neon 8.11.1 → 8.11.2

package/dist/_chunks/git-H32TNt6M.js

@@ -0,0 +1,356 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollowedGitHookSync, readContextFile, setGitBranchMap, setGitBranchMapping, setGitFollow } from "../context.js";
+import { writer } from "../writer.js";
+import { neonSafeBranchName } from "../utils/branch_name.js";
+import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
+import { o as quoteFlagValue } from "./link-BgtkOBws.js";
+import { o as handler$1 } from "./checkout-CXIOydqZ.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import chalk from "chalk";
+import prompts from "prompts";
+//#region src/commands/git.ts
+var git_exports = /* @__PURE__ */ __exportAll({
+	aliases: () => aliases,
+	builder: () => builder,
+	cleanup: () => cleanup,
+	command: () => "git",
+	describe: () => describe,
+	handler: () => handler,
+	install: () => install,
+	partitionBranchesToPrune: () => partitionBranchesToPrune,
+	status: () => status,
+	sync: () => sync,
+	uninstall: () => uninstall
+});
+const command = "git";
+const describe = "Sync the checked-out Neon branch to your git branch (Preview)";
+const aliases = [];
+const builder = (argv) => argv.usage("$0 git <sub-command> [options]").command("install", "Install a git post-checkout hook that syncs the Neon branch on `git checkout`", (yargs) => yargs.epilogue("Requires a project already linked at the repository root — run `neon link` or `neon checkout <branch>` there first."), (args) => {
+	install(args);
+}).command("uninstall", "Remove the git post-checkout hook installed by `git install`", (yargs) => yargs, (args) => {
+	uninstall(args);
+}).command("sync", "Check out the Neon branch mapped to the current git branch (run by the hook)", (yargs) => yargs.options({
+	"env-pull": {
+		describe: "Pull the branch's Neon env vars into a local .env after sync. On by default.",
+		type: "boolean",
+		default: true
+	},
+	pull: {
+		describe: "Run `git pull --ff-only` before syncing so local files (incl. migration files) match the branch before any checkout.after migration runs. Without the flag, prompts when run manually in a TTY and skips in the hook / CI.",
+		type: "boolean"
+	},
+	quiet: {
+		describe: "Suppress sync's own routine status lines (git pull result, detached HEAD notice). Warnings and the delegated checkout's own output are unaffected. Used by the installed git hook.",
+		type: "boolean",
+		default: false
+	}
+}), (args) => sync(args)).command("status", "Show the git context, hook state, and current git → Neon mapping", (yargs) => yargs, (args) => {
+	status(args);
+}).command("cleanup", "Prune git → Neon mappings whose local git branch is gone; optionally delete the orphaned Neon branches", (yargs) => yargs.options({
+	"prune-neon-branches": {
+		describe: "Also delete the orphaned Neon branches (never the default or a protected branch).",
+		type: "boolean",
+		default: false
+	},
+	yes: {
+		describe: "Skip the confirmation prompt before deleting Neon branches.",
+		type: "boolean",
+		default: false
+	}
+}), (args) => cleanup(args));
+const handler = (args) => args;
+const requireRepoRoot = () => {
+	const cwd = process.cwd();
+	if (!isGitRepo(cwd)) throw new Error("Not inside a git repository. Run `neon git` from a git work tree.");
+	const repoRoot = gitRepoRoot(cwd);
+	if (!repoRoot) throw new Error("Could not resolve the git repository root.");
+	return repoRoot;
+};
+/**
+* `.neon` at exactly the repo root — never walk-up-resolved. The single source of truth for
+* all git-hooks state: `git.follow` and the git → Neon map. A `post-checkout` hook always
+* runs with `cwd` at the repo root, so every function here (`install`, `uninstall`, `sync`,
+* `status`, `cleanup`) reads and writes this exact path, never `props.contextFile`'s
+* walk-up resolution — an ancestor directory's unrelated `.neon` (e.g. a parent monorepo
+* folder) must never be mistaken for this repo's own state.
+*
+* Deliberately never *creates* this file: `install` requires it to already exist (from a
+* prior `neon link` / `neon checkout` run at the repo root), and `sync` skips persisting a
+* mapping when it's absent. Auto-creating a bare `{ git: {...} }` file with no `projectId`
+* would plant a **new**, closer `.neon` that shadows a real project link recorded in an
+* ancestor directory (or a linked subdirectory) for every other command's normal
+* context resolution — silently breaking `checkout` / `deploy` / `status` in that
+* directory. Requiring the link first also keeps this file and the project context file
+* the same file whenever hooks state exists, which is what makes `cleanup`'s project-match
+* check (see below) actually correct.
+*/
+const repoRootContextFile = (repoRoot) => join(repoRoot, CONTEXT_FILE);
+const install = (_props) => {
+	const repoRoot = requireRepoRoot();
+	const gitStateFile = repoRootContextFile(repoRoot);
+	if (!readContextFile(gitStateFile).projectId) {
+		const quoted = quoteFlagValue(gitStateFile);
+		throw new Error(`No project linked at the repository root (${gitStateFile}).\nRun \`neon link --context-file ${quoted}\` (an explicit path, since a plain \`neon link\` walks up and may update a different, ancestor \`.neon\` instead) or \`neon checkout <branch> --context-file ${quoted}\` first, then re-run \`neon git install\`.`);
+	}
+	const result = installPostCheckoutHook(repoRoot);
+	if (result.status === "conflict") throw new Error(`A non-neon \`post-checkout\` hook already exists at ${result.hookPath}.\nRemove or rename it first, then re-run \`neon git install\`.`);
+	setGitFollow(gitStateFile, true);
+	log.info("Git → Neon sync %s. `git checkout <branch>` will now check out the mapped Neon branch.\nHook: %s", result.status === "installed" ? "installed" : "updated", postCheckoutHookPath(repoRoot));
+};
+const uninstall = (_props) => {
+	const repoRoot = requireRepoRoot();
+	const result = removePostCheckoutHook(repoRoot);
+	const gitStateFile = repoRootContextFile(repoRoot);
+	if (existsSync(gitStateFile)) setGitFollow(gitStateFile, false);
+	switch (result) {
+		case "removed":
+			log.info("Removed the neon git post-checkout hook. Git → Neon sync is off.");
+			break;
+		case "foreign":
+			log.info("Left the existing `post-checkout` hook in place (not managed by neon). Git → Neon sync flag cleared.");
+			break;
+		case "absent": log.info("No neon git hook was installed. Git → Neon sync flag cleared.");
+	}
+};
+/**
+* Check out the Neon branch that corresponds to the current git branch. Invoked by the
+* installed `post-checkout` hook (with `NEON_GIT_HOOK=1`) and runnable by hand. Resolves the
+* Neon branch name via the persisted map (sticky), delegates to `neon checkout` (whose
+* `checkout.before` hook may further map the name and whose `checkout.after` hook runs
+* migrations, etc.), then records the resulting git → Neon mapping so it stays stable.
+*/
+/** `sync`'s own routine status lines (pull result, detached HEAD) — skipped under
+* `--quiet`. Warnings, errors, and the delegated `checkout`'s own output are unaffected. */
+const syncLog = (props, ...args) => {
+	if (props.quiet) return;
+	log.info(...args);
+};
+const sync = async (props) => {
+	if (isUnfollowedGitHookSync({ _: ["git", "sync"] })) {
+		log.debug("Skipping git sync: this repo has not run `neon git install` (git.follow is not set).");
+		return;
+	}
+	const cwd = process.cwd();
+	if (!isGitRepo(cwd)) throw new Error("Not inside a git repository.");
+	const repoRoot = gitRepoRoot(cwd) ?? cwd;
+	const gitStateFile = repoRootContextFile(repoRoot);
+	const context = readContextFile(gitStateFile);
+	const gitBranch = currentGitBranch(cwd);
+	if (!gitBranch) {
+		syncLog(props, "Detached HEAD — no git branch to sync. Skipping.");
+		return;
+	}
+	if (await resolveShouldPull(props, cwd, gitBranch)) {
+		const outcome = gitPull(cwd);
+		switch (outcome.status) {
+			case "pulled":
+				syncLog(props, "%s git pull --ff-only (%s)", chalk.dim("→"), gitBranch);
+				break;
+			case "no-upstream":
+				syncLog(props, "No upstream for %s — skipping git pull.", gitBranch);
+				break;
+			case "failed": log.warning("git pull --ff-only failed (continuing with sync): %s", outcome.detail);
+		}
+	}
+	const inputName = gitBranchMapping(context, gitBranch) ?? neonSafeBranchName(gitBranch);
+	await handler$1({
+		...props,
+		id: inputName,
+		envPull: props.envPull ?? true
+	});
+	const rootProjectId = readContextFile(gitStateFile).projectId;
+	const pinnedContext = readContextFile(props.contextFile);
+	if (!rootProjectId || pinnedContext.projectId !== rootProjectId) log.warning("Not persisting the git → Neon mapping: this checkout targeted project %s, not a project linked at the repo root (%s).", pinnedContext.projectId ?? "(unknown)", rootProjectId ?? "none");
+	else {
+		const resolved = contextBranch(pinnedContext);
+		if (resolved) setGitBranchMapping(gitStateFile, gitBranch, resolved);
+	}
+};
+/**
+* Decide whether `git sync` should `git pull` first. Mirrors the rest of the CLI's
+* auto-vs-interactive philosophy (cf. `checkout` / `link`): an explicit flag always wins;
+* otherwise we only *prompt* in a real manual TTY, and never auto-pull in the post-checkout
+* hook or CI (no network surprises in automation). Skips when there's nothing upstream.
+*/
+const resolveShouldPull = async (props, cwd, gitBranch) => {
+	if (props.pull === true) return true;
+	if (props.pull === false) return false;
+	if (!hasUpstream(cwd)) return false;
+	if (process.env["NEON_GIT_HOOK"] === "1" || isCi() || !process.stdout.isTTY) return false;
+	const { pull } = await prompts({
+		type: "confirm",
+		name: "pull",
+		message: `Pull latest for "${gitBranch}" (git pull --ff-only) before syncing?`,
+		initial: false
+	});
+	return Boolean(pull);
+};
+const GIT_STATUS_FIELDS = [
+	"gitBranch",
+	"hookInstalled",
+	"followOnCheckout",
+	"mappedNeonBranch",
+	"mappings"
+];
+const status = (props) => {
+	const cwd = process.cwd();
+	const git = readGitContext(cwd);
+	if (!git.available) throw new Error("Not inside a git repository.");
+	const repoRoot = git.repoRoot ?? cwd;
+	const hookPath = postCheckoutHookPath(repoRoot);
+	const context = readContextFile(repoRootContextFile(repoRoot));
+	const currentBranch = git.branch;
+	writer(props).end({
+		gitBranch: currentBranch ?? null,
+		hookInstalled: isManagedHook(hookPath),
+		followOnCheckout: context.git?.follow === true,
+		mappedNeonBranch: currentBranch ? gitBranchMapping(context, currentBranch) ?? null : null,
+		mappings: context.git?.map ?? {}
+	}, {
+		fields: GIT_STATUS_FIELDS,
+		renderColumns: {
+			gitBranch: (v) => v.gitBranch ?? "(detached)",
+			mappedNeonBranch: (v) => v.gitBranch === null ? "(detached — sync skips detached HEAD)" : v.mappedNeonBranch ?? "(unmapped — will derive on next sync)",
+			mappings: (v) => Object.entries(v.mappings).map(([gitBranch, neonBranch]) => `${gitBranch} → ${neonBranch}`).join("\n") || "(none)"
+		}
+	});
+};
+/**
+* Split the orphaned Neon branches (those mapped from now-deleted git branches) into the ones
+* safe to delete and the ones to skip. Default and protected branches are **never** deleted.
+* Pure (no I/O) so it's unit-testable.
+*/
+const partitionBranchesToPrune = (branches, orphanNeonNames) => {
+	const toDelete = [];
+	const skipped = [];
+	for (const branch of branches) {
+		if (!orphanNeonNames.has(branch.name)) continue;
+		if (branch.default) skipped.push({
+			name: branch.name,
+			reason: "default branch"
+		});
+		else if (branch.protected) skipped.push({
+			name: branch.name,
+			reason: "protected"
+		});
+		else toDelete.push(branch);
+	}
+	return {
+		toDelete,
+		skipped
+	};
+};
+/**
+* Prune the git → Neon workflow state. By default this only cleans `.neon`: mapping entries
+* whose git branch no longer exists locally are dropped. With `--prune-neon-branches` it also
+* deletes the orphaned Neon branches — never the default branch and never a protected one.
+*/
+const cleanup = async (props) => {
+	const cwd = process.cwd();
+	if (!isGitRepo(cwd)) throw new Error("Not inside a git repository.");
+	const repoRoot = gitRepoRoot(cwd) ?? cwd;
+	const gitStateFile = repoRootContextFile(repoRoot);
+	const context = readContextFile(gitStateFile);
+	const map = gitBranchMap(context);
+	const entries = Object.entries(map);
+	if (entries.length === 0) {
+		log.info("No git → Neon mappings to clean up.");
+		return;
+	}
+	const local = new Set(localGitBranches(cwd));
+	const stale = entries.filter(([gitBranch]) => !local.has(gitBranch));
+	if (stale.length === 0) {
+		log.info("All %d mapping(s) still have a local git branch — nothing to prune.", entries.length);
+		return;
+	}
+	const kept = Object.fromEntries(entries.filter(([gitBranch]) => local.has(gitBranch)));
+	const keptNeonNames = new Set(Object.values(kept));
+	const staleButShared = stale.filter(([, neonBranch]) => keptNeonNames.has(neonBranch));
+	const orphaned = stale.filter(([, neonBranch]) => !keptNeonNames.has(neonBranch));
+	if (!props.pruneNeonBranches) {
+		setGitBranchMap(gitStateFile, kept);
+		log.info("Pruned %d stale mapping(s) from .neon:", stale.length);
+		for (const [gitBranch, neonBranch] of stale) log.info("  %s → %s", gitBranch, neonBranch);
+		if (orphaned.length > 0) log.info("These Neon branch(es) are no longer mapped and were not deleted: %s. Delete them with `neon branches delete <name>`, or run `neon git cleanup --prune-neon-branches` next time before a mapping-only cleanup.", orphaned.map(([, neonBranch]) => neonBranch).join(", "));
+		return;
+	}
+	if (staleButShared.length > 0) {
+		setGitBranchMap(gitStateFile, {
+			...kept,
+			...Object.fromEntries(orphaned)
+		});
+		log.info("Pruned %d stale mapping(s) whose Neon branch is still in use elsewhere:", staleButShared.length);
+		for (const [gitBranch, neonBranch] of staleButShared) log.info("  %s → %s", gitBranch, neonBranch);
+	}
+	if (!props.projectId) throw new Error("Cannot delete Neon branches: no project in context. Run `neon link` first.");
+	if (!context.projectId) throw new Error(`Cannot delete Neon branches: the git → Neon map has no recorded project (the repo-root .neon at ${gitStateFile} has no projectId). Run \`neon link --context-file ${quoteFlagValue(gitStateFile)}\` to establish it, or \`neon git cleanup\` with no --prune-neon-branches to only prune the local mapping.`);
+	if (context.projectId !== props.projectId) throw new Error(`Cannot delete Neon branches: this git → Neon map was recorded against project ${context.projectId}, but the active project is ${props.projectId}. Run \`neon link\` (or drop --project-id) to target ${context.projectId}, or \`neon git cleanup\` with no --prune-neon-branches to only prune the local mapping.`);
+	if (orphaned.length === 0) {
+		log.info("No orphaned Neon branches to delete.");
+		return;
+	}
+	const orphanNeonNames = new Set(orphaned.map(([, neonBranch]) => neonBranch));
+	const branches = (await props.apiClient.listProjectBranches({ projectId: props.projectId })).data.branches;
+	const { toDelete, skipped } = partitionBranchesToPrune(branches, orphanNeonNames);
+	for (const { name, reason } of skipped) log.info("Keeping Neon branch %s (%s) — never auto-deleted.", name, reason);
+	if (toDelete.length === 0) {
+		log.info("No orphaned Neon branches to delete.");
+		return;
+	}
+	if (!await confirmPrune(props, toDelete)) {
+		log.info("Aborted — no Neon branches were deleted, and no mappings were pruned.");
+		return;
+	}
+	const currentMap = {
+		...kept,
+		...Object.fromEntries(orphaned)
+	};
+	const failed = [];
+	let prunedCount = 0;
+	for (const branch of toDelete) {
+		const branchMappings = orphaned.filter(([, neonBranch]) => neonBranch === branch.name);
+		try {
+			await props.apiClient.deleteProjectBranch(props.projectId, branch.id);
+			log.info("Deleted Neon branch %s (%s).", branch.name, branch.id);
+			prunedCount += branchMappings.length;
+			for (const [gitBranch, neonBranch] of branchMappings) {
+				log.info("  Pruned %s → %s", gitBranch, neonBranch);
+				delete currentMap[gitBranch];
+			}
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			log.error("Failed to delete Neon branch %s: %s", branch.name, message);
+			failed.push({
+				name: branch.name,
+				error: message
+			});
+		}
+		setGitBranchMap(gitStateFile, currentMap);
+	}
+	if (prunedCount > 0) log.info("Pruned %d stale mapping(s) from .neon.", prunedCount);
+	if (failed.length > 0) throw new Error(`Failed to delete ${failed.length} Neon branch(es): ${failed.map((f) => `${f.name} (${f.error})`).join(", ")}. Re-run \`neon git cleanup --prune-neon-branches\` to retry.`);
+};
+/**
+* Confirm deleting the orphaned Neon branches. Deletion is destructive, so an explicit
+* `--yes` wins; otherwise prompt in an interactive terminal, and refuse (with a warning) in
+* CI / non-interactive contexts rather than deleting without consent.
+*/
+const confirmPrune = async (props, toDelete) => {
+	if (props.yes) return true;
+	if (isCi() || !process.stdout.isTTY) {
+		log.warning("Refusing to delete %d Neon branch(es) non-interactively. Re-run with --yes to confirm.", toDelete.length);
+		return false;
+	}
+	const { ok } = await prompts({
+		type: "confirm",
+		name: "ok",
+		message: `Delete ${toDelete.length} orphaned Neon branch(es): ${toDelete.map((branch) => branch.name).join(", ")}?`,
+		initial: false
+	});
+	return Boolean(ok);
+};
+//#endregion
+export { describe as a, install as c, sync as d, uninstall as f, command as i, partitionBranchesToPrune as l, builder as n, git_exports as o, cleanup as r, handler as s, aliases as t, status as u };

package/dist/_chunks/init-BkA6RilG.js

@@ -0,0 +1,111 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { getCliName } from "../utils/cli_name.js";
+import { helpCsv, helpEpilogue } from "../utils/help_text.js";
+import { NEON_SERVICES, servicesOption } from "../neon_services.js";
+import { coerceAgentFlag } from "../utils/agent_flag.js";
+import { initPluginAgents, initSkillsMcpAgents } from "../init/plan.js";
+import { listSkillIds } from "../skills/catalog.js";
+import { runInit } from "../init/run.js";
+//#region src/commands/init.ts
+var init_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const command = "init";
+const describe = "Set up coding agents and this directory for Neon. -y is Recommended. -y with Custom flags applies those answers without prompts.";
+const removedProtocol = () => `\`${getCliName()} init --data\` was removed. Run \`${getCliName()} init\` or \`${getCliName()} init -y\`.`;
+const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file", {
+	hidden: true,
+	type: "string",
+	default: ".neon"
+}).option("yes", {
+	alias: "y",
+	type: "boolean",
+	default: false,
+	describe: "Skip prompts. Alone: Recommended (detected agents, link when authenticated, default neon.ts). With --skill, MCP flags, --no-agent-setup, or --claimable: Custom using those flags"
+}).option("agent-setup", {
+	type: "boolean",
+	default: true,
+	describe: "Install Neon into coding agents. Use --no-agent-setup to skip. Plugin vs skills is inferred from --skill and MCP flags"
+}).option("claimable", {
+	type: "boolean",
+	default: false,
+	describe: "Create a claimable project that expires in 72 hours unless claimed. Selects Custom"
+}).option("package-manager", {
+	type: "string",
+	choices: [
+		"npm",
+		"pnpm",
+		"yarn",
+		"bun"
+	],
+	describe: "Package manager for neon.ts dependencies. -y uses this without asking. Custom asks only when none is detected"
+}).option("link", {
+	type: "boolean",
+	default: true,
+	describe: "Link a Neon project during setup. Use --no-link to skip without being asked"
+}).option("config", {
+	type: "boolean",
+	describe: "Create neon.ts after linking. Use --no-config to skip. Omitted in Custom: you will be asked"
+}).option("services", servicesOption({
+	key: "services",
+	allowed: NEON_SERVICES,
+	describe: "Services to declare in neon.ts",
+	also: "postgres alone writes the starter policy; every branch has Postgres. Implies creating neon.ts. Cannot be combined with --no-config."
+})).option("org-id", {
+	describe: "Forwarded to link: organization ID to link to",
+	type: "string"
+}).option("project-id", {
+	describe: "Forwarded to link: existing project ID to link to",
+	type: "string"
+}).option("project-name", {
+	describe: "Forwarded to link: name for a new project",
+	type: "string"
+}).option("region-id", {
+	describe: "Region for a new project, forwarded to link or to the claimable project",
+	type: "string"
+}).option("branch", {
+	alias: "branch-id",
+	describe: "Forwarded to link: branch name or ID to pin",
+	type: "string"
+}).option("agent", {
+	alias: "a",
+	type: "array",
+	string: true,
+	describe: "Coding agent to install into (repeatable). Skips agent selection. Values listed below",
+	coerce: coerceAgentFlag
+}).option("skill", {
+	type: "array",
+	string: true,
+	describe: "Neon skill to install (repeatable). Selects skills setup (not the plugin) and skips the skills picker. With MCP flags, also configures MCP. Values listed below"
+}).option("mcp-config-location", {
+	type: "string",
+	choices: ["global", "project"],
+	describe: "Where to configure the Neon MCP server: global (user config, same as neon mcp) or project (this directory, same as neon mcp --project). Selects skills and MCP setup"
+}).option("mcp-auth", {
+	type: "string",
+	choices: ["oauth", "api-key"],
+	describe: "MCP authentication. Selects skills and MCP setup. oauth is neon mcp --oauth"
+}).option("mcp-project-scoped", {
+	type: "boolean",
+	default: false,
+	describe: "Limit MCP tools to the linked project, same as neon mcp --project-id. Selects skills and MCP setup"
+}).option("data", {
+	hidden: true,
+	type: "string"
+}).option("output", {
+	alias: "o",
+	hidden: true,
+	describe: "Not supported; the commands init runs print their own output"
+}).example("$0 init", "Recommended or Custom setup").example("$0 init -y", "Recommended setup without prompts").example("$0 init -y --skill neon --mcp-auth oauth --mcp-config-location project", "Custom: those skills and MCP, Recommended defaults for the rest").example("$0 init --no-agent-setup --claimable", "Skip agent setup and create a claimable project").example("$0 init --agent cursor --agent claude-code", "Skip agent selection; install tooling for those agents").epilogue(helpEpilogue("Recommended setup installs tooling for detected coding agents, links a Neon project when the CLI is authenticated or the session is interactive, and writes a default neon.ts.", "init sets up the current directory in place. It does not scaffold starter files.", "-y alone is Recommended. -y with --skill, MCP flags, --no-agent-setup, or --claimable is Custom: those flags, Recommended defaults for unanswered questions. -y never opens a browser.", "--skill selects skills (not the plugin). MCP flags select skills and MCP. --no-agent-setup skips agent setup. --agent without those flags installs the plugin (and skills/MCP for agents the plugin cannot cover).", "Without a TTY, pass -y or enough flags to answer every question.", "--agent / -a is forwarded to plugins, or to skills and mcp. It skips agent selection, including with -y.", helpCsv("Plugin agents", initPluginAgents()), helpCsv("Skills and MCP agents", initSkillsMcpAgents()), helpCsv("Skills", listSkillIds()))).check((argv) => {
+	if (argv.data !== void 0) throw new Error(removedProtocol());
+	if (argv.help !== true && (argv.output === "json" || argv.output === "yaml")) throw new Error(`\`${getCliName()} init\` does not support --output. The commands it runs print their own output.`);
+	return true;
+}).strict();
+const handler = async (props) => {
+	await runInit(props);
+};
+//#endregion
+export { init_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/inspect-g0wekylj.js

@@ -0,0 +1,90 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { writer } from "../writer.js";
+import { fillSingleProject } from "../utils/enrichers.js";
+import { formatInspectQueryError, resolveInspectTargets, runInspectQuery } from "../utils/inspect_db.js";
+import { INSPECT_QUERIES } from "../utils/inspect_queries.js";
+//#region src/commands/inspect.ts
+var inspect_exports = /* @__PURE__ */ __exportAll({
+	aliases: () => aliases,
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const command = "inspect";
+const describe = "Inspect a branch's Postgres health and configuration";
+const aliases = ["inspection"];
+/**
+* `fillSingleProject` hits the API to auto-resolve a project. When the user
+* passes `--db-url` we bypass the Neon API entirely, so skip it.
+*/
+const fillSingleProjectUnlessDbUrl = async (props) => {
+	if (props.dbUrl) return props;
+	return fillSingleProject(props);
+};
+const runSubcommand = async (name, props) => {
+	const query = INSPECT_QUERIES[name];
+	const { targets, includeDatabaseColumn, branchDatabaseCount } = await resolveInspectTargets(props, query.scope);
+	const rows = [];
+	for (const target of targets) {
+		let batch;
+		try {
+			batch = await runInspectQuery(target.connectionUri, query.sql, { requiresExtension: query.requiresExtension });
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			const wrapped = formatInspectQueryError({
+				reason,
+				database: target.database,
+				dbUrl: props.dbUrl,
+				databaseName: props.databaseName,
+				offerDatabaseNameHint: branchDatabaseCount > 1,
+				scope: query.scope,
+				requiresExtension: query.requiresExtension
+			});
+			if (wrapped === void 0) throw err instanceof Error ? err : new Error(reason);
+			throw new Error(wrapped);
+		}
+		if (includeDatabaseColumn) rows.push(...batch.map((row) => ({
+			database: target.database,
+			...row
+		})));
+		else rows.push(...batch);
+	}
+	const fields = includeDatabaseColumn ? ["database", ...query.fields] : query.fields;
+	writer(props).end(rows, {
+		fields,
+		emptyMessage: includeDatabaseColumn ? query.emptyMessageAll ?? query.emptyMessage : query.emptyMessage
+	});
+};
+const dbBuilder = (argv) => {
+	let builder = argv.usage("$0 inspect db <sub-command> [options]").options({
+		"project-id": {
+			describe: "Project ID",
+			type: "string"
+		},
+		branch: {
+			describe: "Branch ID or name",
+			type: "string"
+		},
+		"database-name": {
+			describe: "Database to inspect. Omit to cover every database the API lists for the branch. Ranking and row limits stay per database. One failing database fails the whole run. Compute-wide checks run once against the first listed database. Ignored with --db-url.",
+			type: "string"
+		},
+		"role-name": {
+			describe: "Role name. Defaults to neondb_owner, else the only role besides the Data API and Neon Auth roles",
+			type: "string"
+		},
+		"db-url": {
+			describe: "Inspect any Postgres via a connection string, bypassing the Neon API (project/branch resolution is skipped)",
+			type: "string"
+		}
+	}).middleware(fillSingleProjectUnlessDbUrl);
+	for (const name of Object.keys(INSPECT_QUERIES)) builder = builder.command(name, INSPECT_QUERIES[name].describe, (yargs) => yargs, (args) => runSubcommand(name, args));
+	return builder;
+};
+const builder = (argv) => argv.usage("$0 inspect <sub-command> [options]").command("db", "Run a diagnostic query against a branch's Postgres", dbBuilder);
+const handler = (args) => {
+	return args;
+};
+//#endregion
+export { handler as a, describe as i, builder as n, inspect_exports as o, command as r, aliases as t };

package/dist/_chunks/ip_allow-5lLFvIuE.js

@@ -0,0 +1,106 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { getCliName } from "../utils/cli_name.js";
+import { projectUpdateRequest } from "../parameters.gen.js";
+import { writer } from "../writer.js";
+import { fillSingleProject } from "../utils/enrichers.js";
+//#region src/commands/ip_allow.ts
+var ip_allow_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const IP_ALLOW_FIELDS = [
+	"id",
+	"name",
+	"IP_addresses",
+	"protected_branches_only"
+];
+const command = "ip-allow";
+const describe = "Manage IP Allow";
+const builder = (argv) => {
+	return argv.usage("$0 ip-allow <sub-command> [options]").options({ "project-id": {
+		describe: "Project ID",
+		type: "string"
+	} }).middleware(fillSingleProject).command("list", "List the IP allowlist", (yargs) => yargs, async (args) => {
+		await list(args);
+	}).command("add [ips...]", "Add IP addresses to the IP allowlist", (yargs) => yargs.usage("$0 ip-allow add [ips...]").positional("ips", {
+		describe: "The list of IP addresses to add",
+		type: "string",
+		default: [],
+		array: true
+	}).options({ "protected-only": {
+		describe: projectUpdateRequest["project.settings.allowed_ips.protected_branches_only"].description,
+		type: "boolean"
+	} }), async (args) => {
+		await add(args);
+	}).command("remove [ips...]", "Remove IP addresses from the IP allowlist", (yargs) => yargs.usage("$0 ip-allow remove [ips...]").positional("ips", {
+		describe: "The list of IP addresses to remove",
+		type: "string",
+		default: [],
+		array: true
+	}), async (args) => {
+		await remove(args);
+	}).command("reset [ips...]", "Reset the IP allowlist", (yargs) => yargs.usage("$0 ip-allow reset [ips...]").positional("ips", {
+		describe: "The list of IP addresses to reset",
+		type: "string",
+		default: [],
+		array: true
+	}), async (args) => {
+		await reset(args);
+	});
+};
+const handler = (args) => {
+	return args;
+};
+const list = async (props) => {
+	const { data } = await props.apiClient.getProject(props.projectId);
+	writer(props).end(parse(data.project), { fields: IP_ALLOW_FIELDS });
+};
+const add = async (props) => {
+	if (props.ips.length <= 0) throw new Error(`Enter individual IP addresses, define ranges with a dash, or use CIDR notation for more flexibility.
+       Example: ${getCliName()} ip-allow add 192.168.1.1, 192.168.1.20-192.168.1.50, 192.168.1.0/24 --project-id <id>`);
+	const project = {};
+	const { data } = await props.apiClient.getProject(props.projectId);
+	const existingAllowedIps = data.project.settings?.allowed_ips;
+	project.settings = { allowed_ips: {
+		ips: [...new Set(props.ips.concat(existingAllowedIps?.ips ?? []))],
+		protected_branches_only: props.protectedOnly ?? existingAllowedIps?.protected_branches_only ?? false
+	} };
+	const { data: response } = await props.apiClient.updateProject(props.projectId, { project });
+	writer(props).end(parse(response.project), { fields: IP_ALLOW_FIELDS });
+};
+const remove = async (props) => {
+	if (props.ips.length <= 0) throw new Error(`Remove individual IP addresses and ranges. Example: ${getCliName()} ip-allow remove 192.168.1.1 --project-id <id>`);
+	const project = {};
+	const { data } = await props.apiClient.getProject(props.projectId);
+	const existingAllowedIps = data.project.settings?.allowed_ips;
+	project.settings = { allowed_ips: {
+		ips: existingAllowedIps?.ips?.filter((ip) => !props.ips.includes(ip)) ?? [],
+		protected_branches_only: existingAllowedIps?.protected_branches_only ?? false
+	} };
+	const { data: response } = await props.apiClient.updateProject(props.projectId, { project });
+	writer(props).end(parse(response.project), { fields: IP_ALLOW_FIELDS });
+};
+const reset = async (props) => {
+	const project = {};
+	project.settings = { allowed_ips: {
+		ips: props.ips,
+		protected_branches_only: false
+	} };
+	const { data } = await props.apiClient.updateProject(props.projectId, { project });
+	writer(props).end(parse(data.project), { fields: IP_ALLOW_FIELDS });
+	if (props.ips.length <= 0) log.info(`The IP allowlist has been reset. All databases on project "${data.project.name}" are now exposed to the internet`);
+};
+const parse = (project) => {
+	const ips = project.settings?.allowed_ips?.ips ?? [];
+	return {
+		id: project.id,
+		name: project.name,
+		IP_addresses: ips,
+		protected_branches_only: project.settings?.allowed_ips?.protected_branches_only ?? false
+	};
+};
+//#endregion
+export { ip_allow_exports as a, handler as i, command as n, describe as r, builder as t };