@neon/env 1.4.8 → 1.5.1

package/README.md

@@ -202,6 +202,6 @@ Pass `databaseName` / `roleName` to override the auto-pick.
 
 ## Resolution
 
-The **CLI** (`neon-env run`) resolves project + branch itself: `--project-id` / `--branch` flag → `NEON_PROJECT_ID` / `NEON_BRANCH` (name) / `NEON_BRANCH_ID` (legacy id) env → `.neon[/project.json]` walked up from the working directory (its `branch` field, name or id; legacy `branchId` still read). The API key resolves via `--api-key` → `NEON_API_KEY` → `~/.config/neonctl/credentials.json`.
+The **CLI** (`neon-env run`) resolves project + branch itself: `--project-id` / `--branch` flag → `NEON_PROJECT_ID` / `NEON_BRANCH` (name) / `NEON_BRANCH_ID` (legacy id) env → `.neon[/project.json]` walked up from the working directory (its `branch` field, name or id; legacy `branchId` still read). The policy is the `neon.ts` in the directory holding that `.neon` (or the working directory without one), and `.env.local` is read from the same directory; `--config <path>` overrides the policy file. The API key resolves via `--api-key` → `NEON_API_KEY` → `~/.config/neonctl/credentials.json`.
 
 The **library functions** do none of this — pass `projectId` / `branch` explicitly. This keeps `.neon` parsing in one place (the CLI / neon) and the functions pure.

package/dist/cli.js

@@ -44,9 +44,9 @@ import { homedir } from "node:os";
 * ```
 */
 async function fetchEnvReusingSecrets(config, options) {
-	const { env: source = process.env, keys: requestedKeys, revokeSuperseded = true, ...fetchOptions } = options;
+	const { env: source = process.env, keys: requestedKeys, revokeSuperseded = true, resolvedBranch, ...fetchOptions } = options;
 	const api = options.api ?? createApiFromOptions(options);
-	const { branch, desired } = await resolveBranchPolicy(config, options, api);
+	const { branch, desired } = await resolveBranchPolicy(config, options, api, resolvedBranch);
 	const allPolicyKeys = policyEnvKeys(desired);
 	const requested = requestedKeys ? new Set(requestedKeys) : null;
 	const selectedPolicyKeys = requested === null ? allPolicyKeys : [...allPolicyKeys.filter((key) => requested.has(key)), ...[...requested].filter(isFunctionBaseUrlKey).sort()];
@@ -59,12 +59,16 @@ async function fetchEnvReusingSecrets(config, options) {
 		aiGateway: gatewayCredentialSelected
 	}).filter((key) => selected.has(key));
 	if (secretKeys.length === 0) {
-		const fetched = await fetchEnvKeysState(config, fetchOptions, requested === null ? null : selectedPolicyKeys);
+		const fetched = await fetchEnvKeysState(config, fetchOptions, requested === null ? null : selectedPolicyKeys, {
+			branch,
+			desired
+		});
 		return {
 			vars: preferPersisted(toEntries(fetched.env), source),
 			credential: {
 				issued: false,
 				keys: [],
+				fresh: [],
 				revoked: [],
 				superseded: []
 			},
@@ -93,10 +97,12 @@ async function fetchEnvReusingSecrets(config, options) {
 	const fetchKeys = requested === null ? null : selectedPolicyKeys.filter((key) => !keptSecretKeys.includes(key));
 	const fetched = await fetchEnvKeysState(config, {
 		...fetchOptions,
-		branchId: branch.id,
 		api,
 		...keptSecretKeys.length > 0 && requested === null ? { omitKeys: keptSecretKeys } : {}
-	}, fetchKeys);
+	}, fetchKeys, {
+		branch,
+		desired
+	});
 	const vars = preferPersisted(toEntries(fetched.env), source);
 	const unavailable = fetched.functionUrlsUnavailable ? { functionUrlsUnavailable: true } : {};
 	for (const key of keptSecretKeys) {
@@ -108,6 +114,7 @@ async function fetchEnvReusingSecrets(config, options) {
 		credential: {
 			issued: false,
 			keys: secretKeys,
+			fresh: [],
 			revoked: [],
 			superseded: []
 		},
@@ -121,6 +128,7 @@ async function fetchEnvReusingSecrets(config, options) {
 		credential: {
 			issued: true,
 			keys: secretKeys,
+			fresh: secretKeys.filter((key) => !keptSecretKeys.includes(key)),
 			revoked: revokeSuperseded ? [...ours] : [],
 			superseded: revokeSuperseded ? [] : [...ours]
 		},
@@ -1006,7 +1014,8 @@ function readStoredCredential(selection, env) {
 */
 function resolveContext(options) {
 	const env = options.env ?? process.env;
-	const file = findNeonFile(options.cwd);
+	const found = findNeonFile(options.cwd);
+	const file = found?.file;
 	const projectId = nonEmpty(options.projectId) ?? nonEmpty(env.NEON_PROJECT_ID) ?? file?.projectId;
 	const branch = nonEmpty(options.branch) ?? nonEmpty(env.NEON_BRANCH) ?? nonEmpty(env.NEON_BRANCH_ID) ?? file?.branch;
 	const missing = [];
@@ -1020,28 +1029,31 @@ function resolveContext(options) {
 		ok: true,
 		context: {
 			projectId,
-			branch
+			branch,
+			projectDir: found?.dir ?? resolve(options.cwd)
 		}
 	};
 }
 /**
 * Walk up from `cwd` looking for `.neon/project.json` (preferred) or `.neon` (neonctl
-* convention). Stops at the first `.git` directory or the home directory. Read-only.
+* convention), with the same boundaries as the `neon` CLI's walk so both resolve the same
+* project directory: the home directory and the filesystem root are never checked, and
+* `.git` is not a boundary. Read-only.
 */
 function findNeonFile(cwd) {
+	const home = resolve(homedir());
 	let current = resolve(cwd);
-	const stop = resolve(homedir());
-	let lastSeen = null;
-	while (true) {
-		const parsed = readNeonFileAt(resolve(current, ".neon", "project.json")) ?? readNeonFileAt(resolve(current, ".neon"));
-		if (parsed) return parsed;
-		if (current === stop) return null;
-		if (existsSync(resolve(current, ".git"))) return null;
+	while (current !== home) {
 		const parent = dirname(current);
-		if (parent === current || parent === lastSeen) return null;
-		lastSeen = current;
+		if (parent === current) return null;
+		const parsed = readNeonFileAt(resolve(current, ".neon", "project.json")) ?? readNeonFileAt(resolve(current, ".neon"));
+		if (parsed) return {
+			file: parsed,
+			dir: current
+		};
 		current = parent;
 	}
+	return null;
 }
 function readNeonFileAt(path) {
 	if (!isFile(path)) return null;
@@ -1081,6 +1093,22 @@ function nonEmpty(value) {
 //#region src/lib/cli/commands.ts
 /** File `env run` reads to layer one-time auth keys. Matches the Vercel/Next.js convention. */
 const DEFAULT_ENV_FILE = ".env.local";
+const NEON_CONFIG_FILENAMES = [
+	"neon.ts",
+	"neon.mts",
+	"neon.js",
+	"neon.mjs"
+];
+/** The project's `neon.ts` (or other supported extension). Never searches parent directories. */
+function projectConfigPath(projectDir) {
+	const name = NEON_CONFIG_FILENAMES.find((candidate) => existsSync(join(projectDir, candidate)));
+	if (name === void 0) throw new ConfigLoadError([
+		`Could not find a Neon config file in ${projectDir}.`,
+		`Looked for: ${NEON_CONFIG_FILENAMES.join(", ")} next to the project's .neon (or in the current directory when there is no .neon).`,
+		"Create one with `neon config init`, or pass `--config <path>`."
+	].join("\n"));
+	return join(projectDir, name);
+}
 /**
 * Implementation of `neon-env run -- <cmd...>`. Loads `neon.ts`, fetches the env from
 * Neon, then spawns the user-supplied command with the env vars injected on top of the
@@ -1165,11 +1193,11 @@ function formatDotenvLine(key, value) {
 * working credential verifies and keeps it instead of minting another one per invocation.
 */
 async function loadConfigAndFetchEnv(options, ctx, resolved) {
-	const { config, resolvedPath } = await loadConfigFromFile({
-		...options.configPath ? { path: options.configPath } : {},
+	const { config } = await loadConfigFromFile({
+		path: options.configPath ?? projectConfigPath(resolved.projectDir),
 		cwd: ctx.cwd
 	});
-	const envFileSource = join(dirname(resolvedPath), DEFAULT_ENV_FILE);
+	const envFileSource = join(resolved.projectDir, DEFAULT_ENV_FILE);
 	const fileEnv = existsSync(envFileSource) ? parseEnvFile(readFileSync(envFileSource, "utf-8")) : {};
 	const apiKey = resolveApiKey({
 		...options.apiKey ? { apiKey: options.apiKey } : {},
@@ -1309,7 +1337,7 @@ const argv = yargs(hideBin(process.argv)).scriptName("neon-env").usage("$0 <comm
 	describe: "Print stack traces and structured error details when something fails"
 }).command("run", "Run a command with Neon env vars (from your neon.ts policy) injected into its environment. Use `--` to separate the command: `neon-env run -- npm run dev`.", (y) => y.option("config", {
 	type: "string",
-	describe: "Path to neon.ts (defaults to walking up from cwd)"
+	describe: "Path to neon.ts (defaults to the neon.ts next to .neon, or in cwd without one)"
 }).option("project-id", {
 	type: "string",
 	describe: "Override the .neon/project.json projectId"
@@ -1328,7 +1356,7 @@ const argv = yargs(hideBin(process.argv)).scriptName("neon-env").usage("$0 <comm
 	describe: "Output format: dotenv (KEY=value lines) or json"
 }).option("config", {
 	type: "string",
-	describe: "Path to neon.ts (defaults to walking up from cwd)"
+	describe: "Path to neon.ts (defaults to the neon.ts next to .neon, or in cwd without one)"
 }).option("project-id", {
 	type: "string",
 	describe: "Override the .neon/project.json projectId"