neon 3.0.0 → 3.1.1

package/dist/writer.js

@@ -1,97 +1,77 @@
-import chalk from "chalk";
-import Table from "cli-table";
-import YAML from "yaml";
 import { isCi } from "./env.js";
 import { isObject, toSnakeCase } from "./utils/string.js";
+import chalk from "chalk";
+import YAML from "yaml";
+import Table from "cli-table";
+//#region src/writer.ts
 const writeYaml = (chunks) => {
-    return YAML.stringify(chunks.length === 1
-        ? chunks[0].data
-        : Object.fromEntries(chunks.map(({ config, data }, idx) => [
-            config.title ? toSnakeCase(config.title) : idx,
-            data,
-        ])), null, 2);
+	return YAML.stringify(chunks.length === 1 ? chunks[0].data : Object.fromEntries(chunks.map(({ config, data }, idx) => [config.title ? toSnakeCase(config.title) : idx, data])), null, 2);
 };
 const writeJson = (chunks) => {
-    return JSON.stringify(chunks.length === 1
-        ? chunks[0].data
-        : Object.fromEntries(chunks.map(({ config, data }, idx) => [
-            config.title ? toSnakeCase(config.title) : idx,
-            data,
-        ])), null, 2);
+	return JSON.stringify(chunks.length === 1 ? chunks[0].data : Object.fromEntries(chunks.map(({ config, data }, idx) => [config.title ? toSnakeCase(config.title) : idx, data])), null, 2);
 };
 const writeTable = (chunks, out) => {
-    chunks.forEach(({ data, config: { emptyMessage, fields, title, renderColumns = {} }, }) => {
-        const arrayData = Array.isArray(data) ? data : [data];
-        if (!arrayData.length && emptyMessage) {
-            out.write("\n" + emptyMessage + "\n");
-            return;
-        }
-        const fieldsFiltered = fields.filter((field) => arrayData.some((item) => item[field] !== undefined && item[field] !== ""));
-        const table = new Table({
-            style: {
-                head: ["green"],
-            },
-            head: fieldsFiltered.map((field) => field
-                .split("_")
-                .map((word) => word[0].toUpperCase() + word.slice(1))
-                .join(" ")),
-        });
-        arrayData.forEach((item) => {
-            table.push(fieldsFiltered.map((field) => {
-                const value = item[field];
-                if (renderColumns[field]) {
-                    return renderColumns[field]?.(item);
-                }
-                return Array.isArray(value)
-                    ? value.join("\n")
-                    : isObject(value)
-                        ? JSON.stringify(value, null, 2)
-                        : (value ?? "");
-            }));
-        });
-        if (title) {
-            out.write((isCi() ? title : chalk.bold(title)) + "\n");
-        }
-        out.write(table.toString());
-        out.write("\n");
-    });
+	chunks.forEach(({ data, config: { emptyMessage, fields, title, renderColumns = {} } }) => {
+		const arrayData = Array.isArray(data) ? data : [data];
+		if (!arrayData.length && emptyMessage) {
+			out.write("\n" + emptyMessage + "\n");
+			return;
+		}
+		const fieldsFiltered = fields.filter((field) => arrayData.some((item) => item[field] !== void 0 && item[field] !== ""));
+		const table = new Table({
+			style: { head: ["green"] },
+			head: fieldsFiltered.map((field) => field.split("_").map((word) => word[0].toUpperCase() + word.slice(1)).join(" "))
+		});
+		arrayData.forEach((item) => {
+			table.push(fieldsFiltered.map((field) => {
+				const value = item[field];
+				if (renderColumns[field]) return renderColumns[field]?.(item);
+				return Array.isArray(value) ? value.join("\n") : isObject(value) ? JSON.stringify(value, null, 2) : value ?? "";
+			}));
+		});
+		if (title) out.write((isCi() ? title : chalk.bold(title)) + "\n");
+		out.write(table.toString());
+		out.write("\n");
+	});
 };
 /**
- *
- * Parses the output format, takes data and writes the output to stdout.
- *
- * @example
- * const { data } = await props.apiClient.listProjectBranches(props.project.id);
- * // to output single data
- * writer(props).end(data, { fields: ['id', 'name', 'created_at'] })
- * // to output multiple data
- * writer(props)
- *   .write(data, { fields: ['id', 'name', 'created_at'], title: 'branches' })
- *   .write(data, { fields: ['id', 'created_at'], title: 'endpoints' })
- *   .end()
- */
-export const writer = (props) => {
-    const out = props.out ?? process.stdout;
-    const chunks = [];
-    return {
-        write(data, config) {
-            chunks.push({ data, config });
-            return this;
-        },
-        text(data) {
-            return out.write(data);
-        },
-        end: (...args) => {
-            if (args.length === 2) {
-                chunks.push({ data: args[0], config: args[1] });
-            }
-            if (props.output == "yaml") {
-                return out.write(writeYaml(chunks));
-            }
-            if (props.output == "json") {
-                return out.write(writeJson(chunks));
-            }
-            writeTable(chunks, out);
-        },
-    };
+*
+* Parses the output format, takes data and writes the output to stdout.
+*
+* @example
+* const { data } = await props.apiClient.listProjectBranches(props.project.id);
+* // to output single data
+* writer(props).end(data, { fields: ['id', 'name', 'created_at'] })
+* // to output multiple data
+* writer(props)
+*   .write(data, { fields: ['id', 'name', 'created_at'], title: 'branches' })
+*   .write(data, { fields: ['id', 'created_at'], title: 'endpoints' })
+*   .end()
+*/
+const writer = (props) => {
+	const out = props.out ?? process.stdout;
+	const chunks = [];
+	return {
+		write(data, config) {
+			chunks.push({
+				data,
+				config
+			});
+			return this;
+		},
+		text(data) {
+			return out.write(data);
+		},
+		end: (...args) => {
+			if (args.length === 2) chunks.push({
+				data: args[0],
+				config: args[1]
+			});
+			if (props.output == "yaml") return out.write(writeYaml(chunks));
+			if (props.output == "json") return out.write(writeJson(chunks));
+			writeTable(chunks, out);
+		}
+	};
 };
+//#endregion
+export { writer };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "3.0.0",
+  "version": "3.1.1",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -25,6 +25,8 @@
     ".": "./dist/index.js",
     "./cli": "./dist/cli.js",
     "./dist/_shared/*": null,
+    "./dist/_chunks/*": null,
+    "./dist/_virtual/*": null,
     "./dist/*": "./dist/*",
     "./package.json": "./package.json"
   },
@@ -61,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config-runtime": "1.0.0",
     "@neon/sdk": "2.0.0",
-    "@neon/config": "1.0.0"
+    "@neon/config": "1.0.0",
+    "@neon/config-runtime": "1.0.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"
@@ -90,9 +92,12 @@
     "openapi-types": "12.1.3",
     "rollup": "3.29.4",
     "strip-ansi": "7.1.0",
+    "tsdown": "^0.14.1",
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
+    "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.0",
     "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
@@ -115,10 +120,10 @@
   },
   "scripts": {
     "generateParams": "tsx generateOptionsFromSpec.ts",
-    "codegen": "node ../../scripts/sync-shared.mjs . && node scripts/set-vsx-gallery.mjs",
+    "codegen": "node scripts/set-vsx-gallery.mjs",
     "clean": "rm -rf dist",
-    "build": "pnpm codegen && pnpm generateParams && pnpm clean && tsc -p tsconfig.build.json && cp src/*.html ./dist",
-    "build:internal": "node ../../scripts/sync-shared.mjs . && node scripts/set-vsx-gallery.mjs https://cursor-vsx-proxy.cloud.databricks.com/gallery && pnpm generateParams && pnpm clean && tsc -p tsconfig.build.json && cp src/*.html ./dist",
+    "build": "pnpm codegen && pnpm generateParams && tsc --noEmit && tsdown && cp src/*.html ./dist",
+    "build:internal": "node scripts/set-vsx-gallery.mjs https://cursor-vsx-proxy.cloud.databricks.com/gallery && pnpm generateParams && tsc --noEmit && tsdown && cp src/*.html ./dist",
     "bundle": "node pkg.js",
     "typecheck": "pnpm codegen && tsc --noEmit",
     "lint": "pnpm codegen && pnpm typecheck && biome check src",

package/dist/_shared/auth_selection.js

@@ -1,86 +0,0 @@
-/**
- * # Which credential an invocation authenticates with
- *
- * Four inputs can each answer "who am I": the `--api-key` flag, `NEON_API_KEY`, the
- * `--profile` flag, and `NEON_PROFILE`. This module decides between them, and it is pure so
- * the decision can be tested without a filesystem, a network, or a config directory.
- *
- * ## The rule
- *
- * **An explicit flag beats an ambient environment variable.** That single rule fixes the bug
- * this module exists for: before it, any API key — including one merely exported into the
- * shell — silently voided `--profile`, so `neon --profile work …` would quietly run as
- * whoever `NEON_API_KEY` belonged to and say nothing about it.
- *
- * | Given | What runs |
- * | --- | --- |
- * | `--api-key` and `--profile` | neither: contradictory explicit flags, so this throws |
- * | `--api-key` and `NEON_PROFILE` | the flag's key |
- * | `--profile` and `NEON_API_KEY` | the profile |
- * | `NEON_API_KEY` and `NEON_PROFILE` | the key, and the ignored profile is named in a warning |
- * | `--profile` or `NEON_PROFILE` alone | that profile |
- * | nothing | `DEFAULT` |
- *
- * Two explicit flags throw rather than picking a winner. They express different intents —
- * `--api-key` supplies a credential, `--profile` selects a stored one — so there is no
- * reading of the command that makes both true, and guessing is how the original bug behaved.
- *
- * When both are merely ambient, the key wins. That keeps CI exactly as it was: a pipeline
- * that injects `NEON_API_KEY` must not change behaviour because a `NEON_PROFILE` leaked into
- * the environment. It warns instead of staying silent, because a disregarded account
- * selection is precisely what nobody noticed last time.
- *
- * `auth` and the `profile` subcommands do not use any of this. They read the same flags with
- * different meanings — `neon auth --profile work` names where to *write* a credential, and
- * `neon profile create work --api-key …` names one to *store* — so their callers skip
- * selection entirely rather than passing exemptions down here.
- */
-import { DEFAULT_PROFILE } from "./profiles.js";
-const NO_INPUTS = {
-    apiKeyFlag: "",
-    apiKeyEnv: "",
-    profileEnv: "",
-};
-let inputs = NO_INPUTS;
-export const recordCredentialInputs = (recorded) => {
-    inputs = recorded;
-};
-export const credentialInputs = () => inputs;
-export const selectCredential = ({ apiKeyFlag, profileFlag, apiKeyEnv, profileEnv, }) => {
-    const flagKey = nonEmpty(apiKeyFlag);
-    const flagProfile = nonEmpty(profileFlag);
-    if (flagKey !== undefined && flagProfile !== undefined) {
-        throw new Error("Pass either --api-key or --profile, not both. --api-key supplies a credential directly; --profile selects a stored one.");
-    }
-    if (flagKey !== undefined) {
-        return { source: "explicit-api-key", apiKey: flagKey };
-    }
-    if (flagProfile !== undefined) {
-        return { source: "profile", profile: flagProfile, explicit: true };
-    }
-    const envKey = nonEmpty(apiKeyEnv);
-    const envProfile = nonEmpty(profileEnv);
-    if (envKey !== undefined) {
-        return {
-            source: "ambient-api-key",
-            apiKey: envKey,
-            ...(envProfile !== undefined ? { ignoredProfile: envProfile } : {}),
-        };
-    }
-    return {
-        source: "profile",
-        profile: envProfile ?? DEFAULT_PROFILE,
-        explicit: envProfile !== undefined,
-    };
-};
-/** The warning for an ambient key that displaced an ambient profile, or `null`. */
-export const displacedProfileWarning = (selection) => selection.source === "ambient-api-key" &&
-    selection.ignoredProfile !== undefined
-    ? `NEON_API_KEY is set, so profile "${selection.ignoredProfile}" from NEON_PROFILE was ignored. Pass --profile ${selection.ignoredProfile} to use it instead.`
-    : null;
-function nonEmpty(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed === "" ? undefined : trimmed;
-}

package/dist/_shared/credentials.js

@@ -1,209 +0,0 @@
-/**
- * # Stored credentials — one file per account, two kinds
- *
- * A profile points at exactly one credentials file (see `./profiles.ts`), and that file says
- * what kind of credential it holds. Adding API-key support this way rather than adding a
- * second pointer to `profiles.json` keeps a profile what it already was — one name, one path
- * — and means `profiles.json` needs no schema change at all.
- *
- * ```json
- * // oauth: every file written before this existed. An absent `type` means this.
- * { "access_token": "…", "refresh_token": "…", "expires_at": 1786…, "user_id": "…" }
- *
- * // api_key, stored by `neon profile create --api-key`
- * { "type": "api_key", "api_key": "napi_…", "user_id": "…" }
- *
- * // api_key minted by `--mint --org-id`, which records the scope it was issued at
- * { "type": "api_key", "api_key": "napi_…", "key_id": 123, "org_id": "org-…" }
- * ```
- *
- * ## One profile, one kind
- *
- * A credentials file holds an API key or an OAuth session, never both, and `type` states
- * which. An earlier draft let the two coexist — the idea being that a key could keep the
- * session it was minted from and so rotate without a browser. It did not survive review, for
- * two reasons that are worth recording so nobody rebuilds it:
- *
- * 1. **It never worked.** The resolver returned the key without testing it, so a revoked key
- *    failed to mint and never fell back to the session sitting beside it.
- * 2. **It could mix accounts.** Nothing compared the identity of the credential being written
- *    with the one already there, so a profile could hold one account's session and another's
- *    key, told apart only by a single string. Flip or lose `type` and the profile silently
- *    becomes a different person.
- *
- * Recovery from a dead key is therefore one browser login — `neon profile create <name>
- * --mint --force` — which is what the retained session was supposed to save and never did.
- *
- * ## Older releases
- *
- * A CLI predating this reads the pointer, finds no `type` it understands, ignores it, and
- * looks for `access_token`. An `api_key` profile has none, so an older release falls through
- * to its browser login rather than crashing. That it does not crash is why `credentials`
- * stays a required pointer: an entry without one makes 2.41 and 2.42 throw
- * `ERR_INVALID_ARG_TYPE` from `resolveEntryPath`.
- */
-import { readFileSync } from "node:fs";
-import { writeSecretFile } from "./secure_file.js";
-export const OAUTH = "oauth";
-export const API_KEY = "api_key";
-/**
- * Which credential in this file authenticates, by declaration alone.
- *
- * An unrecognised `type` throws rather than falling back to `oauth`. A file we cannot
- * interpret is a misconfiguration the user has to see: treating it as OAuth would send them
- * to a browser login that silently replaces a credential they meant to keep, and treating it
- * as an API key would authenticate with whatever `api_key` happened to be there.
- *
- * This deliberately does not check that an `api_key` file has a key — `neon profile list`
- * needs the kind of a file it is not about to authenticate with, and must be able to report a
- * broken one rather than throwing halfway through a table.
- */
-export const credentialKind = (credentials, at) => {
-    const declared = credentials.type;
-    if (declared === undefined || declared === OAUTH)
-        return OAUTH;
-    if (declared === API_KEY)
-        return API_KEY;
-    // The value is not quoted back. Everything in this file is secret material, and a
-    // corrupted or hand-edited file can put a key anywhere in it — including here. Naming the
-    // file is enough to act on, and it cannot leak what the file holds.
-    throw new Error(`${at.path} declares a "type" this version does not understand. Expected "${OAUTH}" or "${API_KEY}". ${repair(at)}`);
-};
-/**
- * The way out of a credentials file that cannot be read.
- *
- * One sentence, shared by every such error, because they all have the same two answers: write
- * a new credential over it, or delete it and start again.
- */
-const repair = (at) => `Replace it deliberately with \`neon profile create ${at.profile} --force\`, or delete the file.`;
-/**
- * Resolve what to authenticate with, validating that the declared kind is actually usable.
- *
- * An `api_key` file with no key is a hard error rather than a fall-through to OAuth: the user
- * asked for a key, and quietly opening a browser instead would replace the credential they
- * were trying to fix.
- */
-export const interpretCredentials = (credentials, at) => {
-    if (credentialKind(credentials, at) === OAUTH)
-        return { kind: OAUTH };
-    const apiKey = nonEmpty(credentials.api_key);
-    if (apiKey === undefined) {
-        throw new Error(`${at.path} declares "type": "${API_KEY}" but has no "api_key" value. ${repair(at)}`);
-    }
-    return { kind: API_KEY, apiKey };
-};
-/**
- * Read and classify a credentials file, without deciding what to do about it.
- *
- * A permission or I/O error still throws: there may be a perfectly good credential here that
- * we cannot see, and treating that as absent would send the user to a browser login that
- * overwrites it.
- */
-export const inspectCredentials = (path) => {
-    let contents;
-    try {
-        contents = readFileSync(path, "utf8");
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return { kind: "absent" };
-        throw err;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(contents);
-    }
-    catch {
-        // The parser's message is deliberately discarded. V8 quotes a window of the input
-        // around the syntax error — on Node 24 a truncated credentials file produced
-        // `Unexpected token 'a', ..."api_key":napi_SUPERS"... is not valid JSON` — and this
-        // reason is printed by `profile list` and by every failed authentication. A malformed
-        // secret file is exactly when a diagnostic must say less, not more.
-        return {
-            kind: "unusable",
-            reason: `${path} is not valid JSON, so the credential in it cannot be read`,
-        };
-    }
-    if (parsed === null ||
-        typeof parsed !== "object" ||
-        Array.isArray(parsed)) {
-        return {
-            kind: "unusable",
-            reason: `${path} does not contain a credentials object`,
-        };
-    }
-    return { kind: "ok", credentials: parsed };
-};
-/**
- * The credential at `path`, or `null` when the file is not there.
- *
- * A damaged file is an error, not an absence. Treating it as absent — which is what this used to
- * do — meant any read-only command could repair it by starting a browser sign-in and overwriting
- * it, **possibly as a different account**, with the user never having asked for a repair and no
- * way back to whatever was in the file. Failing here costs one deliberate command; the message
- * names it.
- *
- * `profile list` and telemetry use {@link inspectCredentials} instead, because describing a
- * broken credential is not the same as using one.
- */
-export const readCredentials = (at) => {
-    const read = inspectCredentials(at.path);
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. ${repair(at)}`);
-    }
-    return read.kind === "ok" ? read.credentials : null;
-};
-export const writeCredentials = (path, credentials) => {
-    writeSecretFile(path, JSON.stringify(credentials));
-};
-/**
- * Build an `api_key` credentials object. Nothing from a previous credential is carried over.
- *
- * The scope is stored because it is not recoverable from the secret: `rotate-key` has to mint
- * the replacement on the same endpoint, and an org or project key minted as an account key
- * would silently widen what the profile reaches.
- */
-export const apiKeyCredentials = ({ apiKey, keyId, userId, scope, }) => ({
-    type: API_KEY,
-    api_key: apiKey,
-    ...(keyId !== undefined ? { key_id: keyId } : {}),
-    ...(userId !== undefined ? { user_id: userId } : {}),
-    ...(scope?.orgId !== undefined ? { org_id: scope.orgId } : {}),
-    ...(scope?.projectId !== undefined ? { project_id: scope.projectId } : {}),
-});
-/** The scope recorded on a stored credential. */
-export const scopeOf = (credentials) => ({
-    ...(typeof credentials.org_id === "string"
-        ? { orgId: credentials.org_id }
-        : {}),
-    ...(typeof credentials.project_id === "string"
-        ? { projectId: credentials.project_id }
-        : {}),
-});
-/** How to describe a scope in output. */
-export const describeScope = (scope) => {
-    if (scope.projectId !== undefined)
-        return `project ${scope.projectId}`;
-    if (scope.orgId !== undefined)
-        return `org ${scope.orgId}`;
-    return "account";
-};
-function nonEmpty(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed === "" ? undefined : trimmed;
-}
-/**
- * Whether a stored credential is the same secret as the one about to replace it.
- *
- * Re-storing the key a profile already holds is a no-op, not a replacement — and retiring it
- * would revoke the credential the command has just committed to. Trimmed on both sides, because
- * a key read from a file or a pipe arrives with a trailing newline.
- */
-export const isSameCredential = (existingKey, replacementKey) => {
-    if (existingKey === undefined || replacementKey === undefined)
-        return false;
-    const trimmed = existingKey.trim();
-    return trimmed !== "" && trimmed === replacementKey.trim();
-};