neon 8.8.0 → 8.10.0

package/README.md

@@ -1005,6 +1005,18 @@ neon feedback --message "The branch docs were unclear" --output json
 
 Default table output is `Feedback received. Thank you!`. `--output json` and `--output yaml` print `{ "received": true }`. Messages are limited to 10,000 characters. Do not include passwords, API keys, connection strings, or other secrets.
 
+## Search neon.com (`docs search`)
+
+`neon docs search <query>` searches neon.com: the docs, API reference, PostgreSQL tutorial, guides, FAQs, changelog, and blog. It does not log in and does not use your Neon account. It uses the same search as the neon.com search box.
+
+```bash
+neon docs search "reset a branch"
+neon docs search "create branch" --category api --category docs
+neon docs search "pg_dump" --limit 5 --output json
+```
+
+`--category` limits results to `docs`, `api`, `postgresql`, `guides`, `faqs`, `blog`, or `changelog`; repeat it for more than one. `--limit` is 1 to 40, default 10. Default table output is one row per page: title, the section that matched, and URL. `--output json` and `--output yaml` print an array of hits with `title`, `url`, `category`, `breadcrumb`, `heading`, and `excerpt`, in rank order. No match prints `No results for "<query>".` and exits 0 (`[]` in JSON).
+
 ## Install the Neon plugin (`plugins`)
 
 `neon plugins` installs the Neon agent plugin (`neon-postgres`) by running `npx plugins add`. It does not call the Neon API.

package/dist/_chunks/{credential_io-ByNuojoE.js → credential_io-BS-0Pmwc.js}

@@ -200,6 +200,12 @@ var KeyringUnavailableError = class extends Error {
 		this.name = "KeyringUnavailableError";
 	}
 };
+var KeyringValueTooLargeError = class extends Error {
+	constructor(profile, actual, maximum) {
+		super(`Credentials for profile "${profile}" are ${actual} characters, and this OS keyring stores at most ${maximum}. Run \`neon login --profile ${profile}\` without \`--keyring\` to keep the credential in an owner-only file. If this profile already uses the keyring, remove it first with \`neon profile remove ${profile} --yes\`.`);
+		this.name = "KeyringValueTooLargeError";
+	}
+};
 var KeyringUnreadableError = class extends Error {
 	constructor(profile) {
 		const replace = `\`neon login --profile ${profile}\``;
@@ -248,8 +254,10 @@ const createCredentialStore = (dir, options = {}) => {
 		} catch {
 			previous = null;
 		}
+		const serialized = JSON.stringify(credentials);
+		if (kr.maxPasswordCodeUnits !== void 0 && serialized.length > kr.maxPasswordCodeUnits) throw new KeyringValueTooLargeError(profile, serialized.length, kr.maxPasswordCodeUnits);
 		try {
-			kr.set(KEYRING_SERVICE, account, JSON.stringify(credentials));
+			kr.set(KEYRING_SERVICE, account, serialized);
 		} catch {
 			throw new KeyringUnavailableError();
 		}

package/dist/analytics.js

@@ -1,6 +1,7 @@
-import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
+import { getOrCreateAnonymousId } from "./anonymous_id.js";
 import pkg_default from "./pkg.js";
 import { UnreadableResponseError, getApiClient, isNeonApiError } from "./api.js";
 import { getAuthContext } from "./auth_context.js";
@@ -19,16 +20,17 @@ const WRITE_KEY = "3SQXn5ejjXWLEJ8xU2PRYhAotLtTaeeV";
 const hasCurrentBranchArgv = () => process.argv.includes("--current-branch");
 const ANONYMOUS = "anonymous";
 /**
-* Who to attribute an event to, given whatever identified this invocation.
-*
-* Nothing is guaranteed to have identified it: a command can run with no credentials at all,
-* leaving the id empty. Segment accepts an empty `userId` and forwards it as-is rather than
-* rejecting it, so the substitution has to happen here. `""` is falsy but not nullish, which
-* is why the fallback has to be `||`.
+* The identity to send an event under. A run nothing identified (an empty `userId`, which
+* Segment would forward as-is) is the shared `"anonymous"` user, as it always was, so existing
+* queries on it keep working. The stored anonymous id goes with every event, signed in or not,
+* so the signed-out events of an installation can be joined to its account once a user is known.
 *
 * Exported for tests.
 */
-const analyticsUserId = (userId) => userId || ANONYMOUS;
+const analyticsIdentity = (userId, anonymousId) => ({
+	userId: userId || ANONYMOUS,
+	...anonymousId ? { anonymousId } : {}
+});
 /**
 * The account an invocation that presented no API key may claim, which is nothing at all
 * unless stored credentials named a user.
@@ -77,10 +79,13 @@ const telemetryCredential = (authContext, apiKey, defaultCredentialsPath) => {
 let client;
 let clientInitialized = false;
 let errorEventContext;
+/** Set with the client, so it exists only when analytics is on. */
+let anonymousId;
 /** Lets tests send to a local collector; the CLI itself always uses track.neon.tech. */
-const useAnalyticsClientForTests = (analytics) => {
+const useAnalyticsClientForTests = (analytics, testAnonymousId) => {
 	client = analytics;
 	clientInitialized = true;
+	anonymousId = testAnonymousId;
 };
 /**
 * Phase 1: Run before validation so the Segment client exists if any
@@ -97,7 +102,8 @@ const initAnalyticsClientMiddleware = (args) => {
 		host: "https://track.neon.tech"
 	});
 	log.debug("Initialized CLI analytics client");
-	client.identify({ userId: ANONYMOUS });
+	anonymousId = args.configDir ? getOrCreateAnonymousId(args.configDir) : void 0;
+	client.identify(analyticsIdentity(void 0, anonymousId));
 };
 /**
 * The attribution of the current attempt. A 401 retry runs the middleware again and starts a
@@ -179,9 +185,9 @@ const analyticsMiddleware = (args) => {
 	})();
 	queue = queue.then(() => lookup);
 	enqueue((analytics, { userId }) => {
-		analytics.identify({ userId: analyticsUserId(userId) });
+		analytics.identify(analyticsIdentity(userId, anonymousId));
 		analytics.track({
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			event: "CLI Started",
 			properties: startedProperties,
 			context: { direct: true }
@@ -266,7 +272,7 @@ const sendError = (err, errCode) => {
 	enqueue((analytics, { userId }) => {
 		analytics.track({
 			event: "CLI Error",
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties
 		});
 	});
@@ -284,7 +290,7 @@ const trackEvent = (event, properties) => {
 	enqueue((analytics, { userId }) => {
 		analytics.track({
 			event,
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties
 		});
 	});
@@ -300,7 +306,7 @@ const trackCommandSuccess = (args) => {
 	enqueue((analytics, { userId, accountId, authMethod, authData }) => {
 		analytics.track({
 			event: "cli_command_success",
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties: {
 				...properties,
 				accountId,
@@ -348,4 +354,4 @@ const getAnalyticsEventProperties = (args) => ({
 	githubEnvVars: getGithubEnvVars(process.env)
 });
 //#endregion
-export { analyticsMiddleware, analyticsUserId, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };
+export { analyticsIdentity, analyticsMiddleware, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };

package/dist/anonymous_id.js

@@ -0,0 +1,59 @@
+import { t as writeSecretFile } from "./_chunks/secure_file-BucZj4yQ.js";
+import { isCi } from "./env.js";
+import { log } from "./log.js";
+import { isEexist } from "./refresh_lock.js";
+import { linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+//#region src/anonymous_id.ts
+const ANONYMOUS_ID_FILE = "anonymous_id";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const readStored = (path) => {
+	try {
+		const stored = readFileSync(path, "utf8").trim();
+		return UUID.test(stored) ? stored : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* Names this installation in analytics before sign-in. Commands that know the user send it
+* alongside `userId`, so earlier events can be linked to the account.
+*
+* Not stored in CI, where the config directory doesn't outlive the run and every run would
+* mint a new installation. Call only once analytics is known to be enabled.
+*/
+const getOrCreateAnonymousId = (configDir) => {
+	if (isCi()) return;
+	const path = join(configDir, ANONYMOUS_ID_FILE);
+	try {
+		const stored = readStored(path);
+		if (stored) return stored;
+		mkdirSync(configDir, { recursive: true });
+		const id = randomUUID();
+		const temporary = `${path}.${id}.tmp`;
+		writeFileSync(temporary, `${id}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+		try {
+			linkSync(temporary, path);
+			return id;
+		} catch (err) {
+			if (!isEexist(err)) throw err;
+			const winner = readStored(path);
+			if (winner) return winner;
+			writeSecretFile(path, `${id}\n`);
+			return id;
+		} finally {
+			try {
+				unlinkSync(temporary);
+			} catch {}
+		}
+	} catch (err) {
+		log.debug("Could not store the anonymous analytics id: %s", err);
+		return;
+	}
+};
+//#endregion
+export { ANONYMOUS_ID_FILE, getOrCreateAnonymousId };

package/dist/auth.js

@@ -221,4 +221,4 @@ const auth = async ({ oauthHost, clientId, allowUnsafeTls }) => {
 	});
 };
 //#endregion
-export { AuthRefreshError, auth, classifyRefreshFailure, defaultClientID, refreshToken, revokeToken };
+export { AuthRefreshError, NEONCTL_SCOPES, auth, classifyRefreshFailure, defaultClientID, refreshToken, revokeToken };

package/dist/auth_recovery.js

@@ -1,4 +1,4 @@
-import { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
+import { t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";
 import { log } from "./log.js";
 import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
 import { AuthRefreshError } from "./auth.js";

package/dist/commands/auth.js

@@ -1,18 +1,18 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
+import { withExclusiveLock } from "../refresh_lock.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
+import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
 import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
 import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
-import { withExclusiveLock } from "../refresh_lock.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpEpilogue, helpWidth, wrapHelpText } from "../utils/help_text.js";
@@ -136,20 +136,16 @@ const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "f
 	return tokenSet.access_token || "";
 };
 /**
-* Persist before identity lookup so a lookup failure cannot discard the new session.
-* Merge the identity only while that session remains current on disk.
+* One write, after the lookup: a second write that adds `user_id` could fail the keyring size
+* check after the first had already replaced the previous credential.
 */
 const persistNewSession = async (at, credentials, apiClient, configDir) => {
-	const stored = oauthCredentialsFromTokenSet(credentials, null);
-	writeOAuthCredentials(configDir, at, stored);
 	const identity = await fetchIdentity(apiClient);
-	if (identity.id) {
-		const current = storeFor(configDir).read(at);
-		if (current !== null && current.credentials.access_token === stored.access_token) writeOAuthCredentials(configDir, at, {
-			...current.credentials,
-			user_id: identity.id
-		});
-	}
+	const stored = oauthCredentialsFromTokenSet(credentials, null);
+	writeOAuthCredentials(configDir, at, identity.id ? {
+		...stored,
+		user_id: identity.id
+	} : stored);
 	return identity;
 };
 const fetchIdentity = async (apiClient) => {
@@ -248,8 +244,8 @@ const refreshStoredCredentials = async (at, props) => {
 const oauthCredentialsFromTokenSet = (tokenSet, previous) => {
 	const refreshTokenValue = typeof tokenSet.refresh_token === "string" && tokenSet.refresh_token !== "" ? tokenSet.refresh_token : previous?.refresh_token;
 	const stored = {
-		...tokenSet,
 		type: OAUTH,
+		...typeof tokenSet.access_token === "string" && tokenSet.access_token !== "" ? { access_token: tokenSet.access_token } : {},
 		expires_at: tokenSet.expires_at,
 		...typeof refreshTokenValue === "string" && refreshTokenValue !== "" ? { refresh_token: refreshTokenValue } : {}
 	};
@@ -304,7 +300,7 @@ const ensureAuth = async (props) => {
 	if (isInspectDbUrl(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
-	if (isAskCommand(props) || isFeedbackCommand(props)) return;
+	if (isAskCommand(props) || isFeedbackCommand(props) || isDocsCommand(props)) return;
 	if (props._[0] === "init") {
 		selectCredential({
 			...credentialInputs(),

package/dist/commands/dev.js

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
 import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
-import { envFlag } from "./config.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
+import { envFlag } from "./config.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/docs.js

@@ -0,0 +1,157 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { isNetworkError } from "../errors.js";
+import { writer } from "../writer.js";
+import { single } from "../utils/flags.js";
+//#region src/commands/docs.ts
+var docs_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_SITE_SEARCH_URL: () => DEFAULT_SITE_SEARCH_URL,
+	MAX_LIMIT: () => 40,
+	MAX_QUERY_LENGTH: () => 500,
+	SITE_SEARCH_CATEGORIES: () => SITE_SEARCH_CATEGORIES,
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	parseSearchHits: () => parseSearchHits,
+	resolveSiteSearchUrl: () => resolveSiteSearchUrl
+});
+const DEFAULT_SITE_SEARCH_URL = "https://br-frosty-cell-a5smzg39-assistant.compute.c-1.us-east-2.aws.neon.tech/site-search";
+const SITE_SEARCH_CATEGORIES = [
+	"docs",
+	"api",
+	"postgresql",
+	"guides",
+	"faqs",
+	"blog",
+	"changelog"
+];
+const MAX_QUERY_LENGTH = 500;
+const MAX_LIMIT = 40;
+const DEFAULT_LIMIT = 10;
+const SEARCH_TIMEOUT_MS = 1e4;
+const command = "docs";
+const describe = "Search neon.com docs, guides, and more";
+const SEARCH_DESCRIBE = "Search neon.com: docs, API reference, PostgreSQL tutorial, guides, FAQs, changelog, and blog";
+const builder = (argv) => argv.usage("$0 docs <sub-command> [options]").command("search <query>", SEARCH_DESCRIBE, (yargs) => yargs.positional("query", {
+	describe: "What to search for",
+	type: "string"
+}).options({
+	category: {
+		describe: "Only return pages in these categories (repeatable)",
+		type: "string",
+		array: true,
+		choices: SITE_SEARCH_CATEGORIES
+	},
+	limit: {
+		describe: `Maximum number of results (1-40)`,
+		type: "number",
+		default: DEFAULT_LIMIT
+	},
+	url: {
+		describe: "Override the site search URL",
+		type: "string",
+		hidden: true,
+		coerce: single("url")
+	}
+}).strict().check((args) => {
+	const query = typeof args.query === "string" ? args.query.trim() : "";
+	if (query === "") throw new Error("<query> needs a value");
+	if (query.length > 500) throw new Error(`<query> must be 500 characters or fewer`);
+	const limit = args.limit;
+	if (!Number.isInteger(limit) || limit < 1 || limit > 40) throw new Error(`--limit must be a whole number from 1 to 40`);
+	return true;
+}).example("$0 docs search \"reset a branch\"", SEARCH_DESCRIBE).example("$0 docs search \"create branch\" --category api --category docs", "Search only the API reference and the docs"), (args) => search(args));
+function resolveSiteSearchUrl(opts) {
+	const fromFlag = opts.url?.trim();
+	if (fromFlag) return fromFlag;
+	const fromEnv = opts.envUrl?.trim();
+	if (fromEnv) return fromEnv;
+	return DEFAULT_SITE_SEARCH_URL;
+}
+const search = async (props) => {
+	const query = props.query.trim();
+	const hits = await searchSite({
+		url: resolveSiteSearchUrl({
+			url: props.url,
+			envUrl: process.env.NEON_SITE_SEARCH_URL
+		}),
+		query,
+		limit: props.limit,
+		categories: props.category ? [...new Set(props.category)] : void 0
+	});
+	writer(props).end(hits, {
+		fields: [
+			"title",
+			"heading",
+			"url"
+		],
+		emptyMessage: `No results for "${query}".`,
+		renderColumns: { heading: (hit) => sectionOf(hit) }
+	});
+};
+function sectionOf(hit) {
+	const parts = hit.heading.split(" > ");
+	return (parts[0] === hit.title ? parts.slice(1) : parts).join(" > ");
+}
+function isTimeout(error) {
+	return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+}
+async function searchSite(opts) {
+	const signal = AbortSignal.timeout(SEARCH_TIMEOUT_MS);
+	try {
+		const response = await fetch(opts.url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				query: opts.query,
+				limit: opts.limit,
+				...opts.categories ? { categories: opts.categories } : {}
+			}),
+			signal
+		});
+		const raw = await response.text();
+		if (!response.ok) throw new Error(searchErrorMessage(raw, response.status));
+		return parseSearchHits(raw);
+	} catch (error) {
+		if (isTimeout(error)) throw new Error("Neon site search did not respond in time.");
+		if (isNetworkError(error)) throw new Error("Could not reach Neon site search. Check your internet connection and try again.");
+		throw error;
+	}
+}
+function parseJson(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function searchErrorMessage(raw, status) {
+	const body = parseJson(raw);
+	if (status < 500 && typeof body === "object" && body !== null && "error" in body && typeof body.error === "string" && body.error.trim() !== "") return body.error;
+	return `Neon site search failed (HTTP ${status}).`;
+}
+const UNEXPECTED_RESPONSE = "Neon site search returned an unexpected response.";
+function stringField(fields, key) {
+	const field = fields[key];
+	if (typeof field !== "string") throw new Error(UNEXPECTED_RESPONSE);
+	return field;
+}
+function parseSearchHits(raw) {
+	const body = parseJson(raw);
+	if (typeof body !== "object" || body === null || !("hits" in body) || !Array.isArray(body.hits)) throw new Error(UNEXPECTED_RESPONSE);
+	return body.hits.map((hit) => {
+		if (typeof hit !== "object" || hit === null) throw new Error(UNEXPECTED_RESPONSE);
+		const fields = Object.fromEntries(Object.entries(hit));
+		const breadcrumb = fields.breadcrumb;
+		if (!Array.isArray(breadcrumb) || !breadcrumb.every((part) => typeof part === "string")) throw new Error(UNEXPECTED_RESPONSE);
+		return {
+			title: stringField(fields, "title"),
+			url: stringField(fields, "url"),
+			category: stringField(fields, "category"),
+			breadcrumb,
+			heading: stringField(fields, "heading"),
+			excerpt: stringField(fields, "excerpt")
+		};
+	});
+}
+//#endregion
+export { DEFAULT_SITE_SEARCH_URL, MAX_LIMIT, MAX_QUERY_LENGTH, SITE_SEARCH_CATEGORIES, builder, command, describe, parseSearchHits, resolveSiteSearchUrl, docs_exports as t };

package/dist/commands/env.js

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/index.js

@@ -21,6 +21,7 @@ import { t as databases_exports } from "./databases.js";
 import { t as deploy_exports } from "./deploy.js";
 import { t as dev_exports } from "./dev.js";
 import { t as diff_exports } from "./diff.js";
+import { t as docs_exports } from "./docs.js";
 import { t as feedback_exports } from "./feedback.js";
 import { t as functions_exports } from "./functions.js";
 import { t as git_exports } from "./git.js";
@@ -75,6 +76,7 @@ var commands_default = [
 	skills_exports,
 	ask_exports,
 	feedback_exports,
+	docs_exports,
 	data_api_exports,
 	realtime_exports,
 	functions_exports,

package/dist/commands/manifest.js

@@ -181,6 +181,11 @@ const commandManifest = [
 		describe: "Send feedback to Neon",
 		load: () => import("./feedback.js")
 	},
+	{
+		command: "docs",
+		describe: "Search neon.com docs, guides, and more",
+		load: () => import("./docs.js")
+	},
 	{
 		command: "data-api",
 		describe: "Manage the Neon Data API for a database",

package/dist/commands/profile.js

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
-import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
+import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { branchIdFromProps } from "../utils/enrichers.js";
 import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
+import { branchIdFromProps } from "../utils/enrichers.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/context.js

@@ -90,6 +90,8 @@ const isPluginsCommand = (args) => args._[0] === "plugins" || args._[0] === "plu
 const isAskCommand = (args) => args._[0] === "ask";
 /** Feedback is anonymous, so it must never read credentials or `.neon` context. */
 const isFeedbackCommand = (args) => args._[0] === "feedback";
+/** Docs search calls public neon.com search, so it needs no credentials or `.neon` context. */
+const isDocsCommand = (args) => args._[0] === "docs";
 /**
 * `inspect db --db-url` talks to Postgres with that URI. Skip only when the
 * parsed value is nonempty: empty `--db-url` still goes through project
@@ -177,7 +179,7 @@ const enrichFromContext = (args) => {
 	if (isProfileCommand(args)) return;
 	if (isMcpCommand(args)) return;
 	if (isSkillsCommand(args) || isPluginsCommand(args)) return;
-	if (isAskCommand(args) || isFeedbackCommand(args)) return;
+	if (isAskCommand(args) || isFeedbackCommand(args) || isDocsCommand(args)) return;
 	if (isClaimCommand(args)) return;
 	const context = readContextFile(args.contextFile);
 	if (!args.orgId) args.orgId = context.orgId;
@@ -357,4 +359,4 @@ const globToRegExp = (pattern) => {
 	return new RegExp(`^${source}$`);
 };
 //#endregion
-export { CONTEXT_FILE, applyContext, contextBranch, currentContextFile, enrichFromContext, ensureDirectoryGitignored, ensureGitignored, gitBranchMap, gitBranchMapping, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile, setContext, setGitBranchMap, setGitBranchMapping, setGitFollow, updateContextFile, walkContextFile };
+export { CONTEXT_FILE, applyContext, contextBranch, currentContextFile, enrichFromContext, ensureDirectoryGitignored, ensureGitignored, gitBranchMap, gitBranchMapping, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile, setContext, setGitBranchMap, setGitBranchMapping, setGitFollow, updateContextFile, walkContextFile };

package/dist/credential_io.js

@@ -1 +1 @@
-export { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
+export { t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";

package/dist/init/detect.js

@@ -1,4 +1,4 @@
-import { t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
+import { t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
 import { isCi } from "../env.js";
 import { h as resolveProfile, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
 import { i as selectCredential, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";

package/dist/keyring.js

@@ -1,5 +1,7 @@
 import { createRequire } from "node:module";
 //#region src/keyring.ts
+/** Windows Credential Manager stores at most 2560 bytes per item: 1280 UTF-16 code units. */
+const keyringPasswordLimit = (platform) => platform === "win32" ? 1280 : void 0;
 const isPackaged = () => process.pkg !== void 0;
 const isMissingItem = (err) => {
 	const message = err instanceof Error ? err.message : String(err);
@@ -13,7 +15,9 @@ const tryLoadKeyring = () => {
 	if (isPackaged()) return null;
 	try {
 		const { Entry } = createRequire(import.meta.url)(["@napi-rs", "keyring"].join("/"));
+		const maxPasswordCodeUnits = keyringPasswordLimit(process.platform);
 		return {
+			...maxPasswordCodeUnits !== void 0 ? { maxPasswordCodeUnits } : {},
 			get(service, account) {
 				try {
 					return new Entry(service, account).getPassword();
@@ -39,4 +43,4 @@ const tryLoadKeyring = () => {
 	}
 };
 //#endregion
-export { tryLoadKeyring };
+export { keyringPasswordLimit, tryLoadKeyring };

package/dist/psql/io/history.js

@@ -1,7 +1,7 @@
 import { promises } from "node:fs";
 import * as path from "node:path";
-import * as os from "node:os";
 import { randomUUID } from "node:crypto";
+import * as os from "node:os";
 //#region src/psql/io/history.ts
 /**
 * psql history file I/O.

package/dist/refresh_lock.js

@@ -41,4 +41,4 @@ const withExclusiveLock = async (lockPath, fn) => {
 	}
 };
 //#endregion
-export { withExclusiveLock };
+export { isEexist, withExclusiveLock };

package/dist/retire_credential.js

@@ -1,4 +1,4 @@
-import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-ByNuojoE.js";
+import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-BS-0Pmwc.js";
 import { log } from "./log.js";
 import { getApiClient } from "./api.js";
 import { revokeToken } from "./auth.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.8.0",
+  "version": "8.10.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -70,10 +70,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.2",
-    "@neon/config-runtime": "1.10.1",
-    "@neon/realtime": "0.1.1",
-    "@neon/sdk": "7.3.0"
+    "@neon/config": "1.9.3",
+    "@neon/realtime": "0.1.2",
+    "@neon/sdk": "7.4.0",
+    "@neon/config-runtime": "1.10.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -110,9 +110,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.33",
+    "@neon-internals/env-core": "0.0.34",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/env": "1.6.3",
+    "@neon/env": "1.6.4",
     "@neon/functions": "0.11.0"
   },
   "publishConfig": {