neonctl 2.28.0 → 2.29.1

package/dist/api.js

@@ -11,29 +11,29 @@
 // {@link isNeonApiError} and reads `error.status` / `error.data`. There is no
 // axios anywhere in neonctl: requests go through the global `fetch`, and this is
 // the one place HTTP errors are shaped.
-import { Readable } from 'node:stream';
-import { EnvHttpProxyAgent, setGlobalDispatcher } from 'undici';
-import { createClient, createConfig } from '@neon/sdk/raw';
-import * as raw from '@neon/sdk/raw';
-import { log } from './log.js';
-import pkg from './pkg.js';
+import { Readable } from "node:stream";
+import * as raw from "@neon/sdk/raw";
+import { createClient, createConfig } from "@neon/sdk/raw";
+import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
+import { log } from "./log.js";
+import pkg from "./pkg.js";
 // Node's global `fetch` (undici) ignores HTTP_PROXY / HTTPS_PROXY / NO_PROXY,
 // whereas the axios-based client neonctl used previously honored them. Restore
 // that behaviour by installing a proxy-aware global dispatcher — but only when a
 // proxy is actually configured, so the default (no-proxy) path stays untouched.
 // This covers every `fetch` neonctl makes, including the direct S3 upload.
 const PROXY_ENV_VARS = [
-    'HTTP_PROXY',
-    'http_proxy',
-    'HTTPS_PROXY',
-    'https_proxy',
-    'ALL_PROXY',
-    'all_proxy',
+    "HTTP_PROXY",
+    "http_proxy",
+    "HTTPS_PROXY",
+    "https_proxy",
+    "ALL_PROXY",
+    "all_proxy",
 ];
 if (PROXY_ENV_VARS.some((name) => process.env[name])) {
     setGlobalDispatcher(new EnvHttpProxyAgent());
 }
-const DEFAULT_API_HOST = 'https://console.neon.tech/api/v2';
+const DEFAULT_API_HOST = "https://console.neon.tech/api/v2";
 const REQUEST_TIMEOUT_MS = 60000;
 const USER_AGENT = `neonctl v${pkg.version}`;
 /** Mirrors the api-client `ContentType` enum used by the `request()` escape hatch. */
@@ -53,7 +53,7 @@ export var ContentType;
 export class NeonApiError extends Error {
     constructor(message, init = {}) {
         super(message);
-        this.name = 'NeonApiError';
+        this.name = "NeonApiError";
         this.status = init.status;
         this.statusText = init.statusText;
         this.data = init.data;
@@ -68,18 +68,18 @@ export function isNeonApiError(err) {
 }
 /** Extract a `message` string from a parsed error body, if present. */
 export function messageFromBody(body) {
-    if (body && typeof body === 'object' && 'message' in body) {
+    if (body && typeof body === "object" && "message" in body) {
         const message = body.message;
-        if (typeof message === 'string')
+        if (typeof message === "string")
             return message;
     }
     return undefined;
 }
 /** Extract a machine-readable `code` string from a parsed error body, if present. */
 export function codeFromBody(body) {
-    if (body && typeof body === 'object' && 'code' in body) {
+    if (body && typeof body === "object" && "code" in body) {
         const code = body.code;
-        if (typeof code === 'string')
+        if (typeof code === "string")
             return code;
     }
     return undefined;
@@ -113,7 +113,7 @@ function headersToObject(headers) {
 }
 function isAbortError(err) {
     return (err instanceof Error &&
-        (err.name === 'AbortError' || err.name === 'TimeoutError'));
+        (err.name === "AbortError" || err.name === "TimeoutError"));
 }
 /**
  * Walk an error's `cause` chain to find the underlying socket/DNS `code` (e.g.
@@ -124,9 +124,9 @@ function isAbortError(err) {
 function readSocketCode(err) {
     let current = err;
     for (let depth = 0; depth < 6 && current != null; depth++) {
-        if (typeof current === 'object' && 'code' in current) {
+        if (typeof current === "object" && "code" in current) {
             const code = current.code;
-            if (typeof code === 'string')
+            if (typeof code === "string")
                 return code;
         }
         current = current.cause;
@@ -160,10 +160,10 @@ function httpError(response, body) {
  */
 function networkError(err) {
     if (isAbortError(err)) {
-        return new NeonApiError('Request timed out', { code: 'ECONNABORTED' });
+        return new NeonApiError("Request timed out", { code: "ECONNABORTED" });
     }
     return new NeonApiError(err instanceof Error ? err.message : String(err), {
-        code: readSocketCode(err) ?? 'ENETWORK',
+        code: readSocketCode(err) ?? "ENETWORK",
     });
 }
 /**
@@ -176,11 +176,11 @@ const timedFetch = async (input, init) => {
     const signal = init?.signal
         ? AbortSignal.any([init.signal, timeout])
         : timeout;
-    const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+    const method = init?.method ?? (input instanceof Request ? input.method : "GET");
     const url = input instanceof Request ? input.url : String(input);
-    log.debug('%s %s', method.toUpperCase(), url);
+    log.debug("%s %s", method.toUpperCase(), url);
     const response = await fetch(input, { ...init, signal });
-    log.debug('%d %s', response.status, response.statusText);
+    log.debug("%d %s", response.status, response.statusText);
     return response;
 };
 const RETRY_COUNT = 5;
@@ -211,7 +211,7 @@ export const retryOnLock = async (fn) => {
     throw errOut;
 };
 function buildUrl(apiHost, path, query) {
-    const url = new URL(`${apiHost.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`);
+    const url = new URL(`${apiHost.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`);
     if (query) {
         for (const [key, value] of Object.entries(query)) {
             if (value === undefined || value === null)
@@ -223,7 +223,7 @@ function buildUrl(apiHost, path, query) {
 }
 async function readJsonBody(response) {
     const text = await response.text();
-    if (text.trim() === '')
+    if (text.trim() === "")
         return undefined;
     try {
         return JSON.parse(text);
@@ -241,7 +241,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
         auth: () => apiKey,
         baseUrl,
         fetch: timedFetch,
-        headers: { 'User-Agent': USER_AGENT },
+        headers: { "User-Agent": USER_AGENT },
     }));
     /** Await a raw call, unwrap to a `{ data, status, headers }` envelope, or throw {@link NeonApiError}. */
     async function call(run) {
@@ -254,7 +254,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
         }
         const response = result.response;
         if (!response) {
-            throw networkError(result.error ?? new Error('No response from Neon API'));
+            throw networkError(result.error ?? new Error("No response from Neon API"));
         }
         if (!response.ok) {
             throw httpError(response, result.error ?? result.data);
@@ -274,7 +274,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
      */
     async function request(params) {
         const url = buildUrl(baseUrl, params.path, params.query);
-        const headers = { 'User-Agent': USER_AGENT };
+        const headers = { "User-Agent": USER_AGENT };
         if (params.secure !== false) {
             headers.Authorization = `Bearer ${apiKey}`;
         }
@@ -284,7 +284,7 @@ export const getApiClient = ({ apiKey, apiHost }) => {
             payload = params.body;
         }
         else if (params.body !== undefined) {
-            headers['Content-Type'] = ContentType.Json;
+            headers["Content-Type"] = ContentType.Json;
             payload = JSON.stringify(params.body);
         }
         let response;
@@ -301,13 +301,13 @@ export const getApiClient = ({ apiKey, apiHost }) => {
         if (!response.ok) {
             // For a streamed download the error body arrives as a stream too; hand it
             // back as a Node `Readable` so the caller can drain it for a message.
-            const errorBody = params.format === 'stream' && response.body
+            const errorBody = params.format === "stream" && response.body
                 ? webStreamToNodeReadable(response.body)
                 : await readJsonBody(response);
             throw httpError(response, errorBody);
         }
         let data;
-        if (params.format === 'stream') {
+        if (params.format === "stream") {
             data = response.body
                 ? webStreamToNodeReadable(response.body)
                 : undefined;

package/dist/auth.js

@@ -1,58 +1,62 @@
-import * as client from 'openid-client';
-import { createServer } from 'node:http';
-import { createReadStream } from 'node:fs';
-import { join } from 'node:path';
-import open from 'open';
-import { log } from './log.js';
-import { fileURLToPath } from 'node:url';
-import { sendError } from './analytics.js';
-import { matchErrorCode } from './errors.js';
-import { extendTokenSet } from './utils/auth.js';
+import { createReadStream } from "node:fs";
+import { createServer, } from "node:http";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import open from "open";
+import * as client from "openid-client";
+import { sendError } from "./analytics.js";
+import { matchErrorCode } from "./errors.js";
+import { log } from "./log.js";
+import { extendTokenSet } from "./utils/auth.js";
 // oauth server timeouts
 const SERVER_TIMEOUT = 10000;
 // where to wait for incoming redirect request from oauth server to arrive
 const REDIRECT_URI = (port) => `http://127.0.0.1:${port}/callback`;
 // These scopes cannot be cancelled, they are always needed.
-const ALWAYS_PRESENT_SCOPES = ['openid', 'offline', 'offline_access'];
+const ALWAYS_PRESENT_SCOPES = ["openid", "offline", "offline_access"];
 const NEONCTL_SCOPES = [
     ...ALWAYS_PRESENT_SCOPES,
-    'urn:neoncloud:projects:create',
-    'urn:neoncloud:projects:read',
-    'urn:neoncloud:projects:update',
-    'urn:neoncloud:projects:delete',
-    'urn:neoncloud:orgs:create',
-    'urn:neoncloud:orgs:read',
-    'urn:neoncloud:orgs:update',
-    'urn:neoncloud:orgs:delete',
-    'urn:neoncloud:orgs:permission',
+    "urn:neoncloud:projects:create",
+    "urn:neoncloud:projects:read",
+    "urn:neoncloud:projects:update",
+    "urn:neoncloud:projects:delete",
+    "urn:neoncloud:orgs:create",
+    "urn:neoncloud:orgs:read",
+    "urn:neoncloud:orgs:update",
+    "urn:neoncloud:orgs:delete",
+    "urn:neoncloud:orgs:permission",
 ];
 const AUTH_TIMEOUT_SECONDS = 60;
-export const defaultClientID = 'neonctl';
+export const defaultClientID = "neonctl";
 export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-    log.debug('Discovering oauth server');
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: 'none' }, client.None(), {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
         timeout: SERVER_TIMEOUT,
-        // eslint-disable-next-line @typescript-eslint/no-deprecated
-        execute: allowUnsafeTls ? [client.allowInsecureRequests] : undefined,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
     });
     return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
 };
 export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
-    log.debug('Discovering oauth server');
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: 'none' }, client.None(), {
+    log.debug("Discovering oauth server");
+    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
         timeout: SERVER_TIMEOUT,
-        // eslint-disable-next-line @typescript-eslint/no-deprecated
-        execute: allowUnsafeTls ? [client.allowInsecureRequests] : undefined,
+        execute: allowUnsafeTls
+            ? // eslint-disable-next-line @typescript-eslint/no-deprecated
+                [client.allowInsecureRequests]
+            : undefined,
     });
     //
     // Start HTTP server and wait till /callback is hit
     //
-    log.debug('Starting HTTP Server for callback');
+    log.debug("Starting HTTP Server for callback");
     const server = createServer();
-    server.listen(0, '127.0.0.1', function () {
+    server.listen(0, "127.0.0.1", function () {
         log.debug(`Listening on port ${this.address().port}`);
     });
-    await new Promise((resolve) => server.once('listening', resolve));
+    await new Promise((resolve) => server.once("listening", resolve));
     const listen_port = server.address().port;
     // https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.8
     const state = client.randomState();
@@ -67,17 +71,17 @@ export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
             //
             // Wait for callback and follow oauth flow.
             //
-            if (!request.url?.startsWith('/callback')) {
+            if (!request.url?.startsWith("/callback")) {
                 response.writeHead(404);
                 response.end();
                 return;
             }
             // process the CORS preflight OPTIONS request
-            if (request.method === 'OPTIONS') {
+            if (request.method === "OPTIONS") {
                 response.writeHead(200, {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': 'GET, POST',
-                    'Access-Control-Allow-Headers': 'Content-Type',
+                    "Access-Control-Allow-Origin": "*",
+                    "Access-Control-Allow-Methods": "GET, POST",
+                    "Access-Control-Allow-Headers": "Content-Type",
                 });
                 response.end();
                 return;
@@ -87,29 +91,31 @@ export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
                 pkceCodeVerifier: codeVerifier,
                 expectedState: state,
             });
-            response.writeHead(200, { 'Content-Type': 'text/html' });
-            createReadStream(join(fileURLToPath(new URL('.', import.meta.url)), './callback.html')).pipe(response);
+            response.writeHead(200, { "Content-Type": "text/html" });
+            createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
             clearTimeout(timer);
             const exp = new Date();
             exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
             resolve(extendTokenSet(tokenSet));
             server.close();
         };
-        server.on('request', (req, res) => {
+        server.on("request", (req, res) => {
             void onRequest(req, res);
         });
         //
         // Open browser to let user authenticate
         //
-        const scopes = clientId == defaultClientID ? NEONCTL_SCOPES : ALWAYS_PRESENT_SCOPES;
+        const scopes = clientId == defaultClientID
+            ? NEONCTL_SCOPES
+            : ALWAYS_PRESENT_SCOPES;
         const authUrl = client.buildAuthorizationUrl(configuration, {
-            scope: scopes.join(' '),
+            scope: scopes.join(" "),
             state,
             code_challenge: codeChallenge,
-            code_challenge_method: 'S256',
+            code_challenge_method: "S256",
             redirect_uri: REDIRECT_URI(listen_port),
         });
-        log.info('Awaiting authentication in web browser.');
+        log.info("Awaiting authentication in web browser.");
         log.info(`Auth Url: ${authUrl}`);
         open(authUrl.href).catch((err) => {
             const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { tryCurrentBranchFastPath } from './current_branch_fast_path.js';
+import { tryCurrentBranchFastPath } from "./current_branch_fast_path.js";
 // Fast path for the offline `(config) status --current-branch` probe (used by shell
 // prompts): read the pinned branch from `.neon` without loading the full command tree,
 // api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
 // the heavy `index.js` is imported lazily and only when actually needed.
 if (!tryCurrentBranchFastPath(process.argv)) {
-    void import('./index.js');
+    void import("./index.js");
 }

package/dist/commands/auth.js

@@ -1,26 +1,26 @@
-import { existsSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { getApiClient } from '../api.js';
-import { auth, refreshToken } from '../auth.js';
-import { isCurrentBranchProbe } from '../context.js';
-import { CREDENTIALS_FILE } from '../config.js';
-import { isCi } from '../env.js';
-import { log } from '../log.js';
-import { extendTokenSet } from '../utils/auth.js';
-export const command = 'auth';
-export const aliases = ['login'];
-export const describe = 'Authenticate';
-export const builder = (yargs) => yargs.option('context-file', {
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getApiClient } from "../api.js";
+import { auth, refreshToken } from "../auth.js";
+import { CREDENTIALS_FILE } from "../config.js";
+import { isConfigInit, isCurrentBranchProbe } from "../context.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { extendTokenSet } from "../utils/auth.js";
+export const command = "auth";
+export const aliases = ["login"];
+export const describe = "Authenticate";
+export const builder = (yargs) => yargs.option("context-file", {
     hidden: true,
 });
 export const handler = async (args) => {
     await authFlow(args);
 };
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, 'force-auth': forceAuthKebab, allowUnsafeTls, }) => {
+export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
     const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
     if (!allowInteractiveAuth && isCi()) {
-        throw new Error('Cannot run interactive auth in CI');
+        throw new Error("Cannot run interactive auth in CI");
     }
     const tokenSet = await auth({
         oauthHost: oauthHost,
@@ -30,16 +30,16 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
     const credentialsPath = join(configDir, CREDENTIALS_FILE);
     try {
         await preserveCredentials(credentialsPath, tokenSet, getApiClient({
-            apiKey: tokenSet.access_token || '',
+            apiKey: tokenSet.access_token || "",
             apiHost,
         }));
     }
     catch {
-        log.error('Failed to save credentials');
-        return '';
+        log.error("Failed to save credentials");
+        return "";
     }
-    log.info('Auth complete');
-    return tokenSet.access_token || '';
+    log.info("Auth complete");
+    return tokenSet.access_token || "";
 };
 const preserveCredentials = async (path, credentials, apiClient) => {
     const { data: { id }, } = await apiClient.getCurrentUserInfo();
@@ -52,13 +52,13 @@ const preserveCredentials = async (path, credentials, apiClient) => {
     writeFileSync(path, contents, {
         mode: 0o700,
     });
-    log.debug('Saved credentials to %s', path);
-    log.debug('Credentials MD5 hash: %s', md5hash(contents));
+    log.debug("Saved credentials to %s", path);
+    log.debug("Credentials MD5 hash: %s", md5hash(contents));
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     // Use existing access_token, if present and valid
     if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
-        log.debug('Using existing valid access_token');
+        log.debug("Using existing valid access_token");
         const apiClient = getApiClient({
             apiKey: tokenSet.access_token,
             apiHost: props.apiHost,
@@ -67,10 +67,10 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     }
     // Either access_token is missing or its expired. Refresh the token
     log.debug(tokenSet.expires_at < Date.now()
-        ? 'Token is expired, attempting refresh'
-        : 'Token is missing access_token, attempting refresh');
+        ? "Token is expired, attempting refresh"
+        : "Token is missing access_token, attempting refresh");
     if (!tokenSet.refresh_token) {
-        log.debug('TokenSet is missing refresh_token, starting authentication');
+        log.debug("TokenSet is missing refresh_token, starting authentication");
         return null;
     }
     try {
@@ -87,13 +87,13 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
             apiHost: props.apiHost,
         });
         await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
-        log.debug('Token refresh successful');
+        log.debug("Token refresh successful");
         return { apiKey, apiClient };
     }
     catch (err) {
-        const typedErr = err instanceof Error ? err : new Error('Unknown error');
-        log.debug('Failed to refresh token: %s', typedErr.message);
-        throw new Error('AUTH_REFRESH_FAILED');
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.debug("Failed to refresh token: %s", typedErr.message);
+        throw new Error("AUTH_REFRESH_FAILED");
     }
 };
 export const ensureAuth = async (props) => {
@@ -107,23 +107,28 @@ export const ensureAuth = async (props) => {
     if (isCurrentBranchProbe(props)) {
         return;
     }
+    // `config init` only scaffolds a neon.ts and installs npm packages locally; it
+    // never calls the Neon API, so skip auth entirely — no token refresh, no login.
+    if (isConfigInit(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if
     // present, otherwise run with no API client (env injection is skipped).
-    const isLocalDev = props._[0] === 'dev';
+    const isLocalDev = props._[0] === "dev";
     // `bootstrap` only copies a public template repo; it never calls the Neon
     // API, so it must work without credentials and must never pop a browser
     // login. It uses an API key / stored credentials when present (harmless),
     // otherwise it proceeds with no API client.
-    const isBootstrap = props._[0] === 'bootstrap';
+    const isBootstrap = props._[0] === "bootstrap";
     // `init` manages its own auth flow (asks the user if they have an account,
     // then triggers OAuth at the right time). Skip the global auth middleware.
-    const isInit = props._[0] === 'init';
+    const isInit = props._[0] === "init";
     // Use existing API key or handle auth command
-    if (props.apiKey || props._[0] === 'auth') {
+    if (props.apiKey || props._[0] === "auth") {
         if (props.apiKey) {
-            log.debug('Using an API key to authorize requests');
+            log.debug("Using an API key to authorize requests");
         }
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
@@ -134,10 +139,10 @@ export const ensureAuth = async (props) => {
     const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
     // Handle case when credentials file exists
     if (existsSync(credentialsPath)) {
-        log.debug('Trying to read credentials from %s', credentialsPath);
+        log.debug("Trying to read credentials from %s", credentialsPath);
         try {
-            const contents = readFileSync(credentialsPath, 'utf8');
-            log.debug('Credentials MD5 hash: %s', md5hash(contents));
+            const contents = readFileSync(credentialsPath, "utf8");
+            log.debug("Credentials MD5 hash: %s", md5hash(contents));
             const tokenSet = JSON.parse(contents);
             // Try to use existing token or refresh it
             const result = await handleExistingToken(tokenSet, props, credentialsPath);
@@ -148,32 +153,33 @@ export const ensureAuth = async (props) => {
             }
         }
         catch (err) {
-            if (!(err instanceof Error && err.message === 'AUTH_REFRESH_FAILED') &&
-                err.code !== 'ENOENT' &&
+            if (!(err instanceof Error &&
+                err.message === "AUTH_REFRESH_FAILED") &&
+                err.code !== "ENOENT" &&
                 !(err instanceof SyntaxError)) {
                 // Throw for any errors except auth refresh failure, missing file, or invalid credentials file
                 throw err;
             }
             // Fall through to new auth flow for auth failures
-            log.debug('Ensure auth failed, starting authentication', err);
+            log.debug("Ensure auth failed, starting authentication", err);
         }
     }
     else {
-        log.debug('Credentials file %s does not exist, starting authentication', credentialsPath);
+        log.debug("Credentials file %s does not exist, starting authentication", credentialsPath);
     }
     // `dev` never launches the interactive browser flow. With no usable
     // credentials it proceeds without an API client; env injection is skipped
     // and the function still runs locally.
     if (isLocalDev) {
-        log.debug('dev: no usable credentials; running without env injection');
+        log.debug("dev: no usable credentials; running without env injection");
         return;
     }
     if (isBootstrap) {
-        log.debug('bootstrap: no usable credentials; continuing without auth');
+        log.debug("bootstrap: no usable credentials; continuing without auth");
         return;
     }
     if (isInit) {
-        log.debug('init: skipping global auth; init manages its own auth flow');
+        log.debug("init: skipping global auth; init manages its own auth flow");
         return;
     }
     // Start new auth flow if no valid token exists or refresh failed
@@ -193,16 +199,16 @@ export const deleteCredentials = (configDir) => {
     try {
         if (existsSync(credentialsPath)) {
             rmSync(credentialsPath);
-            log.info('Deleted credentials from %s', credentialsPath);
+            log.info("Deleted credentials from %s", credentialsPath);
         }
         else {
-            log.debug('Credentials file %s does not exist', credentialsPath);
+            log.debug("Credentials file %s does not exist", credentialsPath);
         }
     }
     catch (err) {
-        const typedErr = err instanceof Error ? err : new Error('Unknown error');
-        log.error('Failed to delete credentials: %s', typedErr.message);
-        throw new Error('CREDENTIALS_DELETE_FAILED');
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.error("Failed to delete credentials: %s", typedErr.message);
+        throw new Error("CREDENTIALS_DELETE_FAILED");
     }
 };
-const md5hash = (s) => createHash('md5').update(s).digest('hex');
+const md5hash = (s) => createHash("md5").update(s).digest("hex");