neon 8.12.2 → 8.13.1

package/README.md

@@ -955,7 +955,7 @@ The default mints an account-wide API key (or reuses the Bearer already configur
 
 ## Install Neon agent skills (`skills`)
 
-`neon skills` installs Neon agent skills by running `npx skills add`. It does not call the Neon API. This command needs Node.js 22.20 or newer. The rest of the CLI supports Node.js 20.19 or newer.
+`neon skills` installs Neon agent skills by running `npx skills@latest add`, so it always uses the latest skills CLI, even when an older one is installed globally. It does not call the Neon API. This command needs Node.js 22.20 or newer. The rest of the CLI supports Node.js 20.19 or newer.
 
 ```bash
 # Interactive: this directory, then agents, then skills.

package/dist/_chunks/{checkout-BGvlLc43.js → checkout-CXIOydqZ.js}

@@ -11,9 +11,9 @@ import { looksLikeBranchId } from "../utils/formats.js";
 import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js";
 import { buildCheckoutEvent, readGitContext } from "../utils/git.js";
 import { buildHookBranch, loadHookConfig, resolveHookEnv, runCheckoutAfterHook, runCheckoutBeforeHook, runCreateAfterHook, runCreateBeforeHook } from "../utils/hooks.js";
-import { n as autoPullEnvAfterPin } from "./env-uVRY4xah.js";
-import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BnwcGpbq.js";
-import { i as handler$1 } from "./link-DOM84hYj.js";
+import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
+import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BH_qRHiG.js";
+import { i as handler$1 } from "./link-BgtkOBws.js";
 import chalk from "chalk";
 import prompts from "prompts";
 //#region src/commands/checkout.ts

package/dist/_chunks/{claim-DqzLXZMN.js → claim-DqAvAvDm.js}

@@ -12,7 +12,7 @@ import { projectConfigPath } from "../project.js";
 import { resolveEnvFilePath } from "../env_file.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
-import { c as pull } from "./env-uVRY4xah.js";
+import { c as pull } from "./env-5HS5qQGd.js";
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import open from "open";
 import prompts from "prompts";

package/dist/_chunks/{config-BnwcGpbq.js → config-BH_qRHiG.js}

@@ -23,7 +23,7 @@ import { readGitContext } from "../utils/git.js";
 import { resolveHookEnv, runDeployAfterHook, runDeployBeforeHook } from "../utils/hooks.js";
 import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
-import { n as autoPullEnvAfterPin } from "./env-uVRY4xah.js";
+import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import chalk from "chalk";

package/dist/_chunks/{deploy-BCVcDR1O.js → deploy-D7B0Xfjg.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BnwcGpbq.js";
+import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BH_qRHiG.js";
 import { DEPLOY_COMMANDS_EPILOGUE } from "../commands/deploy_help.js";
 //#region src/commands/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({

package/dist/_chunks/{dev-mrJKMt2R.js → dev-CSvxAecE.js}

@@ -4,12 +4,12 @@ import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { l as functionBaseUrlKey } from "./env-BpP3Dqpe.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
 import { a as resolveDevEnv } from "./env-BNm69Qh8.js";
+import { f as envFlag } from "./config-BH_qRHiG.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
-import { f as envFlag } from "./config-BnwcGpbq.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/_chunks/{git-pN4kMH0d.js → git-H32TNt6M.js}

@@ -5,8 +5,8 @@ import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollow
 import { writer } from "../writer.js";
 import { neonSafeBranchName } from "../utils/branch_name.js";
 import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
-import { o as quoteFlagValue } from "./link-DOM84hYj.js";
-import { o as handler$1 } from "./checkout-BGvlLc43.js";
+import { o as quoteFlagValue } from "./link-BgtkOBws.js";
+import { o as handler$1 } from "./checkout-CXIOydqZ.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";

package/dist/_chunks/{link-DOM84hYj.js → link-BgtkOBws.js}

@@ -13,8 +13,8 @@ import { writer } from "../writer.js";
 import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
-import { n as autoPullEnvAfterPin } from "./env-uVRY4xah.js";
-import { h as initCmd } from "./config-BnwcGpbq.js";
+import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
+import { h as initCmd } from "./config-BH_qRHiG.js";
 import { formatLinkSummary } from "../commands/link_output.js";
 import { r as REGIONS } from "./projects-BwI2Uo0z.js";
 import prompts from "prompts";

package/dist/_chunks/{neon_auth-CBs1_3qu.js → neon_auth-DpF83S24.js}

@@ -1,4 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { stripAnsi } from "../human_table.js";
 import { writer } from "../writer.js";
@@ -78,6 +79,24 @@ const ORGANIZATION_FIELDS = [
 	"organization_limit",
 	"creator_role"
 ];
+const OAUTH_SERVER_FIELDS = [
+	"enabled",
+	"login_page",
+	"consent_page",
+	"mcp",
+	"resources"
+];
+const OAUTH_CLIENT_FIELDS = [
+	"client_id",
+	"name",
+	"type",
+	"redirect_uris",
+	"resources",
+	"skip_consent",
+	"disabled",
+	"created_at"
+];
+const OAUTH_CLIENT_SECRET_FIELDS = ["client_id", "client_secret"];
 const WEBHOOK_FIELDS = [
 	"enabled",
 	"webhook_url",
@@ -110,7 +129,7 @@ const builder = (argv) => {
 		default: false
 	} }), async (args) => {
 		await disable(args);
-	}).command("oauth-provider", "Manage OAuth providers", (yargs) => {
+	}).command("oauth-provider", `Manage social login providers (${SUPPORTED_OAUTH_PROVIDERS.join(", ")})`, (yargs) => {
 		return yargs.usage("$0 neon-auth oauth-provider <sub-command> [options]").command("list", "List OAuth providers", (yargs) => yargs, async (args) => {
 			await oauthProviderList(args);
 		}).command("add", "Add an OAuth provider", (yargs) => yargs.options({
@@ -155,6 +174,87 @@ const builder = (argv) => {
 		} }), async (args) => {
 			await oauthProviderDelete(args);
 		});
+	}).command("oauth-client", "Manage clients of this Neon Auth OAuth server (e.g. MCP clients); configure the server with `config oauth-server`", (yargs) => {
+		return yargs.usage("$0 neon-auth oauth-client <sub-command> [options]").command("list", "List OAuth clients", (yargs) => yargs, async (args) => {
+			await oauthClientList(args);
+		}).command("create", "Create an OAuth client", (yargs) => yargs.options({
+			name: {
+				describe: "Display name of the client",
+				type: "string",
+				demandOption: true
+			},
+			type: {
+				describe: "Client type. Confidential clients receive a secret that is shown only once",
+				type: "string",
+				choices: ["confidential", "public"],
+				demandOption: true
+			},
+			"redirect-uris": {
+				describe: "Redirect URIs the client may use (https, or http on loopback when localhost is allowed)",
+				type: "string",
+				array: true,
+				demandOption: true
+			},
+			resources: {
+				describe: "Protected resource URLs to link the client to; each must be configured with `neon-auth config oauth-server resource add`",
+				type: "string",
+				array: true,
+				demandOption: true
+			},
+			"skip-consent": {
+				describe: "Skip the consent prompt (first-party clients only)",
+				type: "boolean"
+			}
+		}).example("$0 neon-auth oauth-client create --name 'My app' --type confidential --redirect-uris https://app.example.com/callback --resources https://api.example.com", "Create a confidential client"), async (args) => {
+			await oauthClientCreate(args);
+		}).command("get <client-id>", "Get an OAuth client", (yargs) => yargs.usage("$0 neon-auth oauth-client get <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientGet(args);
+		}).command("update <client-id>", "Update an OAuth client (the type cannot be changed)", (yargs) => yargs.usage("$0 neon-auth oauth-client update <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}).options({
+			name: {
+				describe: "Display name of the client",
+				type: "string"
+			},
+			"redirect-uris": {
+				describe: "Redirect URIs the client may use; replaces the stored list",
+				type: "string",
+				array: true
+			},
+			resources: {
+				describe: "Protected resource URLs to link the client to; replaces the stored list (at least one)",
+				type: "string",
+				array: true
+			},
+			"skip-consent": {
+				describe: "Skip the consent prompt (first-party clients only). Use --no-skip-consent or --skip-consent false to turn off",
+				type: "boolean"
+			},
+			disabled: {
+				describe: "Disable the client. Use --no-disabled or --disabled false to re-enable",
+				type: "boolean"
+			}
+		}), async (args) => {
+			await oauthClientUpdate(args);
+		}).command("delete <client-id>", "Delete an OAuth client", (yargs) => yargs.usage("$0 neon-auth oauth-client delete <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientDelete(args);
+		}).command("rotate-secret <client-id>", "Rotate the secret of a confidential client; the old secret stops working immediately", (yargs) => yargs.usage("$0 neon-auth oauth-client rotate-secret <client-id> [options]").positional("client-id", {
+			describe: "OAuth client ID",
+			type: "string",
+			demandOption: true
+		}), async (args) => {
+			await oauthClientRotateSecret(args);
+		});
 	}).command("domain", "Manage redirect URI trusted domains", (yargs) => {
 		return yargs.usage("$0 neon-auth domain <sub-command> [options]").command("list", "List trusted domains", (yargs) => yargs, async (args) => {
 			await domainList(args);
@@ -283,6 +383,63 @@ const builder = (argv) => {
 			}), async (args) => {
 				await organizationUpdate(args);
 			});
+		}).command("oauth-server", "Manage the OAuth 2.1 authorization server (API plugin: oauth_provider)", (yargs) => {
+			return yargs.usage("$0 neon-auth config oauth-server <sub-command> [options]").command("get", "Get OAuth server config", (yargs) => yargs, async (args) => {
+				await oauthServerGet(args);
+			}).command("update", "Update OAuth server config", (yargs) => yargs.options({
+				enabled: {
+					describe: "Enable the OAuth server. Use --no-enabled or --enabled false to disable",
+					type: "boolean"
+				},
+				"login-page": {
+					describe: "URL of the page authorization requests redirect to for sign-in",
+					type: "string"
+				},
+				"consent-page": {
+					describe: "URL of the page authorization requests redirect to for consent",
+					type: "string"
+				},
+				resources: {
+					describe: "Protected resource URLs that clients can be linked to; replaces the stored list. Use `resource add|remove` for incremental changes",
+					type: "string",
+					array: true
+				},
+				"mcp-resource": {
+					describe: "MCP server URL that MCP clients are linked to. Defaults to the stored value when another --mcp-* flag is given. To remove the MCP configuration, use --no-mcp",
+					type: "string"
+				},
+				mcp: {
+					describe: "Remove the MCP configuration (only --no-mcp is accepted)",
+					type: "boolean"
+				},
+				"mcp-client-id-metadata-documents": {
+					describe: "Allow MCP clients to identify themselves with a Client ID Metadata Document (CIMD) URL. Use --no-mcp-client-id-metadata-documents to disallow",
+					type: "boolean"
+				},
+				"mcp-dynamic-registration": {
+					describe: "Allow MCP clients to register themselves via dynamic client registration (deprecated in favor of CIMD)",
+					type: "boolean",
+					hidden: true
+				}
+			}).example("$0 neon-auth config oauth-server update --enabled --mcp-resource https://example.com/mcp --mcp-client-id-metadata-documents", "Enable the OAuth server for an MCP server"), async (args) => {
+				await oauthServerUpdate(args);
+			}).command("resource", "Manage the protected resources of the OAuth server. Add and remove read the stored list and write back the full list, so concurrent changes by others can be overwritten", (yargs) => yargs.usage("$0 neon-auth config oauth-server resource <sub-command> [options]").command("list", "List protected resources", (yargs) => yargs, async (args) => {
+				await oauthResourceList(args);
+			}).command("add <url...>", "Add protected resources (reads the stored list and writes back the full list; concurrent changes by others can be overwritten)", (yargs) => yargs.positional("url", {
+				describe: "Protected resource URLs to add",
+				type: "string",
+				array: true,
+				demandOption: true
+			}), async (args) => {
+				await oauthResourceAdd(args);
+			}).command("remove <url...>", "Remove protected resources (reads the stored list and writes back the full list; concurrent changes by others can be overwritten)", (yargs) => yargs.positional("url", {
+				describe: "Protected resource URLs to remove",
+				type: "string",
+				array: true,
+				demandOption: true
+			}), async (args) => {
+				await oauthResourceRemove(args);
+			}));
 		}).command("webhook", "Manage webhook configuration", (yargs) => {
 			return yargs.usage("$0 neon-auth config webhook <sub-command> [options]").command("get", "Get webhook config", (yargs) => yargs, async (args) => {
 				await webhookGet(args);
@@ -319,7 +476,7 @@ const builder = (argv) => {
 		return yargs.usage("$0 neon-auth plugins <sub-command> [options]").command("list", "List all plugin configurations", (yargs) => yargs, async (args) => {
 			await pluginsList(args);
 		}).command("get <plugin-name>", "Get a specific plugin configuration", (yargs) => yargs.usage("$0 neon-auth plugins get <plugin-name> [options]").positional("plugin-name", {
-			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, allow_localhost)",
+			describe: "Plugin name (e.g. organization, email_provider, email_and_password, oauth_providers, oauth_provider, allow_localhost)",
 			type: "string",
 			demandOption: true
 		}), async (args) => {
@@ -714,6 +871,287 @@ const organizationUpdate = async (props) => {
 	}
 	printKvBlock("Organization configuration updated", printOrganizationEntries(data));
 };
+const optionalBool = (v) => v === void 0 ? void 0 : String(v);
+const printOAuthServerEntries = (data) => [
+	["Enabled:", String(data.enabled)],
+	["Login Page:", data.login_page],
+	["Consent Page:", data.consent_page],
+	["MCP Resource:", data.mcp?.resource],
+	["MCP CIMD:", optionalBool(data.mcp?.client_id_metadata_documents)],
+	["MCP Dynamic Reg:", optionalBool(data.mcp?.dynamic_registration)],
+	["Resources:", (data.resources ?? []).map((r) => r.identifier).join(", ")]
+];
+/** The API rejects an empty PATCH, so fail before any request with the flags that would do something. */
+const requireUpdateFields = (provided, flags) => {
+	if (provided.every((value) => value === void 0)) throw new Error(`Nothing to update. Pass at least one of ${flags.join(", ")}.`);
+};
+const oauthServerGet = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_SERVER_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth server configuration", printOAuthServerEntries(data));
+};
+/**
+* The API requires `mcp.resource` whenever `mcp` is sent and keeps stored booleans that are
+* omitted, so only the resource is filled in from the stored config.
+*/
+const resolveMcpUpdate = async (props, getStoredMcp) => {
+	const { mcpResource, mcpDynamicRegistration: dynamicRegistration, mcpClientIdMetadataDocuments: clientIdMetadataDocuments } = props;
+	if (mcpResource === void 0 && dynamicRegistration === void 0 && clientIdMetadataDocuments === void 0) return;
+	const resource = mcpResource ?? (await getStoredMcp())?.resource;
+	if (!resource) throw new Error("No MCP resource is configured yet. Pass --mcp-resource <url> together with the other --mcp-* flags.");
+	return {
+		resource,
+		dynamic_registration: dynamicRegistration,
+		client_id_metadata_documents: clientIdMetadataDocuments
+	};
+};
+/**
+* Order-preserving dedupe after trimming: padded input would otherwise miss stored values
+* and reach the API as a distinct string, and repeats would be sent as duplicates.
+*/
+const unique = (values) => [...new Set(values.map((value) => value.trim()))];
+/** yargs negation turns `--no-<flag>` on an array option into `[false]`, which bypasses empty-array checks. */
+const isNegatedList = (values) => values === false || Array.isArray(values) && values.includes(false);
+const hasBlank = (values) => values?.some((value) => value.trim() === "") ?? false;
+/** Fails before any request when a list flag was passed with no values or a blank one. */
+const requireNonEmptyLists = (lists) => {
+	for (const [flag, values] of lists) {
+		if (isNegatedList(values)) throw new Error(`--no-${flag.slice(2)} is not supported. ${flag} must list at least one value.`);
+		if (values?.length === 0) throw new Error(`${flag} must list at least one value.`);
+		if (hasBlank(values)) throw new Error(`${flag} must not contain empty values.`);
+	}
+};
+/**
+* yargs negation turns `--no-<flag>` on a string option into `false`, and `--flag ""` yields an
+* empty string; both would otherwise crash on `.trim()` or be sent to the API.
+*/
+const requireNonBlankString = (flag, value, hint) => {
+	if (value === false) throw new Error(`--no-${flag.slice(2)} is not supported. ${hint}`);
+	if (typeof value === "string" && value.trim() === "") throw new Error(`${flag} must not be empty.`);
+};
+const requireNonBlankUrls = (urls) => {
+	if (hasBlank(urls)) throw new Error("URLs must not be empty.");
+};
+/** The MCP resource is linked to MCP clients on its own, so it cannot also be a protected resource. */
+const rejectMcpResourceCollision = (urls, mcpResource) => {
+	if (mcpResource && urls.includes(mcpResource)) throw new Error(`${mcpResource} is the MCP resource and cannot also be a protected resource.`);
+};
+/** Checked before any request so a malformed invocation never reaches the API. */
+const validateOAuthServerUpdate = (props) => {
+	requireNonBlankString("--login-page", props.loginPage, "Pass --login-page <url>.");
+	requireNonBlankString("--consent-page", props.consentPage, "Pass --consent-page <url>.");
+	if (props.mcp === true) throw new Error("--mcp cannot be enabled. Configure MCP with --mcp-resource <url>, or remove it with --no-mcp.");
+	if (props.mcp === false && (props.mcpResource !== void 0 || props.mcpClientIdMetadataDocuments !== void 0 || props.mcpDynamicRegistration !== void 0)) throw new Error("--no-mcp cannot be combined with --mcp-resource, --mcp-client-id-metadata-documents or --mcp-dynamic-registration.");
+	if (props.mcpResource === false) throw new Error("--no-mcp-resource is not supported. To remove the MCP configuration, use --no-mcp.");
+	if (props.mcpResource?.trim() === "") throw new Error("--mcp-resource must not be empty. To remove the MCP configuration, use --no-mcp.");
+	if (isNegatedList(props.resources)) throw new Error("--no-resources is not supported. To remove resources, use `neon-auth config oauth-server resource remove <url...>`.");
+	if (props.resources?.length === 0) throw new Error("--resources must list at least one URL. To remove resources, use `neon-auth config oauth-server resource remove <url...>`.");
+	if (hasBlank(props.resources)) throw new Error("--resources must not contain empty values.");
+};
+const oauthServerUpdate = async (props) => {
+	requireUpdateFields([
+		props.enabled,
+		props.loginPage,
+		props.consentPage,
+		props.resources,
+		props.mcp,
+		props.mcpResource,
+		props.mcpClientIdMetadataDocuments,
+		props.mcpDynamicRegistration
+	], [
+		"--enabled",
+		"--login-page",
+		"--consent-page",
+		"--resources",
+		"--no-mcp",
+		"--mcp-resource",
+		"--mcp-client-id-metadata-documents"
+	]);
+	validateOAuthServerUpdate(props);
+	const loginPage = props.loginPage?.trim();
+	const consentPage = props.consentPage?.trim();
+	const mcpResource = props.mcpResource?.trim();
+	const branchId = await resolveBranch(props);
+	let storedMcp;
+	const getStoredMcp = () => storedMcp ??= props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId).then(({ data }) => data.mcp);
+	const mcp = props.mcp === false ? { resource: "" } : await resolveMcpUpdate({
+		...props,
+		mcpResource
+	}, getStoredMcp);
+	const resources = props.resources && unique(props.resources);
+	if (resources && props.mcp !== false) rejectMcpResourceCollision(resources, mcp?.resource ?? (await getStoredMcp())?.resource);
+	if (props.mcpDynamicRegistration !== void 0) log.warning("--mcp-dynamic-registration is deprecated. Use --mcp-client-id-metadata-documents instead.");
+	const { data } = await props.apiClient.updateNeonAuthOAuthProviderPlugin(props.projectId, branchId, {
+		enabled: props.enabled,
+		login_page: loginPage,
+		consent_page: consentPage,
+		mcp,
+		resources: resources?.map((identifier) => ({ identifier }))
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_SERVER_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth server configuration updated", printOAuthServerEntries(data));
+};
+const getStoredOAuthServer = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthProviderPlugin(props.projectId, branchId);
+	return {
+		branchId,
+		mcpResource: data.mcp?.resource,
+		stored: (data.resources ?? []).map((r) => r.identifier)
+	};
+};
+const reportOAuthResources = (props, resources) => {
+	if (resources.length === 0 && props.output === "table") {
+		printMessage("No protected resources are configured");
+		return;
+	}
+	writer(props).end(resources, { fields: ["identifier"] });
+};
+/** The API replaces the whole list, so every change is a full-list PATCH. */
+const replaceOAuthResources = async (props, branchId, identifiers) => {
+	const { data } = await props.apiClient.updateNeonAuthOAuthProviderPlugin(props.projectId, branchId, { resources: identifiers.map((identifier) => ({ identifier })) });
+	reportOAuthResources(props, data.resources ?? []);
+};
+const oauthResourceList = async (props) => {
+	const { stored } = await getStoredOAuthServer(props);
+	reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+};
+const oauthResourceAdd = async (props) => {
+	requireNonBlankUrls(props.url);
+	const urls = unique(props.url);
+	const { branchId, mcpResource, stored } = await getStoredOAuthServer(props);
+	rejectMcpResourceCollision(urls, mcpResource);
+	const existing = urls.filter((url) => stored.includes(url));
+	if (existing.length > 0) log.warning(`Already configured, skipped: ${existing.join(", ")}`);
+	const added = urls.filter((url) => !stored.includes(url));
+	if (added.length === 0) {
+		reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+		return;
+	}
+	await replaceOAuthResources(props, branchId, [...stored, ...added]);
+};
+const oauthResourceRemove = async (props) => {
+	requireNonBlankUrls(props.url);
+	const requested = unique(props.url);
+	const { branchId, stored } = await getStoredOAuthServer(props);
+	const unknown = requested.filter((url) => !stored.includes(url));
+	if (unknown.length > 0) log.warning(`Not configured, skipped: ${unknown.join(", ")}`);
+	const urls = requested.filter((url) => stored.includes(url));
+	if (urls.length === 0) {
+		reportOAuthResources(props, stored.map((identifier) => ({ identifier })));
+		return;
+	}
+	await replaceOAuthResources(props, branchId, stored.filter((url) => !urls.includes(url)));
+	let linked;
+	try {
+		const { data } = await props.apiClient.listNeonAuthOAuthClients(props.projectId, branchId);
+		linked = data.clients.filter((client) => client.resources.some((resource) => urls.includes(resource)));
+	} catch (err) {
+		log.debug("Could not look up clients linked to the removed resource: %s", err);
+		log.warning("Removed, but could not check for clients still linked to it.");
+		return;
+	}
+	if (linked.length > 0) log.warning(`Clients still linked to a removed resource: ${linked.map((client) => `"${client.name}" (${client.client_id})`).join(", ")}. Their token requests for that resource may fail until it is added again.`);
+};
+const printOAuthClientEntries = (data) => [
+	["Client ID:", data.client_id],
+	["Name:", data.name],
+	["Type:", data.type],
+	["Redirect URIs:", data.redirect_uris.join(", ")],
+	["Resources:", data.resources.join(", ")],
+	["Skip Consent:", String(data.skip_consent)],
+	["Disabled:", String(data.disabled)],
+	["Created At:", data.created_at]
+];
+const oauthClientList = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.listNeonAuthOAuthClients(props.projectId, branchId);
+	if (data.clients.length === 0 && props.output === "table") {
+		printMessage("No OAuth clients are configured for this branch.");
+		return;
+	}
+	writer(props).end(data.clients, { fields: OAUTH_CLIENT_FIELDS });
+};
+/**
+* The secret is shown only once, so human output keeps it on its own last line of stdout
+* and the notice goes to stderr. Structured output keeps it in the object for scripts.
+*/
+const reportOAuthClientSecret = (props, data, fields, entries, title) => {
+	if (props.output === "table") {
+		printKvBlock(title, entries);
+		if (data.client_secret) writeStyled(`${data.client_secret}\n`);
+	} else writer(props).end(data, { fields });
+	if (data.client_secret) log.warning("Store this secret now: it is not shown again.");
+};
+const oauthClientCreate = async (props) => {
+	requireNonBlankString("--name", props.name, "Pass --name <name>.");
+	requireNonEmptyLists([["--redirect-uris", props.redirectUris], ["--resources", props.resources]]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.createNeonAuthOAuthClient(props.projectId, branchId, {
+		name: props.name.trim(),
+		type: props.type,
+		redirect_uris: unique(props.redirectUris),
+		resources: unique(props.resources),
+		skip_consent: props.skipConsent
+	});
+	reportOAuthClientSecret(props, data, [...OAUTH_CLIENT_FIELDS, "client_secret"], printOAuthClientEntries(data), "OAuth client");
+};
+const oauthClientGet = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.getNeonAuthOAuthClient(props.projectId, branchId, props.clientId);
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_CLIENT_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth client", printOAuthClientEntries(data));
+};
+const oauthClientUpdate = async (props) => {
+	requireNonBlankString("--name", props.name, "Pass --name <name>.");
+	requireNonEmptyLists([["--redirect-uris", props.redirectUris], ["--resources", props.resources]]);
+	requireUpdateFields([
+		props.name,
+		props.redirectUris,
+		props.resources,
+		props.skipConsent,
+		props.disabled
+	], [
+		"--name",
+		"--redirect-uris",
+		"--resources",
+		"--skip-consent",
+		"--disabled"
+	]);
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.updateNeonAuthOAuthClient(props.projectId, branchId, props.clientId, {
+		name: props.name?.trim(),
+		redirect_uris: props.redirectUris && unique(props.redirectUris),
+		resources: props.resources && unique(props.resources),
+		skip_consent: props.skipConsent,
+		disabled: props.disabled
+	});
+	if (props.output === "json" || props.output === "yaml") {
+		writer(props).end(data, { fields: OAUTH_CLIENT_FIELDS });
+		return;
+	}
+	printKvBlock("OAuth client updated", printOAuthClientEntries(data));
+};
+const oauthClientDelete = async (props) => {
+	const branchId = await resolveBranch(props);
+	await props.apiClient.deleteNeonAuthOAuthClient(props.projectId, branchId, props.clientId);
+	printMessage(`OAuth client "${props.clientId}" deleted`);
+};
+const oauthClientRotateSecret = async (props) => {
+	const branchId = await resolveBranch(props);
+	const { data } = await props.apiClient.rotateNeonAuthOAuthClientSecret(props.projectId, branchId, props.clientId);
+	reportOAuthClientSecret(props, data, OAUTH_CLIENT_SECRET_FIELDS, [["Client ID:", data.client_id]], "OAuth client secret");
+};
 const printWebhookEntries = (data) => [
 	["Enabled:", String(data.enabled)],
 	["URL:", data.webhook_url ?? ""],

package/dist/_chunks/{status-DoNjIbKf.js → status-DV8Z2kw3.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { y as status } from "./config-BnwcGpbq.js";
+import { y as status } from "./config-BH_qRHiG.js";
 //#region src/commands/status.ts
 var status_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,

package/dist/api.js

@@ -895,6 +895,69 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 			},
 			body: data
 		})),
+		getNeonAuthOAuthProviderPlugin: (projectId, branchId) => call(() => raw.getNeonAuthOAuthProviderPlugin({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		updateNeonAuthOAuthProviderPlugin: (projectId, branchId, data) => call(() => raw.updateNeonAuthOAuthProviderPlugin({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		listNeonAuthOAuthClients: (projectId, branchId) => call(() => raw.listNeonAuthOAuthClients({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			}
+		})),
+		createNeonAuthOAuthClient: (projectId, branchId, data) => call(() => raw.createNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId
+			},
+			body: data
+		})),
+		getNeonAuthOAuthClient: (projectId, branchId, clientId) => call(() => raw.getNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
+		updateNeonAuthOAuthClient: (projectId, branchId, clientId, data) => call(() => raw.updateNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			},
+			body: data
+		})),
+		deleteNeonAuthOAuthClient: (projectId, branchId, clientId) => call(() => raw.deleteNeonAuthOAuthClient({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
+		rotateNeonAuthOAuthClientSecret: (projectId, branchId, clientId) => call(() => raw.rotateNeonAuthOAuthClientSecret({
+			client,
+			path: {
+				project_id: projectId,
+				branch_id: branchId,
+				client_id: clientId
+			}
+		})),
 		getNeonAuthWebhookConfig: (projectId, branchId) => call(() => raw.getNeonAuthWebhookConfig({
 			client,
 			path: {

package/dist/commands/checkout.js

@@ -1 +1 @@
-export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-BGvlLc43.js";
+export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-CXIOydqZ.js";

package/dist/commands/claim.js

@@ -1 +1 @@
-export { t as CLAIM_CREATE_FIELDS, n as CLAIM_LIST_FIELDS, r as aliases, i as builder, a as claimCreateFields, s as claimableCapabilities, c as command, l as create, u as describe, d as handler } from "../_chunks/claim-DqzLXZMN.js";
+export { t as CLAIM_CREATE_FIELDS, n as CLAIM_LIST_FIELDS, r as aliases, i as builder, a as claimCreateFields, s as claimableCapabilities, c as command, l as create, u as describe, d as handler } from "../_chunks/claim-DqAvAvDm.js";

package/dist/commands/config.js

@@ -1 +1 @@
-export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-BnwcGpbq.js";
+export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-BH_qRHiG.js";

package/dist/commands/deploy.js

@@ -1 +1 @@
-export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-BCVcDR1O.js";
+export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-D7B0Xfjg.js";

package/dist/commands/dev.js

@@ -1 +1 @@
-export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-mrJKMt2R.js";
+export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-CSvxAecE.js";

package/dist/commands/env.js

@@ -1 +1 @@
-export { t as ENV_PULL_SKIPPED_HINT, n as autoPullEnvAfterPin, r as builder, i as command, a as describe, s as handler, c as pull } from "../_chunks/env-uVRY4xah.js";
+export { t as ENV_PULL_SKIPPED_HINT, n as autoPullEnvAfterPin, r as builder, i as command, a as describe, s as handler, c as pull } from "../_chunks/env-5HS5qQGd.js";

package/dist/commands/functions_new.js

@@ -8,7 +8,7 @@ import { writer } from "../writer.js";
 import { formatInitDone, printInitDone } from "../init/chrome.js";
 import { FUNCTION_SLUG_PATTERN, deriveFunctionSlug } from "../utils/function_slug.js";
 import { displayPath } from "./env_output.js";
-import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-BnwcGpbq.js";
+import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-BH_qRHiG.js";
 import { recommendedOperations } from "../functions/registry.js";
 import { collidingFiles, operationsFromFlags, planConfigRegistration, planEnvExample, planScaffold, writeScaffold } from "../functions/scaffold.js";
 import { describeRegistrySource, openRegistry } from "../functions/source.js";

package/dist/commands/git.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-pN4kMH0d.js";
+export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-H32TNt6M.js";

package/dist/commands/index.js

@@ -2,34 +2,34 @@ import { r as auth_exports } from "../_chunks/auth-CIUtXByB.js";
 import { t as api_exports } from "../_chunks/api-GbEaBZJ5.js";
 import { n as api_keys_exports } from "../_chunks/api_keys-CNnnugbQ.js";
 import { n as ask_exports } from "../_chunks/ask-DVwy0eUL.js";
-import { o as env_exports } from "../_chunks/env-uVRY4xah.js";
-import { c as config_exports } from "../_chunks/config-BnwcGpbq.js";
+import { o as env_exports } from "../_chunks/env-5HS5qQGd.js";
+import { c as config_exports } from "../_chunks/config-BH_qRHiG.js";
 import { u as projects_exports } from "../_chunks/projects-BwI2Uo0z.js";
-import { a as link_exports } from "../_chunks/link-DOM84hYj.js";
+import { a as link_exports } from "../_chunks/link-BgtkOBws.js";
 import { o as mcp_exports } from "../_chunks/mcp-Bo-7TKc7.js";
 import { c as plugins_exports } from "../_chunks/plugins-DqD7BDO1.js";
 import { l as skills_exports } from "../_chunks/skills-BP6pIm7O.js";
 import { t as bootstrap_exports } from "../_chunks/bootstrap-wPZWa1sT.js";
 import { r as branches_exports } from "../_chunks/branches-BNa1xX1L.js";
 import { n as bucket_exports } from "../_chunks/bucket-BCdryTkD.js";
-import { n as checkout_exports } from "../_chunks/checkout-BGvlLc43.js";
-import { o as claim_exports } from "../_chunks/claim-DqzLXZMN.js";
+import { n as checkout_exports } from "../_chunks/checkout-CXIOydqZ.js";
+import { o as claim_exports } from "../_chunks/claim-DqAvAvDm.js";
 import { a as connection_string_exports } from "../_chunks/connection_string-DB4awPzZ.js";
 import { a as credentials_exports } from "../_chunks/credentials-BSjE9fRR.js";
 import { r as data_api_exports } from "../_chunks/data_api-Djxj5ZQD.js";
 import { o as databases_exports } from "../_chunks/databases-Dok4wru7.js";
-import { r as deploy_exports } from "../_chunks/deploy-BCVcDR1O.js";
-import { s as dev_exports } from "../_chunks/dev-mrJKMt2R.js";
+import { r as deploy_exports } from "../_chunks/deploy-D7B0Xfjg.js";
+import { s as dev_exports } from "../_chunks/dev-CSvxAecE.js";
 import { i as diff_exports } from "../_chunks/diff-DhxxbdQE.js";
 import { c as docs_exports } from "../_chunks/docs-CrVybkTP.js";
 import { o as feedback_exports } from "../_chunks/feedback-CMayyTa8.js";
 import { o as functions_exports } from "../_chunks/functions-Q0zuvtnk.js";
-import { o as git_exports } from "../_chunks/git-pN4kMH0d.js";
+import { o as git_exports } from "../_chunks/git-H32TNt6M.js";
 import { a as init_exports } from "../_chunks/init-BkA6RilG.js";
 import { o as inspect_exports } from "../_chunks/inspect-g0wekylj.js";
 import { a as ip_allow_exports } from "../_chunks/ip_allow-5lLFvIuE.js";
 import { l as logs_exports } from "../_chunks/logs-DWkpjzIH.js";
-import { a as neon_auth_exports } from "../_chunks/neon_auth-CBs1_3qu.js";
+import { a as neon_auth_exports } from "../_chunks/neon_auth-DpF83S24.js";
 import { a as open_exports } from "../_chunks/open-CX3BT3Tp.js";
 import { s as operations_exports } from "../_chunks/operations-D4I-AxVs.js";
 import { o as orgs_exports } from "../_chunks/orgs-xGfANwHQ.js";
@@ -39,7 +39,7 @@ import { s as realtime_exports } from "../_chunks/realtime-BRqIyGR-.js";
 import { l as roles_exports } from "../_chunks/roles-B4w3YT_7.js";
 import { a as set_context_exports } from "../_chunks/set_context-DbrwoImy.js";
 import { s as snapshots_exports } from "../_chunks/snapshots-RJBzW8GM.js";
-import { a as status_exports } from "../_chunks/status-DoNjIbKf.js";
+import { a as status_exports } from "../_chunks/status-DV8Z2kw3.js";
 import { d as triggers_exports } from "../_chunks/triggers-BrRo1z4b.js";
 import { s as user_exports } from "../_chunks/user-dlOGXbX9.js";
 import { i as vpc_endpoints_exports } from "../_chunks/vpc_endpoints-CNb0YfMo.js";

package/dist/commands/link.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-DOM84hYj.js";
+export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-BgtkOBws.js";

package/dist/commands/neon_auth.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-CBs1_3qu.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/neon_auth-DpF83S24.js";

package/dist/commands/status.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-DoNjIbKf.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-DV8Z2kw3.js";

package/dist/commands/subscribe.js

@@ -1,6 +1,6 @@
 import { writer } from "../writer.js";
-import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import { branchIdFromProps } from "../utils/enrichers.js";
+import { o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
 import YAML from "yaml";
 //#region src/commands/subscribe.ts
 const builder = (argv) => argv.usage("$0 realtime subscribe \"<query>\" [options]").positional("query", {

package/dist/init/auth.js

@@ -4,7 +4,7 @@ import "../config.js";
 import "../auth.js";
 import { c as ensureAuth } from "../_chunks/auth-CIUtXByB.js";
 import { recoverFrom401 } from "../auth_recovery.js";
-import { c as pull } from "../_chunks/env-uVRY4xah.js";
+import { c as pull } from "../_chunks/env-5HS5qQGd.js";
 import { c as setupNeonMcp } from "../_chunks/mcp-Bo-7TKc7.js";
 //#region src/init/auth.ts
 const isUnauthorized = (error) => isNeonApiError(error) && error.status === 401;

package/dist/init/link.js

@@ -4,7 +4,7 @@ import "../config.js";
 import "../auth.js";
 import { c as ensureAuth } from "../_chunks/auth-CIUtXByB.js";
 import { recoverFrom401 } from "../auth_recovery.js";
-import { s as runLink } from "../_chunks/link-DOM84hYj.js";
+import { s as runLink } from "../_chunks/link-BgtkOBws.js";
 //#region src/init/link.ts
 const isUnauthorized = (error) => isNeonApiError(error) && error.status === 401;
 const authenticationFailed = () => /* @__PURE__ */ new Error("Authentication failed.");

package/dist/init/run.js

@@ -17,15 +17,15 @@ import { FALLBACK_SKILLS_AGENTS, assertNamedAgentTooling, funnelAgentSetup, plan
 import { inferPackageManager, resolvePackageManager } from "../utils/package_manager.js";
 import { CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, MCP_API_KEY_NEEDS_AUTH, MCP_SCOPED_NEEDS_PROJECT, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, PROGRESS, PROJECT_PINNED_OFFLINE, claimableNext, claimableThenServicesNext, configInitNext, envPullFailedNext, existingConfigNext, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, newConfigNext, offlinePinNext, skippedLinkNext, unattendedUnauthedNext } from "./copy.js";
 import { agentsRowValue, configRowValue, formatInitDone, headingForKind, printInitBanner, printInitDone, printInitProgress, projectRowValue, shouldPrintInitBanner } from "./chrome.js";
-import { h as initCmd, t as ConfigInstallFailed } from "../_chunks/config-BnwcGpbq.js";
-import { o as quoteFlagValue, s as runLink } from "../_chunks/link-DOM84hYj.js";
+import { h as initCmd, t as ConfigInstallFailed } from "../_chunks/config-BH_qRHiG.js";
+import { o as quoteFlagValue, s as runLink } from "../_chunks/link-BgtkOBws.js";
 import { runAuthenticatedLink } from "./link.js";
 import { CannotMintApiKeyError } from "../mcp/mint.js";
 import { pullInitEnv } from "./auth.js";
 import { InitCancelled, raceSigint, restoreCursor } from "./cancelled.js";
 import { pickAgentSetupInteractively, pickInitAgentsInteractively, pickInitConfigInteractively, pickInitMcpAuthInteractively, pickInitMcpConfigLocationInteractively, pickInitModeInteractively, pickInitPackageManagerInteractively, pickInitProjectSetupInteractively, pickInitServicesInteractively, pickInitSkillsInteractively } from "./wizard.js";
 import { runToolingSteps } from "./tooling.js";
-import { l as create } from "../_chunks/claim-DqzLXZMN.js";
+import { l as create } from "../_chunks/claim-DqAvAvDm.js";
 import { INIT_CONFIG_SERVICES_CONFLICT, configPlanFromResolution, initEnvPullAfterConfig, resolveInitConfigChoice } from "./choices.js";
 import { detectInitEnvironment } from "./detect.js";
 import { createInitFunnel, emitInitStart, finishInitFunnel, initStartProperties } from "./funnel.js";

package/dist/skills/freshness.js

@@ -83,17 +83,23 @@ const folderKey = ({ source, folder }) => `${source}:${folder}`;
 /** `undefined` when the remote side has not been fetched yet. */
 const skillStatus = (skill, remote) => {
 	if (remote?.missing === true) return "not found upstream";
-	const latest = skill.hashKind === "tree" ? remote?.tree : remote?.content;
-	if (latest === void 0) return void 0;
-	return latest === skill.hash ? "up to date" : "outdated";
+	if (skill.hashKind === "tree") {
+		if (remote?.tree === void 0) return void 0;
+		return remote.tree === skill.hash ? "up to date" : "outdated";
+	}
+	if (remote?.content === void 0) return void 0;
+	if (skill.hash === remote.content) return "up to date";
+	if (remote.contentCrlf === void 0) return void 0;
+	return skill.hash === remote.contentCrlf ? "up to date" : "outdated";
 };
 const parseRemoteFolder = (value) => {
 	if (!isRecord(value)) return void 0;
-	const { tree, content, missing, pending } = value;
-	if (tree !== void 0 && typeof tree !== "string" || content !== void 0 && typeof content !== "string" || missing !== void 0 && missing !== true || pending !== void 0 && pending !== true) return;
+	const { tree, content, contentCrlf, missing, pending } = value;
+	if (tree !== void 0 && typeof tree !== "string" || content !== void 0 && typeof content !== "string" || contentCrlf !== void 0 && typeof contentCrlf !== "string" || missing !== void 0 && missing !== true || pending !== void 0 && pending !== true) return;
 	return {
 		...tree === void 0 ? {} : { tree },
 		...content === void 0 ? {} : { content },
+		...contentCrlf === void 0 ? {} : { contentCrlf },
 		...missing === void 0 ? {} : { missing },
 		...pending === void 0 ? {} : { pending }
 	};
@@ -137,6 +143,41 @@ const skillContentHash = (files) => {
 	}
 	return hash.digest("hex");
 };
+const LF = 10;
+const CR = 13;
+/** Control bytes Git counts as printable text: backspace, tab, form feed, escape. */
+const PRINTABLE_CONTROLS = /* @__PURE__ */ new Set([
+	8,
+	9,
+	12,
+	27
+]);
+/**
+* The bytes Git writes for a blob when `core.autocrlf=true`, the Git for Windows default. The
+* skills CLI hashes that checkout, so a Windows install records a hash of these bytes. Mirrors
+* Git's `convert.c`: a blob that has any CR, a NUL, or mostly non-printable bytes is written
+* unchanged, and every LF in any other blob becomes CRLF.
+*/
+const autocrlfCheckout = (bytes) => {
+	let lf = 0;
+	let printable = 0;
+	let nonprintable = 0;
+	for (const byte of bytes) {
+		if (byte === CR || byte === 0) return bytes;
+		if (byte === LF) lf += 1;
+		else if (byte === 127 || byte < 32 && !PRINTABLE_CONTROLS.has(byte)) nonprintable += 1;
+		else printable += 1;
+	}
+	if (bytes[bytes.length - 1] === 26) nonprintable -= 1;
+	if (lf === 0 || printable >> 7 < nonprintable) return bytes;
+	const out = new Uint8Array(bytes.length + lf);
+	let at = 0;
+	for (const byte of bytes) {
+		if (byte === LF) out[at++] = CR;
+		out[at++] = byte;
+	}
+	return out;
+};
 const gitBlobSha = (bytes) => createHash("sha1").update(`blob ${bytes.byteLength}\0`).update(bytes).digest("hex");
 const isTreeEntry = (value) => isRecord(value) && typeof value.path === "string" && typeof value.mode === "string" && typeof value.type === "string" && typeof value.sha === "string";
 const githubHeaders = (env) => {
@@ -168,7 +209,7 @@ const folderFiles = (tree, folder) => tree.filter((entry) => {
 	const dirs = entry.path.slice(folder.length + 1).split("/").slice(0, -1);
 	return !dirs.includes(".git") && !dirs.includes("node_modules");
 });
-const fetchContentHash = async (source, folder, tree) => {
+const fetchContentHashes = async (source, folder, tree) => {
 	const files = await Promise.all(folderFiles(tree, folder).map(async (entry) => {
 		const path = entry.path.split("/").map(encodeURIComponent).join("/");
 		const response = await fetch(`https://raw.githubusercontent.com/${source}/HEAD/${path}`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
@@ -180,7 +221,13 @@ const fetchContentHash = async (source, folder, tree) => {
 			bytes
 		};
 	}));
-	return skillContentHash(files);
+	return {
+		content: skillContentHash(files),
+		contentCrlf: skillContentHash(files.map((file) => ({
+			...file,
+			bytes: autocrlfCheckout(file.bytes)
+		})))
+	};
 };
 /**
 * The folders to fetch: the given skills, plus every folder already in the cache so
@@ -232,11 +279,14 @@ const refreshSkillsCheckCache = async ({ cachePath, skills, env = process.env, n
 				continue;
 			}
 			const prior = previous[key];
-			let content = prior?.tree === node.sha ? prior.content : void 0;
-			if (request.content && content === void 0) content = await fetchContentHash(source, request.folder, tree);
+			let hashes = prior?.tree === node.sha && prior.content !== void 0 && prior.contentCrlf !== void 0 ? {
+				content: prior.content,
+				contentCrlf: prior.contentCrlf
+			} : void 0;
+			if (request.content && hashes === void 0) hashes = await fetchContentHashes(source, request.folder, tree);
 			folders[key] = {
 				tree: node.sha,
-				...content === void 0 ? {} : { content }
+				...hashes
 			};
 		}
 	}
@@ -394,4 +444,4 @@ const notifyIfSkillsOutdated = ({ configDir, cwd, now = Date.now() }) => {
 	}, "skills check cache")) spawnSkillsCheckWorker(cachePath, cwd);
 };
 //#endregion
-export { formatSkillsNotice, globalLockPath, lockPath, neonSkillsUpdateCommand, notifyIfSkillsOutdated, parseSkillsCheckCache, parseSkillsLock, planSkillsCheck, projectLockPath, readLockedSkills, readSkillsTelemetry, refreshSkillsCheckCache, scopeLabel, skillContentHash, skillStatus, skillsCheckCachePath, skillsStatusRows, skillsTelemetry };
+export { autocrlfCheckout, formatSkillsNotice, globalLockPath, lockPath, neonSkillsUpdateCommand, notifyIfSkillsOutdated, parseSkillsCheckCache, parseSkillsLock, planSkillsCheck, projectLockPath, readLockedSkills, readSkillsTelemetry, refreshSkillsCheckCache, scopeLabel, skillContentHash, skillStatus, skillsCheckCachePath, skillsStatusRows, skillsTelemetry };

package/dist/skills/run.js

@@ -37,11 +37,13 @@ const assertSkillsNode = (version = process.version) => {
 	if (nodeMeetsMinimum(version, "22.20.0")) return;
 	throw new Error(`neon skills needs Node.js ${SKILLS_MIN_NODE} or newer to run the skills CLI. This process is Node.js ${version.replace(/^v/, "")}. Upgrade Node.js, then retry.`);
 };
+/** A bare `skills` makes npx run any copy already installed globally or cached, however old. */
+const SKILLS_PACKAGE = "skills@latest";
 const skillsAddArgs = (options) => {
 	if (options.skills.length === 0) throw new Error("skills add needs at least one --skill.");
 	const args = [
 		"-y",
-		"skills",
+		SKILLS_PACKAGE,
 		"add",
 		options.source
 	];
@@ -83,7 +85,7 @@ const skillsUpdateDetail = (output) => {
 };
 const skillsUpdateArgs = (options) => [
 	"-y",
-	"skills",
+	SKILLS_PACKAGE,
 	"update",
 	options.global ? "-g" : "-p",
 	"-y"

package/dist/test_utils/fixtures.js

@@ -48,14 +48,15 @@ const test = test$1.extend({
 		let startedServer;
 		await use(async (mockDir, onRequest) => {
 			const app = express();
+			app.use(express.json());
 			if (onRequest) app.use((req, _res, next) => {
 				onRequest({
 					method: req.method,
-					path: req.path
+					path: req.path,
+					body: req.body
 				});
 				next();
 			});
-			app.use(express.json());
 			app.use("/", emocks(join(process.cwd(), "mocks", mockDir), { "404": (_req, res) => res.status(404).send({ message: "Not Found" }) }));
 			const server = await new Promise((resolve) => {
 				const s = app.listen(0, () => {
@@ -76,7 +77,7 @@ const test = test$1.extend({
 	},
 	testCliCommand: async ({ runMockServer }, use) => {
 		await use(async (args, options = {}) => {
-			const apiHost = options.unreachableHost ? await reserveClosedPort() : `http://localhost:${(await runMockServer(options.mockDir || "main")).address().port}`;
+			const apiHost = options.unreachableHost ? await reserveClosedPort() : `http://localhost:${(await runMockServer(options.mockDir || "main", options.onRequest)).address().port}`;
 			let output = "";
 			let error = "";
 			const cp = fork(join(process.cwd(), "./dist/index.js"), [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.12.2",
+  "version": "8.13.1",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -72,10 +72,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.4",
-    "@neon/config-runtime": "1.10.3",
+    "@neon/config": "1.9.5",
+    "@neon/config-runtime": "1.10.4",
     "@neon/realtime": "0.1.2",
-    "@neon/sdk": "7.5.0"
+    "@neon/sdk": "7.6.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -112,10 +112,10 @@
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon-internals/env-core": "0.0.35",
-    "@neon/env": "1.6.5",
-    "@neon/functions": "0.11.0",
-    "@neon/e2e-harness": "0.0.0"
+    "@neon-internals/env-core": "0.0.36",
+    "@neon/env": "1.6.6",
+    "@neon/e2e-harness": "0.0.0",
+    "@neon/functions": "0.11.0"
   },
   "publishConfig": {
     "access": "public",

package/dist/_chunks/{env-uVRY4xah.js → env-5HS5qQGd.js}

@@ -7,9 +7,9 @@ import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOpt
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
 import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-BpP3Dqpe.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "./env-BNm69Qh8.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "./env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "../commands/env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";