neon 8.3.3 → 8.3.5

package/dist/_chunks/{env-BWqJqBDJ.js → env-L2DPzDAK.js}

@@ -2,7 +2,7 @@ import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
 import { loadProjectConfig } from "../project.js";
-import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-HYNFtxu5.js";
+import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-XsUZj_Ay.js";
 import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { ErrorCode, createNeonApiFromOptions, isPlatformError } from "@neon/config";

package/dist/_chunks/{env-HYNFtxu5.js → env-XsUZj_Ay.js}

@@ -1,3 +1,4 @@
+import { n as defaultConnectionRole, t as NEON_DEFAULT_OWNER_ROLE } from "./roles-C3M4q9DS.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from "@neon/config/v1";
 //#region ../../internals/env-core/dist/env.js
 /**
@@ -22,28 +23,11 @@ import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialSco
 * {@link dataApiEnvSchema}.
 */
 /**
-* Neon's default branch owner role, created with every project. This is the role a
-* `DATABASE_URL` should connect as.
-*/
-const NEON_DEFAULT_OWNER_ROLE = "neondb_owner";
-/**
 * Neon's default database, created with every project. When a branch has several databases
 * and none was requested, this is preferred for the `DATABASE_URL` so the common case (a
 * user added a second database next to `neondb`) auto-picks without asking.
 */
 const NEON_DEFAULT_DATABASE = "neondb";
-/**
-* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back
-* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —
-* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the
-* Data API (`neon config apply`) adds these next to the owner role, which is why a plain
-* branch routinely reports more than one role.
-*/
-const NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([
-	"authenticator",
-	"anonymous",
-	"authenticated"
-]);
 const NEON_ENV_VAR_KEYS = {
 	/**
 	* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
@@ -540,11 +524,8 @@ function pickRoleName(roles, branch, requested) {
 		return requested;
 	}
 	if (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, "Create one via the Neon console or pass `roleName` explicitly."].join(" "), { details: { branchId: branch.id } });
-	if (roles.length === 1) return roles[0].name;
-	const owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);
-	if (owner) return owner.name;
-	const appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));
-	if (appRoles.length === 1) return appRoles[0].name;
+	const picked = defaultConnectionRole(roles.map((r) => r.name));
+	if (picked) return picked;
 	throw new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is "${NEON_DEFAULT_OWNER_ROLE}"; cannot auto-pick.`, `Pass \`roleName\` explicitly. Available: ${roles.map((r) => r.name).join(", ")}.`].join(" "), { details: {
 		branchId: branch.id,
 		availableRoles: roles.map((r) => r.name)

package/dist/_chunks/roles-C3M4q9DS.js

@@ -0,0 +1,27 @@
+//#region ../../internals/env-core/dist/roles.js
+/**
+* Neon's default branch owner role, created with every project. This is the role a
+* `DATABASE_URL` should connect as.
+*/
+const NEON_DEFAULT_OWNER_ROLE = "neondb_owner";
+/**
+* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back
+* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —
+* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the
+* Data API (`neon config apply`) adds these next to the owner role, which is why a plain
+* branch routinely reports more than one role.
+*/
+const NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"anonymous",
+	"authenticated"
+]);
+/** `undefined` when more than one app role remains (or none exist), so the caller has to ask. */
+function defaultConnectionRole(roleNames) {
+	if (roleNames.length === 1) return roleNames[0];
+	if (roleNames.includes("neondb_owner")) return NEON_DEFAULT_OWNER_ROLE;
+	const appRoles = roleNames.filter((name) => !NEON_MANAGED_AUTH_ROLES.has(name));
+	return appRoles.length === 1 ? appRoles[0] : void 0;
+}
+//#endregion
+export { defaultConnectionRole as n, NEON_DEFAULT_OWNER_ROLE as t };

package/dist/commands/connection_string.js

@@ -1,4 +1,5 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { n as defaultConnectionRole } from "../_chunks/roles-C3M4q9DS.js";
 import { writer } from "../writer.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
@@ -33,7 +34,7 @@ const builder = (argv) => {
 		},
 		"role-name": {
 			type: "string",
-			describe: "Role name"
+			describe: "Role name. Defaults to neondb_owner, else the only role besides the Data API and Neon Auth roles"
 		},
 		"database-name": {
 			type: "string",
@@ -100,7 +101,8 @@ const handler = async (props) => {
 	if (!endpoint) throw new Error(`No ${props.endpointType ?? ""} endpoint found for the branch: ${branchId}`);
 	const role = !rolesRequest ? props.roleName : await rolesRequest.then(({ data }) => {
 		if (data.roles.length === 0) throw new Error(`No roles found for the branch: ${branchId}`);
-		if (data.roles.length === 1) return data.roles[0].name;
+		const picked = defaultConnectionRole(data.roles.map((r) => r.name));
+		if (picked) return picked;
 		throw new Error(`Multiple roles found for the branch, please provide one with the --role-name option: ${data.roles.map((r) => r.name).join(", ")}`);
 	});
 	const { data: { databases: branchDatabases } } = await databasesRequest;

package/dist/commands/dev.js

@@ -3,10 +3,10 @@ import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { l as functionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { l as functionBaseUrlKey } from "../_chunks/env-XsUZj_Ay.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "../_chunks/env-BWqJqBDJ.js";
+import { a as resolveDevEnv } from "../_chunks/env-L2DPzDAK.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";

package/dist/commands/env.js

@@ -5,11 +5,11 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-XsUZj_Ay.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BWqJqBDJ.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-L2DPzDAK.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/env_output.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES, NEON_SERVICE_LABELS } from "../neon_services.js";
-import { u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { u as isFunctionBaseUrlKey } from "../_chunks/env-XsUZj_Ay.js";
 import { BRANCH_ENV_KEY, ENV_PULL_KEYS, serviceForEnvKey } from "../env_services.js";
 import { isAbsolute, relative } from "node:path";
 import { homedir } from "node:os";

package/dist/commands/inspect.js

@@ -71,7 +71,7 @@ const dbBuilder = (argv) => {
 			type: "string"
 		},
 		"role-name": {
-			describe: "Role name",
+			describe: "Role name. Defaults to neondb_owner, else the only role besides the Data API and Neon Auth roles",
 			type: "string"
 		},
 		"db-url": {

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-BWqJqBDJ.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-L2DPzDAK.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES } from "./neon_services.js";
-import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-HYNFtxu5.js";
+import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-XsUZj_Ay.js";
 //#region src/env_services.ts
 const ENV_PULL_SERVICES = NEON_SERVICES;
 const ENV_PULL_KEYS = [

package/dist/utils/hooks.js

@@ -1,6 +1,6 @@
 import { log } from "../log.js";
 import { loadProjectConfig } from "../project.js";
-import { s as fetchEnvKeys } from "../_chunks/env-HYNFtxu5.js";
+import { s as fetchEnvKeys } from "../_chunks/env-XsUZj_Ay.js";
 import { runHook } from "@neon/config-runtime";
 //#region src/utils/hooks.ts
 /**

package/dist/utils/inspect_db.js

@@ -1,3 +1,4 @@
+import { n as defaultConnectionRole } from "../_chunks/roles-C3M4q9DS.js";
 import { EndpointType } from "./api_enums.js";
 import { branchIdFromProps } from "./enrichers.js";
 import { parsePITBranch } from "./point_in_time.js";
@@ -48,20 +49,37 @@ const connectionUriForDatabase = (connectionUri, database) => {
 	url.pathname = `/${encodeURIComponent(database)}`;
 	return url.toString();
 };
-const listBranchDatabases = async (props) => {
+/**
+* Resolves the branch once and starts its endpoint, role, and database reads together.
+* Callers read them in the order a sequential run would, so the first error is the same.
+*/
+const startBranchConnectionReads = async (props) => {
 	const projectId = props.projectId;
 	const parsedPIT = props.branch ? parsePITBranch(props.branch) : {
 		tag: "head",
 		branch: ""
 	};
-	const branchId = await branchIdFromProps({
-		...props,
-		...props.branch ? { branch: parsedPIT.branch } : {}
+	if (props.branch) props.branch = parsedPIT.branch;
+	const branchId = await branchIdFromProps(props);
+	const endpoints = props.apiClient.listProjectBranchEndpoints(projectId, branchId).then(({ data }) => data.endpoints);
+	const role = props.roleName ? Promise.resolve(props.roleName) : props.apiClient.listProjectBranchRoles(projectId, branchId).then(({ data }) => {
+		if (data.roles.length === 0) throw new Error(`No roles found for the branch: ${branchId}`);
+		const picked = defaultConnectionRole(data.roles.map((r) => r.name));
+		if (picked) return picked;
+		throw new Error(`Multiple roles found for the branch, please provide one with the --role-name option: ${data.roles.map((r) => r.name).join(", ")}`);
 	});
-	const { data: { databases } } = await props.apiClient.listProjectBranchDatabases(projectId, branchId);
+	const databases = props.apiClient.listProjectBranchDatabases(projectId, branchId).then(({ data }) => data.databases);
+	for (const read of [
+		endpoints,
+		role,
+		databases
+	]) read.catch(() => void 0);
 	return {
 		branchId,
-		names: databases.map((d) => d.name)
+		parsedPIT,
+		endpoints,
+		role,
+		databases
 	};
 };
 /**
@@ -70,25 +88,16 @@ const listBranchDatabases = async (props) => {
 * pooling, prisma tuning, and SSL mode). Mirrors how `connection-string`
 * resolves a branch so `inspect db` connects the same way.
 */
-const resolveConnectionUri = async (props) => {
-	const projectId = props.projectId;
-	const parsedPIT = props.branch ? parsePITBranch(props.branch) : {
-		tag: "head",
-		branch: ""
-	};
-	if (props.branch) props.branch = parsedPIT.branch;
-	const branchId = await branchIdFromProps(props);
-	const { data: { endpoints } } = await props.apiClient.listProjectBranchEndpoints(projectId, branchId);
+const resolveConnectionUri = async (props, started) => {
+	const reads = started ?? await startBranchConnectionReads(props);
+	const { branchId, parsedPIT } = reads;
+	const endpoints = await reads.endpoints;
 	const matchEndpointType = props.endpointType ?? EndpointType.ReadWrite;
 	let endpoint = endpoints.find((e) => e.type === matchEndpointType);
 	if (!endpoint && props.endpointType == null) endpoint = endpoints[0];
 	if (!endpoint) throw new Error(`No ${props.endpointType ?? ""} endpoint found for the branch: ${branchId}`);
-	const role = props.roleName || await props.apiClient.listProjectBranchRoles(projectId, branchId).then(({ data }) => {
-		if (data.roles.length === 0) throw new Error(`No roles found for the branch: ${branchId}`);
-		if (data.roles.length === 1) return data.roles[0].name;
-		throw new Error(`Multiple roles found for the branch, please provide one with the --role-name option: ${data.roles.map((r) => r.name).join(", ")}`);
-	});
-	const { data: { databases: branchDatabases } } = await props.apiClient.listProjectBranchDatabases(projectId, branchId);
+	const role = await reads.role;
+	const branchDatabases = await reads.databases;
 	const database = props.databaseName || (() => {
 		if (branchDatabases.length === 0) throw new Error(`No databases found for the branch: ${branchId}`);
 		if (branchDatabases.length === 1) return branchDatabases[0].name;
@@ -158,8 +167,9 @@ const resolveInspectTargets = async (props, scope) => {
 			branchDatabaseCount: 1
 		};
 	}
-	const { branchId, names } = await listBranchDatabases(props);
-	if (names.length === 0) throw new Error(`No databases found for the branch: ${branchId}`);
+	const reads = await startBranchConnectionReads(props);
+	const names = (await reads.databases).map((d) => d.name);
+	if (names.length === 0) throw new Error(`No databases found for the branch: ${reads.branchId}`);
 	const selection = selectInspectTargets({
 		branchDatabases: names,
 		scope
@@ -167,7 +177,7 @@ const resolveInspectTargets = async (props, scope) => {
 	const first = await resolveConnectionUri({
 		...props,
 		databaseName: selection.databases[0]
-	});
+	}, reads);
 	return {
 		targets: selection.databases.map((database) => ({
 			database,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.3.3",
+  "version": "8.3.5",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -65,8 +65,8 @@
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
     "@neon/config": "1.8.6",
-    "@neon/config-runtime": "1.8.0",
-    "@neon/sdk": "7.0.1"
+    "@neon/sdk": "7.0.1",
+    "@neon/config-runtime": "1.8.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -101,9 +101,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.29",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/functions": "0.11.0"
+    "@neon/functions": "0.11.0",
+    "@neon-internals/env-core": "0.0.29"
   },
   "publishConfig": {
     "access": "public",