@neat.is/core 0.9.5-dev.20260824 → 0.9.5

package/dist/neatd.js

@@ -2,11 +2,11 @@
 import {
   reconcileDaemonRecordSync,
   startDaemon
-} from "./chunk-TGCWMMF6.js";
+} from "./chunk-4SLKQNG7.js";
 import {
   listProjects,
   registryPath
-} from "./chunk-IVVF37OU.js";
+} from "./chunk-DGAI4VOE.js";
 import {
   BindAuthorityError,
   __require

package/dist/server.cjs

@@ -787,7 +787,7 @@ function getGraph(project = DEFAULT_PROJECT) {
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types93 = require("@neat.is/types");
+var import_types97 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -19799,9 +19799,229 @@ function createCloudRunConnector(graph, config = {}) {
   };
 }
 
+// src/connectors/gcp-lb/index.ts
+init_cjs_shims();
+
+// src/connectors/gcp-lb/client.ts
+init_cjs_shims();
+function gcpLbRequestLogName(projectId) {
+  return `projects/${projectId}/logs/requests`;
+}
+function buildGcpLbEntriesFilter(projectId, sinceIso) {
+  return [
+    `logName = "${gcpLbRequestLogName(projectId)}"`,
+    `resource.type = "${GCP_LB_RESOURCE_TYPE}"`,
+    'httpRequest.requestMethod != ""',
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var GCP_LB_RESOURCE_TYPE = "http_load_balancer";
+var DEFAULT_LOOKBACK_MS3 = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL3 = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE3 = 1e3;
+var MAX_PAGES3 = 20;
+async function fetchGcpLbRequestLogEntries(creds, sinceIso, apiUrl = ENTRIES_LIST_URL3) {
+  const filter = buildGcpLbEntriesFilter(creds.projectId, sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES3; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE3,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      apiUrl,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id — one customer's Cloud Logging quota is
+      // scoped per GCP project (ADR-131's per-(provider, accountKey) rate-limit
+      // bucket), the same key Cloud Run's and Firebase's connectors use.
+      { provider: "gcp-lb", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    if (Array.isArray(json.entries)) out.push(...json.entries);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/gcp-lb/map.ts
+init_cjs_shims();
+
+// src/connectors/gcp-lb/types.ts
+init_cjs_shims();
+function readGcpLbCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp-lb connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp-lb connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var GCP_LB_TARGET_KIND = "http_load_balancer";
+var FIELD_SEP3 = "\0";
+function packGcpLbTargetName(identity) {
+  return [identity.backendServiceName, identity.method, identity.path].join(FIELD_SEP3);
+}
+function parseGcpLbTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP3);
+  if (firstSep === -1) return null;
+  const backendServiceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP3);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path76 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path76) return null;
+  return { backendServiceName, method, path: path76 };
+}
+
+// src/connectors/gcp-lb/map.ts
+var GCP_LB_RESOURCE_TYPE2 = "http_load_balancer";
+function pathFromRequestUrl3(requestUrl) {
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD5 = 500;
+function mapLogEntryToSignal3(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  if (entry.resource?.type !== GCP_LB_RESOURCE_TYPE2) return null;
+  const backendServiceName = entry.resource?.labels?.["backend_service_name"];
+  if (typeof backendServiceName !== "string" || backendServiceName.length === 0) return null;
+  const req = entry.httpRequest;
+  if (!req) return null;
+  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path76 = pathFromRequestUrl3(req.requestUrl);
+  if (path76 === null) return null;
+  const timestamp = entry.timestamp;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
+  return {
+    targetKind: GCP_LB_TARGET_KIND,
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path76 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals3(entries) {
+  const out = [];
+  for (const entry of entries) {
+    const signal = mapLogEntryToSignal3(entry);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/gcp-lb/resolve.ts
+init_cjs_shims();
+var import_types82 = require("@neat.is/types");
+var GCP_LB_BACKEND_INFRA_KIND = "gcp-lb-backend";
+function findMatchingRouteNode3(graph, serviceName, method, normalizedPath) {
+  let found = null;
+  graph.forEachNode((_id, attrs) => {
+    if (found) return;
+    const node = attrs;
+    if (node.type !== import_types82.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName || !route.pathTemplate) return;
+    if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
+    const routeMethod = route.method.toUpperCase();
+    if (routeMethod !== "ALL" && routeMethod !== method) return;
+    found = route.id;
+  });
+  return found;
+}
+function createGcpLbResolveTarget(graph, config) {
+  return (signal) => {
+    if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
+    const identity = parseGcpLbTargetName(signal.targetName);
+    if (!identity) return null;
+    const { backendServiceName, method, path: path76 } = identity;
+    const mappedService = config.backendServiceMap?.[backendServiceName];
+    if (mappedService) {
+      const routeNodeId = findMatchingRouteNode3(
+        graph,
+        mappedService,
+        method,
+        normalizePathTemplate(path76)
+      );
+      if (routeNodeId) {
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types82.EdgeType.CALLS };
+      }
+    }
+    return {
+      targetNodeId: (0, import_types82.infraId)(GCP_LB_BACKEND_INFRA_KIND, backendServiceName),
+      serviceName: mappedService ?? backendServiceName,
+      edgeType: import_types82.EdgeType.CALLS,
+      ensureInfraNode: {
+        kind: GCP_LB_BACKEND_INFRA_KIND,
+        name: backendServiceName,
+        provider: "gcp-lb"
+      }
+    };
+  };
+}
+
+// src/connectors/gcp-lb/index.ts
+var GcpLbConnector = class {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  config;
+  provider = "gcp-lb";
+  async poll(ctx) {
+    const creds = readGcpLbCredentials(ctx.credentials);
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_LOOKBACK_MS3;
+    const sinceIso = boundedSinceIso2(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const entries = await fetchGcpLbRequestLogEntries(creds, sinceIso, this.config.apiUrl);
+    return mapLogEntriesToSignals3(entries);
+  }
+};
+function boundedSinceIso2(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+function createGcpLbConnector(graph, config = {}) {
+  return {
+    connector: new GcpLbConnector(config),
+    resolveTarget: createGcpLbResolveTarget(graph, config)
+  };
+}
+
 // src/connectors/render/index.ts
 init_cjs_shims();
-var import_types81 = require("@neat.is/types");
+var import_types85 = require("@neat.is/types");
 
 // src/connectors/render/types.ts
 init_cjs_shims();
@@ -19879,7 +20099,7 @@ function buildRenderRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types81.NodeType.RouteNode) return;
+    if (node.type !== import_types85.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -19964,7 +20184,7 @@ function mapRenderRequestLogsToSignals(entries, routeIndex) {
 function createRenderResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind === ROUTE_TARGET_KIND2) {
-      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types81.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types85.EdgeType.CALLS };
     }
     return null;
   };
@@ -20102,21 +20322,21 @@ function mapInsightsToSignals(rows, observedAtIso) {
 
 // src/connectors/planetscale/resolve.ts
 init_cjs_shims();
-var import_types85 = require("@neat.is/types");
+var import_types89 = require("@neat.is/types");
 var PLANETSCALE_DATABASE_KIND = "planetscale-database";
 function createPlanetscaleResolveTarget(graph, config) {
   const databaseName = `${config.organization}/${config.database}`;
   return (signal, _ctx) => {
     if (signal.targetKind !== PLANETSCALE_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
-    const tableId = (0, import_types85.infraId)("sql-table", signal.targetName);
+    const tableId = (0, import_types89.infraId)("sql-table", signal.targetName);
     if (graph.hasNode(tableId)) {
-      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types85.EdgeType.CALLS };
+      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types89.EdgeType.CALLS };
     }
-    const providerId = (0, import_types85.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
+    const providerId = (0, import_types89.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
     return {
       targetNodeId: providerId,
       serviceName: config.serviceName,
-      edgeType: import_types85.EdgeType.CALLS,
+      edgeType: import_types89.EdgeType.CALLS,
       ensureInfraNode: { kind: PLANETSCALE_DATABASE_KIND, name: databaseName, provider: "planetscale" }
     };
   };
@@ -20182,13 +20402,13 @@ function isTransientFailure(err) {
   if (code && INTERNAL_ERROR_CODE.test(code)) return true;
   return false;
 }
-var FIELD_SEP3 = "\0";
+var FIELD_SEP4 = "\0";
 var EAS_TARGET_KIND = "eas-build";
 function packEasTargetName(identity) {
-  return [identity.serviceName, identity.phase].join(FIELD_SEP3);
+  return [identity.serviceName, identity.phase].join(FIELD_SEP4);
 }
 function parseEasTargetName(targetName) {
-  const sep = targetName.indexOf(FIELD_SEP3);
+  const sep = targetName.indexOf(FIELD_SEP4);
   if (sep === -1) return null;
   const serviceName = targetName.slice(0, sep);
   const phase = targetName.slice(sep + 1);
@@ -20381,7 +20601,7 @@ function mapBuildsToSignals(builds, serviceName) {
 
 // src/connectors/eas/resolve.ts
 init_cjs_shims();
-var import_types90 = require("@neat.is/types");
+var import_types94 = require("@neat.is/types");
 var NO_ENV2 = "unknown";
 var EAS_JSON_PHASES = /* @__PURE__ */ new Set(["READ_EAS_JSON"]);
 var APP_CONFIG_PHASES = /* @__PURE__ */ new Set([
@@ -20397,8 +20617,8 @@ function configBasenamesForPhase(phase) {
 function configNodeService(graph, configNodeId) {
   for (const edgeId of graph.inboundEdges(configNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types90.EdgeType.CONFIGURED_BY) continue;
-    const parsed = (0, import_types90.parseFileId)(edge.source);
+    if (edge.type !== import_types94.EdgeType.CONFIGURED_BY) continue;
+    const parsed = (0, import_types94.parseFileId)(edge.source);
     if (parsed) return parsed.service;
   }
   return null;
@@ -20409,7 +20629,7 @@ function findConfigNode(graph, basenames, serviceName) {
   graph.forEachNode((id, attrs) => {
     if (scoped) return;
     const node = attrs;
-    if (node.type !== import_types90.NodeType.ConfigNode) return;
+    if (node.type !== import_types94.NodeType.ConfigNode) return;
     if (typeof node.name !== "string" || !basenames.includes(node.name)) return;
     if (anyMatch === null) anyMatch = id;
     if (configNodeService(graph, id) === serviceName) scoped = id;
@@ -20426,13 +20646,13 @@ function createEasResolveTarget(graph) {
     if (basenames.length > 0) {
       const configNodeId = findConfigNode(graph, basenames, serviceName);
       if (configNodeId) {
-        return { targetNodeId: configNodeId, serviceName, edgeType: import_types90.EdgeType.CALLS };
+        return { targetNodeId: configNodeId, serviceName, edgeType: import_types94.EdgeType.CALLS };
       }
     }
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV2),
       serviceName,
-      edgeType: import_types90.EdgeType.CALLS
+      edgeType: import_types94.EdgeType.CALLS
     };
   };
 }
@@ -20444,7 +20664,7 @@ function isBuildSince(build, sinceIso) {
   if (Number.isNaN(t) || Number.isNaN(s)) return true;
   return t > s;
 }
-function boundedSinceIso2(since, now, maxLookbackMs) {
+function boundedSinceIso3(since, now, maxLookbackMs) {
   const floor = new Date(now.getTime() - maxLookbackMs);
   if (!since) return floor.toISOString();
   const sinceMs = new Date(since).getTime();
@@ -20463,7 +20683,7 @@ var EasConnector = class {
     const creds = readEasCredentials(ctx.credentials);
     const serviceName = this.config.serviceName ?? this.config.appId;
     const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS6;
-    const sinceIso = boundedSinceIso2(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const sinceIso = boundedSinceIso3(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
     const builds = await fetchErroredBuilds(creds.token, this.config, this.fetchImpl);
     const fresh = builds.filter((b) => isBuildSince(b, sinceIso));
     const maxLogBytes = this.config.maxLogBytes ?? DEFAULT_MAX_LOG_BYTES;
@@ -20694,6 +20914,40 @@ var PROVIDER_DISPATCH = {
       });
     }
   },
+  "gcp-lb": {
+    provider: "gcp-lb",
+    // Like cloud-run, gcp-lb reads both projectId and accessToken from the
+    // credential; the single-string form maps to the secret (the token), and the
+    // required-fields check below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createGcpLbConnector(graph, options);
+    },
+    // POST entries:list with pageSize 1 — the exact surface poll() reads, so the
+    // probe checks the actual `logging.logEntries.list` permission the connector
+    // needs. This is the same Cloud Logging read-verdict cloud-run's validate
+    // uses (a lighter GET on logs.list would instead check `logging.logs.list`,
+    // falsely rejecting a correctly-scoped custom role carrying only
+    // `logging.logEntries.list`). A 2xx means the token can list log entries;
+    // 401/403 means the provider rejected it.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "gcp-lb",
+        accountKey: projectId || "validate",
+        url: "https://logging.googleapis.com/v2/entries:list",
+        token: String(credentials.accessToken ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ resourceNames: [`projects/${projectId}`], pageSize: 1 })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
   render: {
     provider: "render",
     primaryCredentialKey: "token",
@@ -21113,11 +21367,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types93.DivergenceTypeSchema.safeParse(c);
+        const r = import_types97.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types93.DivergenceTypeSchema.options
+            allowed: import_types97.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -21479,7 +21733,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types93.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types97.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -21518,7 +21772,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types93.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types97.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",