neon 8.12.1 → 8.13.0

package/dist/_chunks/{checkout-CXIOydqZ.js → checkout-BGvlLc43.js}

@@ -11,9 +11,9 @@ import { looksLikeBranchId } from "../utils/formats.js";
 import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js";
 import { buildCheckoutEvent, readGitContext } from "../utils/git.js";
 import { buildHookBranch, loadHookConfig, resolveHookEnv, runCheckoutAfterHook, runCheckoutBeforeHook, runCreateAfterHook, runCreateBeforeHook } from "../utils/hooks.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
-import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BH_qRHiG.js";
-import { i as handler$1 } from "./link-BgtkOBws.js";
+import { n as autoPullEnvAfterPin } from "./env-uVRY4xah.js";
+import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BnwcGpbq.js";
+import { i as handler$1 } from "./link-DOM84hYj.js";
 import chalk from "chalk";
 import prompts from "prompts";
 //#region src/commands/checkout.ts

package/dist/_chunks/{claim-DqAvAvDm.js → claim-DqzLXZMN.js}

@@ -12,7 +12,7 @@ import { projectConfigPath } from "../project.js";
 import { resolveEnvFilePath } from "../env_file.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
-import { c as pull } from "./env-5HS5qQGd.js";
+import { c as pull } from "./env-uVRY4xah.js";
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import open from "open";
 import prompts from "prompts";

package/dist/_chunks/{config-BH_qRHiG.js → config-BnwcGpbq.js}

@@ -23,7 +23,7 @@ import { readGitContext } from "../utils/git.js";
 import { resolveHookEnv, runDeployAfterHook, runDeployBeforeHook } from "../utils/hooks.js";
 import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
+import { n as autoPullEnvAfterPin } from "./env-uVRY4xah.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import chalk from "chalk";

package/dist/_chunks/{deploy-D7B0Xfjg.js → deploy-BCVcDR1O.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BH_qRHiG.js";
+import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BnwcGpbq.js";
 import { DEPLOY_COMMANDS_EPILOGUE } from "../commands/deploy_help.js";
 //#region src/commands/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({

package/dist/_chunks/{dev-CSvxAecE.js → dev-mrJKMt2R.js}

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "./env-BpP3Dqpe.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
 import { a as resolveDevEnv } from "./env-BNm69Qh8.js";
-import { f as envFlag } from "./config-BH_qRHiG.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
+import { f as envFlag } from "./config-BnwcGpbq.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/_chunks/{git-H32TNt6M.js → git-pN4kMH0d.js}

@@ -5,8 +5,8 @@ import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollow
 import { writer } from "../writer.js";
 import { neonSafeBranchName } from "../utils/branch_name.js";
 import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
-import { o as quoteFlagValue } from "./link-BgtkOBws.js";
-import { o as handler$1 } from "./checkout-CXIOydqZ.js";
+import { o as quoteFlagValue } from "./link-DOM84hYj.js";
+import { o as handler$1 } from "./checkout-BGvlLc43.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";

package/dist/_chunks/{link-BgtkOBws.js → link-DOM84hYj.js}

@@ -13,8 +13,8 @@ import { writer } from "../writer.js";
 import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
-import { h as initCmd } from "./config-BH_qRHiG.js";
+import { n as autoPullEnvAfterPin } from "./env-uVRY4xah.js";
+import { h as initCmd } from "./config-BnwcGpbq.js";
 import { formatLinkSummary } from "../commands/link_output.js";
 import { r as REGIONS } from "./projects-BwI2Uo0z.js";
 import prompts from "prompts";

package/dist/_chunks/{neon_auth-CBs1_3qu.js → neon_auth-DpF83S24.js}

@@ -1,4 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { stripAnsi } from "../human_table.js";
 import { writer } from "../writer.js";
@@ -78,6 +79,24 @@ const ORGANIZATION_FIELDS = [
 	"organization_limit",
 	"creator_role"
 ];
+const OAUTH_SERVER_FIELDS = [
+	"enabled",
+	"login_page",
+	"consent_page",
+	"mcp",
+	"resources"
+];
+const OAUTH_CLIENT_FIELDS = [
+	"client_id",
+	"name",
+	"type",
+	"redirect_uris",
+	"resources",
+	"skip_consent",
+	"disabled",
+	"created_at"
+];
+const OAUTH_CLIENT_SECRET_FIELDS = ["client_id", "client_secret"];
 const WEBHOOK_FIELDS = [
 	"enabled",
 	"webhook_url",
@@ -110,7 +129,7 @@ const builder = (argv) => {
 		default: false
 	} }), async (args) => {
 		await disable(args);
-	}).command("oauth-provider", "Manage OAuth providers", (yargs) => {
+	}).command("oauth-provider", `Manage social login providers (${SUPPORTED_OAUTH_PROVIDERS.join(", ")})`, (yargs) => {
 		return yargs.usage("$0 neon-auth oauth-provider <sub-command> [options]").command("list", "List OAuth providers", (yargs) => yargs, async (args) => {
 			await oauthProviderList(args);
 		}).command("add", "Add an OAuth provider", (yargs) => yargs.options({
@@ -155,6 +174,87 @@ const builder = (argv) => {
 		} }), async (args) => {
 			await oauthProviderDelete(args);
 		});
+	}).command("oauth-client", "Manage clients of this Neon Auth OAuth server (e.g. MCP clients); configure the server with `config oauth-server`", (yargs) => {
+		return yargs.usage("$0 neon-auth oauth-client <sub-command> [options]").command("list", "List OAuth clients", (yargs) => yargs, async (args) => {
+			await oauthClientList(args);
+		}).command("create", "Create an OAuth client", (yargs) => yargs.options({
+			name: {
+				describe: "Display name of the client",
+				type: "string",
+				demandOption: true
+			},
+			type: {
+				describe: "Client type. Confidential clients receive a secret that is shown only once",
+				type: "string",
+				choices: ["confidential", "public"],
+				demandOption: true
+			},
+			"redirect-uris": {
+				describe: "Redirect URIs the client may use (https, or http on loopback when localhost is allowed)",
+				type: "string",
+				array: true,
+				demandOption: true
+			},
+			resources: {
+				describe: "Protected resource URLs to link the client to; each must be configured with `neon-auth config oauth-server resource add`",
+				type: "string",
+				array: true,
+				demandOption: true
+			},
+			"skip-consent": {
+				describe: "Skip the consent prompt (first-party clients only)",
+				type: "boolean"
+			}
+		}).example("$0 neon-auth oauth-client create --name 'My app' --type confidential --redirect-uris https://app.example.com/callback --resources https://api.example.com", "Create a confidential client"), async (args) => {
+			await oauthClientCreate(args);
+		}).command("get <client-id>", "Get an OAuth client", (yargs) => yargs.usage("$0 neon-auth oauth-client get <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientGet(args);
+		}).command("update <client-id>", "Update an OAuth client (the type cannot be changed)", (yargs) => yargs.usage("$0 neon-auth oauth-client update <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}).options({
+			name: {
+				describe: "Display name of the client",
+				type: "string"
+			},
+			"redirect-uris": {
+				describe: "Redirect URIs the client may use; replaces the stored list",
+				type: "string",
+				array: true
+			},
+			resources: {
+				describe: "Protected resource URLs to link the client to; replaces the stored list (at least one)",
+				type: "string",
+				array: true
+			},
+			"skip-consent": {
+				describe: "Skip the consent prompt (first-party clients only). Use --no-skip-consent or --skip-consent false to turn off",
+				type: "boolean"
+			},
+			disabled: {
+				describe: "Disable the client. Use --no-disabled or --disabled false to re-enable",
+				type: "boolean"
+			}
+		}), async (args) => {
+			await oauthClientUpdate(args);
+		}).command("delete <client-id>", "Delete an OAuth client", (yargs) => yargs.usage("$0 neon-auth oauth-client delete <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientDelete(args);
+		}).command("rotate-secret <client-id>", "Rotate the secret of a confidential client; the old secret stops working immediately", (yargs) => yargs.usage("$0 neon-auth oauth-client rotate-secret <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientRotateSecret(args);
+		});
 	}).command("domain", "Manage redirect URI trusted domains", (yargs) => {
 		return yargs.usage("$0 neon-auth domain <sub-command> [options]").command("list", "List trusted domains", (yargs) => yargs, async (args) => {
 			await domainList(args);
@@ -283,6 +383,63 @@ const builder = (argv) => {
 			}), async (args) => {
 				await organizationUpdate(args);
 			});
+		}).command("oauth-server", "Manage the OAuth 2.1 authorization server (API plugin: oauth_provider)", (yargs) => {
+			return yargs.usage("$0 neon-auth config oauth-server <sub-command> [options]").command("get", "Get OAuth server config", (yargs) => yargs, async (args) => {
+				await oauthServerGet(args);
+			}).command("update", "Update OAuth server config", (yargs) => yargs.options({
+				enabled: {
+					describe: "Enable the OAuth server. Use --no-enabled or --enabled false to disable",
+					type: "boolean"
+				},
+				"login-page": {
+					describe: "URL of the page authorization requests redirect to for sign-in",
+					type: "string"
+				},
+				"consent-page": {
+					describe: "URL of the page authorization requests redirect to for consent",
+					type: "string"
+				},
+				resources: {
+					describe: "Protected resource URLs that clients can be linked to; replaces the stored list. Use `resource add|remove` for incremental changes",
+					type: "string",
+					array: true
+				},
+				"mcp-resource": {
+					describe: "MCP server URL that MCP clients are linked to. Defaults to the stored value when another --mcp-* flag is given. To remove the MCP configuration, use --no-mcp",
+					type: "string"
+				},
+				mcp: {
+					describe: "Remove the MCP configuration (only --no-mcp is accepted)",
+					type: "boolean"
+				},
+				"mcp-client-id-metadata-documents": {
+					describe: "Allow MCP clients to identify themselves with a Client ID Metadata Document (CIMD) URL. Use --no-mcp-client-id-metadata-documents to disallow",
+					type: "boolean"
+				},
+				"mcp-dynamic-registration": {
+					describe: "Allow MCP clients to register themselves via dynamic client registration (deprecated in favor of CIMD)",
+					type: "boolean",
+					hidden: true
+				}
+			}).example("$0 neon-auth config oauth-server update --enabled --mcp-resource https://example.com/mcp --mcp-client-id-metadata-documents", "Enable the OAuth server for an MCP server"), async (args) => {
+				await oauthServerUpdate(args);
+			}).command("resource", "Manage the protected resources of the OAuth server. Add and remove read the stored list and write back the full list, so concurrent changes by others can be overwritten", (yargs) => yargs.usage("$0 neon-auth config oauth-server resource <sub-command> [options]").command("list", "List protected resources", (yargs) => yargs, async (args) => {
+				await oauthResourceList(args);
+			}).command("add <url...>", "Add protected resources (reads the stored list and writes back the full list; concurrent changes by others can be overwritten)", (yargs) => yargs.positional("url", {
+				describe: "Protected resource URLs to add",
+				type: "string",
+				array: true,
+				demandOption: true
+			}), async (args) => {
+				await oauthResourceAdd(args);
+			}).command("remove <url...>", "Remove protected resources (reads the stored list and writes back the full list; concurrent changes by others can be overwritten)", (yargs) => yargs.positional("url", {
+				describe: "Protected resource URLs to remove",
+				type: "string",
+				array: true,
+				demandOption: true
+			}), async (args) => {
+				await oauthResourceRemove(args);
+			}));
 		}).command("webhook", "Manage webhook configuration", (yargs) => {
 			return yargs.usage("$0 neon-auth config webhook <sub-command> [options]").command("get", "Get webhook config", (yargs) => yargs, async (args) => {
 				await webhookGet(args);
@@ -319,7 +476,7 @@ const builder = (argv) => {
 		return yargs.usage("$0 neon-auth plugins <sub-command> [options]").command("list", "List all plugin configurations", (yargs) => yargs, async (args) => {
 			await pluginsList(args);
 		}).command("get <plugin-name>", "Get a specific plugin configuration", (yargs) => yargs.usage("$0 neon-auth plugins get <plugin-name> [options]").positional("plugin-name", {
-			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, allow_localhost)",
+			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, oauth_provider, allow_localhost)",
 			type: "string",
 			demandOption: true
 		}), async (args) => {
@@ -714,6 +871,287 @@ const organizationUpdate = async (props) => {
 	}
 	printKvBlock("Organization configuration updated", printOrganizationEntries(data));
 };
+const optionalBool = (v) => v === void 0 ? void 0 : String(v);
+const printOAuthServerEntries = (data) => [
+	["Enabled:", String(data.enabled)],
+	["Login Page:", data.login_page],
+	["Consent Page:", data.consent_page],
+	["MCP Resource:", data.mcp?.resource],
+	["MCP CIMD:", optionalBool(data.mcp?.client_id_metadata_documents)],
+	["MCP Dynamic Reg:", optionalBool(data.mcp?.dynamic_registration)],
+	["Resources:", (data.resources ?? []).map((r) => r.identifier).join(", ")]
+];
+/** The API rejects an empty PATCH, so fail before any request with the flags that would do something. */
+const requireUpdateFields = (provided, flags) => {
+	if (provided.every((value) => value === void 0)) throw new Error(`Nothing to update. Pass at least one of ${flags.join(", ")}.`);
+};
+const oauthServerGet = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_SERVER_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth server configuration", printOAuthServerEntries(data));
+};
+/**
+* The API requires `mcp.resource` whenever `mcp` is sent and keeps stored booleans that are
+* omitted, so only the resource is filled in from the stored config.
+*/
+const resolveMcpUpdate = async (props, getStoredMcp) => {
+	const { mcpResource, mcpDynamicRegistration: dynamicRegistration, mcpClientIdMetadataDocuments: clientIdMetadataDocuments } = props;
+	if (mcpResource === void 0 && dynamicRegistration === void 0 && clientIdMetadataDocuments === void 0) return;
+	const resource = mcpResource ?? (await getStoredMcp())?.resource;
+	if (!resource) throw new Error("No MCP resource is configured yet. Pass --mcp-resource <url> together with the other --mcp-* flags.");
+	return {
+		resource,
+		dynamic_registration: dynamicRegistration,
+		client_id_metadata_documents: clientIdMetadataDocuments
+	};
+};
+/**
+* Order-preserving dedupe after trimming: padded input would otherwise miss stored values
+* and reach the API as a distinct string, and repeats would be sent as duplicates.
+*/
+const unique = (values) => [...new Set(values.map((value) => value.trim()))];
+/** yargs negation turns `--no-<flag>` on an array option into `[false]`, which bypasses empty-array checks. */
+const isNegatedList = (values) => values === false || Array.isArray(values) && values.includes(false);
+const hasBlank = (values) => values?.some((value) => value.trim() === "") ?? false;
+/** Fails before any request when a list flag was passed with no values or a blank one. */
+const requireNonEmptyLists = (lists) => {
+	for (const [flag, values] of lists) {
+		if (isNegatedList(values)) throw new Error(`--no-${flag.slice(2)} is not supported. ${flag} must list at least one value.`);
+		if (values?.length === 0) throw new Error(`${flag} must list at least one value.`);
+		if (hasBlank(values)) throw new Error(`${flag} must not contain empty values.`);
+	}
+};
+/**
+* yargs negation turns `--no-<flag>` on a string option into `false`, and `--flag ""` yields an
+* empty string; both would otherwise crash on `.trim()` or be sent to the API.
+*/
+const requireNonBlankString = (flag, value, hint) => {
+	if (value === false) throw new Error(`--no-${flag.slice(2)} is not supported. ${hint}`);
+	if (typeof value === "string" && value.trim() === "") throw new Error(`${flag} must not be empty.`);
+};
+const requireNonBlankUrls = (urls) => {
+	if (hasBlank(urls)) throw new Error("URLs must not be empty.");
+};
+/** The MCP resource is linked to MCP clients on its own, so it cannot also be a protected resource. */
+const rejectMcpResourceCollision = (urls, mcpResource) => {
+	if (mcpResource && urls.includes(mcpResource)) throw new Error(`${mcpResource} is the MCP resource and cannot also be a protected resource.`);
+};
+/** Checked before any request so a malformed invocation never reaches the API. */
+const validateOAuthServerUpdate = (props) => {
+	requireNonBlankString("--login-page", props.loginPage, "Pass --login-page <url>.");
+	requireNonBlankString("--consent-page", props.consentPage, "Pass --consent-page <url>.");
+	if (props.mcp === true) throw new Error("--mcp cannot be enabled. Configure MCP with --mcp-resource <url>, or remove it with --no-mcp.");
+	if (props.mcp === false && (props.mcpResource !== void 0 || props.mcpClientIdMetadataDocuments !== void 0 || props.mcpDynamicRegistration !== void 0)) throw new Error("--no-mcp cannot be combined with --mcp-resource, --mcp-client-id-metadata-documents or --mcp-dynamic-registration.");
+	if (props.mcpResource === false) throw new Error("--no-mcp-resource is not supported. To remove the MCP configuration, use --no-mcp.");
+	if (props.mcpResource?.trim() === "") throw new Error("--mcp-resource must not be empty. To remove the MCP configuration, use --no-mcp.");
+	if (isNegatedList(props.resources)) throw new Error("--no-resources is not supported. To remove resources, use `neon-auth config oauth-server resource remove <url...>`.");
+	if (props.resources?.length === 0) throw new Error("--resources must list at least one URL. To remove resources, use `neon-auth config oauth-server resource remove <url...>`.");
+	if (hasBlank(props.resources)) throw new Error("--resources must not contain empty values.");
+};
+const oauthServerUpdate = async (props) => {
+	requireUpdateFields([
+		props.enabled,
+		props.loginPage,
+		props.consentPage,
+		props.resources,
+		props.mcp,
+		props.mcpResource,
+		props.mcpClientIdMetadataDocuments,
+		props.mcpDynamicRegistration
+	], [
+		"--enabled",
+		"--login-page",
+		"--consent-page",
+		"--resources",
+		"--no-mcp",
+		"--mcp-resource",
+		"--mcp-client-id-metadata-documents"
+	]);
+	validateOAuthServerUpdate(props);
+	const loginPage = props.loginPage?.trim();
+	const consentPage = props.consentPage?.trim();
+	const mcpResource = props.mcpResource?.trim();
+	const branchId = await resolveBranch(props);
+	let storedMcp;
+	const getStoredMcp = () => storedMcp ??= props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId).then(({ data }) => data.mcp);
+	const mcp = props.mcp === false ? { resource: "" } : await resolveMcpUpdate({
+		...props,
+		mcpResource
+	}, getStoredMcp);
+	const resources = props.resources && unique(props.resources);
+	if (resources && props.mcp !== false) rejectMcpResourceCollision(resources, mcp?.resource ?? (await getStoredMcp())?.resource);
+	if (props.mcpDynamicRegistration !== void 0) log.warning("--mcp-dynamic-registration is deprecated. Use --mcp-client-id-metadata-documents instead.");
+	const { data } = await props.apiClient.updateNeonAuthOAuthProviderPlugin(props.projectId, branchId, {
+		enabled: props.enabled,
+		login_page: loginPage,
+		consent_page: consentPage,
+		mcp,
+		resources: resources?.map((identifier) => ({ identifier }))
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_SERVER_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth server configuration updated", printOAuthServerEntries(data));
+};
+const getStoredOAuthServer = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId);
+	return {
+		branchId,
+		mcpResource: data.mcp?.resource,
+		stored: (data.resources ?? []).map((r) => r.identifier)
+	};
+};
+const reportOAuthResources = (props, resources) => {
+	if (resources.length === 0 && props.output === "table") {
+		printMessage("No protected resources are configured");
+		return;
+	}
+	writer(props).end(resources, { fields: ["identifier"] });
+};
+/** The API replaces the whole list, so every change is a full-list PATCH. */
+const replaceOAuthResources = async (props, branchId, identifiers) => {
+	const { data } = await props.apiClient.updateNeonAuthOAuthProviderPlugin(props.projectId, branchId, { resources: identifiers.map((identifier) => ({ identifier })) });
+	reportOAuthResources(props, data.resources ?? []);
+};
+const oauthResourceList = async (props) => {
+	const { stored } = await getStoredOAuthServer(props);
+	reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+};
+const oauthResourceAdd = async (props) => {
+	requireNonBlankUrls(props.url);
+	const urls = unique(props.url);
+	const { branchId, mcpResource, stored } = await getStoredOAuthServer(props);
+	rejectMcpResourceCollision(urls, mcpResource);
+	const existing = urls.filter((url) => stored.includes(url));
+	if (existing.length > 0) log.warning(`Already configured, skipped: ${existing.join(", ")}`);
+	const added = urls.filter((url) => !stored.includes(url));
+	if (added.length === 0) {
+		reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+		return;
+	}
+	await replaceOAuthResources(props, branchId, [...stored, ...added]);
+};
+const oauthResourceRemove = async (props) => {
+	requireNonBlankUrls(props.url);
+	const requested = unique(props.url);
+	const { branchId, stored } = await getStoredOAuthServer(props);
+	const unknown = requested.filter((url) => !stored.includes(url));
+	if (unknown.length > 0) log.warning(`Not configured, skipped: ${unknown.join(", ")}`);
+	const urls = requested.filter((url) => stored.includes(url));
+	if (urls.length === 0) {
+		reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+		return;
+	}
+	await replaceOAuthResources(props, branchId, stored.filter((url) => !urls.includes(url)));
+	let linked;
+	try {
+		const { data } = await props.apiClient.listNeonAuthOAuthClients(props.projectId, branchId);
+		linked = data.clients.filter((client) => client.resources.some((resource) => urls.includes(resource)));
+	} catch (err) {
+		log.debug("Could not look up clients linked to the removed resource: %s", err);
+		log.warning("Removed, but could not check for clients still linked to it.");
+		return;
+	}
+	if (linked.length > 0) log.warning(`Clients still linked to a removed resource: ${linked.map((client) => `"${client.name}" (${client.client_id})`).join(", ")}. Their token requests for that resource may fail until it is added again.`);
+};
+const printOAuthClientEntries = (data) => [
+	["Client ID:", data.client_id],
+	["Name:", data.name],
+	["Type:", data.type],
+	["Redirect URIs:", data.redirect_uris.join(", ")],
+	["Resources:", data.resources.join(", ")],
+	["Skip Consent:", String(data.skip_consent)],
+	["Disabled:", String(data.disabled)],
+	["Created At:", data.created_at]
+];
+const oauthClientList = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.listNeonAuthOAuthClients(props.projectId, branchId);
+	if (data.clients.length === 0 && props.output === "table") {
+		printMessage("No OAuth clients are configured for this branch.");
+		return;
+	}
+	writer(props).end(data.clients, { fields: OAUTH_CLIENT_FIELDS });
+};
+/**
+* The secret is shown only once, so human output keeps it on its own last line of stdout
+* and the notice goes to stderr. Structured output keeps it in the object for scripts.
+*/
+const reportOAuthClientSecret = (props, data, fields, entries, title) => {
+	if (props.output === "table") {
+		printKvBlock(title, entries);
+		if (data.client_secret) writeStyled(`${data.client_secret}\n`);
+	} else writer(props).end(data, { fields });
+	if (data.client_secret) log.warning("Store this secret now: it is not shown again.");
+};
+const oauthClientCreate = async (props) => {
+	requireNonBlankString("--name", props.name, "Pass --name <name>.");
+	requireNonEmptyLists([["--redirect-uris", props.redirectUris], ["--resources", props.resources]]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.createNeonAuthOAuthClient(props.projectId, branchId, {
+		name: props.name.trim(),
+		type: props.type,
+		redirect_uris: unique(props.redirectUris),
+		resources: unique(props.resources),
+		skip_consent: props.skipConsent
+	});
+	reportOAuthClientSecret(props, data, [...OAUTH_CLIENT_FIELDS, "client_secret"], printOAuthClientEntries(data), "OAuth client");
+};
+const oauthClientGet = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthClient(props.projectId, branchId, props.clientId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_CLIENT_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth client", printOAuthClientEntries(data));
+};
+const oauthClientUpdate = async (props) => {
+	requireNonBlankString("--name", props.name, "Pass --name <name>.");
+	requireNonEmptyLists([["--redirect-uris", props.redirectUris], ["--resources", props.resources]]);
+	requireUpdateFields([
+		props.name,
+		props.redirectUris,
+		props.resources,
+		props.skipConsent,
+		props.disabled
+	], [
+		"--name",
+		"--redirect-uris",
+		"--resources",
+		"--skip-consent",
+		"--disabled"
+	]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthOAuthClient(props.projectId, branchId, props.clientId, {
+		name: props.name?.trim(),
+		redirect_uris: props.redirectUris && unique(props.redirectUris),
+		resources: props.resources && unique(props.resources),
+		skip_consent: props.skipConsent,
+		disabled: props.disabled
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_CLIENT_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth client updated", printOAuthClientEntries(data));
+};
+const oauthClientDelete = async (props) => {
+	const branchId = await resolveBranch(props);
+	await props.apiClient.deleteNeonAuthOAuthClient(props.projectId, branchId, props.clientId);
+	printMessage(`OAuth client "${props.clientId}" deleted`);
+};
+const oauthClientRotateSecret = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.rotateNeonAuthOAuthClientSecret(props.projectId, branchId, props.clientId);
+	reportOAuthClientSecret(props, data, OAUTH_CLIENT_SECRET_FIELDS, [["Client ID:", data.client_id]], "OAuth client secret");
+};
 const printWebhookEntries = (data) => [
 	["Enabled:", String(data.enabled)],
 	["URL:", data.webhook_url ?? ""],

package/dist/_chunks/{status-DV8Z2kw3.js → status-DoNjIbKf.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { y as status } from "./config-BH_qRHiG.js";
+import { y as status } from "./config-BnwcGpbq.js";
 //#region src/commands/status.ts
 var status_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,

package/dist/api.js

@@ -895,6 +895,69 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 			},
 			body: data
 		})),
+		getNeonAuthOAuthProviderPlugin: (projectId, branchId) => call(() => raw.getNeonAuthOAuthProviderPlugin({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		updateNeonAuthOAuthProviderPlugin: (projectId, branchId, data) => call(() => raw.updateNeonAuthOAuthProviderPlugin({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		listNeonAuthOAuthClients: (projectId, branchId) => call(() => raw.listNeonAuthOAuthClients({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		createNeonAuthOAuthClient: (projectId, branchId, data) => call(() => raw.createNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		getNeonAuthOAuthClient: (projectId, branchId, clientId) => call(() => raw.getNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
+		updateNeonAuthOAuthClient: (projectId, branchId, clientId, data) => call(() => raw.updateNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			},
+			body: data
+		})),
+		deleteNeonAuthOAuthClient: (projectId, branchId, clientId) => call(() => raw.deleteNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
+		rotateNeonAuthOAuthClientSecret: (projectId, branchId, clientId) => call(() => raw.rotateNeonAuthOAuthClientSecret({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
 		getNeonAuthWebhookConfig: (projectId, branchId) => call(() => raw.getNeonAuthWebhookConfig({
 			client,
 			path: {

package/dist/commands/checkout.js

@@ -1 +1 @@
-export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-CXIOydqZ.js";
+export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-BGvlLc43.js";

package/dist/commands/claim.js

@@ -1 +1 @@
-export { t as CLAIM_CREATE_FIELDS, n as CLAIM_LIST_FIELDS, r as aliases, i as builder, a as claimCreateFields, s as claimableCapabilities, c as command, l as create, u as describe, d as handler } from "../_chunks/claim-DqAvAvDm.js";
+export { t as CLAIM_CREATE_FIELDS, n as CLAIM_LIST_FIELDS, r as aliases, i as builder, a as claimCreateFields, s as claimableCapabilities, c as command, l as create, u as describe, d as handler } from "../_chunks/claim-DqzLXZMN.js";

package/dist/commands/config.js

@@ -1 +1 @@
-export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-BH_qRHiG.js";
+export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-BnwcGpbq.js";

package/dist/commands/deploy.js

@@ -1 +1 @@
-export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-D7B0Xfjg.js";
+export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-BCVcDR1O.js";

package/dist/commands/dev.js

@@ -1 +1 @@
-export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-CSvxAecE.js";
+export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-mrJKMt2R.js";

package/dist/commands/env.js

@@ -1 +1 @@
-export { t as ENV_PULL_SKIPPED_HINT, n as autoPullEnvAfterPin, r as builder, i as command, a as describe, s as handler, c as pull } from "../_chunks/env-5HS5qQGd.js";
+export { t as ENV_PULL_SKIPPED_HINT, n as autoPullEnvAfterPin, r as builder, i as command, a as describe, s as handler, c as pull } from "../_chunks/env-uVRY4xah.js";

package/dist/commands/functions_new.js

@@ -8,7 +8,7 @@ import { writer } from "../writer.js";
 import { formatInitDone, printInitDone } from "../init/chrome.js";
 import { FUNCTION_SLUG_PATTERN, deriveFunctionSlug } from "../utils/function_slug.js";
 import { displayPath } from "./env_output.js";
-import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-BH_qRHiG.js";
+import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-BnwcGpbq.js";
 import { recommendedOperations } from "../functions/registry.js";
 import { collidingFiles, operationsFromFlags, planConfigRegistration, planEnvExample, planScaffold, writeScaffold } from "../functions/scaffold.js";
 import { describeRegistrySource, openRegistry } from "../functions/source.js";

package/dist/commands/git.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-H32TNt6M.js";
+export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-pN4kMH0d.js";

package/dist/commands/index.js

@@ -2,34 +2,34 @@ import { r as auth_exports } from "../_chunks/auth-CIUtXByB.js";
 import { t as api_exports } from "../_chunks/api-GbEaBZJ5.js";
 import { n as api_keys_exports } from "../_chunks/api_keys-CNnnugbQ.js";
 import { n as ask_exports } from "../_chunks/ask-DVwy0eUL.js";
-import { o as env_exports } from "../_chunks/env-5HS5qQGd.js";
-import { c as config_exports } from "../_chunks/config-BH_qRHiG.js";
+import { o as env_exports } from "../_chunks/env-uVRY4xah.js";
+import { c as config_exports } from "../_chunks/config-BnwcGpbq.js";
 import { u as projects_exports } from "../_chunks/projects-BwI2Uo0z.js";
-import { a as link_exports } from "../_chunks/link-BgtkOBws.js";
+import { a as link_exports } from "../_chunks/link-DOM84hYj.js";
 import { o as mcp_exports } from "../_chunks/mcp-Bo-7TKc7.js";
 import { c as plugins_exports } from "../_chunks/plugins-DqD7BDO1.js";
 import { l as skills_exports } from "../_chunks/skills-BP6pIm7O.js";
 import { t as bootstrap_exports } from "../_chunks/bootstrap-wPZWa1sT.js";
 import { r as branches_exports } from "../_chunks/branches-BNa1xX1L.js";
 import { n as bucket_exports } from "../_chunks/bucket-BCdryTkD.js";
-import { n as checkout_exports } from "../_chunks/checkout-CXIOydqZ.js";
-import { o as claim_exports } from "../_chunks/claim-DqAvAvDm.js";
+import { n as checkout_exports } from "../_chunks/checkout-BGvlLc43.js";
+import { o as claim_exports } from "../_chunks/claim-DqzLXZMN.js";
 import { a as connection_string_exports } from "../_chunks/connection_string-DB4awPzZ.js";
 import { a as credentials_exports } from "../_chunks/credentials-BSjE9fRR.js";
 import { r as data_api_exports } from "../_chunks/data_api-Djxj5ZQD.js";
 import { o as databases_exports } from "../_chunks/databases-Dok4wru7.js";
-import { r as deploy_exports } from "../_chunks/deploy-D7B0Xfjg.js";
-import { s as dev_exports } from "../_chunks/dev-CSvxAecE.js";
+import { r as deploy_exports } from "../_chunks/deploy-BCVcDR1O.js";
+import { s as dev_exports } from "../_chunks/dev-mrJKMt2R.js";
 import { i as diff_exports } from "../_chunks/diff-DhxxbdQE.js";
 import { c as docs_exports } from "../_chunks/docs-CrVybkTP.js";
 import { o as feedback_exports } from "../_chunks/feedback-CMayyTa8.js";
 import { o as functions_exports } from "../_chunks/functions-Q0zuvtnk.js";
-import { o as git_exports } from "../_chunks/git-H32TNt6M.js";
+import { o as git_exports } from "../_chunks/git-pN4kMH0d.js";
 import { a as init_exports } from "../_chunks/init-BkA6RilG.js";
 import { o as inspect_exports } from "../_chunks/inspect-g0wekylj.js";
 import { a as ip_allow_exports } from "../_chunks/ip_allow-5lLFvIuE.js";
 import { l as logs_exports } from "../_chunks/logs-DWkpjzIH.js";
-import { a as neon_auth_exports } from "../_chunks/neon_auth-CBs1_3qu.js";
+import { a as neon_auth_exports } from "../_chunks/neon_auth-DpF83S24.js";
 import { a as open_exports } from "../_chunks/open-CX3BT3Tp.js";
 import { s as operations_exports } from "../_chunks/operations-D4I-AxVs.js";
 import { o as orgs_exports } from "../_chunks/orgs-xGfANwHQ.js";
@@ -39,7 +39,7 @@ import { s as realtime_exports } from "../_chunks/realtime-BRqIyGR-.js";
 import { l as roles_exports } from "../_chunks/roles-B4w3YT_7.js";
 import { a as set_context_exports } from "../_chunks/set_context-DbrwoImy.js";
 import { s as snapshots_exports } from "../_chunks/snapshots-RJBzW8GM.js";
-import { a as status_exports } from "../_chunks/status-DV8Z2kw3.js";
+import { a as status_exports } from "../_chunks/status-DoNjIbKf.js";
 import { d as triggers_exports } from "../_chunks/triggers-BrRo1z4b.js";
 import { s as user_exports } from "../_chunks/user-dlOGXbX9.js";
 import { i as vpc_endpoints_exports } from "../_chunks/vpc_endpoints-CNb0YfMo.js";

package/dist/commands/link.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-BgtkOBws.js";
+export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-DOM84hYj.js";

package/dist/commands/neon_auth.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-CBs1_3qu.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-DpF83S24.js";

package/dist/commands/status.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-DV8Z2kw3.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-DoNjIbKf.js";

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { branchIdFromProps } from "../utils/enrichers.js";
 import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
+import { branchIdFromProps } from "../utils/enrichers.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/init/auth.js

@@ -4,7 +4,7 @@ import "../config.js";
 import "../auth.js";
 import { c as ensureAuth } from "../_chunks/auth-CIUtXByB.js";
 import { recoverFrom401 } from "../auth_recovery.js";
-import { c as pull } from "../_chunks/env-5HS5qQGd.js";
+import { c as pull } from "../_chunks/env-uVRY4xah.js";
 import { c as setupNeonMcp } from "../_chunks/mcp-Bo-7TKc7.js";
 //#region src/init/auth.ts
 const isUnauthorized = (error) => isNeonApiError(error) && error.status === 401;

package/dist/init/link.js

@@ -4,7 +4,7 @@ import "../config.js";
 import "../auth.js";
 import { c as ensureAuth } from "../_chunks/auth-CIUtXByB.js";
 import { recoverFrom401 } from "../auth_recovery.js";
-import { s as runLink } from "../_chunks/link-BgtkOBws.js";
+import { s as runLink } from "../_chunks/link-DOM84hYj.js";
 //#region src/init/link.ts
 const isUnauthorized = (error) => isNeonApiError(error) && error.status === 401;
 const authenticationFailed = () => /* @__PURE__ */ new Error("Authentication failed.");

package/dist/init/run.js

@@ -17,15 +17,15 @@ import { FALLBACK_SKILLS_AGENTS, assertNamedAgentTooling, funnelAgentSetup, plan
 import { inferPackageManager, resolvePackageManager } from "../utils/package_manager.js";
 import { CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, MCP_API_KEY_NEEDS_AUTH, MCP_SCOPED_NEEDS_PROJECT, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, PROGRESS, PROJECT_PINNED_OFFLINE, claimableNext, claimableThenServicesNext, configInitNext, envPullFailedNext, existingConfigNext, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, newConfigNext, offlinePinNext, skippedLinkNext, unattendedUnauthedNext } from "./copy.js";
 import { agentsRowValue, configRowValue, formatInitDone, headingForKind, printInitBanner, printInitDone, printInitProgress, projectRowValue, shouldPrintInitBanner } from "./chrome.js";
-import { h as initCmd, t as ConfigInstallFailed } from "../_chunks/config-BH_qRHiG.js";
-import { o as quoteFlagValue, s as runLink } from "../_chunks/link-BgtkOBws.js";
+import { h as initCmd, t as ConfigInstallFailed } from "../_chunks/config-BnwcGpbq.js";
+import { o as quoteFlagValue, s as runLink } from "../_chunks/link-DOM84hYj.js";
 import { runAuthenticatedLink } from "./link.js";
 import { CannotMintApiKeyError } from "../mcp/mint.js";
 import { pullInitEnv } from "./auth.js";
 import { InitCancelled, raceSigint, restoreCursor } from "./cancelled.js";
 import { pickAgentSetupInteractively, pickInitAgentsInteractively, pickInitConfigInteractively, pickInitMcpAuthInteractively, pickInitMcpConfigLocationInteractively, pickInitModeInteractively, pickInitPackageManagerInteractively, pickInitProjectSetupInteractively, pickInitServicesInteractively, pickInitSkillsInteractively } from "./wizard.js";
 import { runToolingSteps } from "./tooling.js";
-import { l as create } from "../_chunks/claim-DqAvAvDm.js";
+import { l as create } from "../_chunks/claim-DqzLXZMN.js";
 import { INIT_CONFIG_SERVICES_CONFLICT, configPlanFromResolution, initEnvPullAfterConfig, resolveInitConfigChoice } from "./choices.js";
 import { detectInitEnvironment } from "./detect.js";
 import { createInitFunnel, emitInitStart, finishInitFunnel, initStartProperties } from "./funnel.js";

package/dist/skills/run.js

@@ -63,8 +63,8 @@ const quoteNpxArg = (part) => /[\s"'\\*]/.test(part) ? `'${part.replace(/'/g, `'
 const npxCommand = (args) => `npx ${args.map(quoteNpxArg).join(" ")}`;
 const ANSI = /\u001b\[[0-9;]*[A-Za-z]/g;
 const UPDATE_BANNER = /^Checking for skill updates/i;
-const UPDATE_NOTHING = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)|All global skills are up to date/i;
-const UPDATE_RESULT = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)\.?|All global skills are up to date|(?:✓\s*)?Updated \d+ skills?(?:\(s\))?|(?:✗\s*)?Failed to update \d+ skills?(?:\(s\))?/i;
+const UPDATE_NOTHING = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)|All (?:project|global) skills are up to date/i;
+const UPDATE_RESULT = /No (?:project|global) skills (?:to update|to check|tracked in lock file|can be updated in place)\.?|All (?:project|global) skills are up to date|(?:✓\s*)?Updated \d+ skills?(?:\(s\))?|(?:✗\s*)?Failed to update \d+ skills?(?:\(s\))?/i;
 const stripAnsi = (text) => text.replace(ANSI, "").replace(/\r/g, "");
 const skillsUpdateHadNothing = (output) => UPDATE_NOTHING.test(stripAnsi(output));
 const skillsUpdateDetail = (output) => {

package/dist/test_utils/fixtures.js

@@ -48,14 +48,15 @@ const test = test$1.extend({
 		let startedServer;
 		await use(async (mockDir, onRequest) => {
 			const app = express();
+			app.use(express.json());
 			if (onRequest) app.use((req, _res, next) => {
 				onRequest({
 					method: req.method,
-					path: req.path
+					path: req.path,
+					body: req.body
 				});
 				next();
 			});
-			app.use(express.json());
 			app.use("/", emocks(join(process.cwd(), "mocks", mockDir), { "404": (_req, res) => res.status(404).send({ message: "Not Found" }) }));
 			const server = await new Promise((resolve) => {
 				const s = app.listen(0, () => {
@@ -76,7 +77,7 @@ const test = test$1.extend({
 	},
 	testCliCommand: async ({ runMockServer }, use) => {
 		await use(async (args, options = {}) => {
-			const apiHost = options.unreachableHost ? await reserveClosedPort() : `http://localhost:${(await runMockServer(options.mockDir || "main")).address().port}`;
+			const apiHost = options.unreachableHost ? await reserveClosedPort() : `http://localhost:${(await runMockServer(options.mockDir || "main", options.onRequest)).address().port}`;
 			let output = "";
 			let error = "";
 			const cp = fork(join(process.cwd(), "./dist/index.js"), [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.12.1",
+  "version": "8.13.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -72,10 +72,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.4",
-    "@neon/config-runtime": "1.10.3",
+    "@neon/config-runtime": "1.10.4",
     "@neon/realtime": "0.1.2",
-    "@neon/sdk": "7.5.0"
+    "@neon/config": "1.9.5",
+    "@neon/sdk": "7.6.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -112,9 +112,9 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.35",
+    "@neon-internals/env-core": "0.0.36",
     "@neon/e2e-harness": "0.0.0",
-    "@neon/env": "1.6.5",
+    "@neon/env": "1.6.6",
     "@neon/functions": "0.11.0"
   },
   "publishConfig": {

package/dist/_chunks/{env-5HS5qQGd.js → env-uVRY4xah.js}

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "./env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "./env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "../commands/env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";