@theholocron/holocron-plugin-neon 2.0.0-alpha.1 → 2.0.0-alpha.5

package/dist/index.d.mts

@@ -4,10 +4,13 @@ import { ConnectionStringOptions, Storage, StorageBranch } from "@theholocron/cl
 /**
  * Token resolution for the Neon plugin.
  *
- * Resolution order:
+ * Resolution order (matches the standard 4-step precedence set by
+ * `.notes/tech-auth-bootstrap.spec.md`):
  *   1. explicit `cliToken` argument (from `--token` flag)
  *   2. HOLOCRON_NEON_API_KEY env var (preferred — explicit intent)
  *   3. NEON_API_KEY env var (the default Neon CLI reads)
+ *   4. keyring (com.theholocron.cli / "neon")
+ *   5. AuthError naming all four options + the bootstrap hint
  */
 declare class AuthError extends Error {
   name: string;
@@ -17,6 +20,8 @@ interface ResolveTokenInput {
   cliToken?: string;
   /** Env vars; passed in for testability. Defaults to `process.env`. */
   env?: NodeJS.ProcessEnv;
+  /** Keyring lookup fn; passed in for testability. Defaults to `getToken(provider)`. */
+  keyring?: (provider: string) => string | null;
 }
 declare function resolveToken(input?: ResolveTokenInput): string;
 //#endregion
@@ -80,6 +85,28 @@ declare class NeonStorage implements Storage {
   private firstDatabase;
 }
 //#endregion
+//#region src/verify-token.d.ts
+/**
+ * `verifyToken` — plugin-level export used by `holocron auth set` +
+ * `holocron auth check`. Hits Neon's `/users/me` endpoint and
+ * translates the response into the normalized `VerifyTokenResult`
+ * shape.
+ */
+interface VerifyTokenSuccess {
+  ok: true;
+  subject: string;
+}
+interface VerifyTokenFailure {
+  ok: false;
+  message: string;
+}
+type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
+interface VerifyTokenOptions {
+  baseUrl?: string;
+  fetch?: typeof fetch;
+}
+declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
+//#endregion
 //#region src/index.d.ts
 interface NeonPluginOptions extends ResolveTokenInput {
   /** Neon project id this plugin is bound to. Required. */
@@ -101,5 +128,12 @@ declare function createPlugin(options: NeonPluginOptions): {
     storage: () => Storage;
   };
 };
+/**
+ * One-line hint printed by `holocron auth set neon` when no token
+ * is supplied or the supplied token is rejected. Points operators
+ * at https://console.neon.tech/app/settings/api-keys where API keys
+ * are minted.
+ */
+declare const AUTH_HINT: string;
 //#endregion
-export { AuthError, NeonPluginOptions, NeonRestClient, NeonStorage, PluginContext, ResolveTokenInput, createContext, createPlugin, resolveToken, storage };
+export { AUTH_HINT, AuthError, NeonPluginOptions, NeonRestClient, NeonStorage, PluginContext, ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createPlugin, resolveToken, storage, verifyToken };

package/dist/index.mjs

@@ -1,20 +1,24 @@
-import { ProviderApiError } from "@theholocron/cli";
+import { ProviderApiError, getToken } from "@theholocron/cli";
 //#region src/auth.ts
 /**
 * Token resolution for the Neon plugin.
 *
-* Resolution order:
+* Resolution order (matches the standard 4-step precedence set by
+* `.notes/tech-auth-bootstrap.spec.md`):
 *   1. explicit `cliToken` argument (from `--token` flag)
 *   2. HOLOCRON_NEON_API_KEY env var (preferred — explicit intent)
 *   3. NEON_API_KEY env var (the default Neon CLI reads)
+*   4. keyring (com.theholocron.cli / "neon")
+*   5. AuthError naming all four options + the bootstrap hint
 */
 var AuthError = class extends Error {
 	name = "AuthError";
 };
 function resolveToken(input = {}) {
 	const env = input.env ?? process.env;
-	const token = input.cliToken || env.HOLOCRON_NEON_API_KEY || env.NEON_API_KEY;
-	if (!token) throw new AuthError("no Neon API key found. Pass --token <KEY>, or set HOLOCRON_NEON_API_KEY / NEON_API_KEY.");
+	const keyring = input.keyring ?? getToken;
+	const token = input.cliToken || env["HOLOCRON_NEON_API_KEY"] || env["NEON_API_KEY"] || keyring("neon");
+	if (!token) throw new AuthError("no Neon API key found. Pass --token <KEY>, set HOLOCRON_NEON_API_KEY / NEON_API_KEY, or run: holocron auth set neon <KEY>");
 	return token;
 }
 //#endregion
@@ -162,6 +166,32 @@ var NeonRestClient = class {
 	}
 };
 //#endregion
+//#region src/verify-token.ts
+/**
+* `verifyToken` — plugin-level export used by `holocron auth set` +
+* `holocron auth check`. Hits Neon's `/users/me` endpoint and
+* translates the response into the normalized `VerifyTokenResult`
+* shape.
+*/
+async function verifyToken(token, opts = {}) {
+	const restOpts = { token };
+	if (opts.baseUrl !== void 0) restOpts.baseUrl = opts.baseUrl;
+	if (opts.fetch !== void 0) restOpts.fetch = opts.fetch;
+	const rest = new NeonRestClient(restOpts);
+	try {
+		const me = await rest.request("/users/me");
+		return {
+			ok: true,
+			subject: `user @ ${me?.email ?? me?.login ?? me?.name ?? me?.id ?? "unknown"}`
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
 //#region src/index.ts
 function createContext(options) {
 	if (!options.projectId) throw new Error("@theholocron/holocron-plugin-neon requires `projectId` in options");
@@ -183,5 +213,12 @@ function createPlugin(options) {
 		capabilities: { storage: () => storage(ctx) }
 	};
 }
+/**
+* One-line hint printed by `holocron auth set neon` when no token
+* is supplied or the supplied token is rejected. Points operators
+* at https://console.neon.tech/app/settings/api-keys where API keys
+* are minted.
+*/
+const AUTH_HINT = "generate a Neon API key at https://console.neon.tech/app/settings/api-keys, then run: holocron auth set neon <KEY>";
 //#endregion
-export { AuthError, NeonRestClient, NeonStorage, createContext, createPlugin, resolveToken, storage };
+export { AUTH_HINT, AuthError, NeonRestClient, NeonStorage, createContext, createPlugin, resolveToken, storage, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-neon",
-  "version": "2.0.0-alpha.1",
+  "version": "2.0.0-alpha.5",
   "description": "Holocron plugin for Neon. Implements the storage capability against Neon's REST API — branch ops, connection strings, extensions.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/holocron-plugin-neon#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -21,7 +21,7 @@
     }
   },
   "peerDependencies": {
-    "@theholocron/cli": "2.0.0-alpha.1"
+    "@theholocron/cli": "2.0.0-alpha.5"
   },
   "devDependencies": {
     "@theholocron/tsconfig": "^4.1.0",
@@ -32,7 +32,8 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.6",
     "tsdown": "^0.22.3",
-    "@theholocron/cli": "2.0.0-alpha.1"
+    "tsx": "^4.22.4",
+    "@theholocron/cli": "2.0.0-alpha.5"
   },
   "publishConfig": {
     "access": "public"
@@ -47,7 +48,8 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage"
+    "test:coverage": "vitest run --coverage",
+    "validate": "tsx scripts/validate.mjs"
   },
   "types": "./dist/index.d.mts"
 }