neon 2.38.0 → 2.38.2

package/dist/auth_context.js

@@ -0,0 +1,16 @@
+let current = null;
+export const setAuthContext = (context) => {
+    current = context;
+};
+export const getAuthContext = () => current;
+/**
+ * The config directory whose credentials a 401 should clear, or `null` to leave
+ * stored credentials alone.
+ *
+ * An API key passed on the command line never touches the stored OAuth token,
+ * so a 401 on that key says nothing about whether the stored credentials are
+ * still good — clearing them would sign the user out of an account the failed
+ * request never used. The directory comes from the context rather than the
+ * default so that `--config-dir` isolates the deletion too.
+ */
+export const credentialsToClearOn401 = (context) => context?.source === "stored-credentials" ? context.configDir : null;

package/dist/commands/auth.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getApiClient } from "../api.js";
 import { auth, refreshToken } from "../auth.js";
+import { setAuthContext } from "../auth_context.js";
 import { CREDENTIALS_FILE } from "../config.js";
 import { isConfigInit, isCurrentBranchProbe } from "../context.js";
 import { isCi } from "../env.js";
@@ -129,6 +130,10 @@ export const ensureAuth = async (props) => {
     if (props.apiKey || props._[0] === "auth") {
         if (props.apiKey) {
             log.debug("Using an API key to authorize requests");
+            setAuthContext({
+                source: "api-key",
+                configDir: props.configDir,
+            });
         }
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
@@ -149,6 +154,10 @@ export const ensureAuth = async (props) => {
             if (result) {
                 props.apiKey = result.apiKey;
                 props.apiClient = result.apiClient;
+                setAuthContext({
+                    source: "stored-credentials",
+                    configDir: props.configDir,
+                });
                 return;
             }
         }
@@ -189,6 +198,10 @@ export const ensureAuth = async (props) => {
         apiKey,
         apiHost: props.apiHost,
     });
+    setAuthContext({
+        source: "stored-credentials",
+        configDir: props.configDir,
+    });
 };
 /**
  * Deletes the credentials file at the specified path

package/dist/commands/env.js

@@ -82,7 +82,7 @@ export const pull = async (props, opts = {}) => {
     // Reuse `neon dev`'s tiered resolver (neon.ts policy -> plan gate -> fetchEnv, else
     // pullConfig -> fetchEnv). Unlike dev, an unresolved context or failure is surfaced —
     // `env pull` is an explicit action, so it should error rather than write nothing.
-    const vars = await resolveNeonEnvVars({
+    const { vars, credential } = await resolveNeonEnvVars({
         cwd,
         projectId: props.projectId,
         branchId,
@@ -107,6 +107,15 @@ export const pull = async (props, opts = {}) => {
     if (removed.length > 0) {
         log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
     }
+    // A new credential means the values that back object storage / the AI Gateway just
+    // changed, so anything else holding the old ones (a deployed preview, a second checkout)
+    // needs the new values. Name the keys rather than leaving the user to diff the file.
+    if (credential?.issued) {
+        log.info("Issued a new branch credential — these now hold fresh values: %s", credential.keys.join(", "));
+        if (credential.revoked.length > 0) {
+            log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
+        }
+    }
     // A dotenv file *we* create holds live branch credentials (DATABASE_URL, Auth keys, service
     // tokens), so ignore it the same way the `.neon` context file is — otherwise a fresh repo is
     // one `git add -A` away from committing them. Only on creation: re-adding the entry on every
@@ -128,7 +137,12 @@ export const pull = async (props, opts = {}) => {
             gateway: { baseUrl: gatewayBaseUrl, token: gatewayToken },
         });
     }
-    return { status: "written", written, file: targetPath };
+    return {
+        status: "written",
+        written,
+        file: targetPath,
+        ...(credential && credential.keys.length > 0 ? { credential } : {}),
+    };
 };
 /**
  * Pull a freshly-pinned branch's Neon env vars into a local `.env`, bundled into `link` and
@@ -162,8 +176,14 @@ export const autoPullEnvAfterPin = async (props) => {
  */
 export const renderAgentPullNote = (result) => {
     switch (result.status) {
-        case "written":
-            return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.`;
+        case "written": {
+            // Call out a re-issued credential: an agent that already wrote the old storage /
+            // gateway values somewhere else has to update them.
+            const credential = result.credential?.issued
+                ? ` Issued a new branch credential, so ${result.credential.keys.join(", ")} changed.`
+                : "";
+            return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.${credential}`;
+        }
         case "empty":
             return " No Neon env vars to pull for this branch yet.";
         case "skipped":

package/dist/dev/env.js

@@ -1,6 +1,6 @@
 import { loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
-import { fetchEnv, toEntries } from "@neon/env";
+import { fetchEnvReusingSecrets, } from "@neon/env/runtime";
 import { log } from "../log.js";
 /** The API-targeting options every runtime call forwards from the context. */
 const apiOptions = (ctx) => ({
@@ -102,7 +102,8 @@ export const resolveNeonEnvVars = async (ctx) => {
  */
 export const resolveDevEnv = async (ctx) => {
     try {
-        return { vars: await resolveNeonEnvVars(ctx) };
+        const { vars, credential } = await resolveNeonEnvVars(ctx);
+        return { vars, credential };
     }
     catch (err) {
         if (err instanceof DevEnvMismatchError)
@@ -178,15 +179,12 @@ const assertPolicyMatchesBranch = async (config, ctx) => {
 const isMissingResource = (change) => change.kind === "service" &&
     change.action === "create" &&
     !change.identifier.startsWith("function:");
-const fetchAndProject = async (config, ctx) => {
-    const env = await fetchEnv(config, {
-        projectId: ctx.projectId,
-        branch: ctx.branchId,
-        ...apiOptions(ctx),
-        ...(ctx.env ? { env: ctx.env } : {}),
-    });
-    return toEntries(env);
-};
+const fetchAndProject = async (config, ctx) => fetchEnvReusingSecrets(config, {
+    projectId: ctx.projectId,
+    branch: ctx.branchId,
+    ...apiOptions(ctx),
+    ...(ctx.env ? { env: ctx.env } : {}),
+});
 /**
  * Load a `neon.ts` policy if one exists on the path from `cwd` up to the repo
  * root. Returns `null` when there is none (the common "no config" case), and

package/dist/index.js

@@ -4,6 +4,7 @@ import { hideBin } from "yargs/helpers";
 import { analyticsMiddleware, closeAnalytics, getAnalyticsEventProperties, initAnalyticsClientMiddleware, sendError, trackEvent, } from "./analytics.js";
 import { isNeonApiError, messageFromBody } from "./api.js";
 import { defaultClientID } from "./auth.js";
+import { credentialsToClearOn401, getAuthContext } from "./auth_context.js";
 import { deleteCredentials, ensureAuth } from "./commands/auth.js";
 import commands from "./commands/index.js";
 import { defaultDir, ensureConfigDir } from "./config.js";
@@ -175,9 +176,17 @@ async function handleError(msg, err) {
         }
         else if (err.status === 401) {
             sendError(err, "AUTH_FAILED");
+            const configDir = credentialsToClearOn401(getAuthContext());
+            // The request was authorized with a key the user supplied, so there
+            // is nothing of ours to clear and nothing to retry — the same key
+            // would just be rejected again.
+            if (configDir === null) {
+                log.error("Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.");
+                return false;
+            }
             log.info("Authentication failed, deleting credentials...");
             try {
-                deleteCredentials(defaultDir);
+                deleteCredentials(configDir);
                 return true; // Allow retry for auth failures
             }
             catch (deleteErr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.38.0",
+  "version": "2.38.2",
   "description": "CLI tool for Neon Serverless Postgres",
   "keywords": [
     "neon",
@@ -47,7 +47,7 @@
     "cliui": "8.0.1",
     "diff": "5.2.0",
     "fflate": "^0.8.3",
-    "neon-init": "0.20.2",
+    "neon-init": "0.20.3",
     "open": "^10.2.0",
     "openid-client": "6.8.1",
     "pg-protocol": "^1.14.0",
@@ -59,7 +59,7 @@
     "@neon/sdk": "1.3.0",
     "@neon/config": "0.10.0",
     "@neon/config-runtime": "0.10.0",
-    "@neon/env": "0.11.8"
+    "@neon/env": "0.12.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"
@@ -88,7 +88,8 @@
     "strip-ansi": "7.1.0",
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
-    "vitest": "^3.0.9"
+    "vitest": "^3.0.9",
+    "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -118,6 +119,7 @@
     "lint:fix": "pnpm typecheck && biome check src --write",
     "test": "pnpm --filter neonctl... build && vitest run",
     "test:ci": "pnpm build && vitest run",
+    "test:e2e": "pnpm build && vitest run --config vitest.e2e.config.ts",
     "test:conformance": "vitest run --config tests/psql-conformance/vitest.config.ts"
   }
 }