neon 2.38.0 → 2.38.1

package/dist/auth_context.js

@@ -0,0 +1,16 @@
+let current = null;
+export const setAuthContext = (context) => {
+    current = context;
+};
+export const getAuthContext = () => current;
+/**
+ * The config directory whose credentials a 401 should clear, or `null` to leave
+ * stored credentials alone.
+ *
+ * An API key passed on the command line never touches the stored OAuth token,
+ * so a 401 on that key says nothing about whether the stored credentials are
+ * still good — clearing them would sign the user out of an account the failed
+ * request never used. The directory comes from the context rather than the
+ * default so that `--config-dir` isolates the deletion too.
+ */
+export const credentialsToClearOn401 = (context) => context?.source === "stored-credentials" ? context.configDir : null;

package/dist/commands/auth.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getApiClient } from "../api.js";
 import { auth, refreshToken } from "../auth.js";
+import { setAuthContext } from "../auth_context.js";
 import { CREDENTIALS_FILE } from "../config.js";
 import { isConfigInit, isCurrentBranchProbe } from "../context.js";
 import { isCi } from "../env.js";
@@ -129,6 +130,10 @@ export const ensureAuth = async (props) => {
     if (props.apiKey || props._[0] === "auth") {
         if (props.apiKey) {
             log.debug("Using an API key to authorize requests");
+            setAuthContext({
+                source: "api-key",
+                configDir: props.configDir,
+            });
         }
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
@@ -149,6 +154,10 @@ export const ensureAuth = async (props) => {
             if (result) {
                 props.apiKey = result.apiKey;
                 props.apiClient = result.apiClient;
+                setAuthContext({
+                    source: "stored-credentials",
+                    configDir: props.configDir,
+                });
                 return;
             }
         }
@@ -189,6 +198,10 @@ export const ensureAuth = async (props) => {
         apiKey,
         apiHost: props.apiHost,
     });
+    setAuthContext({
+        source: "stored-credentials",
+        configDir: props.configDir,
+    });
 };
 /**
  * Deletes the credentials file at the specified path

package/dist/index.js

@@ -4,6 +4,7 @@ import { hideBin } from "yargs/helpers";
 import { analyticsMiddleware, closeAnalytics, getAnalyticsEventProperties, initAnalyticsClientMiddleware, sendError, trackEvent, } from "./analytics.js";
 import { isNeonApiError, messageFromBody } from "./api.js";
 import { defaultClientID } from "./auth.js";
+import { credentialsToClearOn401, getAuthContext } from "./auth_context.js";
 import { deleteCredentials, ensureAuth } from "./commands/auth.js";
 import commands from "./commands/index.js";
 import { defaultDir, ensureConfigDir } from "./config.js";
@@ -175,9 +176,17 @@ async function handleError(msg, err) {
         }
         else if (err.status === 401) {
             sendError(err, "AUTH_FAILED");
+            const configDir = credentialsToClearOn401(getAuthContext());
+            // The request was authorized with a key the user supplied, so there
+            // is nothing of ours to clear and nothing to retry — the same key
+            // would just be rejected again.
+            if (configDir === null) {
+                log.error("Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.");
+                return false;
+            }
             log.info("Authentication failed, deleting credentials...");
             try {
-                deleteCredentials(defaultDir);
+                deleteCredentials(configDir);
                 return true; // Allow retry for auth failures
             }
             catch (deleteErr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.38.0",
+  "version": "2.38.1",
   "description": "CLI tool for Neon Serverless Postgres",
   "keywords": [
     "neon",
@@ -47,7 +47,7 @@
     "cliui": "8.0.1",
     "diff": "5.2.0",
     "fflate": "^0.8.3",
-    "neon-init": "0.20.2",
+    "neon-init": "0.20.3",
     "open": "^10.2.0",
     "openid-client": "6.8.1",
     "pg-protocol": "^1.14.0",
@@ -58,8 +58,8 @@
     "yargs": "17.7.2",
     "@neon/sdk": "1.3.0",
     "@neon/config": "0.10.0",
-    "@neon/config-runtime": "0.10.0",
-    "@neon/env": "0.11.8"
+    "@neon/env": "0.11.8",
+    "@neon/config-runtime": "0.10.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"
@@ -88,7 +88,8 @@
     "strip-ansi": "7.1.0",
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
-    "vitest": "^3.0.9"
+    "vitest": "^3.0.9",
+    "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -118,6 +119,7 @@
     "lint:fix": "pnpm typecheck && biome check src --write",
     "test": "pnpm --filter neonctl... build && vitest run",
     "test:ci": "pnpm build && vitest run",
+    "test:e2e": "pnpm build && vitest run --config vitest.e2e.config.ts",
     "test:conformance": "vitest run --config tests/psql-conformance/vitest.config.ts"
   }
 }