neon 8.13.2 → 8.14.0

package/dist/_chunks/{functions-Q0zuvtnk.js → functions-3ypiRwZK.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
@@ -15,7 +15,7 @@ import { statSync } from "node:fs";
 import { dirname } from "node:path";
 import { FUNCTION_SOURCE_ENTRIES } from "@neon/config";
 import { bundleAsIs, describeNativeFinding, findUndeclaredNativePackages, resolveEsbuildEntry, zipFunctionBundle } from "@neon/config-runtime";
-//#region src/commands/functions.ts
+// src/commands/functions.ts
 var functions_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -460,5 +460,4 @@ const deleteDomain = async (props) => {
 	}
 	log.info(`Custom domain ${props.domain} deleted from branch ${branchId}`);
 };
-//#endregion
 export { describe as a, deploymentPollDelay as i, builder as n, functions_exports as o, command as r, handler as s, aliases as t };

package/dist/_chunks/{git-H32TNt6M.js → git-Dxw9w9dK.js}

@@ -1,17 +1,17 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollowedGitHookSync, readContextFile, setGitBranchMap, setGitBranchMapping, setGitFollow } from "../context.js";
 import { writer } from "../writer.js";
 import { neonSafeBranchName } from "../utils/branch_name.js";
 import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
-import { o as quoteFlagValue } from "./link-BgtkOBws.js";
-import { o as handler$1 } from "./checkout-CXIOydqZ.js";
+import { o as quoteFlagValue } from "./link-CcwTXRny.js";
+import { o as handler$1 } from "./checkout-C6VMMgY6.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";
 import prompts from "prompts";
-//#region src/commands/git.ts
+// src/commands/git.ts
 var git_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -352,5 +352,4 @@ const confirmPrune = async (props, toDelete) => {
 	});
 	return Boolean(ok);
 };
-//#endregion
 export { describe as a, install as c, sync as d, uninstall as f, command as i, partitionBranchesToPrune as l, builder as n, git_exports as o, cleanup as r, handler as s, aliases as t, status as u };

package/dist/_chunks/{init-BkA6RilG.js → init-BOOGv-mD.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { NEON_SERVICES, servicesOption } from "../neon_services.js";
@@ -6,7 +6,7 @@ import { coerceAgentFlag } from "../utils/agent_flag.js";
 import { initPluginAgents, initSkillsMcpAgents } from "../init/plan.js";
 import { listSkillIds } from "../skills/catalog.js";
 import { runInit } from "../init/run.js";
-//#region src/commands/init.ts
+// src/commands/init.ts
 var init_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -107,5 +107,4 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 const handler = async (props) => {
 	await runInit(props);
 };
-//#endregion
 export { init_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{inspect-g0wekylj.js → inspect-yFAb61qo.js}

@@ -1,9 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { formatInspectQueryError, resolveInspectTargets, runInspectQuery } from "../utils/inspect_db.js";
 import { INSPECT_QUERIES } from "../utils/inspect_queries.js";
-//#region src/commands/inspect.ts
+// src/commands/inspect.ts
 var inspect_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -86,5 +86,4 @@ const builder = (argv) => argv.usage("$0 inspect <sub-command> [options]").comma
 const handler = (args) => {
 	return args;
 };
-//#endregion
 export { handler as a, describe as i, builder as n, inspect_exports as o, command as r, aliases as t };

package/dist/_chunks/{ip_allow-5lLFvIuE.js → ip_allow-DBdxNEUa.js}

@@ -1,10 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { projectUpdateRequest } from "../parameters.gen.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/ip_allow.ts
+// src/commands/ip_allow.ts
 var ip_allow_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -102,5 +102,4 @@ const parse = (project) => {
 		protected_branches_only: project.settings?.allowed_ips?.protected_branches_only ?? false
 	};
 };
-//#endregion
 export { ip_allow_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{link-BgtkOBws.js → link-CcwTXRny.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isInteractiveTerminal } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody } from "../api.js";
-import { r as defaultDir } from "./paths-DMq0Lt7a.js";
+import { r as defaultDir } from "./paths-B55ZfOg1.js";
 import "../config.js";
 import { applyContext, contextBranch, readContextFile, setContext, updateContextFile } from "../context.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
@@ -13,12 +13,12 @@ import { writer } from "../writer.js";
 import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
-import { h as initCmd } from "./config-BH_qRHiG.js";
+import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
+import { h as initCmd } from "./config-7SIE_C5O.js";
 import { formatLinkSummary } from "../commands/link_output.js";
-import { r as REGIONS } from "./projects-BwI2Uo0z.js";
+import { r as REGIONS } from "./projects-a3X4OFEJ.js";
 import prompts from "prompts";
-//#region src/commands/link.ts
+// src/commands/link.ts
 var link_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -932,5 +932,4 @@ const mustString = (value, name) => {
 	if (value === void 0) throw new Error(`Internal error: expected ${name} to be set.`);
 	return value;
 };
-//#endregion
 export { link_exports as a, shouldOfferConfigInit as c, handler as i, command as n, quoteFlagValue as o, describe as r, runLink as s, builder as t };

package/dist/_chunks/{logs-DWkpjzIH.js → logs-BB4uvblR.js}

@@ -1,10 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/logs.ts
+// src/commands/logs.ts
 var logs_exports = /* @__PURE__ */ __exportAll({
 	assertReachableLogsPage: () => assertReachableLogsPage,
 	buildLogsQueryBody: () => buildLogsQueryBody,
@@ -287,5 +287,4 @@ const fieldValues = async (props) => {
 	});
 	if (data.is_truncated) log.info(`More values exist than were returned for "${escapeLogSingleLine(props.field)}". Narrow the window with --since or --start-time, restrict --source, or raise --limit, then run it again.`);
 };
-//#endregion
 export { describe as a, handler as c, command as i, logs_exports as l, buildLogsQueryBody as n, escapeLogSingleLine as o, builder as r, escapeLogTableCell as s, assertReachableLogsPage as t };

package/dist/_chunks/{mcp-Bo-7TKc7.js → mcp-BznTRK3w.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { readContextFile } from "../context.js";
 import { recordCommandSuccessExtras } from "../analytics.js";
@@ -12,7 +12,7 @@ import { AGENT_MCP_SKIP_MESSAGE } from "../init/copy.js";
 import { mintMcpApiKey, mintedKeyRevokeCommand, withdrawMintedKey } from "../mcp/mint.js";
 import { canPickAgentsInteractively, skippableAgentPicker } from "../utils/agent_picker.js";
 import { resolveMcpPlan } from "../mcp/plan.js";
-//#region src/commands/mcp.ts
+// src/commands/mcp.ts
 var mcp_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => "mcp",
@@ -249,5 +249,4 @@ const handler = async (props) => {
 	if (error) throw error;
 	recordCommandSuccessExtras({ scope: outcome.scope });
 };
-//#endregion
 export { mcpInstallError as a, setupNeonMcp as c, handler as i, command as n, mcp_exports as o, describe as r, reportMcpInstall as s, builder as t };

package/dist/_chunks/{neon_auth-DpF83S24.js → neon_auth-Dw-ucM5Y.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { stripAnsi } from "../human_table.js";
@@ -6,8 +6,9 @@ import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject, resolveBranchFromProps } from "../utils/enrichers.js";
+import { readFileSync } from "node:fs";
 import chalk from "chalk";
-//#region src/commands/neon_auth.ts
+// src/commands/neon_auth.ts
 var neon_auth_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -45,17 +46,53 @@ const INTEGRATION_STATUS_FIELDS = [
 	"created_at",
 	"jwks_url"
 ];
-const OAUTH_PROVIDER_FIELDS = [
+const OAUTH_PROVIDER_LIST_FIELDS = [
 	"id",
 	"type",
 	"client_id"
 ];
+const OAUTH_PROVIDER_FIELDS = [
+	...OAUTH_PROVIDER_LIST_FIELDS,
+	"microsoft_tenant_id",
+	"apple_team_id",
+	"apple_key_id"
+];
 const ALLOW_LOCALHOST_FIELDS = ["allow_localhost"];
 const SUPPORTED_OAUTH_PROVIDERS = [
 	NeonAuthOauthProviderId.Google,
 	NeonAuthOauthProviderId.Github,
-	NeonAuthOauthProviderId.Vercel
+	NeonAuthOauthProviderId.Vercel,
+	NeonAuthOauthProviderId.Microsoft,
+	NeonAuthOauthProviderId.Apple
 ];
+const OWN_CREDENTIALS_NOTE = `${[NeonAuthOauthProviderId.Microsoft, NeonAuthOauthProviderId.Apple].join(" and ")} always need your own credentials`;
+const OAUTH_CREDENTIAL_OPTIONS = {
+	"oauth-client-id": {
+		describe: `OAuth client ID from your provider app. For apple, the Services ID. Omit to use Neon's shared OAuth app, where one exists; ${OWN_CREDENTIALS_NOTE}.`,
+		type: "string"
+	},
+	"oauth-client-secret": {
+		describe: `OAuth client secret from your provider app. Omit to use Neon's shared OAuth app, where one exists; ${OWN_CREDENTIALS_NOTE}.`,
+		type: "string"
+	},
+	"oauth-client-secret-file": {
+		describe: "Read the OAuth client secret from a file, for example the apple .p8 private key",
+		type: "string",
+		conflicts: "oauth-client-secret"
+	},
+	"microsoft-tenant-id": {
+		describe: "Tenant ID for the microsoft provider: common, organizations, consumers, a tenant GUID, or a domain",
+		type: "string"
+	},
+	"apple-team-id": {
+		describe: "Apple Developer Team ID (apple only)",
+		type: "string"
+	},
+	"apple-key-id": {
+		describe: "Key ID of the Sign in with Apple private key (apple only). Sent together with a new apple client secret, and only with one",
+		type: "string"
+	}
+};
 const DOMAIN_FIELDS = ["domain"];
 const EMAIL_PASSWORD_FIELDS = [
 	"enabled",
@@ -139,14 +176,7 @@ const builder = (argv) => {
 				choices: SUPPORTED_OAUTH_PROVIDERS,
 				demandOption: true
 			},
-			"oauth-client-id": {
-				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			},
-			"oauth-client-secret": {
-				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			}
+			...OAUTH_CREDENTIAL_OPTIONS
 		}), async (args) => {
 			await oauthProviderAdd(args);
 		}).command("update", "Update an OAuth provider", (yargs) => yargs.options({
@@ -156,14 +186,7 @@ const builder = (argv) => {
 				choices: SUPPORTED_OAUTH_PROVIDERS,
 				demandOption: true
 			},
-			"oauth-client-id": {
-				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			},
-			"oauth-client-secret": {
-				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			}
+			...OAUTH_CREDENTIAL_OPTIONS
 		}), async (args) => {
 			await oauthProviderUpdate(args);
 		}).command("delete", "Delete an OAuth provider", (yargs) => yargs.options({ "provider-id": {
@@ -605,10 +628,37 @@ const oauthProviderList = async (props) => {
 		printMessage("No OAuth providers are configured for this branch.");
 		return;
 	}
-	writer(props).end(data.providers, { fields: OAUTH_PROVIDER_FIELDS });
+	writer(props).end(data.providers, { fields: OAUTH_PROVIDER_LIST_FIELDS });
 	if (data.providers.some((p) => p.type === NeonAuthOauthProviderType.Shared) && props.output === "table") writeStyled(`\n${chalk.yellow("Caution:")} ${SHARED_PROVIDER_DISCLAIMER}\n\n`);
 };
+const resolveClientSecret = (props) => {
+	const file = props.oauthClientSecretFile;
+	if (file === void 0) return props.oauthClientSecret;
+	let contents;
+	try {
+		contents = readFileSync(file, "utf8");
+	} catch (err) {
+		throw new Error(`Could not read --oauth-client-secret-file ${file}: ${err.message}`);
+	}
+	const secret = contents.replace(/[\r\n]+$/, "");
+	if (!secret) throw new Error(`--oauth-client-secret-file ${file} is empty.`);
+	return secret;
+};
+const sharedProviderRejectedMessage = (providerId) => {
+	let flags;
+	switch (providerId) {
+		case NeonAuthOauthProviderId.Apple:
+			flags = "--oauth-client-id <Services ID>, --oauth-client-secret-file <.p8>, --apple-team-id and --apple-key-id";
+			break;
+		case NeonAuthOauthProviderId.Microsoft:
+			flags = "--oauth-client-id and --oauth-client-secret (and optionally --microsoft-tenant-id)";
+			break;
+		default: flags = "--oauth-client-id and --oauth-client-secret";
+	}
+	return `The "${providerId}" provider requires your own OAuth app credentials.\nRe-run with ${flags} to provide them.\nCreate an OAuth app at your provider and use those credentials.`;
+};
 const oauthProviderAdd = async (props) => {
+	const clientSecret = resolveClientSecret(props);
 	const branchId = await resolveBranch(props);
 	const baseUrlRequest = callbackBaseUrl(props, branchId, props.providerId);
 	let data;
@@ -616,38 +666,55 @@ const oauthProviderAdd = async (props) => {
 		({data} = await props.apiClient.addBranchNeonAuthOauthProvider(props.projectId, branchId, {
 			id: props.providerId,
 			client_id: props.oauthClientId,
-			client_secret: props.oauthClientSecret
+			client_secret: clientSecret,
+			microsoft_tenant_id: props.microsoftTenantId,
+			apple_team_id: props.appleTeamId,
+			apple_key_id: props.appleKeyId
 		}));
 	} catch (err) {
-		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
+		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(sharedProviderRejectedMessage(props.providerId));
 		throw err;
 	}
 	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
 	else printKvBlock("OAuth provider added", [
 		["ID:", data.id],
 		["Type:", data.type],
-		...data.client_id ? [["Client ID:", data.client_id]] : []
+		...data.client_id ? [["Client ID:", data.client_id]] : [],
+		...data.microsoft_tenant_id ? [["Tenant ID:", data.microsoft_tenant_id]] : [],
+		...data.apple_team_id ? [["Team ID:", data.apple_team_id]] : [],
+		...data.apple_key_id ? [["Key ID:", data.apple_key_id]] : []
 	]);
 	printCallbackInstructions(props.providerId, await baseUrlRequest);
 };
 const oauthProviderUpdate = async (props) => {
+	const clientSecret = resolveClientSecret(props);
+	if (props.providerId === NeonAuthOauthProviderId.Apple) {
+		if (clientSecret !== void 0 && !props.appleKeyId) throw new Error("Changing the apple client secret requires --apple-key-id, the Key ID of the new private key.");
+		if (props.appleKeyId !== void 0 && clientSecret === void 0) throw new Error("--apple-key-id identifies the new private key, so it requires --oauth-client-secret or --oauth-client-secret-file.");
+	}
 	const branchId = await resolveBranch(props);
 	const baseUrlRequest = callbackBaseUrl(props, branchId, props.providerId);
 	let data;
 	try {
 		({data} = await props.apiClient.updateBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId, {
 			client_id: props.oauthClientId,
-			client_secret: props.oauthClientSecret
+			client_secret: clientSecret,
+			microsoft_tenant_id: props.microsoftTenantId,
+			apple_team_id: props.appleTeamId,
+			apple_key_id: props.appleKeyId
 		}));
 	} catch (err) {
-		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
+		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(sharedProviderRejectedMessage(props.providerId));
 		throw err;
 	}
 	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
 	else printKvBlock("OAuth provider updated", [
 		["ID:", data.id],
 		["Type:", data.type],
-		...data.client_id ? [["Client ID:", data.client_id]] : []
+		...data.client_id ? [["Client ID:", data.client_id]] : [],
+		...data.microsoft_tenant_id ? [["Tenant ID:", data.microsoft_tenant_id]] : [],
+		...data.apple_team_id ? [["Team ID:", data.apple_team_id]] : [],
+		...data.apple_key_id ? [["Key ID:", data.apple_key_id]] : []
 	]);
 	printCallbackInstructions(props.providerId, await baseUrlRequest);
 };
@@ -660,6 +727,14 @@ const CALLBACK_INSTRUCTIONS = {
 		lead: "Create a Vercel App in your Vercel Dashboard and add the following authorization callback URL:",
 		urlLabel: "callback/vercel"
 	},
+	microsoft: {
+		lead: "Register an application in Microsoft Entra ID > App registrations, and add the following redirect URI under the Web platform:",
+		urlLabel: "callback/microsoft"
+	},
+	apple: {
+		lead: "Create a Services ID in the Apple Developer portal, enable Sign in with Apple for it, and add the following return URL (Apple requires HTTPS and does not accept localhost):",
+		urlLabel: "callback/apple"
+	},
 	google: {
 		lead: "Get Google credentials by creating an OAuth client in Google Cloud Console > Credentials, and add the following authorized redirect URL:",
 		urlLabel: "callback/google"
@@ -1256,5 +1331,4 @@ const userSetRole = async (props) => {
 	const { data } = await props.apiClient.updateNeonAuthUserRole(props.projectId, branchId, props.userId, { roles: props.roles });
 	printKvBlock("Roles updated", [["User ID:", data.id], ["Roles:", props.roles.join(", ")]]);
 };
-//#endregion
 export { neon_auth_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{open-CX3BT3Tp.js → open-T2nI89Oh.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import open from "open";
-//#region src/commands/open.ts
+// src/commands/open.ts
 var open_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -29,5 +29,4 @@ const handler = async (props) => {
 		});
 	});
 };
-//#endregion
 export { open_exports as a, handler as i, command as n, projectConsoleUrl as o, describe as r, builder as t };

package/dist/_chunks/{operations-D4I-AxVs.js → operations-CzaR_uqx.js}

@@ -1,7 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/operations.ts
+// src/commands/operations.ts
 var operations_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -33,5 +33,4 @@ const list = async (props) => {
 	});
 	writer(props).end(data.operations, { fields: OPERATIONS_FIELDS });
 };
-//#endregion
 export { handler as a, describe as i, builder as n, list as o, command as r, operations_exports as s, aliases as t };

package/dist/_chunks/{orgs-xGfANwHQ.js → orgs-Dpbr-K0A.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { readContextFile } from "../context.js";
 import { writer } from "../writer.js";
 import chalk from "chalk";
-//#region src/commands/orgs.ts
+// src/commands/orgs.ts
 var orgs_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -48,5 +48,4 @@ const ACRONYMS = {
 };
 /** `free_v3` -> `Free`, `aws_marketplace` -> `AWS Marketplace`; JSON/YAML keep the API id. */
 const planName = (plan) => (plan ?? "").replace(/_v\d+$/, "").split("_").filter(Boolean).map((word) => ACRONYMS[word] ?? word[0].toUpperCase() + word.slice(1)).join(" ");
-//#endregion
 export { handler as a, describe as i, builder as n, orgs_exports as o, command as r, planName as s, aliases as t };

package/dist/_chunks/{paths-DMq0Lt7a.js → paths-B55ZfOg1.js}

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
-//#region ../../internals/cli-core/dist/paths.js
+// ../../internals/cli-core/dist/paths.js
 /**
 * # Where the Neon CLIs keep their files on disk
 *
@@ -147,5 +147,4 @@ const isOwnedCredentialPath = (configDirectory, file) => {
 	const legacy = legacyConfigDir();
 	return legacy !== void 0 && isInsideConfigDir(legacy, file);
 };
-//#endregion
 export { isOwnedCredentialPath as a, isInsideConfigDir as i, credentialsPath as n, resolveConfigFile as o, defaultDir as r, CREDENTIALS_FILE as t };

package/dist/_chunks/{plugins-Dj0H6lDA.js → plugins-CKOcBuuP.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { recordCommandSuccessExtras } from "../analytics.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
@@ -12,7 +12,7 @@ import { AGENT_PLUGIN_SKIP_MESSAGE } from "../init/copy.js";
 import { canPickAgentsInteractively, skippableAgentPicker } from "../utils/agent_picker.js";
 import { resolvePluginsPlan } from "../plugins/plan.js";
 import { NEON_PLUGIN_NAME, PLUGIN_SKILLS, PLUGIN_SOURCE, neonPluginsRetryCommand, pluginsAddArgs, runPluginsCli } from "../plugins/run.js";
-//#region src/commands/plugins.ts
+// src/commands/plugins.ts
 var plugins_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -165,5 +165,4 @@ const handler = async (props) => {
 	if (error) throw error;
 	recordCommandSuccessExtras({ scope: outcome.scope });
 };
-//#endregion
 export { handler as a, plugins_exports as c, describe as i, reportPluginsInstall as l, builder as n, installPlugins as o, command as r, pluginsInstallError as s, aliases as t };

package/dist/_chunks/{profile-yXOiKk9R.js → profile-H0d7gFrX.js}

@@ -1,24 +1,24 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "./credential_io-BS-0Pmwc.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
+import { t as writeSecretFile } from "./secure_file-Caskdohg.js";
+import { c as describeScope, d as scopeOf, l as interpretCredentials, n as KEYRING_SERVICE, o as apiKeyCredentials, r as keyringAccount, s as credentialLabel, t as storeFor } from "./credential_io-DbeSh3Pl.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
-import { a as isOwnedCredentialPath, n as credentialsPath } from "./paths-DMq0Lt7a.js";
-import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-DIB1av2Q.js";
+import { a as isOwnedCredentialPath, n as credentialsPath } from "./paths-B55ZfOg1.js";
+import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as newProfileLocation, f as profilesFilePath, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, o as credentialsDisplay, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, u as locationOf, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-DTazQtjK.js";
 import { auth, revokeToken } from "../auth.js";
-import { t as credentialInputs } from "./auth_selection-YX5_KZgD.js";
+import { t as credentialInputs } from "./auth_selection-CwGLN9Qz.js";
 import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
-import { n as authFlow, p as usableCredential } from "./auth-CIUtXByB.js";
+import { n as authFlow, p as usableCredential } from "./auth-DPSDYYtG.js";
 import { identityFromAuthDetails, isApiKeyMethod, mintedKeyName, notAnApiKeyMessage } from "../profile_keys.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
-import { s as orgIdForProject } from "./api_keys-CNnnugbQ.js";
+import { s as orgIdForProject } from "./api_keys-6Xnxl7a8.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { isAbsolute, relative } from "node:path";
 import prompts from "prompts";
-//#region src/commands/profile.ts
+// src/commands/profile.ts
 var profile_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -668,5 +668,4 @@ const remove = async (props) => {
 	} else if (existsSync(at.path)) log.info("Left %s on disk — not created by neon", at.path);
 	dropPointer();
 };
-//#endregion
 export { handler as a, describe as i, builder as n, profile_exports as o, command as r, aliases as t };

package/dist/_chunks/{profiles-DIB1av2Q.js → profiles-DTazQtjK.js}

@@ -1,12 +1,11 @@
-import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { n as credentialsPath, o as resolveConfigFile, r as defaultDir } from "./paths-DMq0Lt7a.js";
+import { t as writeSecretFile } from "./secure_file-Caskdohg.js";
+import { n as credentialsPath, o as resolveConfigFile, r as defaultDir } from "./paths-B55ZfOg1.js";
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
-//#region ../../internals/cli-core/dist/cli_config.js
+// ../../internals/cli-core/dist/cli_config.js
 const CRED_STORAGE_FILE = "file";
 const CRED_STORAGE_KEYRING = "keyring";
-//#endregion
-//#region ../../internals/cli-core/dist/profiles.js
+// ../../internals/cli-core/dist/profiles.js
 /**
 * Pointer-only profiles avoid mirrored credentials and persistent active-profile
 * state while preserving existing single-account and legacy-directory installs.
@@ -218,5 +217,4 @@ function nonEmpty(value) {
 	const trimmed = value.trim();
 	return trimmed === "" ? void 0 : trimmed;
 }
-//#endregion
 export { upsertProfile as _, canDropProfilesFile as a, listProfiles as c, newProfileLocation as d, profilesFilePath as f, selectProfileName as g, resolveProfile as h, assertValidProfileName as i, locationForName as l, readProfiles as m, KEYRING_CREDENTIALS as n, credentialsDisplay as o, profilesUsingPath as p, assertProfilesUsable as r, isKeyringPointer as s, DEFAULT_PROFILE as t, locationOf as u, CRED_STORAGE_FILE as v, CRED_STORAGE_KEYRING as y };

package/dist/_chunks/{projects-BwI2Uo0z.js → projects-a3X4OFEJ.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody } from "../api.js";
@@ -10,7 +10,7 @@ import { getComputeUnits } from "../utils/compute_units.js";
 import { psql } from "../utils/psql.js";
 import chalk from "chalk";
 import prompts from "prompts";
-//#region src/commands/projects.ts
+// src/commands/projects.ts
 var projects_exports = /* @__PURE__ */ __exportAll({
 	PROJECT_FIELDS: () => PROJECT_FIELDS,
 	RECOVERABLE_PROJECT_FIELDS: () => RECOVERABLE_PROJECT_FIELDS,
@@ -435,5 +435,4 @@ const onPromptState = (state) => {
 		process.exit(1);
 	}
 };
-//#endregion
 export { builder as a, formatDuration as c, aliases as i, handler as l, RECOVERABLE_PROJECT_FIELDS as n, command as o, REGIONS as r, describe as s, PROJECT_FIELDS as t, projects_exports as u };

package/dist/_chunks/{psql-BM-doe8e.js → psql-Bce4X0NG.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { s as handler$1, t as SSL_MODES } from "./connection_string-DB4awPzZ.js";
-//#region src/commands/psql.ts
+import { s as handler$1, t as SSL_MODES } from "./connection_string-C9e7N4xk.js";
+// src/commands/psql.ts
 var psql_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -60,5 +60,4 @@ const handler = async (props) => {
 		extended: false
 	});
 };
-//#endregion
 export { psql_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{psql-BNljLda2.js → psql-DwGeP0IV.js}

@@ -12,7 +12,7 @@ import { executeInputString, loadPsqlrc } from "../psql/io/psqlrc.js";
 import { existsSync, promises } from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
-//#region src/psql/core/startup.ts
+// src/psql/core/startup.ts
 /**
 * psql startup-args parser + applier.
 *
@@ -664,8 +664,7 @@ const resolveLayeredConnect = (argvLayer, resolution, legacyBase) => {
 	return merged;
 };
 const formatParseError = (err) => err.message;
-//#endregion
-//#region src/psql/index.ts
+// src/psql/index.ts
 /**
 * Embedded TypeScript psql entrypoint.
 *
@@ -2166,5 +2165,4 @@ const mergeConnectOptions = (layers, defaults) => {
 	assertSslNegotiationModeCompatible(out.ssl, out.sslnegotiation);
 	return out;
 };
-//#endregion
 export { mergeConnectOptions as a, parseConnectionUriService as c, serviceEntryToConnectOptions as d, CLIENT_VERSION as f, parseStartupArgs as h, looksLikeConnectionString as i, parseConninfo as l, formatParseError as m, envConnectionDefaults as n, parseConnectionUri as o, applyStartupArgs as p, libpqConnectionDefaults as r, parseConnectionUriPartial as s, defaultClientCertDefaults as t, runPsql as u };