@theholocron/holocron-plugin-neon 2.0.0-alpha.0 → 2.0.0-alpha.10

package/README.md

@@ -3,6 +3,12 @@
 Neon plugin for [Holocron](../cli). Implements the `storage`
 capability against [Neon's REST API](https://api-docs.neon.tech/reference/getting-started-with-neon-api).
 
+## Install
+
+```bash
+pnpm add -D @theholocron/holocron-plugin-neon@alpha
+```
+
 ## Auth
 
 Token resolution order:
@@ -15,25 +21,25 @@ Token resolution order:
 
 ```jsonc
 {
-  "providers": {
-    "storage": ["neon", { "projectId": "ancient-resonance-…" }]
-  }
+	"providers": {
+		"storage": ["neon", { "projectId": "ancient-resonance-…" }],
+	},
 }
 ```
 
 - `projectId` (required) — the Neon project id. The plugin binds to
-  this project; every method operates within it.
+	this project; every method operates within it.
 
 ## What's implemented
 
-| Method                  | What it does                                              |
-| ----------------------- | --------------------------------------------------------- |
-| `getConnectionString`   | Fetches the connection URI for a branch. `pooled: true` returns the PgBouncer URL. |
-| `listBranches`          | All branches on the bound project.                        |
-| `createBranch`          | Provisions a branch + a read_write compute endpoint inline (so the next connection-string call doesn't 404). |
-| `destroyBranch`         | DELETEs a branch.                                         |
-| `resetBranch`           | Restores one branch to match another (Neon "restore branch" endpoint). |
-| `enableExtension`       | Runs `CREATE EXTENSION IF NOT EXISTS "..."` against the branch's default database via Neon's run_sql endpoint. Used for PostGIS, pgvector, etc. |
+| Method                | What it does                                                                                                                                    |
+| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| `getConnectionString` | Fetches the connection URI for a branch. `pooled: true` returns the PgBouncer URL.                                                              |
+| `listBranches`        | All branches on the bound project.                                                                                                              |
+| `createBranch`        | Provisions a branch + a read_write compute endpoint inline (so the next connection-string call doesn't 404).                                    |
+| `destroyBranch`       | DELETEs a branch.                                                                                                                               |
+| `resetBranch`         | Restores one branch to match another (Neon "restore branch" endpoint).                                                                          |
+| `enableExtension`     | Runs `CREATE EXTENSION IF NOT EXISTS "..."` against the branch's default database via Neon's run_sql endpoint. Used for PostGIS, pgvector, etc. |
 
 Vercel-managed Neon orgs reject project-create at the Neon API level
 ("organization is managed by Vercel"). For those setups, provision
@@ -45,4 +51,6 @@ later).
 
 ## Status
 
-**v0.0.0 — first port.**
+**`v2.0.0-alpha.0`** — published on npm under the `alpha` dist-tag.
+[Release notes](https://github.com/theholocron/holocron/releases/tag/v2.0.0-alpha.0).
+APIs may still shift before stable v2.0.0.

package/dist/index.d.mts

@@ -4,10 +4,13 @@ import { ConnectionStringOptions, Storage, StorageBranch } from "@theholocron/cl
 /**
  * Token resolution for the Neon plugin.
  *
- * Resolution order:
+ * Resolution order (matches the standard 4-step precedence set by
+ * `.notes/tech-auth-bootstrap.spec.md`):
  *   1. explicit `cliToken` argument (from `--token` flag)
  *   2. HOLOCRON_NEON_API_KEY env var (preferred — explicit intent)
  *   3. NEON_API_KEY env var (the default Neon CLI reads)
+ *   4. keyring (com.theholocron.cli / "neon")
+ *   5. AuthError naming all four options + the bootstrap hint
  */
 declare class AuthError extends Error {
   name: string;
@@ -17,6 +20,8 @@ interface ResolveTokenInput {
   cliToken?: string;
   /** Env vars; passed in for testability. Defaults to `process.env`. */
   env?: NodeJS.ProcessEnv;
+  /** Keyring lookup fn; passed in for testability. Defaults to `getToken(provider)`. */
+  keyring?: (provider: string) => string | null;
 }
 declare function resolveToken(input?: ResolveTokenInput): string;
 //#endregion
@@ -35,7 +40,7 @@ interface RestClientOptions {
   baseUrl?: string;
 }
 interface RequestOptions {
-  method?: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+  method?: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
   body?: unknown;
   query?: Record<string, string>;
 }
@@ -80,6 +85,28 @@ declare class NeonStorage implements Storage {
   private firstDatabase;
 }
 //#endregion
+//#region src/verify-token.d.ts
+/**
+ * `verifyToken` — plugin-level export used by `holocron auth set` +
+ * `holocron auth check`. Hits Neon's `/users/me` endpoint and
+ * translates the response into the normalized `VerifyTokenResult`
+ * shape.
+ */
+interface VerifyTokenSuccess {
+  ok: true;
+  subject: string;
+}
+interface VerifyTokenFailure {
+  ok: false;
+  message: string;
+}
+type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
+interface VerifyTokenOptions {
+  baseUrl?: string;
+  fetch?: typeof fetch;
+}
+declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
+//#endregion
 //#region src/index.d.ts
 interface NeonPluginOptions extends ResolveTokenInput {
   /** Neon project id this plugin is bound to. Required. */
@@ -101,5 +128,12 @@ declare function createPlugin(options: NeonPluginOptions): {
     storage: () => Storage;
   };
 };
+/**
+ * One-line hint printed by `holocron auth set neon` when no token
+ * is supplied or the supplied token is rejected. Points operators
+ * at https://console.neon.tech/app/settings/api-keys where API keys
+ * are minted.
+ */
+declare const AUTH_HINT: string;
 //#endregion
-export { AuthError, NeonPluginOptions, NeonRestClient, NeonStorage, PluginContext, ResolveTokenInput, createContext, createPlugin, resolveToken, storage };
+export { AUTH_HINT, AuthError, NeonPluginOptions, NeonRestClient, NeonStorage, PluginContext, ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createPlugin, resolveToken, storage, verifyToken };

package/dist/index.mjs

@@ -1,20 +1,24 @@
-import { ProviderApiError } from "@theholocron/cli";
+import { ProviderApiError, getToken } from "@theholocron/cli";
 //#region src/auth.ts
 /**
 * Token resolution for the Neon plugin.
 *
-* Resolution order:
+* Resolution order (matches the standard 4-step precedence set by
+* `.notes/tech-auth-bootstrap.spec.md`):
 *   1. explicit `cliToken` argument (from `--token` flag)
 *   2. HOLOCRON_NEON_API_KEY env var (preferred — explicit intent)
 *   3. NEON_API_KEY env var (the default Neon CLI reads)
+*   4. keyring (com.theholocron.cli / "neon")
+*   5. AuthError naming all four options + the bootstrap hint
 */
 var AuthError = class extends Error {
 	name = "AuthError";
 };
 function resolveToken(input = {}) {
 	const env = input.env ?? process.env;
-	const token = input.cliToken || env.HOLOCRON_NEON_API_KEY || env.NEON_API_KEY;
-	if (!token) throw new AuthError("no Neon API key found. Pass --token <KEY>, or set HOLOCRON_NEON_API_KEY / NEON_API_KEY.");
+	const keyring = input.keyring ?? getToken;
+	const token = input.cliToken || env["HOLOCRON_NEON_API_KEY"] || env["NEON_API_KEY"] || keyring("neon");
+	if (!token) throw new AuthError("no Neon API key found. Pass --token <KEY>, set HOLOCRON_NEON_API_KEY / NEON_API_KEY, or run: holocron auth set neon <KEY>");
 	return token;
 }
 //#endregion
@@ -124,7 +128,9 @@ var NeonRestClient = class {
 	constructor(opts) {
 		this.token = opts.token;
 		this.fetchImpl = opts.fetch ?? globalThis.fetch;
-		this.baseUrl = (opts.baseUrl ?? "https://console.neon.tech/api/v2").replace(/\/+$/, "");
+		let url = opts.baseUrl ?? "https://console.neon.tech/api/v2";
+		while (url.endsWith("/")) url = url.slice(0, -1);
+		this.baseUrl = url;
 	}
 	async request(path, opts = {}) {
 		const url = new URL(`${this.baseUrl}${path.startsWith("/") ? path : "/" + path}`);
@@ -160,6 +166,32 @@ var NeonRestClient = class {
 	}
 };
 //#endregion
+//#region src/verify-token.ts
+/**
+* `verifyToken` — plugin-level export used by `holocron auth set` +
+* `holocron auth check`. Hits Neon's `/users/me` endpoint and
+* translates the response into the normalized `VerifyTokenResult`
+* shape.
+*/
+async function verifyToken(token, opts = {}) {
+	const restOpts = { token };
+	if (opts.baseUrl !== void 0) restOpts.baseUrl = opts.baseUrl;
+	if (opts.fetch !== void 0) restOpts.fetch = opts.fetch;
+	const rest = new NeonRestClient(restOpts);
+	try {
+		const me = await rest.request("/users/me");
+		return {
+			ok: true,
+			subject: `user @ ${me?.email ?? me?.login ?? me?.name ?? me?.id ?? "unknown"}`
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
 //#region src/index.ts
 function createContext(options) {
 	if (!options.projectId) throw new Error("@theholocron/holocron-plugin-neon requires `projectId` in options");
@@ -181,5 +213,12 @@ function createPlugin(options) {
 		capabilities: { storage: () => storage(ctx) }
 	};
 }
+/**
+* One-line hint printed by `holocron auth set neon` when no token
+* is supplied or the supplied token is rejected. Points operators
+* at https://console.neon.tech/app/settings/api-keys where API keys
+* are minted.
+*/
+const AUTH_HINT = "generate a Neon API key at https://console.neon.tech/app/settings/api-keys, then run: holocron auth set neon <KEY>";
 //#endregion
-export { AuthError, NeonRestClient, NeonStorage, createContext, createPlugin, resolveToken, storage };
+export { AUTH_HINT, AuthError, NeonRestClient, NeonStorage, createContext, createPlugin, resolveToken, storage, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-neon",
-  "version": "2.0.0-alpha.0",
+  "version": "2.0.0-alpha.10",
   "description": "Holocron plugin for Neon. Implements the storage capability against Neon's REST API — branch ops, connection strings, extensions.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-neon#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -21,7 +21,7 @@
     }
   },
   "peerDependencies": {
-    "@theholocron/cli": "2.0.0-alpha.0"
+    "@theholocron/cli": "2.0.0-alpha.10"
   },
   "devDependencies": {
     "@theholocron/tsconfig": "^4.1.0",
@@ -32,7 +32,8 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.6",
     "tsdown": "^0.22.3",
-    "@theholocron/cli": "2.0.0-alpha.0"
+    "tsx": "^4.22.4",
+    "@theholocron/cli": "2.0.0-alpha.10"
   },
   "publishConfig": {
     "access": "public"
@@ -47,7 +48,8 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
+    "test:coverage": "vitest run --coverage",
+    "validate": "tsx scripts/validate.mjs"
   },
   "types": "./dist/index.d.mts"
 }