neon 3.0.0 → 3.1.0

package/dist/_shared/env-core/reuse-secrets.js

@@ -1,223 +1,179 @@
-import { credentialScopesSatisfied, } from "@neon/config/v1";
-import { createApiFromOptions, credentialEnvKeys, credentialName, fetchEnvKeys, NEON_ENV_VAR_KEYS, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries, } from "./env.js";
+import { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries } from "./env.js";
+import { credentialScopesSatisfied } from "@neon/config/v1";
+//#region src/_shared/env-core/reuse-secrets.ts
 /**
- * Resolve a branch's env while keeping one-time secrets the caller already holds.
- *
- * {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
- * credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
- * them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
- * pull` would leave a live credential behind each time. This is the wrapper that avoids that:
- * it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
- * for only the rest.
- *
- * The check is a real verification, not a presence test. A persisted secret is kept only when
- * it names a credential that still exists on this branch, is not revoked or expired, and
- * carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
- * the console, one copied in from another branch, or one predating a newly-enabled feature all
- * fail that check and get replaced.
- *
- * None of this needs local bookkeeping, because the secrets carry their own credential id:
- * `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
- * against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,
- * where `tokenIdShort` is what the credentials list reports. The env source being replaced is
- * the record of what the last call issued.
- *
- * ```ts
- * import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
- *
- * const { vars, credential } = await fetchEnvReusingSecrets(config, {
- *     projectId,
- *     branch: "main",
- *     env: { ...process.env, ...readEnvFile(".env") },
- * });
- * if (credential.issued) console.log(`new values for ${credential.keys.join(", ")}`);
- * ```
- */
-export async function fetchEnvReusingSecrets(config, options) {
-    const { env: source = process.env, revokeSuperseded = true, ...fetchOptions } = options;
-    const api = options.api ?? createApiFromOptions(options);
-    const { branch, desired } = await resolveBranchPolicy(config, options, api);
-    const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
-    const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
-    const secretKeys = credentialEnvKeys({
-        storage: storageEnabled,
-        aiGateway: gatewayEnabled,
-    });
-    // Nothing credential-backed on this branch, so there is nothing to preserve and no
-    // credential to spend: fetch everything and skip the credentials endpoint entirely.
-    if (secretKeys.length === 0) {
-        const fetched = await fetchEnvKeys(config, fetchOptions, null);
-        return {
-            vars: preferPersisted(toEntries(fetched), source),
-            credential: {
-                issued: false,
-                keys: [],
-                revoked: [],
-                superseded: [],
-            },
-        };
-    }
-    const persisted = readPersistedSecrets(source);
-    const complete = (!storageEnabled ||
-        Boolean(persisted.accessKeyId && persisted.secretAccessKey)) &&
-        (!gatewayEnabled || Boolean(persisted.apiToken));
-    // Look the persisted secrets up whenever there are any — not only when they're complete.
-    // An incomplete set still names the credential a newly-enabled feature is about to
-    // supersede (a storage-only credential on a branch that just gained the AI Gateway), and
-    // that one should be revoked rather than left live.
-    const named = persisted.accessKeyId !== "" || persisted.apiToken !== ""
-        ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted)
-        : { storage: null, gateway: null };
-    const reusable = complete
-        ? reusableCredential(named, { storageEnabled, gatewayEnabled })
-        : null;
-    const scopes = previewCredentialScopes(desired.preview);
-    const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-    // Ask for everything the policy produces, minus the secrets we're keeping — which is what
-    // stops `fetchEnv` from minting a credential it doesn't need.
-    const allKeys = policyEnvKeys(desired);
-    const fetchKeys = keep
-        ? allKeys.filter((key) => !secretKeys.includes(key))
-        : allKeys;
-    const fetched = await fetchEnvKeys(config, 
-    // Pass the resolved id so `fetchEnv` targets the same branch this call verified against,
-    // even if `options.branch` was a name that has since been reused.
-    { ...fetchOptions, branchId: branch.id, api }, fetchKeys);
-    const vars = preferPersisted(toEntries(fetched), source);
-    if (keep) {
-        for (const key of secretKeys) {
-            const value = source[key];
-            if (value !== undefined)
-                vars[key] = value;
-        }
-        return {
-            vars,
-            credential: {
-                issued: false,
-                keys: secretKeys,
-                revoked: [],
-                superseded: [],
-            },
-        };
-    }
-    // A replacement was minted, so revoke what it supersedes: the credentials the old secrets
-    // named, minus any this tool did not issue. Their secrets lived nowhere but the env source
-    // this call replaces, so revoking them strands nothing — and it keeps a branch from
-    // accumulating a live credential per call. Everything else on the branch is left alone: it
-    // may belong to a teammate, another checkout, or a deployed function, and nothing
-    // observable distinguishes those from an orphan of our own.
-    //
-    // Revoked *after* the fetch, so a failed fetch leaves the caller's existing secrets working.
-    const ours = new Set();
-    for (const meta of [named.storage, named.gateway]) {
-        if (meta !== null &&
-            meta.principalType === "user" &&
-            meta.name === credentialName(branch.name)) {
-            ours.add(meta.tokenId);
-        }
-    }
-    if (revokeSuperseded) {
-        for (const tokenId of ours) {
-            await api.revokeCredential(options.projectId, branch.id, tokenId);
-        }
-    }
-    return {
-        vars,
-        credential: {
-            issued: true,
-            keys: secretKeys,
-            revoked: revokeSuperseded ? [...ours] : [],
-            superseded: revokeSuperseded ? [] : [...ours],
-        },
-    };
+* Resolve a branch's env while keeping one-time secrets the caller already holds.
+*
+* {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
+* credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
+* them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
+* pull` would leave a live credential behind each time. This is the wrapper that avoids that:
+* it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
+* for only the rest.
+*
+* The check is a real verification, not a presence test. A persisted secret is kept only when
+* it names a credential that still exists on this branch, is not revoked or expired, and
+* carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
+* the console, one copied in from another branch, or one predating a newly-enabled feature all
+* fail that check and get replaced.
+*
+* None of this needs local bookkeeping, because the secrets carry their own credential id:
+* `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
+* against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,
+* where `tokenIdShort` is what the credentials list reports. The env source being replaced is
+* the record of what the last call issued.
+*
+* ```ts
+* import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
+*
+* const { vars, credential } = await fetchEnvReusingSecrets(config, {
+*     projectId,
+*     branch: "main",
+*     env: { ...process.env, ...readEnvFile(".env") },
+* });
+* if (credential.issued) console.log(`new values for ${credential.keys.join(", ")}`);
+* ```
+*/
+async function fetchEnvReusingSecrets(config, options) {
+	const { env: source = process.env, revokeSuperseded = true, ...fetchOptions } = options;
+	const api = options.api ?? createApiFromOptions(options);
+	const { branch, desired } = await resolveBranchPolicy(config, options, api);
+	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
+	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
+	const secretKeys = credentialEnvKeys({
+		storage: storageEnabled,
+		aiGateway: gatewayEnabled
+	});
+	if (secretKeys.length === 0) {
+		const fetched = await fetchEnvKeys(config, fetchOptions, null);
+		return {
+			vars: preferPersisted(toEntries(fetched), source),
+			credential: {
+				issued: false,
+				keys: [],
+				revoked: [],
+				superseded: []
+			}
+		};
+	}
+	const persisted = readPersistedSecrets(source);
+	const complete = (!storageEnabled || Boolean(persisted.accessKeyId && persisted.secretAccessKey)) && (!gatewayEnabled || Boolean(persisted.apiToken));
+	const named = persisted.accessKeyId !== "" || persisted.apiToken !== "" ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted) : {
+		storage: null,
+		gateway: null
+	};
+	const reusable = complete ? reusableCredential(named, {
+		storageEnabled,
+		gatewayEnabled
+	}) : null;
+	const scopes = previewCredentialScopes(desired.preview);
+	const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
+	const allKeys = policyEnvKeys(desired);
+	const fetchKeys = keep ? allKeys.filter((key) => !secretKeys.includes(key)) : allKeys;
+	const fetched = await fetchEnvKeys(config, {
+		...fetchOptions,
+		branchId: branch.id,
+		api
+	}, fetchKeys);
+	const vars = preferPersisted(toEntries(fetched), source);
+	if (keep) {
+		for (const key of secretKeys) {
+			const value = source[key];
+			if (value !== void 0) vars[key] = value;
+		}
+		return {
+			vars,
+			credential: {
+				issued: false,
+				keys: secretKeys,
+				revoked: [],
+				superseded: []
+			}
+		};
+	}
+	const ours = /* @__PURE__ */ new Set();
+	for (const meta of [named.storage, named.gateway]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
+	if (revokeSuperseded) for (const tokenId of ours) await api.revokeCredential(options.projectId, branch.id, tokenId);
+	return {
+		vars,
+		credential: {
+			issued: true,
+			keys: secretKeys,
+			revoked: revokeSuperseded ? [...ours] : [],
+			superseded: revokeSuperseded ? [] : [...ours]
+		}
+	};
 }
 /** Read the branch credential's secrets out of an env source. */
 function readPersistedSecrets(source) {
-    const storage = NEON_ENV_VAR_KEYS.storage;
-    const gateway = NEON_ENV_VAR_KEYS.aiGateway;
-    return {
-        accessKeyId: source[storage.accessKeyId] ?? "",
-        secretAccessKey: source[storage.secretAccessKey] ?? "",
-        apiToken: source[gateway.apiKey] ?? "",
-    };
+	const storage = NEON_ENV_VAR_KEYS.storage;
+	const gateway = NEON_ENV_VAR_KEYS.aiGateway;
+	return {
+		accessKeyId: source[storage.accessKeyId] ?? "",
+		secretAccessKey: source[storage.secretAccessKey] ?? "",
+		apiToken: source[gateway.apiKey] ?? ""
+	};
 }
 /**
- * Keep a persisted value rather than overwriting it with an empty fetched one.
- *
- * Neon Auth's `base_url` is the case that needs this: integrations created before the API
- * returned it answer with an empty string, and the persisted copy is the only one left. An
- * empty fetched value never carries more information than a non-empty persisted one, so
- * preferring the latter is safe for every var — and it keeps a pull from blanking a working
- * line in someone's `.env`.
- */
+* Keep a persisted value rather than overwriting it with an empty fetched one.
+*
+* Neon Auth's `base_url` is the case that needs this: integrations created before the API
+* returned it answer with an empty string, and the persisted copy is the only one left. An
+* empty fetched value never carries more information than a non-empty persisted one, so
+* preferring the latter is safe for every var — and it keeps a pull from blanking a working
+* line in someone's `.env`.
+*/
 function preferPersisted(vars, source) {
-    const out = { ...vars };
-    for (const [key, value] of Object.entries(out)) {
-        if (value !== "")
-            continue;
-        const persisted = source[key];
-        if (persisted !== undefined && persisted !== "")
-            out[key] = persisted;
-    }
-    return out;
+	const out = { ...vars };
+	for (const [key, value] of Object.entries(out)) {
+		if (value !== "") continue;
+		const persisted = source[key];
+		if (persisted !== void 0 && persisted !== "") out[key] = persisted;
+	}
+	return out;
 }
 /**
- * The credential id embedded in an AI Gateway token. The API mints them as
- * `nt_live_<tokenIdShort>_<secret>`, and `tokenIdShort` is the public identifier the credentials
- * list reports — so a persisted token names the credential that issued it. Returns `null` for
- * anything not in that shape (a `.env.example` placeholder, a hand-typed value), which callers
- * treat as unverifiable.
- */
+* The credential id embedded in an AI Gateway token. The API mints them as
+* `nt_live_<tokenIdShort>_<secret>`, and `tokenIdShort` is the public identifier the credentials
+* list reports — so a persisted token names the credential that issued it. Returns `null` for
+* anything not in that shape (a `.env.example` placeholder, a hand-typed value), which callers
+* treat as unverifiable.
+*/
 function gatewayTokenIdShort(apiToken) {
-    return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
+	return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
 }
 /** Whether an issued credential can still be used: not revoked, not past its expiry. */
 function isLiveCredential(meta, now) {
-    if (meta.revokedAt !== undefined)
-        return false;
-    if (meta.expiresAt === undefined)
-        return true;
-    const expiresAt = Date.parse(meta.expiresAt);
-    return Number.isNaN(expiresAt) || expiresAt > now;
+	if (meta.revokedAt !== void 0) return false;
+	if (meta.expiresAt === void 0) return true;
+	const expiresAt = Date.parse(meta.expiresAt);
+	return Number.isNaN(expiresAt) || expiresAt > now;
 }
 /**
- * The live credentials the persisted secrets name — at most one per half. A half that names
- * nothing contributes nothing, which is what a placeholder, a credential revoked in the
- * console, and one copied in from another branch all look like from here.
- */
+* The live credentials the persisted secrets name — at most one per half. A half that names
+* nothing contributes nothing, which is what a placeholder, a credential revoked in the
+* console, and one copied in from another branch all look like from here.
+*/
 function namedCredentials(live, persisted) {
-    const usable = live.filter((meta) => isLiveCredential(meta, Date.now()));
-    const shortId = persisted.apiToken
-        ? gatewayTokenIdShort(persisted.apiToken)
-        : null;
-    return {
-        storage: persisted.accessKeyId
-            ? (usable.find((meta) => meta.tokenId === persisted.accessKeyId) ??
-                null)
-            : null,
-        gateway: shortId
-            ? (usable.find((meta) => meta.tokenIdShort === shortId) ?? null)
-            : null,
-    };
+	const usable = live.filter((meta) => isLiveCredential(meta, Date.now()));
+	const shortId = persisted.apiToken ? gatewayTokenIdShort(persisted.apiToken) : null;
+	return {
+		storage: persisted.accessKeyId ? usable.find((meta) => meta.tokenId === persisted.accessKeyId) ?? null : null,
+		gateway: shortId ? usable.find((meta) => meta.tokenIdShort === shortId) ?? null : null
+	};
 }
 /**
- * The credential the persisted secrets can be *reused* as, or `null`.
- *
- * Strict on purpose: every half the policy enables has to name a live credential, and when both
- * features are enabled they must name the *same* one — they share a single credential, so
- * halves that disagree came from two different calls and neither can be trusted.
- */
+* The credential the persisted secrets can be *reused* as, or `null`.
+*
+* Strict on purpose: every half the policy enables has to name a live credential, and when both
+* features are enabled they must name the *same* one — they share a single credential, so
+* halves that disagree came from two different calls and neither can be trusted.
+*/
 function reusableCredential(named, enabled) {
-    if (enabled.storageEnabled && enabled.gatewayEnabled) {
-        return named.storage &&
-            named.gateway &&
-            named.storage.tokenId === named.gateway.tokenId
-            ? named.storage
-            : null;
-    }
-    if (enabled.storageEnabled)
-        return named.storage;
-    if (enabled.gatewayEnabled)
-        return named.gateway;
-    return null;
+	if (enabled.storageEnabled && enabled.gatewayEnabled) return named.storage && named.gateway && named.storage.tokenId === named.gateway.tokenId ? named.storage : null;
+	if (enabled.storageEnabled) return named.storage;
+	if (enabled.gatewayEnabled) return named.gateway;
+	return null;
 }
+//#endregion
+export { fetchEnvReusingSecrets };