neon 2.43.0 → 2.45.0

package/dist/config.js

@@ -1,27 +1,6 @@
 import { existsSync, mkdirSync } from "node:fs";
-import { configDir, resolveConfigFile } from "@neon/config/paths";
 import { isCi } from "./env.js";
-export const CREDENTIALS_FILE = "credentials.json";
-/**
- * Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
- *
- * The directory was called `neonctl` until the CLI was renamed. An existing one is still
- * read — see {@link credentialsPath} — but it is never written to, moved, or deleted.
- */
-export const defaultDir = configDir();
-/**
- * Where this invocation's `credentials.json` lives.
- *
- * When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
- * directory is used **in place**: an install that predates the rename keeps working, and
- * its credentials are never duplicated into a second location where one copy could go
- * stale while another tool still reads it.
- *
- * A `--config-dir` the user actually passed is used exactly as given. Falling back out of
- * an explicitly chosen directory would defeat the reason for choosing it — a CI run
- * pointed at a scratch directory must never pick up a developer's real credentials.
- */
-export const credentialsPath = (dir) => resolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;
+export { CREDENTIALS_FILE, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath, } from "./_shared/paths.js";
 export const ensureConfigDir = ({ "config-dir": configDirArg, "force-auth": forceAuth, }) => {
     if (!existsSync(configDirArg) && (!isCi() || forceAuth)) {
         mkdirSync(configDirArg, { recursive: true });

package/dist/context.js

@@ -128,6 +128,13 @@ export const enrichFromContext = (args) => {
     if (isApiKeysCommand(args)) {
         return;
     }
+    // `profile create --mint` mints one too, and for the same reason must take its scope only
+    // from what was typed: enriched here, running it inside a linked directory would quietly
+    // produce a key scoped to that project rather than the account or organization asked for.
+    // No `profile` subcommand has any use for a project or branch.
+    if (isProfileCommand(args)) {
+        return;
+    }
     const context = readContextFile(args.contextFile);
     if (!args.orgId) {
         args.orgId = context.orgId;

package/dist/dev/runtime.js

@@ -2,6 +2,7 @@ import { createServer } from "node:http";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { getRequestListener } from "@hono/node-server";
+import { createUpgradeListener, installWebSocketBridge, } from "./websocket.js";
 const isFunction = (value) => typeof value === "function";
 const hasFetchMethod = (value) => typeof value === "object" &&
     value !== null &&
@@ -27,6 +28,30 @@ export const resolveFetchHandler = (mod) => {
         "  export default { fetch(req) { /* ... */ } }\n" +
         "  export default function (req) { /* ... */ }");
 };
+const hasUpgradeMethod = (value) => typeof value === "object" &&
+    value !== null &&
+    "upgrade" in value &&
+    typeof value.upgrade === "function";
+/**
+ * Resolve the user's optional WebSocket entrypoint: a named `export function upgrade`,
+ * or an `upgrade` method on the default export. `undefined` when the module has
+ * neither, which is the common case — a function without one either uses
+ * `upgradeWebSocket()` inside `fetch` or serves no WebSockets at all.
+ *
+ * Resolution order matches the deployed runtime exactly (named export first, then the
+ * default-export method), so a module that resolves one way locally cannot resolve the
+ * other way once deployed.
+ */
+export const resolveUpgradeHandler = (mod) => {
+    if (typeof mod.upgrade === "function")
+        return mod.upgrade;
+    const defaultExport = mod.default;
+    if (hasUpgradeMethod(defaultExport)) {
+        const target = defaultExport;
+        return (req, socket, head) => target.upgrade(req, socket, head);
+    }
+    return undefined;
+};
 /**
  * Wrap a fetch handler so user errors become a 500 response (with the message
  * in the body during dev) instead of crashing the child process.
@@ -87,11 +112,30 @@ const listen = (server, port, hostname) => new Promise((resolveListen, rejectLis
 export const startRuntime = async ({ source, port, hostname, }) => {
     const absoluteSource = resolve(process.cwd(), source);
     const mod = (await import(pathToFileURL(absoluteSource).href));
-    const handler = withErrorBoundary(resolveFetchHandler(mod));
+    const fetchHandler = resolveFetchHandler(mod);
+    const handler = withErrorBoundary(fetchHandler);
+    // Publish the bridge `upgradeWebSocket()` reads before the user module can serve a
+    // request, so the helper resolves locally exactly as it does when deployed.
+    installWebSocketBridge();
     const listener = getRequestListener(handler, { hostname });
     const server = createServer((incoming, outgoing) => {
         void listener(incoming, outgoing);
     });
+    // Node emits 'upgrade' rather than 'request' for a WebSocket handshake. Without
+    // this listener Node hands the handshake to the ordinary request handler, which
+    // answers 200 on a connection the client expects to be a 101 — so a function's
+    // WebSocket code silently never ran under `neon dev`.
+    //
+    // The upgrade path takes the RAW handler, not the error-boundary-wrapped one. The
+    // boundary turns a throw into a 500 Response, which on this path is
+    // indistinguishable from a handler that deliberately declined the upgrade — so a
+    // crashing handler would answer 501 ("no WebSocket support") instead of surfacing
+    // the error. The upgrade listener has its own equivalent boundary, and reports a
+    // throw as the 502 the deployed runtime returns.
+    server.on("upgrade", createUpgradeListener({
+        fetch: fetchHandler,
+        upgrade: resolveUpgradeHandler(mod),
+    }));
     const boundPort = await bindPort(server, port, hostname);
     process.stdout.write(`neon-dev:ready ${boundPort}\n`);
     return boundPort;