neon 8.9.0 → 8.10.1

package/README.md

@@ -1005,6 +1005,18 @@ neon feedback --message "The branch docs were unclear" --output json
 
 Default table output is `Feedback received. Thank you!`. `--output json` and `--output yaml` print `{ "received": true }`. Messages are limited to 10,000 characters. Do not include passwords, API keys, connection strings, or other secrets.
 
+## Search neon.com (`docs search`)
+
+`neon docs search <query>` searches neon.com: the docs, API reference, PostgreSQL tutorial, guides, FAQs, changelog, and blog. It does not log in and does not use your Neon account. It uses the same search as the neon.com search box. The search service records the query, the CLI version, and the detected coding agent; `--no-analytics` turns that off.
+
+```bash
+neon docs search "reset a branch"
+neon docs search "create branch" --category api --category docs
+neon docs search "pg_dump" --limit 5 --output json
+```
+
+`--category` limits results to `docs`, `api`, `postgresql`, `guides`, `faqs`, `blog`, or `changelog`; repeat it for more than one. `--limit` is 1 to 40, default 10. Default table output is one row per page: title, the section that matched, and URL. `--output json` and `--output yaml` print an array of hits with `title`, `url`, `category`, `breadcrumb`, `heading`, and `excerpt`, in rank order. No match prints `No results for "<query>".` and exits 0 (`[]` in JSON).
+
 ## Install the Neon plugin (`plugins`)
 
 `neon plugins` installs the Neon agent plugin (`neon-postgres`) by running `npx plugins add`. It does not call the Neon API.
@@ -1531,7 +1543,7 @@ Global options are supported with any Neon CLI command.
 
 - <a id="analytics"></a>`--analytics`
 
-  Analytics are enabled by default to gather information about the CLI commands and options that are used by our customers. This data collection assists in offering support, and allows for a better understanding of typical usage patterns so that we can improve user experience. Neon does not collect user-defined data, such as project IDs or command payloads, except the question passed to `neon ask --prompt`. When the CLI fails on an internal bug (a JavaScript `TypeError`, `ReferenceError`, `RangeError`, or `SyntaxError`), it also sends that error to Neon's Sentry: the error type, the message only when it is a standard JavaScript message that names nothing but code (any other message is replaced), the stack trace with file paths cut to the package (`neon/dist/...`), the CLI and Node.js versions, and whether it ran in CI or a coding agent. To opt-out of analytics data collection and error reports, specify `--no-analytics` or `--analytics false`.
+  Analytics are enabled by default to gather information about the CLI commands and options that are used by our customers. This data collection assists in offering support, and allows for a better understanding of typical usage patterns so that we can improve user experience. Neon does not collect user-defined data, such as project IDs or command payloads, except the question passed to `neon ask --prompt` and the query passed to `neon docs search`. The Neon search service records each `neon docs search` query with the CLI version and the detected coding agent; with `--no-analytics` it records nothing. When the CLI fails on an internal bug (a JavaScript `TypeError`, `ReferenceError`, `RangeError`, or `SyntaxError`), it also sends that error to Neon's Sentry: the error type, the message only when it is a standard JavaScript message that names nothing but code (any other message is replaced), the stack trace with file paths cut to the package (`neon/dist/...`), the CLI and Node.js versions, and whether it ran in CI or a coding agent. To opt-out of analytics data collection and error reports, specify `--no-analytics` or `--analytics false`.
 
 - <a id="version"></a>`-v, --version`
 

package/dist/_chunks/{credential_io-ByNuojoE.js → credential_io-BS-0Pmwc.js}

@@ -200,6 +200,12 @@ var KeyringUnavailableError = class extends Error {
 		this.name = "KeyringUnavailableError";
 	}
 };
+var KeyringValueTooLargeError = class extends Error {
+	constructor(profile, actual, maximum) {
+		super(`Credentials for profile "${profile}" are ${actual} characters, and this OS keyring stores at most ${maximum}. Run \`neon login --profile ${profile}\` without \`--keyring\` to keep the credential in an owner-only file. If this profile already uses the keyring, remove it first with \`neon profile remove ${profile} --yes\`.`);
+		this.name = "KeyringValueTooLargeError";
+	}
+};
 var KeyringUnreadableError = class extends Error {
 	constructor(profile) {
 		const replace = `\`neon login --profile ${profile}\``;
@@ -248,8 +254,10 @@ const createCredentialStore = (dir, options = {}) => {
 		} catch {
 			previous = null;
 		}
+		const serialized = JSON.stringify(credentials);
+		if (kr.maxPasswordCodeUnits !== void 0 && serialized.length > kr.maxPasswordCodeUnits) throw new KeyringValueTooLargeError(profile, serialized.length, kr.maxPasswordCodeUnits);
 		try {
-			kr.set(KEYRING_SERVICE, account, JSON.stringify(credentials));
+			kr.set(KEYRING_SERVICE, account, serialized);
 		} catch {
 			throw new KeyringUnavailableError();
 		}

package/dist/analytics.js

@@ -1,4 +1,4 @@
-import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
+import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";
 import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import { getOrCreateAnonymousId } from "./anonymous_id.js";

package/dist/auth.js

@@ -221,4 +221,4 @@ const auth = async ({ oauthHost, clientId, allowUnsafeTls }) => {
 	});
 };
 //#endregion
-export { AuthRefreshError, auth, classifyRefreshFailure, defaultClientID, refreshToken, revokeToken };
+export { AuthRefreshError, NEONCTL_SCOPES, auth, classifyRefreshFailure, defaultClientID, refreshToken, revokeToken };

package/dist/auth_recovery.js

@@ -1,4 +1,4 @@
-import { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
+import { t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";
 import { log } from "./log.js";
 import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
 import { AuthRefreshError } from "./auth.js";

package/dist/commands/auth.js

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { withExclusiveLock } from "../refresh_lock.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
 import { a as isOwnedCredentialPath } from "../_chunks/paths-DMq0Lt7a.js";
-import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
+import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
 import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
@@ -136,20 +136,16 @@ const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "f
 	return tokenSet.access_token || "";
 };
 /**
-* Persist before identity lookup so a lookup failure cannot discard the new session.
-* Merge the identity only while that session remains current on disk.
+* One write, after the lookup: a second write that adds `user_id` could fail the keyring size
+* check after the first had already replaced the previous credential.
 */
 const persistNewSession = async (at, credentials, apiClient, configDir) => {
-	const stored = oauthCredentialsFromTokenSet(credentials, null);
-	writeOAuthCredentials(configDir, at, stored);
 	const identity = await fetchIdentity(apiClient);
-	if (identity.id) {
-		const current = storeFor(configDir).read(at);
-		if (current !== null && current.credentials.access_token === stored.access_token) writeOAuthCredentials(configDir, at, {
-			...current.credentials,
-			user_id: identity.id
-		});
-	}
+	const stored = oauthCredentialsFromTokenSet(credentials, null);
+	writeOAuthCredentials(configDir, at, identity.id ? {
+		...stored,
+		user_id: identity.id
+	} : stored);
 	return identity;
 };
 const fetchIdentity = async (apiClient) => {
@@ -248,8 +244,8 @@ const refreshStoredCredentials = async (at, props) => {
 const oauthCredentialsFromTokenSet = (tokenSet, previous) => {
 	const refreshTokenValue = typeof tokenSet.refresh_token === "string" && tokenSet.refresh_token !== "" ? tokenSet.refresh_token : previous?.refresh_token;
 	const stored = {
-		...tokenSet,
 		type: OAUTH,
+		...typeof tokenSet.access_token === "string" && tokenSet.access_token !== "" ? { access_token: tokenSet.access_token } : {},
 		expires_at: tokenSet.expires_at,
 		...typeof refreshTokenValue === "string" && refreshTokenValue !== "" ? { refresh_token: refreshTokenValue } : {}
 	};
@@ -304,7 +300,7 @@ const ensureAuth = async (props) => {
 	if (isInspectDbUrl(props)) return;
 	if (props._[0] === "open") return;
 	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
-	if (isAskCommand(props) || isFeedbackCommand(props)) return;
+	if (isAskCommand(props) || isFeedbackCommand(props) || isDocsCommand(props)) return;
 	if (props._[0] === "init") {
 		selectCredential({
 			...credentialInputs(),

package/dist/commands/dev.js

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
-import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
-import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
-import { resolveWatchInputs } from "../dev/inputs.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
+import { a as resolveDevEnv } from "../_chunks/env-BNm69Qh8.js";
 import { envFlag } from "./config.js";
+import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
+import { resolveWatchInputs } from "../dev/inputs.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/commands/docs.js

@@ -0,0 +1,174 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { getCliAgent } from "../env.js";
+import pkg_default from "../pkg.js";
+import { isNetworkError } from "../errors.js";
+import { writer } from "../writer.js";
+import { single } from "../utils/flags.js";
+//#region src/commands/docs.ts
+var docs_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_SITE_SEARCH_URL: () => DEFAULT_SITE_SEARCH_URL,
+	MAX_LIMIT: () => 40,
+	MAX_QUERY_LENGTH: () => 500,
+	SITE_SEARCH_CATEGORIES: () => SITE_SEARCH_CATEGORIES,
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	parseSearchHits: () => parseSearchHits,
+	resolveSiteSearchUrl: () => resolveSiteSearchUrl,
+	siteSearchHeaders: () => siteSearchHeaders
+});
+const DEFAULT_SITE_SEARCH_URL = "https://br-frosty-cell-a5smzg39-assistant.compute.c-1.us-east-2.aws.neon.tech/site-search";
+const SITE_SEARCH_CATEGORIES = [
+	"docs",
+	"api",
+	"postgresql",
+	"guides",
+	"faqs",
+	"blog",
+	"changelog"
+];
+const MAX_QUERY_LENGTH = 500;
+const MAX_LIMIT = 40;
+const DEFAULT_LIMIT = 10;
+const SEARCH_TIMEOUT_MS = 1e4;
+const command = "docs";
+const describe = "Search neon.com docs, guides, and more";
+const SEARCH_DESCRIBE = "Search neon.com: docs, API reference, PostgreSQL tutorial, guides, FAQs, changelog, and blog";
+const builder = (argv) => argv.usage("$0 docs <sub-command> [options]").command("search <query>", SEARCH_DESCRIBE, (yargs) => yargs.positional("query", {
+	describe: "What to search for",
+	type: "string"
+}).options({
+	category: {
+		describe: "Only return pages in these categories (repeatable)",
+		type: "string",
+		array: true,
+		choices: SITE_SEARCH_CATEGORIES
+	},
+	limit: {
+		describe: `Maximum number of results (1-40)`,
+		type: "number",
+		default: DEFAULT_LIMIT
+	},
+	url: {
+		describe: "Override the site search URL",
+		type: "string",
+		hidden: true,
+		coerce: single("url")
+	}
+}).strict().check((args) => {
+	const query = typeof args.query === "string" ? args.query.trim() : "";
+	if (query === "") throw new Error("<query> needs a value");
+	if (query.length > 500) throw new Error(`<query> must be 500 characters or fewer`);
+	const limit = args.limit;
+	if (!Number.isInteger(limit) || limit < 1 || limit > 40) throw new Error(`--limit must be a whole number from 1 to 40`);
+	return true;
+}).example("$0 docs search \"reset a branch\"", SEARCH_DESCRIBE).example("$0 docs search \"create branch\" --category api --category docs", "Search only the API reference and the docs"), (args) => search(args));
+function resolveSiteSearchUrl(opts) {
+	const fromFlag = opts.url?.trim();
+	if (fromFlag) return fromFlag;
+	const fromEnv = opts.envUrl?.trim();
+	if (fromEnv) return fromEnv;
+	return DEFAULT_SITE_SEARCH_URL;
+}
+const search = async (props) => {
+	const query = props.query.trim();
+	const hits = await searchSite({
+		url: resolveSiteSearchUrl({
+			url: props.url,
+			envUrl: process.env.NEON_SITE_SEARCH_URL
+		}),
+		query,
+		limit: props.limit,
+		categories: props.category ? [...new Set(props.category)] : void 0,
+		headers: siteSearchHeaders({
+			analytics: props.analytics,
+			agent: getCliAgent(process.env),
+			version: pkg_default.version
+		})
+	});
+	writer(props).end(hits, {
+		fields: [
+			"title",
+			"heading",
+			"url"
+		],
+		emptyMessage: `No results for "${query}".`,
+		renderColumns: { heading: (hit) => sectionOf(hit) }
+	});
+};
+function sectionOf(hit) {
+	const parts = hit.heading.split(" > ");
+	return (parts[0] === hit.title ? parts.slice(1) : parts).join(" > ");
+}
+function siteSearchHeaders(opts) {
+	return {
+		"Content-Type": "application/json",
+		"User-Agent": `neon/${opts.version}`,
+		"x-neon-source": "cli",
+		...opts.agent ? { "x-neon-client": encodeURIComponent(opts.agent) } : {},
+		...opts.analytics ? {} : { "x-neon-analytics": "off" }
+	};
+}
+function isTimeout(error) {
+	return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+}
+async function searchSite(opts) {
+	const signal = AbortSignal.timeout(SEARCH_TIMEOUT_MS);
+	try {
+		const response = await fetch(opts.url, {
+			method: "POST",
+			headers: opts.headers,
+			body: JSON.stringify({
+				query: opts.query,
+				limit: opts.limit,
+				...opts.categories ? { categories: opts.categories } : {}
+			}),
+			signal
+		});
+		const raw = await response.text();
+		if (!response.ok) throw new Error(searchErrorMessage(raw, response.status));
+		return parseSearchHits(raw);
+	} catch (error) {
+		if (isTimeout(error)) throw new Error("Neon site search did not respond in time.");
+		if (isNetworkError(error)) throw new Error("Could not reach Neon site search. Check your internet connection and try again.");
+		throw error;
+	}
+}
+function parseJson(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function searchErrorMessage(raw, status) {
+	const body = parseJson(raw);
+	if (status < 500 && typeof body === "object" && body !== null && "error" in body && typeof body.error === "string" && body.error.trim() !== "") return body.error;
+	return `Neon site search failed (HTTP ${status}).`;
+}
+const UNEXPECTED_RESPONSE = "Neon site search returned an unexpected response.";
+function stringField(fields, key) {
+	const field = fields[key];
+	if (typeof field !== "string") throw new Error(UNEXPECTED_RESPONSE);
+	return field;
+}
+function parseSearchHits(raw) {
+	const body = parseJson(raw);
+	if (typeof body !== "object" || body === null || !("hits" in body) || !Array.isArray(body.hits)) throw new Error(UNEXPECTED_RESPONSE);
+	return body.hits.map((hit) => {
+		if (typeof hit !== "object" || hit === null) throw new Error(UNEXPECTED_RESPONSE);
+		const fields = Object.fromEntries(Object.entries(hit));
+		const breadcrumb = fields.breadcrumb;
+		if (!Array.isArray(breadcrumb) || !breadcrumb.every((part) => typeof part === "string")) throw new Error(UNEXPECTED_RESPONSE);
+		return {
+			title: stringField(fields, "title"),
+			url: stringField(fields, "url"),
+			category: stringField(fields, "category"),
+			breadcrumb,
+			heading: stringField(fields, "heading"),
+			excerpt: stringField(fields, "excerpt")
+		};
+	});
+}
+//#endregion
+export { DEFAULT_SITE_SEARCH_URL, MAX_LIMIT, MAX_QUERY_LENGTH, SITE_SEARCH_CATEGORIES, builder, command, describe, parseSearchHits, resolveSiteSearchUrl, siteSearchHeaders, docs_exports as t };

package/dist/commands/env.js

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "../_chunks/env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "./env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";

package/dist/commands/index.js

@@ -21,6 +21,7 @@ import { t as databases_exports } from "./databases.js";
 import { t as deploy_exports } from "./deploy.js";
 import { t as dev_exports } from "./dev.js";
 import { t as diff_exports } from "./diff.js";
+import { t as docs_exports } from "./docs.js";
 import { t as feedback_exports } from "./feedback.js";
 import { t as functions_exports } from "./functions.js";
 import { t as git_exports } from "./git.js";
@@ -75,6 +76,7 @@ var commands_default = [
 	skills_exports,
 	ask_exports,
 	feedback_exports,
+	docs_exports,
 	data_api_exports,
 	realtime_exports,
 	functions_exports,

package/dist/commands/manifest.js

@@ -181,6 +181,11 @@ const commandManifest = [
 		describe: "Send feedback to Neon",
 		load: () => import("./feedback.js")
 	},
+	{
+		command: "docs",
+		describe: "Search neon.com docs, guides, and more",
+		load: () => import("./docs.js")
+	},
 	{
 		command: "data-api",
 		describe: "Manage the Neon Data API for a database",

package/dist/commands/profile.js

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { t as writeSecretFile } from "../_chunks/secure_file-BucZj4yQ.js";
-import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
+import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { branchIdFromProps } from "../utils/enrichers.js";
+import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/context.js

@@ -90,6 +90,8 @@ const isPluginsCommand = (args) => args._[0] === "plugins" || args._[0] === "plu
 const isAskCommand = (args) => args._[0] === "ask";
 /** Feedback is anonymous, so it must never read credentials or `.neon` context. */
 const isFeedbackCommand = (args) => args._[0] === "feedback";
+/** Docs search calls public neon.com search, so it needs no credentials or `.neon` context. */
+const isDocsCommand = (args) => args._[0] === "docs";
 /**
 * `inspect db --db-url` talks to Postgres with that URI. Skip only when the
 * parsed value is nonempty: empty `--db-url` still goes through project
@@ -177,7 +179,7 @@ const enrichFromContext = (args) => {
 	if (isProfileCommand(args)) return;
 	if (isMcpCommand(args)) return;
 	if (isSkillsCommand(args) || isPluginsCommand(args)) return;
-	if (isAskCommand(args) || isFeedbackCommand(args)) return;
+	if (isAskCommand(args) || isFeedbackCommand(args) || isDocsCommand(args)) return;
 	if (isClaimCommand(args)) return;
 	const context = readContextFile(args.contextFile);
 	if (!args.orgId) args.orgId = context.orgId;
@@ -357,4 +359,4 @@ const globToRegExp = (pattern) => {
 	return new RegExp(`^${source}$`);
 };
 //#endregion
-export { CONTEXT_FILE, applyContext, contextBranch, currentContextFile, enrichFromContext, ensureDirectoryGitignored, ensureGitignored, gitBranchMap, gitBranchMapping, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile, setContext, setGitBranchMap, setGitBranchMapping, setGitFollow, updateContextFile, walkContextFile };
+export { CONTEXT_FILE, applyContext, contextBranch, currentContextFile, enrichFromContext, ensureDirectoryGitignored, ensureGitignored, gitBranchMap, gitBranchMapping, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile, setContext, setGitBranchMap, setGitBranchMapping, setGitFollow, updateContextFile, walkContextFile };

package/dist/credential_io.js

@@ -1 +1 @@
-export { t as storeFor } from "./_chunks/credential_io-ByNuojoE.js";
+export { t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";

package/dist/init/detect.js

@@ -1,4 +1,4 @@
-import { t as storeFor } from "../_chunks/credential_io-ByNuojoE.js";
+import { t as storeFor } from "../_chunks/credential_io-BS-0Pmwc.js";
 import { isCi } from "../env.js";
 import { h as resolveProfile, u as locationOf } from "../_chunks/profiles-DIB1av2Q.js";
 import { i as selectCredential, t as credentialInputs } from "../_chunks/auth_selection-YX5_KZgD.js";

package/dist/keyring.js

@@ -1,5 +1,7 @@
 import { createRequire } from "node:module";
 //#region src/keyring.ts
+/** Windows Credential Manager stores at most 2560 bytes per item: 1280 UTF-16 code units. */
+const keyringPasswordLimit = (platform) => platform === "win32" ? 1280 : void 0;
 const isPackaged = () => process.pkg !== void 0;
 const isMissingItem = (err) => {
 	const message = err instanceof Error ? err.message : String(err);
@@ -13,7 +15,9 @@ const tryLoadKeyring = () => {
 	if (isPackaged()) return null;
 	try {
 		const { Entry } = createRequire(import.meta.url)(["@napi-rs", "keyring"].join("/"));
+		const maxPasswordCodeUnits = keyringPasswordLimit(process.platform);
 		return {
+			...maxPasswordCodeUnits !== void 0 ? { maxPasswordCodeUnits } : {},
 			get(service, account) {
 				try {
 					return new Entry(service, account).getPassword();
@@ -39,4 +43,4 @@ const tryLoadKeyring = () => {
 	}
 };
 //#endregion
-export { tryLoadKeyring };
+export { keyringPasswordLimit, tryLoadKeyring };

package/dist/retire_credential.js

@@ -1,4 +1,4 @@
-import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-ByNuojoE.js";
+import { a as OAUTH, d as scopeOf, i as API_KEY, l as interpretCredentials, t as storeFor, u as isSameCredential } from "./_chunks/credential_io-BS-0Pmwc.js";
 import { log } from "./log.js";
 import { getApiClient } from "./api.js";
 import { revokeToken } from "./auth.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.9.0",
+  "version": "8.10.1",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -71,9 +71,9 @@
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
     "@neon/config": "1.9.3",
-    "@neon/config-runtime": "1.10.2",
     "@neon/realtime": "0.1.2",
-    "@neon/sdk": "7.4.0"
+    "@neon/sdk": "7.4.0",
+    "@neon/config-runtime": "1.10.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",