neon 2.38.1 → 2.38.2

package/dist/commands/env.js

@@ -82,7 +82,7 @@ export const pull = async (props, opts = {}) => {
     // Reuse `neon dev`'s tiered resolver (neon.ts policy -> plan gate -> fetchEnv, else
     // pullConfig -> fetchEnv). Unlike dev, an unresolved context or failure is surfaced —
     // `env pull` is an explicit action, so it should error rather than write nothing.
-    const vars = await resolveNeonEnvVars({
+    const { vars, credential } = await resolveNeonEnvVars({
         cwd,
         projectId: props.projectId,
         branchId,
@@ -107,6 +107,15 @@ export const pull = async (props, opts = {}) => {
     if (removed.length > 0) {
         log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
     }
+    // A new credential means the values that back object storage / the AI Gateway just
+    // changed, so anything else holding the old ones (a deployed preview, a second checkout)
+    // needs the new values. Name the keys rather than leaving the user to diff the file.
+    if (credential?.issued) {
+        log.info("Issued a new branch credential — these now hold fresh values: %s", credential.keys.join(", "));
+        if (credential.revoked.length > 0) {
+            log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
+        }
+    }
     // A dotenv file *we* create holds live branch credentials (DATABASE_URL, Auth keys, service
     // tokens), so ignore it the same way the `.neon` context file is — otherwise a fresh repo is
     // one `git add -A` away from committing them. Only on creation: re-adding the entry on every
@@ -128,7 +137,12 @@ export const pull = async (props, opts = {}) => {
             gateway: { baseUrl: gatewayBaseUrl, token: gatewayToken },
         });
     }
-    return { status: "written", written, file: targetPath };
+    return {
+        status: "written",
+        written,
+        file: targetPath,
+        ...(credential && credential.keys.length > 0 ? { credential } : {}),
+    };
 };
 /**
  * Pull a freshly-pinned branch's Neon env vars into a local `.env`, bundled into `link` and
@@ -162,8 +176,14 @@ export const autoPullEnvAfterPin = async (props) => {
  */
 export const renderAgentPullNote = (result) => {
     switch (result.status) {
-        case "written":
-            return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.`;
+        case "written": {
+            // Call out a re-issued credential: an agent that already wrote the old storage /
+            // gateway values somewhere else has to update them.
+            const credential = result.credential?.issued
+                ? ` Issued a new branch credential, so ${result.credential.keys.join(", ")} changed.`
+                : "";
+            return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.${credential}`;
+        }
         case "empty":
             return " No Neon env vars to pull for this branch yet.";
         case "skipped":

package/dist/dev/env.js

@@ -1,6 +1,6 @@
 import { loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
-import { fetchEnv, toEntries } from "@neon/env";
+import { fetchEnvReusingSecrets, } from "@neon/env/runtime";
 import { log } from "../log.js";
 /** The API-targeting options every runtime call forwards from the context. */
 const apiOptions = (ctx) => ({
@@ -102,7 +102,8 @@ export const resolveNeonEnvVars = async (ctx) => {
  */
 export const resolveDevEnv = async (ctx) => {
     try {
-        return { vars: await resolveNeonEnvVars(ctx) };
+        const { vars, credential } = await resolveNeonEnvVars(ctx);
+        return { vars, credential };
     }
     catch (err) {
         if (err instanceof DevEnvMismatchError)
@@ -178,15 +179,12 @@ const assertPolicyMatchesBranch = async (config, ctx) => {
 const isMissingResource = (change) => change.kind === "service" &&
     change.action === "create" &&
     !change.identifier.startsWith("function:");
-const fetchAndProject = async (config, ctx) => {
-    const env = await fetchEnv(config, {
-        projectId: ctx.projectId,
-        branch: ctx.branchId,
-        ...apiOptions(ctx),
-        ...(ctx.env ? { env: ctx.env } : {}),
-    });
-    return toEntries(env);
-};
+const fetchAndProject = async (config, ctx) => fetchEnvReusingSecrets(config, {
+    projectId: ctx.projectId,
+    branch: ctx.branchId,
+    ...apiOptions(ctx),
+    ...(ctx.env ? { env: ctx.env } : {}),
+});
 /**
  * Load a `neon.ts` policy if one exists on the path from `cwd` up to the repo
  * root. Returns `null` when there is none (the common "no config" case), and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.38.1",
+  "version": "2.38.2",
   "description": "CLI tool for Neon Serverless Postgres",
   "keywords": [
     "neon",
@@ -58,8 +58,8 @@
     "yargs": "17.7.2",
     "@neon/sdk": "1.3.0",
     "@neon/config": "0.10.0",
-    "@neon/env": "0.11.8",
-    "@neon/config-runtime": "0.10.0"
+    "@neon/config-runtime": "0.10.0",
+    "@neon/env": "0.12.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"