neon 4.14.4 → 4.14.6

package/README.md

@@ -116,22 +116,23 @@ to skip the dotenv write.
 
 The command writes:
 
-- a `.neon` context that identifies the project and Claimable Neon service;
+- a `.neon` context with the project id and pinned branch;
 - an owner-only identity assertion under the CLI config directory;
 - `DATABASE_URL`, `DATABASE_URL_UNPOOLED`, `NEON_BRANCH`, and Auth / Data API variables
   when `neon.ts` declares them (or, with no `neon.ts`, when they are provisioned) to `.env`
   or `.env.local` (disable this with `--no-env-pull`). The write is the same `env pull` used
   after create.
 
-Subsequent project commands automatically exchange the assertion for a short-lived agent
-token and send API calls to Claimable Neon. The service decides which operations are
-allowed before claim.
+Subsequent project commands find that assertion by the linked project id, exchange it for a
+short-lived agent token, and send API calls to Claimable Neon. The service decides which
+operations are allowed before claim.
 
 ```bash
 neon claim status                 # lifecycle and transfer status
 neon projects get <project-id>    # regular CLI command, same agent token
 neon psql --role-name neondb_owner -- -c "select now()"
 neon config plan
+neon checkout main
 neon env pull
 
 neon claim accept                 # create a claim code and open the transfer URL

package/dist/claimable/state.js

@@ -77,35 +77,34 @@ const removeClaimableCredentials = (configDir, projectId) => {
 		throw error;
 	}
 };
-const resolveClaimableContext = (context) => {
-	const marker = context.claimable;
-	if (marker === void 0) return null;
-	if (!isRecord(marker)) throw new Error("The linked .neon file has an invalid \"claimable\" marker. Delete the claimable field from .neon, or delete .neon.");
-	if (marker.version !== 1) throw new Error(`Unsupported Claimable Neon context version in .neon. Update the Neon CLI before using this project.`);
-	if (!nonEmptyString(marker.origin) || !nonEmptyString(context.projectId)) throw new Error("The linked .neon file has an incomplete \"claimable\" marker. Delete the claimable field from .neon, or delete .neon.");
-	assertProjectId(context.projectId);
-	return {
-		origin: marker.origin,
-		projectId: context.projectId,
-		...nonEmptyString(context.branch) ? { branch: context.branch } : {}
-	};
+const readLinkedClaimableCredentials = (configDir, context) => {
+	if (!nonEmptyString(context.projectId)) return null;
+	if (!PROJECT_ID.test(context.projectId)) return null;
+	return readClaimableCredentials(configDir, context.projectId);
+};
+const claimableCredentialsExist = (configDir, projectId) => {
+	if (!PROJECT_ID.test(projectId)) return false;
+	return existsSync(claimableCredentialsPath(configDir, projectId));
 };
-const shouldUseClaimableCredentials = (inputs, profileFlag, context) => inputs.apiKeyFlag.trim() === "" && inputs.apiKeyEnv.trim() === "" && inputs.profileEnv.trim() === "" && (profileFlag === void 0 || profileFlag.trim() === "") && resolveClaimableContext(context) !== null;
+const shouldUseClaimableCredentials = (inputs, profileFlag, context, configDir) => inputs.apiKeyFlag.trim() === "" && inputs.apiKeyEnv.trim() === "" && inputs.profileEnv.trim() === "" && (profileFlag === void 0 || profileFlag.trim() === "") && readLinkedClaimableCredentials(configDir, context) !== null;
 /** Management API base URL the CLI uses for a Claimable Neon origin. */
 const claimableApiHost = (origin) => `${new ClaimableClient(origin).origin}/v1`;
 /**
 * Whether this invocation is talking to Claimable Neon, so env resolve must not
 * mint credentials or pull services that require claim.
 *
-* Auth source wins so a same-process checkout that rewrote `.neon` without the
-* marker still skips minting. A `.neon` marker plus a production API host is an
-* account override and is not claimable.
+* Auth source wins so a same-process checkout that rewrote `.neon` still skips
+* minting. A credential file plus a production API host is an account override
+* and is not claimable.
 */
 const isClaimableEnvTarget = (props) => {
-	if (getAuthContext()?.source === "claimable") return true;
-	const linked = resolveClaimableContext(readContextFile(props.contextFile));
-	if (linked === null) return false;
-	return props.apiHost.trim().replace(/\/+$/, "") === claimableApiHost(linked.origin);
+	const source = getAuthContext()?.source;
+	if (source === "claimable") return true;
+	if (source !== void 0) return false;
+	if (props.configDir.trim() === "") return false;
+	const stored = readLinkedClaimableCredentials(props.configDir, readContextFile(props.contextFile));
+	if (stored === null) return false;
+	return props.apiHost.trim().replace(/\/+$/, "") === claimableApiHost(stored.origin);
 };
 //#endregion
-export { assertionHasExpired, claimableApiHost, claimableCredentialsPath, isClaimableEnvTarget, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials, writeClaimableCredentials };
+export { assertionHasExpired, claimableApiHost, claimableCredentialsExist, claimableCredentialsPath, isClaimableEnvTarget, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, shouldUseClaimableCredentials, writeClaimableCredentials };

package/dist/commands/auth.js

@@ -5,13 +5,13 @@ import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { currentContextFile, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
+import { currentContextFile, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile } from "../context.js";
 import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-CvnFEQyd.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
 import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
-import { assertionHasExpired, claimableCredentialsPath, readClaimableCredentials, resolveClaimableContext, shouldUseClaimableCredentials } from "../claimable/state.js";
+import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { withExclusiveLock } from "../refresh_lock.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { existsSync } from "node:fs";
@@ -291,6 +291,7 @@ const ensureAuth = async (props) => {
 	if (isConfigInit(props)) return;
 	if (isProfileCommand(props)) return;
 	if (isMcpOauth(props)) return;
+	if (isInspectDbUrl(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
 	if (isAskCommand(props)) return;
@@ -316,15 +317,12 @@ const ensureAuth = async (props) => {
 	const inputs = credentialInputs();
 	const contextFile = typeof props.contextFile === "function" ? props.contextFile() : props.contextFile ?? currentContextFile();
 	const localContext = readContextFile(contextFile);
-	if (shouldUseClaimableCredentials(inputs, props.profile, localContext)) {
-		const linked = resolveClaimableContext(localContext);
-		if (linked === null) throw new Error("The linked Claimable Neon context could not be resolved.");
-		const stored = readClaimableCredentials(props.configDir, linked.projectId);
-		const path = claimableCredentialsPath(props.configDir, linked.projectId);
-		if (stored === null) throw new Error(`The linked project is claimable, but its identity assertion is missing from ${path}. Run \`neon claim create\` in a new directory, or \`neon link\` after claiming the project.`);
-		if (assertionHasExpired(stored)) throw new Error(`The identity assertion for ${linked.projectId} has expired. Run \`neon claim delete ${linked.projectId} --yes\` to drop the local record.`);
+	if (shouldUseClaimableCredentials(inputs, props.profile, localContext, props.configDir)) {
+		const stored = readLinkedClaimableCredentials(props.configDir, localContext);
+		if (stored === null || localContext.projectId === void 0) throw new Error("The linked Claimable Neon identity assertion could not be read.");
+		const path = claimableCredentialsPath(props.configDir, localContext.projectId);
+		if (assertionHasExpired(stored)) throw new Error(`The identity assertion for ${localContext.projectId} has expired. Run \`neon claim delete ${localContext.projectId} --yes\` to drop the local record.`);
 		const client = new ClaimableClient(stored.origin);
-		if (client.origin !== new ClaimableClient(linked.origin).origin) throw new Error(`The linked .neon file and ${path} name different Claimable Neon services. Delete .neon or the assertion file and run \`neon claim create\` in a new directory.`);
 		let token;
 		try {
 			token = await client.exchange(stored.identityAssertion);
@@ -346,7 +344,7 @@ const ensureAuth = async (props) => {
 		log.debug("Using the linked Claimable Neon project's short-lived access token");
 		return;
 	}
-	if (localContext.claimable !== void 0) log.warning("This directory is linked to a claimable project, but NEON_API_KEY or NEON_PROFILE is set. This command will use that account credential instead of the unclaimed project. Unset them to keep using the unclaimed project.");
+	if (localContext.projectId !== void 0 && claimableCredentialsExist(props.configDir, localContext.projectId)) log.warning("This directory is linked to a claimable project, but NEON_API_KEY or NEON_PROFILE is set. This command will use that account credential instead of the unclaimed project. Unset them to keep using the unclaimed project.");
 	const selection = selectCredential({
 		...inputs,
 		profileFlag: props.profile

package/dist/commands/claim.js

@@ -8,7 +8,7 @@ import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagVal
 import { resolveEnvFilePath } from "../env_file.js";
 import { t as credentialInputs } from "../_chunks/auth_selection-pitMFzDe.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
-import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, removeClaimableCredentials, resolveClaimableContext, writeClaimableCredentials } from "../claimable/state.js";
+import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { pull } from "./env.js";
@@ -184,19 +184,23 @@ const resolveTarget = (props) => {
 	rejectExplicitAccountCredential(props);
 	const requested = props.projectId?.trim();
 	const context = readContextFile(props.contextFile);
-	const linked = resolveClaimableContext(context);
-	const projectId = requested || linked?.projectId;
-	if (projectId === void 0) throw new Error("This directory is not linked to a claimable project. Pass a project id from `neon claim list`, or run `neon claim create` first.");
-	const credentials = readClaimableCredentials(props.configDir, projectId);
-	if (credentials === null) throw new Error(`The identity assertion for ${projectId} is missing. The project cannot be managed from this machine; claim it through its existing verification URL or run \`neon link\` after it is claimed.`);
-	const client = new ClaimableClient(credentials.origin);
-	const contextMatches = linked?.projectId === projectId;
-	if (contextMatches && linked !== null && client.origin !== new ClaimableClient(linked.origin).origin) throw new Error("The .neon context and saved identity assertion name different Claimable Neon services. Delete .neon or the assertion file and run `neon claim create` in a new directory.");
+	if (requested) {
+		const credentials = readClaimableCredentials(props.configDir, requested);
+		if (credentials === null) throw new Error(`The identity assertion for ${requested} is missing. The project cannot be managed from this machine; claim it through its existing verification URL or run \`neon link\` after it is claimed.`);
+		return {
+			projectId: requested,
+			credentials,
+			client: new ClaimableClient(credentials.origin),
+			contextMatches: context.projectId === requested
+		};
+	}
+	const linked = readLinkedClaimableCredentials(props.configDir, context);
+	if (linked === null) throw new Error("This directory is not linked to a claimable project. Pass a project id from `neon claim list`, or run `neon claim create` first.");
 	return {
-		projectId,
-		credentials,
-		client,
-		contextMatches
+		projectId: linked.projectId,
+		credentials: linked,
+		client: new ClaimableClient(linked.origin),
+		contextMatches: true
 	};
 };
 const requireLiveIdentity = (credentials) => {
@@ -210,7 +214,7 @@ const clearLocalRecord = (props, projectId, contextMatches) => {
 const create = async (props) => {
 	rejectExplicitAccountCredential(props);
 	const existing = readContextFile(props.contextFile);
-	if (existing.projectId || existing.orgId || existing.claimable) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
+	if (existing.projectId || existing.orgId) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
 	const contextFileExisted = existsSync(props.contextFile);
 	const cwd = props.cwd ?? process.cwd();
 	const envFile = props.envPull ? resolveEnvFilePath(cwd, props.file) : void 0;
@@ -241,11 +245,7 @@ const create = async (props) => {
 		localStateWritten = true;
 		applyContext(props.contextFile, {
 			projectId: registration.project.id,
-			branch: registration.project.branchId,
-			claimable: {
-				version: 1,
-				origin: client.origin
-			}
+			branch: registration.project.branchId
 		});
 		contextWritten = true;
 		const token = await client.exchange(registration.identityAssertion);
@@ -261,6 +261,7 @@ const create = async (props) => {
 				apiClient,
 				apiKey: token.accessToken,
 				apiHost,
+				configDir: props.configDir,
 				contextFile: props.contextFile,
 				output: props.output,
 				projectId: registration.project.id,

package/dist/commands/dev.js

@@ -89,7 +89,8 @@ const devEnvContext = (props, branchId, cwd) => {
 		...props.apiHost ? { apiHost: props.apiHost } : {},
 		...isClaimableEnvTarget({
 			apiHost: props.apiHost,
-			contextFile: props.contextFile ?? ""
+			contextFile: props.contextFile ?? "",
+			configDir: props.configDir ?? ""
 		}) ? { claimable: true } : {}
 	};
 };

package/dist/commands/env.js

@@ -122,7 +122,11 @@ const NEON_OWNED_ENV_KEYS = [
 ];
 const pull = async (props, opts = {}) => {
 	const cwd = props.cwd ?? process.cwd();
-	const claimable = isClaimableEnvTarget(props);
+	const claimable = isClaimableEnvTarget({
+		apiHost: props.apiHost,
+		contextFile: props.contextFile,
+		configDir: props.configDir ?? ""
+	});
 	const dropped = claimable && (props.services !== void 0 || props.envKeys !== void 0) ? dropClaimableUnsupported(props.services ?? [], props.envKeys ?? []) : null;
 	const selectionServices = dropped ? dropped.services : props.services ?? [];
 	const selectionEnvKeys = dropped ? dropped.envKeys : props.envKeys ?? [];

package/dist/context.js

@@ -55,6 +55,12 @@ const isMcpCommand = (args) => args._[0] === "mcp";
 const isSkillsCommand = (args) => args._[0] === "skills" || args._[0] === "skill";
 const isPluginsCommand = (args) => args._[0] === "plugins" || args._[0] === "plugin";
 const isAskCommand = (args) => args._[0] === "ask";
+/**
+* `inspect db --db-url` talks to Postgres with that URI. Skip only when the
+* parsed value is nonempty: empty `--db-url` still goes through project
+* resolution and needs an API client.
+*/
+const isInspectDbUrl = (args) => (args._[0] === "inspect" || args._[0] === "inspection") && typeof args.dbUrl === "string" && args.dbUrl.length > 0;
 /** Raw argv is required because auth middleware runs before MCP flags are parsed. */
 const isMcpOauth = (args) => isMcpCommand(args) && argvEnablesMcpOauth(process.argv);
 const OAUTH_FALSE = /* @__PURE__ */ new Set([
@@ -242,4 +248,4 @@ const globToRegExp = (pattern) => {
 	return new RegExp(`^${source}$`);
 };
 //#endregion
-export { applyContext, contextBranch, currentContextFile, enrichFromContext, ensureGitignored, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile, setContext, updateContextFile, walkContextFile };
+export { applyContext, contextBranch, currentContextFile, enrichFromContext, ensureGitignored, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigInit, isCurrentBranchProbe, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile, setContext, updateContextFile, walkContextFile };

package/dist/env_file.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 //#region src/env_file.ts
 /**
 * Default dotenv file `env pull` writes to: `.env` when one already exists in the working
@@ -7,7 +7,7 @@ import { join } from "node:path";
 * `vercel env pull` convention. An explicit `--file` always wins over this.
 */
 const resolveEnvFilePath = (cwd, file) => {
-	if (file) return join(cwd, file);
+	if (file) return resolve(cwd, file);
 	if (existsSync(join(cwd, ".env"))) return join(cwd, ".env");
 	return join(cwd, ".env.local");
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.14.4",
+  "version": "4.14.6",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,8 +63,8 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.3.2",
     "@neon/config-runtime": "1.2.3",
+    "@neon/config": "1.3.2",
     "@neon/sdk": "4.0.0"
   },
   "optionalDependencies": {
@@ -97,10 +97,10 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/env-core": "0.0.10",
+    "@neon-internals/cli-core": "0.0.0",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/functions": "0.9.0",
-    "@neon-internals/cli-core": "0.0.0"
+    "@neon-internals/env-core": "0.0.10",
+    "@neon/functions": "0.9.0"
   },
   "publishConfig": {
     "access": "public",