neon 3.1.0 → 3.1.1

package/dist/commands/profile.js

@@ -1,15 +1,15 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
-import { writeSecretFile } from "../_shared/secure_file.js";
-import { API_KEY, OAUTH, apiKeyCredentials, credentialKind, describeScope, inspectCredentials, interpretCredentials, isSameCredential, readCredentials, scopeOf, writeCredentials } from "../_shared/credentials.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
+import { a as describeScope, c as isSameCredential, d as writeCredentials, i as credentialKind, l as readCredentials, n as OAUTH, o as inspectCredentials, r as apiKeyCredentials, s as interpretCredentials, t as API_KEY, u as scopeOf } from "../_chunks/credentials-MYdHdKah.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
-import { isInsideConfigDir } from "../_shared/paths.js";
+import { i as isInsideConfigDir } from "../_chunks/paths-DMq0Lt7a.js";
 import "../config.js";
 import { setAuthContext } from "../auth_context.js";
 import { auth, revokeToken } from "../auth.js";
-import { assertProfilesUsable, assertValidProfileName, listProfiles, newProfileCredentialsPath, onlyDefaultRemains, profilesFilePath, readProfiles, resolveProfile, selectProfileName, upsertProfile } from "../_shared/profiles.js";
-import { credentialInputs } from "../_shared/auth_selection.js";
+import { a as newProfileCredentialsPath, c as readProfiles, d as upsertProfile, i as listProfiles, l as resolveProfile, n as assertProfilesUsable, o as onlyDefaultRemains, r as assertValidProfileName, s as profilesFilePath, u as selectProfileName } from "../_chunks/profiles-Ir29rqns.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
 import { authFlow, credentialsPathForName, usableCredential } from "./auth.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
@@ -679,4 +679,4 @@ const revokeTokenSet = async (credentials, props) => {
 	}, tokenSet);
 };
 //#endregion
-export { aliases, builder, command, describe, handler, profile_exports };
+export { aliases, builder, command, describe, handler, profile_exports as t };

package/dist/commands/projects.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody } from "../api.js";
@@ -351,4 +351,4 @@ const onPromptState = (state) => {
 	}
 };
 //#endregion
-export { PROJECT_FIELDS, REGIONS, aliases, builder, command, describe, handler, projects_exports };
+export { PROJECT_FIELDS, REGIONS, aliases, builder, command, describe, handler, projects_exports as t };

package/dist/commands/psql.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { SSL_MODES, handler as handler$1 } from "./connection_string.js";
@@ -61,4 +61,4 @@ const handler = async (props) => {
 	});
 };
 //#endregion
-export { builder, command, describe, handler, psql_exports };
+export { builder, command, describe, handler, psql_exports as t };

package/dist/commands/roles.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
@@ -59,4 +59,4 @@ const deleteRole = async (props) => {
 	if (data) writer(props).end(data.role, { fields: ROLES_FIELDS });
 };
 //#endregion
-export { aliases, builder, command, create, deleteRole, describe, handler, list, roles_exports };
+export { aliases, builder, command, create, deleteRole, describe, handler, list, roles_exports as t };

package/dist/commands/set_context.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { applyContext } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
@@ -35,4 +35,4 @@ const handler = (props) => {
 	applyContext(props.contextFile, context);
 };
 //#endregion
-export { builder, command, describe, handler, set_context_exports };
+export { builder, command, describe, handler, set_context_exports as t };

package/dist/commands/snapshots.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
@@ -327,4 +327,4 @@ const scheduleSet = async (props) => {
 	});
 };
 //#endregion
-export { SNAPSHOT_FIELDS, aliases, builder, command, describe, handler, snapshots_exports };
+export { SNAPSHOT_FIELDS, aliases, builder, command, describe, handler, snapshots_exports as t };

package/dist/commands/status.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { status } from "./config.js";
 //#region src/commands/status.ts
@@ -41,4 +41,4 @@ const builder = (argv) => argv.usage("$0 status [options]").options({
 }).middleware(fillSingleProject);
 const handler = (args) => status(args);
 //#endregion
-export { builder, command, describe, handler, status_exports };
+export { builder, command, describe, handler, status_exports as t };

package/dist/commands/user.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { writer } from "../writer.js";
 //#region src/commands/user.ts
 var user_exports = /* @__PURE__ */ __exportAll({
@@ -23,4 +23,4 @@ const me = async (props) => {
 	] });
 };
 //#endregion
-export { builder, command, describe, handler, user_exports };
+export { builder, command, describe, handler, user_exports as t };

package/dist/commands/vpc_endpoints.js

@@ -1,4 +1,4 @@
-import { __exportAll } from "../_virtual/_rolldown/runtime.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { log } from "../log.js";
 import { writer } from "../writer.js";
 import { fillSingleOrg, fillSingleProject } from "../utils/enrichers.js";
@@ -103,4 +103,4 @@ const removeProject = async (props) => {
 	writer(props).end(data, { fields: [] });
 };
 //#endregion
-export { builder, command, describe, vpc_endpoints_exports };
+export { builder, command, describe, vpc_endpoints_exports as t };

package/dist/config.js

@@ -1,5 +1,5 @@
 import { isCi } from "./env.js";
-import { CREDENTIALS_FILE, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath } from "./_shared/paths.js";
+import { a as isOwnedCredentialPath, i as isInsideConfigDir, n as credentialsPath, r as defaultDir, t as CREDENTIALS_FILE } from "./_chunks/paths-DMq0Lt7a.js";
 import { existsSync, mkdirSync } from "node:fs";
 //#region src/config.ts
 const ensureConfigDir = ({ "config-dir": configDirArg, "force-auth": forceAuth }) => {

package/dist/dev/env.js

@@ -1,365 +1,2 @@
-import { log } from "../log.js";
-import { getCliName } from "../utils/cli_name.js";
-import { NEON_ENV_VAR_KEYS } from "../_shared/env-core/env.js";
-import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
-import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
-import { createNeonApiFromOptions, loadConfigFromFile } from "@neon/config";
-import { plan, pullConfig } from "@neon/config-runtime";
-//#region src/dev/env.ts
-/** The API-targeting options every runtime call forwards from the context. */
-const apiOptions = (ctx) => ({
-	...ctx.apiKey ? { apiKey: ctx.apiKey } : {},
-	...ctx.apiHost ? { apiHost: ctx.apiHost } : {},
-	...ctx.api ? { api: ctx.api } : {}
-});
-/**
-* Thrown when a `neon.ts` policy declares a branch-level resource (Neon Auth,
-* Data API, a bucket, the AI Gateway) that the linked remote branch does not
-* have yet. Unlike every other failure in {@link resolveDevEnv} — which degrades
-* to "run without injection" — this is a hard stop: the user's intent (a policy)
-* cannot be honored, and silently dropping the secret would be more confusing
-* than refusing to start. The fix is to provision the resource first.
-*/
-var DevEnvMismatchError = class extends Error {
-	constructor(..._args) {
-		super(..._args);
-		this.name = "DevEnvMismatchError";
-	}
-};
-/**
-* Signals that no project/branch context could be resolved, so there is nothing to
-* resolve env from. `resolveDevEnv` degrades on this (dev runs without injection);
-* `env pull` surfaces it (an explicit pull needs a branch).
-*/
-var MissingBranchContextError = class extends Error {
-	constructor(..._args2) {
-		super(..._args2);
-		this.name = "MissingBranchContextError";
-	}
-};
-/**
-* Thrown when an explicit `--service` selection names a service the branch does not have.
-* Unlike the policy path — where the same situation is a {@link DevEnvMismatchError} pointing
-* at `deploy` — the user named the service on the command line, so the fix is to provision it
-* or drop it from the selection.
-*/
-var ServiceNotOnBranchError = class extends Error {
-	constructor(..._args3) {
-		super(..._args3);
-		this.name = "ServiceNotOnBranchError";
-	}
-};
-/**
-* Resolve the branch's Neon env vars (pooled / direct `DATABASE_URL`, plus Auth /
-* Data API when enabled) into a `{ KEY: value }` map. Shared by `neon dev` (which
-* injects them) and `neon env pull` (which writes them to a `.env` file).
-*
-* Tiered:
-*
-*   0. {@link DevEnvContext.services} is set -> that selection *is* the policy, and any
-*      `neon.ts` is ignored. See {@link resolveSelectedServices}.
-*   1. a `neon.ts` policy is found -> the policy is the source of truth. We first
-*      check it against the branch's live state (`plan`); if it declares a resource
-*      the branch is missing, we stop with a {@link DevEnvMismatchError} pointing at
-*      `neonctl deploy`. Otherwise `fetchEnv` evaluates the policy.
-*   2. no `neon.ts`, but a project + branch are known -> `pullConfig` reads the
-*      branch's live state (Auth / Data API enablement plus any object-storage
-*      buckets) into a config, then `fetchEnv` resolves what is actually enabled —
-*      so a branch with a bucket gets its `AWS_*` storage vars pulled with no policy.
-*      With {@link DevEnvContext.implyAiGateway}, the AI Gateway is added on top, since
-*      `pullConfig` cannot read it back.
-*   3. otherwise -> throw {@link MissingBranchContextError}.
-*
-* Unlike {@link resolveDevEnv}, this never swallows errors — callers decide how to
-* handle them.
-*/
-const resolveNeonEnvVars = async (ctx) => {
-	if (ctx.services) return await resolveSelectedServices(ctx, ctx.services);
-	const config = await loadNeonConfig(ctx.cwd);
-	if (config) {
-		if (!ctx.projectId || !ctx.branchId) throw new MissingBranchContextError(`Found a neon.ts but could not resolve the project/branch. Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass --project-id / --branch.`);
-		const envConfig = withoutPreviewFunctions(config);
-		await assertPolicyMatchesBranch(envConfig, ctx);
-		return await fetchAndProject(envConfig, ctx);
-	}
-	if (ctx.projectId && ctx.branchId) {
-		const pulled = await pullConfig({
-			projectId: ctx.projectId,
-			branchId: ctx.branchId,
-			...apiOptions(ctx)
-		});
-		if (!ctx.implyAiGateway) return await fetchAndProject(pulled.config, ctx);
-		return await resolveWithImpliedGateway(pulled.config, ctx, {
-			projectId: ctx.projectId,
-			branchId: ctx.branchId
-		});
-	}
-	throw new MissingBranchContextError(`No project/branch context found. Link a branch (\`${getCliName()} link\` / \`${getCliName()} checkout\`) or pass --project-id and --branch.`);
-};
-/** The same config with the AI Gateway enabled, leaving any other `preview` entries intact. */
-const withAiGateway = (config) => ({
-	...config,
-	preview: {
-		...config.preview,
-		aiGateway: true
-	}
-});
-/**
-* Tier-2 resolution with the AI Gateway added on top of the branch's read-back state.
-*
-* The gateway is not detectable — `pullConfig` reports no enabled flag for it — so it is
-* implied rather than observed. Nobody named it, so it must never be the reason the whole
-* resolve fails: a project outside the regions where branch credentials exist would otherwise
-* lose its `DATABASE_URL` too, and `neon dev` would start with no env at all.
-*
-* So the gateway is only added once its credential endpoint has been shown to answer, by
-* reading the branch's credentials first. A project that does not have them says so on a
-* read, before anything is minted — which is the whole question, since the gateway's env is a
-* credential and nothing else.
-*
-* Deciding this **before** resolving, rather than by catching and retrying, is what keeps it
-* honest. A retry re-runs every call the first attempt made, so it would blame the gateway for
-* a one-off failure in shared work, and — worse — a first attempt that minted a credential and
-* then failed would be papered over by a second that succeeds without one, swallowing the
-* error and stranding a secret nobody holds. Once the read succeeds, a later failure is a real
-* failure and propagates: the same thing already happens on a branch with object storage,
-* whose credential is minted whether or not the gateway is involved.
-*/
-const resolveWithImpliedGateway = async (config, ctx, branch) => {
-	const unreachable = await credentialsUnreachable(ctx, branch);
-	if (unreachable === null) return await fetchAndProject(withAiGateway(config), ctx);
-	log.warning(`Could not reach the AI Gateway's credentials, so %s were not resolved. Everything else was. Either this project does not have the AI Gateway, or the call failed — \`${getCliName()} env pull -s ai-gateway\` will say which.\nDetails: %s`, [NEON_ENV_VAR_KEYS.aiGateway.apiKey, NEON_ENV_VAR_KEYS.aiGateway.baseUrl].join(" and "), unreachable);
-	return {
-		...await fetchAndProject(config, ctx),
-		skipped: ["ai-gateway"]
-	};
-};
-/**
-* Why the branch's credentials could not be read, or `null` when they could. A plain read: it
-* mints nothing, revokes nothing, and changes nothing, so asking is free of the side effects
-* that make a failed resolve ambiguous.
-*/
-const credentialsUnreachable = async (ctx, branch) => {
-	try {
-		await apiFor(ctx).listCredentials(branch.projectId, branch.branchId);
-		return null;
-	} catch (err) {
-		return err instanceof Error ? err.message : String(err);
-	}
-};
-/** The adapter for direct branch reads: the injected one in tests, else built from options. */
-const apiFor = (ctx) => ctx.api ?? createNeonApiFromOptions("neon env", {
-	...ctx.apiKey ? { apiKey: ctx.apiKey } : {},
-	...ctx.apiHost ? { apiHost: ctx.apiHost } : {}
-});
-/**
-* Tier-0: resolve exactly the services `--service` named, with `neon.ts` out of the picture.
-*
-* The selection is checked against the branch's live state so a service that is named but not
-* provisioned fails by name, instead of quietly contributing no vars. `postgres` and the AI
-* Gateway are not checked: every branch has Postgres, and the gateway has no branch-level
-* state to check (an unavailable one surfaces when its credential is minted).
-*/
-const resolveSelectedServices = async (ctx, services) => {
-	const { projectId, branchId } = ctx;
-	if (!projectId || !branchId) throw new MissingBranchContextError(`--service needs a project and branch to read from. Run \`${getCliName()} link\` and \`${getCliName()} checkout <branch>\`, or pass --project-id / --branch.`);
-	const api = apiFor(ctx);
-	const has = (service) => services.includes(service);
-	const [auth, dataApiEnabled, buckets] = await Promise.all([
-		has("auth") ? api.getNeonAuth(projectId, branchId) : null,
-		has("data-api") ? readDataApiEnabled(api, projectId, branchId) : null,
-		has("object-storage") ? api.listBranchBuckets(projectId, branchId) : null
-	]);
-	const config = configForServices(services, branchId, {
-		authEnabled: auth !== null,
-		dataApiEnabled,
-		buckets: buckets ?? []
-	});
-	return await fetchAndProject(config, ctx, { revokeSuperseded: false });
-};
-/**
-* Whether the branch has a Data API integration — or `null` when that cannot be determined.
-*
-* It is enabled per branch *and database*, so this has to probe the database `fetchEnv` will
-* resolve the URL from, or the two would disagree. That is Neon's default `neondb`, else the
-* only database; several databases with no `neondb` is a case `fetchEnv` refuses to auto-pick
-* at all. Reporting "no Data API integration" there would be a claim this read cannot support,
-* so it answers `null` and lets `fetchEnv` raise its own ambiguity error, which names the
-* databases and the fix.
-*/
-const readDataApiEnabled = async (api, projectId, branchId) => {
-	const databases = await api.listBranchDatabases(projectId, branchId);
-	const database = databases.find((db) => db.name === NEON_DEFAULT_DATABASE) ?? (databases.length === 1 ? databases[0] : void 0);
-	if (!database) return databases.length === 0 ? false : null;
-	return await api.getNeonDataApi(projectId, branchId, database.name) !== null;
-};
-/** Neon's default database, and the one `fetchEnv` prefers when a branch has several. */
-const NEON_DEFAULT_DATABASE = "neondb";
-/**
-* Build the `Config` an explicit `--service` selection stands for, raising
-* {@link ServiceNotOnBranchError} for anything the branch does not have. Naming a service
-* that isn't there has to fail rather than contribute no vars, or a scoped pull would report
-* "no Neon env variables to pull" — which reads as a statement about the branch rather than
-* about the selection.
-*/
-const configForServices = (services, branchId, branch) => {
-	const provisionWith = {
-		auth: `${getCliName()} neon-auth enable`,
-		"data-api": `${getCliName()} data-api create`,
-		"object-storage": `${getCliName()} buckets create <name>`
-	};
-	const notOnBranch = (service, what) => {
-		throw new ServiceNotOnBranchError(`--service ${service}: branch ${branchId} has no ${what}, so there are no ${service} env vars to pull. Provision it first (\`${provisionWith[service]}\`, or in the Neon Console), or drop ${service} from --service.`);
-	};
-	const config = {};
-	if (services.includes("auth")) {
-		if (!branch.authEnabled) notOnBranch("auth", "Neon Auth integration");
-		config.auth = true;
-	}
-	if (services.includes("data-api")) {
-		if (branch.dataApiEnabled === false) notOnBranch("data-api", "Data API integration");
-		config.dataApi = true;
-	}
-	const preview = {};
-	if (services.includes("object-storage")) {
-		if (branch.buckets.length === 0) notOnBranch("object-storage", "object-storage buckets");
-		preview.buckets = Object.fromEntries(branch.buckets.map((bucket) => [bucket.name, { access: bucket.accessLevel }]));
-	}
-	if (services.includes("ai-gateway")) preview.aiGateway = true;
-	if (Object.keys(preview).length > 0) config.preview = preview;
-	return config;
-};
-/**
-* `neon dev`'s env resolver: {@link resolveNeonEnvVars} with graceful degradation.
-*
-* - Success → `{ vars }` (possibly just the always-present Postgres URLs).
-* - No linked branch / project → `{ vars: {}, skipped }` with a "link a branch" hint; the
-*   function still runs locally, just without Neon env.
-* - Any other failure (offline, transient API error) → `{ vars: {}, skipped }` naming the
-*   cause; again non-fatal.
-* - {@link DevEnvMismatchError} (policy declares a secret-bearing service the branch lacks)
-*   is the one hard stop and is re-thrown for the caller to surface.
-*/
-const resolveDevEnv = async (ctx) => {
-	try {
-		const { vars, credential } = await resolveNeonEnvVars(ctx);
-		return {
-			vars,
-			credential
-		};
-	} catch (err) {
-		if (err instanceof DevEnvMismatchError) throw err;
-		if (err instanceof MissingBranchContextError) {
-			log.debug("dev: %s; skipping env injection", err.message);
-			return {
-				vars: {},
-				skipped: { reason: `no linked Neon branch — run \`${getCliName()} link\`, then \`${getCliName()} checkout <branch>\`, to inject DATABASE_URL and friends` }
-			};
-		}
-		const detail = err instanceof Error ? err.message : String(err);
-		log.debug("dev: env resolution failed: %s", detail);
-		return {
-			vars: {},
-			skipped: { reason: `could not reach Neon (${detail}); running without Neon env` }
-		};
-	}
-};
-/**
-* Return the policy with its `preview.functions` removed, so the env path never enumerates
-* functions against the Neon API. Functions are local-source-bundled and produce no
-* branch-level secrets, so they are irrelevant to env resolution; probing them only risks
-* failing the whole resolve (undeployed function, or Functions Preview disabled on the
-* project). Buckets / AI Gateway and the top-level Auth / Data API toggles are preserved —
-* they DO carry env, so they must still be checked and resolved. Returns the config
-* unchanged when it declares no functions.
-*/
-const withoutPreviewFunctions = (config) => {
-	const preview = config.preview;
-	if (!preview?.functions) return config;
-	const previewWithoutFunctions = { ...preview };
-	delete previewWithoutFunctions.functions;
-	return {
-		...config,
-		preview: previewWithoutFunctions
-	};
-};
-/**
-* Tier-1 guard. Dry-run the policy against the branch's live state and stop if
-* it declares a branch-level resource the branch is missing. Built on `plan` so
-* it covers every present and future provisionable resource for free: any
-* `create` action is a resource `neonctl deploy` would provision.
-*
-* Called with functions already stripped (see {@link withoutPreviewFunctions}), so the
-* `plan` probe never enumerates the functions API — an undeployed function, or a project
-* without the Functions Preview, must never block local dev or sink env injection.
-*/
-const assertPolicyMatchesBranch = async (config, ctx) => {
-	const missing = (await plan(config, {
-		projectId: ctx.projectId,
-		branchId: ctx.branchId,
-		...apiOptions(ctx)
-	})).applied.filter(isMissingResource);
-	if (missing.length === 0) return;
-	throw new DevEnvMismatchError(`Your neon.ts declares ${missing.map((change) => change.identifier).join(", ")} for branch ${ctx.branchId}, but the branch does not have it yet, so the matching env vars cannot be injected. Provision it first with \`${getCliName()} deploy\` (or \`${getCliName()} config apply\`), then re-run \`${getCliName()} dev\`.`);
-};
-/**
-* A planned change that provisions a branch-level resource the branch lacks: a
-* `create` on a service (Neon Auth, Data API, a bucket, the AI Gateway). Branch
-* setting drift (`update`) and `noop`s are ignored — they don't block local dev
-* — and functions are excluded (see {@link assertPolicyMatchesBranch}).
-*/
-const isMissingResource = (change) => change.kind === "service" && change.action === "create" && !change.identifier.startsWith("function:");
-const fetchAndProject = async (config, ctx, opts = {}) => fetchEnvReusingSecrets(config, {
-	projectId: ctx.projectId,
-	branch: ctx.branchId,
-	...apiOptions(ctx),
-	...ctx.env ? { env: ctx.env } : {},
-	...opts.revokeSuperseded === false ? { revokeSuperseded: false } : {}
-});
-/**
-* Load a `neon.ts` policy if one exists on the path from `cwd` up to the repo
-* root. Returns `null` when there is none (the common "no config" case), and
-* surfaces real load errors (e.g. a syntax error in an existing file).
-*/
-/**
-* Substrings that mark a module-resolution failure while loading `neon.ts` —
-* almost always because the project's dependencies aren't installed yet (the
-* config imports `@neon/config` & friends). Deliberately specific:
-* the generic "…or a missing dependency…" hint the loader always appends is
-* NOT in here, so a real syntax/runtime error doesn't get mislabeled.
-*/
-const MISSING_DEPENDENCY_HINTS = [
-	"cannot find module",
-	"cannot find package",
-	"err_module_not_found",
-	"failed to resolve",
-	"could not resolve",
-	"module not found"
-];
-/** Flatten an error and its `cause` chain to one lowercased string for matching. */
-const errorChainText = (err) => {
-	const parts = [];
-	let current = err;
-	for (let depth = 0; current instanceof Error && depth < 6; depth++) {
-		parts.push(current.message);
-		current = current.cause;
-	}
-	return parts.join("\n").toLowerCase();
-};
-const looksLikeMissingDependency = (err) => {
-	const text = errorChainText(err);
-	return MISSING_DEPENDENCY_HINTS.some((hint) => text.includes(hint));
-};
-const loadNeonConfig = async (cwd) => {
-	try {
-		const { config } = await loadConfigFromFile({ cwd });
-		return config;
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (/Could not find a Neon config file/i.test(message)) return null;
-		if (looksLikeMissingDependency(err)) throw new Error(`Could not load neon.ts: a package it imports is not installed. Run \`${formatInstallCommand(resolvePackageManager(cwd))}\`, then try again.\nOriginal error: ${message}`);
-		throw err;
-	}
-};
-//#endregion
+import { a as resolveNeonEnvVars, i as resolveDevEnv, n as MissingBranchContextError, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-NbA61JR3.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,49 +1,2 @@
-import { NEON_SERVICES } from "./neon_services.js";
-import { NEON_ENV_VAR_KEYS } from "./_shared/env-core/env.js";
-//#region src/env_services.ts
-/**
-* The services `env pull --service` can select: every Neon service that produces branch env
-* vars. `functions` is the one left out — a function's env comes from the local `neon.ts`,
-* never from the branch, so there is nothing to pull.
-*/
-const ENV_PULL_SERVICES = NEON_SERVICES.filter((service) => service !== "functions");
-/** Why the services `env pull` leaves out are not selectable, for the refusal message. */
-const ENV_PULL_UNAVAILABLE = { functions: "a function's env comes from your neon.ts, not from the branch, so there is nothing to pull" };
-/** The OS-level env vars each service contributes to a pulled `.env`. */
-const SERVICE_ENV_KEYS = {
-	postgres: Object.values(NEON_ENV_VAR_KEYS.postgres),
-	auth: Object.values(NEON_ENV_VAR_KEYS.auth),
-	"data-api": Object.values(NEON_ENV_VAR_KEYS.dataApi),
-	"object-storage": Object.values(NEON_ENV_VAR_KEYS.storage),
-	"ai-gateway": Object.values(NEON_ENV_VAR_KEYS.aiGateway),
-	functions: []
-};
-/**
-* The subset of {@link SERVICE_ENV_KEYS} a pull *owns*, and so may prune from the target file
-* when the branch no longer has it. Object storage is deliberately absent: it is emitted under
-* the third-party `AWS_*` names, which collide with credentials a user may set by hand, so
-* `env pull` only ever writes them.
-*/
-const SERVICE_OWNED_ENV_KEYS = {
-	...SERVICE_ENV_KEYS,
-	"object-storage": []
-};
-/**
-* Branch identity. Not a service — every branch has a name — so a scoped pull refreshes it
-* alongside whatever services were selected.
-*/
-const BRANCH_ENV_KEY = NEON_ENV_VAR_KEYS.branch.name;
-/** Every env var the selected services contribute, plus branch identity. */
-const envServiceKeys = (services) => {
-	const keys = /* @__PURE__ */ new Set([BRANCH_ENV_KEY]);
-	for (const service of services) for (const key of SERVICE_ENV_KEYS[service]) keys.add(key);
-	return keys;
-};
-/**
-* The env vars a pull scoped to `services` may prune. Narrower than the unscoped set on
-* purpose: `env pull -s ai-gateway` says nothing about `DATABASE_URL`, so it must leave it
-* alone rather than treat its absence from this pull as "the branch no longer has it".
-*/
-const ownedEnvServiceKeys = (services) => services.flatMap((service) => SERVICE_OWNED_ENV_KEYS[service]);
-//#endregion
-export { BRANCH_ENV_KEY, ENV_PULL_SERVICES, ENV_PULL_UNAVAILABLE, envServiceKeys, ownedEnvServiceKeys };
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_UNAVAILABLE, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_SERVICES, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-Tz9G4JeT.js";
+export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_SERVICES, ENV_PULL_UNAVAILABLE, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { isNeonApiError, messageFromBody } from "./api.js";
-import { defaultDir } from "./_shared/paths.js";
+import { r as defaultDir } from "./_chunks/paths-DMq0Lt7a.js";
 import { ensureConfigDir } from "./config.js";
 import { authFailureMessage, credentialsToClearOn401, getAuthContext } from "./auth_context.js";
 import { currentContextFile, enrichFromContext } from "./context.js";

package/dist/init/auth.js

@@ -1,6 +1,6 @@
-import { inspectCredentials, interpretCredentials } from "../_shared/credentials.js";
-import { resolveConfigFile } from "../_shared/paths.js";
-import { DEFAULT_PROFILE } from "../_shared/profiles.js";
+import { o as inspectCredentials, s as interpretCredentials } from "../_chunks/credentials-MYdHdKah.js";
+import { o as resolveConfigFile } from "../_chunks/paths-DMq0Lt7a.js";
+import { t as DEFAULT_PROFILE } from "../_chunks/profiles-Ir29rqns.js";
 import { log } from "@clack/prompts";
 import { execa } from "execa";
 //#region src/init/auth.ts
@@ -43,7 +43,7 @@ async function isAuthenticated() {
 * Shares the reader with `neon` and `@neon/env` rather than keeping a copy — the inline path
 * resolution this replaced was the third implementation of "where is the config directory", and
 * it also looked only for `access_token`, so an account signed in with an API key read as not
-* authenticated and got sent to a browser. See `shared/cli-core/README.md`.
+* authenticated and got sent to a browser. See `internals/cli-core/README.md`.
 *
 * `null` means *absent*, and only absent. A file that exists and cannot be read throws: this
 * value decides whether to start a browser sign-in, and a sign-in overwrites the file it could

package/dist/psql/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { looksLikeConnectionString, runPsql } from "./index.js";
+import { i as looksLikeConnectionString, u as runPsql } from "../_chunks/psql-DWH-kc69.js";
 //#region src/psql/cli.ts
 /**
 * Standalone psql shim.

package/dist/psql/command/cmd_copy.js

@@ -1,6 +1,6 @@
 import { writeErr, writeOut } from "./shared.js";
 import { pumpReadable } from "../wire/copy.js";
-import { getPipelineState } from "./cmd_pipeline.js";
+import { m as getPipelineState } from "../../_chunks/cmd_pipeline-CUbBO9U_.js";
 import { createReadStream, createWriteStream, promises } from "node:fs";
 import { spawn } from "node:child_process";
 import { Buffer } from "node:buffer";