@neat.is/core 0.5.2 → 0.5.4-dev.20260721

package/dist/{chunk-DPEPI2N6.js → chunk-VR73QNJD.js}

@@ -31,13 +31,13 @@ import {
   touchLastSeen,
   upsertObservedEdge,
   writeAtomically
-} from "./chunk-BI3XKGVG.js";
+} from "./chunk-PEFX3DBR.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
   listenSteppingOtlp,
   readAuthEnv
-} from "./chunk-CFDPIMRP.js";
+} from "./chunk-I4NZ7PSN.js";
 
 // src/daemon.ts
 import {
@@ -98,8 +98,8 @@ async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
       line: callSite.line
     } : void 0;
     const calls = Math.trunc(signal.callCount);
-    if (calls < 1) continue;
-    const errors = Math.min(Math.max(Math.trunc(signal.errorCount), 0), calls);
+    if (!Number.isFinite(calls) || calls < 1) continue;
+    const errors = Number.isFinite(signal.errorCount) ? Math.min(Math.max(Math.trunc(signal.errorCount), 0), calls) : 0;
     let created = false;
     let ok = true;
     for (let i = 0; i < calls; i++) {
@@ -240,7 +240,12 @@ var JUNCTION_DEFAULT_RATE_LIMITS = {
   supabase: { capacity: 30, refillMs: 1e4 },
   // Not a documented API limit at all — a self-imposed ceiling on the raw
   // pg_stat_statements connection (see module header above).
-  "supabase-postgres": { capacity: 20, refillMs: 3e3 }
+  "supabase-postgres": { capacity: 20, refillMs: 3e3 },
+  // Push provider (ADR-146): the Drains REST API is touched only by `neat
+  // connector add/remove/test` (provision/deprovision/validate), never a poll
+  // loop, so this bucket is exercised a handful of times per command. Kept
+  // conservative pending a documented Drains-API rate limit.
+  vercel: { capacity: 20, refillMs: 5e3 }
 };
 var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
 function defaultRateLimitFor(provider) {
@@ -534,7 +539,10 @@ function targetFromRestPath(path3) {
 var ERROR_STATUS_THRESHOLD = 500;
 function mapEdgeLogRowsToSignals(rows) {
   const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(rows)) return [];
   for (const row of rows) {
+    if (!row || typeof row !== "object") continue;
+    if (typeof row.path !== "string" || typeof row.timestamp !== "string") continue;
     const target = targetFromRestPath(row.path);
     if (!target) continue;
     const key = `${target.targetKind}:${target.name}`;
@@ -575,9 +583,12 @@ function tableNameFromQueryText(query) {
 function diffPgStatStatementsToSignals(rows, previous, nowIso) {
   const signals = [];
   const seen = /* @__PURE__ */ new Set();
+  if (!Array.isArray(rows)) return signals;
   for (const row of rows) {
-    seen.add(row.queryid);
+    if (!row || typeof row !== "object" || typeof row.queryid !== "string") continue;
     const calls = Number(row.calls);
+    if (!Number.isFinite(calls)) continue;
+    seen.add(row.queryid);
     const prior = previous.get(row.queryid);
     previous.set(row.queryid, { calls });
     if (!prior || calls < prior.calls) continue;
@@ -897,7 +908,12 @@ function upsertBucket(buckets2, key, isError, timestamp, build) {
 }
 function mapRailwayHttpLogsToSignals(entries, routeIndex) {
   const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entries)) return [];
   for (const entry of entries) {
+    if (!entry || typeof entry !== "object") continue;
+    if (typeof entry.method !== "string" || typeof entry.path !== "string" || typeof entry.timestamp !== "string") {
+      continue;
+    }
     const method = entry.method.toUpperCase();
     const normalizedPath = normalizePathTemplate(entry.path);
     const match = findRailwayRoute(routeIndex, method, normalizedPath);
@@ -936,8 +952,11 @@ function mapRailwayHttpLogsToSignals(entries, routeIndex) {
 }
 function mapRailwayNetworkFlowLogsToSignals(entries) {
   const buckets2 = /* @__PURE__ */ new Map();
+  if (!Array.isArray(entries)) return [];
   for (const entry of entries) {
-    if (!entry.peerServiceId) continue;
+    if (!entry || typeof entry !== "object") continue;
+    if (typeof entry.peerServiceId !== "string" || entry.peerServiceId.length === 0) continue;
+    if (typeof entry.timestamp !== "string") continue;
     const isError = entry.dropCause !== null && entry.dropCause !== "";
     upsertBucket(buckets2, entry.peerServiceId, isError, entry.timestamp, () => ({
       targetKind: PEER_SERVICE_TARGET_KIND,
@@ -1061,7 +1080,7 @@ async function fetchHttpRequestLogEntries(creds, sinceIso) {
       throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
     }
     const json = await res.json();
-    out.push(...json.entries ?? []);
+    if (Array.isArray(json.entries)) out.push(...json.entries);
     if (!json.nextPageToken) break;
     pageToken = json.nextPageToken;
   }
@@ -1097,7 +1116,7 @@ function resourceNameFor(type, labels) {
   }
 }
 function pathFromRequestUrl(requestUrl) {
-  if (!requestUrl) return null;
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
   if (requestUrl.startsWith("/")) {
     const withoutQuery = requestUrl.split("?")[0];
     return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
@@ -1112,18 +1131,19 @@ function pathFromRequestUrl(requestUrl) {
 }
 var ERROR_STATUS_THRESHOLD2 = 500;
 function mapLogEntryToSignal(entry) {
+  if (!entry || typeof entry !== "object") return null;
   const resourceType = entry.resource?.type;
   if (!resourceType || !isFirebaseResourceType(resourceType)) return null;
   const resourceName = resourceNameFor(resourceType, entry.resource?.labels);
   if (!resourceName) return null;
   const req = entry.httpRequest;
   if (!req) return null;
-  if (!req.requestMethod) return null;
+  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
   const path3 = pathFromRequestUrl(req.requestUrl);
   if (path3 === null) return null;
   const timestamp = entry.timestamp;
-  if (!timestamp) return null;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
@@ -1269,7 +1289,7 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
     throw new Error(`cloudflare connector: telemetry query returned an error (${message})`);
   }
   const events = payload.result?.events?.events;
-  if (events === void 0) {
+  if (!Array.isArray(events)) {
     console.warn(
       "[neat connector] cloudflare: telemetry query returned success:true but no result.events.events array \u2014 the response shape may have changed; treating as zero events this tick"
     );
@@ -1295,7 +1315,7 @@ var HTTP_METHODS = /* @__PURE__ */ new Set([
 ]);
 var LEADING_TOKEN_RE = /^(\S+)\s+\S/;
 function parseHttpMethodFromTrigger(trigger) {
-  if (!trigger) return null;
+  if (typeof trigger !== "string") return null;
   const match = LEADING_TOKEN_RE.exec(trigger.trim());
   const token = match?.[1];
   if (!token) return null;
@@ -1311,14 +1331,17 @@ function parsePathFromTrigger(trigger) {
 }
 var ERROR_STATUS_THRESHOLD3 = 500;
 function mapEventToSignal(event) {
+  if (!event || typeof event !== "object") return null;
   const metadata = event.$metadata;
   const workers = event.$workers;
   const method = parseHttpMethodFromTrigger(metadata?.trigger);
   if (!method) return null;
   const scriptName = workers?.scriptName ?? metadata?.service;
-  if (!scriptName) return null;
+  if (typeof scriptName !== "string" || scriptName.length === 0) return null;
   const timestampMs = event.timestamp ?? metadata?.startTime;
   if (typeof timestampMs !== "number" || !Number.isFinite(timestampMs)) return null;
+  const observedAt = new Date(timestampMs);
+  if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
   const path3 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
@@ -1327,7 +1350,7 @@ function mapEventToSignal(event) {
     targetName: scriptName,
     callCount: 1,
     errorCount: isError ? 1 : 0,
-    lastObservedIso: new Date(timestampMs).toISOString(),
+    lastObservedIso: observedAt.toISOString(),
     method,
     ...path3 ? { path: path3 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
@@ -1425,6 +1448,108 @@ function createCloudflareResolveTarget(config, graph) {
   };
 }
 
+// src/connectors/vercel/client.ts
+var DEFAULT_API_BASE_URL = "https://api.vercel.com";
+var DEFAULT_DRAIN_NAME = "neat-otlp";
+var TRACE_SCHEMAS = { trace: { version: "v1" } };
+function apiBase(config) {
+  return config.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+}
+function teamQuery(config) {
+  return `?teamId=${encodeURIComponent(config.teamId)}`;
+}
+function drainDelivery(config, otelToken) {
+  return {
+    type: "http",
+    endpoint: config.endpoint,
+    encoding: "json",
+    headers: bearerAuthHeader(otelToken),
+    ...config.secret ? { secret: config.secret } : {}
+  };
+}
+async function describeError(res) {
+  try {
+    const data = await res.json();
+    const message = data?.error?.message;
+    return typeof message === "string" && message.length > 0 ? ` \u2014 ${message}` : "";
+  } catch {
+    return "";
+  }
+}
+async function createVercelDrain(config, credentials, fetchImpl = fetch) {
+  const projectIds = config.projectIds ?? [];
+  const body = {
+    name: config.drainName ?? DEFAULT_DRAIN_NAME,
+    projects: projectIds.length > 0 ? "some" : "all",
+    ...projectIds.length > 0 ? { projectIds } : {},
+    schemas: TRACE_SCHEMAS,
+    delivery: drainDelivery(config, credentials.otelToken),
+    source: { kind: "self-served" }
+  };
+  const res = await junctionFetch(
+    `${apiBase(config)}/v1/drains${teamQuery(config)}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...bearerAuthHeader(credentials.token) },
+      body: JSON.stringify(body)
+    },
+    { provider: "vercel", accountKey: config.teamId, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(
+      `vercel connector: create drain failed (${res.status} ${res.statusText}${await describeError(res)})`
+    );
+  }
+  const payload = await res.json().catch(() => null);
+  if (!payload || typeof payload.id !== "string" || payload.id.length === 0) {
+    throw new Error(
+      "vercel connector: create drain returned no drain id \u2014 the Drains API response shape may have changed"
+    );
+  }
+  return {
+    id: payload.id,
+    ...payload.status ? { status: payload.status } : {},
+    ...payload.disabledReason ? { disabledReason: payload.disabledReason } : {}
+  };
+}
+async function deleteVercelDrain(config, drainId, credentials, fetchImpl = fetch) {
+  const res = await junctionFetch(
+    `${apiBase(config)}/v1/drains/${encodeURIComponent(drainId)}${teamQuery(config)}`,
+    { method: "DELETE", headers: { ...bearerAuthHeader(credentials.token) } },
+    { provider: "vercel", accountKey: config.teamId, fetchImpl }
+  );
+  if (res.ok || res.status === 404) return;
+  throw new Error(
+    `vercel connector: delete drain failed (${res.status} ${res.statusText}${await describeError(res)})`
+  );
+}
+async function testVercelDrainDelivery(config, credentials, fetchImpl = fetch) {
+  const res = await junctionFetch(
+    `${apiBase(config)}/v1/drains/test${teamQuery(config)}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...bearerAuthHeader(credentials.token) },
+      body: JSON.stringify({ schemas: TRACE_SCHEMAS, delivery: drainDelivery(config, credentials.otelToken) })
+    },
+    { provider: "vercel", accountKey: config.teamId, fetchImpl }
+  );
+  if (res.status === 401 || res.status === 403) {
+    return { status: "failure", error: `vercel rejected the API token (HTTP ${res.status})` };
+  }
+  if (!res.ok) {
+    return {
+      status: "failure",
+      error: `vercel drain validation failed (${res.status} ${res.statusText}${await describeError(res)})`
+    };
+  }
+  const payload = await res.json().catch(() => null);
+  return {
+    ...payload?.status ? { status: payload.status } : {},
+    ...payload?.error ? { error: payload.error } : {},
+    ...payload?.endpoint ? { endpoint: payload.endpoint } : {}
+  };
+}
+
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -1576,8 +1701,96 @@ var PROVIDER_DISPATCH = {
     }
   }
 };
-function getProviderDispatch(provider) {
-  return PROVIDER_DISPATCH[provider];
+function vercelCredsFrom(credentials) {
+  return { token: String(credentials.token ?? ""), otelToken: String(credentials.otelToken ?? "") };
+}
+function vercelConfigFromOptions(options) {
+  const raw = options.projectIds;
+  let projectIds;
+  if (Array.isArray(raw)) projectIds = raw.filter((p) => typeof p === "string");
+  else if (typeof raw === "string" && raw.trim().length > 0) {
+    projectIds = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  }
+  return {
+    teamId: String(options.teamId ?? ""),
+    endpoint: String(options.endpoint ?? ""),
+    ...projectIds && projectIds.length > 0 ? { projectIds } : {},
+    ...typeof options.drainId === "string" ? { drainId: options.drainId } : {},
+    ...typeof options.drainName === "string" ? { drainName: options.drainName } : {},
+    ...typeof options.apiBaseUrl === "string" ? { apiBaseUrl: options.apiBaseUrl } : {},
+    ...typeof options.secret === "string" ? { secret: options.secret } : {}
+  };
+}
+var PUSH_PROVIDER_DISPATCH = {
+  vercel: {
+    provider: "vercel",
+    // The Vercel access token is the "primary" secret a single `--token`
+    // populates; `otelToken` (the daemon's OTLP bearer) is the second field.
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token", "otelToken"],
+    // teamId scopes every Drains call; endpoint is where the drain delivers.
+    // projectIds is optional (absent → the drain covers the whole team).
+    requiredOptionFields: ["teamId", "endpoint"],
+    // POST /v1/drains/test — authenticates the token and pings the endpoint
+    // with a sample event, so `success` means the credential is live *and* the
+    // daemon's OTLP endpoint is reachable and accepted the drain's bearer.
+    async validate({ credentials, options, fetchImpl }) {
+      const result = await testVercelDrainDelivery(
+        vercelConfigFromOptions(options),
+        vercelCredsFrom(credentials),
+        fetchImpl
+      );
+      if (result.status === "success") return { ok: true };
+      return {
+        ok: false,
+        reason: result.error ?? `vercel drain delivery test returned "${result.status ?? "no status"}"`
+      };
+    },
+    // POST /v1/drains — creates the trace drain, returns its id to store in
+    // `options.drainId`. A created-but-not-enabled drain is surfaced as a note,
+    // not a failure (the entry still points at a real drain).
+    async provision({ credentials, options, fetchImpl }) {
+      try {
+        const created = await createVercelDrain(
+          vercelConfigFromOptions(options),
+          vercelCredsFrom(credentials),
+          fetchImpl
+        );
+        const note = created.status && created.status !== "enabled" ? `the drain was created but its status is "${created.status}"${created.disabledReason ? ` (${created.disabledReason})` : ""} \u2014 check the Vercel dashboard` : void 0;
+        return { ok: true, options: { drainId: created.id }, ...note ? { note } : {} };
+      } catch (err) {
+        return { ok: false, reason: err.message };
+      }
+    },
+    // DELETE /v1/drains/{id} — idempotent (deleteVercelDrain treats 404 as
+    // success). No recorded drainId → nothing to delete, still a success.
+    async deprovision({ credentials, options, fetchImpl }) {
+      const drainId = typeof options.drainId === "string" ? options.drainId : "";
+      if (!drainId) {
+        return { ok: true, note: "no drain id was recorded \u2014 nothing to delete on the Vercel side" };
+      }
+      try {
+        await deleteVercelDrain(
+          vercelConfigFromOptions(options),
+          drainId,
+          vercelCredsFrom(credentials),
+          fetchImpl
+        );
+        return { ok: true };
+      } catch (err) {
+        return { ok: false, reason: err.message };
+      }
+    }
+  }
+};
+function isPushProvider(provider) {
+  return provider in PUSH_PROVIDER_DISPATCH;
+}
+function getProviderFieldSchema(provider) {
+  return PROVIDER_DISPATCH[provider] ?? PUSH_PROVIDER_DISPATCH[provider];
+}
+function knownProviderNames() {
+  return [...Object.keys(PROVIDER_DISPATCH), ...Object.keys(PUSH_PROVIDER_DISPATCH)].sort();
 }
 function resolveEntryCredentials(dispatch, entry, env) {
   let credentials;
@@ -1601,6 +1814,13 @@ function resolveEntryCredentials(dispatch, entry, env) {
 function buildRegistration(entry, graph, env = process.env) {
   const dispatch = PROVIDER_DISPATCH[entry.provider];
   if (!dispatch) {
+    if (isPushProvider(entry.provider)) {
+      return {
+        ok: false,
+        push: true,
+        reason: `push provider "${entry.provider}" ingests via the OTLP receiver \u2014 nothing to poll`
+      };
+    }
     return { ok: false, reason: `unknown provider "${entry.provider}"` };
   }
   const creds = resolveEntryCredentials(dispatch, entry, env);
@@ -1635,7 +1855,7 @@ function buildRegistration(entry, graph, env = process.env) {
   };
 }
 async function validateConnectorEntry(entry, env = process.env, fetchImpl) {
-  const dispatch = PROVIDER_DISPATCH[entry.provider];
+  const dispatch = PROVIDER_DISPATCH[entry.provider] ?? PUSH_PROVIDER_DISPATCH[entry.provider];
   if (!dispatch) {
     return { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` };
   }
@@ -1676,10 +1896,58 @@ async function loadConnectorRegistrations(input) {
     if (!connectorMatchesProject(entry, project)) continue;
     const result = buildRegistration(entry, graph, env);
     if (result.ok) registrations.push(result.registration);
-    else onSkip?.(entry, result.reason);
+    else if (!result.push) onSkip?.(entry, result.reason);
   }
   return registrations;
 }
+function resolvePushEntry(entry, env) {
+  const dispatch = PUSH_PROVIDER_DISPATCH[entry.provider];
+  if (!dispatch) {
+    return PROVIDER_DISPATCH[entry.provider] ? {
+      ok: false,
+      outcome: {
+        status: "not-push",
+        reason: `provider "${entry.provider}" is polled, not provisioned \u2014 there is no drain to manage`
+      }
+    } : { ok: false, outcome: { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` } };
+  }
+  const creds = resolveEntryCredentials(dispatch, entry, env);
+  if (!creds.ok) {
+    const status = creds.kind === "unset-env" ? "unset-env" : creds.kind === "missing-field" ? "missing-field" : "failed";
+    return { ok: false, outcome: { status, reason: creds.reason } };
+  }
+  const options = entry.options ?? {};
+  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
+  if (missingOpts.length > 0) {
+    return {
+      ok: false,
+      outcome: { status: "missing-field", reason: `options missing required field(s): ${missingOpts.join(", ")}` }
+    };
+  }
+  return { ok: true, dispatch, credentials: creds.credentials, options };
+}
+async function provisionConnector(entry, env = process.env, fetchImpl) {
+  const resolved = resolvePushEntry(entry, env);
+  if (!resolved.ok) return resolved.outcome;
+  const result = await resolved.dispatch.provision({
+    credentials: resolved.credentials,
+    options: resolved.options,
+    ...fetchImpl ? { fetchImpl } : {}
+  });
+  if (!result.ok) return { status: "failed", reason: result.reason };
+  return { status: "ok", ...result.options ? { options: result.options } : {}, ...result.note ? { note: result.note } : {} };
+}
+async function deprovisionConnector(entry, env = process.env, fetchImpl) {
+  const resolved = resolvePushEntry(entry, env);
+  if (!resolved.ok) return resolved.outcome;
+  const result = await resolved.dispatch.deprovision({
+    credentials: resolved.credentials,
+    options: resolved.options,
+    ...fetchImpl ? { fetchImpl } : {}
+  });
+  if (!result.ok) return { status: "failed", reason: result.reason };
+  return { status: "ok", ...result.note ? { note: result.note } : {} };
+}
 
 // src/unrouted.ts
 import { promises as fs } from "fs";
@@ -2475,9 +2743,12 @@ async function startDaemon(opts = {}) {
 }
 
 export {
-  PROVIDER_DISPATCH,
-  getProviderDispatch,
+  isPushProvider,
+  getProviderFieldSchema,
+  knownProviderNames,
   validateConnectorEntry,
+  provisionConnector,
+  deprovisionConnector,
   readDaemonRecord,
   resolveNeatVersion,
   writeDaemonRecord,
@@ -2488,4 +2759,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-DPEPI2N6.js.map
+//# sourceMappingURL=chunk-VR73QNJD.js.map