neon 8.12.2 → 8.13.0

package/dist/_chunks/{neon_auth-CBs1_3qu.js → neon_auth-DpF83S24.js}

@@ -1,4 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { stripAnsi } from "../human_table.js";
 import { writer } from "../writer.js";
@@ -78,6 +79,24 @@ const ORGANIZATION_FIELDS = [
 	"organization_limit",
 	"creator_role"
 ];
+const OAUTH_SERVER_FIELDS = [
+	"enabled",
+	"login_page",
+	"consent_page",
+	"mcp",
+	"resources"
+];
+const OAUTH_CLIENT_FIELDS = [
+	"client_id",
+	"name",
+	"type",
+	"redirect_uris",
+	"resources",
+	"skip_consent",
+	"disabled",
+	"created_at"
+];
+const OAUTH_CLIENT_SECRET_FIELDS = ["client_id", "client_secret"];
 const WEBHOOK_FIELDS = [
 	"enabled",
 	"webhook_url",
@@ -110,7 +129,7 @@ const builder = (argv) => {
 		default: false
 	} }), async (args) => {
 		await disable(args);
-	}).command("oauth-provider", "Manage OAuth providers", (yargs) => {
+	}).command("oauth-provider", `Manage social login providers (${SUPPORTED_OAUTH_PROVIDERS.join(", ")})`, (yargs) => {
 		return yargs.usage("$0 neon-auth oauth-provider <sub-command> [options]").command("list", "List OAuth providers", (yargs) => yargs, async (args) => {
 			await oauthProviderList(args);
 		}).command("add", "Add an OAuth provider", (yargs) => yargs.options({
@@ -155,6 +174,87 @@ const builder = (argv) => {
 		} }), async (args) => {
 			await oauthProviderDelete(args);
 		});
+	}).command("oauth-client", "Manage clients of this Neon Auth OAuth server (e.g. MCP clients); configure the server with `config oauth-server`", (yargs) => {
+		return yargs.usage("$0 neon-auth oauth-client <sub-command> [options]").command("list", "List OAuth clients", (yargs) => yargs, async (args) => {
+			await oauthClientList(args);
+		}).command("create", "Create an OAuth client", (yargs) => yargs.options({
+			name: {
+				describe: "Display name of the client",
+				type: "string",
+				demandOption: true
+			},
+			type: {
+				describe: "Client type. Confidential clients receive a secret that is shown only once",
+				type: "string",
+				choices: ["confidential", "public"],
+				demandOption: true
+			},
+			"redirect-uris": {
+				describe: "Redirect URIs the client may use (https, or http on loopback when localhost is allowed)",
+				type: "string",
+				array: true,
+				demandOption: true
+			},
+			resources: {
+				describe: "Protected resource URLs to link the client to; each must be configured with `neon-auth config oauth-server resource add`",
+				type: "string",
+				array: true,
+				demandOption: true
+			},
+			"skip-consent": {
+				describe: "Skip the consent prompt (first-party clients only)",
+				type: "boolean"
+			}
+		}).example("$0 neon-auth oauth-client create --name 'My app' --type confidential --redirect-uris https://app.example.com/callback --resources https://api.example.com", "Create a confidential client"), async (args) => {
+			await oauthClientCreate(args);
+		}).command("get <client-id>", "Get an OAuth client", (yargs) => yargs.usage("$0 neon-auth oauth-client get <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientGet(args);
+		}).command("update <client-id>", "Update an OAuth client (the type cannot be changed)", (yargs) => yargs.usage("$0 neon-auth oauth-client update <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}).options({
+			name: {
+				describe: "Display name of the client",
+				type: "string"
+			},
+			"redirect-uris": {
+				describe: "Redirect URIs the client may use; replaces the stored list",
+				type: "string",
+				array: true
+			},
+			resources: {
+				describe: "Protected resource URLs to link the client to; replaces the stored list (at least one)",
+				type: "string",
+				array: true
+			},
+			"skip-consent": {
+				describe: "Skip the consent prompt (first-party clients only). Use --no-skip-consent or --skip-consent false to turn off",
+				type: "boolean"
+			},
+			disabled: {
+				describe: "Disable the client. Use --no-disabled or --disabled false to re-enable",
+				type: "boolean"
+			}
+		}), async (args) => {
+			await oauthClientUpdate(args);
+		}).command("delete <client-id>", "Delete an OAuth client", (yargs) => yargs.usage("$0 neon-auth oauth-client delete <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientDelete(args);
+		}).command("rotate-secret <client-id>", "Rotate the secret of a confidential client; the old secret stops working immediately", (yargs) => yargs.usage("$0 neon-auth oauth-client rotate-secret <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientRotateSecret(args);
+		});
 	}).command("domain", "Manage redirect URI trusted domains", (yargs) => {
 		return yargs.usage("$0 neon-auth domain <sub-command> [options]").command("list", "List trusted domains", (yargs) => yargs, async (args) => {
 			await domainList(args);
@@ -283,6 +383,63 @@ const builder = (argv) => {
 			}), async (args) => {
 				await organizationUpdate(args);
 			});
+		}).command("oauth-server", "Manage the OAuth 2.1 authorization server (API plugin: oauth_provider)", (yargs) => {
+			return yargs.usage("$0 neon-auth config oauth-server <sub-command> [options]").command("get", "Get OAuth server config", (yargs) => yargs, async (args) => {
+				await oauthServerGet(args);
+			}).command("update", "Update OAuth server config", (yargs) => yargs.options({
+				enabled: {
+					describe: "Enable the OAuth server. Use --no-enabled or --enabled false to disable",
+					type: "boolean"
+				},
+				"login-page": {
+					describe: "URL of the page authorization requests redirect to for sign-in",
+					type: "string"
+				},
+				"consent-page": {
+					describe: "URL of the page authorization requests redirect to for consent",
+					type: "string"
+				},
+				resources: {
+					describe: "Protected resource URLs that clients can be linked to; replaces the stored list. Use `resource add|remove` for incremental changes",
+					type: "string",
+					array: true
+				},
+				"mcp-resource": {
+					describe: "MCP server URL that MCP clients are linked to. Defaults to the stored value when another --mcp-* flag is given. To remove the MCP configuration, use --no-mcp",
+					type: "string"
+				},
+				mcp: {
+					describe: "Remove the MCP configuration (only --no-mcp is accepted)",
+					type: "boolean"
+				},
+				"mcp-client-id-metadata-documents": {
+					describe: "Allow MCP clients to identify themselves with a Client ID Metadata Document (CIMD) URL. Use --no-mcp-client-id-metadata-documents to disallow",
+					type: "boolean"
+				},
+				"mcp-dynamic-registration": {
+					describe: "Allow MCP clients to register themselves via dynamic client registration (deprecated in favor of CIMD)",
+					type: "boolean",
+					hidden: true
+				}
+			}).example("$0 neon-auth config oauth-server update --enabled --mcp-resource https://example.com/mcp --mcp-client-id-metadata-documents", "Enable the OAuth server for an MCP server"), async (args) => {
+				await oauthServerUpdate(args);
+			}).command("resource", "Manage the protected resources of the OAuth server. Add and remove read the stored list and write back the full list, so concurrent changes by others can be overwritten", (yargs) => yargs.usage("$0 neon-auth config oauth-server resource <sub-command> [options]").command("list", "List protected resources", (yargs) => yargs, async (args) => {
+				await oauthResourceList(args);
+			}).command("add <url...>", "Add protected resources (reads the stored list and writes back the full list; concurrent changes by others can be overwritten)", (yargs) => yargs.positional("url", {
+				describe: "Protected resource URLs to add",
+				type: "string",
+				array: true,
+				demandOption: true
+			}), async (args) => {
+				await oauthResourceAdd(args);
+			}).command("remove <url...>", "Remove protected resources (reads the stored list and writes back the full list; concurrent changes by others can be overwritten)", (yargs) => yargs.positional("url", {
+				describe: "Protected resource URLs to remove",
+				type: "string",
+				array: true,
+				demandOption: true
+			}), async (args) => {
+				await oauthResourceRemove(args);
+			}));
 		}).command("webhook", "Manage webhook configuration", (yargs) => {
 			return yargs.usage("$0 neon-auth config webhook <sub-command> [options]").command("get", "Get webhook config", (yargs) => yargs, async (args) => {
 				await webhookGet(args);
@@ -319,7 +476,7 @@ const builder = (argv) => {
 		return yargs.usage("$0 neon-auth plugins <sub-command> [options]").command("list", "List all plugin configurations", (yargs) => yargs, async (args) => {
 			await pluginsList(args);
 		}).command("get <plugin-name>", "Get a specific plugin configuration", (yargs) => yargs.usage("$0 neon-auth plugins get <plugin-name> [options]").positional("plugin-name", {
-			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, allow_localhost)",
+			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, oauth_provider, allow_localhost)",
 			type: "string",
 			demandOption: true
 		}), async (args) => {
@@ -714,6 +871,287 @@ const organizationUpdate = async (props) => {
 	}
 	printKvBlock("Organization configuration updated", printOrganizationEntries(data));
 };
+const optionalBool = (v) => v === void 0 ? void 0 : String(v);
+const printOAuthServerEntries = (data) => [
+	["Enabled:", String(data.enabled)],
+	["Login Page:", data.login_page],
+	["Consent Page:", data.consent_page],
+	["MCP Resource:", data.mcp?.resource],
+	["MCP CIMD:", optionalBool(data.mcp?.client_id_metadata_documents)],
+	["MCP Dynamic Reg:", optionalBool(data.mcp?.dynamic_registration)],
+	["Resources:", (data.resources ?? []).map((r) => r.identifier).join(", ")]
+];
+/** The API rejects an empty PATCH, so fail before any request with the flags that would do something. */
+const requireUpdateFields = (provided, flags) => {
+	if (provided.every((value) => value === void 0)) throw new Error(`Nothing to update. Pass at least one of ${flags.join(", ")}.`);
+};
+const oauthServerGet = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_SERVER_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth server configuration", printOAuthServerEntries(data));
+};
+/**
+* The API requires `mcp.resource` whenever `mcp` is sent and keeps stored booleans that are
+* omitted, so only the resource is filled in from the stored config.
+*/
+const resolveMcpUpdate = async (props, getStoredMcp) => {
+	const { mcpResource, mcpDynamicRegistration: dynamicRegistration, mcpClientIdMetadataDocuments: clientIdMetadataDocuments } = props;
+	if (mcpResource === void 0 && dynamicRegistration === void 0 && clientIdMetadataDocuments === void 0) return;
+	const resource = mcpResource ?? (await getStoredMcp())?.resource;
+	if (!resource) throw new Error("No MCP resource is configured yet. Pass --mcp-resource <url> together with the other --mcp-* flags.");
+	return {
+		resource,
+		dynamic_registration: dynamicRegistration,
+		client_id_metadata_documents: clientIdMetadataDocuments
+	};
+};
+/**
+* Order-preserving dedupe after trimming: padded input would otherwise miss stored values
+* and reach the API as a distinct string, and repeats would be sent as duplicates.
+*/
+const unique = (values) => [...new Set(values.map((value) => value.trim()))];
+/** yargs negation turns `--no-<flag>` on an array option into `[false]`, which bypasses empty-array checks. */
+const isNegatedList = (values) => values === false || Array.isArray(values) && values.includes(false);
+const hasBlank = (values) => values?.some((value) => value.trim() === "") ?? false;
+/** Fails before any request when a list flag was passed with no values or a blank one. */
+const requireNonEmptyLists = (lists) => {
+	for (const [flag, values] of lists) {
+		if (isNegatedList(values)) throw new Error(`--no-${flag.slice(2)} is not supported. ${flag} must list at least one value.`);
+		if (values?.length === 0) throw new Error(`${flag} must list at least one value.`);
+		if (hasBlank(values)) throw new Error(`${flag} must not contain empty values.`);
+	}
+};
+/**
+* yargs negation turns `--no-<flag>` on a string option into `false`, and `--flag ""` yields an
+* empty string; both would otherwise crash on `.trim()` or be sent to the API.
+*/
+const requireNonBlankString = (flag, value, hint) => {
+	if (value === false) throw new Error(`--no-${flag.slice(2)} is not supported. ${hint}`);
+	if (typeof value === "string" && value.trim() === "") throw new Error(`${flag} must not be empty.`);
+};
+const requireNonBlankUrls = (urls) => {
+	if (hasBlank(urls)) throw new Error("URLs must not be empty.");
+};
+/** The MCP resource is linked to MCP clients on its own, so it cannot also be a protected resource. */
+const rejectMcpResourceCollision = (urls, mcpResource) => {
+	if (mcpResource && urls.includes(mcpResource)) throw new Error(`${mcpResource} is the MCP resource and cannot also be a protected resource.`);
+};
+/** Checked before any request so a malformed invocation never reaches the API. */
+const validateOAuthServerUpdate = (props) => {
+	requireNonBlankString("--login-page", props.loginPage, "Pass --login-page <url>.");
+	requireNonBlankString("--consent-page", props.consentPage, "Pass --consent-page <url>.");
+	if (props.mcp === true) throw new Error("--mcp cannot be enabled. Configure MCP with --mcp-resource <url>, or remove it with --no-mcp.");
+	if (props.mcp === false && (props.mcpResource !== void 0 || props.mcpClientIdMetadataDocuments !== void 0 || props.mcpDynamicRegistration !== void 0)) throw new Error("--no-mcp cannot be combined with --mcp-resource, --mcp-client-id-metadata-documents or --mcp-dynamic-registration.");
+	if (props.mcpResource === false) throw new Error("--no-mcp-resource is not supported. To remove the MCP configuration, use --no-mcp.");
+	if (props.mcpResource?.trim() === "") throw new Error("--mcp-resource must not be empty. To remove the MCP configuration, use --no-mcp.");
+	if (isNegatedList(props.resources)) throw new Error("--no-resources is not supported. To remove resources, use `neon-auth config oauth-server resource remove <url...>`.");
+	if (props.resources?.length === 0) throw new Error("--resources must list at least one URL. To remove resources, use `neon-auth config oauth-server resource remove <url...>`.");
+	if (hasBlank(props.resources)) throw new Error("--resources must not contain empty values.");
+};
+const oauthServerUpdate = async (props) => {
+	requireUpdateFields([
+		props.enabled,
+		props.loginPage,
+		props.consentPage,
+		props.resources,
+		props.mcp,
+		props.mcpResource,
+		props.mcpClientIdMetadataDocuments,
+		props.mcpDynamicRegistration
+	], [
+		"--enabled",
+		"--login-page",
+		"--consent-page",
+		"--resources",
+		"--no-mcp",
+		"--mcp-resource",
+		"--mcp-client-id-metadata-documents"
+	]);
+	validateOAuthServerUpdate(props);
+	const loginPage = props.loginPage?.trim();
+	const consentPage = props.consentPage?.trim();
+	const mcpResource = props.mcpResource?.trim();
+	const branchId = await resolveBranch(props);
+	let storedMcp;
+	const getStoredMcp = () => storedMcp ??= props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId).then(({ data }) => data.mcp);
+	const mcp = props.mcp === false ? { resource: "" } : await resolveMcpUpdate({
+		...props,
+		mcpResource
+	}, getStoredMcp);
+	const resources = props.resources && unique(props.resources);
+	if (resources && props.mcp !== false) rejectMcpResourceCollision(resources, mcp?.resource ?? (await getStoredMcp())?.resource);
+	if (props.mcpDynamicRegistration !== void 0) log.warning("--mcp-dynamic-registration is deprecated. Use --mcp-client-id-metadata-documents instead.");
+	const { data } = await props.apiClient.updateNeonAuthOAuthProviderPlugin(props.projectId, branchId, {
+		enabled: props.enabled,
+		login_page: loginPage,
+		consent_page: consentPage,
+		mcp,
+		resources: resources?.map((identifier) => ({ identifier }))
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_SERVER_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth server configuration updated", printOAuthServerEntries(data));
+};
+const getStoredOAuthServer = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId);
+	return {
+		branchId,
+		mcpResource: data.mcp?.resource,
+		stored: (data.resources ?? []).map((r) => r.identifier)
+	};
+};
+const reportOAuthResources = (props, resources) => {
+	if (resources.length === 0 && props.output === "table") {
+		printMessage("No protected resources are configured");
+		return;
+	}
+	writer(props).end(resources, { fields: ["identifier"] });
+};
+/** The API replaces the whole list, so every change is a full-list PATCH. */
+const replaceOAuthResources = async (props, branchId, identifiers) => {
+	const { data } = await props.apiClient.updateNeonAuthOAuthProviderPlugin(props.projectId, branchId, { resources: identifiers.map((identifier) => ({ identifier })) });
+	reportOAuthResources(props, data.resources ?? []);
+};
+const oauthResourceList = async (props) => {
+	const { stored } = await getStoredOAuthServer(props);
+	reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+};
+const oauthResourceAdd = async (props) => {
+	requireNonBlankUrls(props.url);
+	const urls = unique(props.url);
+	const { branchId, mcpResource, stored } = await getStoredOAuthServer(props);
+	rejectMcpResourceCollision(urls, mcpResource);
+	const existing = urls.filter((url) => stored.includes(url));
+	if (existing.length > 0) log.warning(`Already configured, skipped: ${existing.join(", ")}`);
+	const added = urls.filter((url) => !stored.includes(url));
+	if (added.length === 0) {
+		reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+		return;
+	}
+	await replaceOAuthResources(props, branchId, [...stored, ...added]);
+};
+const oauthResourceRemove = async (props) => {
+	requireNonBlankUrls(props.url);
+	const requested = unique(props.url);
+	const { branchId, stored } = await getStoredOAuthServer(props);
+	const unknown = requested.filter((url) => !stored.includes(url));
+	if (unknown.length > 0) log.warning(`Not configured, skipped: ${unknown.join(", ")}`);
+	const urls = requested.filter((url) => stored.includes(url));
+	if (urls.length === 0) {
+		reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+		return;
+	}
+	await replaceOAuthResources(props, branchId, stored.filter((url) => !urls.includes(url)));
+	let linked;
+	try {
+		const { data } = await props.apiClient.listNeonAuthOAuthClients(props.projectId, branchId);
+		linked = data.clients.filter((client) => client.resources.some((resource) => urls.includes(resource)));
+	} catch (err) {
+		log.debug("Could not look up clients linked to the removed resource: %s", err);
+		log.warning("Removed, but could not check for clients still linked to it.");
+		return;
+	}
+	if (linked.length > 0) log.warning(`Clients still linked to a removed resource: ${linked.map((client) => `"${client.name}" (${client.client_id})`).join(", ")}. Their token requests for that resource may fail until it is added again.`);
+};
+const printOAuthClientEntries = (data) => [
+	["Client ID:", data.client_id],
+	["Name:", data.name],
+	["Type:", data.type],
+	["Redirect URIs:", data.redirect_uris.join(", ")],
+	["Resources:", data.resources.join(", ")],
+	["Skip Consent:", String(data.skip_consent)],
+	["Disabled:", String(data.disabled)],
+	["Created At:", data.created_at]
+];
+const oauthClientList = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.listNeonAuthOAuthClients(props.projectId, branchId);
+	if (data.clients.length === 0 && props.output === "table") {
+		printMessage("No OAuth clients are configured for this branch.");
+		return;
+	}
+	writer(props).end(data.clients, { fields: OAUTH_CLIENT_FIELDS });
+};
+/**
+* The secret is shown only once, so human output keeps it on its own last line of stdout
+* and the notice goes to stderr. Structured output keeps it in the object for scripts.
+*/
+const reportOAuthClientSecret = (props, data, fields, entries, title) => {
+	if (props.output === "table") {
+		printKvBlock(title, entries);
+		if (data.client_secret) writeStyled(`${data.client_secret}\n`);
+	} else writer(props).end(data, { fields });
+	if (data.client_secret) log.warning("Store this secret now: it is not shown again.");
+};
+const oauthClientCreate = async (props) => {
+	requireNonBlankString("--name", props.name, "Pass --name <name>.");
+	requireNonEmptyLists([["--redirect-uris", props.redirectUris], ["--resources", props.resources]]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.createNeonAuthOAuthClient(props.projectId, branchId, {
+		name: props.name.trim(),
+		type: props.type,
+		redirect_uris: unique(props.redirectUris),
+		resources: unique(props.resources),
+		skip_consent: props.skipConsent
+	});
+	reportOAuthClientSecret(props, data, [...OAUTH_CLIENT_FIELDS, "client_secret"], printOAuthClientEntries(data), "OAuth client");
+};
+const oauthClientGet = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthClient(props.projectId, branchId, props.clientId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_CLIENT_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth client", printOAuthClientEntries(data));
+};
+const oauthClientUpdate = async (props) => {
+	requireNonBlankString("--name", props.name, "Pass --name <name>.");
+	requireNonEmptyLists([["--redirect-uris", props.redirectUris], ["--resources", props.resources]]);
+	requireUpdateFields([
+		props.name,
+		props.redirectUris,
+		props.resources,
+		props.skipConsent,
+		props.disabled
+	], [
+		"--name",
+		"--redirect-uris",
+		"--resources",
+		"--skip-consent",
+		"--disabled"
+	]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthOAuthClient(props.projectId, branchId, props.clientId, {
+		name: props.name?.trim(),
+		redirect_uris: props.redirectUris && unique(props.redirectUris),
+		resources: props.resources && unique(props.resources),
+		skip_consent: props.skipConsent,
+		disabled: props.disabled
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_CLIENT_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth client updated", printOAuthClientEntries(data));
+};
+const oauthClientDelete = async (props) => {
+	const branchId = await resolveBranch(props);
+	await props.apiClient.deleteNeonAuthOAuthClient(props.projectId, branchId, props.clientId);
+	printMessage(`OAuth client "${props.clientId}" deleted`);
+};
+const oauthClientRotateSecret = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.rotateNeonAuthOAuthClientSecret(props.projectId, branchId, props.clientId);
+	reportOAuthClientSecret(props, data, OAUTH_CLIENT_SECRET_FIELDS, [["Client ID:", data.client_id]], "OAuth client secret");
+};
 const printWebhookEntries = (data) => [
 	["Enabled:", String(data.enabled)],
 	["URL:", data.webhook_url ?? ""],

package/dist/api.js

@@ -895,6 +895,69 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 			},
 			body: data
 		})),
+		getNeonAuthOAuthProviderPlugin: (projectId, branchId) => call(() => raw.getNeonAuthOAuthProviderPlugin({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		updateNeonAuthOAuthProviderPlugin: (projectId, branchId, data) => call(() => raw.updateNeonAuthOAuthProviderPlugin({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		listNeonAuthOAuthClients: (projectId, branchId) => call(() => raw.listNeonAuthOAuthClients({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		createNeonAuthOAuthClient: (projectId, branchId, data) => call(() => raw.createNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		getNeonAuthOAuthClient: (projectId, branchId, clientId) => call(() => raw.getNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
+		updateNeonAuthOAuthClient: (projectId, branchId, clientId, data) => call(() => raw.updateNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			},
+			body: data
+		})),
+		deleteNeonAuthOAuthClient: (projectId, branchId, clientId) => call(() => raw.deleteNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
+		rotateNeonAuthOAuthClientSecret: (projectId, branchId, clientId) => call(() => raw.rotateNeonAuthOAuthClientSecret({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
 		getNeonAuthWebhookConfig: (projectId, branchId) => call(() => raw.getNeonAuthWebhookConfig({
 			client,
 			path: {

package/dist/commands/index.js

@@ -29,7 +29,7 @@ import { a as init_exports } from "../_chunks/init-BkA6RilG.js";
 import { o as inspect_exports } from "../_chunks/inspect-g0wekylj.js";
 import { a as ip_allow_exports } from "../_chunks/ip_allow-5lLFvIuE.js";
 import { l as logs_exports } from "../_chunks/logs-DWkpjzIH.js";
-import { a as neon_auth_exports } from "../_chunks/neon_auth-CBs1_3qu.js";
+import { a as neon_auth_exports } from "../_chunks/neon_auth-DpF83S24.js";
 import { a as open_exports } from "../_chunks/open-CX3BT3Tp.js";
 import { s as operations_exports } from "../_chunks/operations-D4I-AxVs.js";
 import { o as orgs_exports } from "../_chunks/orgs-xGfANwHQ.js";

package/dist/commands/neon_auth.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-CBs1_3qu.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-DpF83S24.js";

package/dist/test_utils/fixtures.js

@@ -48,14 +48,15 @@ const test = test$1.extend({
 		let startedServer;
 		await use(async (mockDir, onRequest) => {
 			const app = express();
+			app.use(express.json());
 			if (onRequest) app.use((req, _res, next) => {
 				onRequest({
 					method: req.method,
-					path: req.path
+					path: req.path,
+					body: req.body
 				});
 				next();
 			});
-			app.use(express.json());
 			app.use("/", emocks(join(process.cwd(), "mocks", mockDir), { "404": (_req, res) => res.status(404).send({ message: "Not Found" }) }));
 			const server = await new Promise((resolve) => {
 				const s = app.listen(0, () => {
@@ -76,7 +77,7 @@ const test = test$1.extend({
 	},
 	testCliCommand: async ({ runMockServer }, use) => {
 		await use(async (args, options = {}) => {
-			const apiHost = options.unreachableHost ? await reserveClosedPort() : `http://localhost:${(await runMockServer(options.mockDir || "main")).address().port}`;
+			const apiHost = options.unreachableHost ? await reserveClosedPort() : `http://localhost:${(await runMockServer(options.mockDir || "main", options.onRequest)).address().port}`;
 			let output = "";
 			let error = "";
 			const cp = fork(join(process.cwd(), "./dist/index.js"), [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.12.2",
+  "version": "8.13.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -72,10 +72,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.4",
-    "@neon/config-runtime": "1.10.3",
+    "@neon/config-runtime": "1.10.4",
     "@neon/realtime": "0.1.2",
-    "@neon/sdk": "7.5.0"
+    "@neon/config": "1.9.5",
+    "@neon/sdk": "7.6.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -112,10 +112,10 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.35",
-    "@neon/env": "1.6.5",
-    "@neon/functions": "0.11.0",
-    "@neon/e2e-harness": "0.0.0"
+    "@neon-internals/env-core": "0.0.36",
+    "@neon/e2e-harness": "0.0.0",
+    "@neon/env": "1.6.6",
+    "@neon/functions": "0.11.0"
   },
   "publishConfig": {
     "access": "public",