@neon/env 1.5.0 → 1.5.2

package/dist/cli.js

@@ -44,9 +44,9 @@ import { homedir } from "node:os";
 * ```
 */
 async function fetchEnvReusingSecrets(config, options) {
-	const { env: source = process.env, keys: requestedKeys, revokeSuperseded = true, ...fetchOptions } = options;
+	const { env: source = process.env, keys: requestedKeys, revokeSuperseded = true, resolvedBranch, ...fetchOptions } = options;
 	const api = options.api ?? createApiFromOptions(options);
-	const { branch, desired } = await resolveBranchPolicy(config, options, api);
+	const { branch, desired } = await resolveBranchPolicy(config, options, api, resolvedBranch);
 	const allPolicyKeys = policyEnvKeys(desired);
 	const requested = requestedKeys ? new Set(requestedKeys) : null;
 	const selectedPolicyKeys = requested === null ? allPolicyKeys : [...allPolicyKeys.filter((key) => requested.has(key)), ...[...requested].filter(isFunctionBaseUrlKey).sort()];
@@ -59,12 +59,16 @@ async function fetchEnvReusingSecrets(config, options) {
 		aiGateway: gatewayCredentialSelected
 	}).filter((key) => selected.has(key));
 	if (secretKeys.length === 0) {
-		const fetched = await fetchEnvKeysState(config, fetchOptions, requested === null ? null : selectedPolicyKeys);
+		const fetched = await fetchEnvKeysState(config, fetchOptions, requested === null ? null : selectedPolicyKeys, {
+			branch,
+			desired
+		});
 		return {
 			vars: preferPersisted(toEntries(fetched.env), source),
 			credential: {
 				issued: false,
 				keys: [],
+				fresh: [],
 				revoked: [],
 				superseded: []
 			},
@@ -93,10 +97,12 @@ async function fetchEnvReusingSecrets(config, options) {
 	const fetchKeys = requested === null ? null : selectedPolicyKeys.filter((key) => !keptSecretKeys.includes(key));
 	const fetched = await fetchEnvKeysState(config, {
 		...fetchOptions,
-		branchId: branch.id,
 		api,
 		...keptSecretKeys.length > 0 && requested === null ? { omitKeys: keptSecretKeys } : {}
-	}, fetchKeys);
+	}, fetchKeys, {
+		branch,
+		desired
+	});
 	const vars = preferPersisted(toEntries(fetched.env), source);
 	const unavailable = fetched.functionUrlsUnavailable ? { functionUrlsUnavailable: true } : {};
 	for (const key of keptSecretKeys) {
@@ -108,6 +114,7 @@ async function fetchEnvReusingSecrets(config, options) {
 		credential: {
 			issued: false,
 			keys: secretKeys,
+			fresh: [],
 			revoked: [],
 			superseded: []
 		},
@@ -121,6 +128,7 @@ async function fetchEnvReusingSecrets(config, options) {
 		credential: {
 			issued: true,
 			keys: secretKeys,
+			fresh: secretKeys.filter((key) => !keptSecretKeys.includes(key)),
 			revoked: revokeSuperseded ? [...ours] : [],
 			superseded: revokeSuperseded ? [] : [...ours]
 		},
@@ -450,7 +458,7 @@ const inspectProfiles = (dir) => {
 *
 * A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
 * worst case is a named profile turning up missing, which is recoverable — whereas throwing
-* would lock the user out of `neon auth` itself. Writing is the opposite: see
+* would lock the user out of `neon login` itself. Writing is the opposite: see
 * {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
 */
 const readProfiles = (dir, onWarn = () => {}) => {
@@ -690,7 +698,7 @@ var KeyringUnavailableError = class extends Error {
 };
 var KeyringUnreadableError = class extends Error {
 	constructor(profile) {
-		const replace = `\`neon auth --profile ${profile}\``;
+		const replace = `\`neon login --profile ${profile}\``;
 		super(`Could not read the OS keyring item for profile "${profile}". Unlock the keyring and retry, or run ${replace}. To reset the profile: \`neon profile remove ${profile} --yes\`.`);
 		this.name = "KeyringUnreadableError";
 	}
@@ -993,7 +1001,7 @@ function readStoredCredential(selection, env) {
 	if (credential.kind === "api_key") return credential.apiKey;
 	const token = loaded.credentials.access_token;
 	if (typeof token === "string" && token.trim() !== "") return token.trim();
-	throw new Error(`Profile "${profile}" holds a browser sign-in with no usable token at ${credentialLabel(at)}. Sign in again with \`neon auth --profile ${profile}\`.`);
+	throw new Error(`Profile "${profile}" holds a browser sign-in with no usable token at ${credentialLabel(at)}. Sign in again with \`neon login --profile ${profile}\`.`);
 }
 //#endregion
 //#region src/lib/cli/resolve-context.ts
@@ -1282,7 +1290,7 @@ function handleError(err) {
 		"No Neon API key. `neon-env` looks for one in this order:",
 		"  - the `--api-key` flag",
 		"  - the `NEON_API_KEY` environment variable",
-		"  - `credentials.json` in `NEONCTL_CONFIG_DIR` (else `~/.config/neonctl`) — run `neon auth` to create it"
+		"  - `credentials.json` in `NEONCTL_CONFIG_DIR` (else `~/.config/neonctl`) — run `neon login` to create it"
 	].join("\n"), EXIT_CODE_BY_PLATFORM_ERROR_CODE[ErrorCode.MissingApiKey] ?? 1);
 	if (err instanceof PlatformError) {
 		const exitCode = EXIT_CODE_BY_PLATFORM_ERROR_CODE[err.code];