neonctl 2.28.0 → 2.29.1

package/dist/psql/wire/tls.js

@@ -27,11 +27,11 @@
  *     is the default and `servername` is set. The connection layer wires
  *     `servername` to the configured host before calling us.
  */
-import * as tls from 'node:tls';
-import { createHash, createPrivateKey } from 'node:crypto';
-import { promises as fs, appendFileSync } from 'node:fs';
-import * as path from 'node:path';
-import { SSLRequest } from './protocol.js';
+import { createHash, createPrivateKey } from "node:crypto";
+import { appendFileSync, promises as fs } from "node:fs";
+import * as path from "node:path";
+import * as tls from "node:tls";
+import { SSLRequest } from "./protocol.js";
 /**
  * Hash of the peer cert for `tls-server-end-point`. libpq always uses SHA-256
  * of the DER-encoded certificate; we match that.
@@ -43,9 +43,9 @@ export function computeChannelBindingData(cert) {
     // marks it as `Buffer | undefined` on some versions, hence the guard.
     const raw = cert.raw;
     if (!raw || raw.length === 0) {
-        throw new Error('TLS channel binding: peer certificate has no DER bytes');
+        throw new Error("TLS channel binding: peer certificate has no DER bytes");
     }
-    return createHash('sha256').update(raw).digest();
+    return createHash("sha256").update(raw).digest();
 }
 /**
  * Send SSLRequest, read the 1-byte server response, and either upgrade the
@@ -73,32 +73,32 @@ export function computeChannelBindingData(cert) {
  *     fallback, so a server that does not speak TLS surfaces the handshake
  *     failure rather than a quiet downgrade.
  */
-export async function negotiateTls(socket, sslMode, tlsOpts = {}, fileOpts = {}, negotiation = 'postgres') {
-    if (sslMode === 'disable') {
-        return { kind: 'plain', socket };
+export async function negotiateTls(socket, sslMode, tlsOpts = {}, fileOpts = {}, negotiation = "postgres") {
+    if (sslMode === "disable") {
+        return { kind: "plain", socket };
     }
     // Direct SSL (libpq `sslnegotiation=direct`, PG 17+): skip the `SSLRequest`
     // probe and start the TLS handshake straight away. The parse layer has
     // already rejected weak sslmodes, so this path is only reached with an
     // encrypted mode — never falling back to plaintext.
-    if (negotiation === 'direct') {
+    if (negotiation === "direct") {
         const mergedOpts = await loadTlsFileOptions(tlsOpts, fileOpts, sslMode);
         return upgradeToTls(socket, mergedOpts, fileOpts.sslkeylogfile, fileOpts.sslkey, 
         /* requireAlpn */ true);
     }
     const reply = await sendSslRequest(socket);
-    if (reply === 'S') {
+    if (reply === "S") {
         const mergedOpts = await loadTlsFileOptions(tlsOpts, fileOpts, sslMode);
         return upgradeToTls(socket, mergedOpts, fileOpts.sslkeylogfile, fileOpts.sslkey);
     }
     // reply === 'N': server refused TLS.
-    if (sslMode === 'require' ||
-        sslMode === 'verify-ca' ||
-        sslMode === 'verify-full') {
+    if (sslMode === "require" ||
+        sslMode === "verify-ca" ||
+        sslMode === "verify-full") {
         throw new Error(`SSL connection required (sslmode=${sslMode}) but server refused (replied 'N')`);
     }
     // 'allow' / 'prefer': fall back to plain text.
-    return { kind: 'plain', socket };
+    return { kind: "plain", socket };
 }
 /**
  * Read each non-empty file path in `fileOpts` and merge the bytes onto a
@@ -126,12 +126,12 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     // validate the chain. Mirror that so a stale / placeholder
     // `sslrootcert=` doesn't blow up sslmode=require connections.
     const needsRootCert = sslMode === undefined ||
-        sslMode === 'verify-ca' ||
-        sslMode === 'verify-full';
+        sslMode === "verify-ca" ||
+        sslMode === "verify-full";
     if (needsRootCert &&
         fileOpts.sslrootcert !== undefined &&
-        fileOpts.sslrootcert !== '') {
-        if (fileOpts.sslrootcert === 'system') {
+        fileOpts.sslrootcert !== "") {
+        if (fileOpts.sslrootcert === "system") {
             // `sslrootcert=system`: use the OS / OpenSSL trust store instead of a
             // file. libpq's OpenSSL build honours OpenSSL's $SSL_CERT_FILE (a single
             // bundle) and $SSL_CERT_DIR (a directory of hashed CA files); we read
@@ -140,11 +140,11 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
             // for verify-* modes) is left intact.
             const systemCas = [];
             const sslCertFile = process.env.SSL_CERT_FILE;
-            if (sslCertFile !== undefined && sslCertFile !== '') {
-                systemCas.push(await readPem('sslrootcert', sslCertFile, 'CERTIFICATE'));
+            if (sslCertFile !== undefined && sslCertFile !== "") {
+                systemCas.push(await readPem("sslrootcert", sslCertFile, "CERTIFICATE"));
             }
             const sslCertDir = process.env.SSL_CERT_DIR;
-            if (sslCertDir !== undefined && sslCertDir !== '') {
+            if (sslCertDir !== undefined && sslCertDir !== "") {
                 systemCas.push(...(await readCaDir(sslCertDir)));
             }
             if (systemCas.length === 1) {
@@ -155,7 +155,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
             }
         }
         else {
-            merged.ca = await readPem('sslrootcert', fileOpts.sslrootcert, 'CERTIFICATE');
+            merged.ca = await readPem("sslrootcert", fileOpts.sslrootcert, "CERTIFICATE");
         }
     }
     // libpq `sslcertmode` gates whether the client cert/key are sent.
@@ -163,30 +163,30 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     //   - `require`: a cert MUST be configured (we only honour an explicit
     //     `sslcert`, not libpq's default `~/.postgresql/postgresql.crt`).
     //   - `allow` / unset: current behaviour (send when present).
-    const certMode = fileOpts.sslcertmode ?? 'allow';
-    const clientCert = fileOpts.sslcert !== undefined && fileOpts.sslcert !== ''
+    const certMode = fileOpts.sslcertmode ?? "allow";
+    const clientCert = fileOpts.sslcert !== undefined && fileOpts.sslcert !== ""
         ? fileOpts.sslcert
         : undefined;
-    if (certMode === 'require' && clientCert === undefined) {
+    if (certMode === "require" && clientCert === undefined) {
         throw new Error(`sslcertmode value "require" requires a client certificate`);
     }
-    if (certMode !== 'disable') {
+    if (certMode !== "disable") {
         if (clientCert !== undefined) {
-            merged.cert = await readPem('sslcert', clientCert, 'CERTIFICATE');
+            merged.cert = await readPem("sslcert", clientCert, "CERTIFICATE");
         }
-        if (fileOpts.sslkey !== undefined && fileOpts.sslkey !== '') {
+        if (fileOpts.sslkey !== undefined && fileOpts.sslkey !== "") {
             await assertKeyPermissions(fileOpts.sslkey);
-            merged.key = await readPem('sslkey', fileOpts.sslkey, 'PRIVATE KEY');
+            merged.key = await readPem("sslkey", fileOpts.sslkey, "PRIVATE KEY");
         }
     }
     // CRLs come from a single file (`sslcrl`) and/or every file in a directory
     // (`sslcrldir`). Node's `crl` option accepts an array of PEM buffers, so we
     // collect each source and only set `crl` when at least one was read.
     const crls = [];
-    if (fileOpts.sslcrl !== undefined && fileOpts.sslcrl !== '') {
-        crls.push(await readPem('sslcrl', fileOpts.sslcrl));
+    if (fileOpts.sslcrl !== undefined && fileOpts.sslcrl !== "") {
+        crls.push(await readPem("sslcrl", fileOpts.sslcrl));
     }
-    if (fileOpts.sslcrldir !== undefined && fileOpts.sslcrldir !== '') {
+    if (fileOpts.sslcrldir !== undefined && fileOpts.sslcrldir !== "") {
         crls.push(...(await readCrlDir(fileOpts.sslcrldir)));
     }
     if (crls.length === 1) {
@@ -198,7 +198,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     // sslpassword is plumbed through verbatim — OpenSSL applies it when it
     // sees an encrypted key. Empty string is "no passphrase" (libpq's
     // convention) so we skip it.
-    if (fileOpts.sslpassword !== undefined && fileOpts.sslpassword !== '') {
+    if (fileOpts.sslpassword !== undefined && fileOpts.sslpassword !== "") {
         merged.passphrase = fileOpts.sslpassword;
     }
     // sslkeylogfile is not a tls.connect option; the keylog listener is wired
@@ -206,7 +206,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
     // by opening it for append, so an unwritable path fails fast at connect
     // time with `could not open sslkeylogfile "<path>": <reason>` rather than
     // silently dropping keys mid-handshake.
-    if (fileOpts.sslkeylogfile !== undefined && fileOpts.sslkeylogfile !== '') {
+    if (fileOpts.sslkeylogfile !== undefined && fileOpts.sslkeylogfile !== "") {
         await assertKeyLogFileWritable(fileOpts.sslkeylogfile);
     }
     return merged;
@@ -219,7 +219,7 @@ export async function loadTlsFileOptions(tlsOpts, fileOpts, sslMode) {
  */
 async function assertKeyLogFileWritable(filePath) {
     try {
-        const handle = await fs.open(filePath, 'a');
+        const handle = await fs.open(filePath, "a");
         await handle.close();
     }
     catch (err) {
@@ -232,19 +232,19 @@ function isPemArmored(bytes) {
     // A PEM file is ASCII text; scan a bounded prefix (skipping leading
     // whitespace libpq tolerates) for the armor marker. DER is binary and will
     // not contain this token at the front.
-    const head = bytes.subarray(0, 64).toString('latin1');
-    return head.includes('-----BEGIN');
+    const head = bytes.subarray(0, 64).toString("latin1");
+    return head.includes("-----BEGIN");
 }
 /**
  * Wrap raw DER bytes in the requested PEM armor: base64 the DER, split into
  * 64-char lines (the PEM convention), and bracket with the BEGIN/END markers.
  */
 function derToPem(der, armor) {
-    const b64 = der.toString('base64');
+    const b64 = der.toString("base64");
     const lines = b64.match(/.{1,64}/g) ?? [];
-    const body = lines.join('\n');
+    const body = lines.join("\n");
     const pem = `-----BEGIN ${armor}-----\n${body}\n-----END ${armor}-----\n`;
-    return Buffer.from(pem, 'ascii');
+    return Buffer.from(pem, "ascii");
 }
 /**
  * Convert a DER-encoded private key to canonical PKCS#8 PEM, the way libpq
@@ -258,11 +258,11 @@ function derToPem(der, armor) {
  */
 function derPrivateKeyToPem(der) {
     let lastErr;
-    for (const type of ['pkcs8', 'pkcs1', 'sec1']) {
+    for (const type of ["pkcs8", "pkcs1", "sec1"]) {
         try {
-            const key = createPrivateKey({ key: der, format: 'der', type });
-            const pem = key.export({ format: 'pem', type: 'pkcs8' });
-            return typeof pem === 'string' ? Buffer.from(pem, 'ascii') : pem;
+            const key = createPrivateKey({ key: der, format: "der", type });
+            const pem = key.export({ format: "pem", type: "pkcs8" });
+            return typeof pem === "string" ? Buffer.from(pem, "ascii") : pem;
         }
         catch (err) {
             lastErr = err;
@@ -291,7 +291,7 @@ async function readPem(label, filePath, derArmor) {
     if (derArmor !== undefined && !isPemArmored(bytes)) {
         // Private keys need format-aware decoding (PKCS#8 / PKCS#1 / SEC1);
         // certs are a single ASN.1 shape and wrap directly.
-        return derArmor === 'PRIVATE KEY'
+        return derArmor === "PRIVATE KEY"
             ? derPrivateKeyToPem(bytes)
             : derToPem(bytes, derArmor);
     }
@@ -310,7 +310,7 @@ async function readPem(label, filePath, derArmor) {
  * carry a private key here).
  */
 async function assertKeyPermissions(keyPath) {
-    if (process.platform === 'win32')
+    if (process.platform === "win32")
         return;
     let stat;
     try {
@@ -355,7 +355,7 @@ async function readCrlDir(dirPath) {
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
-        out.push(await readPem('sslcrldir', path.join(dirPath, entry.name)));
+        out.push(await readPem("sslcrldir", path.join(dirPath, entry.name)));
     }
     return out;
 }
@@ -381,7 +381,7 @@ export async function readCaDir(dirPath) {
     for (const entry of entries) {
         if (!entry.isFile())
             continue;
-        out.push(await readPem('SSL_CERT_DIR', path.join(dirPath, entry.name), 'CERTIFICATE'));
+        out.push(await readPem("SSL_CERT_DIR", path.join(dirPath, entry.name), "CERTIFICATE"));
     }
     return out;
 }
@@ -403,7 +403,7 @@ export function sendSslRequest(socket) {
             if (chunk.length === 0)
                 return;
             const first = String.fromCharCode(chunk[0]);
-            if (first !== 'S' && first !== 'N') {
+            if (first !== "S" && first !== "N") {
                 cleanup();
                 reject(new Error(`Unexpected SSLRequest response byte 0x${chunk[0].toString(16)}`));
                 return;
@@ -416,11 +416,11 @@ export function sendSslRequest(socket) {
             resolve(first);
         };
         const cleanup = () => {
-            socket.removeListener('data', onData);
-            socket.removeListener('error', onError);
+            socket.removeListener("data", onData);
+            socket.removeListener("error", onError);
         };
-        socket.on('data', onData);
-        socket.on('error', onError);
+        socket.on("data", onData);
+        socket.on("error", onError);
         socket.write(SSLRequest());
     });
 }
@@ -455,16 +455,16 @@ export function mapTlsHandshakeError(err, servername, keyPath) {
     // Encrypted client-key decrypt failure (wrong / missing `sslpassword`).
     // OpenSSL throws this synchronously out of `tls.connect`; reshape it to
     // libpq's `could not load private key file "<path>": ... bad decrypt`.
-    if (code === 'ERR_OSSL_BAD_DECRYPT' || /bad decrypt/i.test(msg)) {
-        const where = keyPath !== undefined && keyPath !== ''
+    if (code === "ERR_OSSL_BAD_DECRYPT" || /bad decrypt/i.test(msg)) {
+        const where = keyPath !== undefined && keyPath !== ""
             ? `private key file "${keyPath}"`
-            : 'private key file';
+            : "private key file";
         const mapped = new Error(`could not load ${where}: ${msg}`);
         mapped.cause = err;
         return mapped;
     }
-    if (code === 'ERR_TLS_CERT_ALTNAME_INVALID') {
-        const host = servername ?? '';
+    if (code === "ERR_TLS_CERT_ALTNAME_INVALID") {
+        const host = servername ?? "";
         const mapped = new Error(`server certificate for "${host}" does not match host name "${host}"`);
         mapped.cause = err;
         return mapped;
@@ -474,10 +474,10 @@ export function mapTlsHandshakeError(err, servername, keyPath) {
     // `SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED`, etc. libpq collapses
     // them all to `certificate verify failed`.
     const isVerifyFailure = code !== undefined &&
-        code !== 'ERR_TLS_CERT_ALTNAME_INVALID' &&
+        code !== "ERR_TLS_CERT_ALTNAME_INVALID" &&
         /CERT|SIGNATURE|SELF_SIGNED|UNABLE_TO|CHAIN|EXPIRED|NOT_YET_VALID|INVALID_CA/.test(code);
     if (isVerifyFailure || /certificate verify failed/i.test(msg)) {
-        const mapped = new Error('certificate verify failed');
+        const mapped = new Error("certificate verify failed");
         mapped.cause = err;
         return mapped;
     }
@@ -485,7 +485,7 @@ export function mapTlsHandshakeError(err, servername, keyPath) {
 }
 /** Pull the SNI `servername` from the TLS options for error messages. */
 function getServername(tlsOpts) {
-    return typeof tlsOpts.servername === 'string'
+    return typeof tlsOpts.servername === "string"
         ? tlsOpts.servername
         : undefined;
 }
@@ -498,7 +498,7 @@ requireAlpn = false) {
     return new Promise((resolve, reject) => {
         let tlsSocket;
         const cleanup = () => {
-            tlsSocket?.removeListener('error', onError);
+            tlsSocket?.removeListener("error", onError);
         };
         const onError = (err) => {
             cleanup();
@@ -523,10 +523,11 @@ requireAlpn = false) {
                 // Enforce the mandatory `postgresql` ALPN for direct SSL. Without
                 // it a TLS terminator / HTTPS proxy with a valid host cert would be
                 // accepted and the startup packet sent in the blind (review #9).
-                if (requireAlpn && established.alpnProtocol !== 'postgresql') {
+                if (requireAlpn &&
+                    established.alpnProtocol !== "postgresql") {
                     cleanup();
                     established.destroy();
-                    reject(new Error('direct SSL connection requires ALPN, but the server did ' +
+                    reject(new Error("direct SSL connection requires ALPN, but the server did " +
                         'not negotiate the "postgresql" protocol'));
                     return;
                 }
@@ -538,7 +539,7 @@ requireAlpn = false) {
                     // `getPeerCertificate(true)` for compatibility.
                     const x509 = established.getPeerX509Certificate?.();
                     if (x509?.raw && x509.raw.length > 0) {
-                        channelBindingData = createHash('sha256')
+                        channelBindingData = createHash("sha256")
                             .update(x509.raw)
                             .digest();
                     }
@@ -549,7 +550,8 @@ requireAlpn = false) {
                         // accept that channel binding is unavailable.
                         const peerCert = established.getPeerCertificate(true);
                         if (peerCert?.raw && peerCert.raw.length > 0) {
-                            channelBindingData = computeChannelBindingData(peerCert);
+                            channelBindingData =
+                                computeChannelBindingData(peerCert);
                         }
                     }
                 }
@@ -558,18 +560,22 @@ requireAlpn = false) {
                     // path will fall back to SCRAM-SHA-256 (non-PLUS).
                     channelBindingData = null;
                 }
-                resolve({ kind: 'tls', socket: established, channelBindingData });
+                resolve({
+                    kind: "tls",
+                    socket: established,
+                    channelBindingData,
+                });
             });
         }
         catch (err) {
             reject(mapTlsHandshakeError(err instanceof Error ? err : new Error(String(err)), getServername(tlsOpts), keyPath));
             return;
         }
-        tlsSocket.on('error', onError);
+        tlsSocket.on("error", onError);
         // libpq `sslkeylogfile`: append each emitted key-log line so the
         // handshake can be decrypted offline. The path was pre-checked for
         // writability in loadTlsFileOptions.
-        if (sslkeylogfile !== undefined && sslkeylogfile !== '') {
+        if (sslkeylogfile !== undefined && sslkeylogfile !== "") {
             attachKeyLogListener(tlsSocket, sslkeylogfile);
         }
     });
@@ -585,12 +591,12 @@ requireAlpn = false) {
  * fake socket without a real TLS handshake. Exported for tests.
  */
 export function attachKeyLogListener(socket, filePath) {
-    socket.on('keylog', (line) => {
+    socket.on("keylog", (line) => {
         try {
             appendFileSync(filePath, line);
         }
         catch (err) {
-            socket.emit('error', err instanceof Error ? err : new Error(String(err)));
+            socket.emit("error", err instanceof Error ? err : new Error(String(err)));
         }
     });
 }

package/dist/storage_api.js

@@ -23,9 +23,9 @@ export const createProjectBranchBucket = (apiClient, { projectId, branchId, name
     }
     return apiClient.request({
         path: bucketsPath(projectId, branchId),
-        method: 'POST',
+        method: "POST",
         body,
-        format: 'json',
+        format: "json",
         secure: true,
     });
 };
@@ -36,8 +36,8 @@ export const createProjectBranchBucket = (apiClient, { projectId, branchId, name
  */
 export const listProjectBranchBuckets = (apiClient, { projectId, branchId }) => apiClient.request({
     path: bucketsPath(projectId, branchId),
-    method: 'GET',
-    format: 'json',
+    method: "GET",
+    format: "json",
     secure: true,
 });
 /**
@@ -47,7 +47,7 @@ export const listProjectBranchBuckets = (apiClient, { projectId, branchId }) =>
  */
 export const deleteProjectBranchBucket = (apiClient, { projectId, branchId, bucketName, }) => apiClient.request({
     path: bucketPath(projectId, branchId, bucketName),
-    method: 'DELETE',
+    method: "DELETE",
     secure: true,
 });
 /**
@@ -57,9 +57,9 @@ export const deleteProjectBranchBucket = (apiClient, { projectId, branchId, buck
  */
 export const listProjectBranchBucketObjects = (apiClient, { projectId, branchId, bucketName, ...query }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects`,
-    method: 'GET',
+    method: "GET",
     query,
-    format: 'json',
+    format: "json",
     secure: true,
 });
 /**
@@ -79,8 +79,8 @@ export const listProjectBranchBucketObjects = (apiClient, { projectId, branchId,
  */
 export const getProjectBranchBucketObject = (apiClient, { projectId, branchId, bucketName, objectKey, }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects/${encodeURIComponent(objectKey)}/download`,
-    method: 'GET',
-    format: 'stream',
+    method: "GET",
+    format: "stream",
     secure: true,
 });
 /**
@@ -93,7 +93,7 @@ export const getProjectBranchBucketObject = (apiClient, { projectId, branchId, b
  */
 export const deleteProjectBranchBucketObject = (apiClient, { projectId, branchId, bucketName, objectKey, }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects/${encodeURIComponent(objectKey)}`,
-    method: 'DELETE',
+    method: "DELETE",
     secure: true,
 });
 /**
@@ -106,9 +106,9 @@ export const deleteProjectBranchBucketObject = (apiClient, { projectId, branchId
  */
 export const deleteProjectBranchBucketObjectsByPrefix = (apiClient, { projectId, branchId, bucketName, prefix, }) => apiClient.request({
     path: `${bucketPath(projectId, branchId, bucketName)}/objects-by-prefix`,
-    method: 'DELETE',
+    method: "DELETE",
     query: { prefix },
-    format: 'json',
+    format: "json",
     secure: true,
 });
 /**
@@ -130,7 +130,7 @@ export const deleteProjectBranchBucketObjectsByPrefix = (apiClient, { projectId,
  * @request POST /projects/{project_id}/branches/{branch_id}/buckets/{bucket_name}/objects/{object_key}/presign
  */
 export const presignUpload = (apiClient, { projectId, branchId, bucketName, objectKey, contentType, expiresInSeconds, }) => {
-    const body = { operation: 'upload' };
+    const body = { operation: "upload" };
     if (contentType !== undefined) {
         body.content_type = contentType;
     }
@@ -139,9 +139,9 @@ export const presignUpload = (apiClient, { projectId, branchId, bucketName, obje
     }
     return apiClient.request({
         path: `${bucketPath(projectId, branchId, bucketName)}/objects/${encodeURIComponent(objectKey)}/presign`,
-        method: 'POST',
+        method: "POST",
         body,
-        format: 'json',
+        format: "json",
         secure: true,
     });
 };

package/dist/test_utils/fixtures.js

@@ -1,11 +1,11 @@
-import { createServer } from 'node:http';
-import { fork } from 'node:child_process';
-import { join } from 'node:path';
-import { expect, test as originalTest } from 'vitest';
-import strip from 'strip-ansi';
-import emocks from 'emocks';
-import express from 'express';
-import { log } from '../log';
+import { fork } from "node:child_process";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import emocks from "emocks";
+import express from "express";
+import strip from "strip-ansi";
+import { expect, test as originalTest } from "vitest";
+import { log } from "../log";
 /**
  * Reserve a localhost port and close its listener, returning a URL that is guaranteed to
  * refuse connections right now. Lets a test drive the CLI into a real `ECONNREFUSED`
@@ -13,8 +13,8 @@ import { log } from '../log';
  */
 const reserveClosedPort = () => new Promise((resolve, reject) => {
     const probe = createServer();
-    probe.on('error', reject);
-    probe.listen(0, '127.0.0.1', () => {
+    probe.on("error", reject);
+    probe.listen(0, "127.0.0.1", () => {
         const { port } = probe.address();
         probe.close((err) => {
             if (err) {
@@ -33,12 +33,12 @@ export const test = originalTest.extend({
         await use(async (mockDir) => {
             const app = express();
             app.use(express.json());
-            app.use('/', emocks(join(process.cwd(), 'mocks', mockDir), {
-                '404': (_req, res) => res.status(404).send({ message: 'Not Found' }),
+            app.use("/", emocks(join(process.cwd(), "mocks", mockDir), {
+                "404": (_req, res) => res.status(404).send({ message: "Not Found" }),
             }));
             const server = await new Promise((resolve) => {
                 const s = app.listen(0, () => {
-                    log.debug('Mock server listening at %d', s.address().port);
+                    log.debug("Mock server listening at %d", s.address().port);
                     resolve(s);
                 });
             });
@@ -64,44 +64,47 @@ export const test = originalTest.extend({
         await use(async (args, options = {}) => {
             const apiHost = options.unreachableHost
                 ? await reserveClosedPort()
-                : `http://localhost:${(await runMockServer(options.mockDir || 'main')).address().port}`;
-            let output = '';
-            let error = '';
-            const cp = fork(join(process.cwd(), './dist/index.js'), [
-                '--api-host',
+                : `http://localhost:${(await runMockServer(options.mockDir || "main")).address().port}`;
+            let output = "";
+            let error = "";
+            const cp = fork(join(process.cwd(), "./dist/index.js"), [
+                "--api-host",
                 apiHost,
-                '--output',
-                options.output ?? (options.outputTable ? 'table' : 'yaml'),
-                '--api-key',
-                'test-key',
-                '--no-analytics',
+                "--output",
+                options.output ?? (options.outputTable ? "table" : "yaml"),
+                "--api-key",
+                "test-key",
+                "--no-analytics",
                 ...args,
             ], {
-                stdio: 'pipe',
+                stdio: "pipe",
+                ...(options.cwd ? { cwd: options.cwd } : {}),
                 env: {
-                    PATH: `mocks/bin:${process.env.PATH}`,
+                    PATH: `${join(process.cwd(), "mocks/bin")}:${process.env.PATH}`,
                     ...(options.env ?? {}),
                 },
             });
             return new Promise((resolve, reject) => {
-                cp.stdout?.on('data', (data) => {
+                cp.stdout?.on("data", (data) => {
                     output += data.toString();
                 });
-                cp.stderr?.on('data', (data) => {
+                cp.stderr?.on("data", (data) => {
                     error += data.toString();
                     log.error(data.toString());
                 });
-                cp.on('error', (err) => {
+                cp.on("error", (err) => {
                     log.error(err);
                     throw err;
                 });
-                cp.on('close', (code) => {
+                cp.on("close", (code) => {
                     try {
                         expect(code).toBe(options?.code ?? 0);
                         expect(output).toMatchSnapshot();
                         if (options.stderr !== undefined) {
-                            expect(strip(error).replace(/\s+/g, ' ').trim()).toEqual(typeof options.stderr === 'string'
-                                ? options.stderr.toString().replace(/\s+/g, ' ')
+                            expect(strip(error).replace(/\s+/g, " ").trim()).toEqual(typeof options.stderr === "string"
+                                ? options.stderr
+                                    .toString()
+                                    .replace(/\s+/g, " ")
                                 : options.stderr);
                         }
                         resolve();

package/dist/test_utils/oauth_server.js

@@ -1,9 +1,9 @@
-import { log } from '../log';
-import { OAuth2Server } from 'oauth2-mock-server';
+import { OAuth2Server } from "oauth2-mock-server";
+import { log } from "../log";
 export const startOauthServer = async () => {
     const server = new OAuth2Server();
-    await server.issuer.keys.generate('RS256');
-    await server.start(0, 'localhost');
-    log.debug('Started OAuth server on port %d', server.address().port);
+    await server.issuer.keys.generate("RS256");
+    await server.start(0, "localhost");
+    log.debug("Started OAuth server on port %d", server.address().port);
     return server;
 };