neon 3.1.0 → 3.1.1

package/dist/{_shared/env-core/env.js → _chunks/env_services-Tz9G4JeT.js}

@@ -1,13 +1,13 @@
+import { NEON_SERVICES } from "../neon_services.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, resolveConfig } from "@neon/config/v1";
-//#region src/_shared/env-core/env.ts
+//#region ../../internals/env-core/dist/env.js
 /**
 * The Neon env core — resolving a branch's env from the Neon API, and projecting it into
 * OS-level `{ KEY: value }` pairs.
 *
-* Shared source, not a package: `scripts/sync-shared.mjs` copies it into `@neon/env` (which
-* publishes it as `fetchEnv` / `toEntries`) and into the `neon` CLI (which needs the
-* credential-reuse half in `reuse-secrets.ts`). See `shared/env-core/README.md` for why it is
-* a copy rather than an import.
+* Private, and bundled into both consumers: `@neon/env` publishes it as `fetchEnv` /
+* `toEntries`, and the `neon` CLI needs the credential-reuse half in `reuse-secrets.ts`.
+* See `README.md` for why it is not published.
 *
 * The counterpart that reads `process.env` — `parseEnv` and its zod schemas — is not here. It
 * has no consumer outside `@neon/env`, so it stays in that package and imports this.
@@ -84,8 +84,10 @@ const NEON_ENV_VAR_KEYS = {
 		baseUrl: "NEON_AI_GATEWAY_BASE_URL"
 	}
 };
-async function fetchEnv(config, options) {
-	return fetchEnvKeys(config, options, options.keys ?? null);
+/** Fail loudly when selected-key dependency planning and execution disagree. */
+function requiredValue(value, description) {
+	if (value === null) throw new Error(`fetchEnv: missing ${description}.`);
+	return value;
 }
 /**
 * The {@link fetchEnv} body, with the key selection as a plain argument and no generic
@@ -103,31 +105,38 @@ async function fetchEnvKeys(config, options, keys) {
 	const selection = keys ? new Set(keys) : null;
 	const wants = (key) => selection === null || selection.has(key);
 	const result = {};
-	const [roles, databases] = await Promise.all([api.listBranchRoles(projectId, branch.id), api.listBranchDatabases(projectId, branch.id)]);
-	const roleName = pickRoleName(roles, branch, options.roleName);
-	const databaseName = pickDatabaseName(databases, branch, options.databaseName);
 	const K = NEON_ENV_VAR_KEYS;
+	const wantsPooled = wants(K.postgres.databaseUrl);
+	const wantsUnpooled = wants(K.postgres.databaseUrlUnpooled);
 	const wantsAuth = desired.authEnabled && (wants(K.auth.baseUrl) || wants(K.auth.jwksUrl));
 	const wantsDataApi = desired.dataApiEnabled && wants(K.dataApi.url);
-	const [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([
-		api.getConnectionUri(projectId, {
-			branchId: branch.id,
-			databaseName,
-			roleName,
-			pooled: true
-		}),
-		api.getConnectionUri(projectId, {
+	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
+	const needsUnpooled = wantsUnpooled || gatewayEnabled && wants(K.aiGateway.baseUrl);
+	const needsConnectionTarget = wantsPooled || needsUnpooled;
+	const needsDatabase = needsConnectionTarget || wantsDataApi;
+	const [roles, databases] = await Promise.all([needsConnectionTarget ? api.listBranchRoles(projectId, branch.id) : Promise.resolve([]), needsDatabase ? api.listBranchDatabases(projectId, branch.id) : Promise.resolve([])]);
+	const databaseName = needsDatabase ? pickDatabaseName(databases, branch, options.databaseName) : null;
+	const connectionTarget = needsConnectionTarget ? {
+		roleName: pickRoleName(roles, branch, options.roleName),
+		databaseName: requiredValue(databaseName, "database for a selected connection URI")
+	} : null;
+	const getConnectionUri = (pooled) => {
+		const target = requiredValue(connectionTarget, "role and database for a selected connection URI");
+		return api.getConnectionUri(projectId, {
 			branchId: branch.id,
-			databaseName,
-			roleName,
-			pooled: false
-		}),
+			...target,
+			pooled
+		});
+	};
+	const [pooled, unpooled, authSnapshot, dataApiSnapshot] = await Promise.all([
+		wantsPooled ? getConnectionUri(true) : Promise.resolve(null),
+		needsUnpooled ? getConnectionUri(false) : Promise.resolve(null),
 		wantsAuth ? api.getNeonAuth(projectId, branch.id) : Promise.resolve(null),
-		wantsDataApi ? api.getNeonDataApi(projectId, branch.id, databaseName) : Promise.resolve(null)
+		wantsDataApi ? api.getNeonDataApi(projectId, branch.id, requiredValue(databaseName, "database for the selected Data API URL")) : Promise.resolve(null)
 	]);
 	const postgres = {};
-	if (wants(K.postgres.databaseUrl)) postgres.databaseUrl = pooled.uri;
-	if (wants(K.postgres.databaseUrlUnpooled)) postgres.databaseUrlUnpooled = unpooled.uri;
+	if (wantsPooled) postgres.databaseUrl = requiredValue(pooled, "pooled connection URI response").uri;
+	if (wantsUnpooled) postgres.databaseUrlUnpooled = requiredValue(unpooled, "direct connection URI response").uri;
 	if (Object.keys(postgres).length > 0) result.postgres = postgres;
 	if (wants(K.branch.name)) result.branch = { name: branch.name };
 	if (wantsAuth) {
@@ -141,18 +150,22 @@ async function fetchEnvKeys(config, options, keys) {
 		result.auth = auth;
 	}
 	if (wantsDataApi) {
-		if (!dataApiSnapshot) throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${databaseName}.`, "Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false."].join(" "), { details: {
-			projectId,
-			branchId: branch.id,
-			databaseName
-		} });
+		if (!dataApiSnapshot) {
+			const selectedDatabase = requiredValue(databaseName, "database for the selected Data API URL");
+			throw new PlatformError(ErrorCode.NotFound, [`fetchEnv: branch policy enables dataApi but no Data API integration is enabled on branch ${branch.name} (${branch.id}) database ${selectedDatabase}.`, "Enable it via `apply(config, { projectId, branchId })` or in the Neon Console — then re-run fetchEnv. Or return dataApi.enabled=false."].join(" "), { details: {
+				projectId,
+				branchId: branch.id,
+				databaseName: selectedDatabase
+			} });
+		}
 		result.dataApi = { url: dataApiSnapshot.url };
 	}
 	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
-	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
 	const wantsStorage = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey) || wants(K.storage.endpoint) || wants(K.storage.region));
 	const wantsGateway = gatewayEnabled && (wants(K.aiGateway.apiKey) || wants(K.aiGateway.baseUrl));
-	const wantsCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey)) || gatewayEnabled && wants(K.aiGateway.apiKey);
+	const wantsStorageCredential = storageEnabled && (wants(K.storage.accessKeyId) || wants(K.storage.secretAccessKey));
+	const wantsGatewayCredential = gatewayEnabled && wants(K.aiGateway.apiKey);
+	const wantsCredential = wantsStorageCredential || wantsGatewayCredential;
 	if (wantsStorage || wantsGateway) {
 		let storage = null;
 		if (wantsStorage) {
@@ -167,7 +180,10 @@ async function fetchEnvKeys(config, options, keys) {
 			projectId,
 			branchId: branch.id,
 			branchName: branch.name,
-			scopes: previewCredentialScopes(desired.preview)
+			scopes: previewCredentialScopes(desired.preview, {
+				storage: wantsStorageCredential,
+				aiGateway: wantsGatewayCredential
+			})
 		}) : null;
 		if (storage) {
 			const storageEnv = {};
@@ -180,7 +196,7 @@ async function fetchEnvKeys(config, options, keys) {
 		if (wantsGateway) {
 			const gateway = {};
 			if (secrets && wants(K.aiGateway.apiKey)) gateway.apiKey = secrets.apiToken;
-			if (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, unpooled.uri);
+			if (wants(K.aiGateway.baseUrl)) gateway.baseUrl = aiGatewayBaseUrl(branch.id, requiredValue(unpooled, "direct connection URI for the selected AI Gateway base URL").uri);
 			result.aiGateway = gateway;
 		}
 	}
@@ -212,16 +228,14 @@ async function resolveBranchPolicy(config, options, api) {
 	};
 }
 /**
-* Scopes the branch credential should carry for a resolved branch policy. Only object storage
-* and the AI Gateway *require* a credential; functions never force one (they have no credential
-* of their own), but `functions:invoke` is added to the scope set when a credential is already
-* being minted for storage / the AI Gateway, so the one credential can invoke the branch's
-* functions too. Returns `[]` only when nothing credential-bearing is enabled.
+* Scopes the branch credential should carry for a resolved branch policy and optional key
+* selection. Only object storage and the AI Gateway *require* a credential; functions never
+* force one, but `functions:invoke` rides along when another selected feature mints one.
 */
-function previewCredentialScopes(preview) {
+function previewCredentialScopes(preview, selected) {
 	if (!preview) return [];
-	const storage = preview.buckets.length > 0;
-	const aiGateway = preview.aiGatewayEnabled;
+	const storage = preview.buckets.length > 0 && (selected?.storage ?? true);
+	const aiGateway = preview.aiGatewayEnabled && (selected?.aiGateway ?? true);
 	if (!storage && !aiGateway) return [];
 	return deriveCredentialScopes({
 		storage,
@@ -392,4 +406,126 @@ function toEntries(env) {
 	return out;
 }
 //#endregion
-export { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnv, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries };
+//#region src/env_services.ts
+/**
+* The services `env pull --service` can select: every Neon service that produces branch env
+* vars. `functions` is the one left out — a function's env comes from the local `neon.ts`,
+* never from the branch, so there is nothing to pull.
+*/
+const ENV_PULL_SERVICES = NEON_SERVICES.filter((service) => service !== "functions");
+/** Why the services `env pull` leaves out are not selectable, for the refusal message. */
+const ENV_PULL_UNAVAILABLE = { functions: "a function's env comes from your neon.ts, not from the branch, so there is nothing to pull" };
+/** Every OS-level env var `env pull` can write, in stable emit order. */
+const ENV_PULL_KEYS = [
+	...Object.values(NEON_ENV_VAR_KEYS.postgres),
+	NEON_ENV_VAR_KEYS.branch.name,
+	...Object.values(NEON_ENV_VAR_KEYS.auth),
+	...Object.values(NEON_ENV_VAR_KEYS.dataApi),
+	...Object.values(NEON_ENV_VAR_KEYS.storage),
+	...Object.values(NEON_ENV_VAR_KEYS.aiGateway)
+];
+/** The OS-level env vars each service contributes to a pulled `.env`. */
+const SERVICE_ENV_KEYS = {
+	postgres: Object.values(NEON_ENV_VAR_KEYS.postgres),
+	auth: Object.values(NEON_ENV_VAR_KEYS.auth),
+	"data-api": Object.values(NEON_ENV_VAR_KEYS.dataApi),
+	"object-storage": Object.values(NEON_ENV_VAR_KEYS.storage),
+	"ai-gateway": Object.values(NEON_ENV_VAR_KEYS.aiGateway),
+	functions: []
+};
+/**
+* The subset of {@link SERVICE_ENV_KEYS} a pull *owns*, and so may prune from the target file
+* when the branch no longer has it. Object storage is deliberately absent: it is emitted under
+* the third-party `AWS_*` names, which collide with credentials a user may set by hand, so
+* `env pull` only ever writes them.
+*/
+const SERVICE_OWNED_ENV_KEYS = {
+	...SERVICE_ENV_KEYS,
+	"object-storage": []
+};
+/**
+* Branch identity. Not a service — every branch has a name — so a scoped pull refreshes it
+* alongside whatever services were selected.
+*/
+const BRANCH_ENV_KEY = NEON_ENV_VAR_KEYS.branch.name;
+/** The service that produces a key, or `null` for branch identity. */
+const ENV_KEY_SERVICE = {
+	DATABASE_URL: "postgres",
+	DATABASE_URL_UNPOOLED: "postgres",
+	NEON_BRANCH: null,
+	NEON_AUTH_BASE_URL: "auth",
+	NEON_AUTH_JWKS_URL: "auth",
+	NEON_DATA_API_URL: "data-api",
+	AWS_ACCESS_KEY_ID: "object-storage",
+	AWS_SECRET_ACCESS_KEY: "object-storage",
+	AWS_ENDPOINT_URL_S3: "object-storage",
+	AWS_REGION: "object-storage",
+	NEON_AI_GATEWAY_TOKEN: "ai-gateway",
+	NEON_AI_GATEWAY_BASE_URL: "ai-gateway"
+};
+const serviceForEnvKey = (key) => ENV_KEY_SERVICE[key];
+/** Services that must be resolved to produce the selected env keys. */
+const servicesForEnvKeys = (keys) => ENV_PULL_SERVICES.filter((service) => keys.some((key) => ENV_KEY_SERVICE[key] === service));
+/** Every env var the selected services contribute, plus branch identity. */
+const envServiceKeys = (services) => {
+	const keys = /* @__PURE__ */ new Set([BRANCH_ENV_KEY]);
+	for (const service of services) for (const key of SERVICE_ENV_KEYS[service]) keys.add(key);
+	return keys;
+};
+/**
+* The env vars a pull scoped to `services` may prune. Narrower than the unscoped set on
+* purpose: `env pull -s ai-gateway` says nothing about `DATABASE_URL`, so it must leave it
+* alone rather than treat its absence from this pull as "the branch no longer has it".
+*/
+const ownedEnvServiceKeys = (services) => services.flatMap((service) => SERVICE_OWNED_ENV_KEYS[service]);
+/**
+* The exact env vars an explicit selection writes. Services contribute their complete
+* bundles plus branch identity; `--env` contributes only the named keys. The two selectors
+* compose as a union.
+*/
+const envKeysForSelection = (services, envKeys) => {
+	const selected = services.length > 0 ? envServiceKeys(services) : /* @__PURE__ */ new Set();
+	for (const key of envKeys) selected.add(key);
+	if (selected.has(NEON_ENV_VAR_KEYS.storage.accessKeyId) !== selected.has(NEON_ENV_VAR_KEYS.storage.secretAccessKey)) throw new Error("AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be selected together: they are two halves of one newly issued object-storage credential. Add the missing key to --env, or use --service object-storage.");
+	return ENV_PULL_KEYS.filter((key) => selected.has(key));
+};
+/** Parse repeated or comma-separated `--env` values into canonical env-key order. */
+const parseEnvPullKeys = (raw, flag) => {
+	const names = raw.flatMap((value) => value.split(",")).map((name) => name.trim()).filter((name) => name !== "");
+	const supported = `Supported values: ${ENV_PULL_KEYS.join(", ")}.`;
+	if (names.length === 0) throw new Error(`${flag} needs at least one env variable. ${supported}`);
+	const unknown = names.filter((name) => !ENV_PULL_KEYS.some((key) => key === name));
+	if (unknown.length > 0) {
+		const displayNames = unknown.map(redactUnknownEnvValue);
+		const suggestions = [...new Set(unknown.map(suggestEnvPullKey).filter((key) => key !== null))];
+		const suggestion = suggestions.length > 0 ? ` Did you mean ${suggestions.join(" or ")}?` : "";
+		throw new Error(`Unknown env variable${unknown.length === 1 ? "" : "s"} ${displayNames.join(", ")}.${suggestion} ${supported}`);
+	}
+	return ENV_PULL_KEYS.filter((key) => names.includes(key));
+};
+const redactUnknownEnvValue = (value) => {
+	const separator = value.indexOf("=");
+	if (separator !== -1) {
+		const key = value.slice(0, separator);
+		return ENV_PULL_KEYS.some((supportedKey) => supportedKey === key) ? `${key}=<redacted>` : "<redacted invalid value>";
+	}
+	return "<redacted invalid value>";
+};
+const suggestEnvPullKey = (value) => {
+	if (value.includes("=")) return null;
+	const closest = ENV_PULL_KEYS.map((key) => [key, editDistance(value, key)]).sort((a, b) => a[1] - b[1])[0];
+	return closest && closest[1] <= 2 ? closest[0] : null;
+};
+const editDistance = (left, right) => {
+	let previous = Array.from({ length: right.length + 1 }, (_, index) => index);
+	for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {
+		const current = [leftIndex];
+		for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) current[rightIndex] = Math.min((previous[rightIndex] ?? 0) + 1, (current[rightIndex - 1] ?? 0) + 1, (previous[rightIndex - 1] ?? 0) + (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1));
+		previous = current;
+	}
+	return previous[right.length] ?? right.length;
+};
+/** Narrow yargs' array option value without accepting any other runtime shape. */
+const envPullFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
+//#endregion
+export { policyEnvKeys as _, envKeysForSelection as a, toEntries as b, ownedEnvServiceKeys as c, servicesForEnvKeys as d, NEON_ENV_VAR_KEYS as f, fetchEnvKeys as g, credentialName as h, ENV_PULL_UNAVAILABLE as i, parseEnvPullKeys as l, credentialEnvKeys as m, ENV_PULL_KEYS as n, envPullFlagValue as o, createApiFromOptions as p, ENV_PULL_SERVICES as r, envServiceKeys as s, BRANCH_ENV_KEY as t, serviceForEnvKey as u, previewCredentialScopes as v, resolveBranchPolicy as y };

package/dist/{_shared/paths.js → _chunks/paths-DMq0Lt7a.js}

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
-//#region src/_shared/paths.ts
+//#region ../../internals/cli-core/dist/paths.js
 /**
 * # Where the Neon CLIs keep their files on disk
 *
@@ -148,4 +148,4 @@ const isOwnedCredentialPath = (configDirectory, file) => {
 	return legacy !== void 0 && isInsideConfigDir(legacy, file);
 };
 //#endregion
-export { CONFIG_DIR_NAME, CREDENTIALS_FILE, LEGACY_CONFIG_DIR_NAME, configDir, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath, legacyConfigDir, resolveConfigFile };
+export { isOwnedCredentialPath as a, isInsideConfigDir as i, credentialsPath as n, resolveConfigFile as o, defaultDir as r, CREDENTIALS_FILE as t };

package/dist/{_shared/profiles.js → _chunks/profiles-Ir29rqns.js}

@@ -1,8 +1,8 @@
-import { writeSecretFile } from "./secure_file.js";
-import { credentialsPath, defaultDir, resolveConfigFile } from "./paths.js";
+import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
+import { n as credentialsPath, o as resolveConfigFile, r as defaultDir } from "./paths-DMq0Lt7a.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
-//#region src/_shared/profiles.ts
+//#region ../../internals/cli-core/dist/profiles.js
 /**
 * # Profiles — several Neon accounts in one config directory
 *
@@ -180,15 +180,6 @@ const upsertProfile = (dir, name, entry) => {
 	};
 	writeProfiles(path, file);
 };
-/** Remove an entry. Returns false when it wasn't there. */
-const removeProfileEntry = (dir, name) => {
-	const path = profilesFilePath(dir);
-	const file = readProfiles(dir);
-	if (!file?.profiles[name]) return false;
-	delete file.profiles[name];
-	writeProfiles(path, file);
-	return true;
-};
 /**
 * True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
 * lazy creation: a single-account install has no profiles file, before or after.
@@ -223,4 +214,4 @@ function nonEmpty(value) {
 	return trimmed === "" ? void 0 : trimmed;
 }
 //#endregion
-export { DEFAULT_PROFILE, PROFILES_FILE, assertProfilesUsable, assertValidProfileName, inspectProfiles, listProfiles, newProfileCredentialsPath, onlyDefaultRemains, profilesFilePath, readProfiles, removeProfileEntry, resolveProfile, selectProfileName, upsertProfile };
+export { newProfileCredentialsPath as a, readProfiles as c, upsertProfile as d, listProfiles as i, resolveProfile as l, assertProfilesUsable as n, onlyDefaultRemains as o, assertValidProfileName as r, profilesFilePath as s, DEFAULT_PROFILE as t, selectProfileName as u };