neonctl 2.27.1 → 2.29.0

package/dist/auth.js

@@ -1,58 +1,62 @@
-import * as client from 'openid-client';
-import { createServer } from 'node:http';
-import { createReadStream } from 'node:fs';
-import { join } from 'node:path';
-import open from 'open';
-import { log } from './log.js';
-import { fileURLToPath } from 'node:url';
-import { sendError } from './analytics.js';
-import { matchErrorCode } from './errors.js';
-import { extendTokenSet } from './utils/auth.js';
+import { createReadStream } from "node:fs";
+import { createServer, } from "node:http";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import open from "open";
+import * as client from "openid-client";
+import { sendError } from "./analytics.js";
+import { matchErrorCode } from "./errors.js";
+import { log } from "./log.js";
+import { extendTokenSet } from "./utils/auth.js";
 // oauth server timeouts
 const SERVER_TIMEOUT = 10000;
 // where to wait for incoming redirect request from oauth server to arrive
 const REDIRECT_URI = (port) => `http://127.0.0.1:${port}/callback`;
 // These scopes cannot be cancelled, they are always needed.
-const ALWAYS_PRESENT_SCOPES = ['openid', 'offline', 'offline_access'];
+const ALWAYS_PRESENT_SCOPES = ["openid", "offline", "offline_access"];
 const NEONCTL_SCOPES = [
     ...ALWAYS_PRESENT_SCOPES,
-    'urn:neoncloud:projects:create',
-    'urn:neoncloud:projects:read',
-    'urn:neoncloud:projects:update',
-    'urn:neoncloud:projects:delete',
-    'urn:neoncloud:orgs:create',
-    'urn:neoncloud:orgs:read',
-    'urn:neoncloud:orgs:update',
-    'urn:neoncloud:orgs:delete',
-    'urn:neoncloud:orgs:permission',
+    "urn:neoncloud:projects:create",
+    "urn:neoncloud:projects:read",
+    "urn:neoncloud:projects:update",
+    "urn:neoncloud:projects:delete",
+    "urn:neoncloud:orgs:create",
+    "urn:neoncloud:orgs:read",
+    "urn:neoncloud:orgs:update",
+    "urn:neoncloud:orgs:delete",
+    "urn:neoncloud:orgs:permission",
 ];
 const AUTH_TIMEOUT_SECONDS = 60;
-export const defaultClientID = 'neonctl';
+export const defaultClientID = "neonctl";
 export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-    log.debug('Discovering oauth server');
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: 'none' }, client.None(), {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
         timeout: SERVER_TIMEOUT,
-        // eslint-disable-next-line @typescript-eslint/no-deprecated
-        execute: allowUnsafeTls ? [client.allowInsecureRequests] : undefined,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
     });
     return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
 };
 export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
-    log.debug('Discovering oauth server');
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: 'none' }, client.None(), {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
         timeout: SERVER_TIMEOUT,
-        // eslint-disable-next-line @typescript-eslint/no-deprecated
-        execute: allowUnsafeTls ? [client.allowInsecureRequests] : undefined,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
     });
     //
     // Start HTTP server and wait till /callback is hit
     //
-    log.debug('Starting HTTP Server for callback');
+    log.debug("Starting HTTP Server for callback");
     const server = createServer();
-    server.listen(0, '127.0.0.1', function () {
+    server.listen(0, "127.0.0.1", function () {
         log.debug(`Listening on port ${this.address().port}`);
     });
-    await new Promise((resolve) => server.once('listening', resolve));
+    await new Promise((resolve) => server.once("listening", resolve));
     const listen_port = server.address().port;
     // https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.8
     const state = client.randomState();
@@ -67,17 +71,17 @@ export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
             //
             // Wait for callback and follow oauth flow.
             //
-            if (!request.url?.startsWith('/callback')) {
+            if (!request.url?.startsWith("/callback")) {
                 response.writeHead(404);
                 response.end();
                 return;
             }
             // process the CORS preflight OPTIONS request
-            if (request.method === 'OPTIONS') {
+            if (request.method === "OPTIONS") {
                 response.writeHead(200, {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': 'GET, POST',
-                    'Access-Control-Allow-Headers': 'Content-Type',
+                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Methods": "GET, POST",
+                    "Access-Control-Allow-Headers": "Content-Type",
                 });
                 response.end();
                 return;
@@ -87,29 +91,31 @@ export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
                 pkceCodeVerifier: codeVerifier,
                 expectedState: state,
             });
-            response.writeHead(200, { 'Content-Type': 'text/html' });
-            createReadStream(join(fileURLToPath(new URL('.', import.meta.url)), './callback.html')).pipe(response);
+            response.writeHead(200, { "Content-Type": "text/html" });
+            createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
             clearTimeout(timer);
             const exp = new Date();
             exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
             resolve(extendTokenSet(tokenSet));
             server.close();
         };
-        server.on('request', (req, res) => {
+        server.on("request", (req, res) => {
             void onRequest(req, res);
         });
         //
         // Open browser to let user authenticate
         //
-        const scopes = clientId == defaultClientID ? NEONCTL_SCOPES : ALWAYS_PRESENT_SCOPES;
+        const scopes = clientId == defaultClientID
+            ? NEONCTL_SCOPES
+            : ALWAYS_PRESENT_SCOPES;
         const authUrl = client.buildAuthorizationUrl(configuration, {
-            scope: scopes.join(' '),
+            scope: scopes.join(" "),
             state,
             code_challenge: codeChallenge,
-            code_challenge_method: 'S256',
+            code_challenge_method: "S256",
             redirect_uri: REDIRECT_URI(listen_port),
         });
-        log.info('Awaiting authentication in web browser.');
+        log.info("Awaiting authentication in web browser.");
         log.info(`Auth Url: ${authUrl}`);
         open(authUrl.href).catch((err) => {
             const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;

package/dist/cli.js

@@ -1,2 +1,9 @@
 #!/usr/bin/env node
-import './index.js';
+import { tryCurrentBranchFastPath } from "./current_branch_fast_path.js";
+// Fast path for the offline `(config) status --current-branch` probe (used by shell
+// prompts): read the pinned branch from `.neon` without loading the full command tree,
+// api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
+// the heavy `index.js` is imported lazily and only when actually needed.
+if (!tryCurrentBranchFastPath(process.argv)) {
+    void import("./index.js");
+}

package/dist/commands/auth.js

@@ -1,25 +1,26 @@
-import { existsSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { getApiClient } from '../api.js';
-import { auth, refreshToken } from '../auth.js';
-import { CREDENTIALS_FILE } from '../config.js';
-import { isCi } from '../env.js';
-import { log } from '../log.js';
-import { extendTokenSet } from '../utils/auth.js';
-export const command = 'auth';
-export const aliases = ['login'];
-export const describe = 'Authenticate';
-export const builder = (yargs) => yargs.option('context-file', {
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getApiClient } from "../api.js";
+import { auth, refreshToken } from "../auth.js";
+import { CREDENTIALS_FILE } from "../config.js";
+import { isConfigInit, isCurrentBranchProbe } from "../context.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { extendTokenSet } from "../utils/auth.js";
+export const command = "auth";
+export const aliases = ["login"];
+export const describe = "Authenticate";
+export const builder = (yargs) => yargs.option("context-file", {
     hidden: true,
 });
 export const handler = async (args) => {
     await authFlow(args);
 };
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, 'force-auth': forceAuthKebab, allowUnsafeTls, }) => {
+export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
     const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
     if (!allowInteractiveAuth && isCi()) {
-        throw new Error('Cannot run interactive auth in CI');
+        throw new Error("Cannot run interactive auth in CI");
     }
     const tokenSet = await auth({
         oauthHost: oauthHost,
@@ -29,16 +30,16 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
     const credentialsPath = join(configDir, CREDENTIALS_FILE);
     try {
         await preserveCredentials(credentialsPath, tokenSet, getApiClient({
-            apiKey: tokenSet.access_token || '',
+            apiKey: tokenSet.access_token || "",
             apiHost,
         }));
     }
     catch {
-        log.error('Failed to save credentials');
-        return '';
+        log.error("Failed to save credentials");
+        return "";
     }
-    log.info('Auth complete');
-    return tokenSet.access_token || '';
+    log.info("Auth complete");
+    return tokenSet.access_token || "";
 };
 const preserveCredentials = async (path, credentials, apiClient) => {
     const { data: { id }, } = await apiClient.getCurrentUserInfo();
@@ -51,13 +52,13 @@ const preserveCredentials = async (path, credentials, apiClient) => {
     writeFileSync(path, contents, {
         mode: 0o700,
     });
-    log.debug('Saved credentials to %s', path);
-    log.debug('Credentials MD5 hash: %s', md5hash(contents));
+    log.debug("Saved credentials to %s", path);
+    log.debug("Credentials MD5 hash: %s", md5hash(contents));
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     // Use existing access_token, if present and valid
     if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
-        log.debug('Using existing valid access_token');
+        log.debug("Using existing valid access_token");
         const apiClient = getApiClient({
             apiKey: tokenSet.access_token,
             apiHost: props.apiHost,
@@ -66,10 +67,10 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     }
     // Either access_token is missing or its expired. Refresh the token
     log.debug(tokenSet.expires_at < Date.now()
-        ? 'Token is expired, attempting refresh'
-        : 'Token is missing access_token, attempting refresh');
+        ? "Token is expired, attempting refresh"
+        : "Token is missing access_token, attempting refresh");
     if (!tokenSet.refresh_token) {
-        log.debug('TokenSet is missing refresh_token, starting authentication');
+        log.debug("TokenSet is missing refresh_token, starting authentication");
         return null;
     }
     try {
@@ -86,13 +87,13 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
             apiHost: props.apiHost,
         });
         await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
-        log.debug('Token refresh successful');
+        log.debug("Token refresh successful");
         return { apiKey, apiClient };
     }
     catch (err) {
-        const typedErr = err instanceof Error ? err : new Error('Unknown error');
-        log.debug('Failed to refresh token: %s', typedErr.message);
-        throw new Error('AUTH_REFRESH_FAILED');
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.debug("Failed to refresh token: %s", typedErr.message);
+        throw new Error("AUTH_REFRESH_FAILED");
     }
 };
 export const ensureAuth = async (props) => {
@@ -100,23 +101,34 @@ export const ensureAuth = async (props) => {
     if (props._.length === 0 || props.help) {
         return;
     }
+    // `(config) status --current-branch` is a purely-local read of `.neon`; it must
+    // never refresh a token or pop a browser login. Skip auth entirely (the handler
+    // doesn't use an API client in this mode).
+    if (isCurrentBranchProbe(props)) {
+        return;
+    }
+    // `config init` only scaffolds a neon.ts and installs npm packages locally; it
+    // never calls the Neon API, so skip auth entirely — no token refresh, no login.
+    if (isConfigInit(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if
     // present, otherwise run with no API client (env injection is skipped).
-    const isLocalDev = props._[0] === 'dev';
+    const isLocalDev = props._[0] === "dev";
     // `bootstrap` only copies a public template repo; it never calls the Neon
     // API, so it must work without credentials and must never pop a browser
     // login. It uses an API key / stored credentials when present (harmless),
     // otherwise it proceeds with no API client.
-    const isBootstrap = props._[0] === 'bootstrap';
+    const isBootstrap = props._[0] === "bootstrap";
     // `init` manages its own auth flow (asks the user if they have an account,
     // then triggers OAuth at the right time). Skip the global auth middleware.
-    const isInit = props._[0] === 'init';
+    const isInit = props._[0] === "init";
     // Use existing API key or handle auth command
-    if (props.apiKey || props._[0] === 'auth') {
+    if (props.apiKey || props._[0] === "auth") {
         if (props.apiKey) {
-            log.debug('Using an API key to authorize requests');
+            log.debug("Using an API key to authorize requests");
         }
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
@@ -127,10 +139,10 @@ export const ensureAuth = async (props) => {
     const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
     // Handle case when credentials file exists
     if (existsSync(credentialsPath)) {
-        log.debug('Trying to read credentials from %s', credentialsPath);
+        log.debug("Trying to read credentials from %s", credentialsPath);
         try {
-            const contents = readFileSync(credentialsPath, 'utf8');
-            log.debug('Credentials MD5 hash: %s', md5hash(contents));
+            const contents = readFileSync(credentialsPath, "utf8");
+            log.debug("Credentials MD5 hash: %s", md5hash(contents));
             const tokenSet = JSON.parse(contents);
             // Try to use existing token or refresh it
             const result = await handleExistingToken(tokenSet, props, credentialsPath);
@@ -141,32 +153,33 @@ export const ensureAuth = async (props) => {
             }
         }
         catch (err) {
-            if (!(err instanceof Error && err.message === 'AUTH_REFRESH_FAILED') &&
-                err.code !== 'ENOENT' &&
+            if (!(err instanceof Error &&
+                err.message === "AUTH_REFRESH_FAILED") &&
+                err.code !== "ENOENT" &&
                 !(err instanceof SyntaxError)) {
                 // Throw for any errors except auth refresh failure, missing file, or invalid credentials file
                 throw err;
             }
             // Fall through to new auth flow for auth failures
-            log.debug('Ensure auth failed, starting authentication', err);
+            log.debug("Ensure auth failed, starting authentication", err);
         }
     }
     else {
-        log.debug('Credentials file %s does not exist, starting authentication', credentialsPath);
+        log.debug("Credentials file %s does not exist, starting authentication", credentialsPath);
     }
     // `dev` never launches the interactive browser flow. With no usable
     // credentials it proceeds without an API client; env injection is skipped
     // and the function still runs locally.
     if (isLocalDev) {
-        log.debug('dev: no usable credentials; running without env injection');
+        log.debug("dev: no usable credentials; running without env injection");
         return;
     }
     if (isBootstrap) {
-        log.debug('bootstrap: no usable credentials; continuing without auth');
+        log.debug("bootstrap: no usable credentials; continuing without auth");
         return;
     }
     if (isInit) {
-        log.debug('init: skipping global auth; init manages its own auth flow');
+        log.debug("init: skipping global auth; init manages its own auth flow");
         return;
     }
     // Start new auth flow if no valid token exists or refresh failed
@@ -186,16 +199,16 @@ export const deleteCredentials = (configDir) => {
     try {
         if (existsSync(credentialsPath)) {
             rmSync(credentialsPath);
-            log.info('Deleted credentials from %s', credentialsPath);
+            log.info("Deleted credentials from %s", credentialsPath);
         }
         else {
-            log.debug('Credentials file %s does not exist', credentialsPath);
+            log.debug("Credentials file %s does not exist", credentialsPath);
         }
     }
     catch (err) {
-        const typedErr = err instanceof Error ? err : new Error('Unknown error');
-        log.error('Failed to delete credentials: %s', typedErr.message);
-        throw new Error('CREDENTIALS_DELETE_FAILED');
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.error("Failed to delete credentials: %s", typedErr.message);
+        throw new Error("CREDENTIALS_DELETE_FAILED");
     }
 };
-const md5hash = (s) => createHash('md5').update(s).digest('hex');
+const md5hash = (s) => createHash("md5").update(s).digest("hex");