neonctl 2.22.2 → 2.23.1

package/utils/esbuild.js

@@ -0,0 +1,147 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join } from 'node:path';
+import which from 'which';
+const NOT_FOUND = 'esbuild not found. neonctl ships esbuild for most platforms; if you see ' +
+    'this, install esbuild and ensure it is on your PATH (e.g. `npm i -g ' +
+    'esbuild`), or set NEON_ESBUILD_PATH to an esbuild binary.';
+const defaultDeps = {
+    // @yao-pkg/pkg defines process.pkg inside the packaged binary.
+    isPackaged: () => process.pkg !== undefined,
+    loadEsbuild: (name) => import(name),
+};
+// Internal signal: the esbuild JS module could not be imported (exotic platform
+// or not installed). Tells bundleEntry to fall back to the binary; never shown
+// to the user.
+class ModuleNotAvailable extends Error {
+}
+const message = (err) => err instanceof Error ? err.message : String(err);
+const toFilesByBasename = (files) => {
+    const out = {};
+    for (const f of files)
+        out[basename(f.path)] = f.contents;
+    return out;
+};
+const bundleViaModule = async (source, loadEsbuild) => {
+    // esbuild is resolved by a COMPUTED specifier, never the literal string
+    // 'esbuild'. Both rollup (bundle step) and @yao-pkg/pkg (binary step)
+    // statically scan for literal import()/require() calls and would otherwise
+    // pull esbuild and its native Go binary into the bundle/snapshot — bloating
+    // the packaged CLI and emitting "cannot bundle native binary" warnings. The
+    // packaged binary never imports esbuild at all (the isPackaged guard sends it
+    // to the binary path), so keeping this specifier invisible to the scanners is
+    // what keeps esbuild out of the snapshot.
+    // Do NOT "simplify" this back to import('esbuild').
+    const name = ['es', 'build'].join('');
+    let esbuild;
+    try {
+        esbuild = await loadEsbuild(name);
+    }
+    catch {
+        throw new ModuleNotAvailable();
+    }
+    // Mirrors the binary-path bundling flags; write:false keeps output in memory.
+    // logLevel:'silent' suppresses esbuild's own stderr — the rejected error
+    // still carries the diagnostic, matching the binary path's captured-stderr.
+    const result = await esbuild
+        .build({
+        entryPoints: [source],
+        bundle: true,
+        outfile: 'out.js',
+        write: false,
+        sourcemap: true,
+        minify: true,
+        format: 'esm',
+        platform: 'node',
+        packages: 'external',
+        logLevel: 'silent',
+    })
+        .catch((err) => {
+        throw new Error(`Failed to bundle function from ${source}. ${message(err)}`.trim());
+    });
+    const files = result.outputFiles ?? [];
+    // write:false with one entry always yields out.js + out.js.map; an empty set
+    // means the API contract changed under us — fail loud rather than ship an
+    // empty archive.
+    if (files.length === 0) {
+        throw new Error(`Failed to bundle function from ${source}. esbuild produced no output.`);
+    }
+    return toFilesByBasename(files);
+};
+// Find the esbuild binary at deploy time. An explicit override is authoritative
+// (so it fails loudly if wrong); otherwise prefer the host PATH, then a locally
+// installed copy.
+const resolveEsbuild = () => {
+    const override = process.env.NEON_ESBUILD_PATH;
+    if (override) {
+        if (existsSync(override))
+            return override;
+        throw new Error(NOT_FOUND);
+    }
+    const onPath = which.sync('esbuild', { nothrow: true });
+    if (onPath)
+        return onPath;
+    // CWD-relative (not install-relative): helps the dev checkout where esbuild is
+    // a devDependency. In `npm i -g` and pkg installs the PATH branch above wins.
+    const local = join(process.cwd(), 'node_modules', '.bin', 'esbuild');
+    if (existsSync(local))
+        return local;
+    throw new Error(NOT_FOUND);
+};
+const runEsbuild = (bin, args) => new Promise((resolve, reject) => {
+    // stderr is captured (NOT inherited): with --log-level=error a success emits
+    // nothing, and a failure's diagnostic is read out below. Never use 'inherit'.
+    const child = spawn(bin, args, { stdio: ['ignore', 'ignore', 'pipe'] });
+    let stderr = '';
+    child.stderr.on('data', (chunk) => {
+        stderr += chunk.toString();
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+        resolve({ code, stderr });
+    });
+});
+const bundleViaBinary = async (source) => {
+    const bin = resolveEsbuild();
+    const outDir = mkdtempSync(join(tmpdir(), 'neon-fn-bundle-'));
+    const outfile = join(outDir, 'out.js');
+    try {
+        const { code, stderr } = await runEsbuild(bin, [
+            source,
+            '--bundle',
+            `--outfile=${outfile}`,
+            '--sourcemap',
+            '--minify',
+            '--format=esm',
+            '--platform=node',
+            '--packages=external',
+            '--log-level=error',
+        ]);
+        if (code !== 0) {
+            throw new Error(`Failed to bundle function from ${source}. ${stderr.trim()}`.trim());
+        }
+        return {
+            'out.js': new Uint8Array(readFileSync(outfile)),
+            'out.js.map': new Uint8Array(readFileSync(`${outfile}.map`)),
+        };
+    }
+    finally {
+        rmSync(outDir, { recursive: true, force: true });
+    }
+};
+// Bundle `source` into the files the Functions archive expects, keyed by
+// basename. npm installs bundle in-process via the esbuild module; the packaged
+// binary (and platforms esbuild can't run on) shell out to an esbuild binary.
+export const bundleEntry = async (source, deps = defaultDeps) => {
+    if (deps.isPackaged())
+        return bundleViaBinary(source);
+    try {
+        return await bundleViaModule(source, deps.loadEsbuild);
+    }
+    catch (err) {
+        if (err instanceof ModuleNotAvailable)
+            return bundleViaBinary(source);
+        throw err;
+    }
+};

package/utils/psql.js

@@ -1,24 +1,120 @@
-import { log } from '../log.js';
 import { spawn } from 'child_process';
 import which from 'which';
-export const psql = async (connection_uri, args = []) => {
-    const psqlPathOrNull = await which('psql', { nothrow: true });
-    if (psqlPathOrNull === null) {
-        log.error(`psql is not available in the PATH`);
-        process.exit(1);
+import { closeAnalytics, trackEvent } from '../analytics.js';
+import { log } from '../log.js';
+const FALLBACK_ENV = 'NEONCTL_PSQL_FALLBACK';
+/** Max time we wait for the analytics flush before handing off to psql. */
+const ANALYTICS_FLUSH_TIMEOUT_MS = 3000;
+/**
+ * Decide which psql implementation will run, and why. The PATH probe is
+ * skipped when TS is forced (flag or env) — we don't need it and it'd be a
+ * wasted lookup — so `nativeAvailable` is `null` ("not checked") in those
+ * cases rather than a misleading `false`.
+ */
+const planPsql = async (opts) => {
+    if (opts.mode === 'ts') {
+        return {
+            implementation: 'ts',
+            reason: 'forced_flag',
+            nativeAvailable: null,
+            nativePath: null,
+        };
+    }
+    if (process.env[FALLBACK_ENV] === '1') {
+        return {
+            implementation: 'ts',
+            reason: 'forced_env',
+            nativeAvailable: null,
+            nativePath: null,
+        };
     }
+    const nativePath = await which('psql', { nothrow: true });
+    const nativeAvailable = nativePath !== null;
+    if (opts.mode === 'native') {
+        return {
+            implementation: 'native',
+            reason: 'forced_native',
+            nativeAvailable,
+            nativePath,
+        };
+    }
+    // 'auto' (or unset): strict fallback — prefer native, TS only if missing.
+    return nativeAvailable
+        ? {
+            implementation: 'native',
+            reason: 'native_available',
+            nativeAvailable,
+            nativePath,
+        }
+        : {
+            implementation: 'ts',
+            reason: 'fallback_no_native',
+            nativeAvailable,
+            nativePath,
+        };
+};
+/**
+ * Record which psql implementation is about to run, then flush analytics.
+ *
+ * Both exec paths below call `process.exit()`, which short-circuits the
+ * main loop's `closeAnalytics()` — so without flushing here the event (and
+ * any earlier queued events, e.g. `CLI Started`) would be dropped. The
+ * flush is bounded by {@link ANALYTICS_FLUSH_TIMEOUT_MS} so a slow or
+ * unreachable analytics endpoint can't stall the psql launch. No-ops when
+ * analytics is disabled (`--analytics false`), since the client is absent.
+ */
+const reportPsqlInvocation = async (plan) => {
+    trackEvent('psql_invoked', {
+        implementation: plan.implementation,
+        reason: plan.reason,
+        nativeAvailable: plan.nativeAvailable,
+    });
+    await closeAnalytics({ timeout: ANALYTICS_FLUSH_TIMEOUT_MS });
+};
+const execNative = async (binary, connection_uri, args) => {
     log.info('Connecting to the database using psql...');
-    const psql = spawn(psqlPathOrNull, [connection_uri, ...args], {
+    const child = spawn(binary, [connection_uri, ...args], {
         stdio: 'inherit',
     });
     for (const signame of ['SIGINT', 'SIGTERM']) {
         process.on(signame, (code) => {
-            if (!psql.killed && code !== null) {
-                psql.kill(code);
+            if (!child.killed && code !== null) {
+                child.kill(code);
             }
         });
     }
-    psql.on('exit', (code) => {
-        process.exit(code === null ? 1 : code);
+    return new Promise((_, reject) => {
+        child.on('exit', (code) => {
+            process.exit(code === null ? 1 : code);
+        });
+        child.on('error', reject);
+    });
+};
+const execTs = async (connection_uri, args) => {
+    log.info('Connecting to the database using embedded psql (TypeScript)...');
+    const { runPsql } = await import('../psql/index.js');
+    const code = await runPsql([connection_uri, ...args], {
+        stdin: process.stdin,
+        stdout: process.stdout,
+        stderr: process.stderr,
     });
+    process.exit(code);
+};
+export const psql = async (connection_uri, args = [], opts = {}) => {
+    const plan = await planPsql(opts);
+    await reportPsqlInvocation(plan);
+    if (plan.implementation === 'ts') {
+        if (plan.reason === 'fallback_no_native') {
+            log.info('psql binary not found on PATH; falling back to embedded TypeScript psql');
+        }
+        return execTs(connection_uri, args);
+    }
+    // implementation === 'native'
+    if (plan.nativePath === null) {
+        // Only reachable when native was explicitly requested (mode: 'native')
+        // but no binary is on PATH.
+        log.error(`psql is not available in the PATH`);
+        process.exit(1);
+    }
+    return execNative(plan.nativePath, connection_uri, args);
 };

package/utils/zip.js

@@ -0,0 +1,4 @@
+import { zipSync } from 'fflate';
+// Zip the esbuild output (out.js + out.js.map) into the archive the Functions
+// deploy endpoint expects. Compression level 6 matches the previous bundler.
+export const zipBundle = (entries) => zipSync(entries, { level: 6 });

package/writer.js

@@ -46,7 +46,7 @@ const writeTable = (chunks, out) => {
                     ? value.join('\n')
                     : isObject(value)
                         ? JSON.stringify(value, null, 2)
-                        : value;
+                        : (value ?? '');
             }));
         });
         if (title) {

package/commands/auth.test.js

@@ -1,211 +0,0 @@
-import axios from 'axios';
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
-import { join } from 'path';
-import { afterAll, beforeAll, beforeEach, describe, expect, vi } from 'vitest';
-import * as authModule from '../auth';
-import { test } from '../test_utils/fixtures';
-import { startOauthServer } from '../test_utils/oauth_server';
-import { authFlow, ensureAuth, deleteCredentials } from './auth';
-vi.mock('open', () => ({ default: vi.fn((url) => axios.get(url)) }));
-vi.mock('../pkg.ts', () => ({ default: { version: '0.0.0' } }));
-describe('auth', () => {
-    let configDir = '';
-    let oauthServer;
-    beforeAll(async () => {
-        configDir = mkdtempSync('test-config');
-        oauthServer = await startOauthServer();
-    });
-    afterAll(async () => {
-        rmSync(configDir, { recursive: true });
-        await oauthServer.stop();
-    });
-    test('should auth', async ({ runMockServer }) => {
-        const server = await runMockServer('main');
-        await authFlow({
-            _: ['auth'],
-            apiHost: `http://localhost:${server.address().port}`,
-            clientId: 'test-client-id',
-            configDir,
-            forceAuth: true,
-            oauthHost: `http://localhost:${oauthServer.address().port}`,
-            allowUnsafeTls: true,
-        });
-        const credentials = JSON.parse(readFileSync(`${configDir}/credentials.json`, 'utf-8'));
-        expect(credentials.access_token).toEqual(expect.any(String));
-        expect(credentials.refresh_token).toEqual(expect.any(String));
-        expect(credentials.user_id).toEqual(expect.any(String));
-    });
-});
-describe('ensureAuth', () => {
-    let configDir = '';
-    let oauthServer;
-    let mockApiClient;
-    let authSpy;
-    let refreshTokenSpy;
-    beforeAll(async () => {
-        configDir = mkdtempSync('test-config');
-        oauthServer = await startOauthServer();
-        mockApiClient = {};
-        authSpy = vi.spyOn(authModule, 'auth');
-        refreshTokenSpy = vi.spyOn(authModule, 'refreshToken');
-    });
-    afterAll(async () => {
-        rmSync(configDir, { recursive: true });
-        await oauthServer.stop();
-        vi.restoreAllMocks();
-    });
-    beforeEach(() => {
-        authSpy.mockClear();
-        refreshTokenSpy.mockClear();
-    });
-    const setupTestProps = (server) => ({
-        _: ['some-command'],
-        configDir,
-        oauthHost: `http://localhost:${oauthServer.address().port}`,
-        clientId: 'test-client-id',
-        forceAuth: true,
-        apiKey: '',
-        apiHost: `http://localhost:${server.address().port}`,
-        help: false,
-        apiClient: mockApiClient,
-        allowUnsafeTls: true,
-    });
-    test('should start new auth flow when refresh token fails', async ({ runMockServer, }) => {
-        refreshTokenSpy.mockImplementationOnce(() => Promise.reject(new Error('AUTH_REFRESH_FAILED')));
-        authSpy.mockImplementationOnce(() => Promise.resolve({
-            access_token: 'new-auth-token',
-            refresh_token: 'new-refresh-token',
-            expires_at: Math.floor(Date.now() / 1000) + 3600,
-        }));
-        const server = await runMockServer('main');
-        const expiredTokenSet = {
-            access_token: 'expired-token',
-            refresh_token: 'refresh-token',
-            expires_at: Date.now() - 3600 * 1000,
-        };
-        writeFileSync(join(configDir, 'credentials.json'), JSON.stringify(expiredTokenSet), { mode: 0o700 });
-        const props = setupTestProps(server);
-        await ensureAuth(props);
-        expect(refreshTokenSpy).toHaveBeenCalledTimes(1);
-        expect(authSpy).toHaveBeenCalledTimes(1);
-        expect(props.apiKey).toBe('new-auth-token');
-    });
-    test('should trigger auth flow when credentials.json does not exist', async ({ runMockServer, }) => {
-        const server = await runMockServer('main');
-        // Ensure the credentials file does not exist
-        const credentialsPath = join(configDir, 'credentials.json');
-        if (existsSync(credentialsPath)) {
-            rmSync(credentialsPath);
-        }
-        const props = setupTestProps(server);
-        await ensureAuth(props);
-        expect(authSpy).toHaveBeenCalledTimes(1);
-        expect(refreshTokenSpy).not.toHaveBeenCalled();
-        expect(props.apiKey).toEqual(expect.any(String));
-    });
-    test('should trigger auth flow when credentials.json is invalid', async ({ runMockServer, }) => {
-        const server = await runMockServer('main');
-        // Write an empty credentials file
-        writeFileSync(join(configDir, 'credentials.json'), '', { mode: 0o700 });
-        const props = setupTestProps(server);
-        await ensureAuth(props);
-        expect(authSpy).toHaveBeenCalledTimes(1);
-        expect(refreshTokenSpy).not.toHaveBeenCalled();
-        expect(props.apiKey).toEqual(expect.any(String));
-    });
-    test('should try refresh when token is missing access_token but has refresh_token', async ({ runMockServer, }) => {
-        const server = await runMockServer('main');
-        const tokenWithoutAccess = {
-            refresh_token: 'refresh-token',
-        };
-        writeFileSync(join(configDir, 'credentials.json'), JSON.stringify(tokenWithoutAccess), { mode: 0o700 });
-        refreshTokenSpy.mockImplementationOnce(() => Promise.resolve({
-            access_token: 'refreshed-token',
-            refresh_token: 'new-refresh-token',
-            expires_at: Math.floor(Date.now() / 1000) + 3600,
-        }));
-        const props = setupTestProps(server);
-        await ensureAuth(props);
-        expect(refreshTokenSpy).toHaveBeenCalledTimes(1);
-        expect(authSpy).not.toHaveBeenCalled();
-        expect(props.apiKey).toBe('refreshed-token');
-    });
-    test('should use existing valid token', async ({ runMockServer }) => {
-        const server = await runMockServer('main');
-        const validTokenSet = {
-            access_token: 'valid-token',
-            refresh_token: 'refresh-token',
-            expires_at: Date.now() + 3600 * 1000, // 1 hour from now
-        };
-        writeFileSync(join(configDir, 'credentials.json'), JSON.stringify(validTokenSet), { mode: 0o700 });
-        const props = setupTestProps(server);
-        await ensureAuth(props);
-        expect(authSpy).not.toHaveBeenCalled();
-        expect(refreshTokenSpy).not.toHaveBeenCalled();
-        expect(props.apiKey).toBe('valid-token');
-    });
-    test('should require auth for init command', async ({ runMockServer }) => {
-        const server = await runMockServer('main');
-        const credentialsPath = join(configDir, 'credentials.json');
-        if (existsSync(credentialsPath)) {
-            rmSync(credentialsPath);
-        }
-        const props = {
-            ...setupTestProps(server),
-            _: ['init'],
-        };
-        await ensureAuth(props);
-        expect(authSpy).toHaveBeenCalledTimes(1);
-        expect(refreshTokenSpy).not.toHaveBeenCalled();
-        expect(props.apiKey).toEqual(expect.any(String));
-    });
-    test('should successfully refresh expired token', async ({ runMockServer, }) => {
-        refreshTokenSpy.mockImplementationOnce(() => Promise.resolve({
-            access_token: 'new-token',
-            refresh_token: 'new-refresh-token',
-            expires_at: Math.floor(Date.now() / 1000) + 3600,
-        }));
-        const server = await runMockServer('main');
-        const expiredTokenSet = {
-            access_token: 'expired-token',
-            refresh_token: 'refresh-token',
-            expires_at: Date.now() - 3600 * 1000, // expired 1 hour ago
-        };
-        writeFileSync(join(configDir, 'credentials.json'), JSON.stringify(expiredTokenSet), { mode: 0o700 });
-        const props = setupTestProps(server);
-        await ensureAuth(props);
-        expect(refreshTokenSpy).toHaveBeenCalledTimes(1);
-        expect(authSpy).not.toHaveBeenCalled();
-        expect(props.apiKey).toBe('new-token');
-    });
-});
-describe('deleteCredentials', () => {
-    let configDir = '';
-    beforeAll(() => {
-        configDir = mkdtempSync('test-config-delete');
-    });
-    afterAll(() => {
-        rmSync(configDir, { recursive: true });
-    });
-    test('should successfully delete credentials file', () => {
-        const credentialsPath = join(configDir, 'credentials.json');
-        writeFileSync(credentialsPath, 'test-content', { mode: 0o700 });
-        expect(existsSync(credentialsPath)).toBe(true);
-        deleteCredentials(configDir);
-        expect(existsSync(credentialsPath)).toBe(false);
-    });
-    test('should handle non-existent file gracefully', () => {
-        const nonExistentDir = mkdtempSync('test-config-nonexistent');
-        // Ensure the file doesn't exist
-        const credentialsPath = join(nonExistentDir, 'credentials.json');
-        if (existsSync(credentialsPath)) {
-            rmSync(credentialsPath);
-        }
-        expect(existsSync(credentialsPath)).toBe(false);
-        // Should not throw an error
-        expect(() => {
-            deleteCredentials(nonExistentDir);
-        }).not.toThrow();
-        rmSync(nonExistentDir, { recursive: true });
-    });
-});