neon 8.11.1 → 8.11.3

package/dist/commands/claim.js

@@ -1,473 +1 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { isCi } from "../env.js";
-import { log } from "../log.js";
-import { getApiClient } from "../api.js";
-import { applyContext, contextBranch, readContextFile } from "../context.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
-import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
-import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
-import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { claimableDataApiCreateBody, declaredClaimableNeonServices, isClaimableService } from "../config_services.js";
-import { projectConfigPath } from "../project.js";
-import { resolveEnvFilePath } from "../env_file.js";
-import { writer } from "../writer.js";
-import { noPassthrough } from "../utils/flags.js";
-import { pull } from "./env.js";
-import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import open from "open";
-import prompts from "prompts";
-import { loadConfigFromFile } from "@neon/config-runtime";
-//#region src/commands/claim.ts
-var claim_exports = /* @__PURE__ */ __exportAll({
-	CLAIM_CREATE_FIELDS: () => CLAIM_CREATE_FIELDS,
-	CLAIM_LIST_FIELDS: () => CLAIM_LIST_FIELDS,
-	aliases: () => aliases,
-	builder: () => builder,
-	claimCreateFields: () => claimCreateFields,
-	claimableCapabilities: () => claimableCapabilities,
-	command: () => command,
-	create: () => create,
-	describe: () => describe,
-	handler: () => handler
-});
-const CLAIMABLE_SERVICES = NEON_SERVICES.filter(isClaimableService);
-const CAPABILITY_FOR_SERVICE = {
-	postgres: "postgres",
-	auth: "auth",
-	"data-api": "data_api",
-	functions: "functions",
-	"object-storage": "storage",
-	"ai-gateway": "ai_gateway"
-};
-const CAPABILITY_ORDER = [
-	"postgres",
-	"data_api",
-	"auth",
-	"storage",
-	"functions",
-	"ai_gateway"
-];
-const SERVICE_FOR_CAPABILITY = {
-	postgres: "postgres",
-	auth: "auth",
-	data_api: "data-api",
-	functions: "functions",
-	storage: "object-storage",
-	ai_gateway: "ai-gateway"
-};
-const isClaimableCapability = (value) => value in SERVICE_FOR_CAPABILITY;
-const cliServiceName = (capability) => isClaimableCapability(capability) ? SERVICE_FOR_CAPABILITY[capability] : capability;
-const claimableCapabilities = (services) => {
-	const requested = /* @__PURE__ */ new Set(["postgres"]);
-	for (const service of services) requested.add(CAPABILITY_FOR_SERVICE[service]);
-	return CAPABILITY_ORDER.filter((capability) => requested.has(capability));
-};
-const loadCreatePolicy = async (explicitPath, contextFile) => {
-	const path = explicitPath ?? projectConfigPath(contextFile ? { contextFile } : {});
-	if (!path) return void 0;
-	const { config } = await loadConfigFromFile({ path });
-	return {
-		path,
-		config
-	};
-};
-const removeFileIfPresent = (path) => {
-	try {
-		unlinkSync(path);
-	} catch (error) {
-		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
-		throw error;
-	}
-};
-const failureMessage = (error) => error instanceof Error ? error.message : String(error);
-const CLAIM_LIST_FIELDS = [
-	"project_id",
-	"branch_id",
-	"state",
-	"project_expires_at",
-	"origin"
-];
-const CLAIM_CREATE_FIELDS = [
-	"project_id",
-	"branch_id",
-	"region_id",
-	"state",
-	"project_expires_at",
-	"granted_capabilities",
-	"denied_capabilities",
-	"env_file"
-];
-const claimCreateFields = (denied) => CLAIM_CREATE_FIELDS.filter((field) => field !== "denied_capabilities" || denied.length > 0);
-const command = "claim";
-const aliases = ["claimable"];
-const describe = "Create and claim temporary Neon projects";
-const builder = (argv) => argv.usage("$0 claim <sub-command> [options]").option("claimable-host", {
-	describe: "Claimable Neon service origin",
-	type: "string",
-	default: process.env.CLAIMABLE_NEON_HOST ?? "https://claimable.neon.tech",
-	hidden: true
-}).command("create", "Create a temporary Neon project without an account", (y) => y.option("service", servicesOption({
-	key: "service",
-	allowed: CLAIMABLE_SERVICES,
-	describe: "Services to request for the claimable project",
-	also: "Postgres is always included. Services unavailable before claim are recorded and reported."
-})).option("region-id", {
-	describe: "Region ID for the new project (e.g. aws-eu-central-1). Defaults to aws-us-east-2",
-	type: "string"
-}).option("file", {
-	describe: "Target dotenv file. Defaults to an existing .env, otherwise .env.local",
-	type: "string"
-}).option("config", {
-	describe: "Path to neon.ts for registration and the bundled env pull. Defaults to the neon.ts in the project directory (next to .neon, or cwd without one)",
-	type: "string"
-}).option("env-pull", {
-	describe: "Write the same Neon env vars `env pull` would",
-	type: "boolean",
-	default: true
-}).strict().check(noPassthrough("claim create")), async (args) => {
-	const rawServices = servicesFlagValue(args.service);
-	const services = rawServices ? parseServices(rawServices, {
-		allowed: CLAIMABLE_SERVICES,
-		flag: "--service",
-		onDeprecated: (used, canonical) => log.warning(deprecatedServiceMessage(used, canonical))
-	}) : [];
-	const policy = await loadCreatePolicy(typeof args.config === "string" ? args.config : void 0, typeof args.contextFile === "string" ? args.contextFile : void 0);
-	const configuredServices = policy ? declaredClaimableNeonServices(policy.config) : [];
-	const dataApi = policy ? claimableDataApiCreateBody(policy.config) : void 0;
-	await create({
-		...args,
-		services: [.../* @__PURE__ */ new Set([...services, ...configuredServices])],
-		...policy ? { config: policy.path } : {},
-		...dataApi ? { dataApi } : {}
-	});
-}).command("status [project-id]", "Show a claimable project's lifecycle and claim status", (y) => y.positional("project-id", {
-	describe: "Project from `neon claim list`. Defaults to the project linked in this directory",
-	type: "string"
-}).strict().check(noPassthrough("claim status")), async (args) => await status(args)).command("accept [project-id]", "Create a claim code and open the URL where a human signs in and takes the project", (y) => y.positional("project-id", {
-	describe: "Project from `neon claim list`. Defaults to the project linked in this directory",
-	type: "string"
-}).option("open", {
-	describe: "Open the verification URL in a browser",
-	type: "boolean",
-	default: true
-}).strict().check(noPassthrough("claim accept")), async (args) => await accept(args)).command("list", "List claimable projects saved on this machine", (y) => y.strict().check(noPassthrough("claim list")), async (args) => list(args)).command("delete [project-id]", "Permanently delete an unclaimed project, or drop a local record that can no longer reach the service", (y) => y.positional("project-id", {
-	describe: "Project from `neon claim list`. Defaults to the project linked in this directory",
-	type: "string"
-}).option("yes", {
-	alias: "y",
-	describe: "Skip the confirmation prompt",
-	type: "boolean",
-	default: false
-}).strict().check(noPassthrough("claim delete")), async (args) => await deleteProject(args));
-const handler = (_args) => {};
-const rejectExplicitAccountCredential = (props) => {
-	if (credentialInputs().apiKeyFlag.trim() !== "" || props.profile?.trim()) throw new Error("Claimable Neon does not use a Neon account credential. Remove --api-key or --profile.");
-};
-const resolveTarget = (props) => {
-	rejectExplicitAccountCredential(props);
-	const requested = props.projectId?.trim();
-	const context = readContextFile(props.contextFile);
-	if (requested) {
-		const credentials = readClaimableCredentials(props.configDir, requested);
-		if (credentials === null) throw new Error(`The identity assertion for ${requested} is missing. The project cannot be managed from this machine; claim it through its existing verification URL or run \`neon link\` after it is claimed.`);
-		return {
-			projectId: requested,
-			credentials,
-			client: new ClaimableClient(credentials.origin),
-			contextMatches: context.projectId === requested
-		};
-	}
-	const linked = readLinkedClaimableCredentials(props.configDir, context);
-	if (linked === null) throw new Error("This directory is not linked to a claimable project. Pass a project id from `neon claim list`, or run `neon claim create` first.");
-	return {
-		projectId: linked.projectId,
-		credentials: linked,
-		client: new ClaimableClient(linked.origin),
-		contextMatches: true
-	};
-};
-const requireLiveIdentity = (credentials) => {
-	if (assertionHasExpired(credentials)) throw new Error(`The identity assertion for ${credentials.projectId} has expired. Run \`neon claim delete ${credentials.projectId} --yes\` to drop the local record.`);
-};
-const isUnusableIdentity = (error) => error instanceof ClaimableServiceError && (error.code === "invalid_grant" || error.code === "project_expired" || error.code === "not_found");
-const clearLocalRecord = (props, projectId, contextMatches) => {
-	removeClaimableCredentials(props.configDir, projectId);
-	if (contextMatches && existsSync(props.contextFile)) applyContext(props.contextFile, {});
-};
-const create = async (props) => {
-	rejectExplicitAccountCredential(props);
-	const existing = readContextFile(props.contextFile);
-	if (existing.projectId || existing.orgId) throw new Error(`${props.contextFile} already links this directory to a Neon project. Run \`neon claim create\` from an unlinked directory.`);
-	const contextFileExisted = existsSync(props.contextFile);
-	const cwd = props.cwd ?? process.cwd();
-	const envFile = props.envPull ? resolveEnvFilePath({
-		cwd,
-		contextFile: props.contextFile
-	}, props.file) : void 0;
-	const envFileExisted = envFile ? existsSync(envFile) : false;
-	const previousEnv = envFileExisted && envFile ? readFileSync(envFile) : void 0;
-	const client = new ClaimableClient(props.claimableHost);
-	const registration = await client.register({
-		capabilities: claimableCapabilities(props.services ?? []),
-		source: "neon_cli",
-		...props.regionId !== void 0 ? { regionId: props.regionId } : {},
-		...props.dataApi ? { dataApi: props.dataApi } : {}
-	});
-	const stored = {
-		version: 1,
-		origin: client.origin,
-		registrationId: registration.registrationId,
-		projectId: registration.project.id,
-		branchId: registration.project.branchId,
-		identityAssertion: registration.identityAssertion,
-		expiresAt: registration.project.expiresAt,
-		assertionExpires: registration.assertionExpires
-	};
-	let localStateWritten = false;
-	let contextWritten = false;
-	let envWriteAttempted = false;
-	let accessToken;
-	try {
-		writeClaimableCredentials(props.configDir, stored);
-		localStateWritten = true;
-		applyContext(props.contextFile, {
-			projectId: registration.project.id,
-			branch: registration.project.branchId
-		});
-		contextWritten = true;
-		const token = await client.exchange(registration.identityAssertion);
-		accessToken = token.accessToken;
-		if (envFile) {
-			const apiHost = `${client.origin}/v1`;
-			const apiClient = props.apiClient ?? getApiClient({
-				apiKey: token.accessToken,
-				apiHost
-			});
-			envWriteAttempted = true;
-			if ((await pull({
-				apiClient,
-				apiKey: token.accessToken,
-				apiHost,
-				configDir: props.configDir,
-				contextFile: props.contextFile,
-				output: props.output,
-				projectId: registration.project.id,
-				branch: registration.project.branchId,
-				cwd,
-				file: props.file,
-				...props.config ? { config: props.config } : {},
-				...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
-			})).status === "empty") throw new Error("No Neon env variables were pulled for this claimable project.");
-		}
-		const granted = registration.capabilities.filter((decision) => decision.granted).map((decision) => cliServiceName(decision.capability));
-		const denied = registration.capabilities.filter((decision) => !decision.granted).map((decision) => ({
-			capability: cliServiceName(decision.capability),
-			reason: decision.reason,
-			message: decision.message
-		}));
-		writer(props).end({
-			project_id: registration.project.id,
-			branch_id: registration.project.branchId,
-			region_id: registration.project.regionId,
-			state: "unclaimed",
-			project_expires_at: registration.project.expiresAt,
-			granted_capabilities: granted,
-			denied_capabilities: denied,
-			...envFile ? { env_file: envFile } : {}
-		}, {
-			fields: claimCreateFields(denied),
-			renderColumns: { denied_capabilities: (row) => row.denied_capabilities.map((decision) => `${decision.capability}: ${decision.message}`).join(", ") }
-		});
-	} catch (error) {
-		let remoteDeleted = false;
-		try {
-			const cleanupToken = accessToken ?? (await client.exchange(registration.identityAssertion)).accessToken;
-			await client.deleteProject(registration.project.id, cleanupToken);
-			remoteDeleted = true;
-		} catch (cleanupError) {
-			log.error("Claimable project %s could not be cleaned up after create failed: %s", registration.project.id, failureMessage(cleanupError));
-			if (localStateWritten && contextWritten) log.error("Retry cleanup with `neon claim delete --yes` from this directory.");
-		}
-		if (remoteDeleted) try {
-			if (localStateWritten) removeClaimableCredentials(props.configDir, registration.project.id);
-			if (contextWritten) {
-				if (contextFileExisted) applyContext(props.contextFile, existing);
-				else removeFileIfPresent(props.contextFile);
-			}
-			if (envWriteAttempted && envFile) {
-				if (envFileExisted && previousEnv) writeFileSync(envFile, previousEnv);
-				else removeFileIfPresent(envFile);
-			}
-		} catch (rollbackError) {
-			log.error("Project cleanup succeeded, but local rollback failed: %s", failureMessage(rollbackError));
-		}
-		throw error;
-	}
-};
-const status = async (props) => {
-	const { projectId, credentials, client, contextMatches } = resolveTarget(props);
-	if (assertionHasExpired(credentials)) {
-		writer(props).end({
-			project_id: projectId,
-			state: "expired",
-			reconciled: false,
-			project_expires_at: credentials.expiresAt
-		}, { fields: [
-			"project_id",
-			"state",
-			"reconciled",
-			"project_expires_at"
-		] });
-		return;
-	}
-	try {
-		const token = await client.exchange(credentials.identityAssertion);
-		let claimState = "unclaimed";
-		let reconciled = false;
-		let claimExpiresAt;
-		try {
-			const claim = await client.claimStatus(projectId, token.accessToken);
-			claimState = claim.state;
-			reconciled = claim.reconciled;
-			claimExpiresAt = claim.expiresAt;
-		} catch (error) {
-			if (!(error instanceof ClaimableServiceError) || error.code !== "not_found") throw error;
-		}
-		if (reconciled) finishClaimedContext(props, projectId, contextMatches);
-		writer(props).end({
-			project_id: projectId,
-			state: claimState,
-			reconciled,
-			project_expires_at: credentials.expiresAt,
-			...claimExpiresAt ? { claim_expires_at: claimExpiresAt } : {}
-		}, { fields: [
-			"project_id",
-			"state",
-			"reconciled",
-			"project_expires_at",
-			"claim_expires_at"
-		] });
-	} catch (error) {
-		if (error instanceof ClaimableServiceError && error.code === "project_claimed") {
-			finishClaimedContext(props, projectId, contextMatches);
-			writer(props).end({
-				project_id: projectId,
-				state: "claimed",
-				reconciled: true
-			}, { fields: [
-				"project_id",
-				"state",
-				"reconciled"
-			] });
-			return;
-		}
-		if (isUnusableIdentity(error)) {
-			writer(props).end({
-				project_id: projectId,
-				state: "expired",
-				reconciled: false,
-				project_expires_at: credentials.expiresAt
-			}, { fields: [
-				"project_id",
-				"state",
-				"reconciled",
-				"project_expires_at"
-			] });
-			return;
-		}
-		throw error;
-	}
-};
-const accept = async (props) => {
-	const { projectId, credentials, client } = resolveTarget(props);
-	requireLiveIdentity(credentials);
-	const token = await client.exchange(credentials.identityAssertion);
-	const claim = await client.createClaim(projectId, token.accessToken);
-	writer(props).end({
-		project_id: projectId,
-		user_code: claim.userCode,
-		verification_url: claim.verificationUriComplete,
-		expires_in_seconds: claim.expiresIn
-	}, { fields: [
-		"project_id",
-		"user_code",
-		"verification_url",
-		"expires_in_seconds"
-	] });
-	if (props.open && !isCi()) open(claim.verificationUriComplete).catch(() => {
-		log.info("Could not open a browser. Open %s", claim.verificationUriComplete);
-	});
-	else if (props.open) log.info("Browser opening is disabled in CI. Open %s", claim.verificationUriComplete);
-};
-const list = (props) => {
-	rejectExplicitAccountCredential(props);
-	const projects = listClaimableCredentials(props.configDir).map((item) => {
-		const projectMs = Date.parse(item.expiresAt);
-		const projectExpired = Number.isFinite(projectMs) && projectMs <= Date.now();
-		return {
-			project_id: item.projectId,
-			branch_id: item.branchId,
-			state: assertionHasExpired(item) || projectExpired ? "expired" : "unclaimed",
-			project_expires_at: item.expiresAt,
-			origin: item.origin
-		};
-	});
-	writer(props).end(projects, {
-		fields: CLAIM_LIST_FIELDS,
-		emptyMessage: "No Claimable Neon projects are saved on this machine."
-	});
-};
-const deleteProject = async (props) => {
-	const { projectId, credentials, client, contextMatches } = resolveTarget(props);
-	if (!props.yes) {
-		if (isCi() || !process.stdin.isTTY) throw new Error("Deleting a claimable project requires confirmation. Re-run interactively or pass --yes.");
-		const { proceed } = await prompts({
-			type: "confirm",
-			name: "proceed",
-			message: `Permanently delete ${projectId}?`,
-			initial: false
-		});
-		if (!proceed) {
-			log.info("Claimable project was not deleted.");
-			return;
-		}
-	}
-	if (assertionHasExpired(credentials)) {
-		clearLocalRecord(props, projectId, contextMatches);
-		writer(props).end({
-			project_id: projectId,
-			state: "cleared"
-		}, { fields: ["project_id", "state"] });
-		return;
-	}
-	try {
-		const token = await client.exchange(credentials.identityAssertion);
-		await client.deleteProject(projectId, token.accessToken);
-	} catch (error) {
-		if (!isUnusableIdentity(error)) throw error;
-		clearLocalRecord(props, projectId, contextMatches);
-		writer(props).end({
-			project_id: projectId,
-			state: "cleared"
-		}, { fields: ["project_id", "state"] });
-		return;
-	}
-	clearLocalRecord(props, projectId, contextMatches);
-	writer(props).end({
-		project_id: projectId,
-		state: "deleted"
-	}, { fields: ["project_id", "state"] });
-};
-const finishClaimedContext = (props, projectId, contextMatches) => {
-	removeClaimableCredentials(props.configDir, projectId);
-	if (contextMatches && existsSync(props.contextFile)) {
-		const context = readContextFile(props.contextFile);
-		applyContext(props.contextFile, {
-			projectId: context.projectId,
-			...contextBranch(context) ? { branch: contextBranch(context) } : {}
-		});
-	}
-	log.info("Dropped the local identity assertion. The next command needs `neon login` or `neon link`.");
-};
-//#endregion
-export { CLAIM_CREATE_FIELDS, CLAIM_LIST_FIELDS, aliases, builder, claimCreateFields, claimableCapabilities, command, create, describe, handler, claim_exports as t };
+export { t as CLAIM_CREATE_FIELDS, n as CLAIM_LIST_FIELDS, r as aliases, i as builder, a as claimCreateFields, s as claimableCapabilities, c as command, l as create, u as describe, d as handler } from "../_chunks/claim-DqAvAvDm.js";