neon 8.11.1 → 8.11.2

package/dist/commands/profile.js

@@ -1,672 +1 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
-import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
-import { isCi } from "../env.js";
-import { log } from "../log.js";
-import { getApiClient, isNeonApiError } from "../api.js";
-import { setAuthContext } from "../auth_context.js";
-import { a as isOwnedCredentialPath, n as credentialsPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "../_chunks/profiles-DIB1av2Q.js";
-import { auth, revokeToken } from "../auth.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";
-import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
-import { authFlow, usableCredential } from "./auth.js";
-import { identityFromAuthDetails, isApiKeyMethod, mintedKeyName, notAnApiKeyMessage } from "../profile_keys.js";
-import { writer } from "../writer.js";
-import { noPassthrough, single } from "../utils/flags.js";
-import { orgIdForProject } from "./api_keys.js";
-import { existsSync, readFileSync, rmSync } from "node:fs";
-import { isAbsolute, relative } from "node:path";
-import prompts from "prompts";
-//#region src/commands/profile.ts
-var profile_exports = /* @__PURE__ */ __exportAll({
-	aliases: () => aliases,
-	builder: () => builder,
-	command: () => command,
-	describe: () => describe,
-	handler: () => handler
-});
-const command = "profile";
-const aliases = ["profiles"];
-const describe = "Manage named sets of Neon credentials";
-const builder = (argv) => argv.usage("$0 profile <sub-command> [options]").command("list", "List profiles, the account each holds, and where its credentials live", (y) => y.strict().check(noPassthrough("profile list")), async (args) => await list(args)).command("create <name>", "Create a profile. It holds either a browser sign-in or an API key, never both", (y) => y.positional("name", {
-	describe: "Name for the new profile",
-	type: "string",
-	demandOption: true
-}).options({
-	"api-key": {
-		describe: "API key to store, or \"-\" to read it from stdin",
-		defaultDescription: "none; this command ignores NEON_API_KEY",
-		type: "string",
-		nargs: 1
-	},
-	mint: {
-		describe: "Sign in once in the browser, then store a freshly minted API key and nothing else",
-		type: "boolean",
-		default: false
-	},
-	"org-id": {
-		describe: "With --mint, mint a key for this organization instead of your account",
-		type: "string",
-		coerce: single("org-id")
-	},
-	"project-id": {
-		describe: "With --mint, mint a key that can access only this project",
-		type: "string",
-		coerce: single("project-id")
-	},
-	keyring: {
-		describe: "Store the credential in the OS keyring. Per profile; later create without the flag stays there. See `neon profile list`.",
-		type: "boolean"
-	},
-	force: {
-		hidden: true,
-		type: "boolean"
-	}
-}).conflicts("org-id", "project-id").strict().check((argv) => {
-	noPassthrough("profile create")(argv);
-	if (argv.force === true) {
-		const name = typeof argv.name === "string" ? argv.name : "NAME";
-		throw new Error(`--force is no longer a flag. \`neon profile create ${name}\` always replaces an existing profile and revokes the credential it held. Drop --force.`);
-	}
-	return true;
-}).example("$0 profile create work", "Sign in with the browser, like `neon login --profile work`").example("$0 profile create work --api-key \"$KEY\"", "Store a key you already have").example("echo \"$KEY\" | $0 profile create work --api-key -", "Or pipe it, so it never reaches the process arguments").example("$0 profile create ci --mint --org-id org-abc-123", "One browser sign-in, then an org-scoped key and no session left behind").example("$0 profile create work --keyring", "Store the credential in the OS keyring instead of a file"), async (args) => await create(args)).command("rotate-key <name>", "Mint a fresh API key for a profile, at the same scope, and revoke the one it replaces", (y) => y.positional("name", {
-	describe: "Profile to rotate",
-	type: "string",
-	demandOption: true
-}).strict().check(noPassthrough("profile rotate-key")), async (args) => await rotateKey(args)).command("remove <name>", "Revoke a profile's credential where possible, and remove it", (y) => y.positional("name", {
-	describe: "Profile to remove",
-	type: "string",
-	demandOption: true
-}).option("yes", {
-	alias: "y",
-	describe: "Skip the confirmation prompt",
-	type: "boolean",
-	default: false
-}).strict().check(noPassthrough("profile remove")), async (args) => await remove(args));
-const handler = (_args) => {};
-/**
-* Refuse a global credential flag that a `profile` subcommand cannot honour.
-*
-* These commands name their target as a positional and authenticate as that profile, so both
-* `--profile` and `--api-key` have nothing to select here and were silently dropped — which is
-* precisely the class of bug this command family exists to stop. `.strict()` cannot catch
-* either, because both are global options and yargs has already accepted them.
-*
-* No "did you mean". The suggestion this used to make was built from the flag rather than the
-* positional, so it renamed the target: `profile remove work --profile other` answered "did you
-* mean `neon profile remove other`". Since the name is a required positional, that was wrong in
-* every case it fired, and on `remove` it was copy-pasteable destructive advice for an account
-* the user had not mentioned.
-*/
-const rejectProfileFlag = (props, sub) => {
-	const named = props.profile?.trim();
-	if (!named) return;
-	throw new Error(`--profile does not apply to \`profile ${sub}\`, which takes the profile name as an argument. You passed both "${props.name}" and --profile ${named}; drop --profile.`);
-};
-/**
-* Refuse `--api-key` on a subcommand that authenticates as the profile it was given.
-*
-* The mirror image of the flag above, and it was the one left silent: `profile remove work
-* --api-key napi_…` ignored the key, used the stored one, and reported a revoke failure against
-* a credential the user had not passed. This PR exists because a dropped credential flag chose
-* the wrong account; leaving that unsaid on the commands that manage credentials would be the
-* same bug with the arguments swapped.
-*/
-const rejectApiKeyFlag = (sub, instead) => {
-	if (credentialInputs().apiKeyFlag.trim() === "") return;
-	throw new Error(`--api-key does not apply to \`profile ${sub}\`, which uses the credential the profile already holds.${instead ? ` ${instead}` : ""}`);
-};
-/**
-* What kind of credential a file holds, for display.
-*
-* A file that declares a kind we cannot read is reported as `invalid` with the reason logged,
-* rather than throwing: one broken profile must not hide every other row, and the whole point
-* of `list` is to show the state of things including the broken parts.
-*/
-const hintStore = (storage) => storage === "keyring" ? "keyring" : "file";
-const describeAuth = (stored, at, store = "file") => {
-	if (stored === null) return "-";
-	try {
-		return interpretCredentials(stored, at, store).kind === "api_key" ? "api key" : "oauth";
-	} catch (err) {
-		log.warning(err instanceof Error ? err.message : String(err));
-		return "invalid";
-	}
-};
-/**
-* One row's view of a credentials file.
-*
-* Reports a damaged file as `invalid` and carries on, because one broken profile must not take
-* the whole listing with it — and unlike the authenticating path, listing has nothing to
-* recover, so the row itself is the report.
-*
-* One column answers "can this be used". A file whose JSON parses but whose `type` is
-* unreadable used to show `File: ok` beside `Auth: invalid`, so the column a user scans to find
-* the broken profile pointed at a different row than the one that was broken.
-*/
-const inspectForListing = (configDir, at) => {
-	const listing = storeFor(configDir).inspect(at);
-	if (listing.reason !== void 0) log.warning(listing.reason);
-	if (listing.credentials === null) return {
-		stored: null,
-		auth: "-",
-		file: listing.file,
-		storage: listing.storage
-	};
-	const auth = describeAuth(listing.credentials, at, hintStore(listing.storage));
-	return {
-		stored: listing.credentials,
-		auth,
-		file: auth === "invalid" ? "invalid" : listing.file,
-		storage: listing.storage
-	};
-};
-const list = async (props) => {
-	rejectApiKeyFlag("list");
-	const active = selectProfileName(props.profile);
-	if (props.profile !== void 0 && props.profile.trim() !== "") resolveProfile(props.configDir, active);
-	const rows = listProfiles(props.configDir).map((p) => {
-		const { stored, auth, file, storage } = inspectForListing(props.configDir, locationOf(p));
-		const storedUserId = typeof stored?.user_id === "string" ? stored.user_id : void 0;
-		return {
-			active: p.name === active ? "*" : "",
-			name: p.name,
-			account: p.label ?? p.userId ?? storedUserId ?? "-",
-			auth,
-			scope: auth === "oauth" ? describeScope({}) : stored !== null && auth === "api key" ? describeScope(scopeOf(stored)) : "-",
-			file,
-			storage,
-			credentials: props.output === "table" ? credentialsListValue(p, props.configDir) : credentialsDisplay(p)
-		};
-	});
-	writer(props).end(rows, {
-		title: "Profiles",
-		fields: [
-			"active",
-			"name",
-			"account",
-			"auth",
-			"credentials",
-			"scope"
-		]
-	});
-};
-const credentialsListValue = (profile, configDir) => {
-	if (profile.storage === "keyring") return KEYRING_CREDENTIALS;
-	const rel = relative(configDir, profile.credentialsPath);
-	if (rel.startsWith("..") || isAbsolute(rel)) return profile.credentialsPath;
-	return rel;
-};
-const locationForCreate = (configDir, name, keyring) => {
-	assertProfilesUsable(configDir, name);
-	const declared = readProfiles(configDir)?.profiles[name];
-	const pointer = declared !== void 0 && isKeyringPointer(declared.credentials);
-	if (keyring === true || pointer) return {
-		profile: name,
-		storage: CRED_STORAGE_KEYRING
-	};
-	if (declared !== void 0 || name === "DEFAULT") return locationForName(configDir, name);
-	return newProfileLocation(configDir, name, CRED_STORAGE_FILE);
-};
-const existingLocation = (configDir, name) => {
-	try {
-		if (readProfiles(configDir)?.profiles[name] !== void 0 || name === "DEFAULT") return locationForName(configDir, name);
-	} catch {
-		return null;
-	}
-	return null;
-};
-const warnIfKeyringRollbackUnconfirmed = (cleared, profile) => {
-	if (cleared === "cleared") return;
-	log.warning("Could not confirm the new OS keyring item for profile \"%s\" was removed after a failed save.", profile);
-};
-const deleteLeftoverOwnedFile = (configDir, path, except) => {
-	if (!isOwnedCredentialPath(configDir, path)) return;
-	if (profilesUsingPath(configDir, path, except).length > 0) return;
-	try {
-		storeFor(configDir).delete({
-			profile: except,
-			storage: CRED_STORAGE_FILE,
-			path
-		});
-	} catch {
-		log.warning("Saved the keyring item but could not delete %s", path);
-	}
-};
-/** `--api-key -` means "read it from stdin", the usual convention for a piped value. */
-const STDIN = "-";
-/**
-* The key to store.
-*
-* Read from the *flag* and never from `NEON_API_KEY`. Everywhere else those are
-* interchangeable, but "store this credential permanently" is not something an exported
-* environment variable should be able to answer — a `create` that silently wrote whatever
-* happened to be in the shell would be storing a key the user never named.
-*
-* One flag, deliberately. Earlier revisions added `--api-key-file`, `--api-key-stdin` and
-* `--api-key-prompt` to keep the secret out of argv, which is four surfaces to document and
-* validate against each other for things the shell already does — `--api-key "$(cat file)"`
-* reads a file, `--api-key "$KEY"` takes a variable. Piping is the one case the shell cannot
-* express through an argument, so it gets the usual convention instead of a flag: `-`.
-*/
-const resolveKeyToStore = (props) => {
-	const fromFlag = credentialInputs().apiKeyFlag.trim();
-	if (fromFlag === STDIN) return readKeyFromStdin();
-	if (fromFlag !== "") return fromFlag;
-	throw new Error(`Nothing to store for profile "${props.name}". Pass --api-key (or --api-key - to pipe it), --mint to have one minted, or no flags at all to sign in with the browser.`);
-};
-/**
-* Read the key from stdin, for `--api-key -`.
-*
-* A terminal is refused rather than read: `readFileSync(0)` on a tty waits for EOF with no
-* prompt and nothing echoed, which is indistinguishable from a hang — and this spelling exists
-* for pipes, so a terminal means the pipe is missing.
-*/
-const readKeyFromStdin = () => {
-	if (process.stdin.isTTY) throw new Error("`--api-key -` reads the key from stdin, but stdin is a terminal. Pipe it in: echo \"$KEY\" | neon profile create <name> --api-key -");
-	const piped = readFileSync(0, "utf8").trim();
-	if (piped === "") throw new Error("Nothing arrived on stdin, so there is no API key to store.");
-	return piped;
-};
-/**
-* Confirm a key works and find out whose it is, before it is written anywhere.
-*
-* `getAuthDetails` rather than `GET /users/me`: an organization key gets `404 not allowed for
-* organization API keys` from the latter, so asking would fail a perfectly good key.
-*/
-const verifyKey = async (props, apiKey, origin = "supplied") => {
-	const apiClient = getApiClient({
-		apiKey,
-		apiHost: props.apiHost
-	});
-	const { data: details } = await apiClient.getAuthDetails().catch((err) => {
-		if (isNeonApiError(err) && err.status === 401) throw new Error(origin === "minted" ? "Neon rejected the key it had just minted. Nothing was stored; the key is being revoked." : "The Neon API rejected the key passed to --api-key. Check the value, or use --mint to have one minted for this profile.");
-		throw err;
-	});
-	if (!isApiKeyMethod(details.auth_method)) throw new Error(notAnApiKeyMessage(details.auth_method));
-	const email = details.auth_method === "api_key_user" ? (await apiClient.getCurrentUserInfo()).data.email : void 0;
-	return {
-		...identityFromAuthDetails(details, email),
-		...details.auth_method === "api_key_org" ? { orgId: details.account_id } : {},
-		apiClient
-	};
-};
-const create = async (props) => {
-	const { name } = props;
-	rejectProfileFlag(props, "create");
-	assertValidProfileName(name);
-	assertProfilesUsable(props.configDir, name);
-	if (props.keyring === true) storeFor(props.configDir).assertKeyringWritable(existingLocation(props.configDir, name)?.storage === "keyring" ? name : void 0);
-	const suppliedKey = credentialInputs().apiKeyFlag.trim() !== "";
-	if (props.mint) {
-		if (suppliedKey) throw new Error("--mint creates a new key, so it cannot be combined with --api-key. Drop one.");
-		await createByMinting(props);
-		return;
-	}
-	if ((props.orgId ?? props.projectId) !== void 0) throw new Error("--org-id and --project-id only apply with --mint: they choose what a key we mint can reach, and a key you supply already has a scope.");
-	if (!suppliedKey) {
-		if (isCi() && props.forceAuth !== true) throw new Error(`\`neon profile create ${name}\` with no key signs in through the browser, which cannot happen in CI. Pass a key instead: \`neon profile create ${name} --api-key "$KEY"\`, or pipe it with \`echo "$KEY" | neon profile create ${name} --api-key -\`.`);
-		const at = locationForCreate(props.configDir, name, props.keyring);
-		const existing = existingLocation(props.configDir, name);
-		const previous = existing === null ? null : readOutgoingCredential(props.configDir, existing);
-		if (await authFlow({
-			...props,
-			_: ["auth"],
-			profile: name,
-			keyring: props.keyring
-		}) === "") throw new Error(`Could not save credentials for profile "${name}".`);
-		if (at.storage !== "keyring") await retirePreviousCredential(props, name, previous);
-		const signedIn = readProfiles(props.configDir, log.warning)?.profiles[name];
-		report(props, {
-			name,
-			account: signedIn?.label ?? signedIn?.userId ?? "unknown account",
-			auth: "oauth",
-			scope: "-",
-			credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
-			storage: at.storage
-		});
-		return;
-	}
-	const apiKey = resolveKeyToStore(props);
-	const identity = await verifyKey(props, apiKey);
-	const at = locationForCreate(props.configDir, name, props.keyring);
-	const existing = existingLocation(props.configDir, name);
-	if (at.storage === "keyring") storeFor(props.configDir).assertKeyringWritable(existing?.storage === "keyring" ? name : void 0);
-	const previous = existing === null ? null : readOutgoingCredential(props.configDir, existing);
-	storeFor(props.configDir).write(at, apiKeyCredentials({
-		apiKey,
-		...identity.userId !== void 0 ? { userId: identity.userId } : {},
-		...identity.orgId !== void 0 ? { scope: { orgId: identity.orgId } } : {}
-	}));
-	try {
-		recordProfile(props, name, at, identity);
-	} catch (err) {
-		if (at.storage === "keyring" && existing?.storage !== "keyring") warnIfKeyringRollbackUnconfirmed(storeFor(props.configDir).delete(at, { required: false }), name);
-		throw err instanceof Error ? err : new Error(String(err));
-	}
-	await retirePreviousCredential(props, name, previous, apiKey);
-	if (at.storage === "keyring" && existing?.storage === "file") deleteLeftoverOwnedFile(props.configDir, existing.path, name);
-	report(props, {
-		name,
-		account: identity.label ?? "unknown account",
-		auth: "api key",
-		scope: describeScope(identity.orgId !== void 0 ? { orgId: identity.orgId } : {}),
-		credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
-		storage: at.storage
-	});
-	log.warning("A key you supplied cannot be revoked by `rotate-key` or `remove` — only keys minted here record an id.");
-};
-/**
-* What a minted key can reach, in the same words `neon api-keys create` uses for the same key.
-*
-* Saying nothing here would be worse than there: this is the command aimed at agents and shared
-* machines, which is exactly where an over-broad credential does the most damage.
-*/
-const warnAboutReach = (scope) => {
-	if (scope.projectId !== void 0) {
-		log.info("Limited to %s: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.", scope.projectId);
-		return;
-	}
-	if (scope.orgId !== void 0) {
-		log.warning("This key reaches every project in %s, including ones created later. Pass --project-id instead to restrict it to one.", scope.orgId);
-		return;
-	}
-	log.warning("This key reaches everything your account can, in every organization. Pass --org-id or --project-id to narrow it.");
-};
-/**
-* Report a profile that was just written.
-*
-* Through the writer rather than `log`, so `--output json` yields the record an agent needs
-* instead of nothing — it had to follow up with `profile list` to learn what it just created.
-*/
-const report = (props, record) => {
-	const out = writer(props);
-	if (props.output === "table") {
-		log.info("Profile \"%s\" now holds %s for %s (%s), in %s", record.name, record.auth, record.account, record.scope, record.credentials);
-		return;
-	}
-	out.end(record, {
-		fields: [
-			"name",
-			"account",
-			"auth",
-			"scope",
-			...record.keyId !== void 0 ? ["keyId"] : [],
-			"credentials",
-			...record.storage !== void 0 ? ["storage"] : []
-		],
-		title: "Profile"
-	});
-};
-const recordProfile = (props, name, at, identity) => {
-	upsertProfile(props.configDir, name, {
-		credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
-		...identity.label ? { label: identity.label } : {},
-		...identity.userId ? { userId: identity.userId } : {}
-	});
-};
-/**
-* Sign in once, mint a key, keep only the key.
-*
-* This is the reason to prefer a key-backed profile at all: after it, nothing about the profile
-* can trigger a browser. The OAuth session is a means to an end and is revoked at the end of
-* it, so no half-forgotten login is left behind — which also means the file holds exactly one
-* credential, for exactly one account.
-*/
-const createByMinting = async (props) => {
-	const { name } = props;
-	if (isCi() && props.forceAuth !== true) throw new Error(`--mint needs a browser sign-in, which cannot happen in CI. Mint the key with \`neon api-keys create --name ${name}\` and pipe it in: echo "$KEY" | neon profile create ${name} --api-key -`);
-	if (locationForCreate(props.configDir, name, props.keyring).storage === "keyring") storeFor(props.configDir).assertKeyringWritable(existingLocation(props.configDir, name)?.storage === "keyring" ? name : void 0);
-	const oauthProps = {
-		oauthHost: props.oauthHost,
-		clientId: props.clientId,
-		...props.allowUnsafeTls ? { allowUnsafeTls: props.allowUnsafeTls } : {}
-	};
-	const tokenSet = await auth(oauthProps);
-	const session = getApiClient({
-		apiKey: tokenSet.access_token ?? "",
-		apiHost: props.apiHost
-	});
-	let minted;
-	let mintedScope = {};
-	let keyIsReachable = false;
-	try {
-		const scope = await resolveMintScope(props, session);
-		mintedScope = scope;
-		minted = await mintKey(session, name, scope);
-		const identity = await verifyKey(props, minted.key, "minted");
-		const at = locationForCreate(props.configDir, name, props.keyring);
-		const existing = existingLocation(props.configDir, name);
-		const previous = existing === null ? null : readOutgoingCredential(props.configDir, existing);
-		storeFor(props.configDir).write(at, apiKeyCredentials({
-			apiKey: minted.key,
-			keyId: minted.id,
-			...identity.userId !== void 0 ? { userId: identity.userId } : {},
-			scope
-		}));
-		try {
-			recordProfile(props, name, at, identity);
-		} catch (err) {
-			if (at.storage === "keyring" && existing?.storage !== "keyring") warnIfKeyringRollbackUnconfirmed(storeFor(props.configDir).delete(at, { required: false }), name);
-			else keyIsReachable = true;
-			throw err instanceof Error ? err : new Error(String(err));
-		}
-		await retirePreviousCredential(props, name, previous, minted.key);
-		if (at.storage === "keyring" && existing?.storage === "file") deleteLeftoverOwnedFile(props.configDir, existing.path, name);
-		keyIsReachable = true;
-		report(props, {
-			name,
-			account: identity.label ?? "unknown account",
-			auth: "api key",
-			scope: describeScope(scope),
-			keyId: minted.id,
-			credentials: at.storage === "keyring" ? KEYRING_CREDENTIALS : at.path,
-			storage: at.storage
-		});
-		warnAboutReach(scope);
-	} finally {
-		if (minted !== void 0 && !keyIsReachable) {
-			if (await withdrawKey(session, mintedScope, minted.id)) log.info(`Revoked the key that was minted but not stored (id ${minted.id}).`);
-			else log.warning(`Minted key ${minted.id} could be neither stored nor revoked, and may still be live. Remove it with: neon api-keys revoke ${minted.id}${mintedScope.orgId ? ` --org-id ${mintedScope.orgId}` : ""}`);
-		}
-		const revoked = await revokeToken(oauthProps, tokenSet);
-		log.info(revoked ? "Signed the browser session back out, so nothing but the key remains." : "Could not sign the browser session back out; it will expire on its own.");
-	}
-};
-/**
-* The scope to mint at, resolving a project to the organization that owns it.
-*
-* A project-scoped key exists only on the organization endpoint, so the org has to be looked up
-* rather than asked for — `--project-id` alone would otherwise fail for a reason invisible from
-* the command line.
-*/
-const resolveMintScope = async (props, client) => {
-	if (props.projectId === void 0) return props.orgId !== void 0 ? { orgId: props.orgId } : {};
-	return {
-		orgId: await orgIdForProject(client, props.projectId),
-		projectId: props.projectId
-	};
-};
-/**
-* Mint a key at the given scope and refuse anything that came back different.
-*
-* A 2xx is not enough. A response with no `key` leaves a live credential the user can never
-* see, and a `project_id` that does not match would mean storing a credential whose reach we
-* announced wrongly. Both are withdrawn before throwing.
-*/
-const mintKey = async (client, profile, scope) => {
-	const keyName = mintedKeyName(profile);
-	const { data } = scope.orgId ? await client.createOrgApiKey(scope.orgId, {
-		key_name: keyName,
-		...scope.projectId ? { project_id: scope.projectId } : {}
-	}) : await client.createApiKey({ key_name: keyName });
-	const issuedProject = "project_id" in data && typeof data.project_id === "string" ? data.project_id : void 0;
-	const problem = typeof data.key !== "string" || data.key.trim() === "" ? "Neon returned no key." : issuedProject !== scope.projectId ? `Neon returned a key scoped to ${issuedProject ?? "nothing"} rather than ${scope.projectId ?? "the whole organization"}.` : null;
-	if (problem === null) return {
-		id: data.id,
-		key: data.key,
-		name: data.name
-	};
-	const withdrawn = await withdrawKey(client, scope, data.id);
-	throw new Error(`${problem} ${withdrawn ? "The key has been revoked; nothing was stored." : `The key could NOT be revoked and may still be live. Remove it with \`neon api-keys revoke ${data.id}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}\`.`}`);
-};
-const rotateKey = async (props) => {
-	const { name } = props;
-	rejectProfileFlag(props, "rotate-key");
-	rejectApiKeyFlag("rotate-key", `To store a key you already have, use \`neon profile create ${name} --api-key -\`.`);
-	const profile = resolveProfile(props.configDir, name);
-	const at = locationOf(profile);
-	const credential = await usableCredential(props, at);
-	if (credential === null) throw new Error(`Profile "${name}" has no usable credential to mint with. Replace it with \`neon profile create ${name} --mint\`.`);
-	if (credential.kind !== "api_key") throw new Error(`Profile "${name}" holds a browser sign-in, not an API key, so there is no key to rotate. Turn it into a key profile with \`neon profile create ${name} --mint\`.`);
-	const stored = storeFor(props.configDir).read(at)?.credentials ?? null;
-	const scope = stored !== null ? scopeOf(stored) : {};
-	const previousKeyId = typeof stored?.key_id === "number" ? stored.key_id : void 0;
-	const minting = getApiClient({
-		apiKey: credential.apiKey,
-		apiHost: props.apiHost
-	});
-	setAuthContext({
-		source: "profile-api-key",
-		configDir: props.configDir,
-		profile: name,
-		storage: at.storage,
-		...at.storage === "file" ? { credentialsPath: at.path } : {}
-	});
-	const { data: details } = await minting.getAuthDetails();
-	if (details.auth_method === "api_key_org") {
-		const advice = scope.projectId !== void 0 ? `\`neon profile create ${name} --mint --project-id ${scope.projectId}\`` : scope.orgId !== void 0 && previousKeyId !== void 0 ? `\`neon profile create ${name} --mint --org-id ${scope.orgId}\`` : `\`neon profile create ${name} --mint --org-id ${details.account_id}\` — but check \`neon api-keys list --org-id ${details.account_id}\` first, because a key you supplied may have been narrowed to a single project and an organization key would reach more`;
-		throw new Error(`Profile "${name}" holds an organization key, and only a personal credential can mint organization keys — so it cannot mint its own replacement. Sign in and mint one with ${advice}.`);
-	}
-	const created = await mintKey(minting, name, scope);
-	log.info("Minted %s (id %d, %s)", created.name, created.id, describeScope(scope));
-	try {
-		storeFor(props.configDir).write(at, apiKeyCredentials({
-			apiKey: created.key,
-			keyId: created.id,
-			...typeof stored?.user_id === "string" ? { userId: stored.user_id } : {},
-			scope
-		}));
-	} catch (err) {
-		log.error("Minted key %d but could not write %s. Revoke it with: neon api-keys revoke %d%s", created.id, credentialLabel(at), created.id, scope.orgId ? ` --org-id ${scope.orgId}` : "");
-		throw err;
-	}
-	report(props, {
-		name,
-		account: profile.label ?? profile.userId ?? "unknown account",
-		auth: "api key",
-		scope: describeScope(scope),
-		keyId: created.id,
-		credentials: credentialsDisplay(profile),
-		storage: at.storage
-	});
-	if (previousKeyId === void 0) {
-		log.warning("No previous key id was recorded, so the key this replaces is still live. It was supplied rather than minted here, and `GET /api_keys` exposes no prefix to match it by — find it with `neon api-keys list`.");
-		return;
-	}
-	const rotated = getApiClient({
-		apiKey: created.key,
-		apiHost: props.apiHost
-	});
-	if (await withdrawKey(rotated, scope, previousKeyId)) {
-		log.info("Revoked the previous key (id %d)", previousKeyId);
-		return;
-	}
-	log.warning("Stored the new key, but could not revoke the previous one (id %d) — it may still be live. Revoke it with: neon api-keys revoke %d%s", previousKeyId, previousKeyId, scope.orgId ? ` --org-id ${scope.orgId}` : "");
-};
-const remove = async (props) => {
-	const { name } = props;
-	rejectProfileFlag(props, "remove");
-	rejectApiKeyFlag("remove", "It revokes the credential stored for that profile, which is the only one it can revoke.");
-	const profile = resolveProfile(props.configDir, name);
-	if (!props.yes) {
-		if (isCi() || !process.stdin.isTTY) throw new Error("Refusing to remove a profile without confirmation when stdin is not a terminal. Pass --yes.");
-		const who = profile.label ?? profile.userId ?? "unknown account";
-		const { ok } = await prompts({
-			type: "confirm",
-			name: "ok",
-			message: `Remove profile "${name}" (${who})?`,
-			initial: false
-		});
-		if (!ok) throw new Error(`Cancelled — profile "${name}" was not removed.`);
-	}
-	const at = locationOf(profile);
-	let stored = null;
-	try {
-		stored = readOutgoingCredential(props.configDir, at);
-	} catch (err) {
-		if (at.storage === "keyring") log.warning("Could not read the OS keyring item for profile \"%s\"; nothing in it could be revoked.", name);
-		else log.warning("%s. Nothing in it could be revoked.", (err instanceof Error ? err.message : String(err)).replace(/\.$/, ""));
-	}
-	if (stored?.kind === "api_key") {
-		const { keyId, scope } = stored;
-		if (keyId === void 0) log.warning("Profile \"%s\" holds an API key that was supplied rather than minted here, so it stays live on the account — find it with `neon api-keys list`.", name);
-		else {
-			const client = getApiClient({
-				apiKey: stored.apiKey,
-				apiHost: props.apiHost
-			});
-			if (await withdrawKey(client, scope, keyId)) log.info(`Revoked the API key (id ${keyId})`);
-			else log.warning(`Could not revoke the API key (id ${keyId}) — it may still be live. Remove it with: neon api-keys revoke ${keyId}${scope.orgId ? ` --org-id ${scope.orgId}` : ""}`);
-		}
-	} else if (stored !== null) {
-		const revoked = await revokeTokenSet(stored.tokens, props);
-		log.info(revoked ? "Revoked the OAuth token" : "Could not revoke the OAuth token — removing locally anyway");
-	}
-	const dropPointer = () => {
-		assertProfilesUsable(props.configDir, name);
-		const path = profilesFilePath(props.configDir);
-		const file = readProfiles(props.configDir, log.warning);
-		if (file?.profiles[name]) {
-			delete file.profiles[name];
-			if (canDropProfilesFile(file)) {
-				rmSync(path);
-				log.info("Removed \"%s\" — no profiles left, deleted %s", name, path);
-			} else {
-				writeSecretFile(path, `${JSON.stringify(file, null, 2)}\n`);
-				log.info("Removed \"%s\" from %s", name, path);
-			}
-		} else if (name === "DEFAULT") log.info("Signed out of DEFAULT");
-	};
-	const listing = storeFor(props.configDir).inspect(at);
-	if (at.storage === "keyring") {
-		const account = keyringAccount(props.configDir, name);
-		if (name === "DEFAULT") {
-			const leftover = credentialsPath(props.configDir);
-			if (isOwnedCredentialPath(props.configDir, leftover) && existsSync(leftover) && profilesUsingPath(props.configDir, leftover, name).length === 0) {
-				storeFor(props.configDir).delete({
-					profile: name,
-					storage: CRED_STORAGE_FILE,
-					path: leftover
-				}, { required: false });
-				if (existsSync(leftover)) throw new Error(`Could not delete ${leftover}. Refusing to reset DEFAULT — that file would become the profile.`);
-				log.info("Deleted %s", leftover);
-			}
-		}
-		dropPointer();
-		if (listing.reason?.includes("cannot use the OS keyring")) {
-			log.warning("This CLI cannot delete the OS keyring item for profile \"%s\". It remains in the OS store (service %s, account %s) until a CLI with the keyring addon removes it, or you delete it there.", name, KEYRING_SERVICE, account);
-			return;
-		}
-		let cleared = "unconfirmed";
-		try {
-			cleared = storeFor(props.configDir).delete(at, {
-				required: false,
-				account
-			});
-		} catch {
-			cleared = "unconfirmed";
-		}
-		if (cleared === "cleared") log.info("Deleted the OS keyring item for profile \"%s\"", name);
-		else log.warning("Could not confirm the OS keyring item for profile \"%s\" is gone. A leftover may still be in the OS store (service %s, account %s); it is not used once the profile is gone.", name, KEYRING_SERVICE, account);
-		return;
-	}
-	if (isOwnedCredentialPath(props.configDir, at.path)) {
-		storeFor(props.configDir).delete(at);
-		if (listing.credentials !== null || listing.file !== "missing") log.info("Deleted %s", at.path);
-	} else if (existsSync(at.path)) log.info("Left %s on disk — not created by neon", at.path);
-	dropPointer();
-};
-//#endregion
-export { aliases, builder, command, describe, handler, profile_exports as t };
+export { t as aliases, n as builder, r as command, i as describe, a as handler } from "../_chunks/profile-yXOiKk9R.js";