neon 2.38.1 → 2.38.4

package/dist/commands/env.js

@@ -82,7 +82,7 @@ export const pull = async (props, opts = {}) => {
     // Reuse `neon dev`'s tiered resolver (neon.ts policy -> plan gate -> fetchEnv, else
     // pullConfig -> fetchEnv). Unlike dev, an unresolved context or failure is surfaced —
     // `env pull` is an explicit action, so it should error rather than write nothing.
-    const vars = await resolveNeonEnvVars({
+    const { vars, credential } = await resolveNeonEnvVars({
         cwd,
         projectId: props.projectId,
         branchId,
@@ -107,6 +107,15 @@ export const pull = async (props, opts = {}) => {
     if (removed.length > 0) {
         log.info("Removed %d stale Neon variable%s not enabled on this branch: %s", removed.length, removed.length === 1 ? "" : "s", removed.join(", "));
     }
+    // A new credential means the values that back object storage / the AI Gateway just
+    // changed, so anything else holding the old ones (a deployed preview, a second checkout)
+    // needs the new values. Name the keys rather than leaving the user to diff the file.
+    if (credential?.issued) {
+        log.info("Issued a new branch credential — these now hold fresh values: %s", credential.keys.join(", "));
+        if (credential.revoked.length > 0) {
+            log.info("Revoked the credential it replaced (%s).", credential.revoked.join(", "));
+        }
+    }
     // A dotenv file *we* create holds live branch credentials (DATABASE_URL, Auth keys, service
     // tokens), so ignore it the same way the `.neon` context file is — otherwise a fresh repo is
     // one `git add -A` away from committing them. Only on creation: re-adding the entry on every
@@ -128,7 +137,12 @@ export const pull = async (props, opts = {}) => {
             gateway: { baseUrl: gatewayBaseUrl, token: gatewayToken },
         });
     }
-    return { status: "written", written, file: targetPath };
+    return {
+        status: "written",
+        written,
+        file: targetPath,
+        ...(credential && credential.keys.length > 0 ? { credential } : {}),
+    };
 };
 /**
  * Pull a freshly-pinned branch's Neon env vars into a local `.env`, bundled into `link` and
@@ -162,8 +176,14 @@ export const autoPullEnvAfterPin = async (props) => {
  */
 export const renderAgentPullNote = (result) => {
     switch (result.status) {
-        case "written":
-            return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.`;
+        case "written": {
+            // Call out a re-issued credential: an agent that already wrote the old storage /
+            // gateway values somewhere else has to update them.
+            const credential = result.credential?.issued
+                ? ` Issued a new branch credential, so ${result.credential.keys.join(", ")} changed.`
+                : "";
+            return ` Pulled ${result.written.length} Neon env var${result.written.length === 1 ? "" : "s"} into ${result.file}.${credential}`;
+        }
         case "empty":
             return " No Neon env vars to pull for this branch yet.";
         case "skipped":

package/dist/dev/env.js

@@ -1,6 +1,6 @@
 import { loadConfigFromFile } from "@neon/config";
 import { plan, pullConfig } from "@neon/config-runtime";
-import { fetchEnv, toEntries } from "@neon/env";
+import { fetchEnvReusingSecrets, } from "@neon/env/runtime";
 import { log } from "../log.js";
 /** The API-targeting options every runtime call forwards from the context. */
 const apiOptions = (ctx) => ({
@@ -102,7 +102,8 @@ export const resolveNeonEnvVars = async (ctx) => {
  */
 export const resolveDevEnv = async (ctx) => {
     try {
-        return { vars: await resolveNeonEnvVars(ctx) };
+        const { vars, credential } = await resolveNeonEnvVars(ctx);
+        return { vars, credential };
     }
     catch (err) {
         if (err instanceof DevEnvMismatchError)
@@ -178,15 +179,12 @@ const assertPolicyMatchesBranch = async (config, ctx) => {
 const isMissingResource = (change) => change.kind === "service" &&
     change.action === "create" &&
     !change.identifier.startsWith("function:");
-const fetchAndProject = async (config, ctx) => {
-    const env = await fetchEnv(config, {
-        projectId: ctx.projectId,
-        branch: ctx.branchId,
-        ...apiOptions(ctx),
-        ...(ctx.env ? { env: ctx.env } : {}),
-    });
-    return toEntries(env);
-};
+const fetchAndProject = async (config, ctx) => fetchEnvReusingSecrets(config, {
+    projectId: ctx.projectId,
+    branch: ctx.branchId,
+    ...apiOptions(ctx),
+    ...(ctx.env ? { env: ctx.env } : {}),
+});
 /**
  * Load a `neon.ts` policy if one exists on the path from `cwd` up to the repo
  * root. Returns `null` when there is none (the common "no config" case), and

package/dist/index.js

@@ -13,7 +13,7 @@ import { isNetworkError, matchErrorCode, NETWORK_ERROR_MESSAGE, } from "./errors
 import { showHelp } from "./help.js";
 import { log } from "./log.js";
 import pkg from "./pkg.js";
-import { fillInArgs } from "./utils/middlewares.js";
+import { fillInArgs, resolveApiKeyFromEnv } from "./utils/middlewares.js";
 const NO_SUBCOMMANDS_VERBS = [
     // `api <path>` has a handler but no subcommands (like `status`), so the
     // help-fallback middleware must not intercept a bare `neon api /projects`.
@@ -91,7 +91,12 @@ builder = builder
         describe: "API key",
         group: "Global options:",
         type: "string",
-        default: process.env.NEON_API_KEY ?? "",
+        // The default must never be the value of NEON_API_KEY: yargs renders an
+        // option's default into every help screen, so that printed the user's key
+        // verbatim on `neon --help`. `resolveApiKeyFromEnv` reads the env var
+        // instead, and `defaultDescription` names it in help without its value.
+        default: "",
+        defaultDescription: "NEON_API_KEY",
     },
     apiClient: {
         hidden: true,
@@ -119,6 +124,7 @@ builder = builder
     .middleware((args) => {
     fillInArgs(args);
 }, true)
+    .middleware(resolveApiKeyFromEnv, true)
     .middleware(initAnalyticsClientMiddleware, true)
     .help(false)
     .group("help", "Global options:")

package/dist/utils/middlewares.js

@@ -1,3 +1,18 @@
+/**
+ * Resolves `--api-key` from `NEON_API_KEY` when the flag is absent, leaving it an
+ * empty string when neither is set.
+ *
+ * This cannot be expressed as the option's yargs `default`, because yargs prints
+ * defaults in help output and would print the key itself.
+ */
+export const resolveApiKeyFromEnv = (args) => {
+    if (typeof args.apiKey === "string" && args.apiKey !== "") {
+        return;
+    }
+    const fromEnv = process.env.NEON_API_KEY ?? "";
+    args.apiKey = fromEnv;
+    args["api-key"] = fromEnv;
+};
 /**
  * This middleware is needed to fill in the args for nested objects,
  * so that required arguments would work

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.38.1",
+  "version": "2.38.4",
   "description": "CLI tool for Neon Serverless Postgres",
   "keywords": [
     "neon",
@@ -56,10 +56,10 @@
     "which": "3.0.1",
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
-    "@neon/sdk": "1.3.0",
-    "@neon/config": "0.10.0",
-    "@neon/env": "0.11.8",
-    "@neon/config-runtime": "0.10.0"
+    "@neon/config": "0.10.1",
+    "@neon/config-runtime": "0.10.1",
+    "@neon/env": "0.12.1",
+    "@neon/sdk": "1.4.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"