neon 3.1.0 → 3.1.1

package/dist/psql/io/psqlrc.js

@@ -1,6 +1,6 @@
 import { COND_COMMAND_NAMES, attachCondStack } from "../command/cmd_cond.js";
 import { scanSlashArgs } from "../scanner/slash.js";
-import { sendQuery } from "../core/common.js";
+import { U as sendQuery } from "../../_chunks/cmd_pipeline-CUbBO9U_.js";
 import { dispatchBackslash } from "../command/dispatch.js";
 import { initialScanState } from "../types/scanner.js";
 import { scanSql } from "../scanner/sql.js";

package/dist/psql/types/index.js

@@ -1,2 +1,8 @@
 import { initialScanState, isContinueStatus } from "./scanner.js";
+import "./backslash.js";
+import "./connection.js";
+import "./printer.js";
+import "./repl.js";
+import "./settings.js";
+import "./variables.js";
 export { initialScanState, isContinueStatus };

package/dist/utils/inspect_db.js

@@ -2,7 +2,7 @@ import { EndpointType } from "./api_enums.js";
 import { branchIdFromProps } from "./enrichers.js";
 import { parsePITBranch } from "./point_in_time.js";
 import { PgConnection } from "../psql/wire/connection.js";
-import { parseConnectionUri } from "../psql/index.js";
+import { o as parseConnectionUri } from "../_chunks/psql-DWH-kc69.js";
 //#region src/utils/inspect_db.ts
 const SSL_MODES = [
 	"require",

package/dist/utils/middlewares.js

@@ -1,4 +1,4 @@
-import { recordCredentialInputs } from "../_shared/auth_selection.js";
+import { r as recordCredentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
 //#region src/utils/middlewares.ts
 /**
 * Resolves `--api-key` from `NEON_API_KEY` when the flag is absent, leaving it an
@@ -34,6 +34,7 @@ const resolveApiKeyFromEnv = (args) => {
 const fillInArgs = (args, currentArgs = args, acc = []) => {
 	Object.entries(currentArgs).forEach(([k, v]) => {
 		if (k === "_" || k === "--") return;
+		if (Array.isArray(v)) return;
 		if (typeof v === "object" && v !== null) fillInArgs(args, v, [...acc, k]);
 		else if (acc.length > 0) args[acc.join(".") + "." + k] = v;
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -25,6 +25,7 @@
     ".": "./dist/index.js",
     "./cli": "./dist/cli.js",
     "./dist/_shared/*": null,
+    "./dist/_chunks/*": null,
     "./dist/_virtual/*": null,
     "./dist/*": "./dist/*",
     "./package.json": "./package.json"
@@ -95,6 +96,8 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
+    "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.0",
     "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
@@ -117,10 +120,10 @@
   },
   "scripts": {
     "generateParams": "tsx generateOptionsFromSpec.ts",
-    "codegen": "node ../../scripts/sync-shared.mjs . && node scripts/set-vsx-gallery.mjs",
+    "codegen": "node scripts/set-vsx-gallery.mjs",
     "clean": "rm -rf dist",
     "build": "pnpm codegen && pnpm generateParams && tsc --noEmit && tsdown && cp src/*.html ./dist",
-    "build:internal": "node ../../scripts/sync-shared.mjs . && node scripts/set-vsx-gallery.mjs https://cursor-vsx-proxy.cloud.databricks.com/gallery && pnpm generateParams && tsc --noEmit && tsdown && cp src/*.html ./dist",
+    "build:internal": "node scripts/set-vsx-gallery.mjs https://cursor-vsx-proxy.cloud.databricks.com/gallery && pnpm generateParams && tsc --noEmit && tsdown && cp src/*.html ./dist",
     "bundle": "node pkg.js",
     "typecheck": "pnpm codegen && tsc --noEmit",
     "lint": "pnpm codegen && pnpm typecheck && biome check src",

package/dist/_shared/env-core/reuse-secrets.js

@@ -1,179 +0,0 @@
-import { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries } from "./env.js";
-import { credentialScopesSatisfied } from "@neon/config/v1";
-//#region src/_shared/env-core/reuse-secrets.ts
-/**
-* Resolve a branch's env while keeping one-time secrets the caller already holds.
-*
-* {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
-* credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
-* them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
-* pull` would leave a live credential behind each time. This is the wrapper that avoids that:
-* it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
-* for only the rest.
-*
-* The check is a real verification, not a presence test. A persisted secret is kept only when
-* it names a credential that still exists on this branch, is not revoked or expired, and
-* carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
-* the console, one copied in from another branch, or one predating a newly-enabled feature all
-* fail that check and get replaced.
-*
-* None of this needs local bookkeeping, because the secrets carry their own credential id:
-* `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
-* against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,
-* where `tokenIdShort` is what the credentials list reports. The env source being replaced is
-* the record of what the last call issued.
-*
-* ```ts
-* import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
-*
-* const { vars, credential } = await fetchEnvReusingSecrets(config, {
-*     projectId,
-*     branch: "main",
-*     env: { ...process.env, ...readEnvFile(".env") },
-* });
-* if (credential.issued) console.log(`new values for ${credential.keys.join(", ")}`);
-* ```
-*/
-async function fetchEnvReusingSecrets(config, options) {
-	const { env: source = process.env, revokeSuperseded = true, ...fetchOptions } = options;
-	const api = options.api ?? createApiFromOptions(options);
-	const { branch, desired } = await resolveBranchPolicy(config, options, api);
-	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
-	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
-	const secretKeys = credentialEnvKeys({
-		storage: storageEnabled,
-		aiGateway: gatewayEnabled
-	});
-	if (secretKeys.length === 0) {
-		const fetched = await fetchEnvKeys(config, fetchOptions, null);
-		return {
-			vars: preferPersisted(toEntries(fetched), source),
-			credential: {
-				issued: false,
-				keys: [],
-				revoked: [],
-				superseded: []
-			}
-		};
-	}
-	const persisted = readPersistedSecrets(source);
-	const complete = (!storageEnabled || Boolean(persisted.accessKeyId && persisted.secretAccessKey)) && (!gatewayEnabled || Boolean(persisted.apiToken));
-	const named = persisted.accessKeyId !== "" || persisted.apiToken !== "" ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted) : {
-		storage: null,
-		gateway: null
-	};
-	const reusable = complete ? reusableCredential(named, {
-		storageEnabled,
-		gatewayEnabled
-	}) : null;
-	const scopes = previewCredentialScopes(desired.preview);
-	const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-	const allKeys = policyEnvKeys(desired);
-	const fetchKeys = keep ? allKeys.filter((key) => !secretKeys.includes(key)) : allKeys;
-	const fetched = await fetchEnvKeys(config, {
-		...fetchOptions,
-		branchId: branch.id,
-		api
-	}, fetchKeys);
-	const vars = preferPersisted(toEntries(fetched), source);
-	if (keep) {
-		for (const key of secretKeys) {
-			const value = source[key];
-			if (value !== void 0) vars[key] = value;
-		}
-		return {
-			vars,
-			credential: {
-				issued: false,
-				keys: secretKeys,
-				revoked: [],
-				superseded: []
-			}
-		};
-	}
-	const ours = /* @__PURE__ */ new Set();
-	for (const meta of [named.storage, named.gateway]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
-	if (revokeSuperseded) for (const tokenId of ours) await api.revokeCredential(options.projectId, branch.id, tokenId);
-	return {
-		vars,
-		credential: {
-			issued: true,
-			keys: secretKeys,
-			revoked: revokeSuperseded ? [...ours] : [],
-			superseded: revokeSuperseded ? [] : [...ours]
-		}
-	};
-}
-/** Read the branch credential's secrets out of an env source. */
-function readPersistedSecrets(source) {
-	const storage = NEON_ENV_VAR_KEYS.storage;
-	const gateway = NEON_ENV_VAR_KEYS.aiGateway;
-	return {
-		accessKeyId: source[storage.accessKeyId] ?? "",
-		secretAccessKey: source[storage.secretAccessKey] ?? "",
-		apiToken: source[gateway.apiKey] ?? ""
-	};
-}
-/**
-* Keep a persisted value rather than overwriting it with an empty fetched one.
-*
-* Neon Auth's `base_url` is the case that needs this: integrations created before the API
-* returned it answer with an empty string, and the persisted copy is the only one left. An
-* empty fetched value never carries more information than a non-empty persisted one, so
-* preferring the latter is safe for every var — and it keeps a pull from blanking a working
-* line in someone's `.env`.
-*/
-function preferPersisted(vars, source) {
-	const out = { ...vars };
-	for (const [key, value] of Object.entries(out)) {
-		if (value !== "") continue;
-		const persisted = source[key];
-		if (persisted !== void 0 && persisted !== "") out[key] = persisted;
-	}
-	return out;
-}
-/**
-* The credential id embedded in an AI Gateway token. The API mints them as
-* `nt_live_<tokenIdShort>_<secret>`, and `tokenIdShort` is the public identifier the credentials
-* list reports — so a persisted token names the credential that issued it. Returns `null` for
-* anything not in that shape (a `.env.example` placeholder, a hand-typed value), which callers
-* treat as unverifiable.
-*/
-function gatewayTokenIdShort(apiToken) {
-	return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
-}
-/** Whether an issued credential can still be used: not revoked, not past its expiry. */
-function isLiveCredential(meta, now) {
-	if (meta.revokedAt !== void 0) return false;
-	if (meta.expiresAt === void 0) return true;
-	const expiresAt = Date.parse(meta.expiresAt);
-	return Number.isNaN(expiresAt) || expiresAt > now;
-}
-/**
-* The live credentials the persisted secrets name — at most one per half. A half that names
-* nothing contributes nothing, which is what a placeholder, a credential revoked in the
-* console, and one copied in from another branch all look like from here.
-*/
-function namedCredentials(live, persisted) {
-	const usable = live.filter((meta) => isLiveCredential(meta, Date.now()));
-	const shortId = persisted.apiToken ? gatewayTokenIdShort(persisted.apiToken) : null;
-	return {
-		storage: persisted.accessKeyId ? usable.find((meta) => meta.tokenId === persisted.accessKeyId) ?? null : null,
-		gateway: shortId ? usable.find((meta) => meta.tokenIdShort === shortId) ?? null : null
-	};
-}
-/**
-* The credential the persisted secrets can be *reused* as, or `null`.
-*
-* Strict on purpose: every half the policy enables has to name a live credential, and when both
-* features are enabled they must name the *same* one — they share a single credential, so
-* halves that disagree came from two different calls and neither can be trusted.
-*/
-function reusableCredential(named, enabled) {
-	if (enabled.storageEnabled && enabled.gatewayEnabled) return named.storage && named.gateway && named.storage.tokenId === named.gateway.tokenId ? named.storage : null;
-	if (enabled.storageEnabled) return named.storage;
-	if (enabled.gatewayEnabled) return named.gateway;
-	return null;
-}
-//#endregion
-export { fetchEnvReusingSecrets };