@neat.is/core 0.9.20-dev.20260922 → 0.9.21-dev.20260923

package/dist/cli.cjs

@@ -6742,9 +6742,30 @@ function withRecoveredCodeAttrs(attrs, locus) {
   if (locus.codeLineno !== void 0) attrs[CODE_LINENO_ATTR] = locus.codeLineno;
   return attrs;
 }
+var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-amz-security-token",
+  "x-csrf-token"
+]);
+function attrHeaderName(key) {
+  const lower = key.toLowerCase();
+  const marker = ".header.";
+  const at = lower.lastIndexOf(marker);
+  return at >= 0 ? lower.slice(at + marker.length) : lower;
+}
+function isSensitiveAttrKey(key) {
+  return SENSITIVE_HEADER_NAMES.has(attrHeaderName(key));
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
+    if (isSensitiveAttrKey(k)) continue;
     if (typeof v === "bigint") out[k] = v.toString();
     else out[k] = v;
   }
@@ -7335,6 +7356,14 @@ async function readErrorFileTail(errorsPath, maxBytes) {
     await handle.close();
   }
 }
+function redactPersistedAttributes(ev) {
+  if (!ev.attributes) return ev;
+  const scrubbed = sanitizeAttributes(ev.attributes);
+  if (Object.keys(scrubbed).length === Object.keys(ev.attributes).length) return ev;
+  if (Object.keys(scrubbed).length > 0) return { ...ev, attributes: scrubbed };
+  const { attributes: _dropped, ...rest } = ev;
+  return rest;
+}
 async function readErrorEvents(errorsPath, opts) {
   let raw;
   try {
@@ -7343,7 +7372,7 @@ async function readErrorEvents(errorsPath, opts) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
-  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => redactPersistedAttributes(JSON.parse(line)));
   const deduped = dedupeIncidents(events);
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
@@ -17323,6 +17352,77 @@ function formatDivergence(d) {
   const conf = d.confidence.toFixed(2);
   return `  [${conf}] ${d.type} ${d.source} \u2192 ${d.target} \u2014 ${d.reason}`;
 }
+var JS_TS_LANGUAGES = /* @__PURE__ */ new Set(["javascript", "typescript"]);
+var COVERAGE_COLUMNS = [
+  { key: "symbols", label: "symbols" },
+  { key: "routes", label: "routes" },
+  { key: "data", label: "data" },
+  { key: "crossServiceCalls", label: "cross-service calls" }
+];
+function isTableInfra(kind) {
+  return kind !== void 0 && /(table|collection)$/.test(kind);
+}
+function computeLanguageCoverage(nodes, edges) {
+  const serviceLang = /* @__PURE__ */ new Map();
+  const fileService = /* @__PURE__ */ new Map();
+  const nodeById = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    nodeById.set(n.id, n);
+    if (n.type === import_types62.NodeType.ServiceNode) serviceLang.set(n.name, n.language);
+    else if (n.type === import_types62.NodeType.FileNode) fileService.set(n.id, n.service);
+  }
+  const cov = /* @__PURE__ */ new Map();
+  const ensure = (lang) => {
+    let c = cov.get(lang);
+    if (!c) {
+      c = { symbols: false, routes: false, data: false, crossServiceCalls: false };
+      cov.set(lang, c);
+    }
+    return c;
+  };
+  for (const lang of serviceLang.values()) ensure(lang);
+  for (const n of nodes) {
+    if (n.type === import_types62.NodeType.SymbolNode) {
+      if (n.discoveredVia === "otel") continue;
+      const lang = serviceLang.get(n.service);
+      if (lang) ensure(lang).symbols = true;
+    } else if (n.type === import_types62.NodeType.RouteNode) {
+      if (n.discoveredVia === "otel") continue;
+      const lang = serviceLang.get(n.service);
+      if (lang) ensure(lang).routes = true;
+    }
+  }
+  for (const e of edges) {
+    if (e.type !== import_types62.EdgeType.CALLS || e.provenance !== import_types62.Provenance.EXTRACTED) continue;
+    const svc = fileService.get(e.source);
+    const lang = svc ? serviceLang.get(svc) : void 0;
+    if (!lang) continue;
+    const target = nodeById.get(e.target);
+    if (!target) continue;
+    if (target.type === import_types62.NodeType.RouteNode) ensure(lang).crossServiceCalls = true;
+    else if (target.type === import_types62.NodeType.InfraNode && isTableInfra(target.kind)) ensure(lang).data = true;
+  }
+  return cov;
+}
+function renderLanguageCoverage(nodes, edges) {
+  const cov = computeLanguageCoverage(nodes, edges);
+  const langs = [...cov.keys()];
+  if (!langs.some((l) => !JS_TS_LANGUAGES.has(l))) return [];
+  const glyph = (on) => on ? ok(sym.ok) : dim("\u2014");
+  const header = ["", ...COVERAGE_COLUMNS.map((c) => c.label)];
+  const rows = [header];
+  for (const lang of [...langs].sort()) {
+    const c = cov.get(lang);
+    rows.push([lang, ...COVERAGE_COLUMNS.map((col) => glyph(c[col.key]))]);
+  }
+  const lines = ["static coverage by language (this scan):"];
+  for (const row of table(rows)) lines.push(`  ${row}`);
+  lines.push(
+    `  ${sym.arrow} cross-service call recognition is JS/TS-only today (#1158); non-JS/TS callers rely on OBSERVED for cross-service topology.`
+  );
+  lines.push("");
+  return lines;
+}
 function renderValueForwardSummary(input) {
   const { graph, divergences, verbose } = input;
   const nodes = [];
@@ -17356,6 +17456,7 @@ function renderValueForwardSummary(input) {
     lines.push("  \u2192 run your services with the generated otel-init to populate OBSERVED edges.");
     lines.push("");
   }
+  for (const line of renderLanguageCoverage(nodes, edges)) lines.push(line);
   lines.push(renderOtelEnvBlock());
   lines.push("");
   if (verbose) {
@@ -19630,6 +19731,10 @@ function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options =
 // src/connectors/registry.ts
 init_cjs_shims();
 
+// src/connectors/gcp-auth.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+
 // src/connectors/junction.ts
 init_cjs_shims();
 var buckets = /* @__PURE__ */ new Map();
@@ -19891,6 +19996,108 @@ async function dbJunction(run, policy) {
   }
 }
 
+// src/connectors/gcp-auth.ts
+var DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+var JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var ASSERTION_LIFETIME_S = 3600;
+var DEFAULT_REFRESH_SKEW_MS = 6e4;
+var GCP_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
+function parseServiceAccountKey(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    throw new Error("gcp service-account key: not valid JSON");
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("gcp service-account key: expected a JSON object");
+  }
+  const obj = raw;
+  const clientEmail = obj["client_email"];
+  const privateKey = obj["private_key"];
+  const projectId = obj["project_id"];
+  if (typeof clientEmail !== "string" || clientEmail.length === 0) {
+    throw new Error("gcp service-account key: missing client_email");
+  }
+  if (typeof privateKey !== "string" || privateKey.length === 0) {
+    throw new Error("gcp service-account key: missing private_key");
+  }
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp service-account key: missing project_id");
+  }
+  const key = { client_email: clientEmail, private_key: privateKey, project_id: projectId };
+  if (typeof obj["token_uri"] === "string" && obj["token_uri"].length > 0) {
+    key.token_uri = obj["token_uri"];
+  }
+  return key;
+}
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function buildServiceAccountAssertion(key, scope, tokenUri, nowMs) {
+  const iat = Math.floor(nowMs / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const claims = {
+    iss: key.client_email,
+    scope,
+    aud: tokenUri,
+    iat,
+    exp: iat + ASSERTION_LIFETIME_S
+  };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const signature = (0, import_node_crypto3.createSign)("RSA-SHA256").update(signingInput).end().sign(key.private_key);
+  return `${signingInput}.${base64url(signature)}`;
+}
+async function mintGcpAccessToken(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const tokenUri = opts.tokenUri ?? key.token_uri ?? DEFAULT_TOKEN_URI;
+  const mintedAtMs = now();
+  const assertion = buildServiceAccountAssertion(key, scope, tokenUri, mintedAtMs);
+  const body = new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }).toString();
+  const res = await junctionFetch(
+    tokenUri,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    },
+    // accountKey: the GCP project id — an identifier, safe to log, the same
+    // per-(provider, accountKey) rate-limit bucket key the GCP connectors use.
+    { provider: "gcp-auth", accountKey: key.project_id, ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`gcp token mint failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  const accessToken = json.access_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp token mint returned no access_token");
+  }
+  const expiresInS = typeof json.expires_in === "number" && json.expires_in > 0 ? json.expires_in : ASSERTION_LIFETIME_S;
+  return { accessToken, expiresAtMs: mintedAtMs + expiresInS * 1e3 };
+}
+function createGcpTokenSource(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const skewMs = opts.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+  let cached = null;
+  let inFlight = null;
+  const fresh = () => cached !== null && now() < cached.expiresAtMs - skewMs;
+  return async () => {
+    if (!fresh()) {
+      if (!inFlight) {
+        inFlight = mintGcpAccessToken(key, scope, opts).then((minted) => {
+          cached = minted;
+          return minted;
+        }).finally(() => {
+          inFlight = null;
+        });
+      }
+      await inFlight;
+    }
+    return { projectId: key.project_id, accessToken: cached.accessToken };
+  };
+}
+
 // src/connectors/supabase/index.ts
 init_cjs_shims();
 
@@ -20757,7 +20964,7 @@ var import_types75 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
 var DEFAULT_EVENT_LIMIT = 1e3;
 async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
@@ -20770,7 +20977,7 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
   const body = {
     // Cloudflare's schema requires an identifier per query even for an
     // ad-hoc, unsaved one — a fresh id per tick, never reused.
-    queryId: `neat-connector-${(0, import_node_crypto3.randomUUID)()}`,
+    queryId: `neat-connector-${(0, import_node_crypto4.randomUUID)()}`,
     timeframe: { from: window.fromMs, to: window.toMs },
     view: "events",
     limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
@@ -22778,7 +22985,8 @@ function getProviderFieldSchema(provider) {
 function knownProviderNames() {
   return [...Object.keys(PROVIDER_DISPATCH), ...Object.keys(PUSH_PROVIDER_DISPATCH)].sort();
 }
-function resolveEntryCredentials(dispatch, entry2, env) {
+var GCP_SERVICE_ACCOUNT_PROVIDERS = /* @__PURE__ */ new Set(["cloud-run", "gcp-lb", "firebase"]);
+function resolveEntryCredentials(dispatch, entry2, env, fetchImpl) {
   let credentials;
   try {
     const resolved = resolveCredential(entry2.credential, env);
@@ -22787,6 +22995,15 @@ function resolveEntryCredentials(dispatch, entry2, env) {
     if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
     return { ok: false, kind: "error", reason: err.message };
   }
+  if (GCP_SERVICE_ACCOUNT_PROVIDERS.has(entry2.provider) && typeof credentials.serviceAccountKey === "string" && credentials.serviceAccountKey.length > 0) {
+    try {
+      const key = parseServiceAccountKey(credentials.serviceAccountKey);
+      const source = createGcpTokenSource(key, GCP_LOGGING_READ_SCOPE, fetchImpl ? { fetchImpl } : {});
+      return { ok: true, credentials: { projectId: key.project_id }, refreshCredentials: source };
+    } catch (err) {
+      return { ok: false, kind: "error", reason: err.message };
+    }
+  }
   const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
   if (missingCreds.length > 0) {
     return {
@@ -22836,7 +23053,10 @@ function buildRegistration(entry2, graph, env = process.env) {
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
-      ...intervalMs !== void 0 ? { intervalMs } : {}
+      ...intervalMs !== void 0 ? { intervalMs } : {},
+      // A refreshable credential (ADR-230) resolves to a per-tick token source; carry it so the daemon wires
+      // it to the poll loop's `refreshCredentials`. Absent for a static credential.
+      ...creds.refreshCredentials ? { refreshCredentials: creds.refreshCredentials } : {}
     }
   };
 }
@@ -22845,7 +23065,7 @@ async function validateConnectorEntry(entry2, env = process.env, fetchImpl) {
   if (!dispatch) {
     return { status: "unknown-provider", reason: `unknown provider "${entry2.provider}"` };
   }
-  const creds = resolveEntryCredentials(dispatch, entry2, env);
+  const creds = resolveEntryCredentials(dispatch, entry2, env, fetchImpl);
   if (!creds.ok) {
     if (creds.kind === "unset-env") return { status: "unset-env", reason: creds.reason };
     return { status: "missing-field", reason: creds.reason };
@@ -22858,8 +23078,16 @@ async function validateConnectorEntry(entry2, env = process.env, fetchImpl) {
       reason: `options missing required field(s): ${missingOpts.join(", ")}`
     };
   }
+  let credentials = creds.credentials;
+  if (creds.refreshCredentials) {
+    try {
+      credentials = { ...credentials, ...await creds.refreshCredentials() };
+    } catch (err) {
+      return { status: "rejected", reason: err.message };
+    }
+  }
   const result = await dispatch.validate({
-    credentials: creds.credentials,
+    credentials,
     options,
     ...fetchImpl ? { fetchImpl } : {}
   });
@@ -22905,7 +23133,13 @@ async function startConnectorPolling(input) {
       },
       input.graph,
       registration.resolveTarget,
-      { intervalMs: registration.intervalMs, connectorId: registration.id }
+      {
+        intervalMs: registration.intervalMs,
+        connectorId: registration.id,
+        // A refreshable credential (ADR-230) mints a fresh token each tick; the static path leaves this unset
+        // and the loop reuses ctx.credentials, exactly as before.
+        ...registration.refreshCredentials ? { refreshCredentials: registration.refreshCredentials } : {}
+      }
     )
   );
   return () => {
@@ -24392,6 +24626,9 @@ init_otel();
 // src/connectors/hosted.ts
 init_cjs_shims();
 
+// src/connectors/railway/target-ref.ts
+init_cjs_shims();
+
 // src/connectors/hosted-repos.ts
 init_cjs_shims();
 var import_node_os6 = __toESM(require("os"), 1);
@@ -24499,7 +24736,7 @@ init_otel_grpc();
 init_cjs_shims();
 var import_node_fs44 = require("fs");
 var import_node_path81 = __toESM(require("path"), 1);
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var DEFAULT_LIMIT = 10;
 var NOMIC_DIM = 768;
 var MINI_LM_DIM = 384;
@@ -24563,7 +24800,7 @@ function embedText(node) {
   return parts.join(" ");
 }
 function attrsHash(node) {
-  return (0, import_node_crypto4.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
+  return (0, import_node_crypto5.createHash)("sha1").update(embedText(node)).digest("hex").slice(0, 16);
 }
 function cosine(a, b) {
   if (a.length !== b.length) return 0;
@@ -25290,9 +25527,9 @@ init_cjs_shims();
 var import_node_fs46 = require("fs");
 var import_node_path83 = __toESM(require("path"), 1);
 var import_node_child_process2 = require("child_process");
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 function generateToken() {
-  return (0, import_node_crypto5.randomBytes)(32).toString("base64url");
+  return (0, import_node_crypto6.randomBytes)(32).toString("base64url");
 }
 async function probeBinary(binary, arg) {
   return new Promise((resolve) => {
@@ -29448,7 +29685,7 @@ var import_node_child_process5 = require("child_process");
 init_cjs_shims();
 var import_node_http2 = require("http");
 var import_node_child_process4 = require("child_process");
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 
 // src/profiles.ts
 init_cjs_shims();
@@ -29755,7 +29992,7 @@ async function loopbackReceiveToken(webUrl, deps, opts = {}) {
   const out = deps.out ?? (() => {
   });
   const openFn = deps.openBrowser ?? defaultOpenBrowser;
-  const state = (0, import_node_crypto6.randomBytes)(16).toString("hex");
+  const state = (0, import_node_crypto7.randomBytes)(16).toString("hex");
   return new Promise((resolve) => {
     let settled = false;
     let timer;
@@ -32092,6 +32329,15 @@ function formatDivergenceLine2(d) {
       const at = d.location ? ` at ${d.location}` : "";
       return `\u26A0 divergence [observed-failing] ${d.source}${at} declares a call observed failing (${d.failureKind})`;
     }
+    case "deploy-mismatch":
+      if (d.kind === "image") {
+        return `\u26A0 divergence [deploy-mismatch] ${d.source} declares image ${d.declaredImage ?? "unknown"}, running ${d.observedImage ?? "unknown"}`;
+      }
+      return `\u26A0 divergence [deploy-mismatch] ${d.source} declares ${d.declaredReplicas ?? "unknown"} replicas, ${d.observedReplicas ?? "unknown"} ready`;
+    default: {
+      const other = d;
+      return `\u26A0 divergence [${other.type}] ${other.source} \u2192 ${other.target}`;
+    }
   }
 }
 function formatStaleLine(edgeId) {