neon 8.11.1 → 8.11.2

package/dist/commands/ask.js

@@ -1,155 +1 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { isCi } from "../env.js";
-import { isNetworkError } from "../errors.js";
-import { writer } from "../writer.js";
-import { noPassthrough, single } from "../utils/flags.js";
-import { isEventStreamContentType, readAskSse } from "./ask_sse.js";
-import { createThinkingSpinner } from "./thinking_spinner.js";
-//#region src/commands/ask.ts
-var ask_exports = /* @__PURE__ */ __exportAll({
-	DEFAULT_ASK_URL: () => DEFAULT_ASK_URL,
-	builder: () => builder,
-	command: () => "ask",
-	describe: () => describe,
-	handler: () => handler,
-	resolveAskUrl: () => resolveAskUrl
-});
-const DEFAULT_ASK_URL = "https://br-frosty-cell-a5smzg39-assistant.compute.c-1.us-east-2.aws.neon.tech/ask";
-const ASK_TIMEOUT_MS = 12e4;
-const command = "ask";
-const describe = "Ask a question about Neon";
-const builder = (argv) => argv.usage("$0 ask --prompt <question>").option("prompt", {
-	describe: "The question to ask",
-	type: "string",
-	demandOption: true,
-	coerce: single("prompt", { required: true })
-}).option("url", {
-	describe: "Override the assistant URL",
-	type: "string",
-	hidden: true,
-	coerce: single("url")
-}).strict().check(noPassthrough("ask")).example("$0 ask --prompt \"How do schema-only branches work?\"", describe);
-function resolveAskUrl(opts) {
-	const fromFlag = opts.url?.trim();
-	if (fromFlag) return fromFlag;
-	const fromEnv = opts.envUrl?.trim();
-	if (fromEnv) return fromEnv;
-	return DEFAULT_ASK_URL;
-}
-function isMachineOutput(output) {
-	return output === "json" || output === "yaml";
-}
-const handler = async (props) => {
-	const url = resolveAskUrl({
-		url: props.url,
-		envUrl: process.env.NEON_ASK_URL
-	});
-	const human = !isMachineOutput(props.output);
-	const spinner = createThinkingSpinner({
-		out: process.stderr,
-		isTty: Boolean(process.stderr.isTTY) && !isCi() && human
-	});
-	let streamed = "";
-	try {
-		spinner.start();
-		const text = await askAssistant({
-			prompt: props.prompt,
-			url,
-			analytics: props.analytics,
-			acceptEventStream: human,
-			onStatus: (message) => {
-				spinner.setMessage(message);
-			},
-			onText: (chunk) => {
-				if (!human) return;
-				spinner.stop();
-				streamed += chunk;
-				writer(props).text(chunk);
-			}
-		});
-		spinner.stop();
-		if (!human) {
-			writer(props).end({ text }, { fields: ["text"] });
-			return;
-		}
-		if (streamed === "") {
-			writer(props).text(`${text}\n`);
-			return;
-		}
-		if (!streamed.endsWith("\n")) writer(props).text("\n");
-	} catch (error) {
-		spinner.stop();
-		if (human && streamed !== "" && !streamed.endsWith("\n")) writer(props).text("\n");
-		throw error;
-	} finally {
-		spinner.stop();
-	}
-};
-function isAskTimeout(error) {
-	return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
-}
-function askErrorMessage(body, status) {
-	if (typeof body === "object" && body !== null && "error" in body && typeof body.error === "string" && body.error.trim() !== "") return body.error;
-	return `The Neon assistant returned ${status}.`;
-}
-function askText(body) {
-	if (typeof body === "object" && body !== null && "text" in body && typeof body.text === "string") return body.text;
-	throw new Error("The Neon assistant returned an unexpected response.");
-}
-async function readJsonBody(response) {
-	const raw = await response.text();
-	if (raw.trim() === "") return;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return;
-	}
-}
-async function readStreamedAsk(body, opts) {
-	let text = "";
-	let sawDone = false;
-	for await (const event of readAskSse(body)) switch (event.type) {
-		case "status":
-			opts.onStatus?.(event.message);
-			break;
-		case "text":
-			text += event.text;
-			opts.onText?.(event.text);
-			break;
-		case "error": throw new Error(event.error);
-		case "done": sawDone = true;
-	}
-	if (!sawDone) throw new Error("The Neon assistant returned an unexpected response.");
-	return text;
-}
-async function askAssistant(opts) {
-	let response;
-	try {
-		response = await fetch(opts.url, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: opts.acceptEventStream ? "text/event-stream" : "application/json",
-				"x-caller-source": "cli",
-				...opts.analytics ? {} : { "x-caller-analytics": "off" }
-			},
-			body: JSON.stringify({ prompt: opts.prompt }),
-			signal: AbortSignal.timeout(ASK_TIMEOUT_MS)
-		});
-	} catch (error) {
-		if (isAskTimeout(error)) throw new Error("The Neon assistant did not respond in time.");
-		if (isNetworkError(error)) throw new Error("Could not reach the Neon assistant. Check your internet connection and try again.");
-		throw error;
-	}
-	if (!response.ok) {
-		const body = await readJsonBody(response);
-		throw new Error(askErrorMessage(body, response.status));
-	}
-	if (opts.acceptEventStream && isEventStreamContentType(response.headers.get("content-type") ?? void 0)) {
-		if (!response.body) throw new Error("The Neon assistant returned an unexpected response.");
-		return readStreamedAsk(response.body, opts);
-	}
-	return askText(await readJsonBody(response));
-}
-//#endregion
-export { DEFAULT_ASK_URL, builder, command, describe, handler, resolveAskUrl, ask_exports as t };
+export { t as DEFAULT_ASK_URL, r as builder, i as command, a as describe, o as handler, s as resolveAskUrl } from "../_chunks/ask-DVwy0eUL.js";

package/dist/commands/auth.js

@@ -1,495 +1 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
-import { isCi } from "../env.js";
-import { log } from "../log.js";
-import { withExclusiveLock } from "../refresh_lock.js";
-import { getApiClient, isNeonApiError } from "../api.js";
-import { setAuthContext } from "../auth_context.js";
-import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isFunctionsTemplateCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
-import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
-import { extendTokenSet } from "../utils/auth.js";
-import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
-import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
-import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
-import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
-import { getCliName } from "../utils/cli_name.js";
-import { helpEpilogue, helpWidth, wrapHelpText } from "../utils/help_text.js";
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import { createHash } from "node:crypto";
-//#region src/commands/auth.ts
-var auth_exports = /* @__PURE__ */ __exportAll({
-	aliases: () => aliases,
-	authFlow: () => authFlow,
-	builder: () => builder,
-	command: () => command,
-	deleteCredentialsAt: () => deleteCredentialsAt,
-	describe: () => describe,
-	ensureAuth: () => ensureAuth,
-	handler: () => handler,
-	isAccessTokenUsable: () => isAccessTokenUsable,
-	locationForAuth: () => locationForAuth,
-	refreshStoredCredentials: () => refreshStoredCredentials,
-	usableCredential: () => usableCredential
-});
-const locationForAuth = (configDir, name, keyring, options = {}) => {
-	const declared = readProfiles(configDir, log.warning)?.profiles[name];
-	const pointer = declared !== void 0 && isKeyringPointer(declared.credentials);
-	if (keyring === true || pointer) return {
-		profile: name,
-		storage: "keyring"
-	};
-	if (declared !== void 0 || name === "DEFAULT") return locationForName(configDir, name);
-	if (options.create === true) return newProfileLocation(configDir, name, "file");
-	return locationForName(configDir, name);
-};
-const command = "login";
-const aliases = ["auth"];
-const describe = "Sign in with a browser. See --help for API keys and profiles";
-const wrapAuthHelp = (text) => wrapHelpText(text, helpWidth());
-const authHelpEpilogue = () => {
-	const cli = getCliName();
-	return helpEpilogue(wrapAuthHelp("Non-interactive (CI, scripts, agents):"), wrapAuthHelp("Use an existing API key or an API-key profile."), `  ${cli} projects list --profile agent`, wrapAuthHelp(`${cli} profile create <name> --mint needs a browser during setup, then stores an API key and drops the session. It cannot run in CI. Default key is account-wide; --org-id or --project-id (not both) restricts it.`), wrapAuthHelp(`A profile holds a browser session or an API key. Select it with --profile <name> or NEON_PROFILE. List profiles with ${cli} profile list.`), wrapAuthHelp("On commands that use a credential, --api-key or --profile overrides NEON_API_KEY and NEON_PROFILE. Pass either --api-key or --profile, not both. When neither flag is passed and both NEON_API_KEY and NEON_PROFILE are set, the key wins and stderr names the ignored profile. When no flag or environment variable selects a credential, DEFAULT is used."), wrapAuthHelp(`${cli} profile create <name> replaces an existing profile of that name and tries to revoke the credential it held. An imported key with no recorded id stays live. Pick a new name to keep the old profile.`), wrapAuthHelp(`See ${cli} profile --help and ${cli} profile create --help.`));
-};
-const builder = (yargs) => yargs.option("context-file", { hidden: true }).option("keyring", {
-	describe: "Store the credential in the OS keyring. Per profile; a later login without the flag stays there. See `neon profile list`.",
-	type: "boolean"
-}).example("$0 login", "Sign in with a browser").example("$0 login --profile work", "Save a browser session in profile work").example("$0 projects list --api-key \"$KEY\"", "Use an existing API key for this command").example("NEON_API_KEY=\"$KEY\" $0 projects list", "Use an existing API key from the environment").example("$0 profile create agent --api-key \"$KEY\"", "Store an existing API key").example("echo \"$KEY\" | $0 profile create agent --api-key -", "Store a key read from stdin").example("$0 profile create ci --mint", "Sign in once in a browser and store a new API key").epilogue(authHelpEpilogue());
-const handler = async (args) => {
-	await authFlow(args);
-};
-const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, profile, keyring }) => {
-	const profileName = selectProfileName(profile);
-	const isNamed = profileName !== DEFAULT_PROFILE;
-	if (isNamed) assertValidProfileName(profileName);
-	assertProfilesUsable(configDir, profileName);
-	const at = locationForAuth(configDir, profileName, keyring, { create: true });
-	if (at.storage === "keyring") {
-		const declared = readProfiles(configDir)?.profiles[profileName];
-		storeFor(configDir).assertKeyringWritable(declared !== void 0 && isKeyringPointer(declared.credentials) ? profileName : void 0);
-	}
-	if (!(forceAuth ?? forceAuthKebab) && isCi()) throw new Error("Cannot run interactive auth in CI");
-	let previousFile;
-	let previousWasKeyring = false;
-	let previousOutgoing = null;
-	try {
-		const previous = resolveProfile(configDir, profileName);
-		previousWasKeyring = previous.storage === "keyring";
-		if (previous.storage === "file") previousFile = previous.credentialsPath;
-		previousOutgoing = readOutgoingCredential(configDir, locationOf(previous));
-	} catch {
-		previousFile = void 0;
-	}
-	const tokenSet = await auth({
-		oauthHost,
-		clientId,
-		allowUnsafeTls
-	});
-	let identity = {};
-	try {
-		identity = await persistNewSession(at, tokenSet, getApiClient({
-			apiKey: tokenSet.access_token || "",
-			apiHost
-		}), configDir);
-	} catch (err) {
-		log.error("Failed to save credentials");
-		throw err instanceof Error ? err : new Error(String(err));
-	}
-	if (at.storage === "keyring" || isNamed) {
-		try {
-			upsertProfile(configDir, profileName, {
-				credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
-				...identity.email ? { label: identity.email } : {},
-				...identity.id ? { userId: identity.id } : {}
-			});
-		} catch (err) {
-			if (at.storage === "keyring" && !previousWasKeyring) {
-				if (storeFor(configDir).delete(at, { required: false }) !== "cleared") log.warning("Could not confirm the new OS keyring item for profile \"%s\" was removed after a failed save.", profileName);
-			}
-			log.error("Failed to save credentials");
-			throw err instanceof Error ? err : new Error(String(err));
-		}
-		if (at.storage === "keyring") await retirePreviousCredential({
-			apiHost,
-			oauthHost,
-			clientId,
-			...allowUnsafeTls ? { allowUnsafeTls } : {}
-		}, profileName, previousOutgoing);
-		if (at.storage === "keyring" && previousFile !== void 0 && profilesUsingPath(configDir, previousFile, profileName).length === 0) {
-			if (isOwnedCredentialPath(configDir, previousFile)) try {
-				storeFor(configDir).delete({
-					profile: profileName,
-					storage: "file",
-					path: previousFile
-				});
-				log.info("Deleted %s", previousFile);
-			} catch {
-				log.warning("Saved the keyring item but could not delete %s", previousFile);
-			}
-			else if (existsSync(previousFile)) log.info("Left %s on disk — not created by neon", previousFile);
-		}
-		log.info("Saved profile \"%s\" (%s)", profileName, at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path);
-	}
-	log.info(`Auth complete (profile ${profileName})`);
-	return tokenSet.access_token || "";
-};
-/**
-* One write, after the lookup: a second write that adds `user_id` could fail the keyring size
-* check after the first had already replaced the previous credential.
-*/
-const persistNewSession = async (at, credentials, apiClient, configDir) => {
-	const identity = await fetchIdentity(apiClient);
-	const stored = oauthCredentialsFromTokenSet(credentials, null);
-	writeOAuthCredentials(configDir, at, identity.id ? {
-		...stored,
-		user_id: identity.id
-	} : stored);
-	return identity;
-};
-const fetchIdentity = async (apiClient) => {
-	try {
-		const { data: { id, email } } = await apiClient.getCurrentUserInfo();
-		return {
-			...id ? { id } : {},
-			...email ? { email } : {}
-		};
-	} catch (err) {
-		if (isNeonApiError(err) && err.status === 401) throw new Error("Signed in, but the Neon API rejected the new access token. Try `neon login` again.");
-		log.warning("Signed in, but could not look up the account: %s", err instanceof Error ? err.message : String(err));
-		return {};
-	}
-};
-const isAccessTokenUsable = (credentials, now) => {
-	const token = credentials.access_token;
-	if (typeof token !== "string" || token === "") return false;
-	const expiresAt = credentials.expires_at;
-	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return false;
-	return expiresAt > now;
-};
-const handleExistingToken = async (tokenSet, props, at) => {
-	if (isAccessTokenUsable(tokenSet, Date.now())) {
-		log.debug("Using existing valid access_token");
-		const apiKey = tokenSet.access_token ?? "";
-		return {
-			apiKey,
-			apiClient: getApiClient({
-				apiKey,
-				apiHost: props.apiHost
-			}),
-			refreshed: false
-		};
-	}
-	if (typeof tokenSet.refresh_token !== "string" || tokenSet.refresh_token === "") {
-		log.debug("Stored credentials hold no refresh_token");
-		return null;
-	}
-	log.debug("Access token is missing or expired, attempting refresh");
-	const next = await performRefresh(tokenSet, props, at);
-	const apiKey = next.credentials.access_token ?? "";
-	return {
-		apiKey,
-		apiClient: getApiClient({
-			apiKey,
-			apiHost: props.apiHost
-		}),
-		refreshed: next.rotated
-	};
-};
-/**
-* Serialize exchanges because presenting a one-time refresh token twice can revoke
-* the newly issued token family. Persist immediately because the presented token is
-* invalid once the server answers.
-*/
-const performRefresh = async (credentials, props, at) => {
-	return await withExclusiveLock(refreshLockPath(props.configDir, at), async () => {
-		const loaded = storeFor(props.configDir).read(at);
-		const current = loaded?.credentials ?? credentials;
-		if (loaded !== null && isAccessTokenUsable(current, Date.now()) && current.access_token !== credentials.access_token) {
-			log.debug("Refresh lost a race; adopting the credentials another command wrote");
-			return {
-				credentials: current,
-				rotated: false
-			};
-		}
-		let refreshed;
-		try {
-			refreshed = extendTokenSet(await refreshToken({
-				oauthHost: props.oauthHost,
-				clientId: props.clientId,
-				allowUnsafeTls: props.allowUnsafeTls
-			}, current));
-		} catch (err) {
-			throw err instanceof AuthRefreshError ? err : classifyRefreshFailure(err);
-		}
-		const next = oauthCredentialsFromTokenSet(refreshed, loaded?.credentials ?? credentials);
-		writeOAuthCredentials(props.configDir, at, next, { restorePrevious: false });
-		log.debug("Token refresh successful");
-		return {
-			credentials: next,
-			rotated: true
-		};
-	});
-};
-/** A 401 proves the access token is stale even before `expires_at`. */
-const refreshStoredCredentials = async (at, props) => {
-	const loaded = storeFor(props.configDir).read(at);
-	if (loaded === null) return false;
-	if (interpretCredentials(loaded.credentials, at, loaded.backend).kind === "api_key") return false;
-	if (typeof loaded.credentials.refresh_token !== "string" || loaded.credentials.refresh_token === "") return false;
-	await performRefresh(loaded.credentials, props, at);
-	return true;
-};
-const oauthCredentialsFromTokenSet = (tokenSet, previous) => {
-	const refreshTokenValue = typeof tokenSet.refresh_token === "string" && tokenSet.refresh_token !== "" ? tokenSet.refresh_token : previous?.refresh_token;
-	const stored = {
-		type: OAUTH,
-		...typeof tokenSet.access_token === "string" && tokenSet.access_token !== "" ? { access_token: tokenSet.access_token } : {},
-		expires_at: tokenSet.expires_at,
-		...typeof refreshTokenValue === "string" && refreshTokenValue !== "" ? { refresh_token: refreshTokenValue } : {}
-	};
-	if (previous?.user_id !== void 0) stored.user_id = previous.user_id;
-	return stored;
-};
-const writeOAuthCredentials = (configDir, at, credentials, options) => {
-	storeFor(configDir).write(at, credentials, options);
-	log.debug("Saved credentials to %s", credentialLabel(at));
-	log.debug("Credentials MD5 hash: %s", md5hash(JSON.stringify(credentials)));
-};
-const refreshLockPath = (configDir, at) => {
-	const id = createHash("sha256").update(credentialLabel(at)).digest("hex").slice(0, 16);
-	return join(configDir, `.refresh-${id}.lock`);
-};
-/**
-* The credential a stored file can authenticate with right now — its API key, or an OAuth
-* access token, refreshed first when it has expired. Never launches a browser.
-*
-* The `profile` subcommands need exactly this. They deliberately skip `ensureAuth`, but
-* `rotate-key` still has to call the API as the account it is rotating, and falling through to
-* an interactive login would be authenticating something other than what the command is about.
-*/
-const usableCredential = async (props, at) => {
-	const loaded = storeFor(props.configDir).read(at);
-	if (loaded === null) return null;
-	const credential = interpretCredentials(loaded.credentials, at, loaded.backend);
-	if (credential.kind === "api_key") return {
-		apiKey: credential.apiKey,
-		kind: API_KEY
-	};
-	try {
-		const result = await handleExistingToken(loaded.credentials, props, at);
-		return result ? {
-			apiKey: result.apiKey,
-			kind: OAUTH
-		} : null;
-	} catch (err) {
-		log.debug("Could not use the stored OAuth session at %s: %s", credentialLabel(at), err instanceof Error ? err.message : "unknown error");
-		return null;
-	}
-};
-const ensureAuth = async (props) => {
-	if (props._.length === 0 || props.help) return;
-	if (isCurrentBranchProbe(props)) return;
-	if (isConfigInit(props)) return;
-	if (isConfigAdd(props)) return;
-	if (isFunctionsTemplateCommand(props)) return;
-	if (isProfileCommand(props)) return;
-	if (isGitLocalCommand(props)) return;
-	if (isUnfollowedGitHookSync(props)) return;
-	if (isMcpOauth(props)) return;
-	if (isInspectDbUrl(props)) return;
-	if (props._[0] === "open") return;
-	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
-	if (isAskCommand(props) || isFeedbackCommand(props) || isDocsCommand(props)) return;
-	if (props._[0] === "init") {
-		selectCredential({
-			...credentialInputs(),
-			profileFlag: props.profile
-		});
-		log.debug("init: skipping global auth; child commands authenticate");
-		return;
-	}
-	if (isClaimCommand(props)) return;
-	const isLocalDev = props._[0] === "dev";
-	const isBootstrap = props._[0] === "bootstrap";
-	const isMcp = isMcpCommand(props);
-	if (props._[0] === "login" || props._[0] === "auth") {
-		props.apiClient = getApiClient({
-			apiKey: props.apiKey,
-			apiHost: props.apiHost
-		});
-		return;
-	}
-	const inputs = credentialInputs();
-	const contextFile = typeof props.contextFile === "function" ? props.contextFile() : props.contextFile ?? currentContextFile();
-	const localContext = readContextFile(contextFile);
-	if (shouldUseClaimableCredentials(inputs, props.profile, localContext, props.configDir)) {
-		const stored = readLinkedClaimableCredentials(props.configDir, localContext);
-		if (stored === null || localContext.projectId === void 0) throw new Error("The linked Claimable Neon identity assertion could not be read.");
-		const path = claimableCredentialsPath(props.configDir, localContext.projectId);
-		if (assertionHasExpired(stored)) throw new Error(`The identity assertion for ${localContext.projectId} has expired. Run \`neon claim delete ${localContext.projectId} --yes\` to drop the local record.`);
-		const client = new ClaimableClient(stored.origin);
-		let token;
-		try {
-			token = await client.exchange(stored.identityAssertion);
-		} catch (error) {
-			if (error instanceof ClaimableServiceError && error.code === "project_claimed") throw new Error("This project was claimed. Run `neon claim status` to drop the local assertion, then `neon login` or `neon link`.");
-			throw error;
-		}
-		props.apiKey = token.accessToken;
-		props.apiHost = `${client.origin}/v1`;
-		props.apiClient = getApiClient({
-			apiKey: token.accessToken,
-			apiHost: props.apiHost
-		});
-		setAuthContext({
-			source: "claimable",
-			configDir: props.configDir,
-			credentialsPath: path
-		});
-		log.debug("Using the linked Claimable Neon project's short-lived access token");
-		return;
-	}
-	if (localContext.projectId !== void 0 && claimableCredentialsExist(props.configDir, localContext.projectId)) log.warning("This directory is linked to a claimable project, but NEON_API_KEY or NEON_PROFILE is set. This command will use that account credential instead of the unclaimed project. Unset them to keep using the unclaimed project.");
-	const selection = selectCredential({
-		...inputs,
-		profileFlag: props.profile
-	});
-	const displaced = displacedProfileWarning(selection);
-	if (displaced !== null) log.warning(displaced);
-	if (selection.source !== "profile") {
-		props.apiKey = selection.apiKey;
-		log.debug("Using an API key to authorize requests");
-		setAuthContext({
-			source: "api-key",
-			apiKeyFrom: selection.source === "explicit-api-key" ? "flag" : "env",
-			configDir: props.configDir
-		});
-		props.apiClient = getApiClient({
-			apiKey: props.apiKey,
-			apiHost: props.apiHost
-		});
-		return;
-	}
-	props.apiKey = "";
-	const at = locationForAuth(props.configDir, selection.profile);
-	const loaded = storeFor(props.configDir).read(at);
-	if (loaded !== null) {
-		log.debug("Trying to read credentials from %s", credentialLabel(at));
-		const credential = interpretCredentials(loaded.credentials, at, loaded.backend);
-		if (credential.kind === "api_key") {
-			log.debug("Using profile \"%s\"'s API key to authorize requests", selection.profile);
-			props.apiKey = credential.apiKey;
-			setAuthContext({
-				source: "profile-api-key",
-				configDir: props.configDir,
-				profile: selection.profile,
-				storage: at.storage,
-				...at.storage === "file" ? { credentialsPath: at.path } : {}
-			});
-			props.apiClient = getApiClient({
-				apiKey: credential.apiKey,
-				apiHost: props.apiHost
-			});
-			return;
-		}
-		try {
-			setAuthContext({
-				source: "stored-credentials",
-				configDir: props.configDir,
-				profile: selection.profile,
-				storage: at.storage,
-				accessToken: loaded.credentials.access_token,
-				refreshed: false,
-				oauthHost: props.oauthHost,
-				clientId: props.clientId,
-				...at.storage === "file" ? { credentialsPath: at.path } : {}
-			});
-			const result = await handleExistingToken(loaded.credentials, props, at);
-			if (result) {
-				props.apiKey = result.apiKey;
-				props.apiClient = result.apiClient;
-				setAuthContext({
-					source: "stored-credentials",
-					configDir: props.configDir,
-					profile: selection.profile,
-					storage: at.storage,
-					accessToken: result.apiKey,
-					refreshed: result.refreshed,
-					oauthHost: props.oauthHost,
-					clientId: props.clientId,
-					...at.storage === "file" ? { credentialsPath: at.path } : {}
-				});
-				return;
-			}
-		} catch (err) {
-			if (err instanceof AuthRefreshError) {
-				if (isLocalDev || isBootstrap || isMcp) {
-					log.warning("%s Continuing without credentials.", err.message);
-					return;
-				}
-				throw err;
-			}
-			throw err;
-		}
-	} else log.debug("No usable credentials at %s, starting authentication", credentialLabel(at));
-	if (isLocalDev) {
-		log.debug("dev: no usable credentials; running without env injection");
-		return;
-	}
-	if (isBootstrap) {
-		log.debug("bootstrap: no usable credentials; continuing without auth");
-		return;
-	}
-	if (isMcp) {
-		log.debug("mcp: no usable credentials; minting requires auth or --oauth");
-		return;
-	}
-	if (props._[0] === "me") {
-		const state = loaded === null ? "has no stored credential" : "holds a session that has expired";
-		log.info(`Not signed in: profile "${selection.profile}" ${state}. Run \`${getCliName()} login --profile ${selection.profile}\` to sign in, or use an API key with --api-key or NEON_API_KEY.`);
-		process.exitCode = 1;
-		return;
-	}
-	const apiKey = await authFlow({
-		...props,
-		profile: selection.profile
-	});
-	props.apiKey = apiKey;
-	props.apiClient = getApiClient({
-		apiKey,
-		apiHost: props.apiHost
-	});
-	setAuthContext({
-		source: "stored-credentials",
-		configDir: props.configDir,
-		profile: selection.profile,
-		storage: at.storage,
-		accessToken: apiKey,
-		refreshed: true,
-		oauthHost: props.oauthHost,
-		clientId: props.clientId,
-		...at.storage === "file" ? { credentialsPath: at.path } : {}
-	});
-};
-/**
-* Accept an exact location because deriving it from a config directory used to
-* delete DEFAULT when a named profile failed.
-*/
-const deleteCredentialsAt = (at, configDir) => {
-	try {
-		const store = storeFor(configDir);
-		const before = store.inspect(at);
-		store.delete(at);
-		if (before.credentials !== null || before.file === "ok") log.info("Deleted credentials from %s", credentialLabel(at));
-		else log.debug("No stored credential at %s", credentialLabel(at));
-	} catch (err) {
-		const typedErr = err instanceof Error ? err : /* @__PURE__ */ new Error("Unknown error");
-		log.error("Failed to delete credentials: %s", typedErr.message);
-		throw new Error("CREDENTIALS_DELETE_FAILED");
-	}
-};
-const md5hash = (s) => createHash("md5").update(s).digest("hex");
-//#endregion
-export { aliases, authFlow, builder, command, deleteCredentialsAt, describe, ensureAuth, handler, isAccessTokenUsable, locationForAuth, refreshStoredCredentials, auth_exports as t, usableCredential };
+export { t as aliases, n as authFlow, i as builder, a as command, o as deleteCredentialsAt, s as describe, c as ensureAuth, l as handler, u as isAccessTokenUsable, d as locationForAuth, f as refreshStoredCredentials, p as usableCredential } from "../_chunks/auth-CIUtXByB.js";