@neat.is/core 0.5.4-dev.20260721 → 0.6.1

package/dist/{chunk-VR73QNJD.js → chunk-3YUNROLT.js}

@@ -31,13 +31,13 @@ import {
   touchLastSeen,
   upsertObservedEdge,
   writeAtomically
-} from "./chunk-PEFX3DBR.js";
+} from "./chunk-7C6ZULNU.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
   listenSteppingOtlp,
   readAuthEnv
-} from "./chunk-I4NZ7PSN.js";
+} from "./chunk-BZ3AJVAC.js";
 
 // src/daemon.ts
 import {
@@ -1686,15 +1686,21 @@ var PROVIDER_DISPATCH = {
         resolveTarget: createCloudflareResolveTarget(config, graph)
       };
     },
-    // GET /user/tokens/verify — Cloudflare's own purpose-built "is this API
-    // token live" endpoint. 200 on a valid token, 401 on an invalid one.
+    // GET /accounts/{accountId}/tokens/verify — the *account-scoped* token-verify
+    // endpoint. A Workers connector token is scoped to the account, and the
+    // user-level `GET /user/tokens/verify` returns 401 "Invalid API Token" for
+    // such a token even though it authenticates fine against the account's own
+    // resources (confirmed live). Probing the account-scoped verify endpoint —
+    // `accountId` is already required for this provider — returns 200
+    // `{status:"active"}` for a working token and 401 for a bad one, so a valid
+    // Workers token is no longer falsely rejected at `neat connector add`.
     validate({ credentials, options, fetchImpl }) {
       const cfg = options;
       const baseUrl = cfg.baseUrl ?? CLOUDFLARE_API_BASE_URL;
       return authProbe({
         provider: "cloudflare",
         accountKey: cfg.accountId ?? "validate",
-        url: `${baseUrl}/user/tokens/verify`,
+        url: `${baseUrl}/accounts/${cfg.accountId ?? ""}/tokens/verify`,
         token: String(credentials.apiToken ?? ""),
         ...fetchImpl ? { fetchImpl } : {}
       });
@@ -2759,4 +2765,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-VR73QNJD.js.map
+//# sourceMappingURL=chunk-3YUNROLT.js.map