neon 3.5.1 → 4.0.0

package/README.md

@@ -720,8 +720,7 @@ That message reports where parsing stopped and nothing more. `--data` carries wh
 | `--data <json>` | Route to one phase, with that phase's options |
 | `--skip-migrations` | Leave the migrations phase out of the flow |
 | `--preview` | Enable preview features (scaffolding a project from a template) |
-
-`neon init` refuses `--profile`; see [Which credential an invocation uses](#which-credential-an-invocation-uses).
+| `--profile <name>` | Run as that stored account. See [Which credential an invocation uses](#which-credential-an-invocation-uses). |
 
 ## Snapshots (`snapshots`)
 
@@ -842,22 +841,18 @@ neon profile remove work
 ```console
 $ neon profile list
 Profiles
-┌────────┬─────────┬───────────────────────┬─────────┬────────────────┬──────┬─────────┬────────────────────────┐
-│ Active │ Name    │ Account               │ Auth    │ Scope          │ File │ Storage │ Credentials            │
-├────────┼─────────┼───────────────────────┼─────────┼────────────────┼──────┼─────────┼────────────────────────┤
-│ *      │ DEFAULT │ me@example.com        │ oauth   │ -              │ ok   │ file    │ credentials.json       │
-├────────┼─────────┼───────────────────────┼─────────┼────────────────┼──────┼─────────┼────────────────────────┤
-│        │ work    │ me@example.com        │ api key │ account        │ ok   │ keyring │ keyring                │
-├────────┼─────────┼───────────────────────┼─────────┼────────────────┼──────┼─────────┼────────────────────────┤
-│        │ ci      │ org-abc-123           │ api key │ project proj-1 │ ok   │ file    │ credentials.ci.json    │
-└────────┴─────────┴───────────────────────┴─────────┴────────────────┴──────┴─────────┴────────────────────────┘
+Active  Name     Account         Auth     Credentials          Scope
+*       DEFAULT  me@example.com  oauth    credentials.json     account
+        work     me@example.com  api key  keyring              account
+        ci       org-abc-123     api key  credentials.ci.json  project proj-1
 ```
 
-`Scope` is what a key can reach; an OAuth session has none of its own, so it shows `-`. `File`
-says whether the stored credential can be read — `ok`, `invalid` or `missing` for a file;
-`ok`, `invalid` or `unreadable` for a keyring item. A keyring get of null is `unreadable`, not missing:
-the addon cannot tell those apart. `Storage` is `file` or `keyring`, from the profile's
-pointer. The table shows the file name or `keyring`; `--output json` keeps the full path.
+`Scope` is what the credential can reach. An OAuth session and an unscoped user API key both
+show `account`. A project or org key names that project or org. `Credentials` is the path
+relative to the config directory, or `keyring`. A path outside the config directory is shown
+absolute. `--output json` keeps the absolute path, and also includes `file` (`ok`, `invalid`,
+`missing`, or `unreadable`) and `storage` (`file` or `keyring`). A keyring get of null is
+`unreadable`, not missing: the addon cannot tell those apart.
 
 Select one per invocation with `--profile`, or per shell with `NEON_PROFILE`. There is no `profile use` command and nothing is stored about which profile is "current", so what you type is always what runs.
 
@@ -999,7 +994,7 @@ When both are only environment variables the key wins, which keeps a CI pipeline
 
 `neon auth` and the `profile` subcommands are outside all of this, because they read the same flags to mean something else: `neon auth --profile work` names where to write a credential, and `neon profile create work --api-key …` names one to store.
 
-`neon init` does not support `--profile` yet. It runs its own auth flow, which reads the default credentials directly and re-invokes the CLI as a subprocess without passing a profile down, so passing the flag fails instead of quietly running as the default account. `--api-key` and `NEON_API_KEY` reach `neon init` no better and are **not** refused. The flow reads the stored credential and nothing else, so a supplied key is ignored: with a credential on disk `neon init` runs silently as *that* account, and with none it sends you to a browser sign-in. The silent case is the one to watch — it is the same failure `--profile` is refused for, without the refusal. Until that is fixed, sign in as the account you want first, or use another command.
+`neon init` follows the same profile selection: `--profile` and `NEON_PROFILE` pick the stored account. Every `npx neon` it runs, and every command it tells an agent to run (`npx neon …`, `neon init --agent …`), includes `--profile <name>` when a profile was named by `--profile` or `NEON_PROFILE`, and `--config-dir <path>` when you passed `--config-dir`; nothing is added when those were not set. It still ignores `--api-key` and `NEON_API_KEY` for its own credential read and runs as that stored profile (`DEFAULT` when a key was named with no profile). Those keys are also not written onto the emitted commands — putting a key in agent JSON would print it. An ambient `NEON_API_KEY` is inherited by the subprocesses.
 
 ## API keys (`api-keys`)
 
@@ -1014,16 +1009,14 @@ neon api-keys create --name agent --project-id frosty-…   # can access only th
 neon api-keys revoke <id> [--org-id org-…]
 ```
 
-The key is returned once, on create, and cannot be retrieved again. It prints on its own line below the table, so it can be selected in one gesture regardless of terminal width — and `… | tail -1` on stdout yields exactly the key, since both notices go to stderr.
+The key is returned once, on create, and cannot be retrieved again. It prints on its own line below the metadata, so it can be selected in one gesture regardless of terminal width — and `… | tail -1` on stdout yields exactly the key, since both notices go to stderr.
 
 ```console
 $ neon api-keys create --name agent --project-id proj-in-org
 API key
-┌─────┬───────┬─────────────┐
-│ Id  │ Name  │ Project     │
-├─────┼───────┼─────────────┤
-│ 303 │ agent │ proj-in-org │
-└─────┴───────┴─────────────┘
+Id       303
+Name     agent
+Project  proj-in-org
 
 napi_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 WARNING: Store this key now: it is not shown again.
@@ -1062,13 +1055,9 @@ NEON_API_KEY=napi_… neon deploy       # then the agent, reaching only that pro
 ```console
 $ neon api-keys list --org-id org-7
 API keys in org-7
-┌─────┬──────────┬────────────────┬──────────────────────┬──────────────────────┬─────────────────────┐
-│ Id  │ Name     │ Project        │ Created At           │ Last Used At         │ Last Used From Addr │
-├─────┼──────────┼────────────────┼──────────────────────┼──────────────────────┼─────────────────────┤
-│ 301 │ scoped   │ proj-in-org    │ 2026-01-02T00:00:00Z │                      │                     │
-├─────┼──────────┼────────────────┼──────────────────────┼──────────────────────┼─────────────────────┤
-│ 302 │ org-wide │ (all projects) │ 2026-01-03T00:00:00Z │ 2026-02-03T00:00:00Z │ 203.0.113.9         │
-└─────┴──────────┴────────────────┴──────────────────────┴──────────────────────┴─────────────────────┘
+Id   Name      Project         Created At            Last Used At          Last Used From Addr
+301  scoped    proj-in-org     2026-01-02T00:00:00Z
+302  org-wide  (all projects)  2026-01-03T00:00:00Z  2026-02-03T00:00:00Z  203.0.113.9
 ```
 
 `last_used_at` and `last_used_from_addr` are how you spot a key worth revoking.

package/dist/_chunks/{auth_selection-CV_3n1du.js → auth_selection-Bx2NAgkk.js}

@@ -40,7 +40,9 @@ import "./profiles-CVXNvU2r.js";
 let inputs = {
 	apiKeyFlag: "",
 	apiKeyEnv: "",
-	profileEnv: ""
+	profileEnv: "",
+	profileFlag: "",
+	configDir: ""
 };
 const recordCredentialInputs = (recorded) => {
 	inputs = recorded;

package/dist/api.js

@@ -796,7 +796,7 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 			},
 			body: data
 		})),
-		sendNeonAuthTestEmail: (projectId, branchId, data) => call(() => raw.sendNeonAuthTestEmail({
+		sendNeonAuthEmailProviderTest: (projectId, branchId, data) => call(() => raw.sendNeonAuthEmailProviderTest({
 			client,
 			path: {
 				project_id: projectId,

package/dist/commands/api_keys.js

@@ -171,13 +171,8 @@ const create = async (props) => {
 	log.info("Limited to %s: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.", scopeTo);
 };
 /**
-* Print the issued key.
-*
-* In a terminal the secret goes on its own line rather than into a table cell: `cli-table`
-* neither wraps nor truncates, so a 50-odd character key makes the row wider than most
-* terminals and the wrapped remainder ends up beside box-drawing characters. Since this is
-* the only time the key is ever shown, it has to be selectable in one gesture. Structured
-* output keeps the key in the object, where a script expects it.
+* The key is shown only once, so human output keeps it on a selectable line.
+* Structured output keeps it in the object for scripts.
 */
 const report = (props, data, fields, tableFields) => {
 	const out = writer(props);

package/dist/commands/auth.js

@@ -9,7 +9,7 @@ import { setAuthContext } from "../auth_context.js";
 import { isConfigInit, isCurrentBranchProbe, isProfileCommand } from "../context.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { auth, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
 import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";

package/dist/commands/bootstrap.js

@@ -2,7 +2,7 @@ import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
 import { BootstrapInputError, FALLBACK_TEMPLATES, ensureTargetUsable, fetchTemplates, findTemplate, scaffoldTemplate, templateIds } from "../init/bootstrap.js";
 import { DO_NOT_SUBSTITUTE_HINT, formatInstallCommand, inferPackageManager, installArgs, installedPackageManagers, resolvePackageManager, runCommand } from "../utils/package_manager.js";
 import { existsSync } from "node:fs";

package/dist/commands/init.js

@@ -1,6 +1,5 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { closeAnalytics, sendError } from "../analytics.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
 import { detectAgent } from "../init/detect_agent.js";
 import { enrichResponse } from "../init/enrich_output.js";
 import { interactiveInit } from "../init/interactive.js";
@@ -62,11 +61,6 @@ const handler = async (argv) => {
 	const agent = (argv.agent || !process.stdin.isTTY ? detectAgent() : null) || void 0;
 	const isAgentMode = argv.agent || agent !== void 0;
 	try {
-		const selectedProfile = argv.profile?.trim() || credentialInputs().profileEnv.trim();
-		if (selectedProfile) {
-			const how = argv.profile?.trim() ? "--profile was passed, so" : "NEON_PROFILE is set, so";
-			throw new Error(`${how} \`neon init\` would run as the default account instead of "${selectedProfile}", and it does not support profile selection yet. Run it without one, or set the project up with \`neon --profile ${selectedProfile} link\`.`);
-		}
 		if (argv.data && isAgentMode) {
 			let data;
 			try {

package/dist/commands/neon_auth.js

@@ -1,6 +1,7 @@
 import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
+import { noPassthrough, single } from "../utils/flags.js";
 import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
 import chalk from "chalk";
@@ -241,43 +242,17 @@ const builder = (argv) => {
 				}
 			}), async (args) => {
 				await emailProviderUpdate(args);
-			}).command("test", "Send a test email", (yargs) => yargs.options({
-				"recipient-email": {
-					describe: "Email address to send test email to",
-					type: "string",
-					demandOption: true
-				},
-				host: {
-					describe: "SMTP host",
-					type: "string",
-					demandOption: true
-				},
-				port: {
-					describe: "SMTP port",
-					type: "number",
-					demandOption: true
-				},
-				username: {
-					describe: "SMTP username",
-					type: "string",
-					demandOption: true
-				},
-				password: {
-					describe: "SMTP password",
-					type: "string",
-					demandOption: true
-				},
-				"sender-email": {
-					describe: "Sender email address",
-					type: "string",
-					demandOption: true
-				},
-				"sender-name": {
-					describe: "Sender display name",
-					type: "string",
-					demandOption: true
-				}
-			}), async (args) => {
+			}).command("test", "Send a test message through the saved custom SMTP provider", (yargs) => yargs.options({ "recipient-email": {
+				describe: "Email address to deliver the test message to",
+				type: "string",
+				demandOption: true,
+				coerce: single("recipient-email", { required: true })
+			} }).strict().check(noPassthrough("neon-auth config email-provider test")).epilogue([
+				"Save the provider first with",
+				"`neon neon-auth config email-provider update --type standard`.",
+				"A shared provider, a missing configuration, or a",
+				"non-Better-Auth integration is rejected by the API."
+			].join("\n")), async (args) => {
 				await emailProviderTest(args);
 			});
 		}).command("organization", "Manage organization plugin settings", (yargs) => {
@@ -663,18 +638,21 @@ const emailProviderUpdate = async (props) => {
 };
 const emailProviderTest = async (props) => {
 	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.sendNeonAuthTestEmail(props.projectId, branchId, {
-		recipient_email: props.recipientEmail,
-		host: props.host,
-		port: props.port,
-		username: props.username,
-		password: props.password,
-		sender_email: props.senderEmail,
-		sender_name: props.senderName
-	});
-	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: TEST_EMAIL_FIELDS });
-	else if (data.success) printMessage("Test email sent successfully");
-	else process.stdout.write(`\n${chalk.red("Test email failed")}\n  ${data.error_message ?? "Unknown error"}\n\n`);
+	const { data } = await props.apiClient.sendNeonAuthEmailProviderTest(props.projectId, branchId, { recipient_email: props.recipientEmail });
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: TEST_EMAIL_FIELDS });
+		if (!data.success) throw new Error(emailProviderTestFailureMessage(props.recipientEmail, data.error_message));
+		return;
+	}
+	if (data.success) {
+		printMessage(`Test email dispatched to ${props.recipientEmail} using the custom SMTP provider saved on this branch.`);
+		return;
+	}
+	throw new Error(emailProviderTestFailureMessage(props.recipientEmail, data.error_message));
+};
+const emailProviderTestFailureMessage = (recipientEmail, errorMessage) => {
+	const header = `Test email could NOT be sent to ${recipientEmail} using the custom SMTP provider saved on this branch.`;
+	return errorMessage ? `${header}\nUpstream error: ${errorMessage}` : header;
 };
 const printOrganizationEntries = (data) => [
 	["Enabled:          ", String(data.enabled)],

package/dist/commands/profile.js

@@ -7,7 +7,7 @@ import { getApiClient, isNeonApiError } from "../api.js";
 import { o as isOwnedCredentialPath, r as credentialsPath } from "../_chunks/paths-g3DRqJiD.js";
 import { setAuthContext } from "../auth_context.js";
 import { auth, revokeToken } from "../auth.js";
-import { t as credentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
+import { t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
 import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
 import { authFlow, usableCredential } from "./auth.js";
 import { writer } from "../writer.js";
@@ -15,7 +15,7 @@ import { noPassthrough, single } from "../utils/flags.js";
 import { orgIdForProject } from "./api_keys.js";
 import { identityFromAuthDetails, isApiKeyMethod, mintedKeyName, notAnApiKeyMessage } from "../profile_keys.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
-import { basename } from "node:path";
+import { isAbsolute, relative } from "node:path";
 import prompts from "prompts";
 //#region src/commands/profile.ts
 var profile_exports = /* @__PURE__ */ __exportAll({
@@ -173,10 +173,10 @@ const list = async (props) => {
 			name: p.name,
 			account: p.label ?? p.userId ?? storedUserId ?? "-",
 			auth,
-			scope: stored !== null && auth === "api key" ? describeScope(scopeOf(stored)) : "-",
+			scope: auth === "oauth" ? describeScope({}) : stored !== null && auth === "api key" ? describeScope(scopeOf(stored)) : "-",
 			file,
 			storage,
-			...props.output === "table" ? { credentials: p.storage === "keyring" ? KEYRING_CREDENTIALS : basename(p.credentialsPath) } : { credentials: credentialsDisplay(p) }
+			credentials: props.output === "table" ? credentialsListValue(p, props.configDir) : credentialsDisplay(p)
 		};
 	});
 	writer(props).end(rows, {
@@ -186,13 +186,17 @@ const list = async (props) => {
 			"name",
 			"account",
 			"auth",
-			"scope",
-			"file",
-			"storage",
-			"credentials"
+			"credentials",
+			"scope"
 		]
 	});
 };
+const credentialsListValue = (profile, configDir) => {
+	if (profile.storage === "keyring") return KEYRING_CREDENTIALS;
+	const rel = relative(configDir, profile.credentialsPath);
+	if (rel.startsWith("..") || isAbsolute(rel)) return profile.credentialsPath;
+	return rel;
+};
 const locationForCreate = (configDir, name, keyring) => {
 	assertProfilesUsable(configDir, name);
 	const declared = readProfiles(configDir)?.profiles[name];

package/dist/human_table.js

@@ -0,0 +1,239 @@
+import { isObject } from "./utils/string.js";
+import chalk from "chalk";
+//#region src/human_table.ts
+const GUTTER = 2;
+const MIN_COL = 3;
+const ELLIPSIS = "...";
+const ANSI_RE = /\u001b\[[0-9;]*m/g;
+function resolveOutputWidth(out, override, deps = {}) {
+	if (override === null) return;
+	if (typeof override === "number" && Number.isFinite(override) && override > 0) return Math.floor(override);
+	if ("columns" in out) {
+		const columns = Reflect.get(out, "columns");
+		if (typeof columns === "number" && Number.isFinite(columns) && columns > 0) return Math.floor(columns);
+	}
+	const stdout = deps.stdout;
+	if (stdout !== void 0 && out === stdout) return parseColumns(deps.envColumns);
+}
+function parseColumns(value) {
+	if (value === void 0 || value === "") return;
+	if (!/^\d+$/.test(value)) return;
+	const n = Number(value);
+	if (!Number.isFinite(n) || n <= 0) return;
+	return n;
+}
+function displayWidth(s) {
+	const plain = s.replace(ANSI_RE, "");
+	let width = 0;
+	for (const char of plain) {
+		const code = char.codePointAt(0);
+		if (code === void 0) continue;
+		width += charWidth(code);
+	}
+	return width;
+}
+function formatHumanChunk(chunk) {
+	const arrayData = Array.isArray(chunk.data) ? chunk.data : [chunk.data];
+	const isList = Array.isArray(chunk.data);
+	if (!arrayData.length && chunk.emptyMessage) return `\n${chunk.emptyMessage}\n`;
+	let out = "";
+	if (chunk.title) {
+		if (chunk.leadingBlank) out += "\n";
+		out += formatTitle(chunk.title, chunk.colorTitle) + "\n";
+	}
+	if (!arrayData.length) return out;
+	const fields = chunk.fields.filter((field) => arrayData.some((item) => {
+		const value = fieldValue(item, field);
+		return value !== void 0 && value !== "";
+	}));
+	if (!fields.length) return out;
+	const headers = fields.map(titleCaseField);
+	const rows = arrayData.map((item) => fields.map((field) => cellText(item, field, chunk.renderColumns)));
+	const body = isList ? formatList(headers, rows, chunk.width) : formatStacked(headers, rows, chunk.width);
+	if (body) out += body + "\n";
+	return out;
+}
+function formatTitle(title, colorTitle) {
+	return colorTitle ? chalk.bold(title) : title;
+}
+function formatList(headers, rows, width) {
+	if (headers.length === 1) return formatOneColumn(headers[0] ?? "", rows.map((row) => row[0] ?? ""));
+	if (width === void 0) return formatColumns(headers, rows, naturalWidths(headers, rows));
+	for (let n = headers.length; n >= 2; n--) {
+		const subsetHeaders = headers.slice(0, n);
+		const subsetRows = rows.map((row) => row.slice(0, n));
+		const natural = naturalWidths(subsetHeaders, subsetRows);
+		if (rowWidth(natural) <= width) return formatColumns(subsetHeaders, subsetRows, natural);
+		const fitted = tryFit(subsetHeaders, subsetRows, width);
+		if (fitted === void 0) continue;
+		if (!natural.slice(0, n - 1).every((col, i) => fitted[i] === col)) continue;
+		return formatColumns(subsetHeaders.map((cell, i) => truncateTo(cell, fitted[i] ?? 0)), subsetRows.map((row) => row.map((cell, i) => truncateTo(cell, fitted[i] ?? 0))), fitted);
+	}
+	return formatStacked(headers, rows, width);
+}
+function rowWidth(widths) {
+	if (widths.length === 0) return 0;
+	return widths.reduce((sum, col) => sum + col, 0) + (widths.length - 1) * GUTTER;
+}
+function formatOneColumn(header, values) {
+	const lines = [chalk.green(header)];
+	for (const value of values) lines.push(value);
+	return lines.join("\n");
+}
+function formatColumns(headers, rows, widths) {
+	const joinRow = (cells) => cells.map((cell, i) => {
+		const width = widths[i] ?? 0;
+		return i === cells.length - 1 ? truncateTo(cell, width) : padEndWidth(cell, width);
+	}).join(" ".repeat(GUTTER)).trimEnd();
+	const lines = [chalk.green(joinRow(headers))];
+	for (const row of rows) lines.push(joinRow(row));
+	return lines.join("\n");
+}
+function formatStacked(headers, rows, width) {
+	const naturalLabel = Math.max(0, ...headers.map((header) => displayWidth(header)));
+	let labelWidth = naturalLabel;
+	if (width !== void 0) {
+		const maxLabel = width - GUTTER - MIN_COL;
+		labelWidth = maxLabel < 1 ? Math.min(naturalLabel, width) : Math.min(naturalLabel, maxLabel);
+	}
+	return rows.map((row) => headers.map((header, i) => stackedLine(header, row[i] ?? "", labelWidth)).join("\n")).join("\n\n");
+}
+function stackedLine(header, value, labelWidth) {
+	return `${padEndWidth(header, labelWidth)}${" ".repeat(GUTTER)}${value}`;
+}
+function tryFit(headers, rows, width) {
+	const n = headers.length;
+	if (n === 0) return [];
+	const gutters = (n - 1) * GUTTER;
+	if (width <= gutters) return;
+	const budget = width - gutters;
+	if (budget < n * MIN_COL) return;
+	const widths = naturalWidths(headers, rows);
+	let overflow = widths.reduce((sum, col) => sum + col, 0) - budget;
+	if (overflow <= 0) return widths;
+	for (let i = n - 1; i >= 0 && overflow > 0; i--) {
+		const current = widths[i] ?? 0;
+		const take = Math.min(Math.max(current - MIN_COL, 0), overflow);
+		widths[i] = current - take;
+		overflow -= take;
+	}
+	if (overflow > 0) return;
+	return widths;
+}
+function naturalWidths(headers, rows) {
+	return headers.map((header, i) => Math.max(displayWidth(header), ...rows.map((row) => displayWidth(row[i] ?? ""))));
+}
+function padEndWidth(s, width) {
+	const clipped = truncateTo(s, width);
+	const pad = width - displayWidth(clipped);
+	return pad > 0 ? clipped + " ".repeat(pad) : clipped;
+}
+function truncateTo(s, max) {
+	if (max <= 0) return "";
+	if (displayWidth(s) <= max) return s;
+	if (max <= 3) return ELLIPSIS.slice(0, max);
+	const budget = max - 3;
+	let out = "";
+	let used = 0;
+	for (const char of s.replace(ANSI_RE, "")) {
+		const code = char.codePointAt(0);
+		if (code === void 0) continue;
+		const w = charWidth(code);
+		if (used + w > budget) break;
+		out += char;
+		used += w;
+	}
+	return out + ELLIPSIS;
+}
+function cellText(item, field, renderColumns) {
+	if (renderColumns) {
+		const render = Reflect.get(renderColumns, field);
+		if (typeof render === "function") return flattenCell(render(item));
+	}
+	return flattenCell(fieldValue(item, field));
+}
+function fieldValue(item, field) {
+	if (item === null || typeof item !== "object") return;
+	return Reflect.get(item, field);
+}
+function flattenCell(value) {
+	if (value === void 0 || value === null) return "";
+	if (Array.isArray(value)) return value.map((entry) => flattenCell(entry)).join(", ");
+	if (isObject(value)) return JSON.stringify(value);
+	return String(value).replace(/\s+/g, " ").trim();
+}
+function titleCaseField(field) {
+	return field.split("_").map((word) => word ? word[0]?.toUpperCase() + word.slice(1) : word).join(" ");
+}
+const WIDE_RANGES = [
+	[4352, 4447],
+	[8986, 8987],
+	[9001, 9002],
+	[9193, 9196],
+	[9200, 9200],
+	[9203, 9203],
+	[9725, 9726],
+	[9748, 9749],
+	[9800, 9811],
+	[9855, 9855],
+	[9875, 9875],
+	[9889, 9889],
+	[9898, 9899],
+	[9917, 9918],
+	[9924, 9925],
+	[9934, 9934],
+	[9940, 9940],
+	[9962, 9962],
+	[9970, 9971],
+	[9973, 9973],
+	[9978, 9978],
+	[9981, 9981],
+	[9989, 9989],
+	[9994, 9995],
+	[10024, 10024],
+	[10060, 10060],
+	[10062, 10062],
+	[10067, 10069],
+	[10071, 10071],
+	[10133, 10135],
+	[10160, 10160],
+	[10175, 10175],
+	[11035, 11036],
+	[11088, 11088],
+	[11093, 11093],
+	[11904, 12350],
+	[12352, 42191],
+	[43360, 43391],
+	[44032, 55203],
+	[55216, 55295],
+	[63744, 64255],
+	[65040, 65049],
+	[65072, 65135],
+	[65280, 65376],
+	[65504, 65510],
+	[126976, 129791],
+	[131072, 196605],
+	[196608, 262141]
+];
+function charWidth(code) {
+	if (code >= 768 && code <= 879) return 0;
+	let lo = 0;
+	let hi = WIDE_RANGES.length - 1;
+	while (lo <= hi) {
+		const mid = lo + hi >> 1;
+		const range = WIDE_RANGES[mid];
+		if (range === void 0) break;
+		if (code < range[0]) {
+			hi = mid - 1;
+			continue;
+		}
+		if (code > range[1]) {
+			lo = mid + 1;
+			continue;
+		}
+		return 2;
+	}
+	return 1;
+}
+//#endregion
+export { displayWidth, formatHumanChunk, parseColumns, resolveOutputWidth };

package/dist/init/auth.js

@@ -1,6 +1,6 @@
-import { l as locationForName, t as DEFAULT_PROFILE } from "../_chunks/profiles-CVXNvU2r.js";
+import { l as locationForName } from "../_chunks/profiles-CVXNvU2r.js";
 import { l as interpretCredentials, t as storeFor } from "../_chunks/credential_io-D2vw1UOw.js";
-import { n as configDir } from "../_chunks/paths-g3DRqJiD.js";
+import { npxNeonArgs, selectedConfigDir, selectedProfileName } from "./profile_cli.js";
 import { log } from "@clack/prompts";
 import { execa } from "execa";
 //#region src/init/auth.ts
@@ -12,11 +12,7 @@ async function ensureNeonctlAuth(options) {
 	const quiet = options?.json === true;
 	if (await getNeonctlAccessToken()) return true;
 	try {
-		await execa("npx", [
-			"-y",
-			"neon",
-			"me"
-		], {
+		await execa("npx", npxNeonArgs(["me"]), {
 			stdio: "inherit",
 			env: {
 				...process.env,
@@ -44,8 +40,9 @@ async function isAuthenticated() {
 * Unreadable credentials throw so browser sign-in cannot overwrite them.
 */
 async function getNeonctlAccessToken() {
-	const at = locationForName(configDir(), DEFAULT_PROFILE);
-	const loaded = storeFor(configDir()).read(at);
+	const dir = selectedConfigDir();
+	const at = locationForName(dir, selectedProfileName());
+	const loaded = storeFor(dir).read(at);
 	if (loaded === null) return null;
 	const credential = interpretCredentials(loaded.credentials, at, loaded.backend);
 	if (credential.kind === "api_key") return credential.apiKey;

package/dist/init/enrich_output.js

@@ -1,3 +1,4 @@
+import { neonInitAgentCmd } from "./profile_cli.js";
 //#region src/init/enrich_output.ts
 /**
 * Converts a phase's `args` (e.g. ["neon-auth", "--json", "--setup"]) into the
@@ -14,11 +15,15 @@ function argsToCommand(args) {
 		const arg = args[i];
 		if (arg.startsWith("--")) {
 			const key = arg.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+			const next = args[i + 1];
 			if (key === "json") {
 				i += 1;
 				continue;
 			}
-			const next = args[i + 1];
+			if (key === "profile" || key === "configDir") {
+				i += next !== void 0 && !next.startsWith("-") ? 2 : 1;
+				continue;
+			}
 			if (next !== void 0 && !next.startsWith("-")) {
 				data[key] = next;
 				i += 2;
@@ -28,7 +33,7 @@ function argsToCommand(args) {
 			}
 		} else i += 1;
 	}
-	return `neon init --agent --data '${JSON.stringify(data)}'`;
+	return neonInitAgentCmd(data);
 }
 /**
 * Walks a phase response object and:

package/dist/init/interactive.js

@@ -1,5 +1,6 @@
 import { FALLBACK_TEMPLATES, fetchTemplates, scaffoldTemplate } from "./bootstrap.js";
 import { detectAgent, detectIde } from "./detect_agent.js";
+import { neonInitAgentCmd } from "./profile_cli.js";
 import { agentSupportsProjectMcp, detectInstalledAgents, getAgentDisplayName, getSkillsAgentName, mcpPickerOptions, tryResolveAddMcpAgentId } from "./agents.js";
 import { ensureNeonctlAuth, isAuthenticated } from "./auth.js";
 import { installExtension, isExtensionInstalled } from "./extension.js";
@@ -266,7 +267,7 @@ async function interactiveInitInner(options) {
 			initialValue: "no"
 		});
 		if (isCancel(authResult) || authResult === "no") {
-			outro(dim(`Your project is configured with Neon. You can set up Neon Auth later by having your agent run: neon init --agent --data '{"step":"neon-auth"}'`));
+			outro(dim(`Your project is configured with Neon. You can set up Neon Auth later by having your agent run: ${neonInitAgentCmd({ step: "neon-auth" })}`));
 			return;
 		}
 		let projectId = null;
@@ -480,10 +481,10 @@ async function interactiveInitInner(options) {
 	if (inspection.migrationDir && inspection.migrationDir !== "none") gettingStartedData.migrationDir = inspection.migrationDir;
 	if (selectedFeatures.length > 0) gettingStartedData.features = selectedFeatures;
 	if (options.preview) gettingStartedData.preview = true;
-	const cmd = `neon init --agent --data '${JSON.stringify({
+	const cmd = neonInitAgentCmd({
 		step: "getting-started",
 		...gettingStartedData
-	})}'`;
+	});
 	const cols = (process.stdout.columns || 80) - 3;
 	const promptText = `To finish setting up Neon using Neon's agent-guided onboarding experience, have your agent run this shell command: ${cmd}`;
 	log.step("Next steps");

package/dist/init/neonctl.js

@@ -1,21 +1,14 @@
 import { globalInstallCommand, resolveInvokingPackageManager } from "../utils/package_manager.js";
+import { explicitConfigDirCli, explicitProfileCli } from "./profile_cli.js";
 import { lstatSync } from "node:fs";
 import { execa } from "execa";
 //#region src/init/neonctl.ts
 /**
-* Returns the Neon CLI command prefix emitted to users and agents:
-* `CI= npx -y neon`.
-*
-* The CLI reads NEON_API_HOST and NEON_OAUTH_HOST from the environment
-* directly, so no extra flags are needed. The published package is `neon`
-* (its binary is `neon`; the older `neonctl` alias is no longer shipped). `npx`
-* runs it with zero global-install assumptions, and the leading `CI=` keeps the
-* CLI non-interactive.
-*
-* Usage: `${neonctlCmd()} orgs list --output json`
+* `npx -y neon` avoids global-install assumptions, and `CI=` keeps emitted calls
+* non-interactive. API and OAuth hosts stay ambient because the CLI reads them directly.
 */
 function neonctlCmd() {
-	return "CI= npx -y neon";
+	return `CI= npx -y neon${explicitProfileCli()}${explicitConfigDirCli()}`;
 }
 /**
 * The global binaries that indicate the Neon CLI is installed. The current

package/dist/init/phases/status.js

@@ -1,3 +1,4 @@
+import { neonInitAgentCmd } from "../profile_cli.js";
 import { supportsSkills, tryResolveAddMcpAgentId } from "../agents.js";
 import { isAuthenticated } from "../auth.js";
 import { inspectProject } from "../inspect.js";
@@ -35,23 +36,26 @@ async function handleStatusPhase(options) {
 	if (!authed) recommendations.push({
 		priority: "high",
 		message: "Not authenticated with Neon",
-		command: `neon init --agent --data '{"step":"auth"}'`
+		command: neonInitAgentCmd({ step: "auth" })
 	});
 	if (!hasDatabaseUrl) recommendations.push({
 		priority: "high",
 		message: "No DATABASE_URL found in .env",
-		command: `neon init --agent --data '{"step":"db"}'`
+		command: neonInitAgentCmd({ step: "db" })
 	});
 	const statusAgent = options.agent ? tryResolveAddMcpAgentId(options.agent) : void 0;
 	if (!skillsInstalled && (!statusAgent || supportsSkills(statusAgent))) recommendations.push({
 		priority: "medium",
 		message: "Neon agent skills not detected in this project",
-		command: `neon init --agent --data '{"step":"skills","install":true}'`
+		command: neonInitAgentCmd({
+			step: "skills",
+			install: true
+		})
 	});
 	if (migrationTool && !hasMigrations) recommendations.push({
 		priority: "medium",
 		message: `${migrationTool} detected but no migrations found`,
-		command: `neon init --agent --data '{"step":"migrations"}'`
+		command: neonInitAgentCmd({ step: "migrations" })
 	});
 	return {
 		auth: { authenticated: authed },

package/dist/init/profile_cli.js

@@ -0,0 +1,56 @@
+import { t as DEFAULT_PROFILE } from "../_chunks/profiles-CVXNvU2r.js";
+import { n as configDir } from "../_chunks/paths-g3DRqJiD.js";
+import { i as selectCredential, t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
+//#region src/init/profile_cli.ts
+/**
+* API-key selections fall back to DEFAULT because init authenticates from stored credentials.
+*/
+function selectedProfileName() {
+	const selection = selectCredential(credentialInputs());
+	return selection.source === "profile" ? selection.profile : DEFAULT_PROFILE;
+}
+/**
+* An explicit `--config-dir` must override `NEON_CONFIG_DIR` and the home path.
+*/
+function selectedConfigDir() {
+	const recorded = credentialInputs().configDir;
+	return recorded !== "" ? recorded : configDir();
+}
+/**
+* Omitting implicit DEFAULT preserves command compatibility; retaining explicit DEFAULT
+* prevents ambient `NEON_PROFILE` from overriding it in subprocesses.
+*/
+function explicitProfileArgs() {
+	const selection = selectCredential(credentialInputs());
+	if (selection.source === "profile" && selection.explicit) return ["--profile", selection.profile];
+	return [];
+}
+function explicitProfileCli() {
+	const args = explicitProfileArgs();
+	return args.length === 0 ? "" : ` ${args.join(" ")}`;
+}
+function explicitConfigDirArgs() {
+	const dir = credentialInputs().configDir;
+	return dir !== "" ? ["--config-dir", dir] : [];
+}
+function posixSingleQuote(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function explicitConfigDirCli() {
+	const dir = credentialInputs().configDir;
+	return dir === "" ? "" : ` --config-dir ${posixSingleQuote(dir)}`;
+}
+function npxNeonArgs(command) {
+	return [
+		"-y",
+		"neon",
+		...explicitProfileArgs(),
+		...explicitConfigDirArgs(),
+		...command
+	];
+}
+function neonInitAgentCmd(data) {
+	return `neon init --agent${explicitProfileCli()}${explicitConfigDirCli()} --data '${JSON.stringify(data)}'`;
+}
+//#endregion
+export { explicitConfigDirCli, explicitProfileArgs, explicitProfileCli, neonInitAgentCmd, npxNeonArgs, selectedConfigDir, selectedProfileName };

package/dist/init/resolve_context.js

@@ -1,3 +1,4 @@
+import { npxNeonArgs } from "./profile_cli.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { execa } from "execa";
@@ -40,14 +41,12 @@ async function resolveNeonContext(cwd) {
 	if (!neonHost) return null;
 	let orgs;
 	try {
-		const result = await execa("npx", [
-			"-y",
-			"neon",
+		const result = await execa("npx", npxNeonArgs([
 			"orgs",
 			"list",
 			"--output",
 			"json"
-		], {
+		]), {
 			stdio: "pipe",
 			timeout: 3e4,
 			env: {
@@ -63,16 +62,14 @@ async function resolveNeonContext(cwd) {
 	for (const org of orgs) {
 		let projects;
 		try {
-			const result = await execa("npx", [
-				"-y",
-				"neon",
+			const result = await execa("npx", npxNeonArgs([
 				"projects",
 				"list",
 				"--org-id",
 				org.id,
 				"--output",
 				"json"
-			], {
+			]), {
 				stdio: "pipe",
 				timeout: 3e4,
 				env: {
@@ -85,13 +82,11 @@ async function resolveNeonContext(cwd) {
 			continue;
 		}
 		for (const project of projects) try {
-			if ((await execa("npx", [
-				"-y",
-				"neon",
+			if ((await execa("npx", npxNeonArgs([
 				"connection-string",
 				"--project-id",
 				project.id
-			], {
+			]), {
 				stdio: "pipe",
 				timeout: 15e3,
 				env: {

package/dist/utils/middlewares.js

@@ -1,6 +1,13 @@
-import { r as recordCredentialInputs } from "../_chunks/auth_selection-CV_3n1du.js";
+import { r as recordCredentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
 //#region src/utils/middlewares.ts
 /**
+* Forwarding Yargs's default would turn ambient configuration into an explicit child override.
+*/
+function configDirFromArgv(parsed) {
+	if (!process.argv.some((arg) => arg === "--config-dir" || arg.startsWith("--config-dir=")) || typeof parsed !== "string") return "";
+	return parsed;
+}
+/**
 * Resolves `--api-key` from `NEON_API_KEY` when the flag is absent, leaving it an
 * empty string when neither is set.
 *
@@ -20,7 +27,9 @@ const resolveApiKeyFromEnv = (args) => {
 	recordCredentialInputs({
 		apiKeyFlag: fromFlag,
 		apiKeyEnv: fromEnv,
-		profileEnv: process.env.NEON_PROFILE ?? ""
+		profileEnv: process.env.NEON_PROFILE ?? "",
+		profileFlag: typeof args.profile === "string" ? args.profile : "",
+		configDir: configDirFromArgv(args.configDir)
 	});
 	if (fromFlag !== "") return;
 	args.apiKey = fromEnv;

package/dist/writer.js

@@ -1,8 +1,7 @@
 import { isCi } from "./env.js";
-import { isObject, toSnakeCase } from "./utils/string.js";
-import chalk from "chalk";
+import { toSnakeCase } from "./utils/string.js";
+import { formatHumanChunk, resolveOutputWidth } from "./human_table.js";
 import YAML from "yaml";
-import Table from "cli-table";
 //#region src/writer.ts
 const writeYaml = (chunks) => {
 	return YAML.stringify(chunks.length === 1 ? chunks[0].data : Object.fromEntries(chunks.map(({ config, data }, idx) => [config.title ? toSnakeCase(config.title) : idx, data])), null, 2);
@@ -10,28 +9,18 @@ const writeYaml = (chunks) => {
 const writeJson = (chunks) => {
 	return JSON.stringify(chunks.length === 1 ? chunks[0].data : Object.fromEntries(chunks.map(({ config, data }, idx) => [config.title ? toSnakeCase(config.title) : idx, data])), null, 2);
 };
-const writeTable = (chunks, out) => {
-	chunks.forEach(({ data, config: { emptyMessage, fields, title, renderColumns = {} } }) => {
-		const arrayData = Array.isArray(data) ? data : [data];
-		if (!arrayData.length && emptyMessage) {
-			out.write("\n" + emptyMessage + "\n");
-			return;
-		}
-		const fieldsFiltered = fields.filter((field) => arrayData.some((item) => item[field] !== void 0 && item[field] !== ""));
-		const table = new Table({
-			style: { head: ["green"] },
-			head: fieldsFiltered.map((field) => field.split("_").map((word) => word[0].toUpperCase() + word.slice(1)).join(" "))
-		});
-		arrayData.forEach((item) => {
-			table.push(fieldsFiltered.map((field) => {
-				const value = item[field];
-				if (renderColumns[field]) return renderColumns[field]?.(item);
-				return Array.isArray(value) ? value.join("\n") : isObject(value) ? JSON.stringify(value, null, 2) : value ?? "";
-			}));
-		});
-		if (title) out.write((isCi() ? title : chalk.bold(title)) + "\n");
-		out.write(table.toString());
-		out.write("\n");
+const writeTable = (chunks, out, width) => {
+	chunks.forEach(({ data, config }, i) => {
+		out.write(formatHumanChunk({
+			data,
+			fields: config.fields,
+			title: config.title,
+			emptyMessage: config.emptyMessage,
+			renderColumns: config.renderColumns,
+			width,
+			colorTitle: !isCi(),
+			leadingBlank: i > 0 && Boolean(config.title)
+		}));
 	});
 };
 /**
@@ -50,6 +39,10 @@ const writeTable = (chunks, out) => {
 */
 const writer = (props) => {
 	const out = props.out ?? process.stdout;
+	const width = resolveOutputWidth(out, props.columns, {
+		stdout: process.stdout,
+		envColumns: process.env.COLUMNS
+	});
 	const chunks = [];
 	return {
 		write(data, config) {
@@ -69,7 +62,7 @@ const writer = (props) => {
 			});
 			if (props.output == "yaml") return out.write(writeYaml(chunks));
 			if (props.output == "json") return out.write(writeJson(chunks));
-			writeTable(chunks, out);
+			writeTable(chunks, out, width);
 		}
 	};
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "3.5.1",
+  "version": "4.0.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -49,7 +49,6 @@
     "add-mcp": "2.0.0",
     "chalk": "5.3.0",
     "chokidar": "5.0.0",
-    "cli-table": "0.3.11",
     "cliui": "8.0.1",
     "diff": "5.2.0",
     "execa": "^9.5.2",
@@ -64,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config-runtime": "1.0.1",
-    "@neon/config": "1.0.1",
-    "@neon/sdk": "2.1.0"
+    "@neon/config-runtime": "1.0.2",
+    "@neon/config": "1.0.2",
+    "@neon/sdk": "2.2.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -78,7 +77,6 @@
     "@rollup/plugin-json": "6.1.0",
     "@rollup/plugin-node-resolve": "15.2.3",
     "@testcontainers/postgresql": "^11.14.0",
-    "@types/cli-table": "0.3.4",
     "@types/diff": "5.2.1",
     "@types/express": "4.17.21",
     "@types/node": "^20.19.0",
@@ -98,8 +96,8 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/env-core": "0.0.1",
     "@neon-internals/cli-core": "0.0.0",
+    "@neon-internals/env-core": "0.0.2",
     "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {