neon 3.2.2 → 3.3.0

package/dist/commands/profile.js

@@ -1,16 +1,15 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
-import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
-import { a as describeScope, c as isSameCredential, d as writeCredentials, i as credentialKind, l as readCredentials, n as OAUTH, o as inspectCredentials, r as apiKeyCredentials, s as interpretCredentials, t as API_KEY, u as scopeOf } from "../_chunks/credentials-MYdHdKah.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { _ as upsertProfile, a as canDropProfilesFile, b as writeSecretFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "../_chunks/profiles-CVXNvU2r.js";
+import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-D2vw1UOw.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
-import { i as isInsideConfigDir } from "../_chunks/paths-DMq0Lt7a.js";
-import "../config.js";
+import { o as isOwnedCredentialPath, r as credentialsPath } from "../_chunks/paths-g3DRqJiD.js";
 import { setAuthContext } from "../auth_context.js";
 import { auth, revokeToken } from "../auth.js";
-import { a as newProfileCredentialsPath, c as readProfiles, d as upsertProfile, i as listProfiles, l as resolveProfile, n as assertProfilesUsable, o as onlyDefaultRemains, r as assertValidProfileName, s as profilesFilePath, u as selectProfileName } from "../_chunks/profiles-Ir29rqns.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
-import { authFlow, credentialsPathForName, usableCredential } from "./auth.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
+import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
+import { authFlow, usableCredential } from "./auth.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { orgIdForProject } from "./api_keys.js";
@@ -55,12 +54,22 @@ const builder = (argv) => argv.usage("$0 profile <sub-command> [options]").comma
 		type: "string",
 		coerce: single("project-id")
 	},
+	keyring: {
+		describe: "Store the credential in the OS keyring. Per profile; later create without the flag stays there. See `neon profile list`.",
+		type: "boolean"
+	},
 	force: {
-		describe: "Replace an existing profile, revoking the credential it holds now",
-		type: "boolean",
-		default: false
+		hidden: true,
+		type: "boolean"
 	}
-}).conflicts("org-id", "project-id").strict().check(noPassthrough("profile create")).example("$0 profile create work", "Sign in with the browser, like `neon auth --profile work`").example("$0 profile create work --api-key \"$KEY\"", "Store a key you already have").example("echo \"$KEY\" | $0 profile create work --api-key -", "Or pipe it, so it never reaches the process arguments").example("$0 profile create ci --mint --org-id org-abc-123", "One browser sign-in, then an org-scoped key and no session left behind"), async (args) => await create(args)).command("rotate-key <name>", "Mint a fresh API key for a profile, at the same scope, and revoke the one it replaces", (y) => y.positional("name", {
+}).conflicts("org-id", "project-id").strict().check((argv) => {
+	noPassthrough("profile create")(argv);
+	if (argv.force === true) {
+		const name = typeof argv.name === "string" ? argv.name : "NAME";
+		throw new Error(`--force is no longer a flag. \`neon profile create ${name}\` always replaces an existing profile and revokes the credential it held. Drop --force.`);
+	}
+	return true;
+}).example("$0 profile create work", "Sign in with the browser, like `neon auth --profile work`").example("$0 profile create work --api-key \"$KEY\"", "Store a key you already have").example("echo \"$KEY\" | $0 profile create work --api-key -", "Or pipe it, so it never reaches the process arguments").example("$0 profile create ci --mint --org-id org-abc-123", "One browser sign-in, then an org-scoped key and no session left behind").example("$0 profile create work --keyring", "Store the credential in the OS keyring instead of a file"), async (args) => await create(args)).command("rotate-key <name>", "Mint a fresh API key for a profile, at the same scope, and revoke the one it replaces", (y) => y.positional("name", {
 	describe: "Profile to rotate",
 	type: "string",
 	demandOption: true
@@ -114,10 +123,11 @@ const rejectApiKeyFlag = (sub, instead) => {
 * rather than throwing: one broken profile must not hide every other row, and the whole point
 * of `list` is to show the state of things including the broken parts.
 */
-const describeAuth = (stored, at) => {
+const hintStore = (storage) => storage === "keyring" ? "keyring" : "file";
+const describeAuth = (stored, at, store = "file") => {
 	if (stored === null) return "-";
 	try {
-		return interpretCredentials(stored, at).kind === "api_key" ? "api key" : "oauth";
+		return interpretCredentials(stored, at, store).kind === "api_key" ? "api key" : "oauth";
 	} catch (err) {
 		log.warning(err instanceof Error ? err.message : String(err));
 		return "invalid";
@@ -134,26 +144,21 @@ const describeAuth = (stored, at) => {
 * unreadable used to show `File: ok` beside `Auth: invalid`, so the column a user scans to find
 * the broken profile pointed at a different row than the one that was broken.
 */
-const inspectForListing = (at) => {
-	const read = inspectCredentials(at.path);
-	if (read.kind === "unusable") {
-		log.warning(read.reason);
-		return {
-			stored: null,
-			auth: "-",
-			file: "invalid"
-		};
-	}
-	if (read.kind === "absent") return {
+const inspectForListing = (configDir, at) => {
+	const listing = storeFor(configDir).inspect(at);
+	if (listing.reason !== void 0) log.warning(listing.reason);
+	if (listing.credentials === null) return {
 		stored: null,
 		auth: "-",
-		file: "missing"
+		file: listing.file,
+		storage: listing.storage
 	};
-	const auth = describeAuth(read.credentials, at);
+	const auth = describeAuth(listing.credentials, at, hintStore(listing.storage));
 	return {
-		stored: read.credentials,
+		stored: listing.credentials,
 		auth,
-		file: auth === "invalid" ? "invalid" : "ok"
+		file: auth === "invalid" ? "invalid" : listing.file,
+		storage: listing.storage
 	};
 };
 const list = async (props) => {
@@ -161,10 +166,7 @@ const list = async (props) => {
 	const active = selectProfileName(props.profile);
 	if (props.profile !== void 0 && props.profile.trim() !== "") resolveProfile(props.configDir, active);
 	const rows = listProfiles(props.configDir).map((p) => {
-		const { stored, auth, file } = inspectForListing({
-			path: p.credentialsPath,
-			profile: p.name
-		});
+		const { stored, auth, file, storage } = inspectForListing(props.configDir, locationOf(p));
 		const storedUserId = typeof stored?.user_id === "string" ? stored.user_id : void 0;
 		return {
 			active: p.name === active ? "*" : "",
@@ -173,7 +175,8 @@ const list = async (props) => {
 			auth,
 			scope: stored !== null && auth === "api key" ? describeScope(scopeOf(stored)) : "-",
 			file,
-			...props.output === "table" ? { credentials: basename(p.credentialsPath) } : { credentials: p.credentialsPath }
+			storage,
+			...props.output === "table" ? { credentials: p.storage === "keyring" ? KEYRING_CREDENTIALS : basename(p.credentialsPath) } : { credentials: credentialsDisplay(p) }
 		};
 	});
 	writer(props).end(rows, {
@@ -185,71 +188,46 @@ const list = async (props) => {
 			"auth",
 			"scope",
 			"file",
+			"storage",
 			"credentials"
 		]
 	});
 };
-/**
-* The credential a command is about to replace or delete.
-*
-* Deliberately tolerant where {@link readCredentials} is fatal. Using a damaged credential must
-* fail loudly, but *replacing* one must not: `readCredentials` throwing here made the repair its
-* own error message recommends impossible, and left a malformed file unremovable through the
-* CLI. There is nothing to revoke in a file we cannot parse, so this says so and moves on.
-*/
-const readOutgoingCredential = (at) => {
-	const read = inspectCredentials(at.path);
-	const unusable = (reason) => {
-		log.warning("%s. Nothing in it could be revoked, so it is only being replaced locally.", reason.replace(/\.$/, ""));
-		return null;
+const locationForCreate = (configDir, name, keyring) => {
+	assertProfilesUsable(configDir, name);
+	const declared = readProfiles(configDir)?.profiles[name];
+	const pointer = declared !== void 0 && isKeyringPointer(declared.credentials);
+	if (keyring === true || pointer) return {
+		profile: name,
+		storage: CRED_STORAGE_KEYRING
 	};
-	if (read.kind === "unusable") return unusable(read.reason);
-	if (read.kind === "absent") return null;
+	if (declared !== void 0 || name === "DEFAULT") return locationForName(configDir, name);
+	return newProfileLocation(configDir, name, CRED_STORAGE_FILE);
+};
+const existingLocation = (configDir, name) => {
 	try {
-		const credential = interpretCredentials(read.credentials, at);
-		if (credential.kind === "oauth") return {
-			kind: OAUTH,
-			tokens: read.credentials
-		};
-		return {
-			kind: API_KEY,
-			apiKey: credential.apiKey,
-			...typeof read.credentials.key_id === "number" ? { keyId: read.credentials.key_id } : {},
-			scope: scopeOf(read.credentials)
-		};
-	} catch (err) {
-		return unusable(err instanceof Error ? err.message : String(err));
+		if (readProfiles(configDir)?.profiles[name] !== void 0 || name === "DEFAULT") return locationForName(configDir, name);
+	} catch {
+		return null;
 	}
+	return null;
 };
-const credentialsPathFor = (configDir, name) => {
-	assertProfilesUsable(configDir, name);
-	if (readProfiles(configDir)?.profiles[name] || name === "DEFAULT") return credentialsPathForName(configDir, name);
-	return newProfileCredentialsPath(configDir, name);
+const warnIfKeyringRollbackUnconfirmed = (cleared, profile) => {
+	if (cleared === "cleared") return;
+	log.warning("Could not confirm the new OS keyring item for profile \"%s\" was removed after a failed save.", profile);
 };
-/**
-* Refuse to overwrite an existing profile unless asked to, and say what `--force` destroys.
-*
-* Naming the consequence is the point. `--force` does not merely point the profile somewhere
-* else: {@link retirePreviousCredential} revokes the credential being replaced, so a key this
-* CLI minted dies upstream — including the copy the user pasted into CI or another machine,
-* which is not recoverable, only re-mintable. A message promising "replace its credential"
-* described a local edit and made the irreversible half a surprise.
-*/
-const assertReplaceable = (props) => {
-	const { name, configDir, force } = props;
-	if (force) return;
-	const declared = readProfiles(configDir)?.profiles[name];
-	const path = credentialsPathFor(configDir, name);
-	if (!declared && !(name === "DEFAULT" && existsSync(path))) return;
-	const existing = inspectCredentials(path);
-	const stored = existing.kind === "ok" ? existing.credentials : null;
-	const holdsKey = stored !== null && credentialKind(stored, {
-		path,
-		profile: name
-	}) === "api_key";
-	const keyId = typeof stored?.key_id === "number" ? stored.key_id : void 0;
-	if (holdsKey) throw new Error(keyId !== void 0 ? `Profile "${name}" already exists and holds an API key minted here (id ${keyId}). Pass --force to replace it — the key is revoked, wherever else it is in use. To keep the profile and swap the key instead: \`neon profile rotate-key ${name}\`.` : `Profile "${name}" already exists and holds an API key you supplied, which stays live on the account either way — only keys minted here record an id to revoke. Pass --force to replace it locally, or \`neon profile rotate-key ${name}\` to mint one at the same scope.`);
-	throw new Error(`Profile "${name}" already exists and holds a browser sign-in. Pass --force to replace it — the session is signed out as part of the replacement.`);
+const deleteLeftoverOwnedFile = (configDir, path, except) => {
+	if (!isOwnedCredentialPath(configDir, path)) return;
+	if (profilesUsingPath(configDir, path, except).length > 0) return;
+	try {
+		storeFor(configDir).delete({
+			profile: except,
+			storage: CRED_STORAGE_FILE,
+			path
+		});
+	} catch {
+		log.warning("Saved the keyring item but could not delete %s", path);
+	}
 };
 /** `--api-key -` means "read it from stdin", the usual convention for a piped value. */
 const STDIN = "-";
@@ -314,7 +292,7 @@ const create = async (props) => {
 	rejectProfileFlag(props, "create");
 	assertValidProfileName(name);
 	assertProfilesUsable(props.configDir, name);
-	assertReplaceable(props);
+	if (props.keyring === true) storeFor(props.configDir).assertKeyringWritable(existingLocation(props.configDir, name)?.storage === "keyring" ? name : void 0);
 	const suppliedKey = credentialInputs().apiKeyFlag.trim() !== "";
 	if (props.mint) {
 		if (suppliedKey) throw new Error("--mint creates a new key, so it cannot be combined with --api-key. Drop one.");
@@ -324,47 +302,53 @@ const create = async (props) => {
 	if ((props.orgId ?? props.projectId) !== void 0) throw new Error("--org-id and --project-id only apply with --mint: they choose what a key we mint can reach, and a key you supply already has a scope.");
 	if (!suppliedKey) {
 		if (isCi() && props.forceAuth !== true) throw new Error(`\`neon profile create ${name}\` with no key signs in through the browser, which cannot happen in CI. Pass a key instead: \`neon profile create ${name} --api-key "$KEY"\`, or pipe it with \`echo "$KEY" | neon profile create ${name} --api-key -\`.`);
-		const credentialsPath = credentialsPathFor(props.configDir, name);
-		const previous = readOutgoingCredential({
-			path: credentialsPath,
-			profile: name
-		});
+		const at = locationForCreate(props.configDir, name, props.keyring);
+		const existing = existingLocation(props.configDir, name);
+		const previous = existing === null ? null : readOutgoingCredential(props.configDir, existing);
 		if (await authFlow({
 			...props,
 			_: ["auth"],
-			profile: name
+			profile: name,
+			keyring: props.keyring
 		}) === "") throw new Error(`Could not save credentials for profile "${name}".`);
-		await retirePreviousCredential(props, name, previous);
+		if (at.storage !== "keyring") await retirePreviousCredential(props, name, previous);
 		const signedIn = readProfiles(props.configDir, log.warning)?.profiles[name];
 		report(props, {
 			name,
 			account: signedIn?.label ?? signedIn?.userId ?? "unknown account",
 			auth: "oauth",
 			scope: "-",
-			credentials: credentialsPath
+			credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
+			storage: at.storage
 		});
 		return;
 	}
 	const apiKey = resolveKeyToStore(props);
 	const identity = await verifyKey(props, apiKey);
-	const credentialsPath = credentialsPathFor(props.configDir, name);
-	const previous = readOutgoingCredential({
-		path: credentialsPath,
-		profile: name
-	});
-	writeCredentials(credentialsPath, apiKeyCredentials({
+	const at = locationForCreate(props.configDir, name, props.keyring);
+	const existing = existingLocation(props.configDir, name);
+	if (at.storage === "keyring") storeFor(props.configDir).assertKeyringWritable(existing?.storage === "keyring" ? name : void 0);
+	const previous = existing === null ? null : readOutgoingCredential(props.configDir, existing);
+	storeFor(props.configDir).write(at, apiKeyCredentials({
 		apiKey,
 		...identity.userId !== void 0 ? { userId: identity.userId } : {},
 		...identity.orgId !== void 0 ? { scope: { orgId: identity.orgId } } : {}
 	}));
+	try {
+		recordProfile(props, name, at, identity);
+	} catch (err) {
+		if (at.storage === "keyring" && existing?.storage !== "keyring") warnIfKeyringRollbackUnconfirmed(storeFor(props.configDir).delete(at, { required: false }), name);
+		throw err instanceof Error ? err : new Error(String(err));
+	}
 	await retirePreviousCredential(props, name, previous, apiKey);
-	recordProfile(props, name, credentialsPath, identity);
+	if (at.storage === "keyring" && existing?.storage === "file") deleteLeftoverOwnedFile(props.configDir, existing.path, name);
 	report(props, {
 		name,
 		account: identity.label ?? "unknown account",
 		auth: "api key",
 		scope: describeScope(identity.orgId !== void 0 ? { orgId: identity.orgId } : {}),
-		credentials: credentialsPath
+		credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
+		storage: at.storage
 	});
 	log.warning("A key you supplied cannot be revoked by `rotate-key` or `remove` — only keys minted here record an id.");
 };
@@ -404,14 +388,15 @@ const report = (props, record) => {
 			"auth",
 			"scope",
 			...record.keyId !== void 0 ? ["keyId"] : [],
-			"credentials"
+			"credentials",
+			...record.storage !== void 0 ? ["storage"] : []
 		],
 		title: "Profile"
 	});
 };
-const recordProfile = (props, name, credentialsPath, identity) => {
+const recordProfile = (props, name, at, identity) => {
 	upsertProfile(props.configDir, name, {
-		credentials: credentialsPath,
+		credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
 		...identity.label ? { label: identity.label } : {},
 		...identity.userId ? { userId: identity.userId } : {}
 	});
@@ -427,6 +412,7 @@ const recordProfile = (props, name, credentialsPath, identity) => {
 const createByMinting = async (props) => {
 	const { name } = props;
 	if (isCi() && props.forceAuth !== true) throw new Error(`--mint needs a browser sign-in, which cannot happen in CI. Mint the key with \`neon api-keys create --name ${name}\` and pipe it in: echo "$KEY" | neon profile create ${name} --api-key -`);
+	if (locationForCreate(props.configDir, name, props.keyring).storage === "keyring") storeFor(props.configDir).assertKeyringWritable(existingLocation(props.configDir, name)?.storage === "keyring" ? name : void 0);
 	const oauthProps = {
 		oauthHost: props.oauthHost,
 		clientId: props.clientId,
@@ -445,27 +431,33 @@ const createByMinting = async (props) => {
 		mintedScope = scope;
 		minted = await mintKey(session, name, scope);
 		const identity = await verifyKey(props, minted.key, "minted");
-		const credentialsPath = credentialsPathFor(props.configDir, name);
-		const previous = readOutgoingCredential({
-			path: credentialsPath,
-			profile: name
-		});
-		writeCredentials(credentialsPath, apiKeyCredentials({
+		const at = locationForCreate(props.configDir, name, props.keyring);
+		const existing = existingLocation(props.configDir, name);
+		const previous = existing === null ? null : readOutgoingCredential(props.configDir, existing);
+		storeFor(props.configDir).write(at, apiKeyCredentials({
 			apiKey: minted.key,
 			keyId: minted.id,
 			...identity.userId !== void 0 ? { userId: identity.userId } : {},
 			scope
 		}));
-		keyIsReachable = true;
+		try {
+			recordProfile(props, name, at, identity);
+		} catch (err) {
+			if (at.storage === "keyring" && existing?.storage !== "keyring") warnIfKeyringRollbackUnconfirmed(storeFor(props.configDir).delete(at, { required: false }), name);
+			else keyIsReachable = true;
+			throw err instanceof Error ? err : new Error(String(err));
+		}
 		await retirePreviousCredential(props, name, previous, minted.key);
-		recordProfile(props, name, credentialsPath, identity);
+		if (at.storage === "keyring" && existing?.storage === "file") deleteLeftoverOwnedFile(props.configDir, existing.path, name);
+		keyIsReachable = true;
 		report(props, {
 			name,
 			account: identity.label ?? "unknown account",
 			auth: "api key",
 			scope: describeScope(scope),
 			keyId: minted.id,
-			credentials: credentialsPath
+			credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
+			storage: at.storage
 		});
 		warnAboutReach(scope);
 	} finally {
@@ -489,36 +481,6 @@ const resolveMintScope = async (props, client) => {
 	};
 };
 /**
-* Revoke a credential a profile has just stopped using.
-*
-* Called with the credential read *before* the overwrite, and only *after* the replacement is
-* durable. Both halves matter. Reading it first is the only chance: a minted key's `key_id` and
-* an OAuth refresh token are gone the moment the file is rewritten, so nothing could revoke
-* them afterwards. Revoking last is what stops a cancelled sign-in or a failed write from
-* leaving the profile holding a credential that has already been killed.
-*/
-const retirePreviousCredential = async (props, name, existing, replacementKey) => {
-	if (existing === null) return;
-	if (existing.kind === "api_key") {
-		if (isSameCredential(existing.apiKey, replacementKey)) {
-			log.debug("The replacement is the credential already stored; nothing to retire.");
-			return;
-		}
-		if (existing.keyId === void 0) {
-			log.warning("Profile \"%s\" held an API key that was supplied rather than minted here, so it stays live on the account — find it with `neon api-keys list`.", name);
-			return;
-		}
-		const client = getApiClient({
-			apiKey: existing.apiKey,
-			apiHost: props.apiHost
-		});
-		log.info(await withdrawKey(client, existing.scope, existing.keyId) ? `Revoked the key it replaces (id ${existing.keyId})` : `Could not revoke the key it replaces (id ${existing.keyId}); it may still be live. Remove it with: neon api-keys revoke ${existing.keyId}`);
-		return;
-	}
-	const revoked = await revokeTokenSet(existing.tokens, props);
-	log.info(revoked ? "Signed out the session it replaced" : "Could not sign out the session it replaced; it will expire on its own");
-};
-/**
 * Mint a key at the given scope and refuse anything that came back different.
 *
 * A 2xx is not enough. A response with no `key` leaves a live credential the user can never
@@ -541,30 +503,16 @@ const mintKey = async (client, profile, scope) => {
 	const withdrawn = await withdrawKey(client, scope, data.id);
 	throw new Error(`${problem} ${withdrawn ? "The key has been revoked; nothing was stored." : `The key could NOT be revoked and may still be live. Remove it with \`neon api-keys revoke ${data.id}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}\`.`}`);
 };
-/** Best-effort withdrawal of a key we are refusing to store. Never throws. */
-const withdrawKey = async (client, scope, keyId) => {
-	if (!Number.isSafeInteger(keyId) || keyId <= 0) return false;
-	try {
-		const { data } = scope.orgId ? await client.revokeOrgApiKey(scope.orgId, keyId) : await client.revokeApiKey(keyId);
-		return data.revoked === true && data.id === keyId;
-	} catch (err) {
-		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
-		return false;
-	}
-};
 const rotateKey = async (props) => {
 	const { name } = props;
 	rejectProfileFlag(props, "rotate-key");
-	rejectApiKeyFlag("rotate-key", `To store a key you already have, use \`neon profile create ${name} --api-key - --force\`.`);
+	rejectApiKeyFlag("rotate-key", `To store a key you already have, use \`neon profile create ${name} --api-key -\`.`);
 	const profile = resolveProfile(props.configDir, name);
-	const at = {
-		path: profile.credentialsPath,
-		profile: name
-	};
+	const at = locationOf(profile);
 	const credential = await usableCredential(props, at);
-	if (credential === null) throw new Error(`Profile "${name}" has no usable credential to mint with. Replace it with \`neon profile create ${name} --mint --force\`.`);
-	if (credential.kind !== "api_key") throw new Error(`Profile "${name}" holds a browser sign-in, not an API key, so there is no key to rotate. Turn it into a key profile with \`neon profile create ${name} --mint --force\`.`);
-	const stored = readCredentials(at);
+	if (credential === null) throw new Error(`Profile "${name}" has no usable credential to mint with. Replace it with \`neon profile create ${name} --mint\`.`);
+	if (credential.kind !== "api_key") throw new Error(`Profile "${name}" holds a browser sign-in, not an API key, so there is no key to rotate. Turn it into a key profile with \`neon profile create ${name} --mint\`.`);
+	const stored = storeFor(props.configDir).read(at)?.credentials ?? null;
 	const scope = stored !== null ? scopeOf(stored) : {};
 	const previousKeyId = typeof stored?.key_id === "number" ? stored.key_id : void 0;
 	const minting = getApiClient({
@@ -575,24 +523,25 @@ const rotateKey = async (props) => {
 		source: "profile-api-key",
 		configDir: props.configDir,
 		profile: name,
-		credentialsPath: profile.credentialsPath
+		storage: at.storage,
+		...at.storage === "file" ? { credentialsPath: at.path } : {}
 	});
 	const { data: details } = await minting.getAuthDetails();
 	if (details.auth_method === "api_key_org") {
-		const advice = scope.projectId !== void 0 ? `\`neon profile create ${name} --mint --project-id ${scope.projectId} --force\`` : scope.orgId !== void 0 && previousKeyId !== void 0 ? `\`neon profile create ${name} --mint --org-id ${scope.orgId} --force\`` : `\`neon profile create ${name} --mint --org-id ${details.account_id} --force\` — but check \`neon api-keys list --org-id ${details.account_id}\` first, because a key you supplied may have been narrowed to a single project and an organization key would reach more`;
+		const advice = scope.projectId !== void 0 ? `\`neon profile create ${name} --mint --project-id ${scope.projectId}\`` : scope.orgId !== void 0 && previousKeyId !== void 0 ? `\`neon profile create ${name} --mint --org-id ${scope.orgId}\`` : `\`neon profile create ${name} --mint --org-id ${details.account_id}\` — but check \`neon api-keys list --org-id ${details.account_id}\` first, because a key you supplied may have been narrowed to a single project and an organization key would reach more`;
 		throw new Error(`Profile "${name}" holds an organization key, and only a personal credential can mint organization keys — so it cannot mint its own replacement. Sign in and mint one with ${advice}.`);
 	}
 	const created = await mintKey(minting, name, scope);
 	log.info("Minted %s (id %d, %s)", created.name, created.id, describeScope(scope));
 	try {
-		writeCredentials(profile.credentialsPath, apiKeyCredentials({
+		storeFor(props.configDir).write(at, apiKeyCredentials({
 			apiKey: created.key,
 			keyId: created.id,
 			...typeof stored?.user_id === "string" ? { userId: stored.user_id } : {},
 			scope
 		}));
 	} catch (err) {
-		log.error("Minted key %d but could not write %s. Revoke it with: neon api-keys revoke %d%s", created.id, profile.credentialsPath, created.id, scope.orgId ? ` --org-id ${scope.orgId}` : "");
+		log.error("Minted key %d but could not write %s. Revoke it with: neon api-keys revoke %d%s", created.id, credentialLabel(at), created.id, scope.orgId ? ` --org-id ${scope.orgId}` : "");
 		throw err;
 	}
 	report(props, {
@@ -601,7 +550,8 @@ const rotateKey = async (props) => {
 		auth: "api key",
 		scope: describeScope(scope),
 		keyId: created.id,
-		credentials: profile.credentialsPath
+		credentials: credentialsDisplay(profile),
+		storage: at.storage
 	});
 	if (previousKeyId === void 0) {
 		log.warning("No previous key id was recorded, so the key this replaces is still live. It was supplied rather than minted here, and `GET /api_keys` exposes no prefix to match it by — find it with `neon api-keys list`.");
@@ -633,11 +583,14 @@ const remove = async (props) => {
 		});
 		if (!ok) throw new Error(`Cancelled — profile "${name}" was not removed.`);
 	}
-	const at = {
-		path: profile.credentialsPath,
-		profile: name
-	};
-	const stored = readOutgoingCredential(at);
+	const at = locationOf(profile);
+	let stored = null;
+	try {
+		stored = readOutgoingCredential(props.configDir, at);
+	} catch (err) {
+		if (at.storage === "keyring") log.warning("Could not read the OS keyring item for profile \"%s\"; nothing in it could be revoked.", name);
+		else log.warning("%s. Nothing in it could be revoked.", (err instanceof Error ? err.message : String(err)).replace(/\.$/, ""));
+	}
 	if (stored?.kind === "api_key") {
 		const { keyId, scope } = stored;
 		if (keyId === void 0) log.warning("Profile \"%s\" holds an API key that was supplied rather than minted here, so it stays live on the account — find it with `neon api-keys list`.", name);
@@ -652,31 +605,59 @@ const remove = async (props) => {
 		const revoked = await revokeTokenSet(stored.tokens, props);
 		log.info(revoked ? "Revoked the OAuth token" : "Could not revoke the OAuth token — removing locally anyway");
 	}
-	if (existsSync(profile.credentialsPath)) if (isInsideConfigDir(props.configDir, profile.credentialsPath)) {
-		rmSync(profile.credentialsPath);
-		log.info("Deleted %s", profile.credentialsPath);
-	} else log.info("Left %s on disk — not created by neon", profile.credentialsPath);
-	const path = profilesFilePath(props.configDir);
-	const file = readProfiles(props.configDir, log.warning);
-	if (file?.profiles[name]) {
-		delete file.profiles[name];
-		if (onlyDefaultRemains(file)) {
-			rmSync(path);
-			log.info("Removed \"%s\" — no profiles left, deleted %s", name, path);
-		} else {
-			writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
-			log.info("Removed \"%s\" from %s", name, path);
+	const dropPointer = () => {
+		assertProfilesUsable(props.configDir, name);
+		const path = profilesFilePath(props.configDir);
+		const file = readProfiles(props.configDir, log.warning);
+		if (file?.profiles[name]) {
+			delete file.profiles[name];
+			if (canDropProfilesFile(file)) {
+				rmSync(path);
+				log.info("Removed \"%s\" — no profiles left, deleted %s", name, path);
+			} else {
+				writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
+				log.info("Removed \"%s\" from %s", name, path);
+			}
+		} else if (name === "DEFAULT") log.info("Signed out of DEFAULT");
+	};
+	const listing = storeFor(props.configDir).inspect(at);
+	if (at.storage === "keyring") {
+		const account = keyringAccount(props.configDir, name);
+		if (name === "DEFAULT") {
+			const leftover = credentialsPath(props.configDir);
+			if (isOwnedCredentialPath(props.configDir, leftover) && existsSync(leftover) && profilesUsingPath(props.configDir, leftover, name).length === 0) {
+				storeFor(props.configDir).delete({
+					profile: name,
+					storage: CRED_STORAGE_FILE,
+					path: leftover
+				}, { required: false });
+				if (existsSync(leftover)) throw new Error(`Could not delete ${leftover}. Refusing to reset DEFAULT — that file would become the profile.`);
+				log.info("Deleted %s", leftover);
+			}
 		}
-	} else if (name === "DEFAULT") log.info("Signed out of DEFAULT");
-};
-/** Revoke the OAuth refresh token in a credential we already have in hand. */
-const revokeTokenSet = async (credentials, props) => {
-	const tokenSet = credentials;
-	return await revokeToken({
-		oauthHost: props.oauthHost,
-		clientId: props.clientId,
-		...props.allowUnsafeTls ? { allowUnsafeTls: props.allowUnsafeTls } : {}
-	}, tokenSet);
+		dropPointer();
+		if (listing.reason?.includes("cannot use the OS keyring")) {
+			log.warning("This CLI cannot delete the OS keyring item for profile \"%s\". It remains in the OS store (service %s, account %s) until a CLI with the keyring addon removes it, or you delete it there.", name, KEYRING_SERVICE, account);
+			return;
+		}
+		let cleared = "unconfirmed";
+		try {
+			cleared = storeFor(props.configDir).delete(at, {
+				required: false,
+				account
+			});
+		} catch {
+			cleared = "unconfirmed";
+		}
+		if (cleared === "cleared") log.info("Deleted the OS keyring item for profile \"%s\"", name);
+		else log.warning("Could not confirm the OS keyring item for profile \"%s\" is gone. A leftover may still be in the OS store (service %s, account %s); it is not used once the profile is gone.", name, KEYRING_SERVICE, account);
+		return;
+	}
+	if (isOwnedCredentialPath(props.configDir, at.path)) {
+		storeFor(props.configDir).delete(at);
+		if (listing.credentials !== null || listing.file !== "missing") log.info("Deleted %s", at.path);
+	} else if (existsSync(at.path)) log.info("Left %s on disk — not created by neon", at.path);
+	dropPointer();
 };
 //#endregion
 export { aliases, builder, command, describe, handler, profile_exports as t };

package/dist/commands/projects.js

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody } from "../api.js";

package/dist/commands/psql.js

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { SSL_MODES, handler as handler$1 } from "./connection_string.js";

package/dist/commands/roles.js

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";