neon 3.0.0 → 3.1.1

package/dist/_shared/env-core/reuse-secrets.js

@@ -1,223 +0,0 @@
-import { credentialScopesSatisfied, } from "@neon/config/v1";
-import { createApiFromOptions, credentialEnvKeys, credentialName, fetchEnvKeys, NEON_ENV_VAR_KEYS, policyEnvKeys, previewCredentialScopes, resolveBranchPolicy, toEntries, } from "./env.js";
-/**
- * Resolve a branch's env while keeping one-time secrets the caller already holds.
- *
- * {@link fetchEnvKeys} — and the public `fetchEnv` — only ever *fetch*. The Neon API returns a
- * credential's `api_token` / `s3_secret_access_key` exactly once, at mint time, so "fetching"
- * them means minting a new credential; a plain `fetchEnv` on every `neon dev` start or `env
- * pull` would leave a live credential behind each time. This is the wrapper that avoids that:
- * it looks at what the caller already has, decides what is still usable, and asks `fetchEnv`
- * for only the rest.
- *
- * The check is a real verification, not a presence test. A persisted secret is kept only when
- * it names a credential that still exists on this branch, is not revoked or expired, and
- * carries every scope the policy needs. A `.env.example` placeholder, a credential revoked in
- * the console, one copied in from another branch, or one predating a newly-enabled feature all
- * fail that check and get replaced.
- *
- * None of this needs local bookkeeping, because the secrets carry their own credential id:
- * `AWS_ACCESS_KEY_ID` **is** the credential's `tokenId` (the storage gateway authenticates
- * against the full id), and the AI Gateway token is minted as `nt_live_<tokenIdShort>_<secret>`,
- * where `tokenIdShort` is what the credentials list reports. The env source being replaced is
- * the record of what the last call issued.
- *
- * ```ts
- * import { fetchEnvReusingSecrets } from "../_shared/env-core/reuse-secrets.js";
- *
- * const { vars, credential } = await fetchEnvReusingSecrets(config, {
- *     projectId,
- *     branch: "main",
- *     env: { ...process.env, ...readEnvFile(".env") },
- * });
- * if (credential.issued) console.log(`new values for ${credential.keys.join(", ")}`);
- * ```
- */
-export async function fetchEnvReusingSecrets(config, options) {
-    const { env: source = process.env, revokeSuperseded = true, ...fetchOptions } = options;
-    const api = options.api ?? createApiFromOptions(options);
-    const { branch, desired } = await resolveBranchPolicy(config, options, api);
-    const storageEnabled = (desired.preview?.buckets.length ?? 0) > 0;
-    const gatewayEnabled = desired.preview?.aiGatewayEnabled ?? false;
-    const secretKeys = credentialEnvKeys({
-        storage: storageEnabled,
-        aiGateway: gatewayEnabled,
-    });
-    // Nothing credential-backed on this branch, so there is nothing to preserve and no
-    // credential to spend: fetch everything and skip the credentials endpoint entirely.
-    if (secretKeys.length === 0) {
-        const fetched = await fetchEnvKeys(config, fetchOptions, null);
-        return {
-            vars: preferPersisted(toEntries(fetched), source),
-            credential: {
-                issued: false,
-                keys: [],
-                revoked: [],
-                superseded: [],
-            },
-        };
-    }
-    const persisted = readPersistedSecrets(source);
-    const complete = (!storageEnabled ||
-        Boolean(persisted.accessKeyId && persisted.secretAccessKey)) &&
-        (!gatewayEnabled || Boolean(persisted.apiToken));
-    // Look the persisted secrets up whenever there are any — not only when they're complete.
-    // An incomplete set still names the credential a newly-enabled feature is about to
-    // supersede (a storage-only credential on a branch that just gained the AI Gateway), and
-    // that one should be revoked rather than left live.
-    const named = persisted.accessKeyId !== "" || persisted.apiToken !== ""
-        ? namedCredentials(await api.listCredentials(options.projectId, branch.id), persisted)
-        : { storage: null, gateway: null };
-    const reusable = complete
-        ? reusableCredential(named, { storageEnabled, gatewayEnabled })
-        : null;
-    const scopes = previewCredentialScopes(desired.preview);
-    const keep = reusable !== null && credentialScopesSatisfied(reusable.scopes, scopes);
-    // Ask for everything the policy produces, minus the secrets we're keeping — which is what
-    // stops `fetchEnv` from minting a credential it doesn't need.
-    const allKeys = policyEnvKeys(desired);
-    const fetchKeys = keep
-        ? allKeys.filter((key) => !secretKeys.includes(key))
-        : allKeys;
-    const fetched = await fetchEnvKeys(config, 
-    // Pass the resolved id so `fetchEnv` targets the same branch this call verified against,
-    // even if `options.branch` was a name that has since been reused.
-    { ...fetchOptions, branchId: branch.id, api }, fetchKeys);
-    const vars = preferPersisted(toEntries(fetched), source);
-    if (keep) {
-        for (const key of secretKeys) {
-            const value = source[key];
-            if (value !== undefined)
-                vars[key] = value;
-        }
-        return {
-            vars,
-            credential: {
-                issued: false,
-                keys: secretKeys,
-                revoked: [],
-                superseded: [],
-            },
-        };
-    }
-    // A replacement was minted, so revoke what it supersedes: the credentials the old secrets
-    // named, minus any this tool did not issue. Their secrets lived nowhere but the env source
-    // this call replaces, so revoking them strands nothing — and it keeps a branch from
-    // accumulating a live credential per call. Everything else on the branch is left alone: it
-    // may belong to a teammate, another checkout, or a deployed function, and nothing
-    // observable distinguishes those from an orphan of our own.
-    //
-    // Revoked *after* the fetch, so a failed fetch leaves the caller's existing secrets working.
-    const ours = new Set();
-    for (const meta of [named.storage, named.gateway]) {
-        if (meta !== null &&
-            meta.principalType === "user" &&
-            meta.name === credentialName(branch.name)) {
-            ours.add(meta.tokenId);
-        }
-    }
-    if (revokeSuperseded) {
-        for (const tokenId of ours) {
-            await api.revokeCredential(options.projectId, branch.id, tokenId);
-        }
-    }
-    return {
-        vars,
-        credential: {
-            issued: true,
-            keys: secretKeys,
-            revoked: revokeSuperseded ? [...ours] : [],
-            superseded: revokeSuperseded ? [] : [...ours],
-        },
-    };
-}
-/** Read the branch credential's secrets out of an env source. */
-function readPersistedSecrets(source) {
-    const storage = NEON_ENV_VAR_KEYS.storage;
-    const gateway = NEON_ENV_VAR_KEYS.aiGateway;
-    return {
-        accessKeyId: source[storage.accessKeyId] ?? "",
-        secretAccessKey: source[storage.secretAccessKey] ?? "",
-        apiToken: source[gateway.apiKey] ?? "",
-    };
-}
-/**
- * Keep a persisted value rather than overwriting it with an empty fetched one.
- *
- * Neon Auth's `base_url` is the case that needs this: integrations created before the API
- * returned it answer with an empty string, and the persisted copy is the only one left. An
- * empty fetched value never carries more information than a non-empty persisted one, so
- * preferring the latter is safe for every var — and it keeps a pull from blanking a working
- * line in someone's `.env`.
- */
-function preferPersisted(vars, source) {
-    const out = { ...vars };
-    for (const [key, value] of Object.entries(out)) {
-        if (value !== "")
-            continue;
-        const persisted = source[key];
-        if (persisted !== undefined && persisted !== "")
-            out[key] = persisted;
-    }
-    return out;
-}
-/**
- * The credential id embedded in an AI Gateway token. The API mints them as
- * `nt_live_<tokenIdShort>_<secret>`, and `tokenIdShort` is the public identifier the credentials
- * list reports — so a persisted token names the credential that issued it. Returns `null` for
- * anything not in that shape (a `.env.example` placeholder, a hand-typed value), which callers
- * treat as unverifiable.
- */
-function gatewayTokenIdShort(apiToken) {
-    return /^nt_live_([^_]+)_.+$/.exec(apiToken)?.[1] ?? null;
-}
-/** Whether an issued credential can still be used: not revoked, not past its expiry. */
-function isLiveCredential(meta, now) {
-    if (meta.revokedAt !== undefined)
-        return false;
-    if (meta.expiresAt === undefined)
-        return true;
-    const expiresAt = Date.parse(meta.expiresAt);
-    return Number.isNaN(expiresAt) || expiresAt > now;
-}
-/**
- * The live credentials the persisted secrets name — at most one per half. A half that names
- * nothing contributes nothing, which is what a placeholder, a credential revoked in the
- * console, and one copied in from another branch all look like from here.
- */
-function namedCredentials(live, persisted) {
-    const usable = live.filter((meta) => isLiveCredential(meta, Date.now()));
-    const shortId = persisted.apiToken
-        ? gatewayTokenIdShort(persisted.apiToken)
-        : null;
-    return {
-        storage: persisted.accessKeyId
-            ? (usable.find((meta) => meta.tokenId === persisted.accessKeyId) ??
-                null)
-            : null,
-        gateway: shortId
-            ? (usable.find((meta) => meta.tokenIdShort === shortId) ?? null)
-            : null,
-    };
-}
-/**
- * The credential the persisted secrets can be *reused* as, or `null`.
- *
- * Strict on purpose: every half the policy enables has to name a live credential, and when both
- * features are enabled they must name the *same* one — they share a single credential, so
- * halves that disagree came from two different calls and neither can be trusted.
- */
-function reusableCredential(named, enabled) {
-    if (enabled.storageEnabled && enabled.gatewayEnabled) {
-        return named.storage &&
-            named.gateway &&
-            named.storage.tokenId === named.gateway.tokenId
-            ? named.storage
-            : null;
-    }
-    if (enabled.storageEnabled)
-        return named.storage;
-    if (enabled.gatewayEnabled)
-        return named.gateway;
-    return null;
-}

package/dist/_shared/paths.js

@@ -1,148 +0,0 @@
-/**
- * # Where the Neon CLIs keep their files on disk
- *
- **Deliberately impure.** It reads environment variables and touches the filesystem, which
- * `@neon/config` — the package this used to be a subpath of — must never do from its root
- * export. It lives here instead of there precisely so that a policy-facing package does not
- * carry implementor-only code.
- *
- * It exists because three separate readers each grew their own answer to "where is the
- * config directory", and all three disagreed: `packages/cli` honoured `XDG_CONFIG_HOME` but
- * not `NEONCTL_CONFIG_DIR`, `packages/env` honoured the env var but not XDG, and the init
- * flow hardcoded `~/.config/neonctl`. With `XDG_CONFIG_HOME` set, the CLI wrote
- * credentials somewhere the other two never looked.
- *
- * ## The directory
- *
- * `neon` is the current name; `neonctl` is the legacy one, kept readable forever. Resolution,
- * each entry winning over the next:
- *
- * 1. An explicit directory (a `--config-dir` flag) — **exact**, no legacy fallback.
- * 2. `NEON_CONFIG_DIR` — exact.
- * 3. `NEONCTL_CONFIG_DIR` (legacy name) — exact.
- * 4. `$XDG_CONFIG_HOME/neon`, else `<home>/.config/neon`.
- *
- * An explicitly chosen directory is never paired with a fallback: `--config-dir /tmp/ci` that
- * quietly read `~/.config/neonctl` would defeat the point of passing it.
- *
- * ## The files
- *
- * {@link resolveConfigFile} answers "which path should I use for this file", and it is the
- * same answer for reading and writing:
- *
- * - Present in `neon/` → use it.
- * - Present only in `neonctl/` → **use it there, in place.** An existing credentials file is
- *   never copied or moved, so nothing is left behind to go stale and no other tool starts
- *   reading an abandoned token.
- * - Present in neither → the new location. New files only ever appear under `neon/`.
- */
-import { existsSync } from "node:fs";
-import { join, resolve } from "node:path";
-/** Current directory name. New files are created here. */
-export const CONFIG_DIR_NAME = "neon";
-/** Legacy directory name, read forever so existing installs keep working untouched. */
-export const LEGACY_CONFIG_DIR_NAME = "neonctl";
-/** Where files are created. See the module docs for the precedence. */
-export function configDir(options = {}) {
-    const explicit = explicitDir(options);
-    if (explicit)
-        return explicit;
-    return join(configHome(options.env ?? process.env), CONFIG_DIR_NAME);
-}
-/**
- * The legacy directory, or `undefined` when the location was chosen explicitly (in which
- * case there is no legacy counterpart to fall back to).
- */
-export function legacyConfigDir(options = {}) {
-    if (explicitDir(options))
-        return undefined;
-    return join(configHome(options.env ?? process.env), LEGACY_CONFIG_DIR_NAME);
-}
-/**
- * Resolve one file inside the config directory. Prefers the current location, falls back to
- * an existing legacy file **in place**, and otherwise points at the current location so new
- * files are created there.
- */
-export function resolveConfigFile(fileName, options = {}) {
-    const dir = configDir(options);
-    const current = resolve(dir, fileName);
-    if (existsSync(current))
-        return { path: current, dir, isLegacy: false, exists: true };
-    const legacyDir = legacyConfigDir(options);
-    if (legacyDir) {
-        const legacy = resolve(legacyDir, fileName);
-        if (existsSync(legacy))
-            return {
-                path: legacy,
-                dir: legacyDir,
-                isLegacy: true,
-                exists: true,
-            };
-    }
-    return { path: current, dir, isLegacy: false, exists: false };
-}
-/** `$XDG_CONFIG_HOME`, else `<home>/.config`. Falls back to a relative `.config` with no home. */
-function configHome(env) {
-    const xdg = nonEmpty(env.XDG_CONFIG_HOME);
-    if (xdg)
-        return xdg;
-    const home = nonEmpty(env.HOME) ?? nonEmpty(env.USERPROFILE);
-    return home ? join(home, ".config") : ".config";
-}
-function explicitDir(options) {
-    const env = options.env ?? process.env;
-    return (nonEmpty(options.dir) ??
-        nonEmpty(env.NEON_CONFIG_DIR) ??
-        nonEmpty(env.NEONCTL_CONFIG_DIR));
-}
-function nonEmpty(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed === "" ? undefined : trimmed;
-}
-export const CREDENTIALS_FILE = "credentials.json";
-/**
- * Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
- *
- * The directory was called `neonctl` until the CLI was renamed. An existing one is still read —
- * see {@link credentialsPath} — but it is never written to, moved, or deleted.
- */
-export const defaultDir = configDir();
-/**
- * Where this invocation's `credentials.json` lives.
- *
- * When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
- * directory is used **in place**: an install that predates the rename keeps working, and its
- * credentials are never duplicated into a second location where one copy could go stale while
- * another tool still reads it.
- *
- * A `--config-dir` the user actually passed is used exactly as given. Falling back out of an
- * explicitly chosen directory would defeat the reason for choosing it — a CI run pointed at a
- * scratch directory must never pick up a developer's real credentials.
- */
-export const credentialsPath = (dir) => resolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;
-/**
- * Whether a credentials file is one the CLI created, rather than a path a profile adopted.
- *
- * Anything that deletes a credential has to ask this first. A profile entry may point anywhere —
- * that is what makes adopting an existing directory a one-line edit — and a file we did not
- * create is not ours to remove.
- */
-export const isInsideConfigDir = (configDirectory, file) => `${resolve(file)}/`.startsWith(`${resolve(configDirectory)}/`);
-/**
- * Whether a credentials file is one the CLI owns, counting the legacy `neonctl` directory.
- *
- * {@link credentialsPath} deliberately reads an existing legacy file in place rather than
- * migrating it, so for a default config directory that file is ours even though it sits outside
- * `neon/`. Judging ownership on the current directory alone would call an install that predates
- * the rename "adopted".
- */
-export const isOwnedCredentialPath = (configDirectory, file) => {
-    if (isInsideConfigDir(configDirectory, file))
-        return true;
-    if (configDirectory !== defaultDir)
-        return false;
-    const legacy = legacyConfigDir();
-    return legacy !== undefined && isInsideConfigDir(legacy, file);
-};

package/dist/_shared/profiles.js

@@ -1,276 +0,0 @@
-/**
- * # Profiles — several Neon accounts in one config directory
- *
- * A profile is **a pointer to a credentials file**. Nothing more. That constraint is what
- * keeps the feature small: there is no mirror, no per-profile directory tree, no persistent
- * "active profile" state to fall out of sync, and no migration.
- *
- * ```
- * ~/.config/neon/
- * ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
- * ├── credentials.work.json     # created by `neon auth --profile work`
- * └── profiles.json             # created only once a second profile exists
- * ```
- *
- * `profiles.json` maps a name to a path, and the path may point anywhere — which is what
- * makes adopting an existing directory a one-line edit rather than an import command:
- *
- * ```json
- * {
- *   "version": 1,
- *   "profiles": {
- *     "DEFAULT": { "credentials": "credentials.json" },
- *     "work": {
- *       "credentials": "../neonctl-databricks/credentials.json",
- *       "label": "someone@example.com"
- *     }
- *   }
- * }
- * ```
- *
- * ## Selection
- *
- * `--profile` → `NEON_PROFILE` → `DEFAULT`. Per invocation, like `AWS_PROFILE`; there is no
- * `profile use` command, so nothing persists that could disagree with what you typed.
- *
- * ## Compatibility
- *
- * An install with no `profiles.json` is already a valid `DEFAULT`-only state: `DEFAULT`
- * resolves to `credentials.json` in the config directory (including an existing one in the
- * legacy `neonctl` directory — see `./paths.ts`). Nothing is created until a second
- * profile is, and nothing is ever moved.
- */
-import { existsSync, readFileSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
-import { credentialsPath, defaultDir, resolveConfigFile } from "./paths.js";
-import { writeSecretFile } from "./secure_file.js";
-export const PROFILES_FILE = "profiles.json";
-/** The implicit profile. Backed by plain `credentials.json`, with or without a profiles file. */
-export const DEFAULT_PROFILE = "DEFAULT";
-/** Profile names become part of a filename, so keep them boring. */
-const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-/** Which profile this invocation should use: `--profile` → `NEON_PROFILE` → `DEFAULT`. */
-export const selectProfileName = (flag, env = process.env) => nonEmpty(flag) ?? nonEmpty(env.NEON_PROFILE) ?? DEFAULT_PROFILE;
-export const assertValidProfileName = (name) => {
-    if (!NAME_PATTERN.test(name)) {
-        throw new Error(`Invalid profile name "${name}". Use letters, digits, dot, dash or underscore, starting with a letter or digit.`);
-    }
-};
-/** Where `profiles.json` lives for this config directory (whether or not it exists yet). */
-export const profilesFilePath = (dir) => resolveConfigFile(PROFILES_FILE, dir === defaultDir ? {} : { dir }).path;
-/**
- * Read and classify `profiles.json` without deciding what to do about it.
- *
- * Entry keys and shapes are validated here rather than at each use. A key is a profile name,
- * and a name that `assertValidProfileName` would reject cannot have been written by this CLI —
- * it would travel into error messages as a recovery command nobody can run, and into a
- * `credentials.<name>.json` filename.
- */
-export const inspectProfiles = (dir) => {
-    const path = profilesFilePath(dir);
-    if (!existsSync(path))
-        return { kind: "absent" };
-    const broken = (why) => ({
-        kind: "unusable",
-        reason: `${path} could not be read as a profiles file: ${why}`,
-    });
-    // Reading and parsing are separate failures with separate answers. Sharing one catch
-    // reported `EACCES` as "not valid JSON", which sends the user to edit a file that is
-    // perfectly valid and that they cannot open.
-    let contents;
-    try {
-        contents = readFileSync(path, "utf8");
-    }
-    catch (err) {
-        const code = err.code;
-        return broken(code ? `reading it failed with ${code}` : "reading it failed");
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(contents);
-    }
-    catch {
-        return broken("it is not valid JSON");
-    }
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
-        return broken("it does not contain an object");
-    const profiles = parsed.profiles;
-    if (profiles === null ||
-        typeof profiles !== "object" ||
-        Array.isArray(profiles))
-        return broken("it has no `profiles` object");
-    for (const [name, entry] of Object.entries(profiles)) {
-        if (!NAME_PATTERN.test(name))
-            return broken(`"${name}" is not a valid profile name`);
-        if (entry === null ||
-            typeof entry !== "object" ||
-            typeof entry.credentials !== "string" ||
-            entry.credentials.trim() === "") {
-            return broken(`profile "${name}" has no \`credentials\` path`);
-        }
-    }
-    return { kind: "ok", file: { version: 1, profiles } };
-};
-/**
- * Read `profiles.json`, or `null` when there is nothing usable there.
- *
- * A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
- * worst case is a named profile turning up missing, which is recoverable — whereas throwing
- * would lock the user out of `neon auth` itself. Writing is the opposite: see
- * {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
- */
-export const readProfiles = (dir, 
-/** Called with the reason a profiles file was ignored. The consumer owns how it reports. */
-onWarn = () => { }) => {
-    const read = inspectProfiles(dir);
-    if (read.kind === "ok")
-        return read.file;
-    if (read.kind === "unusable")
-        onWarn(read.reason);
-    return null;
-};
-/**
- * Refuse to act on a named profile when the file that defines it cannot be read.
- *
- * Call this **before** anything that writes a credential, opens a browser, or spends an API
- * call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
- * overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon auth
- * --profile` has already signed in over it — a refusal that arrives after the destruction it
- * exists to prevent. The path resolution itself is the unsound part, since with the metadata
- * unreadable the conventional filename is a guess about which account that file belongs to.
- *
- * `DEFAULT` is exempt: it is defined by the absence of metadata rather than by an entry, so
- * signing in normally must keep working while a broken `profiles.json` is repaired.
- */
-export const assertProfilesUsable = (dir, name) => {
-    if (name === DEFAULT_PROFILE)
-        return;
-    const read = inspectProfiles(dir);
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. Fix or delete the file before working with profile "${name}" — it is the only record of where each account's credentials live.`);
-    }
-};
-/** Resolve a profile to an absolute credentials path. Throws when a named profile is unknown. */
-export const resolveProfile = (dir, name) => {
-    const read = inspectProfiles(dir);
-    // A broken file must not be reported as `Unknown profile "work"`. That names the wrong
-    // problem, and the user goes looking for a profile they can see in the file in front of them.
-    if (read.kind === "unusable" && name !== DEFAULT_PROFILE) {
-        throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
-    }
-    const file = read.kind === "ok" ? read.file : null;
-    const entry = file?.profiles[name];
-    if (entry) {
-        return {
-            name,
-            credentialsPath: resolveEntryPath(dir, entry.credentials),
-            ...(entry.label ? { label: entry.label } : {}),
-            ...(entry.userId ? { userId: entry.userId } : {}),
-            declared: true,
-        };
-    }
-    // DEFAULT works with no profiles.json at all, and keeps working when one exists but
-    // doesn't mention it — that is the pre-profiles behaviour, unchanged.
-    if (name === DEFAULT_PROFILE) {
-        return {
-            name,
-            credentialsPath: credentialsPath(dir),
-            declared: false,
-        };
-    }
-    const known = file
-        ? Object.keys(file.profiles).join(", ")
-        : DEFAULT_PROFILE;
-    throw new Error(`Unknown profile "${name}". Known profiles: ${known}. Create it with \`neon profile create ${name}\`.`);
-};
-/** Default location for a new named profile's credentials file. */
-export const newProfileCredentialsPath = (dir, name) => resolve(dir, `credentials.${name}.json`);
-/**
- * Record a profile, creating `profiles.json` if this is the first named one.
- *
- * When the file is created, `DEFAULT` is written explicitly and pointed at wherever
- * `credentials.json` actually is. That matters for an install predating the directory
- * rename: `profiles.json` is created in `neon/` while the credentials are still in
- * `neonctl/`, so `DEFAULT` is recorded as `../neonctl/credentials.json` rather than a
- * relative name that would resolve to a file that isn't there.
- */
-export const upsertProfile = (dir, name, entry) => {
-    assertValidProfileName(name);
-    const path = profilesFilePath(dir);
-    const read = inspectProfiles(dir);
-    // Refusing is the point. Treating a broken file as absent here rebuilt it from a single
-    // `DEFAULT` entry and dropped every named profile in it — silent data loss, in the file
-    // that is the only record of where each account's credentials live. The credentials
-    // themselves survive, so fixing the file by hand recovers everything.
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. Refusing to rewrite it, because doing so would discard the profiles it defines. Fix or delete the file, then re-run.`);
-    }
-    const file = read.kind === "ok"
-        ? read.file
-        : {
-            version: 1,
-            profiles: {
-                [DEFAULT_PROFILE]: {
-                    credentials: relativeToProfiles(path, credentialsPath(dir)),
-                },
-            },
-        };
-    file.profiles[name] = {
-        credentials: relativeToProfiles(path, entry.credentials),
-        ...(entry.label ? { label: entry.label } : {}),
-        ...(entry.userId ? { userId: entry.userId } : {}),
-    };
-    writeProfiles(path, file);
-};
-/** Remove an entry. Returns false when it wasn't there. */
-export const removeProfileEntry = (dir, name) => {
-    const path = profilesFilePath(dir);
-    const file = readProfiles(dir);
-    if (!file?.profiles[name])
-        return false;
-    delete file.profiles[name];
-    writeProfiles(path, file);
-    return true;
-};
-/**
- * True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
- * lazy creation: a single-account install has no profiles file, before or after.
- */
-export const onlyDefaultRemains = (file) => {
-    const names = Object.keys(file.profiles);
-    return (names.length === 0 ||
-        (names.length === 1 && names[0] === DEFAULT_PROFILE));
-};
-export const listProfiles = (dir) => {
-    const read = inspectProfiles(dir);
-    // Listing is the command run to find out what is there, so a broken file is the answer
-    // rather than an obstacle. Showing only `DEFAULT` would state, as fact, that the profiles
-    // in that file do not exist.
-    if (read.kind === "unusable") {
-        throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
-    }
-    const file = read.kind === "ok" ? read.file : null;
-    if (!file)
-        return [resolveProfile(dir, DEFAULT_PROFILE)];
-    const names = Object.keys(file.profiles);
-    if (!names.includes(DEFAULT_PROFILE))
-        names.unshift(DEFAULT_PROFILE);
-    return names.map((name) => resolveProfile(dir, name));
-};
-const writeProfiles = (path, file) => {
-    writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
-};
-const resolveEntryPath = (dir, entry) => isAbsolute(entry) ? entry : resolve(profilesDir(dir), entry);
-/** `profiles.json` may sit in the legacy directory, so entries resolve against its own dir. */
-const profilesDir = (dir) => resolve(profilesFilePath(dir), "..");
-/** Keep entries relative when they sit near `profiles.json`; absolute paths stay absolute. */
-const relativeToProfiles = (profilesPath, target) => {
-    const rel = relative(resolve(profilesPath, ".."), target);
-    return rel && !isAbsolute(rel) ? rel : target;
-};
-function nonEmpty(value) {
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    return trimmed === "" ? undefined : trimmed;
-}