@neat.is/core 0.5.3 → 0.6.0

package/dist/{chunk-X2AMX3QZ.js → chunk-5PVQJLPR.js}

@@ -31,13 +31,13 @@ import {
   touchLastSeen,
   upsertObservedEdge,
   writeAtomically
-} from "./chunk-GJHEZC5K.js";
+} from "./chunk-CS4GHQO3.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
   listenSteppingOtlp,
   readAuthEnv
-} from "./chunk-CFDPIMRP.js";
+} from "./chunk-BZ3AJVAC.js";
 
 // src/daemon.ts
 import {
@@ -240,7 +240,12 @@ var JUNCTION_DEFAULT_RATE_LIMITS = {
   supabase: { capacity: 30, refillMs: 1e4 },
   // Not a documented API limit at all — a self-imposed ceiling on the raw
   // pg_stat_statements connection (see module header above).
-  "supabase-postgres": { capacity: 20, refillMs: 3e3 }
+  "supabase-postgres": { capacity: 20, refillMs: 3e3 },
+  // Push provider (ADR-146): the Drains REST API is touched only by `neat
+  // connector add/remove/test` (provision/deprovision/validate), never a poll
+  // loop, so this bucket is exercised a handful of times per command. Kept
+  // conservative pending a documented Drains-API rate limit.
+  vercel: { capacity: 20, refillMs: 5e3 }
 };
 var JUNCTION_GENERIC_RATE_LIMIT = { capacity: 20, refillMs: 5e3 };
 function defaultRateLimitFor(provider) {
@@ -1443,6 +1448,108 @@ function createCloudflareResolveTarget(config, graph) {
   };
 }
 
+// src/connectors/vercel/client.ts
+var DEFAULT_API_BASE_URL = "https://api.vercel.com";
+var DEFAULT_DRAIN_NAME = "neat-otlp";
+var TRACE_SCHEMAS = { trace: { version: "v1" } };
+function apiBase(config) {
+  return config.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+}
+function teamQuery(config) {
+  return `?teamId=${encodeURIComponent(config.teamId)}`;
+}
+function drainDelivery(config, otelToken) {
+  return {
+    type: "http",
+    endpoint: config.endpoint,
+    encoding: "json",
+    headers: bearerAuthHeader(otelToken),
+    ...config.secret ? { secret: config.secret } : {}
+  };
+}
+async function describeError(res) {
+  try {
+    const data = await res.json();
+    const message = data?.error?.message;
+    return typeof message === "string" && message.length > 0 ? ` \u2014 ${message}` : "";
+  } catch {
+    return "";
+  }
+}
+async function createVercelDrain(config, credentials, fetchImpl = fetch) {
+  const projectIds = config.projectIds ?? [];
+  const body = {
+    name: config.drainName ?? DEFAULT_DRAIN_NAME,
+    projects: projectIds.length > 0 ? "some" : "all",
+    ...projectIds.length > 0 ? { projectIds } : {},
+    schemas: TRACE_SCHEMAS,
+    delivery: drainDelivery(config, credentials.otelToken),
+    source: { kind: "self-served" }
+  };
+  const res = await junctionFetch(
+    `${apiBase(config)}/v1/drains${teamQuery(config)}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...bearerAuthHeader(credentials.token) },
+      body: JSON.stringify(body)
+    },
+    { provider: "vercel", accountKey: config.teamId, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(
+      `vercel connector: create drain failed (${res.status} ${res.statusText}${await describeError(res)})`
+    );
+  }
+  const payload = await res.json().catch(() => null);
+  if (!payload || typeof payload.id !== "string" || payload.id.length === 0) {
+    throw new Error(
+      "vercel connector: create drain returned no drain id \u2014 the Drains API response shape may have changed"
+    );
+  }
+  return {
+    id: payload.id,
+    ...payload.status ? { status: payload.status } : {},
+    ...payload.disabledReason ? { disabledReason: payload.disabledReason } : {}
+  };
+}
+async function deleteVercelDrain(config, drainId, credentials, fetchImpl = fetch) {
+  const res = await junctionFetch(
+    `${apiBase(config)}/v1/drains/${encodeURIComponent(drainId)}${teamQuery(config)}`,
+    { method: "DELETE", headers: { ...bearerAuthHeader(credentials.token) } },
+    { provider: "vercel", accountKey: config.teamId, fetchImpl }
+  );
+  if (res.ok || res.status === 404) return;
+  throw new Error(
+    `vercel connector: delete drain failed (${res.status} ${res.statusText}${await describeError(res)})`
+  );
+}
+async function testVercelDrainDelivery(config, credentials, fetchImpl = fetch) {
+  const res = await junctionFetch(
+    `${apiBase(config)}/v1/drains/test${teamQuery(config)}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...bearerAuthHeader(credentials.token) },
+      body: JSON.stringify({ schemas: TRACE_SCHEMAS, delivery: drainDelivery(config, credentials.otelToken) })
+    },
+    { provider: "vercel", accountKey: config.teamId, fetchImpl }
+  );
+  if (res.status === 401 || res.status === 403) {
+    return { status: "failure", error: `vercel rejected the API token (HTTP ${res.status})` };
+  }
+  if (!res.ok) {
+    return {
+      status: "failure",
+      error: `vercel drain validation failed (${res.status} ${res.statusText}${await describeError(res)})`
+    };
+  }
+  const payload = await res.json().catch(() => null);
+  return {
+    ...payload?.status ? { status: payload.status } : {},
+    ...payload?.error ? { error: payload.error } : {},
+    ...payload?.endpoint ? { endpoint: payload.endpoint } : {}
+  };
+}
+
 // src/connectors/registry.ts
 var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 async function authProbe(input) {
@@ -1579,23 +1686,117 @@ var PROVIDER_DISPATCH = {
         resolveTarget: createCloudflareResolveTarget(config, graph)
       };
     },
-    // GET /user/tokens/verify — Cloudflare's own purpose-built "is this API
-    // token live" endpoint. 200 on a valid token, 401 on an invalid one.
+    // GET /accounts/{accountId}/tokens/verify — the *account-scoped* token-verify
+    // endpoint. A Workers connector token is scoped to the account, and the
+    // user-level `GET /user/tokens/verify` returns 401 "Invalid API Token" for
+    // such a token even though it authenticates fine against the account's own
+    // resources (confirmed live). Probing the account-scoped verify endpoint —
+    // `accountId` is already required for this provider — returns 200
+    // `{status:"active"}` for a working token and 401 for a bad one, so a valid
+    // Workers token is no longer falsely rejected at `neat connector add`.
     validate({ credentials, options, fetchImpl }) {
       const cfg = options;
       const baseUrl = cfg.baseUrl ?? CLOUDFLARE_API_BASE_URL;
       return authProbe({
         provider: "cloudflare",
         accountKey: cfg.accountId ?? "validate",
-        url: `${baseUrl}/user/tokens/verify`,
+        url: `${baseUrl}/accounts/${cfg.accountId ?? ""}/tokens/verify`,
         token: String(credentials.apiToken ?? ""),
         ...fetchImpl ? { fetchImpl } : {}
       });
     }
   }
 };
-function getProviderDispatch(provider) {
-  return PROVIDER_DISPATCH[provider];
+function vercelCredsFrom(credentials) {
+  return { token: String(credentials.token ?? ""), otelToken: String(credentials.otelToken ?? "") };
+}
+function vercelConfigFromOptions(options) {
+  const raw = options.projectIds;
+  let projectIds;
+  if (Array.isArray(raw)) projectIds = raw.filter((p) => typeof p === "string");
+  else if (typeof raw === "string" && raw.trim().length > 0) {
+    projectIds = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  }
+  return {
+    teamId: String(options.teamId ?? ""),
+    endpoint: String(options.endpoint ?? ""),
+    ...projectIds && projectIds.length > 0 ? { projectIds } : {},
+    ...typeof options.drainId === "string" ? { drainId: options.drainId } : {},
+    ...typeof options.drainName === "string" ? { drainName: options.drainName } : {},
+    ...typeof options.apiBaseUrl === "string" ? { apiBaseUrl: options.apiBaseUrl } : {},
+    ...typeof options.secret === "string" ? { secret: options.secret } : {}
+  };
+}
+var PUSH_PROVIDER_DISPATCH = {
+  vercel: {
+    provider: "vercel",
+    // The Vercel access token is the "primary" secret a single `--token`
+    // populates; `otelToken` (the daemon's OTLP bearer) is the second field.
+    primaryCredentialKey: "token",
+    requiredCredentialFields: ["token", "otelToken"],
+    // teamId scopes every Drains call; endpoint is where the drain delivers.
+    // projectIds is optional (absent → the drain covers the whole team).
+    requiredOptionFields: ["teamId", "endpoint"],
+    // POST /v1/drains/test — authenticates the token and pings the endpoint
+    // with a sample event, so `success` means the credential is live *and* the
+    // daemon's OTLP endpoint is reachable and accepted the drain's bearer.
+    async validate({ credentials, options, fetchImpl }) {
+      const result = await testVercelDrainDelivery(
+        vercelConfigFromOptions(options),
+        vercelCredsFrom(credentials),
+        fetchImpl
+      );
+      if (result.status === "success") return { ok: true };
+      return {
+        ok: false,
+        reason: result.error ?? `vercel drain delivery test returned "${result.status ?? "no status"}"`
+      };
+    },
+    // POST /v1/drains — creates the trace drain, returns its id to store in
+    // `options.drainId`. A created-but-not-enabled drain is surfaced as a note,
+    // not a failure (the entry still points at a real drain).
+    async provision({ credentials, options, fetchImpl }) {
+      try {
+        const created = await createVercelDrain(
+          vercelConfigFromOptions(options),
+          vercelCredsFrom(credentials),
+          fetchImpl
+        );
+        const note = created.status && created.status !== "enabled" ? `the drain was created but its status is "${created.status}"${created.disabledReason ? ` (${created.disabledReason})` : ""} \u2014 check the Vercel dashboard` : void 0;
+        return { ok: true, options: { drainId: created.id }, ...note ? { note } : {} };
+      } catch (err) {
+        return { ok: false, reason: err.message };
+      }
+    },
+    // DELETE /v1/drains/{id} — idempotent (deleteVercelDrain treats 404 as
+    // success). No recorded drainId → nothing to delete, still a success.
+    async deprovision({ credentials, options, fetchImpl }) {
+      const drainId = typeof options.drainId === "string" ? options.drainId : "";
+      if (!drainId) {
+        return { ok: true, note: "no drain id was recorded \u2014 nothing to delete on the Vercel side" };
+      }
+      try {
+        await deleteVercelDrain(
+          vercelConfigFromOptions(options),
+          drainId,
+          vercelCredsFrom(credentials),
+          fetchImpl
+        );
+        return { ok: true };
+      } catch (err) {
+        return { ok: false, reason: err.message };
+      }
+    }
+  }
+};
+function isPushProvider(provider) {
+  return provider in PUSH_PROVIDER_DISPATCH;
+}
+function getProviderFieldSchema(provider) {
+  return PROVIDER_DISPATCH[provider] ?? PUSH_PROVIDER_DISPATCH[provider];
+}
+function knownProviderNames() {
+  return [...Object.keys(PROVIDER_DISPATCH), ...Object.keys(PUSH_PROVIDER_DISPATCH)].sort();
 }
 function resolveEntryCredentials(dispatch, entry, env) {
   let credentials;
@@ -1619,6 +1820,13 @@ function resolveEntryCredentials(dispatch, entry, env) {
 function buildRegistration(entry, graph, env = process.env) {
   const dispatch = PROVIDER_DISPATCH[entry.provider];
   if (!dispatch) {
+    if (isPushProvider(entry.provider)) {
+      return {
+        ok: false,
+        push: true,
+        reason: `push provider "${entry.provider}" ingests via the OTLP receiver \u2014 nothing to poll`
+      };
+    }
     return { ok: false, reason: `unknown provider "${entry.provider}"` };
   }
   const creds = resolveEntryCredentials(dispatch, entry, env);
@@ -1653,7 +1861,7 @@ function buildRegistration(entry, graph, env = process.env) {
   };
 }
 async function validateConnectorEntry(entry, env = process.env, fetchImpl) {
-  const dispatch = PROVIDER_DISPATCH[entry.provider];
+  const dispatch = PROVIDER_DISPATCH[entry.provider] ?? PUSH_PROVIDER_DISPATCH[entry.provider];
   if (!dispatch) {
     return { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` };
   }
@@ -1694,10 +1902,58 @@ async function loadConnectorRegistrations(input) {
     if (!connectorMatchesProject(entry, project)) continue;
     const result = buildRegistration(entry, graph, env);
     if (result.ok) registrations.push(result.registration);
-    else onSkip?.(entry, result.reason);
+    else if (!result.push) onSkip?.(entry, result.reason);
   }
   return registrations;
 }
+function resolvePushEntry(entry, env) {
+  const dispatch = PUSH_PROVIDER_DISPATCH[entry.provider];
+  if (!dispatch) {
+    return PROVIDER_DISPATCH[entry.provider] ? {
+      ok: false,
+      outcome: {
+        status: "not-push",
+        reason: `provider "${entry.provider}" is polled, not provisioned \u2014 there is no drain to manage`
+      }
+    } : { ok: false, outcome: { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` } };
+  }
+  const creds = resolveEntryCredentials(dispatch, entry, env);
+  if (!creds.ok) {
+    const status = creds.kind === "unset-env" ? "unset-env" : creds.kind === "missing-field" ? "missing-field" : "failed";
+    return { ok: false, outcome: { status, reason: creds.reason } };
+  }
+  const options = entry.options ?? {};
+  const missingOpts = dispatch.requiredOptionFields.filter((k) => !(k in options));
+  if (missingOpts.length > 0) {
+    return {
+      ok: false,
+      outcome: { status: "missing-field", reason: `options missing required field(s): ${missingOpts.join(", ")}` }
+    };
+  }
+  return { ok: true, dispatch, credentials: creds.credentials, options };
+}
+async function provisionConnector(entry, env = process.env, fetchImpl) {
+  const resolved = resolvePushEntry(entry, env);
+  if (!resolved.ok) return resolved.outcome;
+  const result = await resolved.dispatch.provision({
+    credentials: resolved.credentials,
+    options: resolved.options,
+    ...fetchImpl ? { fetchImpl } : {}
+  });
+  if (!result.ok) return { status: "failed", reason: result.reason };
+  return { status: "ok", ...result.options ? { options: result.options } : {}, ...result.note ? { note: result.note } : {} };
+}
+async function deprovisionConnector(entry, env = process.env, fetchImpl) {
+  const resolved = resolvePushEntry(entry, env);
+  if (!resolved.ok) return resolved.outcome;
+  const result = await resolved.dispatch.deprovision({
+    credentials: resolved.credentials,
+    options: resolved.options,
+    ...fetchImpl ? { fetchImpl } : {}
+  });
+  if (!result.ok) return { status: "failed", reason: result.reason };
+  return { status: "ok", ...result.note ? { note: result.note } : {} };
+}
 
 // src/unrouted.ts
 import { promises as fs } from "fs";
@@ -2493,9 +2749,12 @@ async function startDaemon(opts = {}) {
 }
 
 export {
-  PROVIDER_DISPATCH,
-  getProviderDispatch,
+  isPushProvider,
+  getProviderFieldSchema,
+  knownProviderNames,
   validateConnectorEntry,
+  provisionConnector,
+  deprovisionConnector,
   readDaemonRecord,
   resolveNeatVersion,
   writeDaemonRecord,
@@ -2506,4 +2765,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-X2AMX3QZ.js.map
+//# sourceMappingURL=chunk-5PVQJLPR.js.map