neon 8.8.0 → 8.9.0

package/dist/analytics.js

@@ -1,6 +1,7 @@
 import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
+import { getOrCreateAnonymousId } from "./anonymous_id.js";
 import pkg_default from "./pkg.js";
 import { UnreadableResponseError, getApiClient, isNeonApiError } from "./api.js";
 import { getAuthContext } from "./auth_context.js";
@@ -19,16 +20,17 @@ const WRITE_KEY = "3SQXn5ejjXWLEJ8xU2PRYhAotLtTaeeV";
 const hasCurrentBranchArgv = () => process.argv.includes("--current-branch");
 const ANONYMOUS = "anonymous";
 /**
-* Who to attribute an event to, given whatever identified this invocation.
-*
-* Nothing is guaranteed to have identified it: a command can run with no credentials at all,
-* leaving the id empty. Segment accepts an empty `userId` and forwards it as-is rather than
-* rejecting it, so the substitution has to happen here. `""` is falsy but not nullish, which
-* is why the fallback has to be `||`.
+* The identity to send an event under. A run nothing identified (an empty `userId`, which
+* Segment would forward as-is) is the shared `"anonymous"` user, as it always was, so existing
+* queries on it keep working. The stored anonymous id goes with every event, signed in or not,
+* so the signed-out events of an installation can be joined to its account once a user is known.
 *
 * Exported for tests.
 */
-const analyticsUserId = (userId) => userId || ANONYMOUS;
+const analyticsIdentity = (userId, anonymousId) => ({
+	userId: userId || ANONYMOUS,
+	...anonymousId ? { anonymousId } : {}
+});
 /**
 * The account an invocation that presented no API key may claim, which is nothing at all
 * unless stored credentials named a user.
@@ -77,10 +79,13 @@ const telemetryCredential = (authContext, apiKey, defaultCredentialsPath) => {
 let client;
 let clientInitialized = false;
 let errorEventContext;
+/** Set with the client, so it exists only when analytics is on. */
+let anonymousId;
 /** Lets tests send to a local collector; the CLI itself always uses track.neon.tech. */
-const useAnalyticsClientForTests = (analytics) => {
+const useAnalyticsClientForTests = (analytics, testAnonymousId) => {
 	client = analytics;
 	clientInitialized = true;
+	anonymousId = testAnonymousId;
 };
 /**
 * Phase 1: Run before validation so the Segment client exists if any
@@ -97,7 +102,8 @@ const initAnalyticsClientMiddleware = (args) => {
 		host: "https://track.neon.tech"
 	});
 	log.debug("Initialized CLI analytics client");
-	client.identify({ userId: ANONYMOUS });
+	anonymousId = args.configDir ? getOrCreateAnonymousId(args.configDir) : void 0;
+	client.identify(analyticsIdentity(void 0, anonymousId));
 };
 /**
 * The attribution of the current attempt. A 401 retry runs the middleware again and starts a
@@ -179,9 +185,9 @@ const analyticsMiddleware = (args) => {
 	})();
 	queue = queue.then(() => lookup);
 	enqueue((analytics, { userId }) => {
-		analytics.identify({ userId: analyticsUserId(userId) });
+		analytics.identify(analyticsIdentity(userId, anonymousId));
 		analytics.track({
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			event: "CLI Started",
 			properties: startedProperties,
 			context: { direct: true }
@@ -266,7 +272,7 @@ const sendError = (err, errCode) => {
 	enqueue((analytics, { userId }) => {
 		analytics.track({
 			event: "CLI Error",
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties
 		});
 	});
@@ -284,7 +290,7 @@ const trackEvent = (event, properties) => {
 	enqueue((analytics, { userId }) => {
 		analytics.track({
 			event,
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties
 		});
 	});
@@ -300,7 +306,7 @@ const trackCommandSuccess = (args) => {
 	enqueue((analytics, { userId, accountId, authMethod, authData }) => {
 		analytics.track({
 			event: "cli_command_success",
-			userId: analyticsUserId(userId),
+			...analyticsIdentity(userId, anonymousId),
 			properties: {
 				...properties,
 				accountId,
@@ -348,4 +354,4 @@ const getAnalyticsEventProperties = (args) => ({
 	githubEnvVars: getGithubEnvVars(process.env)
 });
 //#endregion
-export { analyticsMiddleware, analyticsUserId, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };
+export { analyticsIdentity, analyticsMiddleware, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, recordCommandSuccessExtras, recordScaffoldedTemplate, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };

package/dist/anonymous_id.js

@@ -0,0 +1,59 @@
+import { t as writeSecretFile } from "./_chunks/secure_file-BucZj4yQ.js";
+import { isCi } from "./env.js";
+import { log } from "./log.js";
+import { isEexist } from "./refresh_lock.js";
+import { linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+//#region src/anonymous_id.ts
+const ANONYMOUS_ID_FILE = "anonymous_id";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const readStored = (path) => {
+	try {
+		const stored = readFileSync(path, "utf8").trim();
+		return UUID.test(stored) ? stored : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* Names this installation in analytics before sign-in. Commands that know the user send it
+* alongside `userId`, so earlier events can be linked to the account.
+*
+* Not stored in CI, where the config directory doesn't outlive the run and every run would
+* mint a new installation. Call only once analytics is known to be enabled.
+*/
+const getOrCreateAnonymousId = (configDir) => {
+	if (isCi()) return;
+	const path = join(configDir, ANONYMOUS_ID_FILE);
+	try {
+		const stored = readStored(path);
+		if (stored) return stored;
+		mkdirSync(configDir, { recursive: true });
+		const id = randomUUID();
+		const temporary = `${path}.${id}.tmp`;
+		writeFileSync(temporary, `${id}\n`, {
+			mode: 384,
+			flag: "wx"
+		});
+		try {
+			linkSync(temporary, path);
+			return id;
+		} catch (err) {
+			if (!isEexist(err)) throw err;
+			const winner = readStored(path);
+			if (winner) return winner;
+			writeSecretFile(path, `${id}\n`);
+			return id;
+		} finally {
+			try {
+				unlinkSync(temporary);
+			} catch {}
+		}
+	} catch (err) {
+		log.debug("Could not store the anonymous analytics id: %s", err);
+		return;
+	}
+};
+//#endregion
+export { ANONYMOUS_ID_FILE, getOrCreateAnonymousId };

package/dist/commands/auth.js

@@ -2,6 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
+import { withExclusiveLock } from "../refresh_lock.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
@@ -12,7 +13,6 @@ import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "..
 import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
-import { withExclusiveLock } from "../refresh_lock.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpEpilogue, helpWidth, wrapHelpText } from "../utils/help_text.js";

package/dist/commands/dev.js

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
 import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
-import { envFlag } from "./config.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
+import { envFlag } from "./config.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/env.js

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { branchIdFromProps } from "../utils/enrichers.js";
 import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
+import { branchIdFromProps } from "../utils/enrichers.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/psql/io/history.js

@@ -1,7 +1,7 @@
 import { promises } from "node:fs";
 import * as path from "node:path";
-import * as os from "node:os";
 import { randomUUID } from "node:crypto";
+import * as os from "node:os";
 //#region src/psql/io/history.ts
 /**
 * psql history file I/O.

package/dist/refresh_lock.js

@@ -41,4 +41,4 @@ const withExclusiveLock = async (lockPath, fn) => {
 	}
 };
 //#endregion
-export { withExclusiveLock };
+export { isEexist, withExclusiveLock };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.8.0",
+  "version": "8.9.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -70,10 +70,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.2",
-    "@neon/config-runtime": "1.10.1",
-    "@neon/realtime": "0.1.1",
-    "@neon/sdk": "7.3.0"
+    "@neon/config": "1.9.3",
+    "@neon/config-runtime": "1.10.2",
+    "@neon/realtime": "0.1.2",
+    "@neon/sdk": "7.4.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -110,9 +110,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.33",
+    "@neon-internals/env-core": "0.0.34",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/env": "1.6.3",
+    "@neon/env": "1.6.4",
     "@neon/functions": "0.11.0"
   },
   "publishConfig": {