neonctl 2.37.0 → 2.38.0

package/dist/commands/vpc_endpoints.js

@@ -1,134 +0,0 @@
-import { log } from "../log.js";
-import { fillSingleOrg, fillSingleProject } from "../utils/enrichers.js";
-import { writer } from "../writer.js";
-import { REGIONS } from "./projects.js";
-const VPC_ENDPOINT_FIELDS = ["vpc_endpoint_id", "label"];
-const VPC_ENDPOINT_DETAILS_FIELDS = [
-    "vpc_endpoint_id",
-    "label",
-    "state",
-    "num_restricted_projects",
-    "example_restricted_projects",
-];
-export const command = "vpc";
-export const describe = "Manage VPC endpoints and project VPC restrictions";
-export const builder = (argv) => {
-    return argv
-        .usage("$0 vpc <sub-command> [options]")
-        .command("endpoint", "Manage VPC endpoints.\n" +
-        "See: https://neon.tech/docs/guides/neon-private-networking\n" +
-        "After adding an endpoint to an organization, client connections will be accepted\n" +
-        "from the corresponding VPC for all projects in the organization, unless overridden\n" +
-        "by a project-level VPC endpoint restriction.", (yargs) => {
-        return yargs
-            .options({
-            "org-id": {
-                describe: "Organization ID",
-                type: "string",
-            },
-            "region-id": {
-                describe: `The region ID. Possible values: ${REGIONS.join(", ")}`,
-                type: "string",
-                demandOption: true,
-            },
-        })
-            .middleware(fillSingleOrg)
-            .command("list", "List configured VPC endpoints for this organization.", (yargs) => yargs, async (args) => {
-            await listOrg(args);
-        })
-            .command({
-            command: "assign <id>",
-            aliases: ["update <id>", "add <id>"],
-            describe: "Add or update a VPC endpoint for this organization.\n" +
-                "Note: Azure regions are not yet supported.",
-            builder: (yargs) => yargs.options({
-                label: {
-                    describe: "An optional descriptive label for the VPC endpoint",
-                    type: "string",
-                },
-            }),
-            handler: async (args) => {
-                await assignOrg(args);
-            },
-        })
-            .command("remove <id>", "Remove a VPC endpoint from this organization.", (yargs) => yargs, async (args) => {
-            await removeOrg(args);
-        })
-            .command("status <id>", "Get the status of a VPC endpoint for this organization.", (yargs) => yargs, async (args) => {
-            await statusOrg(args);
-        });
-    })
-        .command("project", "Manage project-level VPC endpoint restrictions.\n" +
-        "By default, connections are accepted from any VPC configured at the organization level.\n" +
-        "A project-level VPC endpoint restriction can be used to restrict connections to a specific VPC.", (yargs) => {
-        return yargs
-            .options({
-            "project-id": {
-                describe: "Project ID",
-                type: "string",
-            },
-        })
-            .middleware(fillSingleProject)
-            .command("list", "List VPC endpoint restrictions for this project.", (yargs) => yargs, async (args) => {
-            await listProject(args);
-        })
-            .command({
-            command: "restrict <id>",
-            aliases: ["update <id>"],
-            describe: "Configure or update a VPC endpoint restriction for this project.",
-            builder: (yargs) => yargs.options({
-                label: {
-                    describe: "An optional descriptive label for the VPC endpoint restriction",
-                    type: "string",
-                },
-            }),
-            handler: async (args) => {
-                await assignProject(args);
-            },
-        })
-            .command("remove <id>", "Remove a VPC endpoint restriction from this project.", (yargs) => yargs, async (args) => {
-            await removeProject(args);
-        });
-    });
-};
-const listOrg = async (props) => {
-    const { data } = await props.apiClient.listOrganizationVpcEndpoints(props.orgId, props.regionId);
-    writer(props).end(data.endpoints, {
-        fields: VPC_ENDPOINT_FIELDS,
-    });
-};
-const assignOrg = async (props) => {
-    const vpcEndpointAssignment = {
-        label: props.label || "",
-    };
-    const { data } = await props.apiClient.assignOrganizationVpcEndpoint(props.orgId, props.regionId, props.id, vpcEndpointAssignment);
-    writer(props).end(data, { fields: [] });
-    if (props.regionId.startsWith("azure")) {
-        log.info("VPC endpoint configuration is not supported for Azure regions");
-    }
-};
-const removeOrg = async (props) => {
-    const { data } = await props.apiClient.deleteOrganizationVpcEndpoint(props.orgId, props.regionId, props.id);
-    writer(props).end(data, { fields: [] });
-};
-const statusOrg = async (props) => {
-    const { data } = await props.apiClient.getOrganizationVpcEndpointDetails(props.orgId, props.regionId, props.id);
-    writer(props).end(data, { fields: VPC_ENDPOINT_DETAILS_FIELDS });
-};
-const listProject = async (props) => {
-    const { data } = await props.apiClient.listProjectVpcEndpoints(props.projectId);
-    writer(props).end(data.endpoints, {
-        fields: VPC_ENDPOINT_FIELDS,
-    });
-};
-const assignProject = async (props) => {
-    const vpcEndpointAssignment = {
-        label: props.label || "",
-    };
-    const { data } = await props.apiClient.assignProjectVpcEndpoint(props.projectId, props.id, vpcEndpointAssignment);
-    writer(props).end(data, { fields: [] });
-};
-const removeProject = async (props) => {
-    const { data } = await props.apiClient.deleteProjectVpcEndpoint(props.projectId, props.id);
-    writer(props).end(data, { fields: [] });
-};

package/dist/config.js

@@ -1,11 +0,0 @@
-import { existsSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { isCi } from "./env.js";
-export const CREDENTIALS_FILE = "credentials.json";
-export const defaultDir = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "neonctl");
-export const ensureConfigDir = ({ "config-dir": configDir, "force-auth": forceAuth, }) => {
-    if (!existsSync(configDir) && (!isCi() || forceAuth)) {
-        mkdirSync(configDir, { recursive: true });
-    }
-};

package/dist/config_format.js

@@ -1,72 +0,0 @@
-/**
- * Render a TTL in whole seconds back to the canonical `neon.ts` duration string (e.g.
- * `604800` -> `"7d"`), falling back to seconds when no clean unit boundary matches. Mirrors
- * the formatter `@neon/config` uses when it emits a TTL, so `config status` shows
- * the same value a user would write in `neon.ts`.
- */
-export const formatDurationSeconds = (totalSeconds) => {
-    const units = [
-        ["w", 7 * 24 * 60 * 60],
-        ["d", 24 * 60 * 60],
-        ["h", 60 * 60],
-        ["m", 60],
-    ];
-    for (const [unit, perUnit] of units) {
-        if (totalSeconds % perUnit === 0)
-            return `${totalSeconds / perUnit}${unit}`;
-    }
-    return `${totalSeconds}s`;
-};
-/**
- * Project a resolved branch config (plus the separately-pulled preview state, since
- * functions/buckets don't live on the closure) into a {@link NeonConfigView}.
- *
- * - Service toggles are surfaced as `true` only when enabled (disabled is the absence of
- *   the key, exactly as in `neon.ts`).
- * - `ttlSeconds` is rendered back to a duration string (`7d`).
- * - The `branch` section is the JSON-able part of what would otherwise be the `branch`
- *   closure: `parent` / `ttl` / `protected` / `postgres.computeSettings`.
- * - `branch` and `preview` are omitted entirely when they would be empty.
- */
-export const toNeonConfigView = (resolved, preview) => {
-    const view = {};
-    if (resolved.authEnabled)
-        view.auth = true;
-    if (resolved.dataApiEnabled)
-        view.dataApi = true;
-    const previewView = toPreviewView(preview);
-    if (previewView)
-        view.preview = previewView;
-    const branch = {};
-    if (resolved.parent !== undefined)
-        branch.parent = resolved.parent;
-    if (resolved.ttlSeconds !== undefined)
-        branch.ttl = formatDurationSeconds(resolved.ttlSeconds);
-    if (resolved.protected !== undefined)
-        branch.protected = resolved.protected;
-    if (resolved.postgres?.computeSettings)
-        branch.postgres = resolved.postgres;
-    if (Object.keys(branch).length > 0)
-        view.branch = branch;
-    return view;
-};
-const toPreviewView = (preview) => {
-    if (!preview)
-        return undefined;
-    const out = {};
-    if (preview.functions.length > 0) {
-        out.functions = Object.fromEntries(preview.functions.map((fn) => [fn.slug, { name: fn.name }]));
-    }
-    if (preview.buckets.length > 0) {
-        out.buckets = Object.fromEntries(preview.buckets.map((b) => [b.name, { access: b.access }]));
-    }
-    if (preview.credentials.length > 0) {
-        out.credentials = preview.credentials.map((c) => ({
-            id: c.tokenIdShort,
-            ...(c.name ? { name: c.name } : {}),
-            scopes: c.scopes,
-            ...(c.lastUsedAt ? { lastUsedAt: c.lastUsedAt } : {}),
-        }));
-    }
-    return Object.keys(out).length > 0 ? out : undefined;
-};

package/dist/context.js

@@ -1,231 +0,0 @@
-import { accessSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, normalize, resolve } from "node:path";
-import { log } from "./log.js";
-/**
- * The branch pinned in a context, reading the current `branch` field and
- * falling back to the legacy `branchId` so pre-migration `.neon` files keep
- * working.
- */
-export const contextBranch = (context) => context.branch ?? context.branchId;
-/**
- * True when the invocation is the offline "current branch" probe:
- * `(config) status --current-branch`. This mode only reads the pinned branch
- * from the local `.neon` file (for shell prompts like starship), so it MUST
- * NOT touch the network — several middlewares (auth, analytics, single-project
- * resolution) consult this to early-return and skip their API calls / login.
- *
- * Gated on the exact command as well as the flag so an accidental
- * `--current-branch` on an unrelated command (e.g. `config plan`, where the flag
- * is undefined but non-strict yargs still parses it) can't silently skip
- * auth/analytics. The probe is only `status` (the top-level alias) or
- * `config status` (`_ = ['config', 'status']`).
- */
-export const isCurrentBranchProbe = (args) => args.currentBranch === true &&
-    (args._[0] === "status" ||
-        (args._[0] === "config" && args._[1] === "status"));
-/**
- * `config init` only scaffolds a local `neon.ts` and installs npm packages — it
- * never calls the Neon API. Gated on the exact command path so the global auth
- * middleware and the single-project resolver can skip it (it runs with no API
- * client), mirroring {@link isCurrentBranchProbe}.
- */
-export const isConfigInit = (args) => args._[0] === "config" && args._[1] === "init";
-const CONTEXT_FILE = ".neon";
-const GITIGNORE_FILE = ".gitignore";
-const canAccessFile = (file) => {
-    try {
-        accessSync(file);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-/**
- * Walk upward to find an existing `.neon` file.
- *
- * The walk keeps the established home and POSIX-root boundaries, then also
- * stops when resolving a parent makes no progress. That second guard handles
- * Windows drive and UNC-share roots, whose paths do not equal `normalize("/")`.
- */
-export const walkContextFile = (cwd, root, home, resolvePath, canAccess) => {
-    let currentDir = cwd;
-    while (currentDir !== root && currentDir !== home) {
-        const contextFile = resolvePath(currentDir, CONTEXT_FILE);
-        if (canAccess(contextFile)) {
-            return contextFile;
-        }
-        const parentDir = resolvePath(currentDir, "..");
-        if (parentDir === currentDir) {
-            break;
-        }
-        currentDir = parentDir;
-    }
-    return resolvePath(cwd, CONTEXT_FILE);
-};
-/**
- * Resolve the default `.neon` path for the current working directory.
- *
- * Walks UP from `cwd` looking ONLY for an already-existing `.neon` file so
- * commands run from a sub-directory of a linked project still pick up the
- * project's context. If no `.neon` is found, the path defaults to
- * `<cwd>/.neon`, which makes `neonctl link` and `neonctl set-context`
- * predictable: they always write the context file into the directory they
- * were invoked from.
- *
- * Historically the walk also considered `package.json` and `.git` as project
- * markers, but that led to surprising behaviour when running `link` from a
- * fresh sub-directory inside an unrelated repo (the new link would land in
- * the parent repo's root instead of the cwd).
- *
- * `cwd` is overridable so tests can exercise the walk-up without mutating
- * `process.cwd()` (which would race with other tests running in parallel).
- */
-export const currentContextFile = (cwd = process.cwd()) => walkContextFile(cwd, normalize("/"), homedir(), resolve, canAccessFile);
-export const readContextFile = (file) => {
-    try {
-        return JSON.parse(readFileSync(file, "utf-8"));
-    }
-    catch {
-        return {};
-    }
-};
-export const enrichFromContext = (args) => {
-    // `link` and the deprecated `set-context` manage the context file themselves
-    // and must see the raw flags rather than values pre-filled from an existing
-    // `.neon`, so skip enrichment for both.
-    if (args._[0] === "link" || args._[0] === "set-context") {
-        return;
-    }
-    const context = readContextFile(args.contextFile);
-    if (!args.orgId) {
-        args.orgId = context.orgId;
-    }
-    if (!args.projectId) {
-        args.projectId = context.projectId;
-    }
-    if (!args.branch &&
-        !args.id &&
-        !args.name &&
-        context.projectId === args.projectId) {
-        args.branch = contextBranch(context);
-    }
-};
-export const updateContextFile = (file, context) => {
-    writeFileSync(file, JSON.stringify(context, null, 2));
-};
-/**
- * Shared primitive used by `link`, the deprecated `set-context`, and `checkout`
- * to persist context. Mirrors the destructive write semantics of
- * `updateContextFile` — any field not present in `context` is dropped from the
- * file.
- *
- * `.gitignore` scaffolding only happens when the context file is being
- * *created* (it didn't exist before this write). On updates to an existing
- * `.neon` we never touch `.gitignore`, so a user who deliberately un-ignored
- * the file (e.g. to commit shared context) won't have the entry re-added on
- * every subsequent command.
- */
-export const applyContext = (file, context) => {
-    const isNewFile = !existsSync(file);
-    updateContextFile(file, context);
-    if (isNewFile) {
-        ensureGitignored(file);
-    }
-};
-/**
- * Low-level writer for callers that already hold the resolved identifiers and
- * just need to record them — e.g. `init` or `projects create`, which create a
- * project and want to link it without the resolution, verification, prompting,
- * or env-pull that `link` performs.
- *
- * Unlike the loose {@link applyContext}, this enforces at the type level that
- * `orgId` and `projectId` are present, so the `.neon` file never ends up with a
- * dangling project that has no org. The branch stays optional. It writes through
- * {@link applyContext}, so the same `.gitignore` scaffolding applies.
- */
-export const setContext = (file, context) => {
-    applyContext(file, {
-        orgId: context.orgId,
-        projectId: context.projectId,
-        branch: context.branch,
-    });
-};
-/**
- * Make sure the `.gitignore` next to `file` covers the file's basename — used for the `.neon`
- * context file and for a `.env` we create (both carry credentials that must not be committed).
- * Creates the `.gitignore` if it doesn't exist, otherwise appends the entry only when nothing
- * there already covers it: an exact line, or a basename glob such as `.env*` / `*.local`
- * (see {@link gitignoreCovers}), so a repo that already ignores env files doesn't collect a
- * redundant line per pull.
- *
- * Best-effort: a failure here (e.g. read-only filesystem) is logged at debug
- * level and swallowed; persisting the context file is the primary goal and
- * must not be blocked by a `.gitignore` write error.
- */
-export const ensureGitignored = (file) => {
-    try {
-        const dir = dirname(file);
-        const entry = basenameOf(file);
-        const gitignorePath = resolve(dir, GITIGNORE_FILE);
-        if (!existsSync(gitignorePath)) {
-            writeFileSync(gitignorePath, `${entry}\n`);
-            return;
-        }
-        const current = readFileSync(gitignorePath, "utf-8");
-        if (hasGitignoreEntry(current, entry)) {
-            return;
-        }
-        const needsLeadingNewline = current.length > 0 && !current.endsWith("\n");
-        const addition = `${needsLeadingNewline ? "\n" : ""}${entry}\n`;
-        writeFileSync(gitignorePath, current + addition);
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        log.debug("Failed to update .gitignore next to %s: %s", file, message);
-    }
-};
-const basenameOf = (file) => {
-    const parts = file.split(/[\\/]/);
-    return parts[parts.length - 1] || CONTEXT_FILE;
-};
-const hasGitignoreEntry = (content, entry) => {
-    return content
-        .split(/\r?\n/)
-        .some((line) => gitignoreCovers(line.trim(), entry));
-};
-/**
- * Whether a single `.gitignore` line already ignores `entry` (a bare basename like `.neon` or
- * `.env.local`).
- *
- * Deliberately narrow: an exact match, or a glob **without a path separator** — the
- * `.env*` / `*.local` / `.env.?` shapes that repos actually use for env files — matched
- * against the whole basename. Everything else returns false, which at worst appends an entry
- * git already covers (harmless) rather than skipping one it doesn't (a committed credential).
- * That's why path-scoped patterns (`config/.env`), negations (`!.env.local`), character
- * classes, and comments are all treated as "does not cover".
- */
-const gitignoreCovers = (line, entry) => {
-    if (line === "" || line.startsWith("#") || line.startsWith("!")) {
-        return false;
-    }
-    // A trailing slash marks a directory-only pattern; the leading one anchors to the
-    // .gitignore's own directory, which is exactly where `entry` lives.
-    const pattern = line.replace(/\/$/, "").replace(/^\//, "");
-    if (pattern === entry)
-        return true;
-    if (pattern.includes("/") || pattern.includes("["))
-        return false;
-    if (!pattern.includes("*") && !pattern.includes("?"))
-        return false;
-    return globToRegExp(pattern).test(entry);
-};
-/** Compile a separator-free `.gitignore` glob (`*` / `?` only) into an anchored RegExp. */
-const globToRegExp = (pattern) => {
-    const source = pattern
-        .replace(/[.+^${}()|\\]/g, "\\$&")
-        .replace(/\*/g, "[^/]*")
-        .replace(/\?/g, "[^/]");
-    return new RegExp(`^${source}$`);
-};

package/dist/current_branch_fast_path.js

@@ -1,55 +0,0 @@
-import { contextBranch, currentContextFile, readContextFile, } from "./context.js";
-import { log } from "./log.js";
-/**
- * Offline fast path for `(config) status --current-branch` (used by shell prompts).
- *
- * Reading the pinned branch out of the local `.neon` file does not need the CLI's
- * full command tree, `@neondatabase/api-client`, or yargs — importing those is ~200ms,
- * which dwarfs the actual work. So the entry point ({@link file://./cli.ts}) calls this
- * BEFORE importing `index.js`, and only falls through to the full CLI when this returns
- * `false`. On the fast path the process loads only this module + `context.js`/`log.js`
- * (~25ms total incl. Node startup) instead of ~230ms.
- *
- * It mirrors the `--current-branch` short-circuit in `status()` (commands/config.ts):
- * print the pinned branch to stdout and exit 0, or print nothing + a `neonctl checkout`
- * hint on stderr and exit non-zero when no branch is pinned.
- *
- * Deliberately conservative: only the EXACT bare invocation is handled —
- * `status --current-branch` or `config status --current-branch` with no other args.
- * Anything else (extra flags like `--context-file`/`--output`, more args, etc.) returns
- * `false` and flows through the normal yargs pipeline, so behavior can never diverge —
- * the worst case is "not faster", never "wrong".
- *
- * @returns `true` if it handled the invocation (caller should NOT load the full CLI).
- */
-export const tryCurrentBranchFastPath = (argv, 
-// `cwd` is overridable so tests can exercise the `.neon` walk-up without mutating
-// `process.cwd()` (which isn't allowed in vitest workers), mirroring currentContextFile.
-cwd = process.cwd()) => {
-    // argv is [execPath, scriptPath, ...userArgs].
-    if (!isExactCurrentBranchInvocation(argv.slice(2))) {
-        return false;
-    }
-    const branch = contextBranch(readContextFile(currentContextFile(cwd)));
-    if (branch) {
-        process.stdout.write(`${branch}\n`);
-    }
-    else {
-        log.info("No branch pinned. Run `neonctl checkout <branch>` to pin a branch and pull its env vars.");
-        process.exitCode = 1;
-    }
-    return true;
-};
-/**
- * True only for `status --current-branch` or `config status --current-branch` with no
- * other arguments. Any extra token (another flag, `--context-file`, `=`-style flags,
- * positional args) makes this false so the full CLI handles it.
- */
-const isExactCurrentBranchInvocation = (args) => {
-    const rest = args[0] === "status"
-        ? args.slice(1)
-        : args[0] === "config" && args[1] === "status"
-            ? args.slice(2)
-            : null;
-    return rest !== null && rest.length === 1 && rest[0] === "--current-branch";
-};