neon 8.11.0 → 8.11.2

package/dist/_chunks/connection_string-DB4awPzZ.js

@@ -0,0 +1,154 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { n as defaultConnectionRole } from "./roles-C3M4q9DS.js";
+import { writer } from "../writer.js";
+import { EndpointType } from "../utils/api_enums.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+import { psql } from "../utils/psql.js";
+import { parsePITBranch } from "../utils/point_in_time.js";
+//#region src/commands/connection_string.ts
+var connection_string_exports = /* @__PURE__ */ __exportAll({
+	SSL_MODES: () => SSL_MODES,
+	aliases: () => aliases,
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const SSL_MODES = [
+	"require",
+	"verify-ca",
+	"verify-full",
+	"omit"
+];
+const command = "connection-string [branch]";
+const aliases = ["cs"];
+const describe = "Get connection string";
+const builder = (argv) => {
+	return argv.usage("$0 connection-string [branch] [options]").example("$0 cs main", "Get connection string for the main branch").example("$0 cs main@2024-01-01T00:00:00Z", "Get connection string for the main branch at a specific point in time").example("$0 cs main@0/234235", "Get connection string for the main branch at a specific LSN").positional("branch", {
+		describe: `Branch name or id. Defaults to the default branch if omitted. Can be written in the point-in-time format: "branch@timestamp" or "branch@lsn"`,
+		type: "string"
+	}).options({
+		"project-id": {
+			type: "string",
+			describe: "Project ID"
+		},
+		"role-name": {
+			type: "string",
+			describe: "Role name. Defaults to neondb_owner, else the only role besides the Data API and Neon Auth roles"
+		},
+		"database-name": {
+			type: "string",
+			describe: "Database name"
+		},
+		pooled: {
+			type: "boolean",
+			describe: "Use pooled connection",
+			default: false
+		},
+		prisma: {
+			type: "boolean",
+			describe: "Use connection string for Prisma setup",
+			default: false
+		},
+		"endpoint-type": {
+			type: "string",
+			choices: Object.values(EndpointType),
+			describe: "Endpoint type"
+		},
+		extended: {
+			type: "boolean",
+			describe: "Show extended information"
+		},
+		psql: {
+			type: "boolean",
+			describe: "Connect to a database via psql using connection string",
+			default: false
+		},
+		fallback: {
+			type: "boolean",
+			describe: "Force the embedded TypeScript psql fallback (for testing)",
+			default: false,
+			hidden: true
+		},
+		ssl: {
+			type: "string",
+			choices: SSL_MODES,
+			default: "require",
+			describe: "SSL mode"
+		}
+	}).middleware(fillSingleProject);
+};
+const handler = async (props) => {
+	const projectId = props.projectId;
+	const parsedPIT = props.branch ? parsePITBranch(props.branch) : {
+		tag: "head",
+		branch: ""
+	};
+	if (props.branch) props.branch = parsedPIT.branch;
+	const branchId = await branchIdFromProps(props);
+	const endpointsRequest = props.apiClient.listProjectBranchEndpoints(projectId, branchId);
+	const rolesRequest = props.roleName ? void 0 : props.apiClient.listProjectBranchRoles(projectId, branchId);
+	const databasesRequest = props.apiClient.listProjectBranchDatabases(projectId, branchId);
+	for (const request of [
+		endpointsRequest,
+		rolesRequest,
+		databasesRequest
+	]) request?.catch(() => void 0);
+	const { data: { endpoints } } = await endpointsRequest;
+	const matchEndpointType = props.endpointType ?? EndpointType.ReadWrite;
+	let endpoint = endpoints.find((e) => e.type === matchEndpointType);
+	if (!endpoint && props.endpointType == null) endpoint = endpoints[0];
+	if (!endpoint) throw new Error(`No ${props.endpointType ?? ""} endpoint found for the branch: ${branchId}`);
+	const role = !rolesRequest ? props.roleName : await rolesRequest.then(({ data }) => {
+		if (data.roles.length === 0) throw new Error(`No roles found for the branch: ${branchId}`);
+		const picked = defaultConnectionRole(data.roles.map((r) => r.name));
+		if (picked) return picked;
+		throw new Error(`Multiple roles found for the branch, please provide one with the --role-name option: ${data.roles.map((r) => r.name).join(", ")}`);
+	});
+	const { data: { databases: branchDatabases } } = await databasesRequest;
+	const database = props.databaseName || (() => {
+		if (branchDatabases.length === 0) throw new Error(`No databases found for the branch: ${branchId}`);
+		if (branchDatabases.length === 1) return branchDatabases[0].name;
+		throw new Error(`Multiple databases found for the branch, please provide one with the --database-name option: ${branchDatabases.map((d) => d.name).join(", ")}`);
+	})();
+	if (!branchDatabases.find((d) => d.name === database)) throw new Error(`Database not found: ${database}`);
+	const { data: { password } } = await props.apiClient.getProjectBranchRolePassword(props.projectId, endpoint.branch_id, role);
+	let host = props.pooled ? endpoint.host.replace(endpoint.id, `${endpoint.id}-pooler`) : endpoint.host;
+	if (parsedPIT.tag !== "head") host = endpoint.host.replace(endpoint.id, endpoint.branch_id);
+	const connectionString = new URL(`postgresql://${host}`);
+	connectionString.pathname = `/${encodeURIComponent(database)}`;
+	connectionString.username = role;
+	connectionString.password = password;
+	if (props.prisma) {
+		connectionString.searchParams.set("connect_timeout", "30");
+		if (props.pooled) {
+			connectionString.searchParams.set("pool_timeout", "30");
+			connectionString.searchParams.set("pgbouncer", "true");
+		}
+	}
+	if (props.ssl !== "omit") {
+		connectionString.searchParams.set("sslmode", props.ssl);
+		connectionString.searchParams.set("channel_binding", "require");
+	}
+	if (parsedPIT.tag === "lsn") connectionString.searchParams.set("options", `neon_lsn:${parsedPIT.lsn}`);
+	else if (parsedPIT.tag === "timestamp") connectionString.searchParams.set("options", `neon_timestamp:${parsedPIT.timestamp}`);
+	if (props.psql) {
+		const psqlArgs = props["--"];
+		await psql(connectionString.toString(), psqlArgs, { mode: props.fallback ? "ts" : "auto" });
+	} else if (props.extended) writer(props).end({
+		connection_string: connectionString.toString(),
+		host,
+		role,
+		password,
+		database,
+		options: connectionString.searchParams.toString()
+	}, { fields: [
+		"host",
+		"role",
+		"password",
+		"database"
+	] });
+	else process.stdout.write(connectionString.toString() + "\n");
+};
+//#endregion
+export { connection_string_exports as a, command as i, aliases as n, describe as o, builder as r, handler as s, SSL_MODES as t };

package/dist/_chunks/credentials-BSjE9fRR.js

@@ -0,0 +1,146 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { isNeonApiError, messageFromBody, retryOnLock } from "../api.js";
+import { writer } from "../writer.js";
+import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
+//#region src/commands/credentials.ts
+var credentials_exports = /* @__PURE__ */ __exportAll({
+	aliases: () => aliases,
+	builder: () => builder,
+	command: () => command,
+	create: () => create,
+	describe: () => describe,
+	handler: () => handler,
+	list: () => list,
+	reveal: () => reveal,
+	revoke: () => revoke,
+	rotate: () => rotate
+});
+const CREDENTIAL_SCOPES = [
+	"storage:read",
+	"storage:write",
+	"ai_gateway:invoke",
+	"functions:invoke"
+];
+const LIST_FIELDS = [
+	"token_id",
+	"name",
+	"principal_type",
+	"scopes",
+	"created_at"
+];
+const SECRET_META_FIELDS = [
+	"token_id",
+	"name",
+	"scopes"
+];
+const renderColumns = { scopes: (c) => (c.scopes ?? []).join(", ") };
+/** Translate a token-id 404 into a resource-specific message; re-throw everything else. */
+async function withCredentialNotFound(tokenId, branchId, run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) {
+			if ((messageFromBody(err.data) ?? "").includes("platform credentials not available")) throw err;
+			throw new Error(`Credential ${tokenId} not found on branch ${branchId}.`);
+		}
+		throw err;
+	}
+}
+/**
+* Secrets are shown only once (create/rotate) or on demand (reveal). Table
+* output keeps them off the grid so they stay one selectable line; json/yaml
+* keep them on the object for scripts.
+*/
+const reportSecrets = (props, data, warning) => {
+	const out = writer(props);
+	if (props.output === "table") {
+		out.write(data, { fields: SECRET_META_FIELDS });
+		out.end();
+		const apiToken = "api_token" in data && typeof data.api_token === "string" ? data.api_token : "";
+		const secretKey = "s3_secret_access_key" in data && typeof data.s3_secret_access_key === "string" ? data.s3_secret_access_key : "";
+		out.text(`api_token: ${apiToken}\n`);
+		out.text(`s3_secret_access_key: ${secretKey}\n`);
+	} else out.end(data, { fields: [
+		"token_id",
+		"name",
+		"scopes",
+		"api_token",
+		"s3_secret_access_key"
+	] });
+	log.warning(warning);
+};
+const command = "credentials";
+const describe = "Manage branch credentials";
+const aliases = ["credential"];
+const builder = (argv) => argv.usage("$0 credentials <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("list", "List credentials on the branch", (yargs) => yargs, (args) => list(args)).command("create", "Issue a scoped credential on the branch", (yargs) => yargs.options({
+	name: {
+		describe: "Label for the credential",
+		type: "string"
+	},
+	scope: {
+		describe: "Capability to grant. Repeatable. Values: storage:read, storage:write, ai_gateway:invoke, functions:invoke",
+		type: "string",
+		array: true,
+		choices: CREDENTIAL_SCOPES,
+		demandOption: true
+	}
+}), (args) => create(args)).command("reveal <tokenId>", "Show a credential's api_token and s3_secret_access_key", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => reveal(args)).command("rotate <tokenId>", "Replace a credential's secrets in place. The token id is unchanged.", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => rotate(args)).command("revoke <tokenId>", "Revoke a credential", (yargs) => yargs.positional("tokenId", {
+	describe: "Credential token id (nak_live_<32hex>)",
+	type: "string"
+}), (args) => revoke(args));
+const handler = (args) => {
+	return args;
+};
+const list = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await props.apiClient.listCredentials(props.projectId, branchId);
+	writer(props).end(data.credentials, {
+		fields: LIST_FIELDS,
+		renderColumns,
+		emptyMessage: "No credentials found on this branch."
+	});
+};
+const create = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const scopes = (Array.isArray(props.scope) ? props.scope : [props.scope]).filter((scope) => CREDENTIAL_SCOPES.some((allowed) => allowed === scope));
+	if (scopes.length === 0) throw new Error("Pass at least one --scope. Values: storage:read, storage:write, ai_gateway:invoke, functions:invoke");
+	const { data } = await retryOnLock(() => props.apiClient.createCredential(props.projectId, branchId, {
+		scopes,
+		principal_type: "user",
+		...props.name !== void 0 ? { name: props.name } : {}
+	}));
+	reportSecrets(props, data, "Store these secrets now: they are not shown again unless you run neon credentials reveal.");
+};
+const reveal = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await withCredentialNotFound(props.tokenId, branchId, () => props.apiClient.revealCredential(props.projectId, branchId, props.tokenId));
+	reportSecrets(props, data, "These are live secrets. Treat them like a password.");
+};
+const rotate = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const { data } = await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.rotateCredential(props.projectId, branchId, props.tokenId)));
+	reportSecrets(props, data, "Store the new secrets now: a retry mints another pair and does not recover a lost response. A replica may briefly accept the previous secret.");
+};
+const revoke = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.revokeCredential(props.projectId, branchId, props.tokenId)));
+	log.info(`Credential ${props.tokenId} revoked`);
+};
+//#endregion
+export { credentials_exports as a, list as c, rotate as d, create as i, reveal as l, builder as n, describe as o, command as r, handler as s, aliases as t, revoke as u };

package/dist/_chunks/data_api-Djxj5ZQD.js

@@ -0,0 +1,263 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { isNeonApiError, retryOnLock } from "../api.js";
+import { getCliName } from "../utils/cli_name.js";
+import { writer } from "../writer.js";
+import { branchIdFromProps, fillSingleProject, resolveSingleDatabase } from "../utils/enrichers.js";
+//#region src/commands/data_api.ts
+var data_api_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const SETTINGS_FIELDS = [
+	"db_aggregates_enabled",
+	"db_anon_role",
+	"db_extra_search_path",
+	"db_max_rows",
+	"db_schemas",
+	"jwt_role_claim_key",
+	"jwt_cache_max_lifetime",
+	"openapi_mode",
+	"server_cors_allowed_origins",
+	"server_timing_enabled"
+];
+const settingsFlags = {
+	"db-aggregates-enabled": {
+		type: "boolean",
+		describe: "Enable aggregate functions in queries"
+	},
+	"db-anon-role": {
+		type: "string",
+		describe: "Database role used for anonymous (unauthenticated) requests"
+	},
+	"db-extra-search-path": {
+		type: "string",
+		describe: "Extra schemas appended to the search path"
+	},
+	"db-max-rows": {
+		type: "number",
+		describe: "Maximum number of rows returned by a single request"
+	},
+	"db-schemas": {
+		type: "string",
+		describe: "Comma-separated list of schemas exposed via the Data API"
+	},
+	"jwt-role-claim-key": {
+		type: "string",
+		describe: "JWT claim path used to extract the role"
+	},
+	"jwt-cache-max-lifetime": {
+		type: "number",
+		describe: "Maximum JWT cache lifetime in seconds"
+	},
+	"openapi-mode": {
+		type: "string",
+		choices: ["ignore-privileges", "disabled"],
+		describe: "OpenAPI mode"
+	},
+	"server-cors-allowed-origins": {
+		type: "string",
+		describe: "CORS allowed origins"
+	},
+	"server-timing-enabled": {
+		type: "boolean",
+		describe: "Enable Server-Timing response headers"
+	}
+};
+const command = "data-api";
+const describe = "Manage the Neon Data API for a database";
+const builder = (argv) => argv.usage("$0 data-api <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	},
+	database: {
+		describe: "Database name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("create", "Provision the Neon Data API for a database", (yargs) => yargs.options({
+	"auth-provider": {
+		type: "string",
+		choices: ["neon_auth", "external"],
+		describe: "Authentication provider"
+	},
+	"jwks-url": {
+		type: "string",
+		describe: "URL that lists the JWKS (used with external auth)"
+	},
+	"provider-name": {
+		type: "string",
+		describe: "Name of the auth provider (e.g. Clerk, Stytch, Auth0)"
+	},
+	"jwt-audience": {
+		type: "string",
+		describe: "Expected JWT audience claim"
+	},
+	"add-default-grants": {
+		type: "boolean",
+		describe: "Grant all permissions on tables in the public schema to authenticated users"
+	},
+	"skip-auth-schema": {
+		type: "boolean",
+		describe: "Skip creating the auth schema and RLS functions"
+	},
+	...settingsFlags
+}), (args) => create(args)).command("get", "Show the Neon Data API status and settings", (yargs) => yargs, (args) => get(args)).command("update", "Update Neon Data API settings (merges with current settings by default)", (yargs) => yargs.options({
+	replace: {
+		type: "boolean",
+		default: false,
+		describe: "Replace settings with only the flags provided. Omitted settings revert to server defaults."
+	},
+	...settingsFlags
+}), (args) => update(args)).command("refresh-schema", "Refresh the Data API schema cache without changing settings", (yargs) => yargs, (args) => refreshSchema(args)).command("delete", "Tear down the Neon Data API for a database", (yargs) => yargs, (args) => deleteDataApi(args));
+const handler = (args) => {
+	return args;
+};
+const TOP_LEVEL_CREATE_FIELDS = [
+	"auth_provider",
+	"jwks_url",
+	"provider_name",
+	"jwt_audience",
+	"add_default_grants",
+	"skip_auth_schema"
+];
+const argKey = (snake) => snake.replace(/_/g, "-");
+const buildSettings = (args) => {
+	const settings = {};
+	for (const field of SETTINGS_FIELDS) {
+		const value = args[argKey(field)];
+		if (value === void 0) continue;
+		if (field === "db_schemas" && typeof value === "string") settings[field] = value.split(",").map((s) => s.trim()).filter(Boolean);
+		else settings[field] = value;
+	}
+	return Object.keys(settings).length > 0 ? settings : void 0;
+};
+const buildCreateBody = (args) => {
+	const body = {};
+	for (const field of TOP_LEVEL_CREATE_FIELDS) {
+		const value = args[argKey(field)];
+		if (value !== void 0) body[field] = value;
+	}
+	const settings = buildSettings(args);
+	if (settings) body.settings = settings;
+	return body;
+};
+const create = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const database = await resolveSingleDatabase({
+		apiClient: props.apiClient,
+		projectId: props.projectId,
+		branchId,
+		database: props.database
+	});
+	const body = buildCreateBody(props);
+	const { data } = await retryOnLock(() => props.apiClient.createProjectBranchDataApi(props.projectId, branchId, database, body));
+	writer(props).end(data, { fields: ["url"] });
+};
+const GET_FIELDS = [
+	"url",
+	"status",
+	"db_schemas"
+];
+const get = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const database = await resolveSingleDatabase({
+		apiClient: props.apiClient,
+		projectId: props.projectId,
+		branchId,
+		database: props.database
+	});
+	const { data } = await props.apiClient.getProjectBranchDataApi(props.projectId, branchId, database);
+	const { available_schemas: _ignored, ...publicData } = data;
+	const tableRow = {
+		url: publicData.url,
+		status: publicData.status,
+		db_schemas: (publicData.settings?.db_schemas ?? []).join(", ")
+	};
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(publicData, { fields: [
+			"url",
+			"status",
+			"settings"
+		] });
+		return;
+	}
+	writer(props).end(tableRow, { fields: GET_FIELDS });
+};
+const update = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const database = await resolveSingleDatabase({
+		apiClient: props.apiClient,
+		projectId: props.projectId,
+		branchId,
+		database: props.database
+	});
+	const userSettings = buildSettings(props);
+	if (!userSettings) throw new Error("No settings flags provided. Pass at least one setting flag to update, or use `data-api refresh-schema` to refresh the schema cache without changing settings.");
+	let settings;
+	if (props.replace) settings = userSettings;
+	else {
+		let current;
+		try {
+			const { data } = await props.apiClient.getProjectBranchDataApi(props.projectId, branchId, database);
+			current = data.settings ?? void 0;
+		} catch (err) {
+			if (isNeonApiError(err) && err.status === 404) throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}. Run \`${getCliName()} data-api create\` first.`);
+			throw err;
+		}
+		if (!current) throw new Error(`Could not read current Data API settings for ${database} on branch ${branchId}. Retry, or pass --replace to overwrite.`);
+		settings = {
+			...current,
+			...userSettings ?? {}
+		};
+	}
+	const body = {};
+	if (settings) body.settings = settings;
+	try {
+		await retryOnLock(() => props.apiClient.updateProjectBranchDataApi(props.projectId, branchId, database, body));
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}. Run \`${getCliName()} data-api create\` first.`);
+		throw err;
+	}
+	log.info(`Data API settings updated for ${database} on branch ${branchId}`);
+};
+const refreshSchema = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const database = await resolveSingleDatabase({
+		apiClient: props.apiClient,
+		projectId: props.projectId,
+		branchId,
+		database: props.database
+	});
+	try {
+		await retryOnLock(() => props.apiClient.updateProjectBranchDataApi(props.projectId, branchId, database, {}));
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}. Run \`${getCliName()} data-api create\` first.`);
+		throw err;
+	}
+	log.info(`Data API schema cache refreshed for ${database} on branch ${branchId}`);
+};
+const deleteDataApi = async (props) => {
+	const branchId = await branchIdFromProps(props);
+	const database = await resolveSingleDatabase({
+		apiClient: props.apiClient,
+		projectId: props.projectId,
+		branchId,
+		database: props.database
+	});
+	try {
+		await retryOnLock(() => props.apiClient.deleteProjectBranchDataApi(props.projectId, branchId, database));
+	} catch (err) {
+		if (isNeonApiError(err) && err.status === 404) throw new Error(`Data API is not provisioned for ${database} on branch ${branchId}.`);
+		throw err;
+	}
+	log.info(`Data API deleted for ${database} on branch ${branchId}`);
+};
+//#endregion
+export { handler as a, describe as i, command as n, data_api_exports as r, builder as t };

package/dist/_chunks/databases-Dok4wru7.js

@@ -0,0 +1,84 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { retryOnLock } from "../api.js";
+import { writer } from "../writer.js";
+import { fillSingleProject, resolveBranchFromProps } from "../utils/enrichers.js";
+//#region src/commands/databases.ts
+var databases_exports = /* @__PURE__ */ __exportAll({
+	DATABASE_FIELDS: () => DATABASE_FIELDS,
+	aliases: () => aliases,
+	builder: () => builder,
+	command: () => command,
+	create: () => create,
+	deleteDb: () => deleteDb,
+	describe: () => describe,
+	handler: () => handler,
+	list: () => list
+});
+const DATABASE_FIELDS = [
+	"name",
+	"owner_name",
+	"created_at"
+];
+const command = "databases";
+const describe = "Manage databases";
+const aliases = ["database", "db"];
+const builder = (argv) => argv.usage("$0 databases <sub-command> [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	}
+}).middleware(fillSingleProject).command("list", "List databases", (yargs) => yargs, (args) => list(args)).command("create", "Create a database", (yargs) => yargs.options({
+	name: {
+		describe: "Database name",
+		type: "string",
+		demandOption: true
+	},
+	"owner-name": {
+		describe: "Owner name",
+		type: "string"
+	}
+}), (args) => create(args)).command("delete <database>", "Delete a database", (yargs) => yargs, (args) => deleteDb(args));
+const handler = (args) => {
+	return args;
+};
+const list = async (props) => {
+	const { branchId, branch } = await resolveBranchFromProps(props);
+	const { data } = await props.apiClient.listProjectBranchDatabases(props.projectId, branchId);
+	const branchLabel = branch?.name ?? branchId;
+	writer(props).end(data.databases, {
+		fields: DATABASE_FIELDS,
+		humanTitle: `Databases on ${branchLabel}`,
+		emptyMessage: `No databases on ${branchLabel}.`
+	});
+};
+const create = async (props) => {
+	const { branchId, branch } = await resolveBranchFromProps(props);
+	const owner = props.ownerName ?? await props.apiClient.listProjectBranchRoles(props.projectId, branchId).then(({ data }) => {
+		if (data.roles.length === 0) throw new Error(`No roles found in branch ${branchId}`);
+		if (data.roles.length > 1) throw new Error(`More than one role found in branch ${branchId}. Please specify the owner name. Roles: ${data.roles.map((r) => r.name).join(", ")}`);
+		return data.roles[0].name;
+	});
+	if (!owner) throw new Error("No owner found");
+	const { data } = await retryOnLock(() => props.apiClient.createProjectBranchDatabase(props.projectId, branchId, { database: {
+		name: props.name,
+		owner_name: owner
+	} }));
+	writer(props).end(data.database, {
+		fields: DATABASE_FIELDS,
+		humanTitle: `Database created on ${branch?.name ?? branchId}`
+	});
+};
+const deleteDb = async (props) => {
+	const { branchId, branch } = await resolveBranchFromProps(props);
+	const { data } = await retryOnLock(() => props.apiClient.deleteProjectBranchDatabase(props.projectId, branchId, props.database));
+	if (data) writer(props).end(data.database, {
+		fields: DATABASE_FIELDS,
+		humanTitle: `Database deleted from ${branch?.name ?? branchId}`
+	});
+};
+//#endregion
+export { create as a, describe as c, command as i, handler as l, aliases as n, databases_exports as o, builder as r, deleteDb as s, DATABASE_FIELDS as t, list as u };

package/dist/_chunks/deploy-D7B0Xfjg.js

@@ -0,0 +1,33 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { fillSingleProject } from "../utils/enrichers.js";
+import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BH_qRHiG.js";
+import { DEPLOY_COMMANDS_EPILOGUE } from "../commands/deploy_help.js";
+//#region src/commands/deploy.ts
+var deploy_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const command = "deploy";
+const describe = "Apply a neon.ts policy to a branch (alias for `config apply`)";
+const builder = (argv) => argv.usage("$0 deploy [options]").options({
+	"project-id": {
+		describe: "Project ID",
+		type: "string"
+	},
+	branch: {
+		describe: "Branch ID or name",
+		type: "string"
+	},
+	config: {
+		describe: "Path to a neon.ts policy (defaults to the neon.ts next to .neon, or in cwd without one)",
+		type: "string"
+	},
+	...envFlag,
+	...applyFlags,
+	...envPullFlag
+}).middleware(fillSingleProject).epilogue(DEPLOY_COMMANDS_EPILOGUE).strict();
+const handler = (props) => applyCmd(props);
+//#endregion
+export { handler as a, describe as i, command as n, deploy_exports as r, builder as t };