@neat.is/core 0.9.20-dev.20260922 → 0.9.20

package/dist/neatd.js

@@ -2,11 +2,11 @@
 import {
   reconcileDaemonRecordSync,
   startDaemon
-} from "./chunk-F7I3G4KC.js";
+} from "./chunk-SK2FEJKB.js";
 import {
   listProjects,
   registryPath
-} from "./chunk-KIV7OB2K.js";
+} from "./chunk-NFJ4W5T6.js";
 import {
   BindAuthorityError,
   __require

package/dist/server.cjs

@@ -5704,9 +5704,30 @@ function withRecoveredCodeAttrs(attrs, locus) {
   if (locus.codeLineno !== void 0) attrs[CODE_LINENO_ATTR] = locus.codeLineno;
   return attrs;
 }
+var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-amz-security-token",
+  "x-csrf-token"
+]);
+function attrHeaderName(key) {
+  const lower = key.toLowerCase();
+  const marker = ".header.";
+  const at = lower.lastIndexOf(marker);
+  return at >= 0 ? lower.slice(at + marker.length) : lower;
+}
+function isSensitiveAttrKey(key) {
+  return SENSITIVE_HEADER_NAMES.has(attrHeaderName(key));
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
+    if (isSensitiveAttrKey(k)) continue;
     if (typeof v === "bigint") out[k] = v.toString();
     else out[k] = v;
   }
@@ -6262,6 +6283,14 @@ async function readErrorFileTail(errorsPath, maxBytes) {
     await handle.close();
   }
 }
+function redactPersistedAttributes(ev) {
+  if (!ev.attributes) return ev;
+  const scrubbed = sanitizeAttributes(ev.attributes);
+  if (Object.keys(scrubbed).length === Object.keys(ev.attributes).length) return ev;
+  if (Object.keys(scrubbed).length > 0) return { ...ev, attributes: scrubbed };
+  const { attributes: _dropped, ...rest } = ev;
+  return rest;
+}
 async function readErrorEvents(errorsPath, opts) {
   let raw;
   try {
@@ -6270,7 +6299,7 @@ async function readErrorEvents(errorsPath, opts) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
-  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => redactPersistedAttributes(JSON.parse(line)));
   const deduped = dedupeIncidents(events);
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
@@ -18756,6 +18785,10 @@ async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
 // src/connectors/registry.ts
 init_cjs_shims();
 
+// src/connectors/gcp-auth.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+
 // src/connectors/junction.ts
 init_cjs_shims();
 var buckets = /* @__PURE__ */ new Map();
@@ -19017,6 +19050,108 @@ async function dbJunction(run, policy) {
   }
 }
 
+// src/connectors/gcp-auth.ts
+var DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+var JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var ASSERTION_LIFETIME_S = 3600;
+var DEFAULT_REFRESH_SKEW_MS = 6e4;
+var GCP_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
+function parseServiceAccountKey(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    throw new Error("gcp service-account key: not valid JSON");
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("gcp service-account key: expected a JSON object");
+  }
+  const obj = raw;
+  const clientEmail = obj["client_email"];
+  const privateKey = obj["private_key"];
+  const projectId = obj["project_id"];
+  if (typeof clientEmail !== "string" || clientEmail.length === 0) {
+    throw new Error("gcp service-account key: missing client_email");
+  }
+  if (typeof privateKey !== "string" || privateKey.length === 0) {
+    throw new Error("gcp service-account key: missing private_key");
+  }
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp service-account key: missing project_id");
+  }
+  const key = { client_email: clientEmail, private_key: privateKey, project_id: projectId };
+  if (typeof obj["token_uri"] === "string" && obj["token_uri"].length > 0) {
+    key.token_uri = obj["token_uri"];
+  }
+  return key;
+}
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function buildServiceAccountAssertion(key, scope, tokenUri, nowMs) {
+  const iat = Math.floor(nowMs / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const claims = {
+    iss: key.client_email,
+    scope,
+    aud: tokenUri,
+    iat,
+    exp: iat + ASSERTION_LIFETIME_S
+  };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const signature = (0, import_node_crypto3.createSign)("RSA-SHA256").update(signingInput).end().sign(key.private_key);
+  return `${signingInput}.${base64url(signature)}`;
+}
+async function mintGcpAccessToken(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const tokenUri = opts.tokenUri ?? key.token_uri ?? DEFAULT_TOKEN_URI;
+  const mintedAtMs = now();
+  const assertion = buildServiceAccountAssertion(key, scope, tokenUri, mintedAtMs);
+  const body = new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }).toString();
+  const res = await junctionFetch(
+    tokenUri,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    },
+    // accountKey: the GCP project id — an identifier, safe to log, the same
+    // per-(provider, accountKey) rate-limit bucket key the GCP connectors use.
+    { provider: "gcp-auth", accountKey: key.project_id, ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`gcp token mint failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  const accessToken = json.access_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp token mint returned no access_token");
+  }
+  const expiresInS = typeof json.expires_in === "number" && json.expires_in > 0 ? json.expires_in : ASSERTION_LIFETIME_S;
+  return { accessToken, expiresAtMs: mintedAtMs + expiresInS * 1e3 };
+}
+function createGcpTokenSource(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const skewMs = opts.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+  let cached = null;
+  let inFlight = null;
+  const fresh = () => cached !== null && now() < cached.expiresAtMs - skewMs;
+  return async () => {
+    if (!fresh()) {
+      if (!inFlight) {
+        inFlight = mintGcpAccessToken(key, scope, opts).then((minted) => {
+          cached = minted;
+          return minted;
+        }).finally(() => {
+          inFlight = null;
+        });
+      }
+      await inFlight;
+    }
+    return { projectId: key.project_id, accessToken: cached.accessToken };
+  };
+}
+
 // src/connectors/supabase/index.ts
 init_cjs_shims();
 
@@ -19883,7 +20018,7 @@ var import_types73 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
 var DEFAULT_EVENT_LIMIT = 1e3;
 async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
@@ -19896,7 +20031,7 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
   const body = {
     // Cloudflare's schema requires an identifier per query even for an
     // ad-hoc, unsaved one — a fresh id per tick, never reused.
-    queryId: `neat-connector-${(0, import_node_crypto3.randomUUID)()}`,
+    queryId: `neat-connector-${(0, import_node_crypto4.randomUUID)()}`,
     timeframe: { from: window.fromMs, to: window.toMs },
     view: "events",
     limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
@@ -21898,7 +22033,8 @@ var PUSH_PROVIDER_DISPATCH = {
 function isPushProvider(provider) {
   return provider in PUSH_PROVIDER_DISPATCH;
 }
-function resolveEntryCredentials(dispatch, entry, env) {
+var GCP_SERVICE_ACCOUNT_PROVIDERS = /* @__PURE__ */ new Set(["cloud-run", "gcp-lb", "firebase"]);
+function resolveEntryCredentials(dispatch, entry, env, fetchImpl) {
   let credentials;
   try {
     const resolved = resolveCredential(entry.credential, env);
@@ -21907,6 +22043,15 @@ function resolveEntryCredentials(dispatch, entry, env) {
     if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
     return { ok: false, kind: "error", reason: err.message };
   }
+  if (GCP_SERVICE_ACCOUNT_PROVIDERS.has(entry.provider) && typeof credentials.serviceAccountKey === "string" && credentials.serviceAccountKey.length > 0) {
+    try {
+      const key = parseServiceAccountKey(credentials.serviceAccountKey);
+      const source = createGcpTokenSource(key, GCP_LOGGING_READ_SCOPE, fetchImpl ? { fetchImpl } : {});
+      return { ok: true, credentials: { projectId: key.project_id }, refreshCredentials: source };
+    } catch (err) {
+      return { ok: false, kind: "error", reason: err.message };
+    }
+  }
   const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
   if (missingCreds.length > 0) {
     return {
@@ -21956,7 +22101,10 @@ function buildRegistration(entry, graph, env = process.env) {
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
-      ...intervalMs !== void 0 ? { intervalMs } : {}
+      ...intervalMs !== void 0 ? { intervalMs } : {},
+      // A refreshable credential (ADR-230) resolves to a per-tick token source; carry it so the daemon wires
+      // it to the poll loop's `refreshCredentials`. Absent for a static credential.
+      ...creds.refreshCredentials ? { refreshCredentials: creds.refreshCredentials } : {}
     }
   };
 }
@@ -22884,7 +23032,7 @@ init_otel_grpc();
 init_cjs_shims();
 var import_node_fs39 = require("fs");
 var import_node_path75 = __toESM(require("path"), 1);
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
 var MINI_LM_DIM = 384;
@@ -22948,7 +23096,7 @@ function embedText(node) {
   return parts.join(" ");
 }
 function attrsHash(node) {
-  return (0, import_node_crypto4.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto5.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
 }
 function cosine(a, b) {
   if (a.length !== b.length) return 0;