neonctl 2.37.1 → 2.38.1

package/dist/auth.js

@@ -1,125 +0,0 @@
-import { createReadStream } from "node:fs";
-import { createServer, } from "node:http";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import open from "open";
-import * as client from "openid-client";
-import { sendError } from "./analytics.js";
-import { matchErrorCode } from "./errors.js";
-import { log } from "./log.js";
-import { extendTokenSet } from "./utils/auth.js";
-// oauth server timeouts
-const SERVER_TIMEOUT = 10000;
-// where to wait for incoming redirect request from oauth server to arrive
-const REDIRECT_URI = (port) => `http://127.0.0.1:${port}/callback`;
-// These scopes cannot be cancelled, they are always needed.
-const ALWAYS_PRESENT_SCOPES = ["openid", "offline", "offline_access"];
-const NEONCTL_SCOPES = [
-    ...ALWAYS_PRESENT_SCOPES,
-    "urn:neoncloud:projects:create",
-    "urn:neoncloud:projects:read",
-    "urn:neoncloud:projects:update",
-    "urn:neoncloud:projects:delete",
-    "urn:neoncloud:orgs:create",
-    "urn:neoncloud:orgs:read",
-    "urn:neoncloud:orgs:update",
-    "urn:neoncloud:orgs:delete",
-    "urn:neoncloud:orgs:permission",
-];
-const AUTH_TIMEOUT_SECONDS = 60;
-export const defaultClientID = "neonctl";
-export const refreshToken = async ({ oauthHost, clientId, allowUnsafeTls }, tokenSet) => {
-    log.debug("Discovering oauth server");
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-        timeout: SERVER_TIMEOUT,
-        execute: allowUnsafeTls
-            ? [client.allowInsecureRequests]
-            : undefined,
-    });
-    return await client.refreshTokenGrant(configuration, tokenSet.refresh_token);
-};
-export const auth = async ({ oauthHost, clientId, allowUnsafeTls, }) => {
-    log.debug("Discovering oauth server");
-    const configuration = await client.discovery(new URL(oauthHost), clientId, { token_endpoint_auth_method: "none" }, client.None(), {
-        timeout: SERVER_TIMEOUT,
-        execute: allowUnsafeTls
-            ? [client.allowInsecureRequests]
-            : undefined,
-    });
-    //
-    // Start HTTP server and wait till /callback is hit
-    //
-    log.debug("Starting HTTP Server for callback");
-    const server = createServer();
-    server.listen(0, "127.0.0.1", function () {
-        log.debug(`Listening on port ${this.address().port}`);
-    });
-    await new Promise((resolve) => server.once("listening", resolve));
-    const listen_port = server.address().port;
-    // https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.1.8
-    const state = client.randomState();
-    // we store the code_verifier in memory
-    const codeVerifier = client.randomPKCECodeVerifier();
-    const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            reject(new Error(`Authentication timed out after ${AUTH_TIMEOUT_SECONDS} seconds`));
-        }, AUTH_TIMEOUT_SECONDS * 1000);
-        const onRequest = async (request, response) => {
-            //
-            // Wait for callback and follow oauth flow.
-            //
-            if (!request.url?.startsWith("/callback")) {
-                response.writeHead(404);
-                response.end();
-                return;
-            }
-            // process the CORS preflight OPTIONS request
-            if (request.method === "OPTIONS") {
-                response.writeHead(200, {
-                    "Access-Control-Allow-Origin": "*",
-                    "Access-Control-Allow-Methods": "GET, POST",
-                    "Access-Control-Allow-Headers": "Content-Type",
-                });
-                response.end();
-                return;
-            }
-            log.debug(`Callback received: ${request.url}`);
-            const tokenSet = await client.authorizationCodeGrant(configuration, new URL(request.url, `http://127.0.0.1:${listen_port}`), {
-                pkceCodeVerifier: codeVerifier,
-                expectedState: state,
-            });
-            response.writeHead(200, { "Content-Type": "text/html" });
-            createReadStream(join(fileURLToPath(new URL(".", import.meta.url)), "./callback.html")).pipe(response);
-            clearTimeout(timer);
-            const exp = new Date();
-            exp.setSeconds(exp.getSeconds() + (tokenSet.expires_in ?? 0));
-            resolve(extendTokenSet(tokenSet));
-            server.close();
-        };
-        server.on("request", (req, res) => {
-            void onRequest(req, res);
-        });
-        //
-        // Open browser to let user authenticate
-        //
-        const scopes = clientId == defaultClientID
-            ? NEONCTL_SCOPES
-            : ALWAYS_PRESENT_SCOPES;
-        const authUrl = client.buildAuthorizationUrl(configuration, {
-            scope: scopes.join(" "),
-            state,
-            code_challenge: codeChallenge,
-            code_challenge_method: "S256",
-            redirect_uri: REDIRECT_URI(listen_port),
-        });
-        log.info("Awaiting authentication in web browser.");
-        log.info(`Auth Url: ${authUrl}`);
-        open(authUrl.href).catch((err) => {
-            const msg = `Failed to open web browser. Please copy & paste auth url to authenticate in browser.`;
-            const typedErr = err && err instanceof Error ? err : undefined;
-            sendError(typedErr || new Error(msg), matchErrorCode(msg));
-            log.error(msg);
-        });
-    });
-};

package/dist/callback.html

@@ -1,60 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <title>Neon</title>
-    <style>
-      body,
-      html {
-        width: 100%;
-        height: 100%;
-        margin: 0;
-        text-align: center;
-        font-family: 'Open Sans', sans-serif;
-        display: flex;
-        flex-direction: column;
-        justify-content: center;
-        align-items: center;
-        background-color: #ffffff;
-        color: #2d374c;
-      }
-      @media (prefers-color-scheme: dark) {
-        body,
-        html {
-          background-color: #191919;
-          color: #bfbfbf;
-        }
-      }
-      .logo {
-        display: inline-block;
-        width: 100px;
-        height: 100px;
-        margin: 0 auto;
-      }
-      .logo svg path {
-        fill: #37c38f;
-      }
-      @media (prefers-color-scheme: dark) {
-        .logo svg path {
-          fill: #34d59a;
-        }
-      }
-    </style>
-  </head>
-  <body>
-    <div class="logo">
-      <svg
-        viewBox="0 0 64 64"
-        fill="none"
-        xmlns="http://www.w3.org/2000/svg"
-        aria-hidden="true"
-      >
-        <path
-          d="M63 0.0177909V63.5526L38.4178 42.2501V63.5526H0V0L63 0.0177909ZM7.72251 55.8389H30.6953V25.3238L55.2779 47.0476V7.72922L7.72251 7.71559V55.8389Z"
-        />
-      </svg>
-    </div>
-    <h1>Thank you for using Neon</h1>
-    <p>You may close this page now</p>
-  </body>
-</html>

package/dist/cli.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import { tryCurrentBranchFastPath } from "./current_branch_fast_path.js";
-// Fast path for the offline `(config) status --current-branch` probe (used by shell
-// prompts): read the pinned branch from `.neon` without loading the full command tree,
-// api-client, and yargs (~200ms). Falls through to the full CLI for everything else, so
-// the heavy `index.js` is imported lazily and only when actually needed.
-if (!tryCurrentBranchFastPath(process.argv)) {
-    void import("./index.js");
-}

package/dist/commands/api.js

@@ -1,278 +0,0 @@
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import YAML from "yaml";
-import { DEFAULT_SPEC_URL, getEndpoints, loadSpec } from "../utils/openapi.js";
-import { writer } from "../writer.js";
-const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
-// ── Pure helpers (unit-tested) ───────────────────────────────────────────────
-/**
- * Coerce a raw string into a typed JSON value: booleans, `null`, integers,
- * floats, and JSON arrays/objects are parsed; everything else stays a string.
- */
-export function parseTypedValue(raw) {
-    if (raw === "true")
-        return true;
-    if (raw === "false")
-        return false;
-    if (raw === "null")
-        return null;
-    if (/^-?\d+$/.test(raw))
-        return Number.parseInt(raw, 10);
-    if (/^-?\d*\.\d+$/.test(raw))
-        return Number.parseFloat(raw);
-    if (raw.startsWith("[") || raw.startsWith("{")) {
-        try {
-            return JSON.parse(raw);
-        }
-        catch {
-            return raw;
-        }
-    }
-    return raw;
-}
-/** Split a `key=value` pair on the first `=`. */
-export function parseKeyValue(input) {
-    const eq = input.indexOf("=");
-    if (eq === -1) {
-        throw new Error(`Invalid "key=value" pair: "${input}".`);
-    }
-    return { key: input.slice(0, eq), value: input.slice(eq + 1) };
-}
-/**
- * Assign `value` into `target` at a dot-delimited path, creating intermediate
- * objects as needed. Enables `-F branch.name=dev` → `{ branch: { name: "dev" } }`,
- * matching the nested shape of Neon request bodies.
- */
-export function setDeep(target, dottedKey, value) {
-    const parts = dottedKey.split(".");
-    let node = target;
-    for (let i = 0; i < parts.length - 1; i++) {
-        const part = parts[i];
-        const next = node[part];
-        if (typeof next !== "object" || next === null || Array.isArray(next)) {
-            node[part] = {};
-        }
-        node = node[part];
-    }
-    node[parts[parts.length - 1]] = value;
-}
-/** Build a JSON body object from typed `-F` and string `-f` field pairs. */
-export function buildBody(fields, rawFields) {
-    const body = {};
-    for (const field of fields) {
-        const { key, value } = parseKeyValue(field);
-        setDeep(body, key, parseTypedValue(value));
-    }
-    for (const field of rawFields) {
-        const { key, value } = parseKeyValue(field);
-        setDeep(body, key, value);
-    }
-    return body;
-}
-/** Build a query-string map from `-Q key=value` pairs. */
-export function buildQuery(pairs) {
-    const query = {};
-    for (const pair of pairs) {
-        const { key, value } = parseKeyValue(pair);
-        query[key] = value;
-    }
-    return query;
-}
-/** Build a header map from `-H key:value` pairs. */
-export function parseHeaders(pairs) {
-    const headers = {};
-    for (const pair of pairs) {
-        const idx = pair.indexOf(":");
-        if (idx === -1) {
-            throw new Error(`Invalid header "${pair}". Expected "key:value".`);
-        }
-        headers[pair.slice(0, idx).trim()] = pair.slice(idx + 1).trim();
-    }
-    return headers;
-}
-function assertMethod(method) {
-    if (!HTTP_METHODS.includes(method)) {
-        throw new Error(`Unsupported method "${method}". Use one of: ${HTTP_METHODS.join(", ")}.`);
-    }
-}
-// ── I/O helpers ──────────────────────────────────────────────────────────────
-async function readStdin() {
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        chunks.push(Buffer.from(chunk));
-    }
-    return Buffer.concat(chunks).toString("utf8");
-}
-/** Resolve `--data`: `-` reads stdin, `@file` reads a file, else the literal string. Parsed as JSON when possible. */
-async function readData(data) {
-    let raw;
-    if (data === "-") {
-        raw = await readStdin();
-    }
-    else if (data.startsWith("@")) {
-        raw = readFileSync(resolve(data.slice(1)), "utf8");
-    }
-    else {
-        raw = data;
-    }
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return raw;
-    }
-}
-const toStrings = (values) => (values ?? []).map(String);
-async function listEndpoints(args) {
-    const spec = await loadSpec({
-        configDir: args.configDir,
-        specUrl: args.specUrl,
-        refresh: args.refresh,
-    });
-    if (!spec) {
-        throw new Error(`Could not load the Neon OpenAPI spec from ${args.specUrl}. ` +
-            "Check your network connection or pass --spec-url.");
-    }
-    const endpoints = getEndpoints(spec).map((endpoint) => ({
-        method: endpoint.method,
-        path: endpoint.path,
-        summary: endpoint.summary ?? "",
-    }));
-    writer(args).end(endpoints, {
-        fields: ["method", "path", "summary"],
-        title: `Neon API endpoints (${endpoints.length})`,
-        emptyMessage: "No endpoints found in the spec.",
-    });
-}
-async function runRequest(args) {
-    const path = args.path;
-    if (!path) {
-        throw new Error("Missing API path. Usage: neon api <path> (e.g. neon api /projects). " +
-            "Run `neon api --list` to see available routes.");
-    }
-    if (!path.startsWith("/")) {
-        throw new Error(`Invalid path "${path}". API paths must start with "/". ` +
-            "Run `neon api --list` to see available routes.");
-    }
-    const fields = toStrings(args.field);
-    const rawFields = toStrings(args.rawField);
-    let body;
-    if (args.data !== undefined) {
-        body = await readData(args.data);
-    }
-    else if (fields.length > 0 || rawFields.length > 0) {
-        body = buildBody(fields, rawFields);
-    }
-    const hasBody = body !== undefined;
-    const method = String(args.method ?? (hasBody ? "POST" : "GET")).toUpperCase();
-    assertMethod(method);
-    const query = buildQuery(toStrings(args.query));
-    const headers = parseHeaders(toStrings(args.header));
-    const params = {
-        path,
-        method,
-        ...(Object.keys(query).length > 0 ? { query } : {}),
-        ...(hasBody ? { body } : {}),
-        ...(Object.keys(headers).length > 0 ? { headers } : {}),
-    };
-    const response = await args.apiClient.request(params);
-    const out = process.stdout;
-    if (args.include) {
-        out.write(`HTTP ${response.status} ${response.statusText}\n`);
-        for (const [key, value] of Object.entries(response.headers)) {
-            out.write(`${key}: ${value}\n`);
-        }
-        out.write("\n");
-    }
-    if (response.data === undefined) {
-        return;
-    }
-    if (args.output === "yaml") {
-        out.write(YAML.stringify(response.data));
-    }
-    else {
-        out.write(`${JSON.stringify(response.data, null, 2)}\n`);
-    }
-}
-export const command = "api [path]";
-export const describe = "Call any Neon API route directly (authenticated passthrough)";
-export const builder = (argv) => argv
-    .usage("$0 api <path> [options]")
-    .positional("path", {
-    type: "string",
-    describe: 'API path beginning with "/" (e.g. /projects or ' +
-        "/projects/{project_id}/branches). Use `list` to list endpoints.",
-})
-    .options({
-    method: {
-        alias: "X",
-        type: "string",
-        describe: "HTTP method (GET, POST, PUT, PATCH, DELETE). " +
-            "Defaults to GET, or POST when a body is provided.",
-    },
-    field: {
-        alias: "F",
-        type: "array",
-        string: true,
-        describe: "Body field key=value (repeatable). Dot-notation nests " +
-            "objects (e.g. -F branch.name=dev); values are typed " +
-            "(numbers, booleans, null, JSON).",
-    },
-    "raw-field": {
-        alias: "f",
-        type: "array",
-        string: true,
-        describe: "Body field key=value with the value kept as a raw string.",
-    },
-    data: {
-        alias: "d",
-        type: "string",
-        describe: "Raw request body: a JSON string, @file, or - for stdin. " +
-            "Overrides --field.",
-    },
-    query: {
-        alias: "Q",
-        type: "array",
-        string: true,
-        describe: "Query parameter key=value (repeatable).",
-    },
-    header: {
-        alias: "H",
-        type: "array",
-        string: true,
-        describe: "Extra request header key:value (repeatable).",
-    },
-    include: {
-        alias: "i",
-        type: "boolean",
-        default: false,
-        describe: "Print the response status and headers before the body.",
-    },
-    list: {
-        type: "boolean",
-        default: false,
-        describe: "List available API endpoints from the OpenAPI spec.",
-    },
-    refresh: {
-        type: "boolean",
-        default: false,
-        describe: "Refresh the cached OpenAPI spec (used with --list).",
-    },
-    "spec-url": {
-        type: "string",
-        default: process.env.NEON_API_SPEC_URL ?? DEFAULT_SPEC_URL,
-        hidden: true,
-        describe: "OpenAPI spec URL used by --list.",
-    },
-})
-    .example("$0 api /projects", "List your projects")
-    .example("$0 api /projects/{id}/branches -X POST -F branch.name=dev", "Create a branch")
-    .example("$0 api --list", "List every available API route");
-export const handler = async (args) => {
-    const apiArgs = args;
-    if (apiArgs.list || apiArgs.path === "list" || apiArgs.path === "ls") {
-        await listEndpoints(apiArgs);
-        return;
-    }
-    await runRequest(apiArgs);
-};

package/dist/commands/auth.js

@@ -1,214 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { getApiClient } from "../api.js";
-import { auth, refreshToken } from "../auth.js";
-import { CREDENTIALS_FILE } from "../config.js";
-import { isConfigInit, isCurrentBranchProbe } from "../context.js";
-import { isCi } from "../env.js";
-import { log } from "../log.js";
-import { extendTokenSet } from "../utils/auth.js";
-export const command = "auth";
-export const aliases = ["login"];
-export const describe = "Authenticate";
-export const builder = (yargs) => yargs.option("context-file", {
-    hidden: true,
-});
-export const handler = async (args) => {
-    await authFlow(args);
-};
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
-    const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
-    if (!allowInteractiveAuth && isCi()) {
-        throw new Error("Cannot run interactive auth in CI");
-    }
-    const tokenSet = await auth({
-        oauthHost: oauthHost,
-        clientId: clientId,
-        allowUnsafeTls,
-    });
-    const credentialsPath = join(configDir, CREDENTIALS_FILE);
-    try {
-        await preserveCredentials(credentialsPath, tokenSet, getApiClient({
-            apiKey: tokenSet.access_token || "",
-            apiHost,
-        }));
-    }
-    catch {
-        log.error("Failed to save credentials");
-        return "";
-    }
-    log.info("Auth complete");
-    return tokenSet.access_token || "";
-};
-const preserveCredentials = async (path, credentials, apiClient) => {
-    const { data: { id }, } = await apiClient.getCurrentUserInfo();
-    const contents = JSON.stringify({
-        // Cast to a plain record: we intentionally spread the credentials object.
-        ...credentials,
-        user_id: id,
-    });
-    // correctly sets needed permissions for the credentials file
-    writeFileSync(path, contents, {
-        mode: 0o700,
-    });
-    log.debug("Saved credentials to %s", path);
-    log.debug("Credentials MD5 hash: %s", md5hash(contents));
-};
-const handleExistingToken = async (tokenSet, props, credentialsPath) => {
-    // Use existing access_token, if present and valid
-    if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
-        log.debug("Using existing valid access_token");
-        const apiClient = getApiClient({
-            apiKey: tokenSet.access_token,
-            apiHost: props.apiHost,
-        });
-        return { apiKey: tokenSet.access_token, apiClient };
-    }
-    // Either access_token is missing or its expired. Refresh the token
-    log.debug(tokenSet.expires_at < Date.now()
-        ? "Token is expired, attempting refresh"
-        : "Token is missing access_token, attempting refresh");
-    if (!tokenSet.refresh_token) {
-        log.debug("TokenSet is missing refresh_token, starting authentication");
-        return null;
-    }
-    try {
-        const refreshedTokenSet = await refreshToken({
-            oauthHost: props.oauthHost,
-            clientId: props.clientId,
-            allowUnsafeTls: props.allowUnsafeTls,
-        }, tokenSet);
-        // Extend the token set with expires_at
-        const extendedTokenSet = extendTokenSet(refreshedTokenSet);
-        const apiKey = extendedTokenSet.access_token;
-        const apiClient = getApiClient({
-            apiKey,
-            apiHost: props.apiHost,
-        });
-        await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
-        log.debug("Token refresh successful");
-        return { apiKey, apiClient };
-    }
-    catch (err) {
-        const typedErr = err instanceof Error ? err : new Error("Unknown error");
-        log.debug("Failed to refresh token: %s", typedErr.message);
-        throw new Error("AUTH_REFRESH_FAILED");
-    }
-};
-export const ensureAuth = async (props) => {
-    // Skip auth for help command or no command
-    if (props._.length === 0 || props.help) {
-        return;
-    }
-    // `(config) status --current-branch` is a purely-local read of `.neon`; it must
-    // never refresh a token or pop a browser login. Skip auth entirely (the handler
-    // doesn't use an API client in this mode).
-    if (isCurrentBranchProbe(props)) {
-        return;
-    }
-    // `config init` only scaffolds a neon.ts and installs npm packages locally; it
-    // never calls the Neon API, so skip auth entirely — no token refresh, no login.
-    if (isConfigInit(props)) {
-        return;
-    }
-    // `dev` runs a function locally. It injects the selected branch's env vars
-    // when credentials happen to be available, but must never trigger an
-    // interactive login: use an API key or existing stored credentials if
-    // present, otherwise run with no API client (env injection is skipped).
-    const isLocalDev = props._[0] === "dev";
-    // `bootstrap` only copies a public template repo; it never calls the Neon
-    // API, so it must work without credentials and must never pop a browser
-    // login. It uses an API key / stored credentials when present (harmless),
-    // otherwise it proceeds with no API client.
-    const isBootstrap = props._[0] === "bootstrap";
-    // `init` manages its own auth flow (asks the user if they have an account,
-    // then triggers OAuth at the right time). Skip the global auth middleware.
-    const isInit = props._[0] === "init";
-    // Use existing API key or handle auth command
-    if (props.apiKey || props._[0] === "auth") {
-        if (props.apiKey) {
-            log.debug("Using an API key to authorize requests");
-        }
-        props.apiClient = getApiClient({
-            apiKey: props.apiKey,
-            apiHost: props.apiHost,
-        });
-        return;
-    }
-    const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
-    // Handle case when credentials file exists
-    if (existsSync(credentialsPath)) {
-        log.debug("Trying to read credentials from %s", credentialsPath);
-        try {
-            const contents = readFileSync(credentialsPath, "utf8");
-            log.debug("Credentials MD5 hash: %s", md5hash(contents));
-            const tokenSet = JSON.parse(contents);
-            // Try to use existing token or refresh it
-            const result = await handleExistingToken(tokenSet, props, credentialsPath);
-            if (result) {
-                props.apiKey = result.apiKey;
-                props.apiClient = result.apiClient;
-                return;
-            }
-        }
-        catch (err) {
-            if (!(err instanceof Error &&
-                err.message === "AUTH_REFRESH_FAILED") &&
-                err.code !== "ENOENT" &&
-                !(err instanceof SyntaxError)) {
-                // Throw for any errors except auth refresh failure, missing file, or invalid credentials file
-                throw err;
-            }
-            // Fall through to new auth flow for auth failures
-            log.debug("Ensure auth failed, starting authentication", err);
-        }
-    }
-    else {
-        log.debug("Credentials file %s does not exist, starting authentication", credentialsPath);
-    }
-    // `dev` never launches the interactive browser flow. With no usable
-    // credentials it proceeds without an API client; env injection is skipped
-    // and the function still runs locally.
-    if (isLocalDev) {
-        log.debug("dev: no usable credentials; running without env injection");
-        return;
-    }
-    if (isBootstrap) {
-        log.debug("bootstrap: no usable credentials; continuing without auth");
-        return;
-    }
-    if (isInit) {
-        log.debug("init: skipping global auth; init manages its own auth flow");
-        return;
-    }
-    // Start new auth flow if no valid token exists or refresh failed
-    const apiKey = await authFlow(props);
-    props.apiKey = apiKey;
-    props.apiClient = getApiClient({
-        apiKey,
-        apiHost: props.apiHost,
-    });
-};
-/**
- * Deletes the credentials file at the specified path
- * @param configDir Directory where credentials file is stored
- */
-export const deleteCredentials = (configDir) => {
-    const credentialsPath = join(configDir, CREDENTIALS_FILE);
-    try {
-        if (existsSync(credentialsPath)) {
-            rmSync(credentialsPath);
-            log.info("Deleted credentials from %s", credentialsPath);
-        }
-        else {
-            log.debug("Credentials file %s does not exist", credentialsPath);
-        }
-    }
-    catch (err) {
-        const typedErr = err instanceof Error ? err : new Error("Unknown error");
-        log.error("Failed to delete credentials: %s", typedErr.message);
-        throw new Error("CREDENTIALS_DELETE_FAILED");
-    }
-};
-const md5hash = (s) => createHash("md5").update(s).digest("hex");