neon 8.3.4 → 8.3.6

package/dist/_chunks/{env-BWqJqBDJ.js → env-L2DPzDAK.js}

@@ -2,7 +2,7 @@ import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
 import { loadProjectConfig } from "../project.js";
-import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-HYNFtxu5.js";
+import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-XsUZj_Ay.js";
 import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { ErrorCode, createNeonApiFromOptions, isPlatformError } from "@neon/config";

package/dist/_chunks/{env-HYNFtxu5.js → env-XsUZj_Ay.js}

@@ -1,3 +1,4 @@
+import { n as defaultConnectionRole, t as NEON_DEFAULT_OWNER_ROLE } from "./roles-C3M4q9DS.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from "@neon/config/v1";
 //#region ../../internals/env-core/dist/env.js
 /**
@@ -22,28 +23,11 @@ import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialSco
 * {@link dataApiEnvSchema}.
 */
 /**
-* Neon's default branch owner role, created with every project. This is the role a
-* `DATABASE_URL` should connect as.
-*/
-const NEON_DEFAULT_OWNER_ROLE = "neondb_owner";
-/**
 * Neon's default database, created with every project. When a branch has several databases
 * and none was requested, this is preferred for the `DATABASE_URL` so the common case (a
 * user added a second database next to `neondb`) auto-picks without asking.
 */
 const NEON_DEFAULT_DATABASE = "neondb";
-/**
-* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back
-* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —
-* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the
-* Data API (`neon config apply`) adds these next to the owner role, which is why a plain
-* branch routinely reports more than one role.
-*/
-const NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([
-	"authenticator",
-	"anonymous",
-	"authenticated"
-]);
 const NEON_ENV_VAR_KEYS = {
 	/**
 	* Branch identity. `NEON_BRANCH` carries the branch **name** and is injected into the
@@ -540,11 +524,8 @@ function pickRoleName(roles, branch, requested) {
 		return requested;
 	}
 	if (roles.length === 0) throw new PlatformError(ErrorCode.BranchNotFound, [`fetchEnv: branch ${branch.name} (${branch.id}) has no roles.`, "Create one via the Neon console or pass `roleName` explicitly."].join(" "), { details: { branchId: branch.id } });
-	if (roles.length === 1) return roles[0].name;
-	const owner = roles.find((r) => r.name === NEON_DEFAULT_OWNER_ROLE);
-	if (owner) return owner.name;
-	const appRoles = roles.filter((r) => !NEON_MANAGED_AUTH_ROLES.has(r.name));
-	if (appRoles.length === 1) return appRoles[0].name;
+	const picked = defaultConnectionRole(roles.map((r) => r.name));
+	if (picked) return picked;
 	throw new PlatformError(ErrorCode.AmbiguousBranchAuth, [`fetchEnv: branch ${branch.name} (${branch.id}) has ${roles.length} roles and none is "${NEON_DEFAULT_OWNER_ROLE}"; cannot auto-pick.`, `Pass \`roleName\` explicitly. Available: ${roles.map((r) => r.name).join(", ")}.`].join(" "), { details: {
 		branchId: branch.id,
 		availableRoles: roles.map((r) => r.name)

package/dist/_chunks/roles-C3M4q9DS.js

@@ -0,0 +1,27 @@
+//#region ../../internals/env-core/dist/roles.js
+/**
+* Neon's default branch owner role, created with every project. This is the role a
+* `DATABASE_URL` should connect as.
+*/
+const NEON_DEFAULT_OWNER_ROLE = "neondb_owner";
+/**
+* Roles Neon provisions for the Auth / Data API (PostgREST) stack. They exist to back
+* RLS-scoped Data API requests authenticated by JWT — never to hold a `DATABASE_URL` —
+* so they're skipped when auto-picking the connection role. Enabling Neon Auth or the
+* Data API (`neon config apply`) adds these next to the owner role, which is why a plain
+* branch routinely reports more than one role.
+*/
+const NEON_MANAGED_AUTH_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"anonymous",
+	"authenticated"
+]);
+/** `undefined` when more than one app role remains (or none exist), so the caller has to ask. */
+function defaultConnectionRole(roleNames) {
+	if (roleNames.length === 1) return roleNames[0];
+	if (roleNames.includes("neondb_owner")) return NEON_DEFAULT_OWNER_ROLE;
+	const appRoles = roleNames.filter((name) => !NEON_MANAGED_AUTH_ROLES.has(name));
+	return appRoles.length === 1 ? appRoles[0] : void 0;
+}
+//#endregion
+export { defaultConnectionRole as n, NEON_DEFAULT_OWNER_ROLE as t };

package/dist/commands/connection_string.js

@@ -1,4 +1,5 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { n as defaultConnectionRole } from "../_chunks/roles-C3M4q9DS.js";
 import { writer } from "../writer.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
@@ -33,7 +34,7 @@ const builder = (argv) => {
 		},
 		"role-name": {
 			type: "string",
-			describe: "Role name"
+			describe: "Role name. Defaults to neondb_owner, else the only role besides the Data API and Neon Auth roles"
 		},
 		"database-name": {
 			type: "string",
@@ -100,7 +101,8 @@ const handler = async (props) => {
 	if (!endpoint) throw new Error(`No ${props.endpointType ?? ""} endpoint found for the branch: ${branchId}`);
 	const role = !rolesRequest ? props.roleName : await rolesRequest.then(({ data }) => {
 		if (data.roles.length === 0) throw new Error(`No roles found for the branch: ${branchId}`);
-		if (data.roles.length === 1) return data.roles[0].name;
+		const picked = defaultConnectionRole(data.roles.map((r) => r.name));
+		if (picked) return picked;
 		throw new Error(`Multiple roles found for the branch, please provide one with the --role-name option: ${data.roles.map((r) => r.name).join(", ")}`);
 	});
 	const { data: { databases: branchDatabases } } = await databasesRequest;

package/dist/commands/dev.js

@@ -3,12 +3,12 @@ import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { l as functionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
-import { a as resolveDevEnv } from "../_chunks/env-BWqJqBDJ.js";
-import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
-import { resolveWatchInputs } from "../dev/inputs.js";
+import { l as functionBaseUrlKey } from "../_chunks/env-XsUZj_Ay.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
+import { a as resolveDevEnv } from "../_chunks/env-L2DPzDAK.js";
+import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
+import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/env.js

@@ -5,11 +5,11 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-XsUZj_Ay.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BWqJqBDJ.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-L2DPzDAK.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/env_output.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES, NEON_SERVICE_LABELS } from "../neon_services.js";
-import { u as isFunctionBaseUrlKey } from "../_chunks/env-HYNFtxu5.js";
+import { u as isFunctionBaseUrlKey } from "../_chunks/env-XsUZj_Ay.js";
 import { BRANCH_ENV_KEY, ENV_PULL_KEYS, serviceForEnvKey } from "../env_services.js";
 import { isAbsolute, relative } from "node:path";
 import { homedir } from "node:os";

package/dist/commands/inspect.js

@@ -71,7 +71,7 @@ const dbBuilder = (argv) => {
 			type: "string"
 		},
 		"role-name": {
-			describe: "Role name",
+			describe: "Role name. Defaults to neondb_owner, else the only role besides the Data API and Neon Auth roles",
 			type: "string"
 		},
 		"db-url": {

package/dist/commands/neon_auth.js

@@ -383,10 +383,14 @@ const enable = async (props) => {
 			database_name: props.databaseName
 		})));
 	} catch (err) {
-		if (isNeonApiError(err) && err.status === 409) {
-			alreadyEnabled = true;
+		if (!(isNeonApiError(err) && err.status === 409)) throw err;
+		try {
 			({data} = await props.apiClient.getNeonAuth(props.projectId, branchId));
-		} else throw err;
+		} catch (readErr) {
+			if (isNeonApiError(readErr) && readErr.status === 404) throw err;
+			throw readErr;
+		}
+		alreadyEnabled = true;
 	}
 	if (props.output === "json" || props.output === "yaml") {
 		writer(props).end(data, { fields: INTEGRATION_RESPONSE_FIELDS });

package/dist/dev/env.js

@@ -1,2 +1,2 @@
-import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-BWqJqBDJ.js";
+import { a as resolveDevEnv, i as dropClaimableUnsupported, n as MissingBranchContextError, o as resolveNeonEnvVars, r as ServiceNotOnBranchError, t as DevEnvMismatchError } from "../_chunks/env-L2DPzDAK.js";
 export { DevEnvMismatchError, MissingBranchContextError, ServiceNotOnBranchError, dropClaimableUnsupported, resolveDevEnv, resolveNeonEnvVars };

package/dist/env_services.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES } from "./neon_services.js";
-import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-HYNFtxu5.js";
+import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-XsUZj_Ay.js";
 //#region src/env_services.ts
 const ENV_PULL_SERVICES = NEON_SERVICES;
 const ENV_PULL_KEYS = [

package/dist/utils/hooks.js

@@ -1,6 +1,6 @@
 import { log } from "../log.js";
 import { loadProjectConfig } from "../project.js";
-import { s as fetchEnvKeys } from "../_chunks/env-HYNFtxu5.js";
+import { s as fetchEnvKeys } from "../_chunks/env-XsUZj_Ay.js";
 import { runHook } from "@neon/config-runtime";
 //#region src/utils/hooks.ts
 /**

package/dist/utils/inspect_db.js

@@ -1,3 +1,4 @@
+import { n as defaultConnectionRole } from "../_chunks/roles-C3M4q9DS.js";
 import { EndpointType } from "./api_enums.js";
 import { branchIdFromProps } from "./enrichers.js";
 import { parsePITBranch } from "./point_in_time.js";
@@ -63,7 +64,8 @@ const startBranchConnectionReads = async (props) => {
 	const endpoints = props.apiClient.listProjectBranchEndpoints(projectId, branchId).then(({ data }) => data.endpoints);
 	const role = props.roleName ? Promise.resolve(props.roleName) : props.apiClient.listProjectBranchRoles(projectId, branchId).then(({ data }) => {
 		if (data.roles.length === 0) throw new Error(`No roles found for the branch: ${branchId}`);
-		if (data.roles.length === 1) return data.roles[0].name;
+		const picked = defaultConnectionRole(data.roles.map((r) => r.name));
+		if (picked) return picked;
 		throw new Error(`Multiple roles found for the branch, please provide one with the --role-name option: ${data.roles.map((r) => r.name).join(", ")}`);
 	});
 	const databases = props.apiClient.listProjectBranchDatabases(projectId, branchId).then(({ data }) => data.databases);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.3.4",
+  "version": "8.3.6",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -64,9 +64,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.8.6",
-    "@neon/config-runtime": "1.8.0",
-    "@neon/sdk": "7.0.1"
+    "@neon/config-runtime": "1.8.1",
+    "@neon/sdk": "7.0.1",
+    "@neon/config": "1.8.7"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -101,7 +101,7 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.29",
+    "@neon-internals/env-core": "0.0.30",
     "@neon/e2e-harness": "0.0.0",
     "@neon/functions": "0.11.0"
   },