neon 3.2.2 → 3.4.0

package/dist/retire_credential.js

@@ -0,0 +1,86 @@
+import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-D2vw1UOw.js";
+import { log } from "./log.js";
+import { getApiClient } from "./api.js";
+import { revokeToken } from "./auth.js";
+//#region src/retire_credential.ts
+/**
+* Malformed credentials cannot be revoked, but they must remain replaceable and removable.
+*/
+const readOutgoingCredential = (configDir, at) => {
+	const listing = storeFor(configDir).inspect(at);
+	const store = listing.storage === "keyring" ? "keyring" : "file";
+	const unusable = (reason) => {
+		log.warning("%s. Nothing in it could be revoked.", reason.replace(/\.$/, ""));
+		return null;
+	};
+	if (listing.reason !== void 0 && listing.credentials === null) {
+		if (at.storage === "keyring") {
+			log.warning("Could not read the OS keyring item for profile \"%s\"; nothing in it could be revoked.", at.profile);
+			return null;
+		}
+		return unusable(listing.reason);
+	}
+	if (listing.credentials === null) return null;
+	try {
+		const credential = interpretCredentials(listing.credentials, at, store);
+		if (credential.kind === "oauth") return {
+			kind: OAUTH,
+			tokens: listing.credentials
+		};
+		return {
+			kind: API_KEY,
+			apiKey: credential.apiKey,
+			...typeof listing.credentials.key_id === "number" ? { keyId: listing.credentials.key_id } : {},
+			scope: scopeOf(listing.credentials)
+		};
+	} catch (err) {
+		return unusable(err instanceof Error ? err.message : String(err));
+	}
+};
+/**
+* Read the outgoing credential before overwrite, but retire it only after the replacement is
+* durable: overwrite destroys revocation metadata, while early retirement can strand the
+* profile without a working credential.
+*/
+const retirePreviousCredential = async (props, name, existing, replacementKey) => {
+	if (existing === null) return;
+	if (existing.kind === "api_key") {
+		if (isSameCredential(existing.apiKey, replacementKey)) {
+			log.debug("The replacement is the credential already stored; nothing to retire.");
+			return;
+		}
+		if (existing.keyId === void 0) {
+			log.warning("Profile \"%s\" held an API key that was supplied rather than minted here, so it stays live on the account — find it with `neon api-keys list`.", name);
+			return;
+		}
+		const client = getApiClient({
+			apiKey: existing.apiKey,
+			apiHost: props.apiHost
+		});
+		log.info(await withdrawKey(client, existing.scope, existing.keyId) ? `Revoked the key it replaces (id ${existing.keyId})` : `Could not revoke the key it replaces (id ${existing.keyId}); it may still be live. Remove it with: neon api-keys revoke ${existing.keyId}`);
+		return;
+	}
+	const revoked = await revokeTokenSet(existing.tokens, props);
+	log.info(revoked ? "Signed out the session it replaced" : "Could not sign out the session it replaced; it will expire on its own");
+};
+/** A failed revoke must not strand the caller. */
+const withdrawKey = async (client, scope, keyId) => {
+	if (!Number.isSafeInteger(keyId) || keyId <= 0) return false;
+	try {
+		const { data } = scope.orgId ? await client.revokeOrgApiKey(scope.orgId, keyId) : await client.revokeApiKey(keyId);
+		return data.revoked === true && data.id === keyId;
+	} catch (err) {
+		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
+		return false;
+	}
+};
+const revokeTokenSet = async (credentials, props) => {
+	const tokenSet = credentials;
+	return await revokeToken({
+		oauthHost: props.oauthHost,
+		clientId: props.clientId,
+		...props.allowUnsafeTls ? { allowUnsafeTls: props.allowUnsafeTls } : {}
+	}, tokenSet);
+};
+//#endregion
+export { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey };

package/dist/utils/inspect_db.js

@@ -2,7 +2,7 @@ import { EndpointType } from "./api_enums.js";
 import { branchIdFromProps } from "./enrichers.js";
 import { parsePITBranch } from "./point_in_time.js";
 import { PgConnection } from "../psql/wire/connection.js";
-import { o as parseConnectionUri } from "../_chunks/psql-DWH-kc69.js";
+import { o as parseConnectionUri } from "../_chunks/psql-BNljLda2.js";
 //#region src/utils/inspect_db.ts
 const SSL_MODES = [
 	"require",
@@ -11,6 +11,60 @@ const SSL_MODES = [
 	"omit"
 ];
 /**
+* Keep the database column on one-database branches so adding another database
+* does not change the output schema. Compute-wide views run once because every
+* database returns the same rows.
+*/
+const selectInspectTargets = (input) => {
+	if (input.dbUrlDatabase !== void 0) return {
+		databases: [input.dbUrlDatabase],
+		includeDatabaseColumn: false
+	};
+	if (input.databaseName !== void 0) {
+		if (input.databaseName === "") throw new Error("--database-name cannot be empty. Omit the flag to cover every database.");
+		return {
+			databases: [input.databaseName],
+			includeDatabaseColumn: false
+		};
+	}
+	if (input.branchDatabases.length === 0) throw new Error("No databases found for the branch");
+	if (input.scope === "compute") return {
+		databases: [input.branchDatabases[0]],
+		includeDatabaseColumn: false
+	};
+	return {
+		databases: [...input.branchDatabases].sort((a, b) => a.localeCompare(b, "en")),
+		includeDatabaseColumn: true
+	};
+};
+const formatInspectQueryError = (input) => {
+	if (input.dbUrl !== void 0 || input.databaseName !== void 0) return;
+	const missingExtension = input.requiresExtension !== void 0 && input.reason.includes(`"${input.requiresExtension}"`);
+	const hint = !input.offerDatabaseNameHint ? "" : missingExtension ? `. Pass --database-name to try a database that already has the "${input.requiresExtension}" extension.` : input.scope === "compute" ? ". Pass --database-name to connect through a different database." : ". Pass --database-name to inspect one database.";
+	return `${input.reason} (database ${input.database})${hint}`;
+};
+const connectionUriForDatabase = (connectionUri, database) => {
+	const url = new URL(connectionUri);
+	url.pathname = `/${encodeURIComponent(database)}`;
+	return url.toString();
+};
+const listBranchDatabases = async (props) => {
+	const projectId = props.projectId;
+	const parsedPIT = props.branch ? parsePITBranch(props.branch) : {
+		tag: "head",
+		branch: ""
+	};
+	const branchId = await branchIdFromProps({
+		...props,
+		...props.branch ? { branch: parsedPIT.branch } : {}
+	});
+	const { data: { databases } } = await props.apiClient.listProjectBranchDatabases(projectId, branchId);
+	return {
+		branchId,
+		names: databases.map((d) => d.name)
+	};
+};
+/**
 * Resolve a branch's live Postgres connection details via the Neon API
 * (endpoint → role → password → database → URL, honoring point-in-time,
 * pooling, prisma tuning, and SSL mode). Mirrors how `connection-string`
@@ -45,7 +99,7 @@ const resolveConnectionUri = async (props) => {
 	let host = props.pooled ? endpoint.host.replace(endpoint.id, `${endpoint.id}-pooler`) : endpoint.host;
 	if (parsedPIT.tag !== "head") host = endpoint.host.replace(endpoint.id, endpoint.branch_id);
 	const connectionString = new URL(`postgresql://${host}`);
-	connectionString.pathname = database;
+	connectionString.pathname = `/${encodeURIComponent(database)}`;
 	connectionString.username = role;
 	connectionString.password = password;
 	if (props.prisma) {
@@ -71,6 +125,58 @@ const resolveConnectionUri = async (props) => {
 		options: connectionString.searchParams.toString()
 	};
 };
+const resolveInspectTargets = async (props, scope) => {
+	if (props.dbUrl) {
+		const parsed = parseConnectionUri(props.dbUrl);
+		const selection = selectInspectTargets({
+			dbUrlDatabase: parsed.database,
+			branchDatabases: [],
+			scope
+		});
+		return {
+			targets: [{
+				database: selection.databases[0],
+				connectionUri: props.dbUrl
+			}],
+			includeDatabaseColumn: selection.includeDatabaseColumn,
+			branchDatabaseCount: 1
+		};
+	}
+	if (props.databaseName !== void 0) {
+		selectInspectTargets({
+			databaseName: props.databaseName,
+			branchDatabases: [],
+			scope
+		});
+		const resolved = await resolveConnectionUri(props);
+		return {
+			targets: [{
+				database: resolved.database,
+				connectionUri: resolved.connectionUri
+			}],
+			includeDatabaseColumn: false,
+			branchDatabaseCount: 1
+		};
+	}
+	const { branchId, names } = await listBranchDatabases(props);
+	if (names.length === 0) throw new Error(`No databases found for the branch: ${branchId}`);
+	const selection = selectInspectTargets({
+		branchDatabases: names,
+		scope
+	});
+	const first = await resolveConnectionUri({
+		...props,
+		databaseName: selection.databases[0]
+	});
+	return {
+		targets: selection.databases.map((database) => ({
+			database,
+			connectionUri: connectionUriForDatabase(first.connectionUri, database)
+		})),
+		includeDatabaseColumn: selection.includeDatabaseColumn,
+		branchDatabaseCount: names.length
+	};
+};
 const rowsFrom = (result) => {
 	const names = result.fields.map((f) => f.name);
 	return result.rows.map((row) => {
@@ -108,4 +214,4 @@ const runInspectQuery = async (connectionUri, sql, options = {}) => {
 	}
 };
 //#endregion
-export { SSL_MODES, resolveConnectionUri, runInspectQuery };
+export { SSL_MODES, connectionUriForDatabase, formatInspectQueryError, resolveConnectionUri, resolveInspectTargets, runInspectQuery, selectInspectTargets };

package/dist/utils/inspect_queries.js

@@ -2,6 +2,7 @@
 const INSPECT_QUERIES = {
 	"table-sizes": {
 		describe: "Size of each table (including TOAST), largest first (pg_table_size)",
+		scope: "database",
 		fields: [
 			"schema",
 			"name",
@@ -23,6 +24,7 @@ const INSPECT_QUERIES = {
 	},
 	"index-sizes": {
 		describe: "Size of each index, largest first (pg_relation_size)",
+		scope: "database",
 		fields: [
 			"schema",
 			"name",
@@ -44,6 +46,7 @@ const INSPECT_QUERIES = {
 	},
 	"unused-indexes": {
 		describe: "Non-unique indexes with few scans — candidates for removal (pg_stat_user_indexes)",
+		scope: "database",
 		fields: [
 			"table",
 			"index",
@@ -67,6 +70,7 @@ const INSPECT_QUERIES = {
 	},
 	"seq-scans": {
 		describe: "Number of sequential scans recorded against each table (pg_stat_user_tables)",
+		scope: "database",
 		fields: [
 			"schema",
 			"name",
@@ -84,13 +88,15 @@ const INSPECT_QUERIES = {
 	},
 	"long-running-queries": {
 		describe: "Queries running longer than 5 minutes (pg_stat_activity)",
+		scope: "database",
 		fields: [
 			"pid",
 			"duration",
 			"state",
 			"query"
 		],
-		emptyMessage: "No long-running queries.",
+		emptyMessage: "No long-running queries in this database.",
+		emptyMessageAll: "No long-running queries in any database.",
 		sql: `
 			SELECT
 				pid,
@@ -98,7 +104,8 @@ const INSPECT_QUERIES = {
 				state,
 				query
 			FROM pg_stat_activity
-			WHERE state <> 'idle'
+			WHERE datname = current_database()
+				AND state <> 'idle'
 				AND query NOT ILIKE '%pg_stat_activity%'
 				AND now() - query_start > interval '5 minutes'
 			ORDER BY now() - query_start DESC;
@@ -106,6 +113,7 @@ const INSPECT_QUERIES = {
 	},
 	locks: {
 		describe: "Locks held with the acquiring query and its age (pg_locks + pg_stat_activity)",
+		scope: "database",
 		fields: [
 			"pid",
 			"relname",
@@ -115,7 +123,8 @@ const INSPECT_QUERIES = {
 			"age",
 			"query"
 		],
-		emptyMessage: "No locks held.",
+		emptyMessage: "No locks held in this database.",
+		emptyMessageAll: "No locks held in any database.",
 		sql: `
 			SELECT
 				a.pid,
@@ -128,13 +137,15 @@ const INSPECT_QUERIES = {
 			FROM pg_locks l
 			JOIN pg_stat_activity a ON a.pid = l.pid
 			LEFT JOIN pg_class c ON c.oid = l.relation
-			WHERE a.query <> '<insufficient privilege>'
+			WHERE a.datname = current_database()
+				AND a.query <> '<insufficient privilege>'
 				AND l.pid <> pg_backend_pid()
 			ORDER BY a.query_start;
 		`
 	},
 	outliers: {
 		describe: "Queries taking the most cumulative execution time (needs pg_stat_statements)",
+		scope: "database",
 		fields: [
 			"total_exec_time",
 			"prop_exec_time",
@@ -161,6 +172,7 @@ const INSPECT_QUERIES = {
 	},
 	calls: {
 		describe: "Most frequently called queries (needs pg_stat_statements)",
+		scope: "database",
 		fields: [
 			"ncalls",
 			"total_exec_time",
@@ -186,7 +198,8 @@ const INSPECT_QUERIES = {
 		`
 	},
 	"lfc-hit-rate": {
-		describe: "Local File Cache hit rate (needs neon extension)",
+		describe: "Local File Cache hit rate (compute-wide, needs neon extension)",
+		scope: "compute",
 		fields: ["name", "ratio"],
 		emptyMessage: "No LFC stats available.",
 		requiresExtension: "neon",
@@ -207,7 +220,8 @@ const INSPECT_QUERIES = {
 		`
 	},
 	"working-set": {
-		describe: "Estimated working set vs LFC size (needs neon extension)",
+		describe: "Estimated working set vs LFC size (compute-wide, needs neon extension)",
+		scope: "compute",
 		fields: [
 			"window",
 			"working_set",
@@ -239,6 +253,7 @@ const INSPECT_QUERIES = {
 	},
 	"vacuum-stats": {
 		describe: "Autovacuum status per table: last (auto)vacuum, dead tuples, threshold",
+		scope: "database",
 		fields: [
 			"schema",
 			"table",
@@ -273,6 +288,7 @@ const INSPECT_QUERIES = {
 	},
 	bloat: {
 		describe: "Estimated table/index bloat (statistical estimate, no extension needed)",
+		scope: "database",
 		fields: [
 			"type",
 			"schema",
@@ -333,7 +349,8 @@ const INSPECT_QUERIES = {
 		`
 	},
 	"replication-slots": {
-		describe: "Replication slots: kind, status, client, restart/confirmed-flush LSNs, and lag (pg_replication_slots + pg_stat_replication)",
+		describe: "Replication slots (compute-wide): kind, status, client, restart/confirmed-flush LSNs, and lag (pg_replication_slots + pg_stat_replication)",
+		scope: "compute",
 		fields: [
 			"slot_name",
 			"slot_type",
@@ -379,6 +396,7 @@ const INSPECT_QUERIES = {
 	},
 	subscriptions: {
 		describe: "Per-table logical replication progress on this subscriber (pg_subscription_rel)",
+		scope: "database",
 		fields: [
 			"subscription",
 			"table_name",
@@ -386,6 +404,7 @@ const INSPECT_QUERIES = {
 			"lsn"
 		],
 		emptyMessage: "No subscriptions found on this database.",
+		emptyMessageAll: "No subscriptions found on any database.",
 		sql: `
 			SELECT
 				sub.subname AS subscription,

package/dist/utils/middlewares.js

@@ -1,4 +1,4 @@
-import { r as recordCredentialInputs } from "../_chunks/auth_selection-DGgq6ifc.js";
+import { r as recordCredentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
 //#region src/utils/middlewares.ts
 /**
 * Resolves `--api-key` from `NEON_API_KEY` when the flag is absent, leaving it an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "3.2.2",
+  "version": "3.4.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,11 +63,12 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/sdk": "2.0.0",
     "@neon/config": "1.0.0",
+    "@neon/sdk": "2.0.0",
     "@neon/config-runtime": "1.0.0"
   },
   "optionalDependencies": {
+    "@napi-rs/keyring": "1.3.0",
     "esbuild": "0.28.1"
   },
   "devDependencies": {
@@ -97,8 +98,8 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon/e2e-harness": "0.0.0",
-    "@neon-internals/env-core": "0.0.0"
+    "@neon-internals/env-core": "0.0.0",
+    "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
     "access": "public",

package/dist/_chunks/credentials-MYdHdKah.js

@@ -1,188 +0,0 @@
-import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { readFileSync } from "node:fs";
-//#region ../../internals/cli-core/dist/credentials.js
-/**
-* # Stored credentials — one file per account, two kinds
-*
-* A profile points at exactly one credentials file (see `./profiles.ts`), and that file says
-* what kind of credential it holds. Adding API-key support this way rather than adding a
-* second pointer to `profiles.json` keeps a profile what it already was — one name, one path
-* — and means `profiles.json` needs no schema change at all.
-*
-* ```json
-* // oauth: every file written before this existed. An absent `type` means this.
-* { "access_token": "…", "refresh_token": "…", "expires_at": 1786…, "user_id": "…" }
-*
-* // api_key, stored by `neon profile create --api-key`
-* { "type": "api_key", "api_key": "napi_…", "user_id": "…" }
-*
-* // api_key minted by `--mint --org-id`, which records the scope it was issued at
-* { "type": "api_key", "api_key": "napi_…", "key_id": 123, "org_id": "org-…" }
-* ```
-*
-* ## One profile, one kind
-*
-* A credentials file holds an API key or an OAuth session, never both, and `type` states
-* which. An earlier draft let the two coexist — the idea being that a key could keep the
-* session it was minted from and so rotate without a browser. It did not survive review, for
-* two reasons that are worth recording so nobody rebuilds it:
-*
-* 1. **It never worked.** The resolver returned the key without testing it, so a revoked key
-*    failed to mint and never fell back to the session sitting beside it.
-* 2. **It could mix accounts.** Nothing compared the identity of the credential being written
-*    with the one already there, so a profile could hold one account's session and another's
-*    key, told apart only by a single string. Flip or lose `type` and the profile silently
-*    becomes a different person.
-*
-* Recovery from a dead key is therefore one browser login — `neon profile create <name>
-* --mint --force` — which is what the retained session was supposed to save and never did.
-*
-* ## Older releases
-*
-* A CLI predating this reads the pointer, finds no `type` it understands, ignores it, and
-* looks for `access_token`. An `api_key` profile has none, so an older release falls through
-* to its browser login rather than crashing. That it does not crash is why `credentials`
-* stays a required pointer: an entry without one makes 2.41 and 2.42 throw
-* `ERR_INVALID_ARG_TYPE` from `resolveEntryPath`.
-*/
-const OAUTH = "oauth";
-const API_KEY = "api_key";
-/**
-* Which credential in this file authenticates, by declaration alone.
-*
-* An unrecognised `type` throws rather than falling back to `oauth`. A file we cannot
-* interpret is a misconfiguration the user has to see: treating it as OAuth would send them
-* to a browser login that silently replaces a credential they meant to keep, and treating it
-* as an API key would authenticate with whatever `api_key` happened to be there.
-*
-* This deliberately does not check that an `api_key` file has a key — `neon profile list`
-* needs the kind of a file it is not about to authenticate with, and must be able to report a
-* broken one rather than throwing halfway through a table.
-*/
-const credentialKind = (credentials, at) => {
-	const declared = credentials.type;
-	if (declared === void 0 || declared === "oauth") return OAUTH;
-	if (declared === "api_key") return API_KEY;
-	throw new Error(`${at.path} declares a "type" this version does not understand. Expected "${OAUTH}" or "${API_KEY}". ${repair(at)}`);
-};
-/**
-* The way out of a credentials file that cannot be read.
-*
-* One sentence, shared by every such error, because they all have the same two answers: write
-* a new credential over it, or delete it and start again.
-*/
-const repair = (at) => `Replace it deliberately with \`neon profile create ${at.profile} --force\`, or delete the file.`;
-/**
-* Resolve what to authenticate with, validating that the declared kind is actually usable.
-*
-* An `api_key` file with no key is a hard error rather than a fall-through to OAuth: the user
-* asked for a key, and quietly opening a browser instead would replace the credential they
-* were trying to fix.
-*/
-const interpretCredentials = (credentials, at) => {
-	if (credentialKind(credentials, at) === "oauth") return { kind: OAUTH };
-	const apiKey = nonEmpty(credentials.api_key);
-	if (apiKey === void 0) throw new Error(`${at.path} declares "type": "${API_KEY}" but has no "api_key" value. ${repair(at)}`);
-	return {
-		kind: API_KEY,
-		apiKey
-	};
-};
-/**
-* Read and classify a credentials file, without deciding what to do about it.
-*
-* A permission or I/O error still throws: there may be a perfectly good credential here that
-* we cannot see, and treating that as absent would send the user to a browser login that
-* overwrites it.
-*/
-const inspectCredentials = (path) => {
-	let contents;
-	try {
-		contents = readFileSync(path, "utf8");
-	} catch (err) {
-		if (err.code === "ENOENT") return { kind: "absent" };
-		throw err;
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(contents);
-	} catch {
-		return {
-			kind: "unusable",
-			reason: `${path} is not valid JSON, so the credential in it cannot be read`
-		};
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {
-		kind: "unusable",
-		reason: `${path} does not contain a credentials object`
-	};
-	return {
-		kind: "ok",
-		credentials: parsed
-	};
-};
-/**
-* The credential at `path`, or `null` when the file is not there.
-*
-* A damaged file is an error, not an absence. Treating it as absent — which is what this used to
-* do — meant any read-only command could repair it by starting a browser sign-in and overwriting
-* it, **possibly as a different account**, with the user never having asked for a repair and no
-* way back to whatever was in the file. Failing here costs one deliberate command; the message
-* names it.
-*
-* `profile list` and telemetry use {@link inspectCredentials} instead, because describing a
-* broken credential is not the same as using one.
-*/
-const readCredentials = (at) => {
-	const read = inspectCredentials(at.path);
-	if (read.kind === "unusable") throw new Error(`${read.reason}. ${repair(at)}`);
-	return read.kind === "ok" ? read.credentials : null;
-};
-const writeCredentials = (path, credentials) => {
-	writeSecretFile(path, JSON.stringify(credentials));
-};
-/**
-* Build an `api_key` credentials object. Nothing from a previous credential is carried over.
-*
-* The scope is stored because it is not recoverable from the secret: `rotate-key` has to mint
-* the replacement on the same endpoint, and an org or project key minted as an account key
-* would silently widen what the profile reaches.
-*/
-const apiKeyCredentials = ({ apiKey, keyId, userId, scope }) => ({
-	type: API_KEY,
-	api_key: apiKey,
-	...keyId !== void 0 ? { key_id: keyId } : {},
-	...userId !== void 0 ? { user_id: userId } : {},
-	...scope?.orgId !== void 0 ? { org_id: scope.orgId } : {},
-	...scope?.projectId !== void 0 ? { project_id: scope.projectId } : {}
-});
-/** The scope recorded on a stored credential. */
-const scopeOf = (credentials) => ({
-	...typeof credentials.org_id === "string" ? { orgId: credentials.org_id } : {},
-	...typeof credentials.project_id === "string" ? { projectId: credentials.project_id } : {}
-});
-/** How to describe a scope in output. */
-const describeScope = (scope) => {
-	if (scope.projectId !== void 0) return `project ${scope.projectId}`;
-	if (scope.orgId !== void 0) return `org ${scope.orgId}`;
-	return "account";
-};
-function nonEmpty(value) {
-	if (typeof value !== "string") return void 0;
-	const trimmed = value.trim();
-	return trimmed === "" ? void 0 : trimmed;
-}
-/**
-* Whether a stored credential is the same secret as the one about to replace it.
-*
-* Re-storing the key a profile already holds is a no-op, not a replacement — and retiring it
-* would revoke the credential the command has just committed to. Trimmed on both sides, because
-* a key read from a file or a pipe arrives with a trailing newline.
-*/
-const isSameCredential = (existingKey, replacementKey) => {
-	if (existingKey === void 0 || replacementKey === void 0) return false;
-	const trimmed = existingKey.trim();
-	return trimmed !== "" && trimmed === replacementKey.trim();
-};
-//#endregion
-export { describeScope as a, isSameCredential as c, writeCredentials as d, credentialKind as i, readCredentials as l, OAUTH as n, inspectCredentials as o, apiKeyCredentials as r, interpretCredentials as s, API_KEY as t, scopeOf as u };

package/dist/_chunks/secure_file-BucZj4yQ.js

@@ -1,39 +0,0 @@
-import { renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
-//#region ../../internals/cli-core/dist/secure_file.js
-/**
-* Write a secret to disk owner-only, by creating a temporary file in the same directory and
-* renaming it over the target.
-*
-* The rename is what makes this correct rather than merely tidy. `writeFileSync`'s `mode`
-* applies only when it *creates* the file, so writing over an existing credentials file
-* leaves whatever permissions it already had — a file created `0700` by an older release
-* stays `0700` forever, and one created before a umask change stays world-readable. Renaming
-* a fresh inode into place means every write lands at {@link SECRET_FILE_MODE}, so the
-* permissions repair themselves instead of being inherited.
-*
-* It also closes the window where a reader could see the file at default permissions: the
-* temporary file is created `0600` *before* it holds the secret's final name, and `rename`
-* is atomic within a directory, so there is no moment at which the target is readable by
-* anyone else and no moment at which it is half-written.
-*
-* The temporary name carries the pid so two processes writing at once cannot collide on it.
-*/
-const writeSecretFile = (path, contents) => {
-	const directory = dirname(path);
-	const temporary = join(directory, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
-	try {
-		writeFileSync(temporary, contents, {
-			encoding: "utf8",
-			mode: 384
-		});
-		renameSync(temporary, path);
-	} catch (err) {
-		try {
-			unlinkSync(temporary);
-		} catch {}
-		throw err;
-	}
-};
-//#endregion
-export { writeSecretFile as t };