@neat.is/core 0.9.20-dev.20260922 → 0.9.20

package/dist/index.d.cts

@@ -188,6 +188,15 @@ interface ObservedSignal {
         readyReplicas?: number;
     };
 }
+/**
+ * A per-tick credential source (docs/contracts/connector-config.md §9, ADR-230) — the shape the poll loop's
+ * `refreshCredentials` seam (index.ts) already consumes for the hosted profile. A credential that mints a
+ * short-lived token (a GCP service-account key → a ~1h Google access token) resolves to one of these instead
+ * of a fixed value: the loop calls it each tick to get that tick's credentials, and the source caches and
+ * re-mints behind its own expiry logic. `poll()` is unchanged — the connector still receives an opaque,
+ * already-minted `credentials` record and performs no auth handshake of its own (connectors.md §3).
+ */
+type CredentialSource = () => Promise<Record<string, unknown>>;
 
 /**
  * What a provider's target-resolution step hands back for one signal. The
@@ -250,6 +259,7 @@ interface ConnectorRegistration {
     credentials: Record<string, unknown>;
     resolveTarget: ResolveConnectorTarget;
     intervalMs?: number;
+    refreshCredentials?: CredentialSource;
 }
 
 interface BuildApiOptions {

package/dist/index.d.ts

@@ -188,6 +188,15 @@ interface ObservedSignal {
         readyReplicas?: number;
     };
 }
+/**
+ * A per-tick credential source (docs/contracts/connector-config.md §9, ADR-230) — the shape the poll loop's
+ * `refreshCredentials` seam (index.ts) already consumes for the hosted profile. A credential that mints a
+ * short-lived token (a GCP service-account key → a ~1h Google access token) resolves to one of these instead
+ * of a fixed value: the loop calls it each tick to get that tick's credentials, and the source caches and
+ * re-mints behind its own expiry logic. `poll()` is unchanged — the connector still receives an opaque,
+ * already-minted `credentials` record and performs no auth handshake of its own (connectors.md §3).
+ */
+type CredentialSource = () => Promise<Record<string, unknown>>;
 
 /**
  * What a provider's target-resolution step hands back for one signal. The
@@ -250,6 +259,7 @@ interface ConnectorRegistration {
     credentials: Record<string, unknown>;
     resolveTarget: ResolveConnectorTarget;
     intervalMs?: number;
+    refreshCredentials?: CredentialSource;
 }
 
 interface BuildApiOptions {

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   routeSpanToProject,
   startDaemon
-} from "./chunk-F7I3G4KC.js";
+} from "./chunk-SK2FEJKB.js";
 import {
   ProjectNameCollisionError,
   addProject,
@@ -37,7 +37,7 @@ import {
   thresholdForEdgeType,
   touchLastSeen,
   writeAtomically
-} from "./chunk-KIV7OB2K.js";
+} from "./chunk-NFJ4W5T6.js";
 import {
   startOtelGrpcReceiver
 } from "./chunk-ERE47MCR.js";

package/dist/neatd.cjs

@@ -6577,9 +6577,30 @@ function withRecoveredCodeAttrs(attrs, locus) {
   if (locus.codeLineno !== void 0) attrs[CODE_LINENO_ATTR] = locus.codeLineno;
   return attrs;
 }
+var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-amz-security-token",
+  "x-csrf-token"
+]);
+function attrHeaderName(key) {
+  const lower = key.toLowerCase();
+  const marker = ".header.";
+  const at = lower.lastIndexOf(marker);
+  return at >= 0 ? lower.slice(at + marker.length) : lower;
+}
+function isSensitiveAttrKey(key) {
+  return SENSITIVE_HEADER_NAMES.has(attrHeaderName(key));
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
+    if (isSensitiveAttrKey(k)) continue;
     if (typeof v === "bigint") out[k] = v.toString();
     else out[k] = v;
   }
@@ -7167,6 +7188,14 @@ async function readErrorFileTail(errorsPath, maxBytes) {
     await handle.close();
   }
 }
+function redactPersistedAttributes(ev) {
+  if (!ev.attributes) return ev;
+  const scrubbed = sanitizeAttributes(ev.attributes);
+  if (Object.keys(scrubbed).length === Object.keys(ev.attributes).length) return ev;
+  if (Object.keys(scrubbed).length > 0) return { ...ev, attributes: scrubbed };
+  const { attributes: _dropped, ...rest } = ev;
+  return rest;
+}
 async function readErrorEvents(errorsPath, opts) {
   let raw;
   try {
@@ -7175,7 +7204,7 @@ async function readErrorEvents(errorsPath, opts) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
-  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => redactPersistedAttributes(JSON.parse(line)));
   const deduped = dedupeIncidents(events);
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
@@ -19097,6 +19126,10 @@ function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options =
 // src/connectors/registry.ts
 init_cjs_shims();
 
+// src/connectors/gcp-auth.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+
 // src/connectors/junction.ts
 init_cjs_shims();
 var buckets = /* @__PURE__ */ new Map();
@@ -19358,6 +19391,108 @@ async function dbJunction(run, policy) {
   }
 }
 
+// src/connectors/gcp-auth.ts
+var DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+var JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var ASSERTION_LIFETIME_S = 3600;
+var DEFAULT_REFRESH_SKEW_MS = 6e4;
+var GCP_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
+function parseServiceAccountKey(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    throw new Error("gcp service-account key: not valid JSON");
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("gcp service-account key: expected a JSON object");
+  }
+  const obj = raw;
+  const clientEmail = obj["client_email"];
+  const privateKey = obj["private_key"];
+  const projectId = obj["project_id"];
+  if (typeof clientEmail !== "string" || clientEmail.length === 0) {
+    throw new Error("gcp service-account key: missing client_email");
+  }
+  if (typeof privateKey !== "string" || privateKey.length === 0) {
+    throw new Error("gcp service-account key: missing private_key");
+  }
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp service-account key: missing project_id");
+  }
+  const key = { client_email: clientEmail, private_key: privateKey, project_id: projectId };
+  if (typeof obj["token_uri"] === "string" && obj["token_uri"].length > 0) {
+    key.token_uri = obj["token_uri"];
+  }
+  return key;
+}
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function buildServiceAccountAssertion(key, scope, tokenUri, nowMs) {
+  const iat = Math.floor(nowMs / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const claims = {
+    iss: key.client_email,
+    scope,
+    aud: tokenUri,
+    iat,
+    exp: iat + ASSERTION_LIFETIME_S
+  };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const signature = (0, import_node_crypto3.createSign)("RSA-SHA256").update(signingInput).end().sign(key.private_key);
+  return `${signingInput}.${base64url(signature)}`;
+}
+async function mintGcpAccessToken(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const tokenUri = opts.tokenUri ?? key.token_uri ?? DEFAULT_TOKEN_URI;
+  const mintedAtMs = now();
+  const assertion = buildServiceAccountAssertion(key, scope, tokenUri, mintedAtMs);
+  const body = new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }).toString();
+  const res = await junctionFetch(
+    tokenUri,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    },
+    // accountKey: the GCP project id — an identifier, safe to log, the same
+    // per-(provider, accountKey) rate-limit bucket key the GCP connectors use.
+    { provider: "gcp-auth", accountKey: key.project_id, ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`gcp token mint failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  const accessToken = json.access_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp token mint returned no access_token");
+  }
+  const expiresInS = typeof json.expires_in === "number" && json.expires_in > 0 ? json.expires_in : ASSERTION_LIFETIME_S;
+  return { accessToken, expiresAtMs: mintedAtMs + expiresInS * 1e3 };
+}
+function createGcpTokenSource(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const skewMs = opts.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+  let cached = null;
+  let inFlight = null;
+  const fresh = () => cached !== null && now() < cached.expiresAtMs - skewMs;
+  return async () => {
+    if (!fresh()) {
+      if (!inFlight) {
+        inFlight = mintGcpAccessToken(key, scope, opts).then((minted) => {
+          cached = minted;
+          return minted;
+        }).finally(() => {
+          inFlight = null;
+        });
+      }
+      await inFlight;
+    }
+    return { projectId: key.project_id, accessToken: cached.accessToken };
+  };
+}
+
 // src/connectors/supabase/index.ts
 init_cjs_shims();
 
@@ -20224,7 +20359,7 @@ var import_types73 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
 var DEFAULT_EVENT_LIMIT = 1e3;
 async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
@@ -20237,7 +20372,7 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
   const body = {
     // Cloudflare's schema requires an identifier per query even for an
     // ad-hoc, unsaved one — a fresh id per tick, never reused.
-    queryId: `neat-connector-${(0, import_node_crypto3.randomUUID)()}`,
+    queryId: `neat-connector-${(0, import_node_crypto4.randomUUID)()}`,
     timeframe: { from: window.fromMs, to: window.toMs },
     view: "events",
     limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
@@ -22239,7 +22374,8 @@ var PUSH_PROVIDER_DISPATCH = {
 function isPushProvider(provider) {
   return provider in PUSH_PROVIDER_DISPATCH;
 }
-function resolveEntryCredentials(dispatch, entry2, env) {
+var GCP_SERVICE_ACCOUNT_PROVIDERS = /* @__PURE__ */ new Set(["cloud-run", "gcp-lb", "firebase"]);
+function resolveEntryCredentials(dispatch, entry2, env, fetchImpl) {
   let credentials;
   try {
     const resolved = resolveCredential(entry2.credential, env);
@@ -22248,6 +22384,15 @@ function resolveEntryCredentials(dispatch, entry2, env) {
     if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
     return { ok: false, kind: "error", reason: err.message };
   }
+  if (GCP_SERVICE_ACCOUNT_PROVIDERS.has(entry2.provider) && typeof credentials.serviceAccountKey === "string" && credentials.serviceAccountKey.length > 0) {
+    try {
+      const key = parseServiceAccountKey(credentials.serviceAccountKey);
+      const source = createGcpTokenSource(key, GCP_LOGGING_READ_SCOPE, fetchImpl ? { fetchImpl } : {});
+      return { ok: true, credentials: { projectId: key.project_id }, refreshCredentials: source };
+    } catch (err) {
+      return { ok: false, kind: "error", reason: err.message };
+    }
+  }
   const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
   if (missingCreds.length > 0) {
     return {
@@ -22297,7 +22442,10 @@ function buildRegistration(entry2, graph, env = process.env) {
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
-      ...intervalMs !== void 0 ? { intervalMs } : {}
+      ...intervalMs !== void 0 ? { intervalMs } : {},
+      // A refreshable credential (ADR-230) resolves to a per-tick token source; carry it so the daemon wires
+      // it to the poll loop's `refreshCredentials`. Absent for a static credential.
+      ...creds.refreshCredentials ? { refreshCredentials: creds.refreshCredentials } : {}
     }
   };
 }
@@ -22341,7 +22489,13 @@ async function startConnectorPolling(input) {
       },
       input.graph,
       registration.resolveTarget,
-      { intervalMs: registration.intervalMs, connectorId: registration.id }
+      {
+        intervalMs: registration.intervalMs,
+        connectorId: registration.id,
+        // A refreshable credential (ADR-230) mints a fresh token each tick; the static path leaves this unset
+        // and the loop reuses ctx.credentials, exactly as before.
+        ...registration.refreshCredentials ? { refreshCredentials: registration.refreshCredentials } : {}
+      }
     )
   );
   return () => {
@@ -23299,6 +23453,37 @@ async function reconcileFrontierSurfaces(graph, errorsPath) {
 
 // src/connectors/hosted.ts
 init_cjs_shims();
+
+// src/connectors/railway/target-ref.ts
+init_cjs_shims();
+function nonEmptyString(v) {
+  return typeof v === "string" && v.length > 0;
+}
+function decodeRailwayTargetRef(ref) {
+  if (typeof ref !== "string" || ref.length === 0) return null;
+  let json;
+  try {
+    json = Buffer.from(ref, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  if (!nonEmptyString(obj.environmentId) || !nonEmptyString(obj.serviceId)) return null;
+  return {
+    environmentId: obj.environmentId,
+    serviceId: obj.serviceId,
+    ...nonEmptyString(obj.serviceName) ? { serviceName: obj.serviceName } : {}
+  };
+}
+
+// src/connectors/hosted.ts
 var CREDENTIAL_REFRESH_SKEW_MS = 6e4;
 var CP_REQUEST_TIMEOUT_MS = 1e4;
 async function cpGet(path81, deps) {
@@ -23325,6 +23510,15 @@ function hostedOptions(provider, summary, serviceName) {
       if (!ref) return null;
       return { apiProjectRef: ref, nodeRef: `${ref}.supabase.co`, serviceName };
     }
+    case "railway": {
+      const target = summary.projectRef ? decodeRailwayTargetRef(summary.projectRef) : null;
+      if (!target) return null;
+      return {
+        environmentId: target.environmentId,
+        serviceId: target.serviceId,
+        serviceNameById: { [target.serviceId]: serviceName }
+      };
+    }
     default:
       return null;
   }