@neondatabase/env 1.0.0 → 1.1.0

package/dist/_shared/env-core/reuse-secrets.d.ts

@@ -1,95 +0,0 @@
-import { Config } from "../../config/dist/lib/types.js";
-import "../../config/dist/v1.js";
-import { FetchEnvOptions } from "./env.js";
-
-//#region src/_shared/env-core/reuse-secrets.d.ts
-/**
- * What happened to the branch credential during a {@link fetchEnvReusingSecrets} call.
- */
-interface CredentialOutcome {
-  /**
-   * `true` when a new credential was minted — because none was persisted, or because the
-   * persisted secrets could not be verified against this branch. `false` when the persisted
-   * secrets were verified and kept, and when the policy enables nothing credential-backed.
-   */
-  issued: boolean;
-  /**
-   * The env-var keys the branch credential's secrets surface under, given what the policy
-   * enables. Empty when the policy enables neither object storage nor the AI Gateway.
-   */
-  keys: string[];
-  /**
-   * `tokenId`s revoked because this call superseded them. Only ever credentials the persisted
-   * secrets named *and* that this tool issued; empty otherwise.
-   */
-  revoked: string[];
-  /**
-   * `tokenId`s this call superseded but left live, because `revokeSuperseded` was `false`.
-   * The counterpart to {@link CredentialOutcome.revoked}: exactly the ids that would be
-   * there instead. Lets a caller name what it orphaned rather than saying that it might
-   * have orphaned something — always empty on the default path.
-   */
-  superseded: string[];
-}
-/** A resolved branch env, ready to write to a dotenv file or inject into a process. */
-interface ReusedBranchEnv {
-  /** Every Neon env var for the branch, as `{ KEY: value }`. */
-  vars: Record<string, string>;
-  /** What happened to the branch credential. */
-  credential: CredentialOutcome;
-}
-/**
- * Resolve a branch's env while keeping one-time secrets the caller already holds.
- *
- * {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
- * credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
- * them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
- * pull` would leave a live credential behind each time. This is the wrapper that avoids that:
- * it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
- * for only the rest.
- *
- * The check is a real verification, not a presence test. A persisted secret is kept only when
- * it names a credential that still exists on this branch, is not revoked or expired, and
- * carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
- * the console, one copied in from another branch, or one predating a newly-enabled feature all
- * fail that check and get replaced.
- *
- * None of this needs local bookkeeping, because the secrets carry their own credential id:
- * `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
- * against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,
- * where `tokenIdShort` is what the credentials list reports. The env source being replaced is
- * the record of what the last call issued.
- *
- * ```ts
- * import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
- *
- * const { vars, credential } = await fetchEnvReusingSecrets(config, {
- *     projectId,
- *     branch: "main",
- *     env: { ...process.env, ...readEnvFile(".env") },
- * });
- * if (credential.issued) console.log(`new values for ${credential.keys.join(", ")}`);
- * ```
- */
-declare function fetchEnvReusingSecrets<const C extends Config>(config: C, options: FetchEnvOptions & {
-  /**
-   * Env source holding secrets a previous call persisted — `process.env` layered with a
-   * `.env` file, typically. Defaults to `process.env`.
-   */
-  env?: NodeJS.ProcessEnv;
-  /**
-   * Revoke the credential a freshly-minted one supersedes. Defaults to `true`.
-   *
-   * Pass `false` when this resolve covers only *part* of what the branch has. Object
-   * storage and the AI Gateway share one credential, so a partial resolve cannot tell
-   * whether the credential its persisted secrets name also backs a service it is not
-   * resolving — and revoking it would kill that service while its vars, which this call
-   * is not rewriting, stay on disk and stop working. The cost is an orphaned credential,
-   * which is the safer of the two failures. `neon env pull --service` is the caller that
-   * needs this.
-   */
-  revokeSuperseded?: boolean;
-}): Promise<ReusedBranchEnv>;
-//#endregion
-export { CredentialOutcome, ReusedBranchEnv, fetchEnvReusingSecrets };
-//# sourceMappingURL=reuse-secrets.d.ts.map

package/dist/_shared/env-core/reuse-secrets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reuse-secrets.d.ts","names":[],"sources":["../../../src/_shared/env-core/reuse-secrets.ts"],"mappings":";;;;;;;;AAsBiB,UAAA,iBAAA,CAAiB;EA2BjB;AAAe;AAEzB;AAEM;AAAiB;EA2CR,MAAA,EAAA,OAAA;EAAsB;AAAiB;AACpD;AACC;EAKF,IAAA,EAAA,MAAO,EAAA;EAcJ;AAAR;AAAO;;;;;;;;;;;;UApEO,eAAA;;QAEV;;cAEM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2CS,uCAAuC,gBACpD,YACC;;;;;QAKF,MAAA,CAAO;;;;;;;;;;;;;IAcZ,QAAQ"}

package/dist/_shared/env-core/reuse-secrets.js

@@ -1,181 +0,0 @@
-import { NEON_ENV_VAR_KEYS, createApiFromOptions, credentialEnvKeys, credentialName, fetchEnvKeys, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries } from "./env.js";
-import { credentialScopesSatisfied } from "@neon/config/v1";
-//#region src/_shared/env-core/reuse-secrets.ts
-/**
-* Resolve a branch's env while keeping one-time secrets the caller already holds.
-*
-* {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
-* credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
-* them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
-* pull` would leave a live credential behind each time. This is the wrapper that avoids that:
-* it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
-* for only the rest.
-*
-* The check is a real verification, not a presence test. A persisted secret is kept only when
-* it names a credential that still exists on this branch, is not revoked or expired, and
-* carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
-* the console, one copied in from another branch, or one predating a newly-enabled feature all
-* fail that check and get replaced.
-*
-* None of this needs local bookkeeping, because the secrets carry their own credential id:
-* `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
-* against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,
-* where `tokenIdShort` is what the credentials list reports. The env source being replaced is
-* the record of what the last call issued.
-*
-* ```ts
-* import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
-*
-* const { vars, credential } = await fetchEnvReusingSecrets(config, {
-*     projectId,
-*     branch: "main",
-*     env: { ...process.env, ...readEnvFile(".env") },
-* });
-* if (credential.issued) console.log(`new values for ${credential.keys.join(", ")}`);
-* ```
-*/
-async function fetchEnvReusingSecrets(config, options) {
-	const { env: source = process.env, revokeSuperseded = true, ...fetchOptions } = options;
-	const api = options.api ?? createApiFromOptions(options);
-	const { branch, desired } = await resolveBranchPolicy(config, options, api);
-	const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
-	const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
-	const secretKeys = credentialEnvKeys({
-		storage: storageEnabled,
-		aiGateway: gatewayEnabled
-	});
-	if (secretKeys.length === 0) {
-		const fetched = await fetchEnvKeys(config, fetchOptions, null);
-		return {
-			vars: preferPersisted(toEntries(fetched), source),
-			credential: {
-				issued: false,
-				keys: [],
-				revoked: [],
-				superseded: []
-			}
-		};
-	}
-	const persisted = readPersistedSecrets(source);
-	const complete = (!storageEnabled || Boolean(persisted.accessKeyId && persisted.secretAccessKey)) && (!gatewayEnabled || Boolean(persisted.apiToken));
-	const named = persisted.accessKeyId !== "" || persisted.apiToken !== "" ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted) : {
-		storage: null,
-		gateway: null
-	};
-	const reusable = complete ? reusableCredential(named, {
-		storageEnabled,
-		gatewayEnabled
-	}) : null;
-	const scopes = previewCredentialScopes(desired.preview);
-	const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-	const allKeys = policyEnvKeys(desired);
-	const fetchKeys = keep ? allKeys.filter((key) => !secretKeys.includes(key)) : allKeys;
-	const fetched = await fetchEnvKeys(config, {
-		...fetchOptions,
-		branchId: branch.id,
-		api
-	}, fetchKeys);
-	const vars = preferPersisted(toEntries(fetched), source);
-	if (keep) {
-		for (const key of secretKeys) {
-			const value = source[key];
-			if (value !== void 0) vars[key] = value;
-		}
-		return {
-			vars,
-			credential: {
-				issued: false,
-				keys: secretKeys,
-				revoked: [],
-				superseded: []
-			}
-		};
-	}
-	const ours = /* @__PURE__ */ new Set();
-	for (const meta of [named.storage, named.gateway]) if (meta !== null && meta.principalType === "user" && meta.name === credentialName(branch.name)) ours.add(meta.tokenId);
-	if (revokeSuperseded) for (const tokenId of ours) await api.revokeCredential(options.projectId, branch.id, tokenId);
-	return {
-		vars,
-		credential: {
-			issued: true,
-			keys: secretKeys,
-			revoked: revokeSuperseded ? [...ours] : [],
-			superseded: revokeSuperseded ? [] : [...ours]
-		}
-	};
-}
-/** Read the branch credential's secrets out of an env source. */
-function readPersistedSecrets(source) {
-	const storage = NEON_ENV_VAR_KEYS.storage;
-	const gateway = NEON_ENV_VAR_KEYS.aiGateway;
-	return {
-		accessKeyId: source[storage.accessKeyId] ?? "",
-		secretAccessKey: source[storage.secretAccessKey] ?? "",
-		apiToken: source[gateway.apiKey] ?? ""
-	};
-}
-/**
-* Keep a persisted value rather than overwriting it with an empty fetched one.
-*
-* Neon Auth's `base_url` is the case that needs this: integrations created before the API
-* returned it answer with an empty string, and the persisted copy is the only one left. An
-* empty fetched value never carries more information than a non-empty persisted one, so
-* preferring the latter is safe for every var — and it keeps a pull from blanking a working
-* line in someone's `.env`.
-*/
-function preferPersisted(vars, source) {
-	const out = { ...vars };
-	for (const [key, value] of Object.entries(out)) {
-		if (value !== "") continue;
-		const persisted = source[key];
-		if (persisted !== void 0 && persisted !== "") out[key] = persisted;
-	}
-	return out;
-}
-/**
-* The credential id embedded in an AI Gateway token. The API mints them as
-* `nt_live_<tokenIdShort>_<secret>`, and `tokenIdShort` is the public identifier the credentials
-* list reports — so a persisted token names the credential that issued it. Returns `null` for
-* anything not in that shape (a `.env.example` placeholder, a hand-typed value), which callers
-* treat as unverifiable.
-*/
-function gatewayTokenIdShort(apiToken) {
-	return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
-}
-/** Whether an issued credential can still be used: not revoked, not past its expiry. */
-function isLiveCredential(meta, now) {
-	if (meta.revokedAt !== void 0) return false;
-	if (meta.expiresAt === void 0) return true;
-	const expiresAt = Date.parse(meta.expiresAt);
-	return Number.isNaN(expiresAt) || expiresAt > now;
-}
-/**
-* The live credentials the persisted secrets name — at most one per half. A half that names
-* nothing contributes nothing, which is what a placeholder, a credential revoked in the
-* console, and one copied in from another branch all look like from here.
-*/
-function namedCredentials(live, persisted) {
-	const usable = live.filter((meta) => isLiveCredential(meta, Date.now()));
-	const shortId = persisted.apiToken ? gatewayTokenIdShort(persisted.apiToken) : null;
-	return {
-		storage: persisted.accessKeyId ? usable.find((meta) => meta.tokenId === persisted.accessKeyId) ?? null : null,
-		gateway: shortId ? usable.find((meta) => meta.tokenIdShort === shortId) ?? null : null
-	};
-}
-/**
-* The credential the persisted secrets can be *reused* as, or `null`.
-*
-* Strict on purpose: every half the policy enables has to name a live credential, and when both
-* features are enabled they must name the *same* one — they share a single credential, so
-* halves that disagree came from two different calls and neither can be trusted.
-*/
-function reusableCredential(named, enabled) {
-	if (enabled.storageEnabled && enabled.gatewayEnabled) return named.storage && named.gateway && named.storage.tokenId === named.gateway.tokenId ? named.storage : null;
-	if (enabled.storageEnabled) return named.storage;
-	if (enabled.gatewayEnabled) return named.gateway;
-	return null;
-}
-//#endregion
-export { fetchEnvReusingSecrets };
-
-//# sourceMappingURL=reuse-secrets.js.map

package/dist/_shared/env-core/reuse-secrets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"reuse-secrets.js","names":[],"sources":["../../../src/_shared/env-core/reuse-secrets.ts"],"sourcesContent":["import {\n\ttype Config,\n\tcredentialScopesSatisfied,\n\ttype NeonCredentialMeta,\n} from \"@neon/config/v1\";\n\nimport {\n\tcreateApiFromOptions,\n\tcredentialEnvKeys,\n\tcredentialName,\n\ttype FetchEnvOptions,\n\tfetchEnvKeys,\n\tNEON_ENV_VAR_KEYS,\n\tpolicyEnvKeys,\n\tpreviewCredentialScopes,\n\tresolveBranchPolicy,\n\ttoEntries,\n} from \"./env.js\";\n\n/**\n * What happened to the branch credential during a {@link fetchEnvReusingSecrets} call.\n */\nexport interface CredentialOutcome {\n\t/**\n\t * `true` when a new credential was minted — because none was persisted, or because the\n\t * persisted secrets could not be verified against this branch. `false` when the persisted\n\t * secrets were verified and kept, and when the policy enables nothing credential-backed.\n\t */\n\tissued: boolean;\n\t/**\n\t * The env-var keys the branch credential's secrets surface under, given what the policy\n\t * enables. Empty when the policy enables neither object storage nor the AI Gateway.\n\t */\n\tkeys: string[];\n\t/**\n\t * `tokenId`s revoked because this call superseded them. Only ever credentials the persisted\n\t * secrets named *and* that this tool issued; empty otherwise.\n\t */\n\trevoked: string[];\n\t/**\n\t * `tokenId`s this call superseded but left live, because `revokeSuperseded` was `false`.\n\t * The counterpart to {@link CredentialOutcome.revoked}: exactly the ids that would be\n\t * there instead. Lets a caller name what it orphaned rather than saying that it might\n\t * have orphaned something — always empty on the default path.\n\t */\n\tsuperseded: string[];\n}\n\n/** A resolved branch env, ready to write to a dotenv file or inject into a process. */\nexport interface ReusedBranchEnv {\n\t/** Every Neon env var for the branch, as `{ KEY: value }`. */\n\tvars: Record<string, string>;\n\t/** What happened to the branch credential. */\n\tcredential: CredentialOutcome;\n}\n\n/** The branch credential's secrets as persisted in an env source. Empty string means absent. */\ninterface PersistedSecrets {\n\taccessKeyId: string;\n\tsecretAccessKey: string;\n\tapiToken: string;\n}\n\n/**\n * Resolve a branch's env while keeping one-time secrets the caller already holds.\n *\n * {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a\n * credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so \"fetching\"\n * them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env\n * pull` would leave a live credential behind each time. This is the wrapper that avoids that:\n * it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`\n * for only the rest.\n *\n * The check is a real verification, not a presence test. A persisted secret is kept only when\n * it names a credential that still exists on this branch, is not revoked or expired, and\n * carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in\n * the console, one copied in from another branch, or one predating a newly-enabled feature all\n * fail that check and get replaced.\n *\n * None of this needs local bookkeeping, because the secrets carry their own credential id:\n * `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates\n * against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,\n * where `tokenIdShort` is what the credentials list reports. The env source being replaced is\n * the record of what the last call issued.\n *\n * ```ts\n * import { fetchEnvReusingSecrets } from \"../_shared/env-core/reuse-secrets.js\";\n *\n * const { vars, credential } = await fetchEnvReusingSecrets(config, {\n *     projectId,\n *     branch: \"main\",\n *     env: { ...process.env, ...readEnvFile(\".env\") },\n * });\n * if (credential.issued) console.log(`new values for ${credential.keys.join(\", \")}`);\n * ```\n */\nexport async function fetchEnvReusingSecrets<const C extends Config>(\n\tconfig: C,\n\toptions: FetchEnvOptions & {\n\t\t/**\n\t\t * Env source holding secrets a previous call persisted — `process.env` layered with a\n\t\t * `.env` file, typically. Defaults to `process.env`.\n\t\t */\n\t\tenv?: NodeJS.ProcessEnv;\n\t\t/**\n\t\t * Revoke the credential a freshly-minted one supersedes. Defaults to `true`.\n\t\t *\n\t\t * Pass `false` when this resolve covers only *part* of what the branch has. Object\n\t\t * storage and the AI Gateway share one credential, so a partial resolve cannot tell\n\t\t * whether the credential its persisted secrets name also backs a service it is not\n\t\t * resolving — and revoking it would kill that service while its vars, which this call\n\t\t * is not rewriting, stay on disk and stop working. The cost is an orphaned credential,\n\t\t * which is the safer of the two failures. `neon env pull --service` is the caller that\n\t\t * needs this.\n\t\t */\n\t\trevokeSuperseded?: boolean;\n\t},\n): Promise<ReusedBranchEnv> {\n\tconst {\n\t\tenv: source = process.env,\n\t\trevokeSuperseded = true,\n\t\t...fetchOptions\n\t} = options;\n\tconst api = options.api ?? createApiFromOptions(options);\n\tconst { branch, desired } = await resolveBranchPolicy(config, options, api);\n\n\tconst storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;\n\tconst gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;\n\tconst secretKeys = credentialEnvKeys({\n\t\tstorage: storageEnabled,\n\t\taiGateway: gatewayEnabled,\n\t});\n\n\t// Nothing credential-backed on this branch, so there is nothing to preserve and no\n\t// credential to spend: fetch everything and skip the credentials endpoint entirely.\n\tif (secretKeys.length === 0) {\n\t\tconst fetched = await fetchEnvKeys(config, fetchOptions, null);\n\t\treturn {\n\t\t\tvars: preferPersisted(toEntries(fetched), source),\n\t\t\tcredential: {\n\t\t\t\tissued: false,\n\t\t\t\tkeys: [],\n\t\t\t\trevoked: [],\n\t\t\t\tsuperseded: [],\n\t\t\t},\n\t\t};\n\t}\n\n\tconst persisted = readPersistedSecrets(source);\n\tconst complete =\n\t\t(!storageEnabled ||\n\t\t\tBoolean(persisted.accessKeyId && persisted.secretAccessKey)) &&\n\t\t(!gatewayEnabled || Boolean(persisted.apiToken));\n\n\t// Look the persisted secrets up whenever there are any — not only when they're complete.\n\t// An incomplete set still names the credential a newly-enabled feature is about to\n\t// supersede (a storage-only credential on a branch that just gained the AI Gateway), and\n\t// that one should be revoked rather than left live.\n\tconst named =\n\t\tpersisted.accessKeyId !== \"\" || persisted.apiToken !== \"\"\n\t\t\t? namedCredentials(\n\t\t\t\t\tawait api.listCredentials(options.projectId, branch.id),\n\t\t\t\t\tpersisted,\n\t\t\t\t)\n\t\t\t: { storage: null, gateway: null };\n\n\tconst reusable = complete\n\t\t? reusableCredential(named, { storageEnabled, gatewayEnabled })\n\t\t: null;\n\tconst scopes = previewCredentialScopes(desired.preview);\n\tconst keep =\n\t\treusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);\n\n\t// Ask for everything the policy produces, minus the secrets we're keeping — which is what\n\t// stops `fetchEnv` from minting a credential it doesn't need.\n\tconst allKeys = policyEnvKeys(desired);\n\tconst fetchKeys = keep\n\t\t? allKeys.filter((key) => !secretKeys.includes(key))\n\t\t: allKeys;\n\tconst fetched = await fetchEnvKeys(\n\t\tconfig,\n\t\t// Pass the resolved id so `fetchEnv` targets the same branch this call verified against,\n\t\t// even if `options.branch` was a name that has since been reused.\n\t\t{ ...fetchOptions, branchId: branch.id, api },\n\t\tfetchKeys,\n\t);\n\n\tconst vars = preferPersisted(toEntries(fetched), source);\n\tif (keep) {\n\t\tfor (const key of secretKeys) {\n\t\t\tconst value = source[key];\n\t\t\tif (value !== undefined) vars[key] = value;\n\t\t}\n\t\treturn {\n\t\t\tvars,\n\t\t\tcredential: {\n\t\t\t\tissued: false,\n\t\t\t\tkeys: secretKeys,\n\t\t\t\trevoked: [],\n\t\t\t\tsuperseded: [],\n\t\t\t},\n\t\t};\n\t}\n\n\t// A replacement was minted, so revoke what it supersedes: the credentials the old secrets\n\t// named, minus any this tool did not issue. Their secrets lived nowhere but the env source\n\t// this call replaces, so revoking them strands nothing — and it keeps a branch from\n\t// accumulating a live credential per call. Everything else on the branch is left alone: it\n\t// may belong to a teammate, another checkout, or a deployed function, and nothing\n\t// observable distinguishes those from an orphan of our own.\n\t//\n\t// Revoked *after* the fetch, so a failed fetch leaves the caller's existing secrets working.\n\tconst ours = new Set<string>();\n\tfor (const meta of [named.storage, named.gateway]) {\n\t\tif (\n\t\t\tmeta !== null &&\n\t\t\tmeta.principalType === \"user\" &&\n\t\t\tmeta.name === credentialName(branch.name)\n\t\t) {\n\t\t\tours.add(meta.tokenId);\n\t\t}\n\t}\n\tif (revokeSuperseded) {\n\t\tfor (const tokenId of ours) {\n\t\t\tawait api.revokeCredential(options.projectId, branch.id, tokenId);\n\t\t}\n\t}\n\n\treturn {\n\t\tvars,\n\t\tcredential: {\n\t\t\tissued: true,\n\t\t\tkeys: secretKeys,\n\t\t\trevoked: revokeSuperseded ? [...ours] : [],\n\t\t\tsuperseded: revokeSuperseded ? [] : [...ours],\n\t\t},\n\t};\n}\n\n/** Read the branch credential's secrets out of an env source. */\nfunction readPersistedSecrets(source: NodeJS.ProcessEnv): PersistedSecrets {\n\tconst storage = NEON_ENV_VAR_KEYS.storage;\n\tconst gateway = NEON_ENV_VAR_KEYS.aiGateway;\n\treturn {\n\t\taccessKeyId: source[storage.accessKeyId] ?? \"\",\n\t\tsecretAccessKey: source[storage.secretAccessKey] ?? \"\",\n\t\tapiToken: source[gateway.apiKey] ?? \"\",\n\t};\n}\n\n/**\n * Keep a persisted value rather than overwriting it with an empty fetched one.\n *\n * Neon Auth's `base_url` is the case that needs this: integrations created before the API\n * returned it answer with an empty string, and the persisted copy is the only one left. An\n * empty fetched value never carries more information than a non-empty persisted one, so\n * preferring the latter is safe for every var — and it keeps a pull from blanking a working\n * line in someone's `.env`.\n */\nfunction preferPersisted(\n\tvars: Record<string, string>,\n\tsource: NodeJS.ProcessEnv,\n): Record<string, string> {\n\tconst out = { ...vars };\n\tfor (const [key, value] of Object.entries(out)) {\n\t\tif (value !== \"\") continue;\n\t\tconst persisted = source[key];\n\t\tif (persisted !== undefined && persisted !== \"\") out[key] = persisted;\n\t}\n\treturn out;\n}\n\n/**\n * The credential id embedded in an AI Gateway token. The API mints them as\n * `nt_live_<tokenIdShort>_<secret>`, and `tokenIdShort` is the public identifier the credentials\n * list reports — so a persisted token names the credential that issued it. Returns `null` for\n * anything not in that shape (a `.env.example` placeholder, a hand-typed value), which callers\n * treat as unverifiable.\n */\nfunction gatewayTokenIdShort(apiToken: string): string | null {\n\treturn /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;\n}\n\n/** Whether an issued credential can still be used: not revoked, not past its expiry. */\nfunction isLiveCredential(meta: NeonCredentialMeta, now: number): boolean {\n\tif (meta.revokedAt !== undefined) return false;\n\tif (meta.expiresAt === undefined) return true;\n\tconst expiresAt = Date.parse(meta.expiresAt);\n\treturn Number.isNaN(expiresAt) || expiresAt > now;\n}\n\n/**\n * The live credentials the persisted secrets name — at most one per half. A half that names\n * nothing contributes nothing, which is what a placeholder, a credential revoked in the\n * console, and one copied in from another branch all look like from here.\n */\nfunction namedCredentials(\n\tlive: NeonCredentialMeta[],\n\tpersisted: PersistedSecrets,\n): { storage: NeonCredentialMeta | null; gateway: NeonCredentialMeta | null } {\n\tconst usable = live.filter((meta) => isLiveCredential(meta, Date.now()));\n\tconst shortId = persisted.apiToken\n\t\t? gatewayTokenIdShort(persisted.apiToken)\n\t\t: null;\n\treturn {\n\t\tstorage: persisted.accessKeyId\n\t\t\t? (usable.find((meta) => meta.tokenId === persisted.accessKeyId) ??\n\t\t\t\tnull)\n\t\t\t: null,\n\t\tgateway: shortId\n\t\t\t? (usable.find((meta) => meta.tokenIdShort === shortId) ?? null)\n\t\t\t: null,\n\t};\n}\n\n/**\n * The credential the persisted secrets can be *reused* as, or `null`.\n *\n * Strict on purpose: every half the policy enables has to name a live credential, and when both\n * features are enabled they must name the *same* one — they share a single credential, so\n * halves that disagree came from two different calls and neither can be trusted.\n */\nfunction reusableCredential(\n\tnamed: ReturnType<typeof namedCredentials>,\n\tenabled: { storageEnabled: boolean; gatewayEnabled: boolean },\n): NeonCredentialMeta | null {\n\tif (enabled.storageEnabled && enabled.gatewayEnabled) {\n\t\treturn named.storage &&\n\t\t\tnamed.gateway &&\n\t\t\tnamed.storage.tokenId === named.gateway.tokenId\n\t\t\t? named.storage\n\t\t\t: null;\n\t}\n\tif (enabled.storageEnabled) return named.storage;\n\tif (enabled.gatewayEnabled) return named.gateway;\n\treturn null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgGA,eAAsB,uBACrB,QACA,SAmB2B;CAC3B,MAAM,EACL,KAAK,SAAS,QAAQ,KACtB,mBAAmB,MACnB,GAAG,iBACA;CACJ,MAAM,MAAM,QAAQ,OAAO,qBAAqB,OAAO;CACvD,MAAM,EAAE,QAAQ,YAAY,MAAM,oBAAoB,QAAQ,SAAS,GAAG;CAE1E,MAAM,kBAAkB,QAAQ,SAAS,QAAQ,UAAU,KAAK;CAChE,MAAM,iBAAiB,QAAQ,SAAS,oBAAoB;CAC5D,MAAM,aAAa,kBAAkB;EACpC,SAAS;EACT,WAAW;CACZ,CAAC;CAID,IAAI,WAAW,WAAW,GAAG;EAC5B,MAAM,UAAU,MAAM,aAAa,QAAQ,cAAc,IAAI;EAC7D,OAAO;GACN,MAAM,gBAAgB,UAAU,OAAO,GAAG,MAAM;GAChD,YAAY;IACX,QAAQ;IACR,MAAM,CAAC;IACP,SAAS,CAAC;IACV,YAAY,CAAC;GACd;EACD;CACD;CAEA,MAAM,YAAY,qBAAqB,MAAM;CAC7C,MAAM,YACJ,CAAC,kBACD,QAAQ,UAAU,eAAe,UAAU,eAAe,OAC1D,CAAC,kBAAkB,QAAQ,UAAU,QAAQ;CAM/C,MAAM,QACL,UAAU,gBAAgB,MAAM,UAAU,aAAa,KACpD,iBACA,MAAM,IAAI,gBAAgB,QAAQ,WAAW,OAAO,EAAE,GACtD,SACD,IACC;EAAE,SAAS;EAAM,SAAS;CAAK;CAEnC,MAAM,WAAW,WACd,mBAAmB,OAAO;EAAE;EAAgB;CAAe,CAAC,IAC5D;CACH,MAAM,SAAS,wBAAwB,QAAQ,OAAO;CACtD,MAAM,OACL,aAAa,QAAQ,0BAA0B,SAAS,QAAQ,MAAM;CAIvE,MAAM,UAAU,cAAc,OAAO;CACrC,MAAM,YAAY,OACf,QAAQ,QAAQ,QAAQ,CAAC,WAAW,SAAS,GAAG,CAAC,IACjD;CACH,MAAM,UAAU,MAAM,aACrB,QAGA;EAAE,GAAG;EAAc,UAAU,OAAO;EAAI;CAAI,GAC5C,SACD;CAEA,MAAM,OAAO,gBAAgB,UAAU,OAAO,GAAG,MAAM;CACvD,IAAI,MAAM;EACT,KAAK,MAAM,OAAO,YAAY;GAC7B,MAAM,QAAQ,OAAO;GACrB,IAAI,UAAU,KAAA,GAAW,KAAK,OAAO;EACtC;EACA,OAAO;GACN;GACA,YAAY;IACX,QAAQ;IACR,MAAM;IACN,SAAS,CAAC;IACV,YAAY,CAAC;GACd;EACD;CACD;CAUA,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,CAAC,MAAM,SAAS,MAAM,OAAO,GAC/C,IACC,SAAS,QACT,KAAK,kBAAkB,UACvB,KAAK,SAAS,eAAe,OAAO,IAAI,GAExC,KAAK,IAAI,KAAK,OAAO;CAGvB,IAAI,kBACH,KAAK,MAAM,WAAW,MACrB,MAAM,IAAI,iBAAiB,QAAQ,WAAW,OAAO,IAAI,OAAO;CAIlE,OAAO;EACN;EACA,YAAY;GACX,QAAQ;GACR,MAAM;GACN,SAAS,mBAAmB,CAAC,GAAG,IAAI,IAAI,CAAC;GACzC,YAAY,mBAAmB,CAAC,IAAI,CAAC,GAAG,IAAI;EAC7C;CACD;AACD;;AAGA,SAAS,qBAAqB,QAA6C;CAC1E,MAAM,UAAU,kBAAkB;CAClC,MAAM,UAAU,kBAAkB;CAClC,OAAO;EACN,aAAa,OAAO,QAAQ,gBAAgB;EAC5C,iBAAiB,OAAO,QAAQ,oBAAoB;EACpD,UAAU,OAAO,QAAQ,WAAW;CACrC;AACD;;;;;;;;;;AAWA,SAAS,gBACR,MACA,QACyB;CACzB,MAAM,MAAM,EAAE,GAAG,KAAK;CACtB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG,GAAG;EAC/C,IAAI,UAAU,IAAI;EAClB,MAAM,YAAY,OAAO;EACzB,IAAI,cAAc,KAAA,KAAa,cAAc,IAAI,IAAI,OAAO;CAC7D;CACA,OAAO;AACR;;;;;;;;AASA,SAAS,oBAAoB,UAAiC;CAC7D,OAAO,uBAAuB,KAAK,QAAQ,CAAC,GAAG,MAAM;AACtD;;AAGA,SAAS,iBAAiB,MAA0B,KAAsB;CACzE,IAAI,KAAK,cAAc,KAAA,GAAW,OAAO;CACzC,IAAI,KAAK,cAAc,KAAA,GAAW,OAAO;CACzC,MAAM,YAAY,KAAK,MAAM,KAAK,SAAS;CAC3C,OAAO,OAAO,MAAM,SAAS,KAAK,YAAY;AAC/C;;;;;;AAOA,SAAS,iBACR,MACA,WAC6E;CAC7E,MAAM,SAAS,KAAK,QAAQ,SAAS,iBAAiB,MAAM,KAAK,IAAI,CAAC,CAAC;CACvE,MAAM,UAAU,UAAU,WACvB,oBAAoB,UAAU,QAAQ,IACtC;CACH,OAAO;EACN,SAAS,UAAU,cACf,OAAO,MAAM,SAAS,KAAK,YAAY,UAAU,WAAW,KAC9D,OACC;EACH,SAAS,UACL,OAAO,MAAM,SAAS,KAAK,iBAAiB,OAAO,KAAK,OACzD;CACJ;AACD;;;;;;;;AASA,SAAS,mBACR,OACA,SAC4B;CAC5B,IAAI,QAAQ,kBAAkB,QAAQ,gBACrC,OAAO,MAAM,WACZ,MAAM,WACN,MAAM,QAAQ,YAAY,MAAM,QAAQ,UACtC,MAAM,UACN;CAEJ,IAAI,QAAQ,gBAAgB,OAAO,MAAM;CACzC,IAAI,QAAQ,gBAAgB,OAAO,MAAM;CACzC,OAAO;AACR"}

package/dist/_shared/paths.d.ts

@@ -1,116 +0,0 @@
-//#region src/_shared/paths.d.ts
-/**
- * # Where the Neon CLIs keep their files on disk
- *
- **Deliberately impure.** It reads environment variables and touches the filesystem, which
- * `@neon/config` — the package this used to be a subpath of — must never do from its root
- * export. It lives here instead of there precisely so that a policy-facing package does not
- * carry implementor-only code.
- *
- * It exists because three separate readers each grew their own answer to "where is the
- * config directory", and all three disagreed: `packages/cli` honoured `XDG_CONFIG_HOME` but
- * not `NEONCTL_CONFIG_DIR`, `packages/env` honoured the env var but not XDG, and the init
- * flow hardcoded `~/.config/neonctl`. With `XDG_CONFIG_HOME` set, the CLI wrote
- * credentials somewhere the other two never looked.
- *
- * ## The directory
- *
- * `neon` is the current name; `neonctl` is the legacy one, kept readable forever. Resolution,
- * each entry winning over the next:
- *
- * 1. An explicit directory (a `--config-dir` flag) — **exact**, no legacy fallback.
- * 2. `NEON_CONFIG_DIR` — exact.
- * 3. `NEONCTL_CONFIG_DIR` (legacy name) — exact.
- * 4. `$XDG_CONFIG_HOME/neon`, else `<home>/.config/neon`.
- *
- * An explicitly chosen directory is never paired with a fallback: `--config-dir /tmp/ci` that
- * quietly read `~/.config/neonctl` would defeat the point of passing it.
- *
- * ## The files
- *
- * {@link resolveConfigFile} answers "which path should I use for this file", and it is the
- * same answer for reading and writing:
- *
- * - Present in `neon/` → use it.
- * - Present only in `neonctl/` → **use it there, in place.** An existing credentials file is
- *   never copied or moved, so nothing is left behind to go stale and no other tool starts
- *   reading an abandoned token.
- * - Present in neither → the new location. New files only ever appear under `neon/`.
- */
-/** Current directory name. New files are created here. */
-declare const CONFIG_DIR_NAME = "neon";
-/** Legacy directory name, read forever so existing installs keep working untouched. */
-declare const LEGACY_CONFIG_DIR_NAME = "neonctl";
-interface ConfigPathOptions {
-  /**
-   * An explicit directory, e.g. from a `--config-dir` flag. Used exactly as given: no
-   * environment variables are consulted and the legacy directory is never searched.
-   */
-  dir?: string;
-  /** Environment to read. Defaults to `process.env`. Injectable for tests. */
-  env?: NodeJS.ProcessEnv;
-}
-/** Where files are created. See the module docs for the precedence. */
-declare function configDir(options?: ConfigPathOptions): string;
-/**
- * The legacy directory, or `undefined` when the location was chosen explicitly (in which
- * case there is no legacy counterpart to fall back to).
- */
-declare function legacyConfigDir(options?: ConfigPathOptions): string | undefined;
-interface ResolvedConfigFile {
-  /** The path to use, for both reading and writing. */
-  path: string;
-  /** The directory `path` lives in. */
-  dir: string;
-  /** True when the file was found in the legacy `neonctl` directory. */
-  isLegacy: boolean;
-  /** Whether the file exists at `path` right now. */
-  exists: boolean;
-}
-/**
- * Resolve one file inside the config directory. Prefers the current location, falls back to
- * an existing legacy file **in place**, and otherwise points at the current location so new
- * files are created there.
- */
-declare function resolveConfigFile(fileName: string, options?: ConfigPathOptions): ResolvedConfigFile;
-declare const CREDENTIALS_FILE = "credentials.json";
-/**
- * Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
- *
- * The directory was called `neonctl` until the CLI was renamed. An existing one is still read —
- * see {@link credentialsPath} — but it is never written to, moved, or deleted.
- */
-declare const defaultDir: string;
-/**
- * Where this invocation's `credentials.json` lives.
- *
- * When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
- * directory is used **in place**: an install that predates the rename keeps working, and its
- * credentials are never duplicated into a second location where one copy could go stale while
- * another tool still reads it.
- *
- * A `--config-dir` the user actually passed is used exactly as given. Falling back out of an
- * explicitly chosen directory would defeat the reason for choosing it — a CI run pointed at a
- * scratch directory must never pick up a developer's real credentials.
- */
-declare const credentialsPath: (dir: string) => string;
-/**
- * Whether a credentials file is one the CLI created, rather than a path a profile adopted.
- *
- * Anything that deletes a credential has to ask this first. A profile entry may point anywhere —
- * that is what makes adopting an existing directory a one-line edit — and a file we did not
- * create is not ours to remove.
- */
-declare const isInsideConfigDir: (configDirectory: string, file: string) => boolean;
-/**
- * Whether a credentials file is one the CLI owns, counting the legacy `neonctl` directory.
- *
- * {@link credentialsPath} deliberately reads an existing legacy file in place rather than
- * migrating it, so for a default config directory that file is ours even though it sits outside
- * `neon/`. Judging ownership on the current directory alone would call an install that predates
- * the rename "adopted".
- */
-declare const isOwnedCredentialPath: (configDirectory: string, file: string) => boolean;
-//#endregion
-export { CONFIG_DIR_NAME, CREDENTIALS_FILE, ConfigPathOptions, LEGACY_CONFIG_DIR_NAME, ResolvedConfigFile, configDir, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath, legacyConfigDir, resolveConfigFile };
-//# sourceMappingURL=paths.d.ts.map

package/dist/_shared/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","names":[],"sources":["../../src/_shared/paths.ts"],"mappings":";;AA2CA;AAGA;AAEA;AAWA;AAUA;AAOA;AAgBA;AAAiC;AAEvB;AACP;AAAkB;AA4CrB;AAQA;AAcA;AAUA;AAaA;;;;;;;;;;;;;;;;;;;;;;;cA7Ia,eAAA;;cAGA,sBAAA;UAEI,iBAAA;;;;;;;QAOV,MAAA,CAAO;;;iBAIE,SAAA,WAAmB;;;;;iBAUnB,eAAA,WACN;UAMO,kBAAA;;;;;;;;;;;;;;;iBAgBD,iBAAA,6BAEN,oBACP;cA4CU,gBAAA;;;;;;;cAQA;;;;;;;;;;;;;cAcA;;;;;;;;cAUA;;;;;;;;;cAaA"}

package/dist/_shared/paths.js

@@ -1,153 +0,0 @@
-import { existsSync } from "node:fs";
-import { join, resolve } from "node:path";
-//#region src/_shared/paths.ts
-/**
-* # Where the Neon CLIs keep their files on disk
-*
-**Deliberately impure.** It reads environment variables and touches the filesystem, which
-* `@neon/config` — the package this used to be a subpath of — must never do from its root
-* export. It lives here instead of there precisely so that a policy-facing package does not
-* carry implementor-only code.
-*
-* It exists because three separate readers each grew their own answer to "where is the
-* config directory", and all three disagreed: `packages/cli` honoured `XDG_CONFIG_HOME` but
-* not `NEONCTL_CONFIG_DIR`, `packages/env` honoured the env var but not XDG, and the init
-* flow hardcoded `~/.config/neonctl`. With `XDG_CONFIG_HOME` set, the CLI wrote
-* credentials somewhere the other two never looked.
-*
-* ## The directory
-*
-* `neon` is the current name; `neonctl` is the legacy one, kept readable forever. Resolution,
-* each entry winning over the next:
-*
-* 1. An explicit directory (a `--config-dir` flag) — **exact**, no legacy fallback.
-* 2. `NEON_CONFIG_DIR` — exact.
-* 3. `NEONCTL_CONFIG_DIR` (legacy name) — exact.
-* 4. `$XDG_CONFIG_HOME/neon`, else `<home>/.config/neon`.
-*
-* An explicitly chosen directory is never paired with a fallback: `--config-dir /tmp/ci` that
-* quietly read `~/.config/neonctl` would defeat the point of passing it.
-*
-* ## The files
-*
-* {@link resolveConfigFile} answers "which path should I use for this file", and it is the
-* same answer for reading and writing:
-*
-* - Present in `neon/` → use it.
-* - Present only in `neonctl/` → **use it there, in place.** An existing credentials file is
-*   never copied or moved, so nothing is left behind to go stale and no other tool starts
-*   reading an abandoned token.
-* - Present in neither → the new location. New files only ever appear under `neon/`.
-*/
-/** Current directory name. New files are created here. */
-const CONFIG_DIR_NAME = "neon";
-/** Legacy directory name, read forever so existing installs keep working untouched. */
-const LEGACY_CONFIG_DIR_NAME = "neonctl";
-/** Where files are created. See the module docs for the precedence. */
-function configDir(options = {}) {
-	const explicit = explicitDir(options);
-	if (explicit) return explicit;
-	return join(configHome(options.env ?? process.env), CONFIG_DIR_NAME);
-}
-/**
-* The legacy directory, or `undefined` when the location was chosen explicitly (in which
-* case there is no legacy counterpart to fall back to).
-*/
-function legacyConfigDir(options = {}) {
-	if (explicitDir(options)) return void 0;
-	return join(configHome(options.env ?? process.env), LEGACY_CONFIG_DIR_NAME);
-}
-/**
-* Resolve one file inside the config directory. Prefers the current location, falls back to
-* an existing legacy file **in place**, and otherwise points at the current location so new
-* files are created there.
-*/
-function resolveConfigFile(fileName, options = {}) {
-	const dir = configDir(options);
-	const current = resolve(dir, fileName);
-	if (existsSync(current)) return {
-		path: current,
-		dir,
-		isLegacy: false,
-		exists: true
-	};
-	const legacyDir = legacyConfigDir(options);
-	if (legacyDir) {
-		const legacy = resolve(legacyDir, fileName);
-		if (existsSync(legacy)) return {
-			path: legacy,
-			dir: legacyDir,
-			isLegacy: true,
-			exists: true
-		};
-	}
-	return {
-		path: current,
-		dir,
-		isLegacy: false,
-		exists: false
-	};
-}
-/** `$XDG_CONFIG_HOME`, else `<home>/.config`. Falls back to a relative `.config` with no home. */
-function configHome(env) {
-	const xdg = nonEmpty(env.XDG_CONFIG_HOME);
-	if (xdg) return xdg;
-	const home = nonEmpty(env.HOME) ?? nonEmpty(env.USERPROFILE);
-	return home ? join(home, ".config") : ".config";
-}
-function explicitDir(options) {
-	const env = options.env ?? process.env;
-	return nonEmpty(options.dir) ?? nonEmpty(env.NEON_CONFIG_DIR) ?? nonEmpty(env.NEONCTL_CONFIG_DIR);
-}
-function nonEmpty(value) {
-	if (typeof value !== "string") return void 0;
-	const trimmed = value.trim();
-	return trimmed === "" ? void 0 : trimmed;
-}
-const CREDENTIALS_FILE = "credentials.json";
-/**
-* Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
-*
-* The directory was called `neonctl` until the CLI was renamed. An existing one is still read —
-* see {@link credentialsPath} — but it is never written to, moved, or deleted.
-*/
-const defaultDir = configDir();
-/**
-* Where this invocation's `credentials.json` lives.
-*
-* When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
-* directory is used **in place**: an install that predates the rename keeps working, and its
-* credentials are never duplicated into a second location where one copy could go stale while
-* another tool still reads it.
-*
-* A `--config-dir` the user actually passed is used exactly as given. Falling back out of an
-* explicitly chosen directory would defeat the reason for choosing it — a CI run pointed at a
-* scratch directory must never pick up a developer's real credentials.
-*/
-const credentialsPath = (dir) => resolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;
-/**
-* Whether a credentials file is one the CLI created, rather than a path a profile adopted.
-*
-* Anything that deletes a credential has to ask this first. A profile entry may point anywhere —
-* that is what makes adopting an existing directory a one-line edit — and a file we did not
-* create is not ours to remove.
-*/
-const isInsideConfigDir = (configDirectory, file) => `${resolve(file)}/`.startsWith(`${resolve(configDirectory)}/`);
-/**
-* Whether a credentials file is one the CLI owns, counting the legacy `neonctl` directory.
-*
-* {@link credentialsPath} deliberately reads an existing legacy file in place rather than
-* migrating it, so for a default config directory that file is ours even though it sits outside
-* `neon/`. Judging ownership on the current directory alone would call an install that predates
-* the rename "adopted".
-*/
-const isOwnedCredentialPath = (configDirectory, file) => {
-	if (isInsideConfigDir(configDirectory, file)) return true;
-	if (configDirectory !== defaultDir) return false;
-	const legacy = legacyConfigDir();
-	return legacy !== void 0 && isInsideConfigDir(legacy, file);
-};
-//#endregion
-export { CONFIG_DIR_NAME, CREDENTIALS_FILE, LEGACY_CONFIG_DIR_NAME, configDir, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath, legacyConfigDir, resolveConfigFile };
-
-//# sourceMappingURL=paths.js.map

package/dist/_shared/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","names":[],"sources":["../../src/_shared/paths.ts"],"sourcesContent":["/**\n * # Where the Neon CLIs keep their files on disk\n *\n **Deliberately impure.** It reads environment variables and touches the filesystem, which\n * `@neon/config` — the package this used to be a subpath of — must never do from its root\n * export. It lives here instead of there precisely so that a policy-facing package does not\n * carry implementor-only code.\n *\n * It exists because three separate readers each grew their own answer to \"where is the\n * config directory\", and all three disagreed: `packages/cli` honoured `XDG_CONFIG_HOME` but\n * not `NEONCTL_CONFIG_DIR`, `packages/env` honoured the env var but not XDG, and the init\n * flow hardcoded `~/.config/neonctl`. With `XDG_CONFIG_HOME` set, the CLI wrote\n * credentials somewhere the other two never looked.\n *\n * ## The directory\n *\n * `neon` is the current name; `neonctl` is the legacy one, kept readable forever. Resolution,\n * each entry winning over the next:\n *\n * 1. An explicit directory (a `--config-dir` flag) — **exact**, no legacy fallback.\n * 2. `NEON_CONFIG_DIR` — exact.\n * 3. `NEONCTL_CONFIG_DIR` (legacy name) — exact.\n * 4. `$XDG_CONFIG_HOME/neon`, else `<home>/.config/neon`.\n *\n * An explicitly chosen directory is never paired with a fallback: `--config-dir /tmp/ci` that\n * quietly read `~/.config/neonctl` would defeat the point of passing it.\n *\n * ## The files\n *\n * {@link resolveConfigFile} answers \"which path should I use for this file\", and it is the\n * same answer for reading and writing:\n *\n * - Present in `neon/` → use it.\n * - Present only in `neonctl/` → **use it there, in place.** An existing credentials file is\n *   never copied or moved, so nothing is left behind to go stale and no other tool starts\n *   reading an abandoned token.\n * - Present in neither → the new location. New files only ever appear under `neon/`.\n */\n\nimport { existsSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\n\n/** Current directory name. New files are created here. */\nexport const CONFIG_DIR_NAME = \"neon\";\n\n/** Legacy directory name, read forever so existing installs keep working untouched. */\nexport const LEGACY_CONFIG_DIR_NAME = \"neonctl\";\n\nexport interface ConfigPathOptions {\n\t/**\n\t * An explicit directory, e.g. from a `--config-dir` flag. Used exactly as given: no\n\t * environment variables are consulted and the legacy directory is never searched.\n\t */\n\tdir?: string;\n\t/** Environment to read. Defaults to `process.env`. Injectable for tests. */\n\tenv?: NodeJS.ProcessEnv;\n}\n\n/** Where files are created. See the module docs for the precedence. */\nexport function configDir(options: ConfigPathOptions = {}): string {\n\tconst explicit = explicitDir(options);\n\tif (explicit) return explicit;\n\treturn join(configHome(options.env ?? process.env), CONFIG_DIR_NAME);\n}\n\n/**\n * The legacy directory, or `undefined` when the location was chosen explicitly (in which\n * case there is no legacy counterpart to fall back to).\n */\nexport function legacyConfigDir(\n\toptions: ConfigPathOptions = {},\n): string | undefined {\n\tif (explicitDir(options)) return undefined;\n\treturn join(configHome(options.env ?? process.env), LEGACY_CONFIG_DIR_NAME);\n}\n\nexport interface ResolvedConfigFile {\n\t/** The path to use, for both reading and writing. */\n\tpath: string;\n\t/** The directory `path` lives in. */\n\tdir: string;\n\t/** True when the file was found in the legacy `neonctl` directory. */\n\tisLegacy: boolean;\n\t/** Whether the file exists at `path` right now. */\n\texists: boolean;\n}\n\n/**\n * Resolve one file inside the config directory. Prefers the current location, falls back to\n * an existing legacy file **in place**, and otherwise points at the current location so new\n * files are created there.\n */\nexport function resolveConfigFile(\n\tfileName: string,\n\toptions: ConfigPathOptions = {},\n): ResolvedConfigFile {\n\tconst dir = configDir(options);\n\tconst current = resolve(dir, fileName);\n\tif (existsSync(current))\n\t\treturn { path: current, dir, isLegacy: false, exists: true };\n\n\tconst legacyDir = legacyConfigDir(options);\n\tif (legacyDir) {\n\t\tconst legacy = resolve(legacyDir, fileName);\n\t\tif (existsSync(legacy))\n\t\t\treturn {\n\t\t\t\tpath: legacy,\n\t\t\t\tdir: legacyDir,\n\t\t\t\tisLegacy: true,\n\t\t\t\texists: true,\n\t\t\t};\n\t}\n\n\treturn { path: current, dir, isLegacy: false, exists: false };\n}\n\n/** `$XDG_CONFIG_HOME`, else `<home>/.config`. Falls back to a relative `.config` with no home. */\nfunction configHome(env: NodeJS.ProcessEnv): string {\n\tconst xdg = nonEmpty(env.XDG_CONFIG_HOME);\n\tif (xdg) return xdg;\n\tconst home = nonEmpty(env.HOME) ?? nonEmpty(env.USERPROFILE);\n\treturn home ? join(home, \".config\") : \".config\";\n}\n\nfunction explicitDir(options: ConfigPathOptions): string | undefined {\n\tconst env = options.env ?? process.env;\n\treturn (\n\t\tnonEmpty(options.dir) ??\n\t\tnonEmpty(env.NEON_CONFIG_DIR) ??\n\t\tnonEmpty(env.NEONCTL_CONFIG_DIR)\n\t);\n}\n\nfunction nonEmpty(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst trimmed = value.trim();\n\treturn trimmed === \"\" ? undefined : trimmed;\n}\n\nexport const CREDENTIALS_FILE = \"credentials.json\";\n\n/**\n * Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.\n *\n * The directory was called `neonctl` until the CLI was renamed. An existing one is still read —\n * see {@link credentialsPath} — but it is never written to, moved, or deleted.\n */\nexport const defaultDir = configDir();\n\n/**\n * Where this invocation's `credentials.json` lives.\n *\n * When `--config-dir` was left at its default, an existing file in the legacy `neonctl`\n * directory is used **in place**: an install that predates the rename keeps working, and its\n * credentials are never duplicated into a second location where one copy could go stale while\n * another tool still reads it.\n *\n * A `--config-dir` the user actually passed is used exactly as given. Falling back out of an\n * explicitly chosen directory would defeat the reason for choosing it — a CI run pointed at a\n * scratch directory must never pick up a developer's real credentials.\n */\nexport const credentialsPath = (dir: string): string =>\n\tresolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;\n\n/**\n * Whether a credentials file is one the CLI created, rather than a path a profile adopted.\n *\n * Anything that deletes a credential has to ask this first. A profile entry may point anywhere —\n * that is what makes adopting an existing directory a one-line edit — and a file we did not\n * create is not ours to remove.\n */\nexport const isInsideConfigDir = (\n\tconfigDirectory: string,\n\tfile: string,\n): boolean => `${resolve(file)}/`.startsWith(`${resolve(configDirectory)}/`);\n\n/**\n * Whether a credentials file is one the CLI owns, counting the legacy `neonctl` directory.\n *\n * {@link credentialsPath} deliberately reads an existing legacy file in place rather than\n * migrating it, so for a default config directory that file is ours even though it sits outside\n * `neon/`. Judging ownership on the current directory alone would call an install that predates\n * the rename \"adopted\".\n */\nexport const isOwnedCredentialPath = (\n\tconfigDirectory: string,\n\tfile: string,\n): boolean => {\n\tif (isInsideConfigDir(configDirectory, file)) return true;\n\tif (configDirectory !== defaultDir) return false;\n\tconst legacy = legacyConfigDir();\n\treturn legacy !== undefined && isInsideConfigDir(legacy, file);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAa,kBAAkB;;AAG/B,MAAa,yBAAyB;;AAatC,SAAgB,UAAU,UAA6B,CAAC,GAAW;CAClE,MAAM,WAAW,YAAY,OAAO;CACpC,IAAI,UAAU,OAAO;CACrB,OAAO,KAAK,WAAW,QAAQ,OAAO,QAAQ,GAAG,GAAG,eAAe;AACpE;;;;;AAMA,SAAgB,gBACf,UAA6B,CAAC,GACT;CACrB,IAAI,YAAY,OAAO,GAAG,OAAO,KAAA;CACjC,OAAO,KAAK,WAAW,QAAQ,OAAO,QAAQ,GAAG,GAAG,sBAAsB;AAC3E;;;;;;AAkBA,SAAgB,kBACf,UACA,UAA6B,CAAC,GACT;CACrB,MAAM,MAAM,UAAU,OAAO;CAC7B,MAAM,UAAU,QAAQ,KAAK,QAAQ;CACrC,IAAI,WAAW,OAAO,GACrB,OAAO;EAAE,MAAM;EAAS;EAAK,UAAU;EAAO,QAAQ;CAAK;CAE5D,MAAM,YAAY,gBAAgB,OAAO;CACzC,IAAI,WAAW;EACd,MAAM,SAAS,QAAQ,WAAW,QAAQ;EAC1C,IAAI,WAAW,MAAM,GACpB,OAAO;GACN,MAAM;GACN,KAAK;GACL,UAAU;GACV,QAAQ;EACT;CACF;CAEA,OAAO;EAAE,MAAM;EAAS;EAAK,UAAU;EAAO,QAAQ;CAAM;AAC7D;;AAGA,SAAS,WAAW,KAAgC;CACnD,MAAM,MAAM,SAAS,IAAI,eAAe;CACxC,IAAI,KAAK,OAAO;CAChB,MAAM,OAAO,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW;CAC3D,OAAO,OAAO,KAAK,MAAM,SAAS,IAAI;AACvC;AAEA,SAAS,YAAY,SAAgD;CACpE,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,OACC,SAAS,QAAQ,GAAG,KACpB,SAAS,IAAI,eAAe,KAC5B,SAAS,IAAI,kBAAkB;AAEjC;AAEA,SAAS,SAAS,OAA+C;CAChE,IAAI,OAAO,UAAU,UAAU,OAAO,KAAA;CACtC,MAAM,UAAU,MAAM,KAAK;CAC3B,OAAO,YAAY,KAAK,KAAA,IAAY;AACrC;AAEA,MAAa,mBAAmB;;;;;;;AAQhC,MAAa,aAAa,UAAU;;;;;;;;;;;;;AAcpC,MAAa,mBAAmB,QAC/B,kBAAkB,kBAAkB,QAAQ,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;;;;;;;;AASxE,MAAa,qBACZ,iBACA,SACa,GAAG,QAAQ,IAAI,EAAE,GAAG,WAAW,GAAG,QAAQ,eAAe,EAAE,EAAE;;;;;;;;;AAU3E,MAAa,yBACZ,iBACA,SACa;CACb,IAAI,kBAAkB,iBAAiB,IAAI,GAAG,OAAO;CACrD,IAAI,oBAAoB,YAAY,OAAO;CAC3C,MAAM,SAAS,gBAAgB;CAC/B,OAAO,WAAW,KAAA,KAAa,kBAAkB,QAAQ,IAAI;AAC9D"}