neon 3.2.2 → 3.3.0

package/dist/_chunks/{profiles-Ir29rqns.js → profiles-CVXNvU2r.js}

@@ -1,55 +1,67 @@
-import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { n as credentialsPath, o as resolveConfigFile, r as defaultDir } from "./paths-DMq0Lt7a.js";
-import { existsSync, readFileSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
-//#region ../../internals/cli-core/dist/profiles.js
+import { i as defaultDir, r as credentialsPath, s as resolveConfigFile } from "./paths-g3DRqJiD.js";
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+//#region ../../internals/cli-core/dist/secure_file.js
 /**
-* # Profiles — several Neon accounts in one config directory
-*
-* A profile is **a pointer to a credentials file**. Nothing more. That constraint is what
-* keeps the feature small: there is no mirror, no per-profile directory tree, no persistent
-* "active profile" state to fall out of sync, and no migration.
-*
-* ```
-* ~/.config/neon/
-* ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
-* ├── credentials.work.json     # created by `neon auth --profile work`
-* └── profiles.json             # created only once a second profile exists
-* ```
-*
-* `profiles.json` maps a name to a path, and the path may point anywhere — which is what
-* makes adopting an existing directory a one-line edit rather than an import command:
+* Write a secret to disk owner-only, by creating a temporary file in the same directory and
+* renaming it over the target.
 *
-* ```json
-* {
-*   "version": 1,
-*   "profiles": {
-*     "DEFAULT": { "credentials": "credentials.json" },
-*     "work": {
-*       "credentials": "../neonctl-databricks/credentials.json",
-*       "label": "someone@example.com"
-*     }
-*   }
-* }
-* ```
+* The rename is what makes this correct rather than merely tidy. `writeFileSync`'s `mode`
+* applies only when it *creates* the file, so writing over an existing credentials file
+* leaves whatever permissions it already had — a file created `0700` by an older release
+* stays `0700` forever, and one created before a umask change stays world-readable. Renaming
+* a fresh inode into place means every write lands at {@link SECRET_FILE_MODE}, so the
+* permissions repair themselves instead of being inherited.
 *
-* ## Selection
+* It also closes the window where a reader could see the file at default permissions: the
+* temporary file is created `0600` *before* it holds the secret's final name, and `rename`
+* is atomic within a directory, so there is no moment at which the target is readable by
+* anyone else and no moment at which it is half-written.
 *
-* `--profile` → `NEON_PROFILE` → `DEFAULT`. Per invocation, like `AWS_PROFILE`; there is no
-* `profile use` command, so nothing persists that could disagree with what you typed.
-*
-* ## Compatibility
-*
-* An install with no `profiles.json` is already a valid `DEFAULT`-only state: `DEFAULT`
-* resolves to `credentials.json` in the config directory (including an existing one in the
-* legacy `neonctl` directory — see `./paths.ts`). Nothing is created until a second
-* profile is, and nothing is ever moved.
+* The temporary name carries the pid so two processes writing at once cannot collide on it.
+*/
+const writeSecretFile = (path, contents) => {
+	const directory = dirname(path);
+	const temporary = join(directory, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+	try {
+		writeFileSync(temporary, contents, {
+			encoding: "utf8",
+			mode: 384
+		});
+		renameSync(temporary, path);
+	} catch (err) {
+		try {
+			unlinkSync(temporary);
+		} catch {}
+		throw err;
+	}
+};
+//#endregion
+//#region ../../internals/cli-core/dist/cli_config.js
+const CRED_STORAGE_FILE = "file";
+const CRED_STORAGE_KEYRING = "keyring";
+//#endregion
+//#region ../../internals/cli-core/dist/profiles.js
+/**
+* Pointer-only profiles avoid mirrored credentials and persistent active-profile
+* state while preserving existing single-account and legacy-directory installs.
 */
 const PROFILES_FILE = "profiles.json";
+const KEYRING_CREDENTIALS = "keyring";
+const isKeyringPointer = (credentials) => credentials === KEYRING_CREDENTIALS;
 /** The implicit profile. Backed by plain `credentials.json`, with or without a profiles file. */
 const DEFAULT_PROFILE = "DEFAULT";
 /** Profile names become part of a filename, so keep them boring. */
 const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const locationOf = (profile) => profile.storage === "keyring" ? {
+	profile: profile.name,
+	storage: CRED_STORAGE_KEYRING
+} : {
+	profile: profile.name,
+	storage: CRED_STORAGE_FILE,
+	path: profile.credentialsPath
+};
+const credentialsDisplay = (profile) => profile.storage === "keyring" ? KEYRING_CREDENTIALS : profile.credentialsPath;
 /** Which profile this invocation should use: `--profile` → `NEON_PROFILE` → `DEFAULT`. */
 const selectProfileName = (flag, env = process.env) => nonEmpty(flag) ?? nonEmpty(env.NEON_PROFILE) ?? "DEFAULT";
 const assertValidProfileName = (name) => {
@@ -90,7 +102,7 @@ const inspectProfiles = (dir) => {
 	if (profiles === null || typeof profiles !== "object" || Array.isArray(profiles)) return broken("it has no `profiles` object");
 	for (const [name, entry] of Object.entries(profiles)) {
 		if (!NAME_PATTERN.test(name)) return broken(`"${name}" is not a valid profile name`);
-		if (entry === null || typeof entry !== "object" || typeof entry.credentials !== "string" || entry.credentials.trim() === "") return broken(`profile "${name}" has no \`credentials\` path`);
+		if (entry === null || typeof entry !== "object" || typeof entry.credentials !== "string" || entry.credentials.trim() === "") return broken(`profile "${name}" has no \`credentials\` pointer`);
 	}
 	return {
 		kind: "ok",
@@ -115,7 +127,7 @@ const readProfiles = (dir, onWarn = () => {}) => {
 	return null;
 };
 /**
-* Refuse to act on a named profile when the file that defines it cannot be read.
+* Storage cannot be trusted when the profiles file cannot be read.
 *
 * Call this **before** anything that writes a credential, opens a browser, or spends an API
 * call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
@@ -124,29 +136,39 @@ const readProfiles = (dir, onWarn = () => {}) => {
 * exists to prevent. The path resolution itself is the unsound part, since with the metadata
 * unreadable the conventional filename is a guess about which account that file belongs to.
 *
-* `DEFAULT` is exempt: it is defined by the absence of metadata rather than by an entry, so
-* signing in normally must keep working while a broken `profiles.json` is repaired.
+* DEFAULT follows the same rule because the broken file may be its only
+* keyring pointer.
 */
 const assertProfilesUsable = (dir, name) => {
-	if (name === "DEFAULT") return;
 	const read = inspectProfiles(dir);
 	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file before working with profile "${name}" — it is the only record of where each account's credentials live.`);
 };
 /** Resolve a profile to an absolute credentials path. Throws when a named profile is unknown. */
 const resolveProfile = (dir, name) => {
 	const read = inspectProfiles(dir);
-	if (read.kind === "unusable" && name !== "DEFAULT") throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file — every profile is defined in it.`);
 	const file = read.kind === "ok" ? read.file : null;
 	const entry = file?.profiles[name];
-	if (entry) return {
-		name,
-		credentialsPath: resolveEntryPath(dir, entry.credentials),
-		...entry.label ? { label: entry.label } : {},
-		...entry.userId ? { userId: entry.userId } : {},
-		declared: true
-	};
+	if (entry) {
+		if (isKeyringPointer(entry.credentials)) return {
+			name,
+			storage: CRED_STORAGE_KEYRING,
+			...entry.label ? { label: entry.label } : {},
+			...entry.userId ? { userId: entry.userId } : {},
+			declared: true
+		};
+		return {
+			name,
+			storage: CRED_STORAGE_FILE,
+			credentialsPath: resolveEntryPath(dir, entry.credentials),
+			...entry.label ? { label: entry.label } : {},
+			...entry.userId ? { userId: entry.userId } : {},
+			declared: true
+		};
+	}
 	if (name === "DEFAULT") return {
 		name,
+		storage: CRED_STORAGE_FILE,
 		credentialsPath: credentialsPath(dir),
 		declared: false
 	};
@@ -171,23 +193,37 @@ const upsertProfile = (dir, name, entry) => {
 	if (read.kind === "unusable") throw new Error(`${read.reason}. Refusing to rewrite it, because doing so would discard the profiles it defines. Fix or delete the file, then re-run.`);
 	const file = read.kind === "ok" ? read.file : {
 		version: 1,
-		profiles: { [DEFAULT_PROFILE]: { credentials: relativeToProfiles(path, credentialsPath(dir)) } }
+		profiles: { [DEFAULT_PROFILE]: { credentials: storedPointer(path, credentialsPath(dir)) } }
 	};
 	file.profiles[name] = {
-		credentials: relativeToProfiles(path, entry.credentials),
+		credentials: storedPointer(path, entry.credentials),
 		...entry.label ? { label: entry.label } : {},
 		...entry.userId ? { userId: entry.userId } : {}
 	};
 	writeProfiles(path, file);
 };
-/**
-* True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
-* lazy creation: a single-account install has no profiles file, before or after.
-*/
 const onlyDefaultRemains = (file) => {
 	const names = Object.keys(file.profiles);
 	return names.length === 0 || names.length === 1 && names[0] === "DEFAULT";
 };
+const canDropProfilesFile = (file) => {
+	if (!onlyDefaultRemains(file)) return false;
+	const remaining = file.profiles[DEFAULT_PROFILE];
+	return remaining === void 0 || !isKeyringPointer(remaining.credentials);
+};
+const locationForName = (dir, name) => locationOf(resolveProfile(dir, name));
+const newProfileLocation = (dir, name, storage) => storage === "keyring" ? {
+	profile: name,
+	storage: CRED_STORAGE_KEYRING
+} : {
+	profile: name,
+	storage: CRED_STORAGE_FILE,
+	path: newProfileCredentialsPath(dir, name)
+};
+const profilesUsingPath = (dir, path, except) => {
+	const resolved = resolve(path);
+	return listProfiles(dir).filter((profile) => profile.name !== except && profile.storage === "file" && resolve(profile.credentialsPath) === resolved).map((profile) => profile.name);
+};
 const listProfiles = (dir) => {
 	const read = inspectProfiles(dir);
 	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
@@ -203,10 +239,14 @@ const writeProfiles = (path, file) => {
 const resolveEntryPath = (dir, entry) => isAbsolute(entry) ? entry : resolve(profilesDir(dir), entry);
 /** `profiles.json` may sit in the legacy directory, so entries resolve against its own dir. */
 const profilesDir = (dir) => resolve(profilesFilePath(dir), "..");
-/** Keep entries relative when they sit near `profiles.json`; absolute paths stay absolute. */
-const relativeToProfiles = (profilesPath, target) => {
-	const rel = relative(resolve(profilesPath, ".."), target);
-	return rel && !isAbsolute(rel) ? rel : target;
+/** A relative file named `keyring` would otherwise collide with the storage sentinel. */
+const storedPointer = (profilesPath, credentials) => {
+	if (isKeyringPointer(credentials)) return KEYRING_CREDENTIALS;
+	const base = resolve(profilesPath, "..");
+	const abs = isAbsolute(credentials) ? credentials : resolve(base, credentials);
+	const rel = relative(base, abs);
+	const stored = rel && !isAbsolute(rel) ? rel : abs;
+	return stored === "keyring" ? `./${KEYRING_CREDENTIALS}` : stored;
 };
 function nonEmpty(value) {
 	if (typeof value !== "string") return void 0;
@@ -214,4 +254,4 @@ function nonEmpty(value) {
 	return trimmed === "" ? void 0 : trimmed;
 }
 //#endregion
-export { newProfileCredentialsPath as a, readProfiles as c, upsertProfile as d, listProfiles as i, resolveProfile as l, assertProfilesUsable as n, onlyDefaultRemains as o, assertValidProfileName as r, profilesFilePath as s, DEFAULT_PROFILE as t, selectProfileName as u };
+export { upsertProfile as _, canDropProfilesFile as a, writeSecretFile as b, listProfiles as c, newProfileLocation as d, profilesFilePath as f, selectProfileName as g, resolveProfile as h, assertValidProfileName as i, locationForName as l, readProfiles as m, KEYRING_CREDENTIALS as n, credentialsDisplay as o, profilesUsingPath as p, assertProfilesUsable as r, isKeyringPointer as s, DEFAULT_PROFILE as t, locationOf as u, CRED_STORAGE_FILE as v, CRED_STORAGE_KEYRING as y };

package/dist/_chunks/{psql-DWH-kc69.js → psql-BNljLda2.js}

@@ -284,13 +284,14 @@ const parseStartupArgs = (argv) => {
 	const applyShort = (letter, attachedValue, flagDisplay) => {
 		const takesArg = SHORT_WITH_ARG.has(letter);
 		let value;
-		if (takesArg) if (attachedValue !== void 0) value = attachedValue;
-		else {
-			const v = needValue(flagDisplay);
-			if (typeof v !== "string") return v;
-			value = v;
-		}
-		else if (attachedValue !== void 0) return {
+		if (takesArg) {
+			if (attachedValue !== void 0) value = attachedValue;
+			else {
+				const v = needValue(flagDisplay);
+				if (typeof v !== "string") return v;
+				value = v;
+			}
+		} else if (attachedValue !== void 0) return {
 			kind: "invalid-option",
 			message: `option does not take an argument -- ${letter}`
 		};

package/dist/_chunks/{rolldown-runtime-D7D4PA-g.js → rolldown-runtime-8H4AJuhK.js}

@@ -1,3 +1,4 @@
+import "node:module";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {

package/dist/analytics.js

@@ -1,9 +1,9 @@
-import { n as OAUTH, o as inspectCredentials } from "./_chunks/credentials-MYdHdKah.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-D2vw1UOw.js";
 import { getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { getApiClient, isNeonApiError } from "./api.js";
-import { n as credentialsPath } from "./_chunks/paths-DMq0Lt7a.js";
+import { r as credentialsPath } from "./_chunks/paths-g3DRqJiD.js";
 import "./config.js";
 import { getAuthContext } from "./auth_context.js";
 import { isCurrentBranchProbe } from "./context.js";
@@ -67,6 +67,7 @@ const storedCredentialAttribution = (storedUserId) => storedUserId ? {
 const telemetryCredential = (authContext, apiKey, defaultCredentialsPath) => {
 	if (authContext === null) return { credentialsPath: defaultCredentialsPath };
 	if (authContext.source === "api-key") return { apiKey };
+	if (authContext.storage === "keyring") return { apiKey };
 	return {
 		apiKey,
 		credentialsPath: authContext.credentialsPath ?? defaultCredentialsPath
@@ -102,12 +103,25 @@ const analyticsMiddleware = async (args) => {
 	if (isCurrentBranchProbe(args)) return;
 	const { apiKey: keyToQuery, credentialsPath: fileToRead } = telemetryCredential(getAuthContext(), args.apiKey, credentialsPath(args.configDir));
 	if (fileToRead !== void 0) try {
-		const read = inspectCredentials(fileToRead);
-		if (read.kind === "ok" && typeof read.credentials.user_id === "string") userId = read.credentials.user_id;
-		else if (read.kind !== "ok") log.debug("No usable credentials at %s", fileToRead);
+		const listing = storeFor(args.configDir).inspect({
+			profile: getAuthContext()?.profile ?? "DEFAULT",
+			storage: "file",
+			path: fileToRead
+		});
+		if (typeof listing.credentials?.user_id === "string") userId = listing.credentials.user_id;
+		else log.debug("No usable credentials at %s", fileToRead);
 	} catch (err) {
 		log.debug("Could not read %s: %s", fileToRead, err);
 	}
+	else if (getAuthContext()?.storage === "keyring") try {
+		const listing = storeFor(args.configDir).inspect({
+			profile: getAuthContext()?.profile ?? "DEFAULT",
+			storage: "keyring"
+		});
+		if (typeof listing.credentials?.user_id === "string") userId = listing.credentials.user_id;
+	} catch (err) {
+		log.debug("Could not read the OS keyring item: %s", err);
+	}
 	try {
 		if (keyToQuery) {
 			const apiClient = getApiClient({

package/dist/auth_context.js

@@ -1,6 +1,19 @@
-import { a as isOwnedCredentialPath } from "./_chunks/paths-DMq0Lt7a.js";
+import { o as isOwnedCredentialPath } from "./_chunks/paths-g3DRqJiD.js";
 import "./config.js";
 //#region src/auth_context.ts
+const locationFromContext = (context) => {
+	if (context.profile === void 0) return null;
+	if (context.storage === "keyring") return {
+		profile: context.profile,
+		storage: "keyring"
+	};
+	if (context.credentialsPath === void 0) return null;
+	return {
+		profile: context.profile,
+		storage: "file",
+		path: context.credentialsPath
+	};
+};
 let current = null;
 const setAuthContext = (context) => {
 	current = context;
@@ -10,27 +23,12 @@ const getAuthContext = () => current;
 const clearAuthContext = () => {
 	current = null;
 };
-/**
-* The credentials file a 401 should delete, or `null` to leave everything on disk.
-*
-* Only an expired OAuth token set is worth clearing: deleting it makes the next command log
-* in again, which is the recovery. Neither key-shaped source is.
-*
-* A key passed on the command line was never ours to store, so a 401 on it says nothing about
-* any stored credential — clearing one would sign the user out of an account the failed
-* request never used.
-*
-* A key read from a profile must survive for a sharper reason: unlike an OAuth token there is
-* nothing to refresh and no automatic way back, so deleting it would destroy the only copy of
-* a credential the user has to paste or mint again. It is also the expected state during
-* rotation, where the whole point is that the old key is dead and the file must still be there
-* to be replaced.
-*/
 const credentialsToClearOn401 = (context) => {
 	if (context?.source !== "stored-credentials") return null;
-	const path = context.credentialsPath;
-	if (path === void 0) return null;
-	return isOwnedCredentialPath(context.configDir, path) ? path : null;
+	const at = locationFromContext(context);
+	if (at === null) return null;
+	if (at.storage === "keyring") return null;
+	return isOwnedCredentialPath(context.configDir, at.path) ? at : null;
 };
 /**
 * What to tell the user when the API rejects their credential, naming the profile and file
@@ -38,10 +36,13 @@ const credentialsToClearOn401 = (context) => {
 */
 const authFailureMessage = (context) => {
 	const profile = context?.profile ?? "the selected profile";
-	const where = context?.credentialsPath !== void 0 ? ` (${context.credentialsPath})` : "";
-	if (context?.source === "profile-api-key") return `Authentication failed: the Neon API rejected profile "${profile}"'s API key${where}. Replace it with \`neon profile create ${profile} --mint --force\`, or store another with \`neon profile create ${profile} --api-key - --force\`.`;
-	if (context?.source === "stored-credentials") return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. That file was not created by neon, so it was left alone — sign in again with \`neon auth --profile ${profile}\`.`;
+	const where = context?.storage === "keyring" ? " (OS keyring)" : context?.credentialsPath !== void 0 ? ` (${context.credentialsPath})` : "";
+	if (context?.source === "profile-api-key") return `Authentication failed: the Neon API rejected profile "${profile}"'s API key${where}. Replace it with \`neon profile create ${profile} --mint\`, or store another with \`neon profile create ${profile} --api-key -\`.`;
+	if (context?.source === "stored-credentials") {
+		if (context.storage === "keyring") return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session (OS keyring). Sign in again with \`neon auth --profile ${profile}\`.`;
+		return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. That file was not created by neon, so it was left alone — sign in again with \`neon auth --profile ${profile}\`.`;
+	}
 	return "Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.";
 };
 //#endregion
-export { authFailureMessage, clearAuthContext, credentialsToClearOn401, getAuthContext, setAuthContext };
+export { authFailureMessage, clearAuthContext, credentialsToClearOn401, getAuthContext, locationFromContext, setAuthContext };

package/dist/commands/api.js

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { getEndpoints, loadSpec } from "../utils/openapi.js";
 import { writer } from "../writer.js";
 import { readFileSync } from "node:fs";

package/dist/commands/api_keys.js

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";