neon 4.13.0 → 4.14.0

package/dist/_shared/paths.js

@@ -0,0 +1,151 @@
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+//#region src/_shared/paths.ts
+/**
+* # Where the Neon CLIs keep their files on disk
+*
+**Deliberately impure.** It reads environment variables and touches the filesystem, which
+* `@neon/config` — the package this used to be a subpath of — must never do from its root
+* export. It lives here instead of there precisely so that a policy-facing package does not
+* carry implementor-only code.
+*
+* It exists because three separate readers each grew their own answer to "where is the
+* config directory", and all three disagreed: `packages/cli` honoured `XDG_CONFIG_HOME` but
+* not `NEONCTL_CONFIG_DIR`, `packages/env` honoured the env var but not XDG, and the init
+* flow hardcoded `~/.config/neonctl`. With `XDG_CONFIG_HOME` set, the CLI wrote
+* credentials somewhere the other two never looked.
+*
+* ## The directory
+*
+* `neon` is the current name; `neonctl` is the legacy one, kept readable forever. Resolution,
+* each entry winning over the next:
+*
+* 1. An explicit directory (a `--config-dir` flag) — **exact**, no legacy fallback.
+* 2. `NEON_CONFIG_DIR` — exact.
+* 3. `NEONCTL_CONFIG_DIR` (legacy name) — exact.
+* 4. `$XDG_CONFIG_HOME/neon`, else `<home>/.config/neon`.
+*
+* An explicitly chosen directory is never paired with a fallback: `--config-dir /tmp/ci` that
+* quietly read `~/.config/neonctl` would defeat the point of passing it.
+*
+* ## The files
+*
+* {@link resolveConfigFile} answers "which path should I use for this file", and it is the
+* same answer for reading and writing:
+*
+* - Present in `neon/` → use it.
+* - Present only in `neonctl/` → **use it there, in place.** An existing credentials file is
+*   never copied or moved, so nothing is left behind to go stale and no other tool starts
+*   reading an abandoned token.
+* - Present in neither → the new location. New files only ever appear under `neon/`.
+*/
+/** Current directory name. New files are created here. */
+const CONFIG_DIR_NAME = "neon";
+/** Legacy directory name, read forever so existing installs keep working untouched. */
+const LEGACY_CONFIG_DIR_NAME = "neonctl";
+/** Where files are created. See the module docs for the precedence. */
+function configDir(options = {}) {
+	const explicit = explicitDir(options);
+	if (explicit) return explicit;
+	return join(configHome(options.env ?? process.env), CONFIG_DIR_NAME);
+}
+/**
+* The legacy directory, or `undefined` when the location was chosen explicitly (in which
+* case there is no legacy counterpart to fall back to).
+*/
+function legacyConfigDir(options = {}) {
+	if (explicitDir(options)) return void 0;
+	return join(configHome(options.env ?? process.env), LEGACY_CONFIG_DIR_NAME);
+}
+/**
+* Resolve one file inside the config directory. Prefers the current location, falls back to
+* an existing legacy file **in place**, and otherwise points at the current location so new
+* files are created there.
+*/
+function resolveConfigFile(fileName, options = {}) {
+	const dir = configDir(options);
+	const current = resolve(dir, fileName);
+	if (existsSync(current)) return {
+		path: current,
+		dir,
+		isLegacy: false,
+		exists: true
+	};
+	const legacyDir = legacyConfigDir(options);
+	if (legacyDir) {
+		const legacy = resolve(legacyDir, fileName);
+		if (existsSync(legacy)) return {
+			path: legacy,
+			dir: legacyDir,
+			isLegacy: true,
+			exists: true
+		};
+	}
+	return {
+		path: current,
+		dir,
+		isLegacy: false,
+		exists: false
+	};
+}
+/** `$XDG_CONFIG_HOME`, else `<home>/.config`. Falls back to a relative `.config` with no home. */
+function configHome(env) {
+	const xdg = nonEmpty(env.XDG_CONFIG_HOME);
+	if (xdg) return xdg;
+	const home = nonEmpty(env.HOME) ?? nonEmpty(env.USERPROFILE);
+	return home ? join(home, ".config") : ".config";
+}
+function explicitDir(options) {
+	const env = options.env ?? process.env;
+	return nonEmpty(options.dir) ?? nonEmpty(env.NEON_CONFIG_DIR) ?? nonEmpty(env.NEONCTL_CONFIG_DIR);
+}
+function nonEmpty(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+const CREDENTIALS_FILE = "credentials.json";
+/**
+* Default for `--config-dir`: `$XDG_CONFIG_HOME/neon`, else `~/.config/neon`.
+*
+* The directory was called `neonctl` until the CLI was renamed. An existing one is still read —
+* see {@link credentialsPath} — but it is never written to, moved, or deleted.
+*/
+const defaultDir = configDir();
+/**
+* Where this invocation's `credentials.json` lives.
+*
+* When `--config-dir` was left at its default, an existing file in the legacy `neonctl`
+* directory is used **in place**: an install that predates the rename keeps working, and its
+* credentials are never duplicated into a second location where one copy could go stale while
+* another tool still reads it.
+*
+* A `--config-dir` the user actually passed is used exactly as given. Falling back out of an
+* explicitly chosen directory would defeat the reason for choosing it — a CI run pointed at a
+* scratch directory must never pick up a developer's real credentials.
+*/
+const credentialsPath = (dir) => resolveConfigFile(CREDENTIALS_FILE, dir === defaultDir ? {} : { dir }).path;
+/**
+* Whether a credentials file is one the CLI created, rather than a path a profile adopted.
+*
+* Anything that deletes a credential has to ask this first. A profile entry may point anywhere —
+* that is what makes adopting an existing directory a one-line edit — and a file we did not
+* create is not ours to remove.
+*/
+const isInsideConfigDir = (configDirectory, file) => `${resolve(file)}/`.startsWith(`${resolve(configDirectory)}/`);
+/**
+* Whether a credentials file is one the CLI owns, counting the legacy `neonctl` directory.
+*
+* {@link credentialsPath} deliberately reads an existing legacy file in place rather than
+* migrating it, so for a default config directory that file is ours even though it sits outside
+* `neon/`. Judging ownership on the current directory alone would call an install that predates
+* the rename "adopted".
+*/
+const isOwnedCredentialPath = (configDirectory, file) => {
+	if (isInsideConfigDir(configDirectory, file)) return true;
+	if (configDirectory !== defaultDir) return false;
+	const legacy = legacyConfigDir();
+	return legacy !== void 0 && isInsideConfigDir(legacy, file);
+};
+//#endregion
+export { CONFIG_DIR_NAME, CREDENTIALS_FILE, LEGACY_CONFIG_DIR_NAME, configDir, credentialsPath, defaultDir, isInsideConfigDir, isOwnedCredentialPath, legacyConfigDir, resolveConfigFile };

package/dist/_shared/profiles.js

@@ -0,0 +1,226 @@
+import { credentialsPath, defaultDir, resolveConfigFile } from "./paths.js";
+import { writeSecretFile } from "./secure_file.js";
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+//#region src/_shared/profiles.ts
+/**
+* # Profiles — several Neon accounts in one config directory
+*
+* A profile is **a pointer to a credentials file**. Nothing more. That constraint is what
+* keeps the feature small: there is no mirror, no per-profile directory tree, no persistent
+* "active profile" state to fall out of sync, and no migration.
+*
+* ```
+* ~/.config/neon/
+* ├── credentials.json          # this IS the DEFAULT profile, not a copy of it
+* ├── credentials.work.json     # created by `neon auth --profile work`
+* └── profiles.json             # created only once a second profile exists
+* ```
+*
+* `profiles.json` maps a name to a path, and the path may point anywhere — which is what
+* makes adopting an existing directory a one-line edit rather than an import command:
+*
+* ```json
+* {
+*   "version": 1,
+*   "profiles": {
+*     "DEFAULT": { "credentials": "credentials.json" },
+*     "work": {
+*       "credentials": "../neonctl-databricks/credentials.json",
+*       "label": "someone@example.com"
+*     }
+*   }
+* }
+* ```
+*
+* ## Selection
+*
+* `--profile` → `NEON_PROFILE` → `DEFAULT`. Per invocation, like `AWS_PROFILE`; there is no
+* `profile use` command, so nothing persists that could disagree with what you typed.
+*
+* ## Compatibility
+*
+* An install with no `profiles.json` is already a valid `DEFAULT`-only state: `DEFAULT`
+* resolves to `credentials.json` in the config directory (including an existing one in the
+* legacy `neonctl` directory — see `./paths.ts`). Nothing is created until a second
+* profile is, and nothing is ever moved.
+*/
+const PROFILES_FILE = "profiles.json";
+/** The implicit profile. Backed by plain `credentials.json`, with or without a profiles file. */
+const DEFAULT_PROFILE = "DEFAULT";
+/** Profile names become part of a filename, so keep them boring. */
+const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/** Which profile this invocation should use: `--profile` → `NEON_PROFILE` → `DEFAULT`. */
+const selectProfileName = (flag, env = process.env) => nonEmpty(flag) ?? nonEmpty(env.NEON_PROFILE) ?? "DEFAULT";
+const assertValidProfileName = (name) => {
+	if (!NAME_PATTERN.test(name)) throw new Error(`Invalid profile name "${name}". Use letters, digits, dot, dash or underscore, starting with a letter or digit.`);
+};
+/** Where `profiles.json` lives for this config directory (whether or not it exists yet). */
+const profilesFilePath = (dir) => resolveConfigFile(PROFILES_FILE, dir === defaultDir ? {} : { dir }).path;
+/**
+* Read and classify `profiles.json` without deciding what to do about it.
+*
+* Entry keys and shapes are validated here rather than at each use. A key is a profile name,
+* and a name that `assertValidProfileName` would reject cannot have been written by this CLI —
+* it would travel into error messages as a recovery command nobody can run, and into a
+* `credentials.<name>.json` filename.
+*/
+const inspectProfiles = (dir) => {
+	const path = profilesFilePath(dir);
+	if (!existsSync(path)) return { kind: "absent" };
+	const broken = (why) => ({
+		kind: "unusable",
+		reason: `${path} could not be read as a profiles file: ${why}`
+	});
+	let contents;
+	try {
+		contents = readFileSync(path, "utf8");
+	} catch (err) {
+		const code = err.code;
+		return broken(code ? `reading it failed with ${code}` : "reading it failed");
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(contents);
+	} catch {
+		return broken("it is not valid JSON");
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return broken("it does not contain an object");
+	const profiles = parsed.profiles;
+	if (profiles === null || typeof profiles !== "object" || Array.isArray(profiles)) return broken("it has no `profiles` object");
+	for (const [name, entry] of Object.entries(profiles)) {
+		if (!NAME_PATTERN.test(name)) return broken(`"${name}" is not a valid profile name`);
+		if (entry === null || typeof entry !== "object" || typeof entry.credentials !== "string" || entry.credentials.trim() === "") return broken(`profile "${name}" has no \`credentials\` path`);
+	}
+	return {
+		kind: "ok",
+		file: {
+			version: 1,
+			profiles
+		}
+	};
+};
+/**
+* Read `profiles.json`, or `null` when there is nothing usable there.
+*
+* A malformed file is reported through `onWarn` and treated as absent, because for a *read* the
+* worst case is a named profile turning up missing, which is recoverable — whereas throwing
+* would lock the user out of `neon auth` itself. Writing is the opposite: see
+* {@link upsertProfile}, which refuses rather than rebuilding a file it cannot read.
+*/
+const readProfiles = (dir, onWarn = () => {}) => {
+	const read = inspectProfiles(dir);
+	if (read.kind === "ok") return read.file;
+	if (read.kind === "unusable") onWarn(read.reason);
+	return null;
+};
+/**
+* Refuse to act on a named profile when the file that defines it cannot be read.
+*
+* Call this **before** anything that writes a credential, opens a browser, or spends an API
+* call. {@link upsertProfile} refuses too, but it runs last: by then `create` has already
+* overwritten `credentials.<name>.json` and revoked the key it replaced, and `neon auth
+* --profile` has already signed in over it — a refusal that arrives after the destruction it
+* exists to prevent. The path resolution itself is the unsound part, since with the metadata
+* unreadable the conventional filename is a guess about which account that file belongs to.
+*
+* `DEFAULT` is exempt: it is defined by the absence of metadata rather than by an entry, so
+* signing in normally must keep working while a broken `profiles.json` is repaired.
+*/
+const assertProfilesUsable = (dir, name) => {
+	if (name === "DEFAULT") return;
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file before working with profile "${name}" — it is the only record of where each account's credentials live.`);
+};
+/** Resolve a profile to an absolute credentials path. Throws when a named profile is unknown. */
+const resolveProfile = (dir, name) => {
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable" && name !== "DEFAULT") throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
+	const file = read.kind === "ok" ? read.file : null;
+	const entry = file?.profiles[name];
+	if (entry) return {
+		name,
+		credentialsPath: resolveEntryPath(dir, entry.credentials),
+		...entry.label ? { label: entry.label } : {},
+		...entry.userId ? { userId: entry.userId } : {},
+		declared: true
+	};
+	if (name === "DEFAULT") return {
+		name,
+		credentialsPath: credentialsPath(dir),
+		declared: false
+	};
+	const known = file ? Object.keys(file.profiles).join(", ") : DEFAULT_PROFILE;
+	throw new Error(`Unknown profile "${name}". Known profiles: ${known}. Create it with \`neon profile create ${name}\`.`);
+};
+/** Default location for a new named profile's credentials file. */
+const newProfileCredentialsPath = (dir, name) => resolve(dir, `credentials.${name}.json`);
+/**
+* Record a profile, creating `profiles.json` if this is the first named one.
+*
+* When the file is created, `DEFAULT` is written explicitly and pointed at wherever
+* `credentials.json` actually is. That matters for an install predating the directory
+* rename: `profiles.json` is created in `neon/` while the credentials are still in
+* `neonctl/`, so `DEFAULT` is recorded as `../neonctl/credentials.json` rather than a
+* relative name that would resolve to a file that isn't there.
+*/
+const upsertProfile = (dir, name, entry) => {
+	assertValidProfileName(name);
+	const path = profilesFilePath(dir);
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Refusing to rewrite it, because doing so would discard the profiles it defines. Fix or delete the file, then re-run.`);
+	const file = read.kind === "ok" ? read.file : {
+		version: 1,
+		profiles: { [DEFAULT_PROFILE]: { credentials: relativeToProfiles(path, credentialsPath(dir)) } }
+	};
+	file.profiles[name] = {
+		credentials: relativeToProfiles(path, entry.credentials),
+		...entry.label ? { label: entry.label } : {},
+		...entry.userId ? { userId: entry.userId } : {}
+	};
+	writeProfiles(path, file);
+};
+/** Remove an entry. Returns false when it wasn't there. */
+const removeProfileEntry = (dir, name) => {
+	const path = profilesFilePath(dir);
+	const file = readProfiles(dir);
+	if (!file?.profiles[name]) return false;
+	delete file.profiles[name];
+	writeProfiles(path, file);
+	return true;
+};
+/**
+* True when only `DEFAULT` is left, so `profiles.json` no longer earns its place. Mirrors
+* lazy creation: a single-account install has no profiles file, before or after.
+*/
+const onlyDefaultRemains = (file) => {
+	const names = Object.keys(file.profiles);
+	return names.length === 0 || names.length === 1 && names[0] === "DEFAULT";
+};
+const listProfiles = (dir) => {
+	const read = inspectProfiles(dir);
+	if (read.kind === "unusable") throw new Error(`${read.reason}. Fix or delete the file — every named profile is defined in it.`);
+	const file = read.kind === "ok" ? read.file : null;
+	if (!file) return [resolveProfile(dir, DEFAULT_PROFILE)];
+	const names = Object.keys(file.profiles);
+	if (!names.includes("DEFAULT")) names.unshift(DEFAULT_PROFILE);
+	return names.map((name) => resolveProfile(dir, name));
+};
+const writeProfiles = (path, file) => {
+	writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
+};
+const resolveEntryPath = (dir, entry) => isAbsolute(entry) ? entry : resolve(profilesDir(dir), entry);
+/** `profiles.json` may sit in the legacy directory, so entries resolve against its own dir. */
+const profilesDir = (dir) => resolve(profilesFilePath(dir), "..");
+/** Keep entries relative when they sit near `profiles.json`; absolute paths stay absolute. */
+const relativeToProfiles = (profilesPath, target) => {
+	const rel = relative(resolve(profilesPath, ".."), target);
+	return rel && !isAbsolute(rel) ? rel : target;
+};
+function nonEmpty(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+//#endregion
+export { DEFAULT_PROFILE, PROFILES_FILE, assertProfilesUsable, assertValidProfileName, inspectProfiles, listProfiles, newProfileCredentialsPath, onlyDefaultRemains, profilesFilePath, readProfiles, removeProfileEntry, resolveProfile, selectProfileName, upsertProfile };

package/dist/_shared/secure_file.js

@@ -0,0 +1,41 @@
+import { renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+//#region src/_shared/secure_file.ts
+/** Owner read/write. A credential needs those two and nothing else. */
+const SECRET_FILE_MODE = 384;
+/**
+* Write a secret to disk owner-only, by creating a temporary file in the same directory and
+* renaming it over the target.
+*
+* The rename is what makes this correct rather than merely tidy. `writeFileSync`'s `mode`
+* applies only when it *creates* the file, so writing over an existing credentials file
+* leaves whatever permissions it already had — a file created `0700` by an older release
+* stays `0700` forever, and one created before a umask change stays world-readable. Renaming
+* a fresh inode into place means every write lands at {@link SECRET_FILE_MODE}, so the
+* permissions repair themselves instead of being inherited.
+*
+* It also closes the window where a reader could see the file at default permissions: the
+* temporary file is created `0600` *before* it holds the secret's final name, and `rename`
+* is atomic within a directory, so there is no moment at which the target is readable by
+* anyone else and no moment at which it is half-written.
+*
+* The temporary name carries the pid so two processes writing at once cannot collide on it.
+*/
+const writeSecretFile = (path, contents) => {
+	const directory = dirname(path);
+	const temporary = join(directory, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+	try {
+		writeFileSync(temporary, contents, {
+			encoding: "utf8",
+			mode: 384
+		});
+		renameSync(temporary, path);
+	} catch (err) {
+		try {
+			unlinkSync(temporary);
+		} catch {}
+		throw err;
+	}
+};
+//#endregion
+export { SECRET_FILE_MODE, writeSecretFile };

package/dist/analytics.js

@@ -1,11 +1,11 @@
-import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-YeAxg9Xn.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-D8AR-jvB.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { getApiClient, isNeonApiError } from "./api.js";
+import { getAuthContext } from "./auth_context.js";
 import { n as credentialsPath } from "./_chunks/paths-DMq0Lt7a.js";
 import "./config.js";
-import { getAuthContext } from "./auth_context.js";
 import { isCurrentBranchProbe } from "./context.js";
 import { Analytics } from "@segment/analytics-node";
 //#region src/analytics.ts

package/dist/auth.js

@@ -30,13 +30,101 @@ const NEONCTL_SCOPES = [
 ];
 const AUTH_TIMEOUT_SECONDS = 60;
 const defaultClientID = "neonctl";
-const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-	log.debug("Discovering oauth server");
+/** `terminal` is a dead grant. A network failure is not. */
+var AuthRefreshError = class extends Error {
+	constructor(message, options) {
+		super(message);
+		this.name = "AuthRefreshError";
+		this.terminal = options.terminal;
+		this.oauthError = options.oauthError;
+		this.cause = options.cause;
+	}
+};
+const DEAD_GRANT_ERRORS = /* @__PURE__ */ new Set([
+	"invalid_grant",
+	"token_inactive",
+	"invalid_token"
+]);
+const classifyRefreshFailure = (err) => {
+	const rejection = oauthRejection(err);
+	if (rejection) return new AuthRefreshError(`The Neon authorization server rejected the stored session: ${rejection.error}${rejection.description ? `: ${rejection.description}` : ""}`, {
+		terminal: DEAD_GRANT_ERRORS.has(rejection.error),
+		oauthError: rejection.error,
+		cause: err
+	});
+	return new AuthRefreshError(`Could not reach the Neon authorization server to refresh the stored session: ${err instanceof Error ? err.message : String(err)}`, {
+		terminal: false,
+		cause: err
+	});
+};
+const oauthRejection = (err) => {
+	if (err instanceof client.ResponseBodyError) return {
+		error: err.error,
+		...err.error_description ? { description: err.error_description } : {}
+	};
+	if (err instanceof client.WWWAuthenticateChallengeError) {
+		const challenge = err.cause.find(({ parameters }) => parameters.error);
+		const error = challenge?.parameters.error;
+		if (typeof error !== "string") return null;
+		const description = challenge?.parameters.error_description;
+		return {
+			error,
+			...typeof description === "string" ? { description } : {}
+		};
+	}
+	return null;
+};
+const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
+/** Remote HTTP would send the refresh token in the clear. Loopback is for local test servers. */
+const oauthExecute = (oauthHost, allowUnsafeTls) => {
+	if (allowUnsafeTls === true) return [client.allowInsecureRequests];
+	try {
+		const url = new URL(oauthHost);
+		if (url.protocol === "http:" && isLoopbackHostname(url.hostname)) return [client.allowInsecureRequests];
+	} catch {
+		return;
+	}
+};
+const isSafeOAuthUrl = (value) => {
+	try {
+		const url = new URL(value);
+		if (url.protocol === "https:") return true;
+		return url.protocol === "http:" && isLoopbackHostname(url.hostname);
+	} catch {
+		return false;
+	}
+};
+const assertSafeOAuthEndpoints = (configuration, allowUnsafeTls) => {
+	if (allowUnsafeTls === true) return;
+	const metadata = configuration.serverMetadata();
+	for (const endpoint of [
+		metadata.token_endpoint,
+		metadata.revocation_endpoint,
+		metadata.authorization_endpoint,
+		metadata.jwks_uri
+	]) {
+		if (typeof endpoint !== "string" || endpoint === "") continue;
+		if (!isSafeOAuthUrl(endpoint)) throw new AuthRefreshError(`The authorization server advertised ${endpoint}, which is not HTTPS or loopback HTTP.`, { terminal: false });
+	}
+};
+const discover = async ({ oauthHost, clientId, allowUnsafeTls }) => {
 	const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
 		timeout: SERVER_TIMEOUT,
-		execute: allowUnsafeTls ? [client.allowInsecureRequests] : void 0
+		execute: oauthExecute(oauthHost, allowUnsafeTls)
 	});
-	return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
+	assertSafeOAuthEndpoints(configuration, allowUnsafeTls);
+	return configuration;
+};
+const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
+	const refresh = tokenSet.refresh_token;
+	if (typeof refresh !== "string" || refresh === "") throw new AuthRefreshError("The stored credentials hold no refresh token.", { terminal: true });
+	log.debug("Discovering oauth server");
+	const configuration = await discover({
+		oauthHost,
+		clientId,
+		allowUnsafeTls
+	});
+	return await client.refreshTokenGrant(configuration, refresh);
 };
 /**
 * Invalidate a refresh token at the authorization server (RFC 7009).
@@ -50,9 +138,10 @@ const revokeToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) =>
 	const token = tokenSet.refresh_token;
 	if (typeof token !== "string" || token === "") return false;
 	try {
-		const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-			timeout: SERVER_TIMEOUT,
-			execute: allowUnsafeTls ? [client.allowInsecureRequests] : void 0
+		const configuration = await discover({
+			oauthHost,
+			clientId,
+			allowUnsafeTls
 		});
 		await client.tokenRevocation(configuration, token, { token_type_hint: "refresh_token" });
 		return true;
@@ -63,9 +152,10 @@ const revokeToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) =>
 };
 const auth = async ({ oauthHost, clientId, allowUnsafeTls }) => {
 	log.debug("Discovering oauth server");
-	const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-		timeout: SERVER_TIMEOUT,
-		execute: allowUnsafeTls ? [client.allowInsecureRequests] : void 0
+	const configuration = await discover({
+		oauthHost,
+		clientId,
+		allowUnsafeTls
 	});
 	log.debug("Starting HTTP Server for callback");
 	const server = createServer();
@@ -131,4 +221,4 @@ const auth = async ({ oauthHost, clientId, allowUnsafeTls }) => {
 	});
 };
 //#endregion
-export { auth, defaultClientID, refreshToken, revokeToken };
+export { AuthRefreshError, auth, classifyRefreshFailure, defaultClientID, refreshToken, revokeToken };

package/dist/auth_context.js

@@ -1,5 +1,3 @@
-import { a as isOwnedCredentialPath } from "./_chunks/paths-DMq0Lt7a.js";
-import "./config.js";
 //#region src/auth_context.ts
 const locationFromContext = (context) => {
 	if (context.profile === void 0) return null;
@@ -23,13 +21,6 @@ const getAuthContext = () => current;
 const clearAuthContext = () => {
 	current = null;
 };
-const credentialsToClearOn401 = (context) => {
-	if (context?.source !== "stored-credentials") return null;
-	const at = locationFromContext(context);
-	if (at === null) return null;
-	if (at.storage === "keyring") return null;
-	return isOwnedCredentialPath(context.configDir, at.path) ? at : null;
-};
 /**
 * What to tell the user when the API rejects their credential, naming the profile and file
 * when one is involved so they know which of several accounts failed and what to re-run.
@@ -41,9 +32,9 @@ const authFailureMessage = (context) => {
 	if (context?.source === "claimable") return `Authentication failed: Claimable Neon rejected the linked project's short-lived access token${where}. Retry the command to exchange the saved identity assertion again; if it still fails, run \`neon claim status\`.`;
 	if (context?.source === "stored-credentials") {
 		if (context.storage === "keyring") return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session (OS keyring). Sign in again with \`neon auth --profile ${profile}\`.`;
-		return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. That file was not created by neon, so it was left alone — sign in again with \`neon auth --profile ${profile}\`.`;
+		return `Authentication failed: the Neon API rejected profile "${profile}"'s stored session${where}. Sign in again with \`neon auth --profile ${profile}\`.`;
 	}
 	return "Authentication failed: the Neon API rejected the API key. Check --api-key or NEON_API_KEY.";
 };
 //#endregion
-export { authFailureMessage, clearAuthContext, credentialsToClearOn401, getAuthContext, locationFromContext, setAuthContext };
+export { authFailureMessage, clearAuthContext, getAuthContext, locationFromContext, setAuthContext };

package/dist/claimable/api.js

@@ -179,7 +179,8 @@ var ClaimableClient = class {
 			json: {
 				type: "anonymous",
 				capabilities: input.capabilities,
-				source: input.source
+				source: input.source,
+				...input.dataApi !== void 0 ? { data_api: input.dataApi } : {}
 			}
 		}));
 	}

package/dist/commands/ask.js

@@ -128,7 +128,8 @@ async function askAssistant(opts) {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
-				Accept: opts.acceptEventStream ? "text/event-stream" : "application/json"
+				Accept: opts.acceptEventStream ? "text/event-stream" : "application/json",
+				"x-neon-source": "cli"
 			},
 			body: JSON.stringify({ prompt: opts.prompt }),
 			signal: AbortSignal.timeout(ASK_TIMEOUT_MS)