@neat.is/core 0.9.21-dev.20260924 → 0.9.21

package/dist/{chunk-SK2FEJKB.js → chunk-KVJQQUUY.js}

@@ -7,6 +7,7 @@ import {
   buildApi,
   extractFromDirectory,
   getGraph,
+  getPushProviderDispatch,
   handleSpan,
   isBoundaryTimeoutSymptom,
   junctionFetch,
@@ -32,7 +33,7 @@ import {
   startStalenessLoop,
   touchLastSeen,
   writeAtomically
-} from "./chunk-NFJ4W5T6.js";
+} from "./chunk-J3VVEB45.js";
 import {
   assertBindAuthority,
   buildOtelReceiver,
@@ -80,6 +81,10 @@ async function reconcileFrontierSurfaces(graph, errorsPath) {
   stageHangSurfaces(graph, incidents);
 }
 
+// src/connectors/hosted.ts
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
 // src/connectors/railway/target-ref.ts
 function nonEmptyString(v) {
   return typeof v === "string" && v.length > 0;
@@ -124,11 +129,14 @@ function credentialRecord(provider, cred) {
   switch (provider) {
     case "supabase":
       return { managementToken: cred.accessToken };
+    case "gcp":
+      if (!cred.projectRef) throw new Error("gcp credential delivered without a project ref");
+      return { projectId: cred.projectRef, accessToken: cred.accessToken };
     default:
       return { token: cred.accessToken };
   }
 }
-function hostedOptions(provider, summary, serviceName) {
+function hostedOptions(provider, summary, serviceName, firebaseServiceMap) {
   switch (provider) {
     case "supabase": {
       const ref = summary.projectRef;
@@ -144,10 +152,125 @@ function hostedOptions(provider, summary, serviceName) {
         serviceNameById: { [target.serviceId]: serviceName }
       };
     }
+    case "firebase": {
+      return { inferServices: true, excludeCloudRun: true, ...firebaseServiceMap ?? {} };
+    }
+    case "cloud-run":
+    case "gcp-lb":
+      return { inferServices: true };
     default:
       return null;
   }
 }
+function parseFirebaseServiceMap(raw) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+    const out = {};
+    for (const key of ["functions", "cloudRun", "hosting"]) {
+      const group = parsed[key];
+      if (group === void 0) continue;
+      if (!group || typeof group !== "object" || Array.isArray(group)) return void 0;
+      const entries = Object.entries(group);
+      if (entries.some(([, v]) => typeof v !== "string" || v.length === 0)) return void 0;
+      out[key] = Object.fromEntries(entries);
+    }
+    return Object.keys(out).length > 0 ? out : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function pushHandlesPath(projectDir) {
+  return join(projectDir, "neat-out", "connectors-hosted.json");
+}
+async function readPushHandles(projectDir) {
+  try {
+    const parsed = JSON.parse(await readFile(pushHandlesPath(projectDir), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function writePushHandle(projectDir, provider, handle) {
+  const path5 = pushHandlesPath(projectDir);
+  const handles = await readPushHandles(projectDir);
+  handles[provider] = handle;
+  await mkdir(dirname(path5), { recursive: true });
+  const tmp = `${path5}.${process.pid}.tmp`;
+  await writeFile(tmp, `${JSON.stringify(handles, null, 2)}
+`, "utf8");
+  await rename(tmp, path5);
+}
+function pushCredentialRecord(provider, cred, deps) {
+  switch (provider) {
+    case "vercel":
+      return { token: cred.accessToken, otelToken: deps.otelToken ?? deps.daemonToken };
+    default:
+      return { token: cred.accessToken };
+  }
+}
+function hostedPushOptions(provider, summary, deps) {
+  switch (provider) {
+    case "vercel": {
+      if (!deps.publicUrl) {
+        return { skip: "no public URL for this daemon (NEAT_PUBLIC_URL) \u2014 a drain has nowhere to deliver" };
+      }
+      if (!summary.projectRef) return { skip: "no Vercel team selected yet \u2014 drains are team-scoped" };
+      const endpoint = `${deps.publicUrl.replace(/\/+$/, "")}/v1/traces`;
+      return { options: { teamId: summary.projectRef, endpoint }, endpoint };
+    }
+    default:
+      return { skip: "no hosted option mapping for this push provider" };
+  }
+}
+async function provisionHostedPushProvider(summary, dispatch, input) {
+  const { deps, projectDir, onSkip, onProvisioned } = input;
+  const provider = summary.provider;
+  const mapped = hostedPushOptions(provider, summary, deps);
+  if ("skip" in mapped) {
+    onSkip?.(provider, mapped.skip);
+    return;
+  }
+  let cred;
+  try {
+    cred = await cpGet(
+      `/internal/projects/${deps.projectId}/connections/${provider}/credential`,
+      deps
+    );
+  } catch (err) {
+    onSkip?.(provider, `credential delivery failed \u2014 ${err.message}`);
+    return;
+  }
+  const credentials = pushCredentialRecord(provider, cred, deps);
+  const existing = (await readPushHandles(projectDir))[provider];
+  const alreadyProvisioned = existing !== void 0 && existing.endpoint === mapped.endpoint;
+  const options = alreadyProvisioned ? { ...mapped.options, ...existing.options } : mapped.options;
+  const seam = deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {};
+  const validation = await dispatch.validate({ credentials, options, ...seam });
+  if (!validation.ok) {
+    onSkip?.(provider, `drain delivery test failed \u2014 ${validation.reason}`);
+    return;
+  }
+  if (alreadyProvisioned) {
+    onProvisioned?.(provider, "drain already provisioned \u2014 delivery re-validated");
+    return;
+  }
+  const result = await dispatch.provision({ credentials, options, ...seam });
+  if (!result.ok) {
+    onSkip?.(provider, `drain provisioning failed \u2014 ${result.reason}`);
+    return;
+  }
+  await writePushHandle(projectDir, provider, {
+    endpoint: mapped.endpoint,
+    options: result.options ?? {},
+    provisionedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  onProvisioned?.(provider, result.note);
+}
+var HOSTED_CONNECTORS_FOR = {
+  gcp: ["firebase", "cloud-run", "gcp-lb"]
+};
 function createHostedCredentialSource(provider, deps) {
   let cached = null;
   return async () => {
@@ -176,40 +299,50 @@ async function startHostedConnectors(input) {
   if (!Array.isArray(connections)) return () => {
   };
   const stops = [];
+  const lookupPush = input.pushDispatch ?? getPushProviderDispatch;
   for (const c of connections) {
-    const dispatch = PROVIDER_DISPATCH[c.provider];
-    if (!dispatch) {
-      onSkip?.(c.provider, "no pull connector for this provider");
+    const push = lookupPush(c.provider);
+    if (push) {
+      await provisionHostedPushProvider(c, push, input);
       continue;
     }
-    if (c.needsProjectSelection || !c.projectRef) {
-      onSkip?.(c.provider, "no project selected yet \u2014 not pullable");
-      continue;
-    }
-    const options = hostedOptions(c.provider, c, project);
-    if (!options) {
-      onSkip?.(c.provider, "no hosted option mapping for this provider");
-      continue;
-    }
-    let built;
-    try {
-      built = dispatch.build(graph, options);
-    } catch (err) {
-      onSkip?.(c.provider, err.message);
-      continue;
+    const credentialSource = createHostedCredentialSource(c.provider, deps);
+    for (const name of HOSTED_CONNECTORS_FOR[c.provider] ?? [c.provider]) {
+      const dispatch = PROVIDER_DISPATCH[name];
+      if (!dispatch) {
+        onSkip?.(name, "no pull connector for this provider");
+        continue;
+      }
+      if (c.needsProjectSelection || !c.projectRef) {
+        onSkip?.(name, "no project selected yet \u2014 not pullable");
+        continue;
+      }
+      const options = hostedOptions(name, c, project, input.firebaseServiceMap);
+      if (!options) {
+        onSkip?.(name, "no hosted option mapping for this provider");
+        continue;
+      }
+      let built;
+      try {
+        built = dispatch.build(graph, options);
+      } catch (err) {
+        onSkip?.(name, err.message);
+        continue;
+      }
+      stops.push(
+        startLoop(
+          built.connector,
+          { projectDir, project, credentials: {}, ...errorsPath ? { errorsPath } : {} },
+          graph,
+          built.resolveTarget,
+          {
+            connectorId: `hosted:${name}`,
+            // The credential is fetched by the CONNECTION's provider (`gcp`), not the connector's name.
+            refreshCredentials: credentialSource
+          }
+        )
+      );
     }
-    stops.push(
-      startLoop(
-        built.connector,
-        { projectDir, project, credentials: {}, ...errorsPath ? { errorsPath } : {} },
-        graph,
-        built.resolveTarget,
-        {
-          connectorId: `hosted:${c.provider}`,
-          refreshCredentials: createHostedCredentialSource(c.provider, deps)
-        }
-      )
-    );
   }
   return () => {
     for (const stop of stops) stop();
@@ -223,10 +356,18 @@ async function maybeStartHostedConnectors(input) {
   if (!cpUrl || !projectId || !daemonToken) return () => {
   };
   return startHostedConnectors({
-    deps: { cpUrl, projectId, daemonToken, ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {} },
+    deps: {
+      cpUrl,
+      projectId,
+      daemonToken,
+      ...env.NEAT_PUBLIC_URL ? { publicUrl: env.NEAT_PUBLIC_URL } : {},
+      ...env.NEAT_OTEL_TOKEN ? { otelToken: env.NEAT_OTEL_TOKEN } : {},
+      ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+    },
     graph: input.graph,
     projectDir: input.projectDir,
     project: input.project,
+    ...parseFirebaseServiceMap(env.NEAT_FIREBASE_SERVICE_MAP) ? { firebaseServiceMap: parseFirebaseServiceMap(env.NEAT_FIREBASE_SERVICE_MAP) } : {},
     ...input.errorsPath ? { errorsPath: input.errorsPath } : {},
     ...input.onSkip ? { onSkip: input.onSkip } : {}
   });
@@ -306,6 +447,8 @@ async function syncOneRepo(r, input) {
   let dir;
   try {
     dir = await mkdtemp(path.join(tmpRoot, "neat-repo-"));
+    await cpPostStatus(deps, r.owner, r.name, { syncStatus: "syncing", detail: "cloning" }).catch(() => {
+    });
     await cloneRepo(r.cloneUrl, r.defaultBranch, dir);
     const extracted = await extract(graph, dir);
     const nodes = extracted?.nodesAdded ?? 0;
@@ -333,23 +476,26 @@ async function runRepoSyncPass(input) {
     repos = await cpGet2(`/internal/projects/${input.deps.projectId}/repos`, input.deps);
   } catch (err) {
     input.onSkip?.("(all)", `control plane repo list unreadable \u2014 ${err.message}`);
-    return;
+    return false;
   }
-  if (!Array.isArray(repos)) return;
+  if (!Array.isArray(repos)) return false;
   for (const r of repos) {
-    if (!needsSync(r)) continue;
+    if (!input.forceResync && !needsSync(r)) continue;
     await syncOneRepo(r, input);
   }
+  return true;
 }
 async function startRepoSync(input) {
   const intervalMs = input.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS;
   let stopped = false;
   let running = false;
+  let bootResyncDone = false;
   const tick = async () => {
     if (stopped || running) return;
     running = true;
     try {
-      await runRepoSyncPass(input);
+      const listed = await runRepoSyncPass({ ...input, forceResync: !bootResyncDone });
+      if (listed) bootResyncDone = true;
     } finally {
       running = false;
     }
@@ -740,7 +886,7 @@ function createK8sResolveTarget(graph) {
 }
 
 // src/connectors/kubernetes/substrate.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import os2 from "os";
 import path2 from "path";
 function defaultHome() {
@@ -754,7 +900,7 @@ function k8sSubstrateConfigPath(home = defaultHome()) {
 async function readK8sSubstrateConfig(home = defaultHome()) {
   let raw;
   try {
-    raw = await readFile(k8sSubstrateConfigPath(home), "utf8");
+    raw = await readFile2(k8sSubstrateConfigPath(home), "utf8");
   } catch {
     return { version: 1, deployments: [] };
   }
@@ -1753,4 +1899,4 @@ export {
   resolveHost,
   startDaemon
 };
-//# sourceMappingURL=chunk-SK2FEJKB.js.map
+//# sourceMappingURL=chunk-KVJQQUUY.js.map