neon 3.0.0 → 3.1.1

package/dist/commands/auth.js

@@ -1,346 +1,301 @@
-import { createHash } from "node:crypto";
-import { existsSync, rmSync } from "node:fs";
-import { credentialInputs, displacedProfileWarning, selectCredential, } from "../_shared/auth_selection.js";
-import { API_KEY, interpretCredentials, OAUTH, readCredentials, writeCredentials, } from "../_shared/credentials.js";
-import { assertProfilesUsable, assertValidProfileName, DEFAULT_PROFILE, newProfileCredentialsPath, readProfiles, resolveProfile, selectProfileName, upsertProfile, } from "../_shared/profiles.js";
-import { getApiClient } from "../api.js";
-import { auth, refreshToken } from "../auth.js";
-import { setAuthContext } from "../auth_context.js";
-import { credentialsPath as defaultCredentialsPath } from "../config.js";
-import { isConfigInit, isCurrentBranchProbe, isProfileCommand, } from "../context.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { d as writeCredentials, l as readCredentials, n as OAUTH, s as interpretCredentials, t as API_KEY } from "../_chunks/credentials-MYdHdKah.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
+import { getApiClient } from "../api.js";
+import { n as credentialsPath } from "../_chunks/paths-DMq0Lt7a.js";
+import "../config.js";
+import { setAuthContext } from "../auth_context.js";
+import { isConfigInit, isCurrentBranchProbe, isProfileCommand } from "../context.js";
 import { extendTokenSet } from "../utils/auth.js";
+import { auth, refreshToken } from "../auth.js";
+import { a as newProfileCredentialsPath, c as readProfiles, d as upsertProfile, l as resolveProfile, n as assertProfilesUsable, r as assertValidProfileName, t as DEFAULT_PROFILE, u as selectProfileName } from "../_chunks/profiles-Ir29rqns.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
+import { existsSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
+//#region src/commands/auth.ts
+var auth_exports = /* @__PURE__ */ __exportAll({
+	aliases: () => aliases,
+	authFlow: () => authFlow,
+	builder: () => builder,
+	command: () => command,
+	credentialsPathForName: () => credentialsPathForName,
+	deleteCredentialsAt: () => deleteCredentialsAt,
+	describe: () => describe,
+	ensureAuth: () => ensureAuth,
+	handler: () => handler,
+	usableCredential: () => usableCredential
+});
 /**
- * The credentials file a named profile resolves to, falling back to plain `credentials.json`
- * when the name is `DEFAULT` and nothing is declared. An unknown profile name is a hard error
- * rather than a silent write to the default file — a typo must not authenticate the wrong
- * account.
- */
-export const credentialsPathForName = (configDir, name) => {
-    if (name === DEFAULT_PROFILE && !readProfiles(configDir, log.warning))
-        return defaultCredentialsPath(configDir);
-    return resolveProfile(configDir, name).credentialsPath;
+* The credentials file a named profile resolves to, falling back to plain `credentials.json`
+* when the name is `DEFAULT` and nothing is declared. An unknown profile name is a hard error
+* rather than a silent write to the default file — a typo must not authenticate the wrong
+* account.
+*/
+const credentialsPathForName = (configDir, name) => {
+	if (name === "DEFAULT" && !readProfiles(configDir, log.warning)) return credentialsPath(configDir);
+	return resolveProfile(configDir, name).credentialsPath;
 };
-const credentialsPathFor = ({ configDir, profile, }) => credentialsPathForName(configDir, selectProfileName(profile));
-export const command = "auth";
-export const aliases = ["login"];
-export const describe = "Authenticate";
-export const builder = (yargs) => yargs.option("context-file", {
-    hidden: true,
-});
-export const handler = async (args) => {
-    await authFlow(args);
+const credentialsPathFor = ({ configDir, profile }) => credentialsPathForName(configDir, selectProfileName(profile));
+const command = "auth";
+const aliases = ["login"];
+const describe = "Authenticate";
+const builder = (yargs) => yargs.option("context-file", { hidden: true });
+const handler = async (args) => {
+	await authFlow(args);
 };
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, profile, }) => {
-    const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
-    if (!allowInteractiveAuth && isCi()) {
-        throw new Error("Cannot run interactive auth in CI");
-    }
-    // A named profile that doesn't exist yet is created here rather than erroring: `neon
-    // auth --profile work` is how you make one, so it must work before there is anything
-    // to look up.
-    const profileName = selectProfileName(profile);
-    const isNamed = profileName !== DEFAULT_PROFILE;
-    if (isNamed)
-        assertValidProfileName(profileName);
-    // Both checks belong before the browser opens. Signing in and then refusing costs a real
-    // sign-in, and worse, the write in between lands on a path chosen from metadata this
-    // refuses to trust.
-    assertProfilesUsable(configDir, profileName);
-    const tokenSet = await auth({
-        oauthHost: oauthHost,
-        clientId: clientId,
-        allowUnsafeTls,
-    });
-    const credentialsPath = isNamed && !readProfiles(configDir, log.warning)?.profiles[profileName]
-        ? newProfileCredentialsPath(configDir, profileName)
-        : credentialsPathFor({ configDir, profile });
-    let identity = {};
-    try {
-        identity = await preserveCredentials(credentialsPath, tokenSet, getApiClient({
-            apiKey: tokenSet.access_token || "",
-            apiHost,
-        }));
-    }
-    catch {
-        log.error("Failed to save credentials");
-        return "";
-    }
-    if (isNamed) {
-        upsertProfile(configDir, profileName, {
-            credentials: credentialsPath,
-            ...(identity.email ? { label: identity.email } : {}),
-            ...(identity.id ? { userId: identity.id } : {}),
-        });
-        log.info('Saved profile "%s" (%s)', profileName, credentialsPath);
-    }
-    log.info("Auth complete");
-    return tokenSet.access_token || "";
+const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, profile }) => {
+	if (!(forceAuth ?? forceAuthKebab) && isCi()) throw new Error("Cannot run interactive auth in CI");
+	const profileName = selectProfileName(profile);
+	const isNamed = profileName !== DEFAULT_PROFILE;
+	if (isNamed) assertValidProfileName(profileName);
+	assertProfilesUsable(configDir, profileName);
+	const tokenSet = await auth({
+		oauthHost,
+		clientId,
+		allowUnsafeTls
+	});
+	const credentialsPath = isNamed && !readProfiles(configDir, log.warning)?.profiles[profileName] ? newProfileCredentialsPath(configDir, profileName) : credentialsPathFor({
+		configDir,
+		profile
+	});
+	let identity = {};
+	try {
+		identity = await preserveCredentials(credentialsPath, tokenSet, getApiClient({
+			apiKey: tokenSet.access_token || "",
+			apiHost
+		}));
+	} catch {
+		log.error("Failed to save credentials");
+		return "";
+	}
+	if (isNamed) {
+		upsertProfile(configDir, profileName, {
+			credentials: credentialsPath,
+			...identity.email ? { label: identity.email } : {},
+			...identity.id ? { userId: identity.id } : {}
+		});
+		log.info("Saved profile \"%s\" (%s)", profileName, credentialsPath);
+	}
+	log.info("Auth complete");
+	return tokenSet.access_token || "";
 };
 /**
- * Persist the token set and return the account it belongs to, so a named profile can be
- * labelled with an email. The credentials file records only `user_id` — a UUID with no
- * email — which is why identifying a stored profile offline is otherwise impossible.
- */
+* Persist the token set and return the account it belongs to, so a named profile can be
+* labelled with an email. The credentials file records only `user_id` — a UUID with no
+* email — which is why identifying a stored profile offline is otherwise impossible.
+*/
 const preserveCredentials = async (path, credentials, apiClient) => {
-    const { data: { id, email }, } = await apiClient.getCurrentUserInfo();
-    // Replace rather than merge, and declare the kind. Signing in makes this an OAuth
-    // credential and nothing of a previous one is carried over: a retained API key would leave
-    // the file holding two credentials, possibly for two different accounts, with a single
-    // field deciding which one is live.
-    const stored = {
-        ...credentials,
-        type: OAUTH,
-        ...(id !== undefined ? { user_id: id } : {}),
-    };
-    writeCredentials(path, stored);
-    log.debug("Saved credentials to %s", path);
-    log.debug("Credentials MD5 hash: %s", md5hash(JSON.stringify(stored)));
-    return { ...(id ? { id } : {}), ...(email ? { email } : {}) };
+	const { data: { id, email } } = await apiClient.getCurrentUserInfo();
+	const stored = {
+		...credentials,
+		type: OAUTH,
+		...id !== void 0 ? { user_id: id } : {}
+	};
+	writeCredentials(path, stored);
+	log.debug("Saved credentials to %s", path);
+	log.debug("Credentials MD5 hash: %s", md5hash(JSON.stringify(stored)));
+	return {
+		...id ? { id } : {},
+		...email ? { email } : {}
+	};
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
-    // Use existing access_token, if present and valid
-    if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
-        log.debug("Using existing valid access_token");
-        const apiClient = getApiClient({
-            apiKey: tokenSet.access_token,
-            apiHost: props.apiHost,
-        });
-        return { apiKey: tokenSet.access_token, apiClient };
-    }
-    // Either access_token is missing or its expired. Refresh the token
-    log.debug(tokenSet.expires_at < Date.now()
-        ? "Token is expired, attempting refresh"
-        : "Token is missing access_token, attempting refresh");
-    if (!tokenSet.refresh_token) {
-        log.debug("TokenSet is missing refresh_token, starting authentication");
-        return null;
-    }
-    try {
-        const refreshedTokenSet = await refreshToken({
-            oauthHost: props.oauthHost,
-            clientId: props.clientId,
-            allowUnsafeTls: props.allowUnsafeTls,
-        }, tokenSet);
-        // Extend the token set with expires_at
-        const extendedTokenSet = extendTokenSet(refreshedTokenSet);
-        const apiKey = extendedTokenSet.access_token;
-        const apiClient = getApiClient({
-            apiKey,
-            apiHost: props.apiHost,
-        });
-        await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
-        log.debug("Token refresh successful");
-        return { apiKey, apiClient };
-    }
-    catch (err) {
-        const typedErr = err instanceof Error ? err : new Error("Unknown error");
-        log.debug("Failed to refresh token: %s", typedErr.message);
-        throw new Error("AUTH_REFRESH_FAILED");
-    }
+	if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
+		log.debug("Using existing valid access_token");
+		const apiClient = getApiClient({
+			apiKey: tokenSet.access_token,
+			apiHost: props.apiHost
+		});
+		return {
+			apiKey: tokenSet.access_token,
+			apiClient
+		};
+	}
+	log.debug(tokenSet.expires_at < Date.now() ? "Token is expired, attempting refresh" : "Token is missing access_token, attempting refresh");
+	if (!tokenSet.refresh_token) {
+		log.debug("TokenSet is missing refresh_token, starting authentication");
+		return null;
+	}
+	try {
+		const refreshedTokenSet = await refreshToken({
+			oauthHost: props.oauthHost,
+			clientId: props.clientId,
+			allowUnsafeTls: props.allowUnsafeTls
+		}, tokenSet);
+		const extendedTokenSet = extendTokenSet(refreshedTokenSet);
+		const apiKey = extendedTokenSet.access_token;
+		const apiClient = getApiClient({
+			apiKey,
+			apiHost: props.apiHost
+		});
+		await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
+		log.debug("Token refresh successful");
+		return {
+			apiKey,
+			apiClient
+		};
+	} catch (err) {
+		const typedErr = err instanceof Error ? err : /* @__PURE__ */ new Error("Unknown error");
+		log.debug("Failed to refresh token: %s", typedErr.message);
+		throw new Error("AUTH_REFRESH_FAILED");
+	}
 };
 /**
- * The credential a stored file can authenticate with right now — its API key, or an OAuth
- * access token, refreshed first when it has expired. Never launches a browser.
- *
- * The `profile` subcommands need exactly this. They deliberately skip `ensureAuth`, but
- * `rotate-key` still has to call the API as the account it is rotating, and falling through to
- * an interactive login would be authenticating something other than what the command is about.
- */
-export const usableCredential = async (props, at) => {
-    const credentialsPath = at.path;
-    const stored = readCredentials(at);
-    if (stored === null)
-        return null;
-    // A file that declares an unusable kind throws, rather than being reported as "no
-    // credential" — the user needs to know it is broken, not that it is absent.
-    const credential = interpretCredentials(stored, at);
-    if (credential.kind === API_KEY) {
-        return { apiKey: credential.apiKey, kind: API_KEY };
-    }
-    try {
-        const result = await handleExistingToken(stored, props, credentialsPath);
-        return result ? { apiKey: result.apiKey, kind: OAUTH } : null;
-    }
-    catch (err) {
-        log.debug("Could not use the stored OAuth session at %s: %s", credentialsPath, err instanceof Error ? err.message : "unknown error");
-        return null;
-    }
+* The credential a stored file can authenticate with right now — its API key, or an OAuth
+* access token, refreshed first when it has expired. Never launches a browser.
+*
+* The `profile` subcommands need exactly this. They deliberately skip `ensureAuth`, but
+* `rotate-key` still has to call the API as the account it is rotating, and falling through to
+* an interactive login would be authenticating something other than what the command is about.
+*/
+const usableCredential = async (props, at) => {
+	const credentialsPath = at.path;
+	const stored = readCredentials(at);
+	if (stored === null) return null;
+	const credential = interpretCredentials(stored, at);
+	if (credential.kind === "api_key") return {
+		apiKey: credential.apiKey,
+		kind: API_KEY
+	};
+	try {
+		const result = await handleExistingToken(stored, props, credentialsPath);
+		return result ? {
+			apiKey: result.apiKey,
+			kind: OAUTH
+		} : null;
+	} catch (err) {
+		log.debug("Could not use the stored OAuth session at %s: %s", credentialsPath, err instanceof Error ? err.message : "unknown error");
+		return null;
+	}
 };
-export const ensureAuth = async (props) => {
-    // Skip auth for help command or no command
-    if (props._.length === 0 || props.help) {
-        return;
-    }
-    // `(config) status --current-branch` is a purely-local read of `.neon`; it must
-    // never refresh a token or pop a browser login. Skip auth entirely (the handler
-    // doesn't use an API client in this mode).
-    if (isCurrentBranchProbe(props)) {
-        return;
-    }
-    // `config init` only scaffolds a neon.ts and installs npm packages locally; it
-    // never calls the Neon API, so skip auth entirely — no token refresh, no login.
-    if (isConfigInit(props)) {
-        return;
-    }
-    // `profile` reads and edits credential files on disk. Authenticating first would mean
-    // a browser login just to list profiles, and would make a lapsed profile unremovable.
-    if (isProfileCommand(props)) {
-        return;
-    }
-    // `dev` runs a function locally. It injects the selected branch's env vars
-    // when credentials happen to be available, but must never trigger an
-    // interactive login: use an API key or existing stored credentials if
-    // present, otherwise run with no API client (env injection is skipped).
-    const isLocalDev = props._[0] === "dev";
-    // `bootstrap` only copies a public template repo; it never calls the Neon
-    // API, so it must work without credentials and must never pop a browser
-    // login. It uses an API key / stored credentials when present (harmless),
-    // otherwise it proceeds with no API client.
-    const isBootstrap = props._[0] === "bootstrap";
-    // `init` manages its own auth flow (asks the user if they have an account,
-    // then triggers OAuth at the right time). Skip the global auth middleware.
-    const isInit = props._[0] === "init";
-    // `auth` writes a credential rather than using one, and reads `--profile` as the
-    // destination to write it to. Running selection here would reject the flag pair it
-    // accepts, and could resolve a stored key that this command must not authenticate with.
-    if (props._[0] === "auth") {
-        props.apiClient = getApiClient({
-            apiKey: props.apiKey,
-            apiHost: props.apiHost,
-        });
-        return;
-    }
-    // Throws when `--api-key` and `--profile` are both passed.
-    const selection = selectCredential({
-        ...credentialInputs(),
-        profileFlag: props.profile,
-    });
-    const displaced = displacedProfileWarning(selection);
-    if (displaced !== null) {
-        log.warning(displaced);
-    }
-    if (selection.source !== "profile") {
-        props.apiKey = selection.apiKey;
-        log.debug("Using an API key to authorize requests");
-        setAuthContext({
-            source: "api-key",
-            configDir: props.configDir,
-        });
-        props.apiClient = getApiClient({
-            apiKey: props.apiKey,
-            apiHost: props.apiHost,
-        });
-        return;
-    }
-    // An explicit `--profile` outranks an exported `NEON_API_KEY`, which the middleware has
-    // already folded into `apiKey`. Clear it so nothing downstream — analytics, `dev`'s env
-    // runtime, a re-exec — authenticates with a key this invocation decided against.
-    props.apiKey = "";
-    const credentialsPath = credentialsPathForName(props.configDir, selection.profile);
-    const at = { path: credentialsPath, profile: selection.profile };
-    const stored = readCredentials(at);
-    if (stored !== null) {
-        log.debug("Trying to read credentials from %s", credentialsPath);
-        // Throws on a file whose declared kind is unusable. That is deliberate: falling
-        // through to a browser login would replace the credential the user is fixing.
-        const credential = interpretCredentials(stored, at);
-        if (credential.kind === API_KEY) {
-            log.debug('Using profile "%s"\'s API key to authorize requests', selection.profile);
-            props.apiKey = credential.apiKey;
-            setAuthContext({
-                source: "profile-api-key",
-                configDir: props.configDir,
-                profile: selection.profile,
-                credentialsPath,
-            });
-            props.apiClient = getApiClient({
-                apiKey: credential.apiKey,
-                apiHost: props.apiHost,
-            });
-            return;
-        }
-        try {
-            const result = await handleExistingToken(stored, props, credentialsPath);
-            if (result) {
-                props.apiKey = result.apiKey;
-                props.apiClient = result.apiClient;
-                setAuthContext({
-                    source: "stored-credentials",
-                    configDir: props.configDir,
-                    profile: selection.profile,
-                    credentialsPath,
-                });
-                return;
-            }
-        }
-        catch (err) {
-            if (!(err instanceof Error && err.message === "AUTH_REFRESH_FAILED")) {
-                throw err;
-            }
-            // A refresh that failed is recoverable by logging in again.
-            log.debug("Ensure auth failed, starting authentication", err);
-        }
-    }
-    else {
-        log.debug("No usable credentials at %s, starting authentication", credentialsPath);
-    }
-    // `dev` never launches the interactive browser flow. With no usable
-    // credentials it proceeds without an API client; env injection is skipped
-    // and the function still runs locally.
-    if (isLocalDev) {
-        log.debug("dev: no usable credentials; running without env injection");
-        return;
-    }
-    if (isBootstrap) {
-        log.debug("bootstrap: no usable credentials; continuing without auth");
-        return;
-    }
-    if (isInit) {
-        log.debug("init: skipping global auth; init manages its own auth flow");
-        return;
-    }
-    // Start new auth flow if no valid token exists or refresh failed. Pass the resolved
-    // profile rather than the raw flag, so a name that came from `NEON_PROFILE` is written to
-    // its own file instead of overwriting `DEFAULT`'s.
-    const apiKey = await authFlow({ ...props, profile: selection.profile });
-    props.apiKey = apiKey;
-    props.apiClient = getApiClient({
-        apiKey,
-        apiHost: props.apiHost,
-    });
-    setAuthContext({
-        source: "stored-credentials",
-        configDir: props.configDir,
-        profile: selection.profile,
-        credentialsPath,
-    });
+const ensureAuth = async (props) => {
+	if (props._.length === 0 || props.help) return;
+	if (isCurrentBranchProbe(props)) return;
+	if (isConfigInit(props)) return;
+	if (isProfileCommand(props)) return;
+	const isLocalDev = props._[0] === "dev";
+	const isBootstrap = props._[0] === "bootstrap";
+	const isInit = props._[0] === "init";
+	if (props._[0] === "auth") {
+		props.apiClient = getApiClient({
+			apiKey: props.apiKey,
+			apiHost: props.apiHost
+		});
+		return;
+	}
+	const selection = selectCredential({
+		...credentialInputs(),
+		profileFlag: props.profile
+	});
+	const displaced = displacedProfileWarning(selection);
+	if (displaced !== null) log.warning(displaced);
+	if (selection.source !== "profile") {
+		props.apiKey = selection.apiKey;
+		log.debug("Using an API key to authorize requests");
+		setAuthContext({
+			source: "api-key",
+			configDir: props.configDir
+		});
+		props.apiClient = getApiClient({
+			apiKey: props.apiKey,
+			apiHost: props.apiHost
+		});
+		return;
+	}
+	props.apiKey = "";
+	const credentialsPath = credentialsPathForName(props.configDir, selection.profile);
+	const at = {
+		path: credentialsPath,
+		profile: selection.profile
+	};
+	const stored = readCredentials(at);
+	if (stored !== null) {
+		log.debug("Trying to read credentials from %s", credentialsPath);
+		const credential = interpretCredentials(stored, at);
+		if (credential.kind === "api_key") {
+			log.debug("Using profile \"%s\"'s API key to authorize requests", selection.profile);
+			props.apiKey = credential.apiKey;
+			setAuthContext({
+				source: "profile-api-key",
+				configDir: props.configDir,
+				profile: selection.profile,
+				credentialsPath
+			});
+			props.apiClient = getApiClient({
+				apiKey: credential.apiKey,
+				apiHost: props.apiHost
+			});
+			return;
+		}
+		try {
+			const result = await handleExistingToken(stored, props, credentialsPath);
+			if (result) {
+				props.apiKey = result.apiKey;
+				props.apiClient = result.apiClient;
+				setAuthContext({
+					source: "stored-credentials",
+					configDir: props.configDir,
+					profile: selection.profile,
+					credentialsPath
+				});
+				return;
+			}
+		} catch (err) {
+			if (!(err instanceof Error && err.message === "AUTH_REFRESH_FAILED")) throw err;
+			log.debug("Ensure auth failed, starting authentication", err);
+		}
+	} else log.debug("No usable credentials at %s, starting authentication", credentialsPath);
+	if (isLocalDev) {
+		log.debug("dev: no usable credentials; running without env injection");
+		return;
+	}
+	if (isBootstrap) {
+		log.debug("bootstrap: no usable credentials; continuing without auth");
+		return;
+	}
+	if (isInit) {
+		log.debug("init: skipping global auth; init manages its own auth flow");
+		return;
+	}
+	const apiKey = await authFlow({
+		...props,
+		profile: selection.profile
+	});
+	props.apiKey = apiKey;
+	props.apiClient = getApiClient({
+		apiKey,
+		apiHost: props.apiHost
+	});
+	setAuthContext({
+		source: "stored-credentials",
+		configDir: props.configDir,
+		profile: selection.profile,
+		credentialsPath
+	});
 };
 /**
- * Delete one credentials file — used by the 401 handler to clear an OAuth token set the API
- * has rejected, so the next command logs in again instead of failing the same way.
- *
- * It takes the exact path rather than a directory and an optional profile. Deriving the path
- * here meant re-running selection from partial state, and the 401 handler has no parsed
- * arguments: it passed only the config directory, so a rejected token on a
- * `--profile`-selected account deleted whatever `DEFAULT` pointed at — signing the user out
- * of an account whose credentials the failed request had never touched.
- */
-export const deleteCredentialsAt = (credentialsPath) => {
-    try {
-        if (existsSync(credentialsPath)) {
-            rmSync(credentialsPath);
-            log.info("Deleted credentials from %s", credentialsPath);
-        }
-        else {
-            log.debug("Credentials file %s does not exist", credentialsPath);
-        }
-    }
-    catch (err) {
-        const typedErr = err instanceof Error ? err : new Error("Unknown error");
-        log.error("Failed to delete credentials: %s", typedErr.message);
-        throw new Error("CREDENTIALS_DELETE_FAILED");
-    }
+* Delete one credentials file — used by the 401 handler to clear an OAuth token set the API
+* has rejected, so the next command logs in again instead of failing the same way.
+*
+* It takes the exact path rather than a directory and an optional profile. Deriving the path
+* here meant re-running selection from partial state, and the 401 handler has no parsed
+* arguments: it passed only the config directory, so a rejected token on a
+* `--profile`-selected account deleted whatever `DEFAULT` pointed at — signing the user out
+* of an account whose credentials the failed request had never touched.
+*/
+const deleteCredentialsAt = (credentialsPath) => {
+	try {
+		if (existsSync(credentialsPath)) {
+			rmSync(credentialsPath);
+			log.info("Deleted credentials from %s", credentialsPath);
+		} else log.debug("Credentials file %s does not exist", credentialsPath);
+	} catch (err) {
+		const typedErr = err instanceof Error ? err : /* @__PURE__ */ new Error("Unknown error");
+		log.error("Failed to delete credentials: %s", typedErr.message);
+		throw new Error("CREDENTIALS_DELETE_FAILED");
+	}
 };
 const md5hash = (s) => createHash("md5").update(s).digest("hex");
+//#endregion
+export { aliases, authFlow, builder, command, credentialsPathForName, deleteCredentialsAt, describe, ensureAuth, handler, auth_exports as t, usableCredential };