neon 4.13.0 → 4.14.0

package/dist/dev/functions.js

@@ -21,21 +21,38 @@ const resolveFunctionsFromConfig = async (cwd, branchName) => {
 			name: branchName ?? "local",
 			exists: branchName !== void 0
 		}).preview?.functions ?? []).map((fn) => {
-			const source = isAbsolute(fn.source) ? fn.source : resolve(configDir, fn.source);
+			const source = resolveFunctionSource(fn.source, configDir);
 			if (!existsSync(source)) throw new Error(`Function "${fn.slug}" points at a source that does not exist: ${source} (from neon.ts "${fn.source}"). Fix the source path and re-run.`);
-			return {
-				slug: fn.slug,
-				name: fn.name,
-				source,
-				...devPort(fn.dev) !== void 0 ? { port: devPort(fn.dev) } : {},
-				env: { ...fn.env },
-				...fn.externalPackages ? { externalPackages: fn.externalPackages.map((pkg) => pkg.name) } : {},
-				...fn.bundler !== "esbuild" ? { bundler: fn.bundler } : {}
-			};
+			return toPlannedFunction(fn, source);
 		})
 	};
 };
 /**
+* The neon.ts function whose `source` is this file, if any. Sibling sources are not
+* required to exist: `neon dev --source` is serving one file, not the whole set.
+*/
+const findConfigFunctionBySource = async (cwd, source) => {
+	const loaded = await loadNeonConfig(cwd);
+	if (!loaded) return void 0;
+	return (resolveConfig(loaded.config, {
+		name: "local",
+		exists: false
+	}).preview?.functions ?? []).map((fn) => toPlannedFunction(fn, resolveFunctionSource(fn.source, loaded.configDir))).find((fn) => fn.source === source);
+};
+const resolveFunctionSource = (source, configDir) => isAbsolute(source) ? source : resolve(configDir, source);
+const toPlannedFunction = (fn, source) => {
+	const port = devPort(fn.dev);
+	return {
+		slug: fn.slug,
+		name: fn.name,
+		source,
+		...port !== void 0 ? { port } : {},
+		env: { ...fn.env },
+		...fn.externalPackages ? { externalPackages: fn.externalPackages.map((pkg) => pkg.name) } : {},
+		...fn.bundler !== "esbuild" ? { bundler: fn.bundler } : {}
+	};
+};
+/**
 * Read the `port` off a {@link FunctionDevConfig}. `undefined` when no `dev.port` is set
 * (the supervisor then searches for a free port).
 */
@@ -61,4 +78,4 @@ const loadNeonConfig = async (cwd) => {
 	}
 };
 //#endregion
-export { resolveFunctionsFromConfig };
+export { findConfigFunctionBySource, resolveFunctionsFromConfig };

package/dist/dev/websocket.js

@@ -357,7 +357,7 @@ const handleUpgrade = async (req, socket, head, { fetch: fetchHandler, upgrade,
 		return;
 	}
 	if (record.claimed) {
-		log("websocket_upgrade_response_lost: upgradeWebSocket() was called for this request but the response returned from the handler is not the one it produced. `Response.clone()` and rebuilding a response (`new Response(res.body, res)`, as response-rewriting middleware does) both discard the upgrade. Return the `response` from upgradeWebSocket() unchanged.");
+		log("websocket_upgrade_response_lost: upgradeWebSocket() was called for this request but the response returned from the handler is not the one it produced. `Response.clone()` and rebuilding a response (`new Response(res.body, res)`, as response-rewriting middleware does) both discard the upgrade. Return the `response` from upgradeWebSocket() unchanged.\nWith @neon/functions/hono the helper returns the response for you, so this is a middleware on the upgrade route rebuilding it: `cors()` always does, and so does any middleware that reads `c.res` before `await next()` or calls `c.header()` after it. Take it off this route. It usually surfaces first as `RangeError: init[\"status\"] must be in the range of 200 to 599` from inside Hono, which names none of this.");
 		abortClaimedUpgrade(record);
 		writeUpgradeRejection(socket, 500, "websocket_upgrade_response_lost");
 		return;

package/dist/env_services.js

@@ -1,2 +1,2 @@
-import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_UNAVAILABLE, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_SERVICES, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-Tz9G4JeT.js";
-export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_SERVICES, ENV_PULL_UNAVAILABLE, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };
+import { a as envKeysForSelection, c as ownedEnvServiceKeys, d as servicesForEnvKeys, i as ENV_PULL_SERVICES, l as parseEnvPullKeys, n as ENV_PULL_KEYS, o as envPullFlagValue, r as ENV_PULL_KEY_HELP, s as envServiceKeys, t as BRANCH_ENV_KEY, u as serviceForEnvKey } from "./_chunks/env_services-CAWrZTWa.js";
+export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };

package/dist/index.js

@@ -1,16 +1,17 @@
+import { t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { isNeonApiError, messageFromBody } from "./api.js";
+import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
 import { r as defaultDir } from "./_chunks/paths-DMq0Lt7a.js";
 import { ensureConfigDir } from "./config.js";
-import { authFailureMessage, credentialsToClearOn401, getAuthContext } from "./auth_context.js";
 import { currentContextFile, enrichFromContext } from "./context.js";
 import { analyticsMiddleware, closeAnalytics, getAnalyticsEventProperties, initAnalyticsClientMiddleware, sendError, trackEvent } from "./analytics.js";
 import { NETWORK_ERROR_MESSAGE, isNetworkError, matchErrorCode } from "./errors.js";
-import { defaultClientID } from "./auth.js";
+import { AuthRefreshError, defaultClientID } from "./auth.js";
 import { getCliName } from "./utils/cli_name.js";
 import { showHelp } from "./help.js";
-import { deleteCredentialsAt, ensureAuth } from "./commands/auth.js";
+import { ensureAuth, isAccessTokenUsable, refreshStoredCredentials } from "./commands/auth.js";
 import { rewriteUnknownAgentArg } from "./init/plan.js";
 import commands_default from "./commands/index.js";
 import { fillInArgs, resolveApiKeyFromEnv } from "./utils/middlewares.js";
@@ -123,7 +124,64 @@ builder = builder.scriptName(pkg_default.name).locale("en").usage("$0 <command>
 }).alias("help", "h").middleware(async (args) => {
 	if (args.help || args._.length === 1 && !NO_SUBCOMMANDS_VERBS.includes(args._[0])) await showHelp(builder);
 }).middleware(ensureAuth).middleware(enrichFromContext).middleware(analyticsMiddleware).command(commands_default).strictCommands().version(pkg_default.version).group("version", "Global options:").alias("version", "v").completion().scriptName(getCliName()).epilog("For more information, visit https://neon.com/docs/reference/neon-cli").wrap(null).fail(false);
-async function handleError(msg, err) {
+function supersededOnDisk(rejectedToken) {
+	if (rejectedToken === void 0) return false;
+	const context = getAuthContext();
+	if (context === null) return false;
+	const at = locationFromContext(context);
+	if (at === null) return false;
+	try {
+		const loaded = storeFor(context.configDir).read(at);
+		return loaded !== null && loaded.credentials.access_token !== rejectedToken && isAccessTokenUsable(loaded.credentials, Date.now());
+	} catch {
+		return false;
+	}
+}
+async function recoverFrom401(canRetry) {
+	const context = getAuthContext();
+	if (context === null || context.source !== "stored-credentials") {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	if (context.refreshed === true) {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	if (!canRetry) {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	if (supersededOnDisk(context.accessToken)) {
+		log.debug("The rejected token has already been replaced on disk; retrying with the current one");
+		return true;
+	}
+	const at = locationFromContext(context);
+	if (at === null || context.oauthHost === void 0 || context.clientId === void 0) {
+		log.error(authFailureMessage(context));
+		return false;
+	}
+	try {
+		if (await refreshStoredCredentials(at, {
+			apiHost: "",
+			oauthHost: context.oauthHost,
+			clientId: context.clientId,
+			configDir: context.configDir
+		})) {
+			log.debug("Refreshed the stored session after a 401; retrying");
+			return true;
+		}
+	} catch (err) {
+		if (err instanceof AuthRefreshError) {
+			log.error(err.message);
+			if (err.terminal) log.error(`Run \`neon auth --profile ${context.profile ?? "DEFAULT"}\` to sign in again.`);
+			return false;
+		}
+		log.debug("Refresh after 401 failed: %s", err instanceof Error ? err.message : "unknown error");
+	}
+	log.error(authFailureMessage(context));
+	return false;
+}
+async function handleError(msg, err, canRetry) {
 	if (process.argv.some((arg) => arg === "--help" || arg === "-h")) {
 		await showHelp(builder);
 		process.exit(0);
@@ -142,6 +200,15 @@ async function handleError(msg, err) {
 			return false;
 		}
 	}
+	if (err instanceof AuthRefreshError) {
+		log.error(err.message);
+		if (err.terminal) {
+			const context = getAuthContext();
+			log.error(`Run \`neon auth --profile ${context?.profile ?? "DEFAULT"}\` to sign in again.`);
+		}
+		sendError(err, "AUTH_FAILED");
+		return false;
+	}
 	if (isNetworkError(err)) {
 		log.error(NETWORK_ERROR_MESSAGE);
 		const error = err instanceof Error ? err : new Error(NETWORK_ERROR_MESSAGE);
@@ -155,21 +222,7 @@ async function handleError(msg, err) {
 			return false;
 		} else if (err.status === 401) {
 			sendError(err, "AUTH_FAILED");
-			const context = getAuthContext();
-			const staleCredentials = credentialsToClearOn401(context);
-			if (staleCredentials === null) {
-				log.error(authFailureMessage(context));
-				return false;
-			}
-			log.info("Authentication failed, deleting credentials...");
-			try {
-				if (context === null) return false;
-				deleteCredentialsAt(staleCredentials, context.configDir);
-				return true;
-			} catch (deleteErr) {
-				log.debug("Failed to delete credentials: %s", deleteErr instanceof Error ? deleteErr.message : "unknown error");
-				return false;
-			}
+			return await recoverFrom401(canRetry);
 		} else {
 			const serverMessage = messageFromBody(err.data);
 			if (serverMessage) log.error(serverMessage);
@@ -206,7 +259,7 @@ async function handleError(msg, err) {
 		break;
 	} catch (err) {
 		attempts++;
-		if (!await handleError("", err) || attempts >= MAX_ATTEMPTS) {
+		if (!await handleError("", err, attempts < MAX_ATTEMPTS) || attempts >= MAX_ATTEMPTS) {
 			await closeAnalytics();
 			process.exit(1);
 		}

package/dist/init/build_config.js

@@ -0,0 +1,4 @@
+//#region src/init/build_config.ts
+const INTERNAL_VSX_GALLERY = "";
+//#endregion
+export { INTERNAL_VSX_GALLERY };

package/dist/neon_services.js

@@ -48,8 +48,8 @@ const deprecatedServiceMessage = (used, canonical) => `"${used}" is the old name
 *
 * An unrecognized name is rejected rather than dropped: a typo would otherwise act on
 * everything *except* the service that was asked for, and report success. A name that is a
-* real service but not one this command supports says so specifically — "functions has no env
-* variables" is a different problem from a typo, and has a different fix.
+* real service but not one this command supports says so specifically — "postgres is on
+* every branch" is a different problem from a typo, and has a different fix.
 */
 const parseServices = (raw, options) => {
 	const { allowed, flag, noneMeans, whyUnavailable = {}, onDeprecated } = options;

package/dist/psql/wire/connection.js

@@ -4,9 +4,9 @@ import { PipelineSession } from "./pipeline.js";
 import { createScramClient } from "./sasl.js";
 import { negotiateTls } from "./tls.js";
 import { createHash } from "node:crypto";
+import * as net from "node:net";
 import { Buffer } from "node:buffer";
 import * as dns from "node:dns/promises";
-import * as net from "node:net";
 import * as tls from "node:tls";
 //#region src/psql/wire/connection.ts
 /**

package/dist/refresh_lock.js

@@ -0,0 +1,44 @@
+import { closeSync, openSync, statSync, unlinkSync } from "node:fs";
+//#region src/refresh_lock.ts
+const WAIT_MS = 2e4;
+const RETRY_MS = 50;
+const STALE_MS = 6e4;
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const isEexist = (err) => err instanceof Error && err.code === "EEXIST";
+const isStale = (path) => {
+	try {
+		return Date.now() - statSync(path).mtimeMs > STALE_MS;
+	} catch {
+		return true;
+	}
+};
+/**
+* Serialize exchanges because replaying a one-time refresh token can revoke the
+* newly issued token family.
+*/
+const withExclusiveLock = async (lockPath, fn) => {
+	const deadline = Date.now() + WAIT_MS;
+	for (;;) try {
+		const fd = openSync(lockPath, "wx", 384);
+		try {
+			return await fn();
+		} finally {
+			closeSync(fd);
+			try {
+				unlinkSync(lockPath);
+			} catch {}
+		}
+	} catch (err) {
+		if (!isEexist(err)) throw err;
+		if (isStale(lockPath)) {
+			try {
+				unlinkSync(lockPath);
+			} catch {}
+			continue;
+		}
+		if (Date.now() >= deadline) throw new Error(`Could not lock ${lockPath} to refresh the stored session. Retry the command.`);
+		await delay(RETRY_MS);
+	}
+};
+//#endregion
+export { withExclusiveLock };

package/dist/retire_credential.js

@@ -1,4 +1,4 @@
-import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-YeAxg9Xn.js";
+import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-D8AR-jvB.js";
 import { log } from "./log.js";
 import { getApiClient } from "./api.js";
 import { revokeToken } from "./auth.js";

package/dist/test_utils/neon_api_server.js

@@ -0,0 +1,60 @@
+import { createServer } from "node:http";
+//#region src/test_utils/neon_api_server.ts
+const startNeonApiServer = async (user = {
+	id: "user-1",
+	email: "user@example.com"
+}) => {
+	const rejected = /* @__PURE__ */ new Set();
+	const seen = [];
+	let rejectAll = false;
+	let failUserLookup = false;
+	const server = createServer((req, res) => {
+		const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+		const token = (req.headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+		if (url.pathname !== "/users/me") return json(res, 404, { message: "Not Found" });
+		seen.push(token);
+		if (rejectAll || token === "" || rejected.has(token)) return json(res, 401, { message: "Unauthorized" });
+		if (failUserLookup) return json(res, 500, { message: "Internal Server Error" });
+		return json(res, 200, {
+			id: user.id,
+			email: user.email,
+			login: "tester",
+			name: "Tester",
+			projects_limit: 10,
+			branches_limit: 10,
+			max_autoscaling_limit: 1,
+			plan: "free",
+			auth_accounts: []
+		});
+	});
+	await new Promise((resolve) => {
+		server.listen(0, "127.0.0.1", resolve);
+	});
+	return {
+		url: `http://127.0.0.1:${server.address().port}`,
+		reject: (accessToken) => {
+			rejected.add(accessToken);
+		},
+		rejectAll: (value) => {
+			rejectAll = value;
+		},
+		failUserLookup: (value) => {
+			failUserLookup = value;
+		},
+		seenTokens: () => [...seen],
+		stop: () => closeServer(server)
+	};
+};
+const json = (res, status, body) => {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"content-length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+};
+const closeServer = (server) => new Promise((resolve, reject) => {
+	server.close((err) => err ? reject(err) : resolve());
+});
+//#endregion
+export { startNeonApiServer };

package/dist/test_utils/rotating_oauth_server.js

@@ -0,0 +1,94 @@
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+//#region src/test_utils/rotating_oauth_server.ts
+const startRotatingOauthServer = async (options = {}) => {
+	const lifetime = options.accessTokenLifetimeSeconds ?? 3600;
+	const liveRefreshTokens = /* @__PURE__ */ new Set();
+	let refreshAttempts = 0;
+	let rotations = 0;
+	let unreachable = false;
+	const issue = ({ expiresIn = lifetime } = {}) => {
+		const refresh = `refresh-${randomUUID()}`;
+		liveRefreshTokens.add(refresh);
+		return {
+			access_token: `access-${randomUUID()}`,
+			refresh_token: refresh,
+			expires_in: expiresIn,
+			token_type: "bearer"
+		};
+	};
+	const server = createServer((req, res) => {
+		const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+		if (url.pathname === "/.well-known/openid-configuration") return json(res, 200, {
+			issuer: baseUrl(),
+			token_endpoint: `${baseUrl()}/oauth2/token`,
+			authorization_endpoint: `${baseUrl()}/oauth2/authorize`,
+			revocation_endpoint: `${baseUrl()}/oauth2/revoke`,
+			response_types_supported: ["code"],
+			grant_types_supported: ["authorization_code", "refresh_token"],
+			token_endpoint_auth_methods_supported: ["none"],
+			scopes_supported: [
+				"openid",
+				"offline",
+				"offline_access"
+			]
+		});
+		if (url.pathname === "/oauth2/token" && req.method === "POST") return readBody(req, (body) => {
+			const form = new URLSearchParams(body);
+			if (form.get("grant_type") !== "refresh_token") return json(res, 400, { error: "unsupported_grant_type" });
+			refreshAttempts += 1;
+			if (unreachable) {
+				res.destroy();
+				return;
+			}
+			const presented = form.get("refresh_token") ?? "";
+			if (!liveRefreshTokens.delete(presented)) return json(res, 400, {
+				error: "invalid_grant",
+				error_description: "The provided authorization grant or refresh token is invalid, expired, or revoked."
+			});
+			rotations += 1;
+			return json(res, 200, {
+				...issue(),
+				scope: "openid offline offline_access"
+			});
+		});
+		return json(res, 404, { error: "not_found" });
+	});
+	await new Promise((resolve) => {
+		server.listen(0, "127.0.0.1", resolve);
+	});
+	const baseUrl = () => `http://127.0.0.1:${server.address().port}`;
+	return {
+		url: baseUrl(),
+		refreshAttempts: () => refreshAttempts,
+		rotations: () => rotations,
+		issue,
+		revoke: (refreshToken) => {
+			liveRefreshTokens.delete(refreshToken);
+		},
+		setUnreachable: (value) => {
+			unreachable = value;
+		},
+		stop: () => closeServer(server)
+	};
+};
+const json = (res, status, body) => {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"content-type": "application/json;charset=UTF-8",
+		"content-length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+};
+const readBody = (req, next) => {
+	let body = "";
+	req.on("data", (chunk) => {
+		body += chunk.toString();
+	});
+	req.on("end", () => next(body));
+};
+const closeServer = (server) => new Promise((resolve, reject) => {
+	server.close((err) => err ? reject(err) : resolve());
+});
+//#endregion
+export { startRotatingOauthServer };

package/dist/utils/config_diff.js

@@ -104,18 +104,6 @@ const appliedBranchFields = (change) => {
 		default: return expandField(field, void 0, details.settings);
 	}
 };
-/**
-* Render the applied (or planned) changes as a `git diff`-style list:
-*
-* - **Service changes** (auth / Data API / buckets / functions) are additions
-*   with no meaningful "before", so they list as green `+ <label>` lines
-*   (`~ <label>` for the lone Data API settings *update*).
-* - **Branch setting changes** group per branch and render as sorted
-*   `field → value` lines under a `~ <branch>` header.
-*
-* Returns "" when there is nothing to show. Pure — callers own the heading
-* spacing and any surrounding summary.
-*/
 const renderAppliedChanges = (changes, title, opts) => {
 	if (changes.length === 0) return "";
 	const paint = palette(opts.color);
@@ -123,7 +111,8 @@ const renderAppliedChanges = (changes, title, opts) => {
 	const services = changes.filter((c) => c.kind === "service").sort((a, b) => a.identifier.localeCompare(b.identifier));
 	for (const service of services) {
 		const label = serviceLabel(service.identifier);
-		lines.push(service.action === "create" ? `  ${paint.added(`+ ${label}`)}` : `  ${paint.arrow(`~ ${label}`)}`);
+		const line = service.action === "create" ? `+ ${label}` : service.action === "delete" ? `- ${label}` : `~ ${label}`;
+		lines.push(`  ${service.action === "create" ? paint.added(line) : service.action === "delete" ? paint.removed(line) : paint.arrow(line)}`);
 	}
 	const byBranch = /* @__PURE__ */ new Map();
 	for (const change of changes.filter((c) => c.kind === "branch")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.13.0",
+  "version": "4.14.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.1.0",
-    "@neon/sdk": "3.0.0",
-    "@neon/config-runtime": "1.1.0"
+    "@neon/config": "1.2.0",
+    "@neon/sdk": "3.1.0",
+    "@neon/config-runtime": "1.2.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -73,6 +73,7 @@
   },
   "devDependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
+    "hono": "^4.12.25",
     "@rollup/plugin-commonjs": "25.0.8",
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "15.2.3",
@@ -97,8 +98,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.7",
     "@neon/e2e-harness": "0.0.0",
-    "@neon-internals/env-core": "0.0.6"
+    "@neon/functions": "0.9.0"
   },
   "publishConfig": {
     "access": "public",