neon 3.0.0 → 3.1.1

package/dist/commands/neon_auth.js

@@ -1,1028 +1,820 @@
-import chalk from "chalk";
+import { t as __exportAll } from "../_chunks/rolldown-runtime-D7D4PA-g.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
-import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider, } from "../utils/api_enums.js";
-import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
 import { writer } from "../writer.js";
-// Shared styled output helpers
+import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider } from "../utils/api_enums.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+import chalk from "chalk";
+//#region src/commands/neon_auth.ts
+var neon_auth_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
 const printKvBlock = (title, entries) => {
-    process.stdout.write(`\n${chalk.green(title)}\n`);
-    for (const [key, value] of entries) {
-        process.stdout.write(`  ${chalk.green(key)}  ${value ?? ""}\n`);
-    }
-    process.stdout.write("\n");
+	process.stdout.write(`\n${chalk.green(title)}\n`);
+	for (const [key, value] of entries) process.stdout.write(`  ${chalk.green(key)}  ${value ?? ""}\n`);
+	process.stdout.write("\n");
 };
 const printMessage = (message) => {
-    process.stdout.write(`\n${chalk.green(message)}\n\n`);
+	process.stdout.write(`\n${chalk.green(message)}\n\n`);
 };
 const INTEGRATION_RESPONSE_FIELDS = [
-    "auth_provider",
-    "db_name",
-    "base_url",
-    "schema_name",
-    "table_name",
-    "jwks_url",
+	"auth_provider",
+	"db_name",
+	"base_url",
+	"schema_name",
+	"table_name",
+	"jwks_url"
 ];
 const INTEGRATION_STATUS_FIELDS = [
-    "auth_provider",
-    "branch_id",
-    "db_name",
-    "base_url",
-    "created_at",
-    "jwks_url",
+	"auth_provider",
+	"branch_id",
+	"db_name",
+	"base_url",
+	"created_at",
+	"jwks_url"
+];
+const OAUTH_PROVIDER_FIELDS = [
+	"id",
+	"type",
+	"client_id"
 ];
-const OAUTH_PROVIDER_FIELDS = ["id", "type", "client_id"];
 const ALLOW_LOCALHOST_FIELDS = ["allow_localhost"];
 const SUPPORTED_OAUTH_PROVIDERS = [
-    NeonAuthOauthProviderId.Google,
-    NeonAuthOauthProviderId.Github,
-    NeonAuthOauthProviderId.Vercel,
+	NeonAuthOauthProviderId.Google,
+	NeonAuthOauthProviderId.Github,
+	NeonAuthOauthProviderId.Vercel
 ];
 const DOMAIN_FIELDS = ["domain"];
 const EMAIL_PASSWORD_FIELDS = [
-    "enabled",
-    "email_verification_method",
-    "require_email_verification",
-    "auto_sign_in_after_verification",
-    "send_verification_email_on_sign_up",
-    "send_verification_email_on_sign_in",
-    "disable_sign_up",
+	"enabled",
+	"email_verification_method",
+	"require_email_verification",
+	"auto_sign_in_after_verification",
+	"send_verification_email_on_sign_up",
+	"send_verification_email_on_sign_in",
+	"disable_sign_up"
 ];
 const EMAIL_PROVIDER_FIELDS = [
-    "type",
-    "host",
-    "port",
-    "username",
-    "sender_email",
-    "sender_name",
+	"type",
+	"host",
+	"port",
+	"username",
+	"sender_email",
+	"sender_name"
 ];
 const ORGANIZATION_FIELDS = [
-    "enabled",
-    "organization_limit",
-    "creator_role",
+	"enabled",
+	"organization_limit",
+	"creator_role"
 ];
 const WEBHOOK_FIELDS = [
-    "enabled",
-    "webhook_url",
-    "enabled_events",
-    "timeout_seconds",
+	"enabled",
+	"webhook_url",
+	"enabled_events",
+	"timeout_seconds"
 ];
 const TEST_EMAIL_FIELDS = ["success", "error_message"];
-export const command = "neon-auth";
-export const describe = "Manage Neon Auth";
-export const builder = (argv) => {
-    return argv
-        .usage("$0 neon-auth <sub-command> [options]")
-        .options({
-        "project-id": {
-            describe: "Project ID",
-            type: "string",
-        },
-        branch: {
-            describe: "Branch ID or name",
-            type: "string",
-        },
-    })
-        .middleware(fillSingleProject)
-        .command("enable", "Enable Neon Auth on a branch", (yargs) => yargs.options({
-        "database-name": {
-            describe: "Database name to use for auth data",
-            type: "string",
-        },
-    }), async (args) => {
-        await enable(args);
-    })
-        .command("status", "Get Neon Auth status for a branch", (yargs) => yargs, async (args) => {
-        await status(args);
-    })
-        .command("disable", "Disable Neon Auth on a branch", (yargs) => yargs.options({
-        "delete-data": {
-            describe: "Permanently delete all Neon Auth data and schema from the database",
-            type: "boolean",
-            default: false,
-        },
-    }), async (args) => {
-        await disable(args);
-    })
-        .command("oauth-provider", "Manage OAuth providers", (yargs) => {
-        return yargs
-            .usage("$0 neon-auth oauth-provider <sub-command> [options]")
-            .command("list", "List OAuth providers", (yargs) => yargs, async (args) => {
-            await oauthProviderList(args);
-        })
-            .command("add", "Add an OAuth provider", (yargs) => yargs.options({
-            "provider-id": {
-                describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
-                type: "string",
-                choices: SUPPORTED_OAUTH_PROVIDERS,
-                demandOption: true,
-            },
-            "oauth-client-id": {
-                describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-                type: "string",
-            },
-            "oauth-client-secret": {
-                describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-                type: "string",
-            },
-        }), async (args) => {
-            await oauthProviderAdd(args);
-        })
-            .command("update", "Update an OAuth provider", (yargs) => yargs.options({
-            "provider-id": {
-                describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
-                type: "string",
-                choices: SUPPORTED_OAUTH_PROVIDERS,
-                demandOption: true,
-            },
-            "oauth-client-id": {
-                describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-                type: "string",
-            },
-            "oauth-client-secret": {
-                describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-                type: "string",
-            },
-        }), async (args) => {
-            await oauthProviderUpdate(args);
-        })
-            .command("delete", "Delete an OAuth provider", (yargs) => yargs.options({
-            "provider-id": {
-                describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
-                type: "string",
-                choices: SUPPORTED_OAUTH_PROVIDERS,
-                demandOption: true,
-            },
-        }), async (args) => {
-            await oauthProviderDelete(args);
-        });
-    })
-        .command("domain", "Manage redirect URI trusted domains", (yargs) => {
-        return yargs
-            .usage("$0 neon-auth domain <sub-command> [options]")
-            .command("list", "List trusted domains", (yargs) => yargs, async (args) => {
-            await domainList(args);
-        })
-            .command("add <domain>", "Add a trusted domain", (yargs) => yargs
-            .usage("$0 neon-auth domain add <domain> [options]")
-            .positional("domain", {
-            describe: "Domain to add",
-            type: "string",
-            demandOption: true,
-        }), async (args) => {
-            await domainAdd(args);
-        })
-            .command("delete <domain>", "Delete a trusted domain", (yargs) => yargs
-            .usage("$0 neon-auth domain delete <domain> [options]")
-            .positional("domain", {
-            describe: "Domain to delete",
-            type: "string",
-            demandOption: true,
-        }), async (args) => {
-            await domainDelete(args);
-        })
-            .command("allow-localhost", "Manage localhost connection settings", (yargs) => yargs
-            .usage("$0 neon-auth domain allow-localhost <sub-command> [options]")
-            .command("get", "Get localhost connection setting", (yargs) => yargs, async (args) => {
-            await allowLocalhostGet(args);
-        })
-            .command("enable", "Allow localhost connections", (yargs) => yargs, async (args) => {
-            await allowLocalhostEnable(args);
-        })
-            .command("disable", "Restrict localhost connections", (yargs) => yargs, async (args) => {
-            await allowLocalhostDisable(args);
-        }));
-    })
-        .command("config", "Manage Neon Auth configuration", (yargs) => {
-        return yargs
-            .usage("$0 neon-auth config <sub-command> [options]")
-            .command("email-password", "Manage email and password authentication settings", (yargs) => {
-            return yargs
-                .usage("$0 neon-auth config email-password <sub-command> [options]")
-                .command("get", "Get email and password config", (yargs) => yargs, async (args) => {
-                await emailPasswordGet(args);
-            })
-                .command("update", "Update email and password config", (yargs) => yargs.options({
-                enabled: {
-                    describe: "Enable email and password authentication",
-                    type: "boolean",
-                },
-                "email-verification-method": {
-                    describe: "Email verification method",
-                    type: "string",
-                    choices: Object.values(NeonAuthEmailVerificationMethod),
-                },
-                "require-email-verification": {
-                    describe: "Require email verification before users can sign in",
-                    type: "boolean",
-                },
-                "auto-sign-in-after-verification": {
-                    describe: "Auto sign in users after verifying their email",
-                    type: "boolean",
-                },
-                "send-verification-email-on-sign-up": {
-                    describe: "Send verification email on sign up",
-                    type: "boolean",
-                },
-                "send-verification-email-on-sign-in": {
-                    describe: "Send verification email on sign in",
-                    type: "boolean",
-                },
-                "disable-sign-up": {
-                    describe: "Disable new user sign ups",
-                    type: "boolean",
-                },
-            }), async (args) => {
-                await emailPasswordUpdate(args);
-            });
-        })
-            .command("email-provider", "Manage email provider configuration", (yargs) => {
-            return yargs
-                .usage("$0 neon-auth config email-provider <sub-command> [options]")
-                .command("get", "Get email provider config", (yargs) => yargs, async (args) => {
-                await emailProviderGet(args);
-            })
-                .command("update", "Update email provider config", (yargs) => yargs.options({
-                type: {
-                    describe: "Email provider type",
-                    type: "string",
-                    choices: [
-                        "standard",
-                        "shared",
-                    ],
-                    demandOption: true,
-                },
-                host: {
-                    describe: "SMTP host (required for standard)",
-                    type: "string",
-                },
-                port: {
-                    describe: "SMTP port (required for standard)",
-                    type: "number",
-                },
-                username: {
-                    describe: "SMTP username (required for standard)",
-                    type: "string",
-                },
-                password: {
-                    describe: "SMTP password (required for standard)",
-                    type: "string",
-                },
-                "sender-email": {
-                    describe: "Sender email address",
-                    type: "string",
-                },
-                "sender-name": {
-                    describe: "Sender display name",
-                    type: "string",
-                },
-            }), async (args) => {
-                await emailProviderUpdate(args);
-            })
-                .command("test", "Send a test email", (yargs) => yargs.options({
-                "recipient-email": {
-                    describe: "Email address to send test email to",
-                    type: "string",
-                    demandOption: true,
-                },
-                host: {
-                    describe: "SMTP host",
-                    type: "string",
-                    demandOption: true,
-                },
-                port: {
-                    describe: "SMTP port",
-                    type: "number",
-                    demandOption: true,
-                },
-                username: {
-                    describe: "SMTP username",
-                    type: "string",
-                    demandOption: true,
-                },
-                password: {
-                    describe: "SMTP password",
-                    type: "string",
-                    demandOption: true,
-                },
-                "sender-email": {
-                    describe: "Sender email address",
-                    type: "string",
-                    demandOption: true,
-                },
-                "sender-name": {
-                    describe: "Sender display name",
-                    type: "string",
-                    demandOption: true,
-                },
-            }), async (args) => {
-                await emailProviderTest(args);
-            });
-        })
-            .command("organization", "Manage organization plugin settings", (yargs) => {
-            return yargs
-                .usage("$0 neon-auth config organization <sub-command> [options]")
-                .command("get", "Get organization plugin config", (yargs) => yargs, async (args) => {
-                await organizationGet(args);
-            })
-                .command("update", "Update organization plugin config", (yargs) => yargs.options({
-                enabled: {
-                    describe: "Enable the organization plugin",
-                    type: "boolean",
-                },
-                limit: {
-                    describe: "Maximum number of organizations a user can create",
-                    type: "number",
-                },
-                "creator-role": {
-                    describe: "Role assigned to organization creator",
-                    type: "string",
-                    choices: [
-                        "admin",
-                        "owner",
-                    ],
-                },
-            }), async (args) => {
-                await organizationUpdate(args);
-            });
-        })
-            .command("webhook", "Manage webhook configuration", (yargs) => {
-            return yargs
-                .usage("$0 neon-auth config webhook <sub-command> [options]")
-                .command("get", "Get webhook config", (yargs) => yargs, async (args) => {
-                await webhookGet(args);
-            })
-                .command("update", "Update webhook config", (yargs) => yargs.options({
-                enabled: {
-                    describe: "Enable webhooks",
-                    type: "boolean",
-                    demandOption: true,
-                },
-                url: {
-                    describe: "Webhook endpoint URL",
-                    type: "string",
-                },
-                "enabled-events": {
-                    describe: "Events to enable",
-                    type: "string",
-                    choices: [
-                        "user.before_create",
-                        "user.created",
-                        "send.otp",
-                        "send.magic_link",
-                    ],
-                    array: true,
-                },
-                timeout: {
-                    describe: "Webhook timeout in seconds (1-10)",
-                    type: "number",
-                },
-            }), async (args) => {
-                await webhookUpdate(args);
-            });
-        });
-    })
-        .command("plugins", "View Neon Auth plugin configurations", (yargs) => {
-        return yargs
-            .usage("$0 neon-auth plugins <sub-command> [options]")
-            .command("list", "List all plugin configurations", (yargs) => yargs, async (args) => {
-            await pluginsList(args);
-        })
-            .command("get <plugin-name>", "Get a specific plugin configuration", (yargs) => yargs
-            .usage("$0 neon-auth plugins get <plugin-name> [options]")
-            .positional("plugin-name", {
-            describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, allow_localhost)",
-            type: "string",
-            demandOption: true,
-        }), async (args) => {
-            await pluginsGet(args);
-        });
-    })
-        .command("user", "Manage Neon Auth users", (yargs) => {
-        return yargs
-            .usage("$0 neon-auth user <sub-command> [options]")
-            .command("create", "Create an auth user", (yargs) => yargs.options({
-            email: {
-                describe: "User email address",
-                type: "string",
-                demandOption: true,
-            },
-            name: {
-                describe: "User display name (defaults to email if not provided)",
-                type: "string",
-            },
-        }), async (args) => {
-            await userCreate(args);
-        })
-            .command("delete <user-id>", "Delete an auth user", (yargs) => yargs
-            .usage("$0 neon-auth user delete <user-id> [options]")
-            .positional("user-id", {
-            describe: "ID of the user to delete",
-            type: "string",
-            demandOption: true,
-        }), async (args) => {
-            await userDelete(args);
-        })
-            .command("set-role <user-id>", "Set roles for an auth user", (yargs) => yargs
-            .usage("$0 neon-auth user set-role <user-id> [options]")
-            .positional("user-id", {
-            describe: "ID of the user to update",
-            type: "string",
-            demandOption: true,
-        })
-            .options({
-            roles: {
-                describe: "Roles to assign",
-                type: "string",
-                array: true,
-                demandOption: true,
-            },
-        }), async (args) => {
-            await userSetRole(args);
-        });
-    });
-};
-export const handler = (args) => {
-    return args;
+const command = "neon-auth";
+const describe = "Manage Neon Auth";
+const builder = (argv) => {
+	return argv.usage("$0 neon-auth <sub-command> [options]").options({
+		"project-id": {
+			describe: "Project ID",
+			type: "string"
+		},
+		branch: {
+			describe: "Branch ID or name",
+			type: "string"
+		}
+	}).middleware(fillSingleProject).command("enable", "Enable Neon Auth on a branch", (yargs) => yargs.options({ "database-name": {
+		describe: "Database name to use for auth data",
+		type: "string"
+	} }), async (args) => {
+		await enable(args);
+	}).command("status", "Get Neon Auth status for a branch", (yargs) => yargs, async (args) => {
+		await status(args);
+	}).command("disable", "Disable Neon Auth on a branch", (yargs) => yargs.options({ "delete-data": {
+		describe: "Permanently delete all Neon Auth data and schema from the database",
+		type: "boolean",
+		default: false
+	} }), async (args) => {
+		await disable(args);
+	}).command("oauth-provider", "Manage OAuth providers", (yargs) => {
+		return yargs.usage("$0 neon-auth oauth-provider <sub-command> [options]").command("list", "List OAuth providers", (yargs) => yargs, async (args) => {
+			await oauthProviderList(args);
+		}).command("add", "Add an OAuth provider", (yargs) => yargs.options({
+			"provider-id": {
+				describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
+				type: "string",
+				choices: SUPPORTED_OAUTH_PROVIDERS,
+				demandOption: true
+			},
+			"oauth-client-id": {
+				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
+				type: "string"
+			},
+			"oauth-client-secret": {
+				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
+				type: "string"
+			}
+		}), async (args) => {
+			await oauthProviderAdd(args);
+		}).command("update", "Update an OAuth provider", (yargs) => yargs.options({
+			"provider-id": {
+				describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
+				type: "string",
+				choices: SUPPORTED_OAUTH_PROVIDERS,
+				demandOption: true
+			},
+			"oauth-client-id": {
+				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
+				type: "string"
+			},
+			"oauth-client-secret": {
+				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
+				type: "string"
+			}
+		}), async (args) => {
+			await oauthProviderUpdate(args);
+		}).command("delete", "Delete an OAuth provider", (yargs) => yargs.options({ "provider-id": {
+			describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
+			type: "string",
+			choices: SUPPORTED_OAUTH_PROVIDERS,
+			demandOption: true
+		} }), async (args) => {
+			await oauthProviderDelete(args);
+		});
+	}).command("domain", "Manage redirect URI trusted domains", (yargs) => {
+		return yargs.usage("$0 neon-auth domain <sub-command> [options]").command("list", "List trusted domains", (yargs) => yargs, async (args) => {
+			await domainList(args);
+		}).command("add <domain>", "Add a trusted domain", (yargs) => yargs.usage("$0 neon-auth domain add <domain> [options]").positional("domain", {
+			describe: "Domain to add",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await domainAdd(args);
+		}).command("delete <domain>", "Delete a trusted domain", (yargs) => yargs.usage("$0 neon-auth domain delete <domain> [options]").positional("domain", {
+			describe: "Domain to delete",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await domainDelete(args);
+		}).command("allow-localhost", "Manage localhost connection settings", (yargs) => yargs.usage("$0 neon-auth domain allow-localhost <sub-command> [options]").command("get", "Get localhost connection setting", (yargs) => yargs, async (args) => {
+			await allowLocalhostGet(args);
+		}).command("enable", "Allow localhost connections", (yargs) => yargs, async (args) => {
+			await allowLocalhostEnable(args);
+		}).command("disable", "Restrict localhost connections", (yargs) => yargs, async (args) => {
+			await allowLocalhostDisable(args);
+		}));
+	}).command("config", "Manage Neon Auth configuration", (yargs) => {
+		return yargs.usage("$0 neon-auth config <sub-command> [options]").command("email-password", "Manage email and password authentication settings", (yargs) => {
+			return yargs.usage("$0 neon-auth config email-password <sub-command> [options]").command("get", "Get email and password config", (yargs) => yargs, async (args) => {
+				await emailPasswordGet(args);
+			}).command("update", "Update email and password config", (yargs) => yargs.options({
+				enabled: {
+					describe: "Enable email and password authentication",
+					type: "boolean"
+				},
+				"email-verification-method": {
+					describe: "Email verification method",
+					type: "string",
+					choices: Object.values(NeonAuthEmailVerificationMethod)
+				},
+				"require-email-verification": {
+					describe: "Require email verification before users can sign in",
+					type: "boolean"
+				},
+				"auto-sign-in-after-verification": {
+					describe: "Auto sign in users after verifying their email",
+					type: "boolean"
+				},
+				"send-verification-email-on-sign-up": {
+					describe: "Send verification email on sign up",
+					type: "boolean"
+				},
+				"send-verification-email-on-sign-in": {
+					describe: "Send verification email on sign in",
+					type: "boolean"
+				},
+				"disable-sign-up": {
+					describe: "Disable new user sign ups",
+					type: "boolean"
+				}
+			}), async (args) => {
+				await emailPasswordUpdate(args);
+			});
+		}).command("email-provider", "Manage email provider configuration", (yargs) => {
+			return yargs.usage("$0 neon-auth config email-provider <sub-command> [options]").command("get", "Get email provider config", (yargs) => yargs, async (args) => {
+				await emailProviderGet(args);
+			}).command("update", "Update email provider config", (yargs) => yargs.options({
+				type: {
+					describe: "Email provider type",
+					type: "string",
+					choices: ["standard", "shared"],
+					demandOption: true
+				},
+				host: {
+					describe: "SMTP host (required for standard)",
+					type: "string"
+				},
+				port: {
+					describe: "SMTP port (required for standard)",
+					type: "number"
+				},
+				username: {
+					describe: "SMTP username (required for standard)",
+					type: "string"
+				},
+				password: {
+					describe: "SMTP password (required for standard)",
+					type: "string"
+				},
+				"sender-email": {
+					describe: "Sender email address",
+					type: "string"
+				},
+				"sender-name": {
+					describe: "Sender display name",
+					type: "string"
+				}
+			}), async (args) => {
+				await emailProviderUpdate(args);
+			}).command("test", "Send a test email", (yargs) => yargs.options({
+				"recipient-email": {
+					describe: "Email address to send test email to",
+					type: "string",
+					demandOption: true
+				},
+				host: {
+					describe: "SMTP host",
+					type: "string",
+					demandOption: true
+				},
+				port: {
+					describe: "SMTP port",
+					type: "number",
+					demandOption: true
+				},
+				username: {
+					describe: "SMTP username",
+					type: "string",
+					demandOption: true
+				},
+				password: {
+					describe: "SMTP password",
+					type: "string",
+					demandOption: true
+				},
+				"sender-email": {
+					describe: "Sender email address",
+					type: "string",
+					demandOption: true
+				},
+				"sender-name": {
+					describe: "Sender display name",
+					type: "string",
+					demandOption: true
+				}
+			}), async (args) => {
+				await emailProviderTest(args);
+			});
+		}).command("organization", "Manage organization plugin settings", (yargs) => {
+			return yargs.usage("$0 neon-auth config organization <sub-command> [options]").command("get", "Get organization plugin config", (yargs) => yargs, async (args) => {
+				await organizationGet(args);
+			}).command("update", "Update organization plugin config", (yargs) => yargs.options({
+				enabled: {
+					describe: "Enable the organization plugin",
+					type: "boolean"
+				},
+				limit: {
+					describe: "Maximum number of organizations a user can create",
+					type: "number"
+				},
+				"creator-role": {
+					describe: "Role assigned to organization creator",
+					type: "string",
+					choices: ["admin", "owner"]
+				}
+			}), async (args) => {
+				await organizationUpdate(args);
+			});
+		}).command("webhook", "Manage webhook configuration", (yargs) => {
+			return yargs.usage("$0 neon-auth config webhook <sub-command> [options]").command("get", "Get webhook config", (yargs) => yargs, async (args) => {
+				await webhookGet(args);
+			}).command("update", "Update webhook config", (yargs) => yargs.options({
+				enabled: {
+					describe: "Enable webhooks",
+					type: "boolean",
+					demandOption: true
+				},
+				url: {
+					describe: "Webhook endpoint URL",
+					type: "string"
+				},
+				"enabled-events": {
+					describe: "Events to enable",
+					type: "string",
+					choices: [
+						"user.before_create",
+						"user.created",
+						"send.otp",
+						"send.magic_link"
+					],
+					array: true
+				},
+				timeout: {
+					describe: "Webhook timeout in seconds (1-10)",
+					type: "number"
+				}
+			}), async (args) => {
+				await webhookUpdate(args);
+			});
+		});
+	}).command("plugins", "View Neon Auth plugin configurations", (yargs) => {
+		return yargs.usage("$0 neon-auth plugins <sub-command> [options]").command("list", "List all plugin configurations", (yargs) => yargs, async (args) => {
+			await pluginsList(args);
+		}).command("get <plugin-name>", "Get a specific plugin configuration", (yargs) => yargs.usage("$0 neon-auth plugins get <plugin-name> [options]").positional("plugin-name", {
+			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, allow_localhost)",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await pluginsGet(args);
+		});
+	}).command("user", "Manage Neon Auth users", (yargs) => {
+		return yargs.usage("$0 neon-auth user <sub-command> [options]").command("create", "Create an auth user", (yargs) => yargs.options({
+			email: {
+				describe: "User email address",
+				type: "string",
+				demandOption: true
+			},
+			name: {
+				describe: "User display name (defaults to email if not provided)",
+				type: "string"
+			}
+		}), async (args) => {
+			await userCreate(args);
+		}).command("delete <user-id>", "Delete an auth user", (yargs) => yargs.usage("$0 neon-auth user delete <user-id> [options]").positional("user-id", {
+			describe: "ID of the user to delete",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await userDelete(args);
+		}).command("set-role <user-id>", "Set roles for an auth user", (yargs) => yargs.usage("$0 neon-auth user set-role <user-id> [options]").positional("user-id", {
+			describe: "ID of the user to update",
+			type: "string",
+			demandOption: true
+		}).options({ roles: {
+			describe: "Roles to assign",
+			type: "string",
+			array: true,
+			demandOption: true
+		} }), async (args) => {
+			await userSetRole(args);
+		});
+	});
+};
+const handler = (args) => {
+	return args;
 };
 const resolveBranch = async (props) => {
-    return props.branchId ?? (await branchIdFromProps(props));
+	return props.branchId ?? await branchIdFromProps(props);
 };
 const enable = async (props) => {
-    const branchId = await resolveBranch(props);
-    let data;
-    let alreadyEnabled = false;
-    try {
-        ({ data } = await retryOnLock(() => props.apiClient.createNeonAuth(props.projectId, branchId, {
-            auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
-            database_name: props.databaseName,
-        })));
-    }
-    catch (err) {
-        if (isNeonApiError(err) && err.status === 409) {
-            alreadyEnabled = true;
-            ({ data } = await props.apiClient.getNeonAuth(props.projectId, branchId));
-        }
-        else {
-            throw err;
-        }
-    }
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: INTEGRATION_RESPONSE_FIELDS });
-        return;
-    }
-    // Access type-specific fields loosely — CREATE response has schema/table,
-    // GET response (already-enabled path) has db_name instead.
-    const d = data;
-    printKvBlock(alreadyEnabled ? "Neon Auth is already enabled" : "Neon Auth enabled", [
-        ["Auth Provider:", data.auth_provider],
-        ...(d.db_name
-            ? [["Database:     ", d.db_name]]
-            : []),
-        ["Base URL:     ", data.base_url],
-        ...(d.schema_name
-            ? [["Schema Name:  ", d.schema_name]]
-            : []),
-        ...(d.table_name
-            ? [["Table Name:   ", d.table_name]]
-            : []),
-        ["JWKS URL:     ", data.jwks_url],
-    ]);
-    if (data.base_url) {
-        process.stdout.write(`  ${chalk.green("Set this environment variable in your application:")}\n`);
-        process.stdout.write(`  NEON_AUTH_BASE_URL=${data.base_url}\n\n`);
-    }
+	const branchId = await resolveBranch(props);
+	let data;
+	let alreadyEnabled = false;
+	try {
+		({data} = await retryOnLock(() => props.apiClient.createNeonAuth(props.projectId, branchId, {
+			auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
+			database_name: props.databaseName
+		})));
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 409) {
+			alreadyEnabled = true;
+			({data} = await props.apiClient.getNeonAuth(props.projectId, branchId));
+		} else throw err;
+	}
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: INTEGRATION_RESPONSE_FIELDS });
+		return;
+	}
+	const d = data;
+	printKvBlock(alreadyEnabled ? "Neon Auth is already enabled" : "Neon Auth enabled", [
+		["Auth Provider:", data.auth_provider],
+		...d.db_name ? [["Database:     ", d.db_name]] : [],
+		["Base URL:     ", data.base_url],
+		...d.schema_name ? [["Schema Name:  ", d.schema_name]] : [],
+		...d.table_name ? [["Table Name:   ", d.table_name]] : [],
+		["JWKS URL:     ", data.jwks_url]
+	]);
+	if (data.base_url) {
+		process.stdout.write(`  ${chalk.green("Set this environment variable in your application:")}\n`);
+		process.stdout.write(`  NEON_AUTH_BASE_URL=${data.base_url}\n\n`);
+	}
 };
 const status = async (props) => {
-    const branchId = await resolveBranch(props);
-    let data;
-    try {
-        ({ data } = await props.apiClient.getNeonAuth(props.projectId, branchId));
-    }
-    catch (err) {
-        if (isNeonApiError(err) && err.status === 404) {
-            printMessage("Neon Auth is not configured for this branch");
-            return;
-        }
-        throw err;
-    }
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: INTEGRATION_STATUS_FIELDS });
-        return;
-    }
-    printKvBlock("Neon Auth status", [
-        ["Auth Provider:", data.auth_provider],
-        ["Branch ID:    ", data.branch_id],
-        ["Database:     ", data.db_name],
-        ["Base URL:     ", data.base_url],
-        ["Created At:   ", data.created_at],
-        ["JWKS URL:     ", data.jwks_url],
-    ]);
+	const branchId = await resolveBranch(props);
+	let data;
+	try {
+		({data} = await props.apiClient.getNeonAuth(props.projectId, branchId));
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) {
+			printMessage("Neon Auth is not configured for this branch");
+			return;
+		}
+		throw err;
+	}
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: INTEGRATION_STATUS_FIELDS });
+		return;
+	}
+	printKvBlock("Neon Auth status", [
+		["Auth Provider:", data.auth_provider],
+		["Branch ID:    ", data.branch_id],
+		["Database:     ", data.db_name],
+		["Base URL:     ", data.base_url],
+		["Created At:   ", data.created_at],
+		["JWKS URL:     ", data.jwks_url]
+	]);
 };
 const disable = async (props) => {
-    const branchId = await resolveBranch(props);
-    await retryOnLock(() => props.apiClient.disableNeonAuth(props.projectId, branchId, {
-        delete_data: props.deleteData,
-    }));
-    printMessage("Neon Auth has been disabled");
+	const branchId = await resolveBranch(props);
+	await retryOnLock(() => props.apiClient.disableNeonAuth(props.projectId, branchId, { delete_data: props.deleteData }));
+	printMessage("Neon Auth has been disabled");
 };
-// --- OAuth provider ---
-const SHARED_PROVIDER_DISCLAIMER = "Shared keys are created by the Neon team for development only " +
-    "and should not be used for production apps. It helps you get started, " +
-    "but will show Neon branding (logo and name) on the OAuth consent screen.";
+const SHARED_PROVIDER_DISCLAIMER = "Shared keys are created by the Neon team for development only and should not be used for production apps. It helps you get started, but will show Neon branding (logo and name) on the OAuth consent screen.";
 const oauthProviderList = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.listBranchNeonAuthOauthProviders(props.projectId, branchId);
-    if (data.providers.length === 0 && props.output === "table") {
-        printMessage("No OAuth providers are configured for this branch.");
-        return;
-    }
-    writer(props).end(data.providers, { fields: OAUTH_PROVIDER_FIELDS });
-    const hasShared = data.providers.some((p) => p.type === NeonAuthOauthProviderType.Shared);
-    if (hasShared && props.output === "table") {
-        process.stdout.write(`\n${chalk.yellow("Caution:")} ${SHARED_PROVIDER_DISCLAIMER}\n\n`);
-    }
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.listBranchNeonAuthOauthProviders(props.projectId, branchId);
+	if (data.providers.length === 0 && props.output === "table") {
+		printMessage("No OAuth providers are configured for this branch.");
+		return;
+	}
+	writer(props).end(data.providers, { fields: OAUTH_PROVIDER_FIELDS });
+	if (data.providers.some((p) => p.type === NeonAuthOauthProviderType.Shared) && props.output === "table") process.stdout.write(`\n${chalk.yellow("Caution:")} ${SHARED_PROVIDER_DISCLAIMER}\n\n`);
 };
 const oauthProviderAdd = async (props) => {
-    const branchId = await resolveBranch(props);
-    let data;
-    try {
-        ({ data } = await props.apiClient.addBranchNeonAuthOauthProvider(props.projectId, branchId, {
-            id: props.providerId,
-            client_id: props.oauthClientId,
-            client_secret: props.oauthClientSecret,
-        }));
-    }
-    catch (err) {
-        if (isNeonApiError(err) &&
-            codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") {
-            throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\n` +
-                `Re-run with --oauth-client-id and --oauth-client-secret to provide them.\n` +
-                `Create an OAuth app at your provider and use those credentials.`);
-        }
-        throw err;
-    }
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
-    }
-    else {
-        printKvBlock("OAuth provider added", [
-            ["ID:         ", data.id],
-            ["Type:       ", data.type],
-            ...(data.client_id
-                ? [["Client ID:  ", data.client_id]]
-                : []),
-        ]);
-    }
-    await printCallbackInstructions(props, branchId, props.providerId);
+	const branchId = await resolveBranch(props);
+	let data;
+	try {
+		({data} = await props.apiClient.addBranchNeonAuthOauthProvider(props.projectId, branchId, {
+			id: props.providerId,
+			client_id: props.oauthClientId,
+			client_secret: props.oauthClientSecret
+		}));
+	} catch (err) {
+		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
+		throw err;
+	}
+	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
+	else printKvBlock("OAuth provider added", [
+		["ID:         ", data.id],
+		["Type:       ", data.type],
+		...data.client_id ? [["Client ID:  ", data.client_id]] : []
+	]);
+	await printCallbackInstructions(props, branchId, props.providerId);
 };
 const oauthProviderUpdate = async (props) => {
-    const branchId = await resolveBranch(props);
-    let data;
-    try {
-        ({ data } = await props.apiClient.updateBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId, {
-            client_id: props.oauthClientId,
-            client_secret: props.oauthClientSecret,
-        }));
-    }
-    catch (err) {
-        if (isNeonApiError(err) &&
-            codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") {
-            throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\n` +
-                `Re-run with --oauth-client-id and --oauth-client-secret to provide them.\n` +
-                `Create an OAuth app at your provider and use those credentials.`);
-        }
-        throw err;
-    }
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
-    }
-    else {
-        printKvBlock("OAuth provider updated", [
-            ["ID:         ", data.id],
-            ["Type:       ", data.type],
-            ...(data.client_id
-                ? [["Client ID:  ", data.client_id]]
-                : []),
-        ]);
-    }
-    await printCallbackInstructions(props, branchId, props.providerId);
+	const branchId = await resolveBranch(props);
+	let data;
+	try {
+		({data} = await props.apiClient.updateBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId, {
+			client_id: props.oauthClientId,
+			client_secret: props.oauthClientSecret
+		}));
+	} catch (err) {
+		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
+		throw err;
+	}
+	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
+	else printKvBlock("OAuth provider updated", [
+		["ID:         ", data.id],
+		["Type:       ", data.type],
+		...data.client_id ? [["Client ID:  ", data.client_id]] : []
+	]);
+	await printCallbackInstructions(props, branchId, props.providerId);
 };
 const CALLBACK_INSTRUCTIONS = {
-    github: {
-        lead: "Create an OAuth app in the GitHub Developer Portal and add the following authorization callback URL:",
-        urlLabel: "callback/github",
-    },
-    vercel: {
-        lead: "Create a Vercel App in your Vercel Dashboard and add the following authorization callback URL:",
-        urlLabel: "callback/vercel",
-    },
-    google: {
-        lead: "Get Google credentials by creating an OAuth client in Google Cloud Console > Credentials, and add the following authorized redirect URL:",
-        urlLabel: "callback/google",
-    },
+	github: {
+		lead: "Create an OAuth app in the GitHub Developer Portal and add the following authorization callback URL:",
+		urlLabel: "callback/github"
+	},
+	vercel: {
+		lead: "Create a Vercel App in your Vercel Dashboard and add the following authorization callback URL:",
+		urlLabel: "callback/vercel"
+	},
+	google: {
+		lead: "Get Google credentials by creating an OAuth client in Google Cloud Console > Credentials, and add the following authorized redirect URL:",
+		urlLabel: "callback/google"
+	}
 };
 const printCallbackInstructions = async (props, branchId, providerId) => {
-    const instructions = CALLBACK_INSTRUCTIONS[providerId];
-    if (!instructions)
-        return;
-    if (props.output === "json" || props.output === "yaml")
-        return;
-    let baseUrl;
-    try {
-        const { data } = await props.apiClient.getNeonAuth(props.projectId, branchId);
-        baseUrl = data.base_url;
-    }
-    catch {
-        return;
-    }
-    if (!baseUrl)
-        return;
-    const callbackUrl = `${baseUrl.replace(/\/$/, "")}/${instructions.urlLabel}`;
-    printKvBlock(instructions.lead, [["URL:  ", callbackUrl]]);
+	const instructions = CALLBACK_INSTRUCTIONS[providerId];
+	if (!instructions) return;
+	if (props.output === "json" || props.output === "yaml") return;
+	let baseUrl;
+	try {
+		const { data } = await props.apiClient.getNeonAuth(props.projectId, branchId);
+		baseUrl = data.base_url;
+	} catch {
+		return;
+	}
+	if (!baseUrl) return;
+	const callbackUrl = `${baseUrl.replace(/\/$/, "")}/${instructions.urlLabel}`;
+	printKvBlock(instructions.lead, [["URL:  ", callbackUrl]]);
 };
 const oauthProviderDelete = async (props) => {
-    const branchId = await resolveBranch(props);
-    await props.apiClient.deleteBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId);
-    printMessage(`OAuth provider "${props.providerId}" deleted`);
+	const branchId = await resolveBranch(props);
+	await props.apiClient.deleteBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId);
+	printMessage(`OAuth provider "${props.providerId}" deleted`);
 };
-// --- Domains ---
 const domainList = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.listBranchNeonAuthTrustedDomains(props.projectId, branchId);
-    if (data.domains.length === 0 && props.output === "table") {
-        printMessage("No trusted domains are configured for this branch.");
-        return;
-    }
-    writer(props).end(data.domains, { fields: DOMAIN_FIELDS });
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.listBranchNeonAuthTrustedDomains(props.projectId, branchId);
+	if (data.domains.length === 0 && props.output === "table") {
+		printMessage("No trusted domains are configured for this branch.");
+		return;
+	}
+	writer(props).end(data.domains, { fields: DOMAIN_FIELDS });
 };
 const validateDomainUri = (domain) => {
-    let url;
-    try {
-        url = new URL(domain);
-    }
-    catch {
-        throw new Error(`Invalid domain URI "${domain}". Must be a full URI including scheme, e.g. https://${domain}`);
-    }
-    if (!["http:", "https:"].includes(url.protocol)) {
-        throw new Error(`Invalid domain URI "${domain}". Must use http or https scheme, e.g. https://${url.host}`);
-    }
+	let url;
+	try {
+		url = new URL(domain);
+	} catch {
+		throw new Error(`Invalid domain URI "${domain}". Must be a full URI including scheme, e.g. https://${domain}`);
+	}
+	if (!["http:", "https:"].includes(url.protocol)) throw new Error(`Invalid domain URI "${domain}". Must use http or https scheme, e.g. https://${url.host}`);
 };
 const domainAdd = async (props) => {
-    validateDomainUri(props.domain);
-    const branchId = await resolveBranch(props);
-    await props.apiClient.addBranchNeonAuthTrustedDomain(props.projectId, branchId, {
-        domain: props.domain,
-        auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
-    });
-    printMessage(`Domain "${props.domain}" added`);
+	validateDomainUri(props.domain);
+	const branchId = await resolveBranch(props);
+	await props.apiClient.addBranchNeonAuthTrustedDomain(props.projectId, branchId, {
+		domain: props.domain,
+		auth_provider: NeonAuthSupportedAuthProvider.BetterAuth
+	});
+	printMessage(`Domain "${props.domain}" added`);
 };
 const domainDelete = async (props) => {
-    validateDomainUri(props.domain);
-    const branchId = await resolveBranch(props);
-    const { data: existing } = await props.apiClient.listBranchNeonAuthTrustedDomains(props.projectId, branchId);
-    if (!existing.domains.some((d) => d.domain === props.domain)) {
-        throw new Error(`Domain "${props.domain}" is not in the trusted domains list.`);
-    }
-    await props.apiClient.deleteBranchNeonAuthTrustedDomain(props.projectId, branchId, {
-        auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
-        domains: [{ domain: props.domain }],
-    });
-    printMessage(`Domain "${props.domain}" deleted`);
+	validateDomainUri(props.domain);
+	const branchId = await resolveBranch(props);
+	const { data: existing } = await props.apiClient.listBranchNeonAuthTrustedDomains(props.projectId, branchId);
+	if (!existing.domains.some((d) => d.domain === props.domain)) throw new Error(`Domain "${props.domain}" is not in the trusted domains list.`);
+	await props.apiClient.deleteBranchNeonAuthTrustedDomain(props.projectId, branchId, {
+		auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
+		domains: [{ domain: props.domain }]
+	});
+	printMessage(`Domain "${props.domain}" deleted`);
 };
-// --- Allow localhost ---
 const allowLocalhostGet = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthAllowLocalhost(props.projectId, branchId);
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: ALLOW_LOCALHOST_FIELDS });
-        return;
-    }
-    printKvBlock("Localhost connection settings", [
-        ["Allow localhost:", String(data.allow_localhost)],
-    ]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthAllowLocalhost(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: ALLOW_LOCALHOST_FIELDS });
+		return;
+	}
+	printKvBlock("Localhost connection settings", [["Allow localhost:", String(data.allow_localhost)]]);
 };
 const allowLocalhostEnable = async (props) => {
-    const branchId = await resolveBranch(props);
-    await props.apiClient.updateNeonAuthAllowLocalhost(props.projectId, branchId, {
-        allow_localhost: true,
-    });
-    printMessage("Localhost connections allowed");
+	const branchId = await resolveBranch(props);
+	await props.apiClient.updateNeonAuthAllowLocalhost(props.projectId, branchId, { allow_localhost: true });
+	printMessage("Localhost connections allowed");
 };
 const allowLocalhostDisable = async (props) => {
-    const branchId = await resolveBranch(props);
-    await props.apiClient.updateNeonAuthAllowLocalhost(props.projectId, branchId, {
-        allow_localhost: false,
-    });
-    printMessage("Localhost connections restricted");
+	const branchId = await resolveBranch(props);
+	await props.apiClient.updateNeonAuthAllowLocalhost(props.projectId, branchId, { allow_localhost: false });
+	printMessage("Localhost connections restricted");
 };
-// --- Email and password ---
 const printEmailPasswordEntries = (data) => [
-    ["Enabled:                    ", String(data.enabled)],
-    ["Verification Method:        ", data.email_verification_method],
-    ["Require Verification:       ", String(data.require_email_verification)],
-    [
-        "Auto Sign In After Verify:  ",
-        String(data.auto_sign_in_after_verification),
-    ],
-    [
-        "Send Email On Sign Up:      ",
-        String(data.send_verification_email_on_sign_up),
-    ],
-    [
-        "Send Email On Sign In:      ",
-        String(data.send_verification_email_on_sign_in),
-    ],
-    ["Disable Sign Up:            ", String(data.disable_sign_up)],
+	["Enabled:                    ", String(data.enabled)],
+	["Verification Method:        ", data.email_verification_method],
+	["Require Verification:       ", String(data.require_email_verification)],
+	["Auto Sign In After Verify:  ", String(data.auto_sign_in_after_verification)],
+	["Send Email On Sign Up:      ", String(data.send_verification_email_on_sign_up)],
+	["Send Email On Sign In:      ", String(data.send_verification_email_on_sign_in)],
+	["Disable Sign Up:            ", String(data.disable_sign_up)]
 ];
 const emailPasswordGet = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthEmailAndPasswordConfig(props.projectId, branchId);
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: EMAIL_PASSWORD_FIELDS });
-        return;
-    }
-    printKvBlock("Email & password auth configuration", printEmailPasswordEntries(data));
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthEmailAndPasswordConfig(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: EMAIL_PASSWORD_FIELDS });
+		return;
+	}
+	printKvBlock("Email & password auth configuration", printEmailPasswordEntries(data));
 };
 const emailPasswordUpdate = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.updateNeonAuthEmailAndPasswordConfig(props.projectId, branchId, {
-        enabled: props.enabled,
-        email_verification_method: props.emailVerificationMethod,
-        require_email_verification: props.requireEmailVerification,
-        auto_sign_in_after_verification: props.autoSignInAfterVerification,
-        send_verification_email_on_sign_up: props.sendVerificationEmailOnSignUp,
-        send_verification_email_on_sign_in: props.sendVerificationEmailOnSignIn,
-        disable_sign_up: props.disableSignUp,
-    });
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: EMAIL_PASSWORD_FIELDS });
-        return;
-    }
-    printKvBlock("Email & password auth configuration updated", printEmailPasswordEntries(data));
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthEmailAndPasswordConfig(props.projectId, branchId, {
+		enabled: props.enabled,
+		email_verification_method: props.emailVerificationMethod,
+		require_email_verification: props.requireEmailVerification,
+		auto_sign_in_after_verification: props.autoSignInAfterVerification,
+		send_verification_email_on_sign_up: props.sendVerificationEmailOnSignUp,
+		send_verification_email_on_sign_in: props.sendVerificationEmailOnSignIn,
+		disable_sign_up: props.disableSignUp
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: EMAIL_PASSWORD_FIELDS });
+		return;
+	}
+	printKvBlock("Email & password auth configuration updated", printEmailPasswordEntries(data));
 };
-// --- Email provider ---
 const printEmailProviderEntries = (data) => [
-    ["Type:          ", data.type],
-    ...(data.type === "standard"
-        ? [
-            ["Host:          ", data.host],
-            [
-                "Port:          ",
-                data.port != null ? String(data.port) : undefined,
-            ],
-            ["Username:      ", data.username],
-        ]
-        : []),
-    ["Sender Email:  ", data.sender_email],
-    ["Sender Name:   ", data.sender_name],
+	["Type:          ", data.type],
+	...data.type === "standard" ? [
+		["Host:          ", data.host],
+		["Port:          ", data.port != null ? String(data.port) : void 0],
+		["Username:      ", data.username]
+	] : [],
+	["Sender Email:  ", data.sender_email],
+	["Sender Name:   ", data.sender_name]
 ];
 const emailProviderGet = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthEmailProvider(props.projectId, branchId);
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, {
-            fields: EMAIL_PROVIDER_FIELDS,
-        });
-        return;
-    }
-    printKvBlock("Email provider configuration", printEmailProviderEntries(data));
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthEmailProvider(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: EMAIL_PROVIDER_FIELDS });
+		return;
+	}
+	printKvBlock("Email provider configuration", printEmailProviderEntries(data));
 };
 const emailProviderUpdate = async (props) => {
-    if (props.type === "standard" &&
-        (!props.host || !props.port || !props.username || !props.password)) {
-        throw new Error("--host, --port, --username, and --password are required for standard email provider");
-    }
-    const warnSharedSender = props.type === "shared" && (props.senderEmail || props.senderName);
-    const branchId = await resolveBranch(props);
-    let config;
-    if (props.type === "standard") {
-        config = {
-            type: "standard",
-            host: props.host,
-            port: props.port,
-            username: props.username,
-            password: props.password,
-            sender_email: props.senderEmail,
-            sender_name: props.senderName,
-        };
-    }
-    else {
-        config = {
-            type: "shared",
-        };
-    }
-    const { data } = await props.apiClient.updateNeonAuthEmailProvider(props.projectId, branchId, config);
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, {
-            fields: EMAIL_PROVIDER_FIELDS,
-        });
-    }
-    else {
-        printKvBlock("Email provider configuration updated", printEmailProviderEntries(data));
-    }
-    if (warnSharedSender) {
-        process.stderr.write(`${chalk.yellow("Warning:")} --sender-email and --sender-name are ignored for the shared email provider. ` +
-            `These values only take effect with --type standard.\n\n`);
-    }
+	if (props.type === "standard" && (!props.host || !props.port || !props.username || !props.password)) throw new Error("--host, --port, --username, and --password are required for standard email provider");
+	const warnSharedSender = props.type === "shared" && (props.senderEmail || props.senderName);
+	const branchId = await resolveBranch(props);
+	let config;
+	if (props.type === "standard") config = {
+		type: "standard",
+		host: props.host,
+		port: props.port,
+		username: props.username,
+		password: props.password,
+		sender_email: props.senderEmail,
+		sender_name: props.senderName
+	};
+	else config = { type: "shared" };
+	const { data } = await props.apiClient.updateNeonAuthEmailProvider(props.projectId, branchId, config);
+	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: EMAIL_PROVIDER_FIELDS });
+	else printKvBlock("Email provider configuration updated", printEmailProviderEntries(data));
+	if (warnSharedSender) process.stderr.write(`${chalk.yellow("Warning:")} --sender-email and --sender-name are ignored for the shared email provider. These values only take effect with --type standard.\n\n`);
 };
 const emailProviderTest = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.sendNeonAuthTestEmail(props.projectId, branchId, {
-        recipient_email: props.recipientEmail,
-        host: props.host,
-        port: props.port,
-        username: props.username,
-        password: props.password,
-        sender_email: props.senderEmail,
-        sender_name: props.senderName,
-    });
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: TEST_EMAIL_FIELDS });
-    }
-    else if (data.success) {
-        printMessage("Test email sent successfully");
-    }
-    else {
-        process.stdout.write(`\n${chalk.red("Test email failed")}\n  ${data.error_message ?? "Unknown error"}\n\n`);
-    }
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.sendNeonAuthTestEmail(props.projectId, branchId, {
+		recipient_email: props.recipientEmail,
+		host: props.host,
+		port: props.port,
+		username: props.username,
+		password: props.password,
+		sender_email: props.senderEmail,
+		sender_name: props.senderName
+	});
+	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: TEST_EMAIL_FIELDS });
+	else if (data.success) printMessage("Test email sent successfully");
+	else process.stdout.write(`\n${chalk.red("Test email failed")}\n  ${data.error_message ?? "Unknown error"}\n\n`);
 };
-// --- Organization plugin ---
 const printOrganizationEntries = (data) => [
-    ["Enabled:          ", String(data.enabled)],
-    ["Org Limit:        ", String(data.organization_limit)],
-    ["Creator Role:     ", data.creator_role],
+	["Enabled:          ", String(data.enabled)],
+	["Org Limit:        ", String(data.organization_limit)],
+	["Creator Role:     ", data.creator_role]
 ];
 const organizationGet = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
-    const org = data.organization;
-    if (!org) {
-        if (props.output === "json" || props.output === "yaml") {
-            writer(props).end({}, {
-                fields: ORGANIZATION_FIELDS,
-            });
-            return;
-        }
-        printMessage("No organization plugin config found.");
-        return;
-    }
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(org, { fields: ORGANIZATION_FIELDS });
-        return;
-    }
-    printKvBlock("Organization configuration", printOrganizationEntries(org));
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
+	const org = data.organization;
+	if (!org) {
+		if (props.output === "json" || props.output === "yaml") {
+			writer(props).end({}, { fields: ORGANIZATION_FIELDS });
+			return;
+		}
+		printMessage("No organization plugin config found.");
+		return;
+	}
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(org, { fields: ORGANIZATION_FIELDS });
+		return;
+	}
+	printKvBlock("Organization configuration", printOrganizationEntries(org));
 };
 const organizationUpdate = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.updateNeonAuthOrganizationPlugin(props.projectId, branchId, {
-        enabled: props.enabled,
-        organization_limit: props.limit,
-        creator_role: props.creatorRole,
-    });
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: ORGANIZATION_FIELDS });
-        return;
-    }
-    printKvBlock("Organization configuration updated", printOrganizationEntries(data));
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthOrganizationPlugin(props.projectId, branchId, {
+		enabled: props.enabled,
+		organization_limit: props.limit,
+		creator_role: props.creatorRole
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: ORGANIZATION_FIELDS });
+		return;
+	}
+	printKvBlock("Organization configuration updated", printOrganizationEntries(data));
 };
-// --- Webhook ---
 const printWebhookEntries = (data) => [
-    ["Enabled:        ", String(data.enabled)],
-    ["URL:            ", data.webhook_url ?? ""],
-    ["Events:         ", (data.enabled_events ?? []).join(", ")],
-    [
-        "Timeout (sec):  ",
-        data.timeout_seconds != null ? String(data.timeout_seconds) : "",
-    ],
+	["Enabled:        ", String(data.enabled)],
+	["URL:            ", data.webhook_url ?? ""],
+	["Events:         ", (data.enabled_events ?? []).join(", ")],
+	["Timeout (sec):  ", data.timeout_seconds != null ? String(data.timeout_seconds) : ""]
 ];
 const webhookGet = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthWebhookConfig(props.projectId, branchId);
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: WEBHOOK_FIELDS });
-        return;
-    }
-    printKvBlock("Webhook configuration", printWebhookEntries(data));
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthWebhookConfig(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: WEBHOOK_FIELDS });
+		return;
+	}
+	printKvBlock("Webhook configuration", printWebhookEntries(data));
 };
 const webhookUpdate = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.updateNeonAuthWebhookConfig(props.projectId, branchId, {
-        enabled: props.enabled,
-        webhook_url: props.url,
-        enabled_events: props.enabledEvents,
-        timeout_seconds: props.timeout,
-    });
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, { fields: WEBHOOK_FIELDS });
-        return;
-    }
-    printKvBlock("Webhook configuration updated", printWebhookEntries(data));
-};
-// --- Plugins ---
-const pluginTitle = (name) => name.replace(/_/g, " ").replace(/^\w/, (c) => c.toUpperCase()) +
-    " configuration";
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthWebhookConfig(props.projectId, branchId, {
+		enabled: props.enabled,
+		webhook_url: props.url,
+		enabled_events: props.enabledEvents,
+		timeout_seconds: props.timeout
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: WEBHOOK_FIELDS });
+		return;
+	}
+	printKvBlock("Webhook configuration updated", printWebhookEntries(data));
+};
+const pluginTitle = (name) => name.replace(/_/g, " ").replace(/^\w/, (c) => c.toUpperCase()) + " configuration";
 const formatValue = (v) => {
-    if (v == null)
-        return "";
-    if (typeof v === "string")
-        return v;
-    if (typeof v === "number" || typeof v === "boolean")
-        return String(v);
-    return JSON.stringify(v);
+	if (v == null) return "";
+	if (typeof v === "string") return v;
+	if (typeof v === "number" || typeof v === "boolean") return String(v);
+	return JSON.stringify(v);
 };
 const pluginsList = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
-    if (props.output === "json" || props.output === "yaml") {
-        writer(props).end(data, {
-            fields: Object.keys(data),
-        });
-        return;
-    }
-    const summarize = (value) => {
-        if (value == null)
-            return "not configured";
-        if (typeof value === "boolean")
-            return String(value);
-        if (typeof value === "string")
-            return value;
-        if (typeof value === "number")
-            return String(value);
-        if (Array.isArray(value))
-            return value.length === 1
-                ? "1 item"
-                : `${String(value.length)} items`;
-        if (typeof value === "object") {
-            const obj = value;
-            if ("enabled" in obj)
-                return obj.enabled ? "enabled" : "disabled";
-            if ("type" in obj)
-                return formatValue(obj.type);
-        }
-        return JSON.stringify(value);
-    };
-    const entries = Object.entries(data).map(([key, value]) => [key.padEnd(24), summarize(value)]);
-    printKvBlock("Neon Auth plugins", entries);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: Object.keys(data) });
+		return;
+	}
+	const summarize = (value) => {
+		if (value == null) return "not configured";
+		if (typeof value === "boolean") return String(value);
+		if (typeof value === "string") return value;
+		if (typeof value === "number") return String(value);
+		if (Array.isArray(value)) return value.length === 1 ? "1 item" : `${String(value.length)} items`;
+		if (typeof value === "object") {
+			const obj = value;
+			if ("enabled" in obj) return obj.enabled ? "enabled" : "disabled";
+			if ("type" in obj) return formatValue(obj.type);
+		}
+		return JSON.stringify(value);
+	};
+	const entries = Object.entries(data).map(([key, value]) => [key.padEnd(24), summarize(value)]);
+	printKvBlock("Neon Auth plugins", entries);
 };
 const pluginsGet = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
-    const plugin = data[props.pluginName];
-    if (plugin === undefined) {
-        const available = Object.keys(data).join(", ");
-        throw new Error(`Unknown plugin "${props.pluginName}". Available plugins: ${available}`);
-    }
-    if (props.output === "json" || props.output === "yaml") {
-        const fields = typeof plugin === "object" && !Array.isArray(plugin)
-            ? Object.keys(plugin)
-            : [];
-        writer(props).end(plugin, { fields: fields });
-        return;
-    }
-    if (typeof plugin === "object" &&
-        !Array.isArray(plugin) &&
-        plugin != null) {
-        const entries = Object.entries(plugin).map(([k, v]) => [`${k}:`.padEnd(18), formatValue(v)]);
-        printKvBlock(pluginTitle(props.pluginName), entries);
-    }
-    else if (Array.isArray(plugin)) {
-        const entries = plugin.map((item, i) => [
-            `[${i}]:`.padEnd(18),
-            typeof item === "object" ? JSON.stringify(item) : String(item),
-        ]);
-        printKvBlock(pluginTitle(props.pluginName), entries);
-    }
-    else {
-        printKvBlock(pluginTitle(props.pluginName), [
-            ["Value:".padEnd(18), String(plugin)],
-        ]);
-    }
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
+	const plugin = data[props.pluginName];
+	if (plugin === void 0) {
+		const available = Object.keys(data).join(", ");
+		throw new Error(`Unknown plugin "${props.pluginName}". Available plugins: ${available}`);
+	}
+	if (props.output === "json" || props.output === "yaml") {
+		const fields = typeof plugin === "object" && !Array.isArray(plugin) ? Object.keys(plugin) : [];
+		writer(props).end(plugin, { fields });
+		return;
+	}
+	if (typeof plugin === "object" && !Array.isArray(plugin) && plugin != null) {
+		const entries = Object.entries(plugin).map(([k, v]) => [`${k}:`.padEnd(18), formatValue(v)]);
+		printKvBlock(pluginTitle(props.pluginName), entries);
+	} else if (Array.isArray(plugin)) {
+		const entries = plugin.map((item, i) => [`[${i}]:`.padEnd(18), typeof item === "object" ? JSON.stringify(item) : String(item)]);
+		printKvBlock(pluginTitle(props.pluginName), entries);
+	} else printKvBlock(pluginTitle(props.pluginName), [["Value:".padEnd(18), String(plugin)]]);
 };
-// --- User ---
 const userCreate = async (props) => {
-    const branchId = await resolveBranch(props);
-    const requestBody = {
-        email: props.email,
-        name: props.name ?? props.email,
-    };
-    const { data } = await props.apiClient.createBranchNeonAuthNewUser(props.projectId, branchId, requestBody);
-    const displayName = requestBody.name !== props.email ? requestBody.name : undefined;
-    printKvBlock("User created", [
-        ["ID:    ", data.id],
-        ["Email: ", requestBody.email],
-        ...(displayName ? [["Name:  ", displayName]] : []),
-    ]);
+	const branchId = await resolveBranch(props);
+	const requestBody = {
+		email: props.email,
+		name: props.name ?? props.email
+	};
+	const { data } = await props.apiClient.createBranchNeonAuthNewUser(props.projectId, branchId, requestBody);
+	const displayName = requestBody.name !== props.email ? requestBody.name : void 0;
+	printKvBlock("User created", [
+		["ID:    ", data.id],
+		["Email: ", requestBody.email],
+		...displayName ? [["Name:  ", displayName]] : []
+	]);
 };
 const userDelete = async (props) => {
-    const branchId = await resolveBranch(props);
-    await props.apiClient.deleteBranchNeonAuthUser(props.projectId, branchId, props.userId);
-    printMessage(`User "${props.userId}" deleted`);
+	const branchId = await resolveBranch(props);
+	await props.apiClient.deleteBranchNeonAuthUser(props.projectId, branchId, props.userId);
+	printMessage(`User "${props.userId}" deleted`);
 };
 const userSetRole = async (props) => {
-    const branchId = await resolveBranch(props);
-    const { data } = await props.apiClient.updateNeonAuthUserRole(props.projectId, branchId, props.userId, { roles: props.roles });
-    printKvBlock("Roles updated", [
-        ["User ID: ", data.id],
-        ["Roles:   ", props.roles.join(", ")],
-    ]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthUserRole(props.projectId, branchId, props.userId, { roles: props.roles });
+	printKvBlock("Roles updated", [["User ID: ", data.id], ["Roles:   ", props.roles.join(", ")]]);
 };
+//#endregion
+export { builder, command, describe, handler, neon_auth_exports as t };