        );
+        nodesAdded += n;
+        edgesAdded += e;
         if (!(0, import_types10.passesExtractedFloor)(confidence)) {
           noteExtractedDropped({
-            source: service.node.id,
+            source: fileNodeId,
             target: targetId,
             type: import_types10.EdgeType.CALLS,
             confidence,
@@ -3865,14 +3935,6 @@ async function addHttpCallEdges(graph, services) {
           });
           continue;
         }
-        const { fileNodeId, nodesAdded: n, edgesAdded: e } = ensureFileNode(
-          graph,
-          service.pkg.name,
-          service.node.id,
-          relFile
-        );
-        nodesAdded += n;
-        edgesAdded += e;
         const edgeId = (0, import_types4.extractedEdgeId)(fileNodeId, targetId, import_types10.EdgeType.CALLS);
         if (!graph.hasEdge(edgeId)) {
           const edge = {
@@ -4147,9 +4209,18 @@ async function addExternalEndpointEdges(graph, services) {
       }
       const edgeType = edgeTypeFromEndpoint(ep);
       const confidence = (0, import_types15.confidenceForExtracted)(ep.confidenceKind);
+      const relFile = toPosix2(ep.evidence.file);
+      const { fileNodeId, nodesAdded: n, edgesAdded: e } = ensureFileNode(
+        graph,
+        service.pkg.name,
+        service.node.id,
+        relFile
+      );
+      nodesAdded += n;
+      edgesAdded += e;
       if (!(0, import_types15.passesExtractedFloor)(confidence)) {
         noteExtractedDropped({
-          source: service.node.id,
+          source: fileNodeId,
           target: ep.infraId,
           type: edgeType,
           confidence,
@@ -4158,15 +4229,6 @@ async function addExternalEndpointEdges(graph, services) {
         });
         continue;
       }
-      const relFile = toPosix2(ep.evidence.file);
-      const { fileNodeId, nodesAdded: n, edgesAdded: e } = ensureFileNode(
-        graph,
-        service.pkg.name,
-        service.node.id,
-        relFile
-      );
-      nodesAdded += n;
-      edgesAdded += e;
       const edgeId = (0, import_types4.extractedEdgeId)(fileNodeId, ep.infraId, edgeType);
       if (seenEdges.has(edgeId)) continue;
       seenEdges.add(edgeId);
@@ -5838,14 +5900,18 @@ function registerRoutes(scope, ctx) {
 async function buildApi(opts) {
   const app = (0, import_fastify.default)({ logger: false });
   await app.register(import_cors.default, { origin: true });
+  const env = readAuthEnv();
+  const authToken = opts.authToken ?? env.authToken;
+  const trustProxy = opts.trustProxy ?? env.trustProxy;
+  const publicRead = opts.publicRead ?? env.publicRead;
   mountBearerAuth(app, {
-    token: opts.authToken,
-    trustProxy: opts.trustProxy,
-    publicRead: opts.publicRead
+    token: authToken,
+    trustProxy,
+    publicRead
   });
   app.get("/api/config", async () => ({
-    publicRead: opts.publicRead === true,
-    authProxy: opts.trustProxy === true
+    publicRead: publicRead === true,
+    authProxy: trustProxy === true
   }));
   const startedAt = opts.startedAt ?? Date.now();
   const registry = buildLegacyRegistry(opts);
@@ -5935,6 +6001,7 @@ async function buildApi(opts) {
 }
 
 // src/watch.ts
+init_auth();
 init_otel();
 init_otel_grpc();
 
@@ -6419,7 +6486,9 @@ async function startWatch(graph, opts) {
     project: projectName,
     onPolicyTrigger
   });
-  const host = opts.host ?? "0.0.0.0";
+  const auth = readAuthEnv();
+  const host = opts.host ?? (auth.authToken ? "0.0.0.0" : "127.0.0.1");
+  assertBindAuthority(host, auth.authToken);
   const port = opts.port ?? 8080;
   const otelPort = opts.otelPort ?? 4318;
   const cachePath = opts.embeddingsCachePath ?? import_node_path38.default.join(import_node_path38.default.dirname(opts.outPath), "embeddings.json");
@@ -6735,7 +6804,8 @@ var import_node_path40 = __toESM(require("path"), 1);
 // src/installers/templates.ts
 init_cjs_shims();
 var OTEL_INIT_HEADER = "// Generated by `neat init --apply` (ADR-069). OpenTelemetry auto-instrumentation hook.";
-var OTEL_INIT_STAMP = "// neat-template-version: 2 \u2014 file-first call-site capture (ADR-089).";
+var OTEL_INIT_STAMP = "// neat-template-version: 3 \u2014 file-first call-site capture (ADR-089) + OTLP bearer auth (#410).";
+var OTEL_OTLP_HEADERS_JS = "if (process.env.NEAT_OTEL_TOKEN) process.env.OTEL_EXPORTER_OTLP_HEADERS ||= 'Authorization=Bearer ' + process.env.NEAT_OTEL_TOKEN";
 function neatCallsiteProcessorSource(ts) {
   const stackT = ts ? ": string" : "";
   const spanT = ts ? ": any" : "";
@@ -6802,6 +6872,7 @@ var OTEL_INIT_CJS = `${OTEL_INIT_HEADER}
 ${OTEL_INIT_STAMP}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 const { NodeSDK } = require('@opentelemetry/sdk-node')
 const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node')
@@ -6819,6 +6890,7 @@ var OTEL_INIT_ESM = `${OTEL_INIT_HEADER}
 ${OTEL_INIT_STAMP}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 import { NodeSDK } from '@opentelemetry/sdk-node'
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
@@ -6836,6 +6908,7 @@ var OTEL_INIT_TS = `${OTEL_INIT_HEADER}
 ${OTEL_INIT_STAMP}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 import { NodeSDK } from '@opentelemetry/sdk-node'
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
@@ -6860,6 +6933,8 @@ function renderEnvNeat(serviceName, projectName) {
     "# Generated by `neat init --apply` (ADR-069).",
     `OTEL_SERVICE_NAME=${serviceName}`,
     `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://localhost:4318/projects/${projectName}/v1/traces`,
+    "# Set NEAT_OTEL_TOKEN to the daemon's OTLP secret to authenticate exported spans (#410).",
+    "# NEAT_OTEL_TOKEN=",
     ""
   ].join("\n");
 }
@@ -6881,6 +6956,7 @@ export async function register() {
 var NEXT_INSTRUMENTATION_NODE_TS = `${NEXT_INSTRUMENTATION_HEADER}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 import { NodeSDK } from '@opentelemetry/sdk-node'
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
@@ -6892,6 +6968,7 @@ new NodeSDK({ instrumentations }).start()
 var NEXT_INSTRUMENTATION_NODE_JS = `${NEXT_INSTRUMENTATION_HEADER}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 const { NodeSDK } = require('@opentelemetry/sdk-node')
 const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node')
@@ -6910,6 +6987,7 @@ var FRAMEWORK_OTEL_INIT_HEADER = "// Generated by `neat init --apply` (ADR-074).
 var FRAMEWORK_OTEL_INIT_TS_BODY = `${FRAMEWORK_OTEL_INIT_HEADER}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 import { NodeSDK } from '@opentelemetry/sdk-node'
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node'
@@ -6923,6 +7001,7 @@ sdk.start()
 var FRAMEWORK_OTEL_INIT_JS_BODY = `${FRAMEWORK_OTEL_INIT_HEADER}
 process.env.OTEL_SERVICE_NAME ||= '__SERVICE_NAME__'
 process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||= 'http://localhost:4318/projects/__PROJECT__/v1/traces'
+${OTEL_OTLP_HEADERS_JS}
 
 const { NodeSDK } = require('@opentelemetry/sdk-node')
 const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node')
@@ -9776,7 +9855,7 @@ function printBanner() {
   console.log("\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   ");
   console.log("");
   console.log("  Network Expressive Architecting Tool");
-  console.log("  neat.is  \xB7  v0.4.0  \xB7  Apache 2.0");
+  console.log(`  neat.is  \xB7  v${readPackageVersion()}  \xB7  Apache 2.0`);
   console.log("");
 }
 function printDiscoveryReport(opts, services) {
@@ -10421,6 +10500,7 @@ if (/[\\/]cli\.(?:cjs|js)$/.test(entry) || entry.endsWith("/cli") || entry.endsW
   CLAUDE_SKILL_CONFIG,
   QUERY_VERBS,
   parseArgs,
+  printBanner,
   readPackageVersion,
   runInit,
   runQueryVerb,