@neat.is/core 0.9.20-dev.20260922 → 0.9.20

package/dist/{chunk-KIV7OB2K.js → chunk-NFJ4W5T6.js}

@@ -4690,9 +4690,30 @@ function withRecoveredCodeAttrs(attrs, locus) {
   if (locus.codeLineno !== void 0) attrs[CODE_LINENO_ATTR] = locus.codeLineno;
   return attrs;
 }
+var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-amz-security-token",
+  "x-csrf-token"
+]);
+function attrHeaderName(key) {
+  const lower = key.toLowerCase();
+  const marker = ".header.";
+  const at = lower.lastIndexOf(marker);
+  return at >= 0 ? lower.slice(at + marker.length) : lower;
+}
+function isSensitiveAttrKey(key) {
+  return SENSITIVE_HEADER_NAMES.has(attrHeaderName(key));
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
+    if (isSensitiveAttrKey(k)) continue;
     if (typeof v === "bigint") out[k] = v.toString();
     else out[k] = v;
   }
@@ -5283,6 +5304,14 @@ async function readErrorFileTail(errorsPath, maxBytes) {
     await handle.close();
   }
 }
+function redactPersistedAttributes(ev) {
+  if (!ev.attributes) return ev;
+  const scrubbed = sanitizeAttributes(ev.attributes);
+  if (Object.keys(scrubbed).length === Object.keys(ev.attributes).length) return ev;
+  if (Object.keys(scrubbed).length > 0) return { ...ev, attributes: scrubbed };
+  const { attributes: _dropped, ...rest } = ev;
+  return rest;
+}
 async function readErrorEvents(errorsPath, opts) {
   let raw;
   try {
@@ -5291,7 +5320,7 @@ async function readErrorEvents(errorsPath, opts) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
-  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => redactPersistedAttributes(JSON.parse(line)));
   const deduped = dedupeIncidents(events);
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
@@ -18599,6 +18628,9 @@ function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options =
   };
 }
 
+// src/connectors/gcp-auth.ts
+import { createSign } from "crypto";
+
 // src/connectors/junction.ts
 var buckets = /* @__PURE__ */ new Map();
 function bucketMapKey(provider, accountKey) {
@@ -18859,6 +18891,108 @@ async function dbJunction(run, policy) {
   }
 }
 
+// src/connectors/gcp-auth.ts
+var DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+var JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var ASSERTION_LIFETIME_S = 3600;
+var DEFAULT_REFRESH_SKEW_MS = 6e4;
+var GCP_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
+function parseServiceAccountKey(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    throw new Error("gcp service-account key: not valid JSON");
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("gcp service-account key: expected a JSON object");
+  }
+  const obj = raw;
+  const clientEmail = obj["client_email"];
+  const privateKey = obj["private_key"];
+  const projectId = obj["project_id"];
+  if (typeof clientEmail !== "string" || clientEmail.length === 0) {
+    throw new Error("gcp service-account key: missing client_email");
+  }
+  if (typeof privateKey !== "string" || privateKey.length === 0) {
+    throw new Error("gcp service-account key: missing private_key");
+  }
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp service-account key: missing project_id");
+  }
+  const key = { client_email: clientEmail, private_key: privateKey, project_id: projectId };
+  if (typeof obj["token_uri"] === "string" && obj["token_uri"].length > 0) {
+    key.token_uri = obj["token_uri"];
+  }
+  return key;
+}
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function buildServiceAccountAssertion(key, scope, tokenUri, nowMs) {
+  const iat = Math.floor(nowMs / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const claims = {
+    iss: key.client_email,
+    scope,
+    aud: tokenUri,
+    iat,
+    exp: iat + ASSERTION_LIFETIME_S
+  };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const signature = createSign("RSA-SHA256").update(signingInput).end().sign(key.private_key);
+  return `${signingInput}.${base64url(signature)}`;
+}
+async function mintGcpAccessToken(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const tokenUri = opts.tokenUri ?? key.token_uri ?? DEFAULT_TOKEN_URI;
+  const mintedAtMs = now();
+  const assertion = buildServiceAccountAssertion(key, scope, tokenUri, mintedAtMs);
+  const body = new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }).toString();
+  const res = await junctionFetch(
+    tokenUri,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    },
+    // accountKey: the GCP project id — an identifier, safe to log, the same
+    // per-(provider, accountKey) rate-limit bucket key the GCP connectors use.
+    { provider: "gcp-auth", accountKey: key.project_id, ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`gcp token mint failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  const accessToken = json.access_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp token mint returned no access_token");
+  }
+  const expiresInS = typeof json.expires_in === "number" && json.expires_in > 0 ? json.expires_in : ASSERTION_LIFETIME_S;
+  return { accessToken, expiresAtMs: mintedAtMs + expiresInS * 1e3 };
+}
+function createGcpTokenSource(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const skewMs = opts.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+  let cached = null;
+  let inFlight = null;
+  const fresh = () => cached !== null && now() < cached.expiresAtMs - skewMs;
+  return async () => {
+    if (!fresh()) {
+      if (!inFlight) {
+        inFlight = mintGcpAccessToken(key, scope, opts).then((minted) => {
+          cached = minted;
+          return minted;
+        }).finally(() => {
+          inFlight = null;
+        });
+      }
+      await inFlight;
+    }
+    return { projectId: key.project_id, accessToken: cached.accessToken };
+  };
+}
+
 // src/connectors/supabase/client.ts
 var DEFAULT_SUPABASE_MANAGEMENT_API_URL = "https://api.supabase.com";
 var DEFAULT_LOG_LIMIT = 1e3;
@@ -21665,7 +21799,8 @@ function getProviderFieldSchema(provider) {
 function knownProviderNames() {
   return [...Object.keys(PROVIDER_DISPATCH), ...Object.keys(PUSH_PROVIDER_DISPATCH)].sort();
 }
-function resolveEntryCredentials(dispatch, entry, env) {
+var GCP_SERVICE_ACCOUNT_PROVIDERS = /* @__PURE__ */ new Set(["cloud-run", "gcp-lb", "firebase"]);
+function resolveEntryCredentials(dispatch, entry, env, fetchImpl) {
   let credentials;
   try {
     const resolved = resolveCredential(entry.credential, env);
@@ -21674,6 +21809,15 @@ function resolveEntryCredentials(dispatch, entry, env) {
     if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
     return { ok: false, kind: "error", reason: err.message };
   }
+  if (GCP_SERVICE_ACCOUNT_PROVIDERS.has(entry.provider) && typeof credentials.serviceAccountKey === "string" && credentials.serviceAccountKey.length > 0) {
+    try {
+      const key = parseServiceAccountKey(credentials.serviceAccountKey);
+      const source = createGcpTokenSource(key, GCP_LOGGING_READ_SCOPE, fetchImpl ? { fetchImpl } : {});
+      return { ok: true, credentials: { projectId: key.project_id }, refreshCredentials: source };
+    } catch (err) {
+      return { ok: false, kind: "error", reason: err.message };
+    }
+  }
   const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
   if (missingCreds.length > 0) {
     return {
@@ -21723,7 +21867,10 @@ function buildRegistration(entry, graph, env = process.env) {
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
-      ...intervalMs !== void 0 ? { intervalMs } : {}
+      ...intervalMs !== void 0 ? { intervalMs } : {},
+      // A refreshable credential (ADR-230) resolves to a per-tick token source; carry it so the daemon wires
+      // it to the poll loop's `refreshCredentials`. Absent for a static credential.
+      ...creds.refreshCredentials ? { refreshCredentials: creds.refreshCredentials } : {}
     }
   };
 }
@@ -21732,7 +21879,7 @@ async function validateConnectorEntry(entry, env = process.env, fetchImpl) {
   if (!dispatch) {
     return { status: "unknown-provider", reason: `unknown provider "${entry.provider}"` };
   }
-  const creds = resolveEntryCredentials(dispatch, entry, env);
+  const creds = resolveEntryCredentials(dispatch, entry, env, fetchImpl);
   if (!creds.ok) {
     if (creds.kind === "unset-env") return { status: "unset-env", reason: creds.reason };
     return { status: "missing-field", reason: creds.reason };
@@ -21745,8 +21892,16 @@ async function validateConnectorEntry(entry, env = process.env, fetchImpl) {
       reason: `options missing required field(s): ${missingOpts.join(", ")}`
     };
   }
+  let credentials = creds.credentials;
+  if (creds.refreshCredentials) {
+    try {
+      credentials = { ...credentials, ...await creds.refreshCredentials() };
+    } catch (err) {
+      return { status: "rejected", reason: err.message };
+    }
+  }
   const result = await dispatch.validate({
-    credentials: creds.credentials,
+    credentials,
     options,
     ...fetchImpl ? { fetchImpl } : {}
   });
@@ -21792,7 +21947,13 @@ async function startConnectorPolling(input) {
       },
       input.graph,
       registration.resolveTarget,
-      { intervalMs: registration.intervalMs, connectorId: registration.id }
+      {
+        intervalMs: registration.intervalMs,
+        connectorId: registration.id,
+        // A refreshable credential (ADR-230) mints a fresh token each tick; the static path leaves this unset
+        // and the loop reuses ctx.credentials, exactly as before.
+        ...registration.refreshCredentials ? { refreshCredentials: registration.refreshCredentials } : {}
+      }
     )
   );
   return () => {
@@ -22859,4 +23020,4 @@ export {
   deprovisionConnector,
   buildApi
 };
-//# sourceMappingURL=chunk-KIV7OB2K.js.map
+//# sourceMappingURL=chunk-NFJ4W5T6.js.map