neonctl 2.28.0 → 2.29.0

package/README.md

@@ -361,7 +361,7 @@ neonctl env pull
 neonctl env pull --branch preview --file .env.preview
 ```
 
-If you'd rather not keep env vars on disk, inject them at runtime instead with `neon-env run -- <your dev command>` (from `@neondatabase/env`) or `neonctl dev`, and pass `--no-env-pull` to `link` / `checkout`.
+If you'd rather not keep env vars on disk, inject them at runtime instead with `neon-env run -- <your dev command>` (from `@neon/env`) or `neonctl dev`, and pass `--no-env-pull` to `link` / `checkout`.
 
 **Where `.neon` lives**: `link` writes `.neon` into the **current working directory** by default. If an existing `.neon` is found in any parent directory, that file is reused — so commands run from a sub-directory of a linked project still pick up the project's context. To pin the location explicitly, pass `--context-file <path>`.
 
@@ -373,7 +373,7 @@ Describe a branch's desired state in a `neon.ts` policy and reconcile it from th
 
 ```ts
 // neon.ts
-import { defineConfig } from '@neondatabase/config/v1';
+import { defineConfig } from '@neon/config/v1';
 
 export default defineConfig({
   // Static: what exists on every branch (drives the typed env).

package/dist/analytics.js

@@ -1,22 +1,22 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { Analytics } from '@segment/analytics-node';
-import { CREDENTIALS_FILE } from './config.js';
-import { isCurrentBranchProbe } from './context.js';
-import { getGithubEnvVars, isCi } from './env.js';
-import { log } from './log.js';
-import pkg from './pkg.js';
-import { getApiClient, isNeonApiError } from './api.js';
-const WRITE_KEY = '3SQXn5ejjXWLEJ8xU2PRYhAotLtTaeeV';
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { Analytics } from "@segment/analytics-node";
+import { getApiClient, isNeonApiError } from "./api.js";
+import { CREDENTIALS_FILE } from "./config.js";
+import { isCurrentBranchProbe } from "./context.js";
+import { getGithubEnvVars, isCi } from "./env.js";
+import { log } from "./log.js";
+import pkg from "./pkg.js";
+const WRITE_KEY = "3SQXn5ejjXWLEJ8xU2PRYhAotLtTaeeV";
 /**
  * Raw-argv fallback for the offline `--current-branch` probe. The init
  * middleware runs before validation, where the parsed `currentBranch` flag may
  * not be populated yet, so we also scan `process.argv` directly to be safe.
  */
-const hasCurrentBranchArgv = () => process.argv.includes('--current-branch');
+const hasCurrentBranchArgv = () => process.argv.includes("--current-branch");
 let client;
 let clientInitialized = false;
-let userId = '';
+let userId = "";
 /**
  * Phase 1: Run before validation so the Segment client exists if any
  * middleware (e.g. auth) fails. Enables sendError() in the fail handler.
@@ -36,11 +36,11 @@ export const initAnalyticsClientMiddleware = (args) => {
     clientInitialized = true;
     client = new Analytics({
         writeKey: WRITE_KEY,
-        host: 'https://track.neon.tech',
+        host: "https://track.neon.tech",
     });
-    log.debug('Initialized CLI analytics client');
+    log.debug("Initialized CLI analytics client");
     client.identify({
-        userId: 'anonymous',
+        userId: "anonymous",
     });
 };
 /**
@@ -56,11 +56,13 @@ export const analyticsMiddleware = async (args) => {
     }
     try {
         const credentialsPath = join(args.configDir, CREDENTIALS_FILE);
-        const credentials = readFileSync(credentialsPath, { encoding: 'utf-8' });
+        const credentials = readFileSync(credentialsPath, {
+            encoding: "utf-8",
+        });
         userId = JSON.parse(credentials).user_id;
     }
     catch (err) {
-        log.debug('Failed to read credentials file', err);
+        log.debug("Failed to read credentials file", err);
     }
     try {
         if (args.apiKey) {
@@ -75,25 +77,25 @@ export const analyticsMiddleware = async (args) => {
             args.authMethod = authDetails.auth_method;
             args.authData = authDetails.auth_data;
             // Get user id if not org api key
-            if (!userId && authDetails.auth_method !== 'api_key_org') {
+            if (!userId && authDetails.auth_method !== "api_key_org") {
                 const resp = await apiClient?.getCurrentUserInfo?.();
                 userId = resp?.data?.id;
             }
         }
         else {
             args.accountId = userId;
-            args.authMethod = 'oauth';
+            args.authMethod = "oauth";
         }
     }
     catch (err) {
-        log.debug('Failed to get user id from api', err);
+        log.debug("Failed to get user id from api", err);
     }
     client.identify({
-        userId: userId?.toString() ?? 'anonymous',
+        userId: userId?.toString() ?? "anonymous",
     });
     client.track({
-        userId: userId || 'anonymous',
-        event: 'CLI Started',
+        userId: userId || "anonymous",
+        event: "CLI Started",
         properties: getAnalyticsEventProperties(args),
         context: {
             direct: true,
@@ -102,12 +104,12 @@ export const analyticsMiddleware = async (args) => {
 };
 export const closeAnalytics = async (opts) => {
     if (client) {
-        log.debug('Flushing CLI analytics');
+        log.debug("Flushing CLI analytics");
         // `timeout` bounds how long we wait for in-flight events to flush so a
         // slow / unreachable track.neon.tech can't hang a short-lived command
         // (e.g. the psql launch path, which flushes here before process.exit).
         await client.closeAndFlush(opts);
-        log.debug('Flushed CLI analytics');
+        log.debug("Flushed CLI analytics");
     }
 };
 export const sendError = (err, errCode) => {
@@ -115,13 +117,13 @@ export const sendError = (err, errCode) => {
         return;
     }
     const apiError = isNeonApiError(err) ? err : undefined;
-    const requestId = apiError?.headers?.['x-neon-ret-request-id'];
+    const requestId = apiError?.headers?.["x-neon-ret-request-id"];
     if (requestId) {
-        log.debug('Failed request ID: %s', requestId);
+        log.debug("Failed request ID: %s", requestId);
     }
     client.track({
-        event: 'CLI Error',
-        userId: userId || 'anonymous',
+        event: "CLI Error",
+        userId: userId || "anonymous",
         properties: {
             message: err.message,
             stack: err.stack,
@@ -130,7 +132,7 @@ export const sendError = (err, errCode) => {
             requestId: requestId,
         },
     });
-    log.debug('Sent CLI error event: %s', errCode);
+    log.debug("Sent CLI error event: %s", errCode);
 };
 export const trackEvent = (event, properties) => {
     if (!client) {
@@ -138,14 +140,14 @@ export const trackEvent = (event, properties) => {
     }
     client.track({
         event,
-        userId: userId || 'anonymous',
+        userId: userId || "anonymous",
         properties,
     });
-    log.debug('Sent CLI event: %s', event);
+    log.debug("Sent CLI event: %s", event);
 };
 export const getAnalyticsEventProperties = (args) => ({
     version: pkg.version,
-    command: args._.join(' '),
+    command: args._.join(" "),
     flags: {
         output: args.output,
     },

package/dist/api.js

@@ -11,29 +11,29 @@
 // {@link isNeonApiError} and reads `error.status` / `error.data`. There is no
 // axios anywhere in neonctl: requests go through the global `fetch`, and this is
 // the one place HTTP errors are shaped.
-import { Readable } from 'node:stream';
-import { EnvHttpProxyAgent, setGlobalDispatcher } from 'undici';
-import { createClient, createConfig } from '@neon/sdk/raw';
-import * as raw from '@neon/sdk/raw';
-import { log } from './log.js';
-import pkg from './pkg.js';
+import { Readable } from "node:stream";
+import * as raw from "@neon/sdk/raw";
+import { createClient, createConfig } from "@neon/sdk/raw";
+import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
+import { log } from "./log.js";
+import pkg from "./pkg.js";
 // Node's global `fetch` (undici) ignores HTTP_PROXY / HTTPS_PROXY / NO_PROXY,
 // whereas the axios-based client neonctl used previously honored them. Restore
 // that behaviour by installing a proxy-aware global dispatcher — but only when a
 // proxy is actually configured, so the default (no-proxy) path stays untouched.
 // This covers every `fetch` neonctl makes, including the direct S3 upload.
 const PROXY_ENV_VARS = [
-    'HTTP_PROXY',
-    'http_proxy',
-    'HTTPS_PROXY',
-    'https_proxy',
-    'ALL_PROXY',
-    'all_proxy',
+    "HTTP_PROXY",
+    "http_proxy",
+    "HTTPS_PROXY",
+    "https_proxy",
+    "ALL_PROXY",
+    "all_proxy",
 ];
 if (PROXY_ENV_VARS.some((name) => process.env[name])) {
     setGlobalDispatcher(new EnvHttpProxyAgent());
 }
-const DEFAULT_API_HOST = 'https://console.neon.tech/api/v2';
+const DEFAULT_API_HOST = "https://console.neon.tech/api/v2";
 const REQUEST_TIMEOUT_MS = 60000;
 const USER_AGENT = `neonctl v${pkg.version}`;
 /** Mirrors the api-client `ContentType` enum used by the `request()` escape hatch. */
@@ -53,7 +53,7 @@ export var ContentType;
 export class NeonApiError extends Error {
     constructor(message, init = {}) {
         super(message);
-        this.name = 'NeonApiError';
+        this.name = "NeonApiError";
         this.status = init.status;
         this.statusText = init.statusText;
         this.data = init.data;
@@ -68,18 +68,18 @@ export function isNeonApiError(err) {
 }
 /** Extract a `message` string from a parsed error body, if present. */
 export function messageFromBody(body) {
-    if (body && typeof body === 'object' && 'message' in body) {
+    if (body && typeof body === "object" && "message" in body) {
         const message = body.message;
-        if (typeof message === 'string')
+        if (typeof message === "string")
             return message;
     }
     return undefined;
 }
 /** Extract a machine-readable `code` string from a parsed error body, if present. */
 export function codeFromBody(body) {
-    if (body && typeof body === 'object' && 'code' in body) {
+    if (body && typeof body === "object" && "code" in body) {
         const code = body.code;
-        if (typeof code === 'string')
+        if (typeof code === "string")
             return code;
     }
     return undefined;
@@ -113,7 +113,7 @@ function headersToObject(headers) {
 }
 function isAbortError(err) {
     return (err instanceof Error &&
-        (err.name === 'AbortError' || err.name === 'TimeoutError'));
+        (err.name === "AbortError" || err.name === "TimeoutError"));
 }
 /**
  * Walk an error's `cause` chain to find the underlying socket/DNS `code` (e.g.
@@ -124,9 +124,9 @@ function isAbortError(err) {
 function readSocketCode(err) {
     let current = err;
     for (let depth = 0; depth < 6 && current != null; depth++) {
-        if (typeof current === 'object' && 'code' in current) {
+        if (typeof current === "object" && "code" in current) {
             const code = current.code;
-            if (typeof code === 'string')
+            if (typeof code === "string")
                 return code;
         }
         current = current.cause;
@@ -160,10 +160,10 @@ function httpError(response, body) {
  */
 function networkError(err) {
     if (isAbortError(err)) {
-        return new NeonApiError('Request timed out', { code: 'ECONNABORTED' });
+        return new NeonApiError("Request timed out", { code: "ECONNABORTED" });
     }
     return new NeonApiError(err instanceof Error ? err.message : String(err), {
-        code: readSocketCode(err) ?? 'ENETWORK',
+        code: readSocketCode(err) ?? "ENETWORK",
     });
 }
 /**
@@ -176,11 +176,11 @@ const timedFetch = async (input, init) => {
     const signal = init?.signal
         ? AbortSignal.any([init.signal, timeout])
         : timeout;
-    const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+    const method = init?.method ?? (input instanceof Request ? input.method : "GET");
     const url = input instanceof Request ? input.url : String(input);
-    log.debug('%s %s', method.toUpperCase(), url);
+    log.debug("%s %s", method.toUpperCase(), url);
     const response = await fetch(input, { ...init, signal });
-    log.debug('%d %s', response.status, response.statusText);
+    log.debug("%d %s", response.status, response.statusText);
     return response;
 };
 const RETRY_COUNT = 5;
@@ -211,7 +211,7 @@ export const retryOnLock = async (fn) => {
     throw errOut;
 };
 function buildUrl(apiHost, path, query) {
-    const url = new URL(`${apiHost.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`);
+    const url = new URL(`${apiHost.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`);
     if (query) {
         for (const [key, value] of Object.entries(query)) {
             if (value === undefined || value === null)
@@ -223,7 +223,7 @@ function buildUrl(apiHost, path, query) {
 }
 async function readJsonBody(response) {
     const text = await response.text();
-    if (text.trim() === '')
+    if (text.trim() === "")
         return undefined;
     try {
         return JSON.parse(text);
@@ -241,7 +241,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
         auth: () => apiKey,
         baseUrl,
         fetch: timedFetch,
-        headers: { 'User-Agent': USER_AGENT },
+        headers: { "User-Agent": USER_AGENT },
     }));
     /** Await a raw call, unwrap to a `{ data, status, headers }` envelope, or throw {@link NeonApiError}. */
     async function call(run) {
@@ -254,7 +254,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
         }
         const response = result.response;
         if (!response) {
-            throw networkError(result.error ?? new Error('No response from Neon API'));
+            throw networkError(result.error ?? new Error("No response from Neon API"));
         }
         if (!response.ok) {
             throw httpError(response, result.error ?? result.data);
@@ -274,7 +274,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
      */
     async function request(params) {
         const url = buildUrl(baseUrl, params.path, params.query);
-        const headers = { 'User-Agent': USER_AGENT };
+        const headers = { "User-Agent": USER_AGENT };
         if (params.secure !== false) {
             headers.Authorization = `Bearer ${apiKey}`;
         }
@@ -284,7 +284,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
             payload = params.body;
         }
         else if (params.body !== undefined) {
-            headers['Content-Type'] = ContentType.Json;
+            headers["Content-Type"] = ContentType.Json;
             payload = JSON.stringify(params.body);
         }
         let response;
@@ -301,13 +301,13 @@ export const getApiClient = ({ apiKey, apiHost }) => {
         if (!response.ok) {
             // For a streamed download the error body arrives as a stream too; hand it
             // back as a Node `Readable` so the caller can drain it for a message.
-            const errorBody = params.format === 'stream' && response.body
+            const errorBody = params.format === "stream" && response.body
                 ? webStreamToNodeReadable(response.body)
                 : await readJsonBody(response);
             throw httpError(response, errorBody);
         }
         let data;
-        if (params.format === 'stream') {
+        if (params.format === "stream") {
             data = response.body
                 ? webStreamToNodeReadable(response.body)
                 : undefined;

package/dist/auth.js

@@ -1,58 +1,62 @@
-import * as client from 'openid-client';
-import { createServer } from 'node:http';
-import { createReadStream } from 'node:fs';
-import { join } from 'node:path';
-import open from 'open';
-import { log } from './log.js';
-import { fileURLToPath } from 'node:url';
-import { sendError } from './analytics.js';
-import { matchErrorCode } from './errors.js';
-import { extendTokenSet } from './utils/auth.js';
+import { createReadStream } from "node:fs";
+import { createServer, } from "node:http";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import open from "open";
+import * as client from "openid-client";
+import { sendError } from "./analytics.js";
+import { matchErrorCode } from "./errors.js";
+import { log } from "./log.js";
+import { extendTokenSet } from "./utils/auth.js";
 // oauth server timeouts
 const SERVER_TIMEOUT = 10000;
 // where to wait for incoming redirect request from oauth server to arrive
 const REDIRECT_URI = (port) => `http://127.0.0.1:${port}/callback`;
 // These scopes cannot be cancelled, they are always needed.
-const ALWAYS_PRESENT_SCOPES = ['openid', 'offline', 'offline_access'];
+const ALWAYS_PRESENT_SCOPES = ["openid", "offline", "offline_access"];
 const NEONCTL_SCOPES = [
     ...ALWAYS_PRESENT_SCOPES,
-    'urn:neoncloud:projects:create',
-    'urn:neoncloud:projects:read',
-    'urn:neoncloud:projects:update',
-    'urn:neoncloud:projects:delete',
-    'urn:neoncloud:orgs:create',
-    'urn:neoncloud:orgs:read',
-    'urn:neoncloud:orgs:update',
-    'urn:neoncloud:orgs:delete',
-    'urn:neoncloud:orgs:permission',
+    "urn:neoncloud:projects:create",
+    "urn:neoncloud:projects:read",
+    "urn:neoncloud:projects:update",
+    "urn:neoncloud:projects:delete",
+    "urn:neoncloud:orgs:create",
+    "urn:neoncloud:orgs:read",
+    "urn:neoncloud:orgs:update",
+    "urn:neoncloud:orgs:delete",
+    "urn:neoncloud:orgs:permission",
 ];
 const AUTH_TIMEOUT_SECONDS = 60;
-export const defaultClientID = 'neonctl';
+export const defaultClientID = "neonctl";
 export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-    log.debug('Discovering oauth server');
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: 'none' }, client.None(), {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
         timeout: SERVER_TIMEOUT,
-        // eslint-disable-next-line @typescript-eslint/no-deprecated
-        execute: allowUnsafeTls ? [client.allowInsecureRequests] : undefined,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
     });
     return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
 };
 export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
-    log.debug('Discovering oauth server');
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: 'none' }, client.None(), {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
         timeout: SERVER_TIMEOUT,
-        // eslint-disable-next-line @typescript-eslint/no-deprecated
-        execute: allowUnsafeTls ? [client.allowInsecureRequests] : undefined,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
     });
     //
     // Start HTTP server and wait till /callback is hit
     //
-    log.debug('Starting HTTP Server for callback');
+    log.debug("Starting HTTP Server for callback");
     const server = createServer();
-    server.listen(0, '127.0.0.1', function () {
+    server.listen(0, "127.0.0.1", function () {
         log.debug(`Listening on port ${this.address().port}`);
     });
-    await new Promise((resolve) => server.once('listening', resolve));
+    await new Promise((resolve) => server.once("listening", resolve));
     const listen_port = server.address().port;
     // https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.8
     const state = client.randomState();
@@ -67,17 +71,17 @@ export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
             //
             // Wait for callback and follow oauth flow.
             //
-            if (!request.url?.startsWith('/callback')) {
+            if (!request.url?.startsWith("/callback")) {
                 response.writeHead(404);
                 response.end();
                 return;
             }
             // process the CORS preflight OPTIONS request
-            if (request.method === 'OPTIONS') {
+            if (request.method === "OPTIONS") {
                 response.writeHead(200, {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': 'GET, POST',
-                    'Access-Control-Allow-Headers': 'Content-Type',
+                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Methods": "GET, POST",
+                    "Access-Control-Allow-Headers": "Content-Type",
                 });
                 response.end();
                 return;
@@ -87,29 +91,31 @@ export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
                 pkceCodeVerifier: codeVerifier,
                 expectedState: state,
             });
-            response.writeHead(200, { 'Content-Type': 'text/html' });
-            createReadStream(join(fileURLToPath(new URL('.', import.meta.url)), './callback.html')).pipe(response);
+            response.writeHead(200, { "Content-Type": "text/html" });
+            createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
             clearTimeout(timer);
             const exp = new Date();
             exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
             resolve(extendTokenSet(tokenSet));
             server.close();
         };
-        server.on('request', (req, res) => {
+        server.on("request", (req, res) => {
             void onRequest(req, res);
         });
         //
         // Open browser to let user authenticate
         //
-        const scopes = clientId == defaultClientID ? NEONCTL_SCOPES : ALWAYS_PRESENT_SCOPES;
+        const scopes = clientId == defaultClientID
+            ? NEONCTL_SCOPES
+            : ALWAYS_PRESENT_SCOPES;
         const authUrl = client.buildAuthorizationUrl(configuration, {
-            scope: scopes.join(' '),
+            scope: scopes.join(" "),
             state,
             code_challenge: codeChallenge,
-            code_challenge_method: 'S256',
+            code_challenge_method: "S256",
             redirect_uri: REDIRECT_URI(listen_port),
         });
-        log.info('Awaiting authentication in web browser.');
+        log.info("Awaiting authentication in web browser.");
         log.info(`Auth Url: ${authUrl}`);
         open(authUrl.href).catch((err) => {
             const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { tryCurrentBranchFastPath } from './current_branch_fast_path.js';
+import { tryCurrentBranchFastPath } from "./current_branch_fast_path.js";
 // Fast path for the offline `(config) status --current-branch` probe (used by shell
 // prompts): read the pinned branch from `.neon` without loading the full command tree,
 // api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
 // the heavy `index.js` is imported lazily and only when actually needed.
 if (!tryCurrentBranchFastPath(process.argv)) {
-    void import('./index.js');
+    void import("./index.js");
 }