@neat.is/core 0.9.20-dev.20260922 → 0.9.21-dev.20260923

package/dist/index.cjs

@@ -6614,9 +6614,30 @@ function withRecoveredCodeAttrs(attrs, locus) {
   if (locus.codeLineno !== void 0) attrs[CODE_LINENO_ATTR] = locus.codeLineno;
   return attrs;
 }
+var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-amz-security-token",
+  "x-csrf-token"
+]);
+function attrHeaderName(key) {
+  const lower = key.toLowerCase();
+  const marker = ".header.";
+  const at = lower.lastIndexOf(marker);
+  return at >= 0 ? lower.slice(at + marker.length) : lower;
+}
+function isSensitiveAttrKey(key) {
+  return SENSITIVE_HEADER_NAMES.has(attrHeaderName(key));
+}
 function sanitizeAttributes(attrs) {
   const out = {};
   for (const [k, v] of Object.entries(attrs)) {
+    if (isSensitiveAttrKey(k)) continue;
     if (typeof v === "bigint") out[k] = v.toString();
     else out[k] = v;
   }
@@ -7207,6 +7228,14 @@ async function readErrorFileTail(errorsPath, maxBytes) {
     await handle.close();
   }
 }
+function redactPersistedAttributes(ev) {
+  if (!ev.attributes) return ev;
+  const scrubbed = sanitizeAttributes(ev.attributes);
+  if (Object.keys(scrubbed).length === Object.keys(ev.attributes).length) return ev;
+  if (Object.keys(scrubbed).length > 0) return { ...ev, attributes: scrubbed };
+  const { attributes: _dropped, ...rest } = ev;
+  return rest;
+}
 async function readErrorEvents(errorsPath, opts) {
   let raw;
   try {
@@ -7215,7 +7244,7 @@ async function readErrorEvents(errorsPath, opts) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
-  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+  const events = raw.split("\n").filter((line) => line.length > 0).map((line) => redactPersistedAttributes(JSON.parse(line)));
   const deduped = dedupeIncidents(events);
   const cap = opts?.limit !== void 0 && opts.limit > 0 ? Math.min(opts.limit, INCIDENT_READ_MAX_EVENTS) : INCIDENT_READ_MAX_EVENTS;
   return deduped.length > cap ? deduped.slice(deduped.length - cap) : deduped;
@@ -19195,6 +19224,10 @@ function startConnectorPollLoop(connector, ctx, graph, resolveTarget, options =
 // src/connectors/registry.ts
 init_cjs_shims();
 
+// src/connectors/gcp-auth.ts
+init_cjs_shims();
+var import_node_crypto3 = require("crypto");
+
 // src/connectors/junction.ts
 init_cjs_shims();
 var buckets = /* @__PURE__ */ new Map();
@@ -19456,6 +19489,108 @@ async function dbJunction(run, policy) {
   }
 }
 
+// src/connectors/gcp-auth.ts
+var DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token";
+var JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var ASSERTION_LIFETIME_S = 3600;
+var DEFAULT_REFRESH_SKEW_MS = 6e4;
+var GCP_LOGGING_READ_SCOPE = "https://www.googleapis.com/auth/logging.read";
+function parseServiceAccountKey(json) {
+  let raw;
+  try {
+    raw = JSON.parse(json);
+  } catch {
+    throw new Error("gcp service-account key: not valid JSON");
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("gcp service-account key: expected a JSON object");
+  }
+  const obj = raw;
+  const clientEmail = obj["client_email"];
+  const privateKey = obj["private_key"];
+  const projectId = obj["project_id"];
+  if (typeof clientEmail !== "string" || clientEmail.length === 0) {
+    throw new Error("gcp service-account key: missing client_email");
+  }
+  if (typeof privateKey !== "string" || privateKey.length === 0) {
+    throw new Error("gcp service-account key: missing private_key");
+  }
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp service-account key: missing project_id");
+  }
+  const key = { client_email: clientEmail, private_key: privateKey, project_id: projectId };
+  if (typeof obj["token_uri"] === "string" && obj["token_uri"].length > 0) {
+    key.token_uri = obj["token_uri"];
+  }
+  return key;
+}
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function buildServiceAccountAssertion(key, scope, tokenUri, nowMs) {
+  const iat = Math.floor(nowMs / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const claims = {
+    iss: key.client_email,
+    scope,
+    aud: tokenUri,
+    iat,
+    exp: iat + ASSERTION_LIFETIME_S
+  };
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+  const signature = (0, import_node_crypto3.createSign)("RSA-SHA256").update(signingInput).end().sign(key.private_key);
+  return `${signingInput}.${base64url(signature)}`;
+}
+async function mintGcpAccessToken(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const tokenUri = opts.tokenUri ?? key.token_uri ?? DEFAULT_TOKEN_URI;
+  const mintedAtMs = now();
+  const assertion = buildServiceAccountAssertion(key, scope, tokenUri, mintedAtMs);
+  const body = new URLSearchParams({ grant_type: JWT_BEARER_GRANT, assertion }).toString();
+  const res = await junctionFetch(
+    tokenUri,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    },
+    // accountKey: the GCP project id — an identifier, safe to log, the same
+    // per-(provider, accountKey) rate-limit bucket key the GCP connectors use.
+    { provider: "gcp-auth", accountKey: key.project_id, ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {} }
+  );
+  if (!res.ok) {
+    throw new Error(`gcp token mint failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  const accessToken = json.access_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp token mint returned no access_token");
+  }
+  const expiresInS = typeof json.expires_in === "number" && json.expires_in > 0 ? json.expires_in : ASSERTION_LIFETIME_S;
+  return { accessToken, expiresAtMs: mintedAtMs + expiresInS * 1e3 };
+}
+function createGcpTokenSource(key, scope, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const skewMs = opts.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+  let cached = null;
+  let inFlight = null;
+  const fresh = () => cached !== null && now() < cached.expiresAtMs - skewMs;
+  return async () => {
+    if (!fresh()) {
+      if (!inFlight) {
+        inFlight = mintGcpAccessToken(key, scope, opts).then((minted) => {
+          cached = minted;
+          return minted;
+        }).finally(() => {
+          inFlight = null;
+        });
+      }
+      await inFlight;
+    }
+    return { projectId: key.project_id, accessToken: cached.accessToken };
+  };
+}
+
 // src/connectors/supabase/index.ts
 init_cjs_shims();
 
@@ -20322,7 +20457,7 @@ var import_types73 = require("@neat.is/types");
 
 // src/connectors/cloudflare/client.ts
 init_cjs_shims();
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
 var DEFAULT_EVENT_LIMIT = 1e3;
 async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
@@ -20335,7 +20470,7 @@ async function queryWorkerInvocations(ctx, config, window, fetchImpl = fetch) {
   const body = {
     // Cloudflare's schema requires an identifier per query even for an
     // ad-hoc, unsaved one — a fresh id per tick, never reused.
-    queryId: `neat-connector-${(0, import_node_crypto3.randomUUID)()}`,
+    queryId: `neat-connector-${(0, import_node_crypto4.randomUUID)()}`,
     timeframe: { from: window.fromMs, to: window.toMs },
     view: "events",
     limit: config.eventLimit ?? DEFAULT_EVENT_LIMIT,
@@ -22337,7 +22472,8 @@ var PUSH_PROVIDER_DISPATCH = {
 function isPushProvider(provider) {
   return provider in PUSH_PROVIDER_DISPATCH;
 }
-function resolveEntryCredentials(dispatch, entry, env) {
+var GCP_SERVICE_ACCOUNT_PROVIDERS = /* @__PURE__ */ new Set(["cloud-run", "gcp-lb", "firebase"]);
+function resolveEntryCredentials(dispatch, entry, env, fetchImpl) {
   let credentials;
   try {
     const resolved = resolveCredential(entry.credential, env);
@@ -22346,6 +22482,15 @@ function resolveEntryCredentials(dispatch, entry, env) {
     if (err instanceof EnvRefUnsetError) return { ok: false, kind: "unset-env", reason: err.message };
     return { ok: false, kind: "error", reason: err.message };
   }
+  if (GCP_SERVICE_ACCOUNT_PROVIDERS.has(entry.provider) && typeof credentials.serviceAccountKey === "string" && credentials.serviceAccountKey.length > 0) {
+    try {
+      const key = parseServiceAccountKey(credentials.serviceAccountKey);
+      const source = createGcpTokenSource(key, GCP_LOGGING_READ_SCOPE, fetchImpl ? { fetchImpl } : {});
+      return { ok: true, credentials: { projectId: key.project_id }, refreshCredentials: source };
+    } catch (err) {
+      return { ok: false, kind: "error", reason: err.message };
+    }
+  }
   const missingCreds = dispatch.requiredCredentialFields.filter((k) => !credentials[k]);
   if (missingCreds.length > 0) {
     return {
@@ -22395,7 +22540,10 @@ function buildRegistration(entry, graph, env = process.env) {
       connector: built.connector,
       credentials,
       resolveTarget: built.resolveTarget,
-      ...intervalMs !== void 0 ? { intervalMs } : {}
+      ...intervalMs !== void 0 ? { intervalMs } : {},
+      // A refreshable credential (ADR-230) resolves to a per-tick token source; carry it so the daemon wires
+      // it to the poll loop's `refreshCredentials`. Absent for a static credential.
+      ...creds.refreshCredentials ? { refreshCredentials: creds.refreshCredentials } : {}
     }
   };
 }
@@ -22439,7 +22587,13 @@ async function startConnectorPolling(input) {
       },
       input.graph,
       registration.resolveTarget,
-      { intervalMs: registration.intervalMs, connectorId: registration.id }
+      {
+        intervalMs: registration.intervalMs,
+        connectorId: registration.id,
+        // A refreshable credential (ADR-230) mints a fresh token each tick; the static path leaves this unset
+        // and the loop reuses ctx.credentials, exactly as before.
+        ...registration.refreshCredentials ? { refreshCredentials: registration.refreshCredentials } : {}
+      }
     )
   );
   return () => {
@@ -23405,6 +23559,37 @@ async function reconcileFrontierSurfaces(graph, errorsPath) {
 
 // src/connectors/hosted.ts
 init_cjs_shims();
+
+// src/connectors/railway/target-ref.ts
+init_cjs_shims();
+function nonEmptyString(v) {
+  return typeof v === "string" && v.length > 0;
+}
+function decodeRailwayTargetRef(ref) {
+  if (typeof ref !== "string" || ref.length === 0) return null;
+  let json;
+  try {
+    json = Buffer.from(ref, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  if (!nonEmptyString(obj.environmentId) || !nonEmptyString(obj.serviceId)) return null;
+  return {
+    environmentId: obj.environmentId,
+    serviceId: obj.serviceId,
+    ...nonEmptyString(obj.serviceName) ? { serviceName: obj.serviceName } : {}
+  };
+}
+
+// src/connectors/hosted.ts
 var CREDENTIAL_REFRESH_SKEW_MS = 6e4;
 var CP_REQUEST_TIMEOUT_MS = 1e4;
 async function cpGet(path79, deps) {
@@ -23431,6 +23616,15 @@ function hostedOptions(provider, summary, serviceName) {
       if (!ref) return null;
       return { apiProjectRef: ref, nodeRef: `${ref}.supabase.co`, serviceName };
     }
+    case "railway": {
+      const target = summary.projectRef ? decodeRailwayTargetRef(summary.projectRef) : null;
+      if (!target) return null;
+      return {
+        environmentId: target.environmentId,
+        serviceId: target.serviceId,
+        serviceNameById: { [target.serviceId]: serviceName }
+      };
+    }
     default:
       return null;
   }