neon 3.0.0 → 3.1.0

package/dist/_shared/profiles.js

@@ -1,276 +1,226 @@
-/**
- * # Profiles — several Neon accounts in one config directory
- *
- * A profile is **a pointer to a credentials file**. Nothing more. That constraint is what
- * keeps the feature small: there is no mirror, no per-profile directory tree, no persistent
- * "active profile" state to fall out of sync, and no migration.
- *
- * ```
- * ~/.config/neon/
- * ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
- * ├── credentials.work.json     # created by `neon auth --profile work`
- * └── profiles.json             # created only once a second profile exists
- * ```
- *
- * `profiles.json` maps a name to a path, and the path may point anywhere — which is what
- * makes adopting an existing directory a one-line edit rather than an import command:
- *
- * ```json
- * {
- *   "version": 1,
- *   "profiles": {
- *     "DEFAULT": { "credentials": "credentials.json" },
- *     "work": {
- *       "credentials": "../neonctl-databricks/credentials.json",
- *       "label": "someone@example.com"
- *     }
- *   }
- * }
- * ```
- *
- * ## Selection
- *
- * `--profile` → `NEON_PROFILE` → `DEFAULT`. Per invocation, like `AWS_PROFILE`; there is no
- * `profile use` command, so nothing persists that could disagree with what you typed.
- *
- * ## Compatibility
- *
- * An install with no `profiles.json` is already a valid `DEFAULT`-only state: `DEFAULT`
- * resolves to `credentials.json` in the config directory (including an existing one in the
- * legacy `neonctl` directory — see `./paths.ts`). Nothing is created until a second
- * profile is, and nothing is ever moved.
- */
+import { writeSecretFile } from "./secure_file.js";
+import { credentialsPath, defaultDir, resolveConfigFile } from "./paths.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
-import { credentialsPath, defaultDir, resolveConfigFile } from "./paths.js";
-import { writeSecretFile } from "./secure_file.js";
-export const PROFILES_FILE = "profiles.json";
+//#region src/_shared/profiles.ts
+/**
+* # Profiles — several Neon accounts in one config directory
+*
+* A profile is **a pointer to a credentials file**. Nothing more. That constraint is what
+* keeps the feature small: there is no mirror, no per-profile directory tree, no persistent
+* "active profile" state to fall out of sync, and no migration.
+*
+* ```
+* ~/.config/neon/
+* ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
+* ├── credentials.work.json     # created by `neon auth --profile work`
+* └── profiles.json             # created only once a second profile exists
+* ```
+*
+* `profiles.json` maps a name to a path, and the path may point anywhere — which is what
+* makes adopting an existing directory a one-line edit rather than an import command:
+*
+* ```json
+* {
+*   "version": 1,
+*   "profiles": {
+*     "DEFAULT": { "credentials": "credentials.json" },
+*     "work": {
+*       "credentials": "../neonctl-databricks/credentials.json",
+*       "label": "someone@example.com"
+*     }
+*   }
+* }
+* ```
+*
+* ## Selection
+*
+* `--profile` → `NEON_PROFILE` → `DEFAULT`. Per invocation, like `AWS_PROFILE`; there is no
+* `profile use` command, so nothing persists that could disagree with what you typed.
+*
+* ## Compatibility
+*
+* An install with no `profiles.json` is already a valid `DEFAULT`-only state: `DEFAULT`
+* resolves to `credentials.json` in the config directory (including an existing one in the
+* legacy `neonctl` directory — see `./paths.ts`). Nothing is created until a second
+* profile is, and nothing is ever moved.
+*/
+const PROFILES_FILE = "profiles.json";
 /** The implicit profile. Backed by plain `credentials.json`, with or without a profiles file. */
-export const DEFAULT_PROFILE = "DEFAULT";
+const DEFAULT_PROFILE = "DEFAULT";
 /** Profile names become part of a filename, so keep them boring. */
 const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 /** Which profile this invocation should use: `--profile` → `NEON_PROFILE` → `DEFAULT`. */
-export const selectProfileName = (flag, env = process.env) => nonEmpty(flag) ?? nonEmpty(env.NEON_PROFILE) ?? DEFAULT_PROFILE;
-export const assertValidProfileName = (name) => {
-    if (!NAME_PATTERN.test(name)) {
-        throw new Error(`Invalid profile name "${name}". Use letters, digits, dot, dash or underscore, starting with a letter or digit.`);
-    }
+const selectProfileName = (flag, env = process.env) => nonEmpty(flag) ?? nonEmpty(env.NEON_PROFILE) ?? "DEFAULT";
+const assertValidProfileName = (name) => {
+	if (!NAME_PATTERN.test(name)) throw new Error(`Invalid profile name "${name}". Use letters, digits, dot, dash or underscore, starting with a letter or digit.`);
 };
 /** Where `profiles.json` lives for this config directory (whether or not it exists yet). */
-export const profilesFilePath = (dir) => resolveConfigFile(PROFILES_FILE, dir === defaultDir ? {} : { dir }).path;
+const profilesFilePath = (dir) => resolveConfigFile(PROFILES_FILE, dir === defaultDir ? {} : { dir }).path;
 /**
- * Read and classify `profiles.json` without deciding what to do about it.
- *
- * Entry keys and shapes are validated here rather than at each use. A key is a profile name,
- * and a name that `assertValidProfileName` would reject cannot have been written by this CLI —
- * it would travel into error messages as a recovery command nobody can run, and into a
- * `credentials.<name>.json` filename.
- */
-export const inspectProfiles = (dir) => {
-    const path = profilesFilePath(dir);
-    if (!existsSync(path))
-        return { kind: "absent" };
-    const broken = (why) => ({
-        kind: "unusable",
-        reason: `${path} could not be read as a profiles file: ${why}`,
-    });
-    // Reading and parsing are separate failures with separate answers. Sharing one catch
-    // reported `EACCES` as "not valid JSON", which sends the user to edit a file that is
-    // perfectly valid and that they cannot open.
-    let contents;
-    try {
-        contents = readFileSync(path, "utf8");
-    }
-    catch (err) {
-        const code = err.code;
-        return broken(code ? `reading it failed with ${code}` : "reading it failed");
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(contents);
-    }
-    catch {
-        return broken("it is not valid JSON");
-    }
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-        return broken("it does not contain an object");
-    const profiles = parsed.profiles;
-    if (profiles === null ||
-        typeof profiles !== "object" ||
-        Array.isArray(profiles))
-        return broken("it has no `profiles` object");
-    for (const [name, entry] of Object.entries(profiles)) {
-        if (!NAME_PATTERN.test(name))
-            return broken(`"${name}" is not a valid profile name`);
-        if (entry === null ||
-            typeof entry !== "object" ||
-            typeof entry.credentials !== "string" ||
-            entry.credentials.trim() === "") {
-            return broken(`profile "${name}" has no \`credentials\` path`);
-        }
-    }
-    return { kind: "ok", file: { version: 1, profiles } };
+* Read and classify `profiles.json` without deciding what to do about it.
+*
+* Entry keys and shapes are validated here rather than at each use. A key is a profile name,
+* and a name that `assertValidProfileName` would reject cannot have been written by this CLI —
+* it would travel into error messages as a recovery command nobody can run, and into a
+* `credentials.<name>.json` filename.
+*/
+const inspectProfiles = (dir) => {
+	const path = profilesFilePath(dir);
+	if (!existsSync(path)) return { kind: "absent" };
+	const broken = (why) => ({
+		kind: "unusable",
+		reason: `${path} could not be read as a profiles file: ${why}`
+	});
+	let contents;
+	try {
+		contents = readFileSync(path, "utf8");
+	} catch (err) {
+		const code = err.code;
+		return broken(code ? `reading it failed with ${code}` : "reading it failed");
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(contents);
+	} catch {
+		return broken("it is not valid JSON");
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return broken("it does not contain an object");
+	const profiles = parsed.profiles;
+	if (profiles === null || typeof profiles !== "object" || Array.isArray(profiles)) return broken("it has no `profiles` object");
+	for (const [name, entry] of Object.entries(profiles)) {
+		if (!NAME_PATTERN.test(name)) return broken(`"${name}" is not a valid profile name`);
+		if (entry === null || typeof entry !== "object" || typeof entry.credentials !== "string" || entry.credentials.trim() === "") return broken(`profile "${name}" has no \`credentials\` path`);
+	}
+	return {
+		kind: "ok",
+		file: {
+			version: 1,
+			profiles
+		}
+	};
 };
 /**
- * Read `profiles.json`, or `null` when there is nothing usable there.
- *
- * A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
- * worst case is a named profile turning up missing, which is recoverable — whereas throwing
- * would lock the user out of `neon auth` itself. Writing is the opposite: see
- * {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
- */
-export const readProfiles = (dir, 
-/** Called with the reason a profiles file was ignored. The consumer owns how it reports. */
-onWarn = () => { }) => {
-    const read = inspectProfiles(dir);
-    if (read.kind === "ok")
-        return read.file;
-    if (read.kind === "unusable")
-        onWarn(read.reason);
-    return null;
+* Read `profiles.json`, or `null` when there is nothing usable there.
+*
+* A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
+* worst case is a named profile turning up missing, which is recoverable — whereas throwing
+* would lock the user out of `neon auth` itself. Writing is the opposite: see
+* {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
+*/
+const readProfiles = (dir, onWarn = () => {}) => {
+	const read = inspectProfiles(dir);
+	if (read.kind === "ok") return read.file;
+	if (read.kind === "unusable") onWarn(read.reason);
+	return null;
 };
 /**
- * Refuse to act on a named profile when the file that defines it cannot be read.
- *
- * Call this **before** anything that writes a credential, opens a browser, or spends an API
- * call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
- * overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon auth
- * --profile` has already signed in over it — a refusal that arrives after the destruction it
- * exists to prevent. The path resolution itself is the unsound part, since with the metadata
- * unreadable the conventional filename is a guess about which account that file belongs to.
- *
- * `DEFAULT` is exempt: it is defined by the absence of metadata rather than by an entry, so
- * signing in normally must keep working while a broken `profiles.json` is repaired.
- */
-export const assertProfilesUsable = (dir, name) => {
-    if (name === DEFAULT_PROFILE)
-        return;
-    const read = inspectProfiles(dir);
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. Fix or delete the file before working with profile "${name}" — it is the only record of where each account's credentials live.`);
-    }
+* Refuse to act on a named profile when the file that defines it cannot be read.
+*
+* Call this **before** anything that writes a credential, opens a browser, or spends an API
+* call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
+* overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon auth
+* --profile` has already signed in over it — a refusal that arrives after the destruction it
+* exists to prevent. The path resolution itself is the unsound part, since with the metadata
+* unreadable the conventional filename is a guess about which account that file belongs to.
+*
+* `DEFAULT` is exempt: it is defined by the absence of metadata rather than by an entry, so
+* signing in normally must keep working while a broken `profiles.json` is repaired.
+*/
+const assertProfilesUsable = (dir, name) => {
+	if (name === "DEFAULT") return;
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file before working with profile "${name}" — it is the only record of where each account's credentials live.`);
 };
 /** Resolve a profile to an absolute credentials path. Throws when a named profile is unknown. */
-export const resolveProfile = (dir, name) => {
-    const read = inspectProfiles(dir);
-    // A broken file must not be reported as `Unknown profile "work"`. That names the wrong
-    // problem, and the user goes looking for a profile they can see in the file in front of them.
-    if (read.kind === "unusable" && name !== DEFAULT_PROFILE) {
-        throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
-    }
-    const file = read.kind === "ok" ? read.file : null;
-    const entry = file?.profiles[name];
-    if (entry) {
-        return {
-            name,
-            credentialsPath: resolveEntryPath(dir, entry.credentials),
-            ...(entry.label ? { label: entry.label } : {}),
-            ...(entry.userId ? { userId: entry.userId } : {}),
-            declared: true,
-        };
-    }
-    // DEFAULT works with no profiles.json at all, and keeps working when one exists but
-    // doesn't mention it — that is the pre-profiles behaviour, unchanged.
-    if (name === DEFAULT_PROFILE) {
-        return {
-            name,
-            credentialsPath: credentialsPath(dir),
-            declared: false,
-        };
-    }
-    const known = file
-        ? Object.keys(file.profiles).join(", ")
-        : DEFAULT_PROFILE;
-    throw new Error(`Unknown profile "${name}". Known profiles: ${known}. Create it with \`neon profile create ${name}\`.`);
+const resolveProfile = (dir, name) => {
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable" && name !== "DEFAULT") throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
+	const file = read.kind === "ok" ? read.file : null;
+	const entry = file?.profiles[name];
+	if (entry) return {
+		name,
+		credentialsPath: resolveEntryPath(dir, entry.credentials),
+		...entry.label ? { label: entry.label } : {},
+		...entry.userId ? { userId: entry.userId } : {},
+		declared: true
+	};
+	if (name === "DEFAULT") return {
+		name,
+		credentialsPath: credentialsPath(dir),
+		declared: false
+	};
+	const known = file ? Object.keys(file.profiles).join(", ") : DEFAULT_PROFILE;
+	throw new Error(`Unknown profile "${name}". Known profiles: ${known}. Create it with \`neon profile create ${name}\`.`);
 };
 /** Default location for a new named profile's credentials file. */
-export const newProfileCredentialsPath = (dir, name) => resolve(dir, `credentials.${name}.json`);
+const newProfileCredentialsPath = (dir, name) => resolve(dir, `credentials.${name}.json`);
 /**
- * Record a profile, creating `profiles.json` if this is the first named one.
- *
- * When the file is created, `DEFAULT` is written explicitly and pointed at wherever
- * `credentials.json` actually is. That matters for an install predating the directory
- * rename: `profiles.json` is created in `neon/` while the credentials are still in
- * `neonctl/`, so `DEFAULT` is recorded as `../neonctl/credentials.json` rather than a
- * relative name that would resolve to a file that isn't there.
- */
-export const upsertProfile = (dir, name, entry) => {
-    assertValidProfileName(name);
-    const path = profilesFilePath(dir);
-    const read = inspectProfiles(dir);
-    // Refusing is the point. Treating a broken file as absent here rebuilt it from a single
-    // `DEFAULT` entry and dropped every named profile in it — silent data loss, in the file
-    // that is the only record of where each account's credentials live. The credentials
-    // themselves survive, so fixing the file by hand recovers everything.
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. Refusing to rewrite it, because doing so would discard the profiles it defines. Fix or delete the file, then re-run.`);
-    }
-    const file = read.kind === "ok"
-        ? read.file
-        : {
-            version: 1,
-            profiles: {
-                [DEFAULT_PROFILE]: {
-                    credentials: relativeToProfiles(path, credentialsPath(dir)),
-                },
-            },
-        };
-    file.profiles[name] = {
-        credentials: relativeToProfiles(path, entry.credentials),
-        ...(entry.label ? { label: entry.label } : {}),
-        ...(entry.userId ? { userId: entry.userId } : {}),
-    };
-    writeProfiles(path, file);
+* Record a profile, creating `profiles.json` if this is the first named one.
+*
+* When the file is created, `DEFAULT` is written explicitly and pointed at wherever
+* `credentials.json` actually is. That matters for an install predating the directory
+* rename: `profiles.json` is created in `neon/` while the credentials are still in
+* `neonctl/`, so `DEFAULT` is recorded as `../neonctl/credentials.json` rather than a
+* relative name that would resolve to a file that isn't there.
+*/
+const upsertProfile = (dir, name, entry) => {
+	assertValidProfileName(name);
+	const path = profilesFilePath(dir);
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Refusing to rewrite it, because doing so would discard the profiles it defines. Fix or delete the file, then re-run.`);
+	const file = read.kind === "ok" ? read.file : {
+		version: 1,
+		profiles: { [DEFAULT_PROFILE]: { credentials: relativeToProfiles(path, credentialsPath(dir)) } }
+	};
+	file.profiles[name] = {
+		credentials: relativeToProfiles(path, entry.credentials),
+		...entry.label ? { label: entry.label } : {},
+		...entry.userId ? { userId: entry.userId } : {}
+	};
+	writeProfiles(path, file);
 };
 /** Remove an entry. Returns false when it wasn't there. */
-export const removeProfileEntry = (dir, name) => {
-    const path = profilesFilePath(dir);
-    const file = readProfiles(dir);
-    if (!file?.profiles[name])
-        return false;
-    delete file.profiles[name];
-    writeProfiles(path, file);
-    return true;
+const removeProfileEntry = (dir, name) => {
+	const path = profilesFilePath(dir);
+	const file = readProfiles(dir);
+	if (!file?.profiles[name]) return false;
+	delete file.profiles[name];
+	writeProfiles(path, file);
+	return true;
 };
 /**
- * True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
- * lazy creation: a single-account install has no profiles file, before or after.
- */
-export const onlyDefaultRemains = (file) => {
-    const names = Object.keys(file.profiles);
-    return (names.length === 0 ||
-        (names.length === 1 && names[0] === DEFAULT_PROFILE));
+* True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
+* lazy creation: a single-account install has no profiles file, before or after.
+*/
+const onlyDefaultRemains = (file) => {
+	const names = Object.keys(file.profiles);
+	return names.length === 0 || names.length === 1 && names[0] === "DEFAULT";
 };
-export const listProfiles = (dir) => {
-    const read = inspectProfiles(dir);
-    // Listing is the command run to find out what is there, so a broken file is the answer
-    // rather than an obstacle. Showing only `DEFAULT` would state, as fact, that the profiles
-    // in that file do not exist.
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
-    }
-    const file = read.kind === "ok" ? read.file : null;
-    if (!file)
-        return [resolveProfile(dir, DEFAULT_PROFILE)];
-    const names = Object.keys(file.profiles);
-    if (!names.includes(DEFAULT_PROFILE))
-        names.unshift(DEFAULT_PROFILE);
-    return names.map((name) => resolveProfile(dir, name));
+const listProfiles = (dir) => {
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
+	const file = read.kind === "ok" ? read.file : null;
+	if (!file) return [resolveProfile(dir, DEFAULT_PROFILE)];
+	const names = Object.keys(file.profiles);
+	if (!names.includes("DEFAULT")) names.unshift(DEFAULT_PROFILE);
+	return names.map((name) => resolveProfile(dir, name));
 };
 const writeProfiles = (path, file) => {
-    writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
+	writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
 };
 const resolveEntryPath = (dir, entry) => isAbsolute(entry) ? entry : resolve(profilesDir(dir), entry);
 /** `profiles.json` may sit in the legacy directory, so entries resolve against its own dir. */
 const profilesDir = (dir) => resolve(profilesFilePath(dir), "..");
 /** Keep entries relative when they sit near `profiles.json`; absolute paths stay absolute. */
 const relativeToProfiles = (profilesPath, target) => {
-    const rel = relative(resolve(profilesPath, ".."), target);
-    return rel && !isAbsolute(rel) ? rel : target;
+	const rel = relative(resolve(profilesPath, ".."), target);
+	return rel && !isAbsolute(rel) ? rel : target;
 };
 function nonEmpty(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed === "" ? undefined : trimmed;
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
 }
+//#endregion
+export { DEFAULT_PROFILE, PROFILES_FILE, assertProfilesUsable, assertValidProfileName, inspectProfiles, listProfiles, newProfileCredentialsPath, onlyDefaultRemains, profilesFilePath, readProfiles, removeProfileEntry, resolveProfile, selectProfileName, upsertProfile };

package/dist/_shared/secure_file.js

@@ -1,43 +1,41 @@
 import { renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
+//#region src/_shared/secure_file.ts
 /** Owner read/write. A credential needs those two and nothing else. */
-export const SECRET_FILE_MODE = 0o600;
+const SECRET_FILE_MODE = 384;
 /**
- * Write a secret to disk owner-only, by creating a temporary file in the same directory and
- * renaming it over the target.
- *
- * The rename is what makes this correct rather than merely tidy. `writeFileSync`'s `mode`
- * applies only when it *creates* the file, so writing over an existing credentials file
- * leaves whatever permissions it already had — a file created `0700` by an older release
- * stays `0700` forever, and one created before a umask change stays world-readable. Renaming
- * a fresh inode into place means every write lands at {@link SECRET_FILE_MODE}, so the
- * permissions repair themselves instead of being inherited.
- *
- * It also closes the window where a reader could see the file at default permissions: the
- * temporary file is created `0600` *before* it holds the secret's final name, and `rename`
- * is atomic within a directory, so there is no moment at which the target is readable by
- * anyone else and no moment at which it is half-written.
- *
- * The temporary name carries the pid so two processes writing at once cannot collide on it.
- */
-export const writeSecretFile = (path, contents) => {
-    const directory = dirname(path);
-    const temporary = join(directory, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
-    try {
-        writeFileSync(temporary, contents, {
-            encoding: "utf8",
-            mode: SECRET_FILE_MODE,
-        });
-        renameSync(temporary, path);
-    }
-    catch (err) {
-        // Never leave the secret behind under a temporary name the caller doesn't know about.
-        try {
-            unlinkSync(temporary);
-        }
-        catch {
-            // The temp file was never created, or is already gone. Report the original error.
-        }
-        throw err;
-    }
+* Write a secret to disk owner-only, by creating a temporary file in the same directory and
+* renaming it over the target.
+*
+* The rename is what makes this correct rather than merely tidy. `writeFileSync`'s `mode`
+* applies only when it *creates* the file, so writing over an existing credentials file
+* leaves whatever permissions it already had — a file created `0700` by an older release
+* stays `0700` forever, and one created before a umask change stays world-readable. Renaming
+* a fresh inode into place means every write lands at {@link SECRET_FILE_MODE}, so the
+* permissions repair themselves instead of being inherited.
+*
+* It also closes the window where a reader could see the file at default permissions: the
+* temporary file is created `0600` *before* it holds the secret's final name, and `rename`
+* is atomic within a directory, so there is no moment at which the target is readable by
+* anyone else and no moment at which it is half-written.
+*
+* The temporary name carries the pid so two processes writing at once cannot collide on it.
+*/
+const writeSecretFile = (path, contents) => {
+	const directory = dirname(path);
+	const temporary = join(directory, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+	try {
+		writeFileSync(temporary, contents, {
+			encoding: "utf8",
+			mode: 384
+		});
+		renameSync(temporary, path);
+	} catch (err) {
+		try {
+			unlinkSync(temporary);
+		} catch {}
+		throw err;
+	}
 };
+//#endregion
+export { SECRET_FILE_MODE, writeSecretFile };

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll };