neon 8.11.0 → 8.11.2

package/dist/commands/neon_auth.js

@@ -1,822 +1 @@
-import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
-import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
-import { stripAnsi } from "../human_table.js";
-import { writer } from "../writer.js";
-import { noPassthrough, single } from "../utils/flags.js";
-import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider } from "../utils/api_enums.js";
-import { branchIdFromProps, fillSingleProject, resolveBranchFromProps } from "../utils/enrichers.js";
-import chalk from "chalk";
-//#region src/commands/neon_auth.ts
-var neon_auth_exports = /* @__PURE__ */ __exportAll({
-	builder: () => builder,
-	command: () => command,
-	describe: () => describe,
-	handler: () => handler
-});
-const writeStyled = (text, stream = process.stdout) => {
-	stream.write(process.env.NO_COLOR ? stripAnsi(text) : text);
-};
-const printKvBlock = (title, entries) => {
-	const labels = entries.map(([key]) => key.trimEnd());
-	const width = Math.max(0, ...labels.map((label) => label.length));
-	let text = `\n${chalk.green(title)}\n`;
-	entries.forEach(([, value], i) => {
-		text += `  ${chalk.green(labels[i].padEnd(width))}  ${value ?? ""}\n`;
-	});
-	writeStyled(`${text}\n`);
-};
-const printMessage = (message) => {
-	writeStyled(`\n${chalk.green(message)}\n\n`);
-};
-const INTEGRATION_RESPONSE_FIELDS = [
-	"auth_provider",
-	"db_name",
-	"base_url",
-	"schema_name",
-	"table_name",
-	"jwks_url"
-];
-const INTEGRATION_STATUS_FIELDS = [
-	"auth_provider",
-	"branch_id",
-	"db_name",
-	"base_url",
-	"created_at",
-	"jwks_url"
-];
-const OAUTH_PROVIDER_FIELDS = [
-	"id",
-	"type",
-	"client_id"
-];
-const ALLOW_LOCALHOST_FIELDS = ["allow_localhost"];
-const SUPPORTED_OAUTH_PROVIDERS = [
-	NeonAuthOauthProviderId.Google,
-	NeonAuthOauthProviderId.Github,
-	NeonAuthOauthProviderId.Vercel
-];
-const DOMAIN_FIELDS = ["domain"];
-const EMAIL_PASSWORD_FIELDS = [
-	"enabled",
-	"email_verification_method",
-	"require_email_verification",
-	"auto_sign_in_after_verification",
-	"send_verification_email_on_sign_up",
-	"send_verification_email_on_sign_in",
-	"disable_sign_up"
-];
-const EMAIL_PROVIDER_FIELDS = [
-	"type",
-	"host",
-	"port",
-	"username",
-	"sender_email",
-	"sender_name"
-];
-const ORGANIZATION_FIELDS = [
-	"enabled",
-	"organization_limit",
-	"creator_role"
-];
-const WEBHOOK_FIELDS = [
-	"enabled",
-	"webhook_url",
-	"enabled_events",
-	"timeout_seconds"
-];
-const TEST_EMAIL_FIELDS = ["success", "error_message"];
-const command = "neon-auth";
-const describe = "Manage Neon Auth";
-const builder = (argv) => {
-	return argv.usage("$0 neon-auth <sub-command> [options]").options({
-		"project-id": {
-			describe: "Project ID",
-			type: "string"
-		},
-		branch: {
-			describe: "Branch ID or name",
-			type: "string"
-		}
-	}).middleware(fillSingleProject).command("enable", "Enable Neon Auth on a branch", (yargs) => yargs.options({ "database-name": {
-		describe: "Database name to use for auth data",
-		type: "string"
-	} }), async (args) => {
-		await enable(args);
-	}).command("status", "Get Neon Auth status for a branch", (yargs) => yargs, async (args) => {
-		await status(args);
-	}).command("disable", "Disable Neon Auth on a branch", (yargs) => yargs.options({ "delete-data": {
-		describe: "Permanently delete all Neon Auth data and schema from the database",
-		type: "boolean",
-		default: false
-	} }), async (args) => {
-		await disable(args);
-	}).command("oauth-provider", "Manage OAuth providers", (yargs) => {
-		return yargs.usage("$0 neon-auth oauth-provider <sub-command> [options]").command("list", "List OAuth providers", (yargs) => yargs, async (args) => {
-			await oauthProviderList(args);
-		}).command("add", "Add an OAuth provider", (yargs) => yargs.options({
-			"provider-id": {
-				describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
-				type: "string",
-				choices: SUPPORTED_OAUTH_PROVIDERS,
-				demandOption: true
-			},
-			"oauth-client-id": {
-				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			},
-			"oauth-client-secret": {
-				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			}
-		}), async (args) => {
-			await oauthProviderAdd(args);
-		}).command("update", "Update an OAuth provider", (yargs) => yargs.options({
-			"provider-id": {
-				describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
-				type: "string",
-				choices: SUPPORTED_OAUTH_PROVIDERS,
-				demandOption: true
-			},
-			"oauth-client-id": {
-				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			},
-			"oauth-client-secret": {
-				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			}
-		}), async (args) => {
-			await oauthProviderUpdate(args);
-		}).command("delete", "Delete an OAuth provider", (yargs) => yargs.options({ "provider-id": {
-			describe: `OAuth provider ID. Supported values: ${SUPPORTED_OAUTH_PROVIDERS.join(", ")}`,
-			type: "string",
-			choices: SUPPORTED_OAUTH_PROVIDERS,
-			demandOption: true
-		} }), async (args) => {
-			await oauthProviderDelete(args);
-		});
-	}).command("domain", "Manage redirect URI trusted domains", (yargs) => {
-		return yargs.usage("$0 neon-auth domain <sub-command> [options]").command("list", "List trusted domains", (yargs) => yargs, async (args) => {
-			await domainList(args);
-		}).command("add <domain>", "Add a trusted domain", (yargs) => yargs.usage("$0 neon-auth domain add <domain> [options]").positional("domain", {
-			describe: "Domain to add",
-			type: "string",
-			demandOption: true
-		}), async (args) => {
-			await domainAdd(args);
-		}).command("delete <domain>", "Delete a trusted domain", (yargs) => yargs.usage("$0 neon-auth domain delete <domain> [options]").positional("domain", {
-			describe: "Domain to delete",
-			type: "string",
-			demandOption: true
-		}), async (args) => {
-			await domainDelete(args);
-		}).command("allow-localhost", "Manage localhost connection settings", (yargs) => yargs.usage("$0 neon-auth domain allow-localhost <sub-command> [options]").command("get", "Get localhost connection setting", (yargs) => yargs, async (args) => {
-			await allowLocalhostGet(args);
-		}).command("enable", "Allow localhost connections", (yargs) => yargs, async (args) => {
-			await allowLocalhostEnable(args);
-		}).command("disable", "Restrict localhost connections", (yargs) => yargs, async (args) => {
-			await allowLocalhostDisable(args);
-		}));
-	}).command("config", "Manage Neon Auth configuration", (yargs) => {
-		return yargs.usage("$0 neon-auth config <sub-command> [options]").command("email-password", "Manage email and password authentication settings", (yargs) => {
-			return yargs.usage("$0 neon-auth config email-password <sub-command> [options]").command("get", "Get email and password config", (yargs) => yargs, async (args) => {
-				await emailPasswordGet(args);
-			}).command("update", "Update email and password config", (yargs) => yargs.options({
-				enabled: {
-					describe: "Enable email and password authentication",
-					type: "boolean"
-				},
-				"email-verification-method": {
-					describe: "Email verification method",
-					type: "string",
-					choices: Object.values(NeonAuthEmailVerificationMethod)
-				},
-				"require-email-verification": {
-					describe: "Require email verification before users can sign in",
-					type: "boolean"
-				},
-				"auto-sign-in-after-verification": {
-					describe: "Auto sign in users after verifying their email",
-					type: "boolean"
-				},
-				"send-verification-email-on-sign-up": {
-					describe: "Send verification email on sign up",
-					type: "boolean"
-				},
-				"send-verification-email-on-sign-in": {
-					describe: "Send verification email on sign in",
-					type: "boolean"
-				},
-				"disable-sign-up": {
-					describe: "Disable new user sign ups",
-					type: "boolean"
-				}
-			}), async (args) => {
-				await emailPasswordUpdate(args);
-			});
-		}).command("email-provider", "Manage email provider configuration", (yargs) => {
-			return yargs.usage("$0 neon-auth config email-provider <sub-command> [options]").command("get", "Get email provider config", (yargs) => yargs, async (args) => {
-				await emailProviderGet(args);
-			}).command("update", "Update email provider config", (yargs) => yargs.options({
-				type: {
-					describe: "Email provider type",
-					type: "string",
-					choices: ["standard", "shared"],
-					demandOption: true
-				},
-				host: {
-					describe: "SMTP host (required for standard)",
-					type: "string"
-				},
-				port: {
-					describe: "SMTP port (required for standard)",
-					type: "number"
-				},
-				username: {
-					describe: "SMTP username (required for standard)",
-					type: "string"
-				},
-				password: {
-					describe: "SMTP password (required for standard)",
-					type: "string"
-				},
-				"sender-email": {
-					describe: "Sender email address",
-					type: "string"
-				},
-				"sender-name": {
-					describe: "Sender display name",
-					type: "string"
-				}
-			}), async (args) => {
-				await emailProviderUpdate(args);
-			}).command("test", "Send a test message through the saved custom SMTP provider", (yargs) => yargs.options({ "recipient-email": {
-				describe: "Email address to deliver the test message to",
-				type: "string",
-				demandOption: true,
-				coerce: single("recipient-email", { required: true })
-			} }).strict().check(noPassthrough("neon-auth config email-provider test")).epilogue([
-				"Save the provider first with",
-				"`neon neon-auth config email-provider update --type standard`.",
-				"A shared provider, a missing configuration, or a",
-				"non-Better-Auth integration is rejected by the API."
-			].join("\n")), async (args) => {
-				await emailProviderTest(args);
-			});
-		}).command("organization", "Manage organization plugin settings", (yargs) => {
-			return yargs.usage("$0 neon-auth config organization <sub-command> [options]").command("get", "Get organization plugin config", (yargs) => yargs, async (args) => {
-				await organizationGet(args);
-			}).command("update", "Update organization plugin config", (yargs) => yargs.options({
-				enabled: {
-					describe: "Enable the organization plugin",
-					type: "boolean"
-				},
-				limit: {
-					describe: "Maximum number of organizations a user can create",
-					type: "number"
-				},
-				"creator-role": {
-					describe: "Role assigned to organization creator",
-					type: "string",
-					choices: ["admin", "owner"]
-				}
-			}), async (args) => {
-				await organizationUpdate(args);
-			});
-		}).command("webhook", "Manage webhook configuration", (yargs) => {
-			return yargs.usage("$0 neon-auth config webhook <sub-command> [options]").command("get", "Get webhook config", (yargs) => yargs, async (args) => {
-				await webhookGet(args);
-			}).command("update", "Update webhook config", (yargs) => yargs.options({
-				enabled: {
-					describe: "Enable webhooks",
-					type: "boolean",
-					demandOption: true
-				},
-				url: {
-					describe: "Webhook endpoint URL",
-					type: "string"
-				},
-				"enabled-events": {
-					describe: "Events to enable",
-					type: "string",
-					choices: [
-						"user.before_create",
-						"user.created",
-						"send.otp",
-						"send.magic_link"
-					],
-					array: true
-				},
-				timeout: {
-					describe: "Webhook timeout in seconds (1-10)",
-					type: "number"
-				}
-			}), async (args) => {
-				await webhookUpdate(args);
-			});
-		});
-	}).command("plugins", "View Neon Auth plugin configurations", (yargs) => {
-		return yargs.usage("$0 neon-auth plugins <sub-command> [options]").command("list", "List all plugin configurations", (yargs) => yargs, async (args) => {
-			await pluginsList(args);
-		}).command("get <plugin-name>", "Get a specific plugin configuration", (yargs) => yargs.usage("$0 neon-auth plugins get <plugin-name> [options]").positional("plugin-name", {
-			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, allow_localhost)",
-			type: "string",
-			demandOption: true
-		}), async (args) => {
-			await pluginsGet(args);
-		});
-	}).command("user", "Manage Neon Auth users", (yargs) => {
-		return yargs.usage("$0 neon-auth user <sub-command> [options]").command("create", "Create an auth user", (yargs) => yargs.options({
-			email: {
-				describe: "User email address",
-				type: "string",
-				demandOption: true
-			},
-			name: {
-				describe: "User display name (defaults to email if not provided)",
-				type: "string"
-			}
-		}), async (args) => {
-			await userCreate(args);
-		}).command("delete <user-id>", "Delete an auth user", (yargs) => yargs.usage("$0 neon-auth user delete <user-id> [options]").positional("user-id", {
-			describe: "ID of the user to delete",
-			type: "string",
-			demandOption: true
-		}), async (args) => {
-			await userDelete(args);
-		}).command("set-role <user-id>", "Set roles for an auth user", (yargs) => yargs.usage("$0 neon-auth user set-role <user-id> [options]").positional("user-id", {
-			describe: "ID of the user to update",
-			type: "string",
-			demandOption: true
-		}).options({ roles: {
-			describe: "Roles to assign",
-			type: "string",
-			array: true,
-			demandOption: true
-		} }), async (args) => {
-			await userSetRole(args);
-		});
-	});
-};
-const handler = (args) => {
-	return args;
-};
-const resolveBranch = async (props) => {
-	return props.branchId ?? await branchIdFromProps(props);
-};
-/** The branch name is only known when it was resolved from a listing, not from an id. */
-const resolveBranchWithName = async (props) => {
-	if (props.branchId) return { branchId: props.branchId };
-	const { branchId, branch } = await resolveBranchFromProps(props);
-	return {
-		branchId,
-		branchName: branch?.name
-	};
-};
-const enable = async (props) => {
-	const branchId = await resolveBranch(props);
-	let data;
-	let alreadyEnabled = false;
-	try {
-		({data} = await retryOnLock(() => props.apiClient.createNeonAuth(props.projectId, branchId, {
-			auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
-			database_name: props.databaseName
-		})));
-	} catch (err) {
-		if (!(isNeonApiError(err) && err.status === 409)) throw err;
-		try {
-			({data} = await props.apiClient.getNeonAuth(props.projectId, branchId));
-		} catch (readErr) {
-			if (isNeonApiError(readErr) && readErr.status === 404) throw err;
-			throw readErr;
-		}
-		alreadyEnabled = true;
-	}
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: INTEGRATION_RESPONSE_FIELDS });
-		return;
-	}
-	const d = data;
-	printKvBlock(alreadyEnabled ? "Neon Auth is already enabled" : "Neon Auth enabled", [
-		["Auth Provider:", data.auth_provider],
-		...d.db_name ? [["Database:", d.db_name]] : [],
-		["Base URL:", data.base_url],
-		...d.schema_name ? [["Schema Name:", d.schema_name]] : [],
-		...d.table_name ? [["Table Name:", d.table_name]] : [],
-		["JWKS URL:", data.jwks_url]
-	]);
-	if (data.base_url) {
-		writeStyled(`  ${chalk.green("Set this environment variable in your application:")}\n`);
-		writeStyled(`  NEON_AUTH_BASE_URL=${data.base_url}\n\n`);
-	}
-};
-const status = async (props) => {
-	const { branchId, branchName } = await resolveBranchWithName(props);
-	let data;
-	try {
-		({data} = await props.apiClient.getNeonAuth(props.projectId, branchId));
-	} catch (err) {
-		if (isNeonApiError(err) && err.status === 404) {
-			printMessage("Neon Auth is not configured for this branch");
-			return;
-		}
-		throw err;
-	}
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: INTEGRATION_STATUS_FIELDS });
-		return;
-	}
-	printKvBlock("Neon Auth status", [
-		["Auth Provider:", data.auth_provider],
-		["Branch:", branchName ? `${branchName} (${data.branch_id})` : data.branch_id],
-		["Database:", data.db_name],
-		["Base URL:", data.base_url],
-		["Created At:", data.created_at],
-		["JWKS URL:", data.jwks_url]
-	]);
-};
-const disable = async (props) => {
-	const branchId = await resolveBranch(props);
-	await retryOnLock(() => props.apiClient.disableNeonAuth(props.projectId, branchId, { delete_data: props.deleteData }));
-	printMessage("Neon Auth has been disabled");
-};
-const SHARED_PROVIDER_DISCLAIMER = "Shared keys are created by the Neon team for development only and should not be used for production apps. It helps you get started, but will show Neon branding (logo and name) on the OAuth consent screen.";
-const oauthProviderList = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.listBranchNeonAuthOauthProviders(props.projectId, branchId);
-	if (data.providers.length === 0 && props.output === "table") {
-		printMessage("No OAuth providers are configured for this branch.");
-		return;
-	}
-	writer(props).end(data.providers, { fields: OAUTH_PROVIDER_FIELDS });
-	if (data.providers.some((p) => p.type === NeonAuthOauthProviderType.Shared) && props.output === "table") writeStyled(`\n${chalk.yellow("Caution:")} ${SHARED_PROVIDER_DISCLAIMER}\n\n`);
-};
-const oauthProviderAdd = async (props) => {
-	const branchId = await resolveBranch(props);
-	const baseUrlRequest = callbackBaseUrl(props, branchId, props.providerId);
-	let data;
-	try {
-		({data} = await props.apiClient.addBranchNeonAuthOauthProvider(props.projectId, branchId, {
-			id: props.providerId,
-			client_id: props.oauthClientId,
-			client_secret: props.oauthClientSecret
-		}));
-	} catch (err) {
-		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
-		throw err;
-	}
-	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
-	else printKvBlock("OAuth provider added", [
-		["ID:", data.id],
-		["Type:", data.type],
-		...data.client_id ? [["Client ID:", data.client_id]] : []
-	]);
-	printCallbackInstructions(props.providerId, await baseUrlRequest);
-};
-const oauthProviderUpdate = async (props) => {
-	const branchId = await resolveBranch(props);
-	const baseUrlRequest = callbackBaseUrl(props, branchId, props.providerId);
-	let data;
-	try {
-		({data} = await props.apiClient.updateBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId, {
-			client_id: props.oauthClientId,
-			client_secret: props.oauthClientSecret
-		}));
-	} catch (err) {
-		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
-		throw err;
-	}
-	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
-	else printKvBlock("OAuth provider updated", [
-		["ID:", data.id],
-		["Type:", data.type],
-		...data.client_id ? [["Client ID:", data.client_id]] : []
-	]);
-	printCallbackInstructions(props.providerId, await baseUrlRequest);
-};
-const CALLBACK_INSTRUCTIONS = {
-	github: {
-		lead: "Create an OAuth app in the GitHub Developer Portal and add the following authorization callback URL:",
-		urlLabel: "callback/github"
-	},
-	vercel: {
-		lead: "Create a Vercel App in your Vercel Dashboard and add the following authorization callback URL:",
-		urlLabel: "callback/vercel"
-	},
-	google: {
-		lead: "Get Google credentials by creating an OAuth client in Google Cloud Console > Credentials, and add the following authorized redirect URL:",
-		urlLabel: "callback/google"
-	}
-};
-/**
-* Starts the base-URL read for the callback instructions, or resolves to undefined when none
-* apply. It runs alongside the provider write (adding a provider does not change the base URL)
-* and never rejects: a failed read prints no instructions, as before.
-*/
-const callbackBaseUrl = (props, branchId, providerId) => {
-	if (!CALLBACK_INSTRUCTIONS[providerId]) return Promise.resolve(void 0);
-	if (props.output === "json" || props.output === "yaml") return Promise.resolve(void 0);
-	return props.apiClient.getNeonAuth(props.projectId, branchId).then(({ data }) => data.base_url, () => void 0);
-};
-const printCallbackInstructions = (providerId, baseUrl) => {
-	const instructions = CALLBACK_INSTRUCTIONS[providerId];
-	if (!instructions || !baseUrl) return;
-	const callbackUrl = `${baseUrl.replace(/\/$/, "")}/${instructions.urlLabel}`;
-	printKvBlock(instructions.lead, [["URL:", callbackUrl]]);
-};
-const oauthProviderDelete = async (props) => {
-	const branchId = await resolveBranch(props);
-	await props.apiClient.deleteBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId);
-	printMessage(`OAuth provider "${props.providerId}" deleted`);
-};
-const domainList = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.listBranchNeonAuthTrustedDomains(props.projectId, branchId);
-	if (data.domains.length === 0 && props.output === "table") {
-		printMessage("No trusted domains are configured for this branch.");
-		return;
-	}
-	writer(props).end(data.domains, { fields: DOMAIN_FIELDS });
-};
-const validateDomainUri = (domain) => {
-	let url;
-	try {
-		url = new URL(domain);
-	} catch {
-		throw new Error(`Invalid domain URI "${domain}". Must be a full URI including scheme, e.g. https://${domain}`);
-	}
-	if (!["http:", "https:"].includes(url.protocol)) throw new Error(`Invalid domain URI "${domain}". Must use http or https scheme, e.g. https://${url.host}`);
-};
-const domainAdd = async (props) => {
-	validateDomainUri(props.domain);
-	const branchId = await resolveBranch(props);
-	await props.apiClient.addBranchNeonAuthTrustedDomain(props.projectId, branchId, {
-		domain: props.domain,
-		auth_provider: NeonAuthSupportedAuthProvider.BetterAuth
-	});
-	printMessage(`Domain "${props.domain}" added`);
-};
-const domainDelete = async (props) => {
-	validateDomainUri(props.domain);
-	const branchId = await resolveBranch(props);
-	const { data: existing } = await props.apiClient.listBranchNeonAuthTrustedDomains(props.projectId, branchId);
-	if (!existing.domains.some((d) => d.domain === props.domain)) throw new Error(`Domain "${props.domain}" is not in the trusted domains list.`);
-	await props.apiClient.deleteBranchNeonAuthTrustedDomain(props.projectId, branchId, {
-		auth_provider: NeonAuthSupportedAuthProvider.BetterAuth,
-		domains: [{ domain: props.domain }]
-	});
-	printMessage(`Domain "${props.domain}" deleted`);
-};
-const allowLocalhostGet = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthAllowLocalhost(props.projectId, branchId);
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: ALLOW_LOCALHOST_FIELDS });
-		return;
-	}
-	printKvBlock("Localhost connection settings", [["Allow localhost:", String(data.allow_localhost)]]);
-};
-const allowLocalhostEnable = async (props) => {
-	const branchId = await resolveBranch(props);
-	await props.apiClient.updateNeonAuthAllowLocalhost(props.projectId, branchId, { allow_localhost: true });
-	printMessage("Localhost connections allowed");
-};
-const allowLocalhostDisable = async (props) => {
-	const branchId = await resolveBranch(props);
-	await props.apiClient.updateNeonAuthAllowLocalhost(props.projectId, branchId, { allow_localhost: false });
-	printMessage("Localhost connections restricted");
-};
-const printEmailPasswordEntries = (data) => [
-	["Enabled:", String(data.enabled)],
-	["Verification Method:", data.email_verification_method],
-	["Require Verification:", String(data.require_email_verification)],
-	["Auto Sign In After Verify:  ", String(data.auto_sign_in_after_verification)],
-	["Send Email On Sign Up:      ", String(data.send_verification_email_on_sign_up)],
-	["Send Email On Sign In:      ", String(data.send_verification_email_on_sign_in)],
-	["Disable Sign Up:", String(data.disable_sign_up)]
-];
-const emailPasswordGet = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthEmailAndPasswordConfig(props.projectId, branchId);
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: EMAIL_PASSWORD_FIELDS });
-		return;
-	}
-	printKvBlock("Email & password auth configuration", printEmailPasswordEntries(data));
-};
-const emailPasswordUpdate = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.updateNeonAuthEmailAndPasswordConfig(props.projectId, branchId, {
-		enabled: props.enabled,
-		email_verification_method: props.emailVerificationMethod,
-		require_email_verification: props.requireEmailVerification,
-		auto_sign_in_after_verification: props.autoSignInAfterVerification,
-		send_verification_email_on_sign_up: props.sendVerificationEmailOnSignUp,
-		send_verification_email_on_sign_in: props.sendVerificationEmailOnSignIn,
-		disable_sign_up: props.disableSignUp
-	});
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: EMAIL_PASSWORD_FIELDS });
-		return;
-	}
-	printKvBlock("Email & password auth configuration updated", printEmailPasswordEntries(data));
-};
-const printEmailProviderEntries = (data) => [
-	["Type:", data.type],
-	...data.type === "standard" ? [
-		["Host:", data.host],
-		["Port:          ", data.port != null ? String(data.port) : void 0],
-		["Username:", data.username]
-	] : [],
-	["Sender Email:", data.sender_email],
-	["Sender Name:", data.sender_name]
-];
-const emailProviderGet = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthEmailProvider(props.projectId, branchId);
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: EMAIL_PROVIDER_FIELDS });
-		return;
-	}
-	printKvBlock("Email provider configuration", printEmailProviderEntries(data));
-};
-const emailProviderUpdate = async (props) => {
-	if (props.type === "standard" && (!props.host || !props.port || !props.username || !props.password)) throw new Error("--host, --port, --username, and --password are required for standard email provider");
-	const warnSharedSender = props.type === "shared" && (props.senderEmail || props.senderName);
-	const branchId = await resolveBranch(props);
-	let config;
-	if (props.type === "standard") config = {
-		type: "standard",
-		host: props.host,
-		port: props.port,
-		username: props.username,
-		password: props.password,
-		sender_email: props.senderEmail,
-		sender_name: props.senderName
-	};
-	else config = { type: "shared" };
-	const { data } = await props.apiClient.updateNeonAuthEmailProvider(props.projectId, branchId, config);
-	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: EMAIL_PROVIDER_FIELDS });
-	else printKvBlock("Email provider configuration updated", printEmailProviderEntries(data));
-	if (warnSharedSender) writeStyled(`${chalk.yellow("Warning:")} --sender-email and --sender-name are ignored for the shared email provider. These values only take effect with --type standard.\n\n`, process.stderr);
-};
-const emailProviderTest = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.sendNeonAuthEmailProviderTest(props.projectId, branchId, { recipient_email: props.recipientEmail });
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: TEST_EMAIL_FIELDS });
-		if (!data.success) throw new Error(emailProviderTestFailureMessage(props.recipientEmail, data.error_message));
-		return;
-	}
-	if (data.success) {
-		printMessage(`Test email dispatched to ${props.recipientEmail} using the custom SMTP provider saved on this branch.`);
-		return;
-	}
-	throw new Error(emailProviderTestFailureMessage(props.recipientEmail, data.error_message));
-};
-const emailProviderTestFailureMessage = (recipientEmail, errorMessage) => {
-	const header = `Test email could NOT be sent to ${recipientEmail} using the custom SMTP provider saved on this branch.`;
-	return errorMessage ? `${header}\nUpstream error: ${errorMessage}` : header;
-};
-const printOrganizationEntries = (data) => [
-	["Enabled:", String(data.enabled)],
-	["Org Limit:", String(data.organization_limit)],
-	["Creator Role:", data.creator_role]
-];
-const organizationGet = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
-	const org = data.organization;
-	if (!org) {
-		if (props.output === "json" || props.output === "yaml") {
-			writer(props).end({}, { fields: ORGANIZATION_FIELDS });
-			return;
-		}
-		printMessage("No organization plugin config found.");
-		return;
-	}
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(org, { fields: ORGANIZATION_FIELDS });
-		return;
-	}
-	printKvBlock("Organization configuration", printOrganizationEntries(org));
-};
-const organizationUpdate = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.updateNeonAuthOrganizationPlugin(props.projectId, branchId, {
-		enabled: props.enabled,
-		organization_limit: props.limit,
-		creator_role: props.creatorRole
-	});
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: ORGANIZATION_FIELDS });
-		return;
-	}
-	printKvBlock("Organization configuration updated", printOrganizationEntries(data));
-};
-const printWebhookEntries = (data) => [
-	["Enabled:", String(data.enabled)],
-	["URL:", data.webhook_url ?? ""],
-	["Events:", (data.enabled_events ?? []).join(", ")],
-	["Timeout (sec):  ", data.timeout_seconds != null ? String(data.timeout_seconds) : ""]
-];
-const webhookGet = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthWebhookConfig(props.projectId, branchId);
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: WEBHOOK_FIELDS });
-		return;
-	}
-	printKvBlock("Webhook configuration", printWebhookEntries(data));
-};
-const webhookUpdate = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.updateNeonAuthWebhookConfig(props.projectId, branchId, {
-		enabled: props.enabled,
-		webhook_url: props.url,
-		enabled_events: props.enabledEvents,
-		timeout_seconds: props.timeout
-	});
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: WEBHOOK_FIELDS });
-		return;
-	}
-	printKvBlock("Webhook configuration updated", printWebhookEntries(data));
-};
-const pluginTitle = (name) => name.replace(/_/g, " ").replace(/^\w/, (c) => c.toUpperCase()) + " configuration";
-const formatValue = (v) => {
-	if (v == null) return "";
-	if (typeof v === "string") return v;
-	if (typeof v === "number" || typeof v === "boolean") return String(v);
-	return JSON.stringify(v);
-};
-const pluginsList = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
-	if (props.output === "json" || props.output === "yaml") {
-		writer(props).end(data, { fields: Object.keys(data) });
-		return;
-	}
-	const summarize = (value) => {
-		if (value == null) return "not configured";
-		if (typeof value === "boolean") return String(value);
-		if (typeof value === "string") return value;
-		if (typeof value === "number") return String(value);
-		if (Array.isArray(value)) return value.length === 1 ? "1 item" : `${String(value.length)} items`;
-		if (typeof value === "object") {
-			const obj = value;
-			if ("enabled" in obj) return obj.enabled ? "enabled" : "disabled";
-			if ("type" in obj) return formatValue(obj.type);
-		}
-		return JSON.stringify(value);
-	};
-	const entries = Object.entries(data).map(([key, value]) => [key, summarize(value)]);
-	printKvBlock("Neon Auth plugins", entries);
-};
-const pluginsGet = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.getNeonAuthPluginConfigs(props.projectId, branchId);
-	const plugin = data[props.pluginName];
-	if (plugin === void 0) {
-		const available = Object.keys(data).join(", ");
-		throw new Error(`Unknown plugin "${props.pluginName}". Available plugins: ${available}`);
-	}
-	if (props.output === "json" || props.output === "yaml") {
-		const fields = typeof plugin === "object" && !Array.isArray(plugin) ? Object.keys(plugin) : [];
-		writer(props).end(plugin, { fields });
-		return;
-	}
-	if (typeof plugin === "object" && !Array.isArray(plugin) && plugin != null) {
-		const entries = Object.entries(plugin).map(([k, v]) => [`${k}:`, formatValue(v)]);
-		printKvBlock(pluginTitle(props.pluginName), entries);
-	} else if (Array.isArray(plugin)) {
-		const entries = plugin.map((item, i) => [`[${i}]:`, typeof item === "object" ? JSON.stringify(item) : String(item)]);
-		printKvBlock(pluginTitle(props.pluginName), entries);
-	} else printKvBlock(pluginTitle(props.pluginName), [["Value:", String(plugin)]]);
-};
-const userCreate = async (props) => {
-	const branchId = await resolveBranch(props);
-	const requestBody = {
-		email: props.email,
-		name: props.name ?? props.email
-	};
-	const { data } = await props.apiClient.createBranchNeonAuthNewUser(props.projectId, branchId, requestBody);
-	const displayName = requestBody.name !== props.email ? requestBody.name : void 0;
-	printKvBlock("User created", [
-		["ID:", data.id],
-		["Email:", requestBody.email],
-		...displayName ? [["Name:", displayName]] : []
-	]);
-};
-const userDelete = async (props) => {
-	const branchId = await resolveBranch(props);
-	await props.apiClient.deleteBranchNeonAuthUser(props.projectId, branchId, props.userId);
-	printMessage(`User "${props.userId}" deleted`);
-};
-const userSetRole = async (props) => {
-	const branchId = await resolveBranch(props);
-	const { data } = await props.apiClient.updateNeonAuthUserRole(props.projectId, branchId, props.userId, { roles: props.roles });
-	printKvBlock("Roles updated", [["User ID:", data.id], ["Roles:", props.roles.join(", ")]]);
-};
-//#endregion
-export { builder, command, describe, handler, neon_auth_exports as t };
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-CBs1_3qu.js";