neon 2.42.0 → 2.44.0

package/dist/config.js

@@ -1,27 +1,6 @@
 import { existsSync, mkdirSync } from "node:fs";
-import { configDir, resolveConfigFile } from "@neon/config/paths";
 import { isCi } from "./env.js";
-export const CREDENTIALS_FILE = "credentials.json";
-/**
- * Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
- *
- * The directory was called `neonctl` until the CLI was renamed. An existing one is still
- * read — see {@link credentialsPath} — but it is never written to, moved, or deleted.
- */
-export const defaultDir = configDir();
-/**
- * Where this invocation's `credentials.json` lives.
- *
- * When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
- * directory is used **in place**: an install that predates the rename keeps working, and
- * its credentials are never duplicated into a second location where one copy could go
- * stale while another tool still reads it.
- *
- * A `--config-dir` the user actually passed is used exactly as given. Falling back out of
- * an explicitly chosen directory would defeat the reason for choosing it — a CI run
- * pointed at a scratch directory must never pick up a developer's real credentials.
- */
-export const credentialsPath = (dir) => resolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;
+export { CREDENTIALS_FILE, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath, } from "./_shared/paths.js";
 export const ensureConfigDir = ({ "config-dir": configDirArg, "force-auth": forceAuth, }) => {
     if (!existsSync(configDirArg) && (!isCi() || forceAuth)) {
         mkdirSync(configDirArg, { recursive: true });

package/dist/context.js

@@ -49,6 +49,11 @@ export const isConfigInit = (args) => args._[0] === "config" &&
  * access has already lapsed is the main reason to remove one.
  */
 export const isProfileCommand = (args) => args._[0] === "profile" || args._[0] === "profiles";
+/**
+ * `neon api-keys …`, under either spelling. Exempts the group from context enrichment: how
+ * far a credential reaches must come from an explicit flag, never from `.neon`.
+ */
+export const isApiKeysCommand = (args) => args._[0] === "api-keys" || args._[0] === "api-key";
 const CONTEXT_FILE = ".neon";
 const GITIGNORE_FILE = ".gitignore";
 const canAccessFile = (file) => {
@@ -116,6 +121,20 @@ export const enrichFromContext = (args) => {
     if (args._[0] === "link" || args._[0] === "set-context") {
         return;
     }
+    // `api-keys` mints credentials, and how far a credential reaches must be something the
+    // user typed — never something inherited from whichever project happens to be checked
+    // out. Enriched here, `api-keys create --name ci` in a linked directory would quietly
+    // produce a key scoped to that project instead of the account key it asked for.
+    if (isApiKeysCommand(args)) {
+        return;
+    }
+    // `profile create --mint` mints one too, and for the same reason must take its scope only
+    // from what was typed: enriched here, running it inside a linked directory would quietly
+    // produce a key scoped to that project rather than the account or organization asked for.
+    // No `profile` subcommand has any use for a project or branch.
+    if (isProfileCommand(args)) {
+        return;
+    }
     const context = readContextFile(args.contextFile);
     if (!args.orgId) {
         args.orgId = context.orgId;

package/dist/index.js

@@ -4,8 +4,8 @@ import { hideBin } from "yargs/helpers";
 import { analyticsMiddleware, closeAnalytics, getAnalyticsEventProperties, initAnalyticsClientMiddleware, sendError, trackEvent, } from "./analytics.js";
 import { isNeonApiError, messageFromBody } from "./api.js";
 import { defaultClientID } from "./auth.js";
-import { credentialsToClearOn401, getAuthContext } from "./auth_context.js";
-import { deleteCredentials, ensureAuth } from "./commands/auth.js";
+import { authFailureMessage, credentialsToClearOn401, getAuthContext, } from "./auth_context.js";
+import { deleteCredentialsAt, ensureAuth } from "./commands/auth.js";
 import commands from "./commands/index.js";
 import { defaultDir, ensureConfigDir } from "./config.js";
 import { currentContextFile, enrichFromContext } from "./context.js";
@@ -96,6 +96,10 @@ builder = builder
         describe: "API key",
         group: "Global options:",
         type: "string",
+        // Take the next token as the value even when it looks like an option, so
+        // `--api-key -` binds the dash rather than being read as a command of its own.
+        // `profile create` gives `-` its meaning; everywhere else it is just a value.
+        nargs: 1,
         // The default must never be the value of NEON_API_KEY: yargs renders an
         // option's default into every help screen, so that printed the user's key
         // verbatim on `neon --help`. `resolveApiKeyFromEnv` reads the env var
@@ -187,17 +191,20 @@ async function handleError(msg, err) {
         }
         else if (err.status === 401) {
             sendError(err, "AUTH_FAILED");
-            const configDir = credentialsToClearOn401(getAuthContext());
-            // The request was authorized with a key the user supplied, so there
-            // is nothing of ours to clear and nothing to retry — the same key
-            // would just be rejected again.
-            if (configDir === null) {
-                log.error("Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.");
+            const context = getAuthContext();
+            const staleCredentials = credentialsToClearOn401(context);
+            // The request was authorized with a key rather than a refreshable token — one the
+            // user supplied, or one stored in a profile. Either way there is nothing to clear
+            // and nothing to retry, since the same key would just be rejected again. Deleting
+            // a profile's key would destroy the only copy of a credential that cannot be
+            // refreshed, so the message says what to re-run instead.
+            if (staleCredentials === null) {
+                log.error(authFailureMessage(context));
                 return false;
             }
             log.info("Authentication failed, deleting credentials...");
             try {
-                deleteCredentials(configDir);
+                deleteCredentialsAt(staleCredentials);
                 return true; // Allow retry for auth failures
             }
             catch (deleteErr) {

package/dist/profile_keys.js

@@ -0,0 +1,55 @@
+/**
+ * Helpers for the API-key half of a profile: naming a minted key, reading one off disk, and
+ * turning what the API says about a key into something displayable.
+ *
+ * Kept apart from `./commands/profile.ts` because these are the decisions worth testing
+ * directly — the command around them is prompts, an API client, and output.
+ */
+import { randomBytes } from "node:crypto";
+/** Auth methods that are an API key. Anything else is not a key and must not be stored as one. */
+const API_KEY_METHODS = ["api_key_user", "api_key_org"];
+export const isApiKeyMethod = (method) => API_KEY_METHODS.includes(method);
+/**
+ * A unique name for a key we mint, carrying the profile it belongs to, a UTC timestamp, and a
+ * random suffix.
+ *
+ * Neither part is decoration. Key names are unique per account and the key being replaced still
+ * holds its name while the replacement is minted, so a stable name fails the rotation outright
+ * with `choose another unique name for api key`.
+ *
+ * The random suffix is there because a timestamp alone is not enough: at second precision two
+ * rotations in the same second collide, which is easy to hit from a script and was hit while
+ * testing this. Going to milliseconds only narrows the window, so the name carries four random
+ * hex characters and the class of failure is gone rather than made less likely.
+ */
+export const mintedKeyName = (profile, now = new Date(), suffix = randomBytes(2).toString("hex")) => {
+    const stamp = now
+        .toISOString()
+        .replace(/[-:]/g, "")
+        .replace(/\.\d+Z$/, "Z");
+    return `neon-cli-${profile}-${stamp}-${suffix}`;
+};
+/**
+ * What to record about a validated key.
+ *
+ * An organization-scoped key has no user, and `GET /users/me` answers `404 not allowed for
+ * organization API keys` — so the account id is the only identity available, and asking for an
+ * email would turn a perfectly good key into a failed `profile create`. The id is returned bare
+ * rather than as "organization <id>": it already announces what it is through its `org-` prefix,
+ * and `list` shows the scope in the next column.
+ */
+export const identityFromAuthDetails = (details, email) => {
+    if (details.auth_method === "api_key_org") {
+        return { label: details.account_id };
+    }
+    return {
+        ...(email ? { label: email } : { label: details.account_id }),
+        ...(details.account_id ? { userId: details.account_id } : {}),
+    };
+};
+/**
+ * The message for a credential that authenticates but is not an API key — an OAuth access
+ * token pasted in by mistake, most likely. It would work until it expired, then fail with no
+ * way to refresh it, so it is refused at the point where the mistake is still obvious.
+ */
+export const notAnApiKeyMessage = (method) => `That credential authenticates as "${method}", not an API key. Create a key with \`neon api-keys create --name <name>\`, or have one minted with \`neon profile create <name> --mint\`.`;

package/dist/utils/flags.js

@@ -0,0 +1,52 @@
+/**
+ * Strict readers for flags whose value decides how much a credential can reach.
+ *
+ * These live apart from any one command because both `api-keys` and `profile create` mint
+ * keys, and a lenient reading of a scope flag has the same consequence in either: the flag
+ * reads as falsy, the scope check falls through, and an **account** key is minted instead of
+ * the narrow one that was asked for. Two copies of that check is one copy too many.
+ */
+/**
+ * A flag is either absent, or exactly one non-empty string. Anything else is an error.
+ *
+ * - `--org-id ""` — an unset shell variable; empty string, which is falsy.
+ * - `--no-org-id` — yargs boolean negation; `false`, which is falsy.
+ * - `--org-id a --org-id b` — an array, which would reach the API as `a,b`.
+ *
+ * A misspelled flag never binds and cannot be seen here; `.strict()` rejects it. Anything
+ * after a `--` terminator is handled by {@link noPassthrough}.
+ */
+export const single = (name, { required = false } = {}) => (value) => {
+    if (value === undefined)
+        return undefined;
+    if (Array.isArray(value)) {
+        throw new Error(`--${name} was given more than once. Pass it at most once.`);
+    }
+    // `--no-x` is the negation form and yields `false`, so name it rather than telling
+    // the user their value was empty when they never gave one.
+    if (value === false) {
+        throw new Error(required
+            ? `--no-${name} is not valid: --${name} is required.`
+            : `--no-${name} is not a valid way to skip --${name}. Omit the flag entirely.`);
+    }
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new Error(required
+            ? `--${name} needs a value.`
+            : `--${name} needs a value. Pass one, or omit the flag entirely.`);
+    }
+    return value;
+};
+/**
+ * Refuse arguments after a `--` terminator.
+ *
+ * The CLI sets `populate--`, so everything past `--` lands in `argv["--"]` where `.strict()`
+ * never looks — `create --name x -- --project-id p` would parse cleanly and mint an account
+ * key from a line that names the scope flag.
+ */
+export const noPassthrough = (command) => (argv) => {
+    const rest = argv["--"];
+    if (Array.isArray(rest) && rest.length > 0) {
+        throw new Error(`${command} takes no arguments after \`--\`, and options placed there are ignored rather than applied. Remove the \`--\`.`);
+    }
+    return true;
+};

package/dist/utils/middlewares.js

@@ -1,15 +1,29 @@
+import { recordCredentialInputs } from "../_shared/auth_selection.js";
 /**
  * Resolves `--api-key` from `NEON_API_KEY` when the flag is absent, leaving it an
  * empty string when neither is set.
  *
  * This cannot be expressed as the option's yargs `default`, because yargs prints
  * defaults in help output and would print the key itself.
+ *
+ * This is also the one place that reads the credential environment, and it records what it saw
+ * before folding anything together. Folding destroys the distinction the precedence rules turn
+ * on — `--api-key` outranks `--profile` and an exported `NEON_API_KEY` does not, but once both
+ * live in `args.apiKey` they are indistinguishable. The snapshot lives outside `args`
+ * deliberately: a hidden yargs option would be a second, undocumented way to pass a
+ * credential, and commands that call `.strict()` reject arguments the middleware invents.
  */
 export const resolveApiKeyFromEnv = (args) => {
-    if (typeof args.apiKey === "string" && args.apiKey !== "") {
+    const fromFlag = typeof args.apiKey === "string" ? args.apiKey : "";
+    const fromEnv = process.env.NEON_API_KEY ?? "";
+    recordCredentialInputs({
+        apiKeyFlag: fromFlag,
+        apiKeyEnv: fromEnv,
+        profileEnv: process.env.NEON_PROFILE ?? "",
+    });
+    if (fromFlag !== "") {
         return;
     }
-    const fromEnv = process.env.NEON_API_KEY ?? "";
     args.apiKey = fromEnv;
     args["api-key"] = fromEnv;
 };

package/dist/utils/package_manager.js

@@ -48,12 +48,19 @@ export const addDependenciesArgs = (pm, packages) => (pm === "npm" ? ["install",
  * exited cleanly; a non-zero exit is reported but never throws — the caller
  * decides whether to treat it as fatal.
  */
-export const runCommand = (cmd, args, cwd) => new Promise((resolvePromise) => {
+export const runCommand = (cmd, args, cwd, 
+/**
+ * Extra environment for the child. Anything secret belongs here rather than in `args`:
+ * arguments are visible to any process that can list processes, and both handlers below
+ * print the full argument list when the command fails.
+ */
+env) => new Promise((resolvePromise) => {
     // npm/pnpm/yarn ship as .cmd shims on Windows, which need a shell to run.
     const child = spawn(cmd, args, {
         cwd,
         stdio: "inherit",
         shell: process.platform === "win32",
+        ...(env ? { env: { ...process.env, ...env } } : {}),
     });
     child.on("error", (err) => {
         log.warning("Could not run `%s %s`: %s", cmd, args.join(" "), err instanceof Error ? err.message : String(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.42.0",
+  "version": "2.44.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -55,11 +55,11 @@
     "which": "3.0.1",
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
-    "@neon/sdk": "1.4.1",
-    "@neon/config": "0.13.1",
-    "@neon/config-runtime": "0.12.2",
-    "@neon/env": "0.13.2",
-    "neon-init": "0.20.6"
+    "@neon/config-runtime": "0.12.4",
+    "@neon/env": "0.14.0",
+    "@neon/sdk": "1.5.0",
+    "neon-init": "0.20.7",
+    "@neon/config": "0.14.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"
@@ -112,14 +112,14 @@
   "scripts": {
     "generateParams": "tsx generateOptionsFromSpec.ts",
     "clean": "rm -rf dist",
-    "build": "pnpm generateParams && pnpm clean && tsc -p tsconfig.build.json && cp src/*.html ./dist",
+    "build": "node ../../scripts/sync-shared.mjs . && pnpm generateParams && pnpm clean && tsc -p tsconfig.build.json && cp src/*.html ./dist",
     "bundle": "node pkg.js",
-    "typecheck": "tsc --noEmit",
-    "lint": "pnpm typecheck && biome check src",
+    "typecheck": "node ../../scripts/sync-shared.mjs . && tsc --noEmit",
+    "lint": "node ../../scripts/sync-shared.mjs . && pnpm typecheck && biome check src",
     "lint:fix": "pnpm typecheck && biome check src --write",
-    "test": "pnpm --filter neonctl... build && vitest run",
-    "test:ci": "pnpm build && vitest run",
-    "test:e2e": "pnpm build && vitest run --config vitest.e2e.config.ts",
-    "test:conformance": "vitest run --config tests/psql-conformance/vitest.config.ts"
+    "test": "node ../../scripts/sync-shared.mjs . && pnpm --filter neonctl... build && vitest run",
+    "test:ci": "node ../../scripts/sync-shared.mjs . && pnpm build && vitest run",
+    "test:e2e": "node ../../scripts/sync-shared.mjs . && pnpm build && vitest run --config vitest.e2e.config.ts",
+    "test:conformance": "node ../../scripts/sync-shared.mjs . && vitest run --config tests/psql-conformance/vitest.config.ts"
   }
 }