neon 2.37.1 → 2.38.1

package/README.md

@@ -1,4 +1,10 @@
-The Neon CLI is a command-line interface that lets you manage [Neon Serverless Postgres](https://neon.tech/) directly from the terminal. For the complete documentation, see [Neon CLI](https://neon.tech/docs/reference/neon-cli).
+# Neon CLI
+
+The `neon` package is a command-line interface that lets you manage [Neon Serverless Postgres](https://neon.tech/) directly from the terminal. For the complete documentation, see [Neon CLI](https://neon.tech/docs/reference/neon-cli).
+
+The legacy `neonctl` package is a lightweight compatibility package that depends
+on this package and invokes the same CLI entry point. The implementation and
+build artifacts live only here.
 
 ## Install the Neon CLI
 
@@ -18,7 +24,7 @@ brew install neonctl
 
 **Binary (macOS, Linux, Windows)**
 
-Download a binary file [here](https://github.com/neondatabase/neonctl/releases).
+Download a `neon-<platform>` binary from the [releases page](https://github.com/neondatabase/neon-pkgs/releases), which carries one asset per platform for each `neon@<version>` tag.
 
 ### Upgrade
 
@@ -706,4 +712,5 @@ bun run test:conformance:matrix  # run across PG 14/15/16/17/18 locally (require
 
 ## Releasing
 
-Maintainers: see [`RELEASING.md`](./RELEASING.md) for the two-stage publish flow.
+Maintainers: see the repository's [release skill](../../.claude/skills/release/SKILL.md)
+for the Changesets bump and external publish flow.

package/dist/auth_context.js

@@ -0,0 +1,16 @@
+let current = null;
+export const setAuthContext = (context) => {
+    current = context;
+};
+export const getAuthContext = () => current;
+/**
+ * The config directory whose credentials a 401 should clear, or `null` to leave
+ * stored credentials alone.
+ *
+ * An API key passed on the command line never touches the stored OAuth token,
+ * so a 401 on that key says nothing about whether the stored credentials are
+ * still good — clearing them would sign the user out of an account the failed
+ * request never used. The directory comes from the context rather than the
+ * default so that `--config-dir` isolates the deletion too.
+ */
+export const credentialsToClearOn401 = (context) => context?.source === "stored-credentials" ? context.configDir : null;

package/dist/commands/auth.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getApiClient } from "../api.js";
 import { auth, refreshToken } from "../auth.js";
+import { setAuthContext } from "../auth_context.js";
 import { CREDENTIALS_FILE } from "../config.js";
 import { isConfigInit, isCurrentBranchProbe } from "../context.js";
 import { isCi } from "../env.js";
@@ -129,6 +130,10 @@ export const ensureAuth = async (props) => {
     if (props.apiKey || props._[0] === "auth") {
         if (props.apiKey) {
             log.debug("Using an API key to authorize requests");
+            setAuthContext({
+                source: "api-key",
+                configDir: props.configDir,
+            });
         }
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
@@ -149,6 +154,10 @@ export const ensureAuth = async (props) => {
             if (result) {
                 props.apiKey = result.apiKey;
                 props.apiClient = result.apiClient;
+                setAuthContext({
+                    source: "stored-credentials",
+                    configDir: props.configDir,
+                });
                 return;
             }
         }
@@ -189,6 +198,10 @@ export const ensureAuth = async (props) => {
         apiKey,
         apiHost: props.apiHost,
     });
+    setAuthContext({
+        source: "stored-credentials",
+        configDir: props.configDir,
+    });
 };
 /**
  * Deletes the credentials file at the specified path

package/dist/index.js

@@ -4,6 +4,7 @@ import { hideBin } from "yargs/helpers";
 import { analyticsMiddleware, closeAnalytics, getAnalyticsEventProperties, initAnalyticsClientMiddleware, sendError, trackEvent, } from "./analytics.js";
 import { isNeonApiError, messageFromBody } from "./api.js";
 import { defaultClientID } from "./auth.js";
+import { credentialsToClearOn401, getAuthContext } from "./auth_context.js";
 import { deleteCredentials, ensureAuth } from "./commands/auth.js";
 import commands from "./commands/index.js";
 import { defaultDir, ensureConfigDir } from "./config.js";
@@ -175,9 +176,17 @@ async function handleError(msg, err) {
         }
         else if (err.status === 401) {
             sendError(err, "AUTH_FAILED");
+            const configDir = credentialsToClearOn401(getAuthContext());
+            // The request was authorized with a key the user supplied, so there
+            // is nothing of ours to clear and nothing to retry — the same key
+            // would just be rejected again.
+            if (configDir === null) {
+                log.error("Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.");
+                return false;
+            }
             log.info("Authentication failed, deleting credentials...");
             try {
-                deleteCredentials(defaultDir);
+                deleteCredentials(configDir);
                 return true; // Allow retry for auth failures
             }
             catch (deleteErr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.37.1",
+  "version": "2.38.1",
   "description": "CLI tool for Neon Serverless Postgres",
   "keywords": [
     "neon",
@@ -21,8 +21,13 @@
   },
   "type": "module",
   "main": "dist/index.js",
+  "exports": {
+    ".": "./dist/index.js",
+    "./cli": "./dist/cli.js",
+    "./dist/*": "./dist/*",
+    "./package.json": "./package.json"
+  },
   "bin": {
-    "neonctl": "dist/cli.js",
     "neon": "dist/cli.js"
   },
   "files": [
@@ -42,7 +47,7 @@
     "cliui": "8.0.1",
     "diff": "5.2.0",
     "fflate": "^0.8.3",
-    "neon-init": "0.20.2",
+    "neon-init": "0.20.3",
     "open": "^10.2.0",
     "openid-client": "6.8.1",
     "pg-protocol": "^1.14.0",
@@ -53,8 +58,8 @@
     "yargs": "17.7.2",
     "@neon/sdk": "1.3.0",
     "@neon/config": "0.10.0",
-    "@neon/config-runtime": "0.10.0",
-    "@neon/env": "0.11.8"
+    "@neon/env": "0.11.8",
+    "@neon/config-runtime": "0.10.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"
@@ -83,7 +88,8 @@
     "strip-ansi": "7.1.0",
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
-    "vitest": "^3.0.9"
+    "vitest": "^3.0.9",
+    "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -113,6 +119,7 @@
     "lint:fix": "pnpm typecheck && biome check src --write",
     "test": "pnpm --filter neonctl... build && vitest run",
     "test:ci": "pnpm build && vitest run",
+    "test:e2e": "pnpm build && vitest run --config vitest.e2e.config.ts",
     "test:conformance": "vitest run --config tests/psql-conformance/vitest.config.ts"
   }
 }