neon 8.13.2 → 8.15.0

package/README.md

@@ -673,7 +673,7 @@ export default defineConfig({
 
 ### Getting a `neon.ts` (`config init`)
 
-`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is purely local — no auth, no API calls. In an interactive terminal it asks which services the policy should declare:
+`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is local — no auth and no API calls — except `--services data-api`, which reads the linked branch's Data API with a credential already on hand (never a login) so the scaffold declares the right auth. In an interactive terminal it asks which services the policy should declare:
 
 ```
 ? Which Neon services should neon.ts declare? (space to toggle, enter to confirm) ›

package/dist/_chunks/{api-GbEaBZJ5.js → api-1MKsfpY3.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { codeFromBody, isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
 import { describeOperation, getEndpoints, loadSpec } from "../utils/openapi.js";
@@ -6,7 +6,7 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import chalk from "chalk";
 import YAML from "yaml";
-//#region src/commands/api.ts
+// src/commands/api.ts
 var api_exports = /* @__PURE__ */ __exportAll({
 	buildBody: () => buildBody,
 	buildQuery: () => buildQuery,
@@ -384,5 +384,4 @@ const handler = async (args) => {
 	}
 	await runRequest(apiArgs);
 };
-//#endregion
 export { colorizeJson as a, handler as c, parseTypedValue as d, setDeep as f, builder as i, parseHeaders as l, buildBody as n, command as o, buildQuery as r, describe as s, api_exports as t, parseKeyValue as u };

package/dist/_chunks/{api_keys-CNnnugbQ.js → api_keys-6Xnxl7a8.js}

@@ -1,9 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
-//#region src/commands/api_keys.ts
+// src/commands/api_keys.ts
 var api_keys_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -277,5 +277,4 @@ const orgIdForProject = async (client, projectId, usage = "api-keys") => {
 	if (!orgId) throw new Error(usage === "mcp" ? `Project ${projectId} does not belong to an organization, so it cannot have a project-scoped API key. Pass --oauth to pin tools without minting, or omit --project-id to mint an account-wide key.` : `Project ${projectId} does not belong to an organization, so it cannot have a project-scoped API key. Omit --project-id to create an account key.`);
 	return orgId;
 };
-//#endregion
 export { describe as a, command as i, api_keys_exports as n, handler as o, builder as r, orgIdForProject as s, aliases as t };

package/dist/_chunks/{ask-DVwy0eUL.js → ask-Xlek1Pxh.js}

@@ -1,11 +1,11 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { isNetworkError } from "../errors.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { isEventStreamContentType, readAskSse } from "../commands/ask_sse.js";
 import { createThinkingSpinner } from "../commands/thinking_spinner.js";
-//#region src/commands/ask.ts
+// src/commands/ask.ts
 var ask_exports = /* @__PURE__ */ __exportAll({
 	DEFAULT_ASK_URL: () => DEFAULT_ASK_URL,
 	builder: () => builder,
@@ -151,5 +151,4 @@ async function askAssistant(opts) {
 	}
 	return askText(await readJsonBody(response));
 }
-//#endregion
 export { describe as a, command as i, ask_exports as n, handler as o, builder as r, resolveAskUrl as s, DEFAULT_ASK_URL as t };

package/dist/_chunks/{auth-CIUtXByB.js → auth-rup6nemJ.js}

@@ -1,16 +1,16 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "./credential_io-BS-0Pmwc.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
+import { a as OAUTH, i as API_KEY, l as interpretCredentials, s as credentialLabel, t as storeFor } from "./credential_io-DbeSh3Pl.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { withExclusiveLock } from "../refresh_lock.js";
 import { getApiClient, isNeonApiError } from "../api.js";
 import { setAuthContext } from "../auth_context.js";
-import { a as isOwnedCredentialPath } from "./paths-DMq0Lt7a.js";
+import { a as isOwnedCredentialPath } from "./paths-B55ZfOg1.js";
 import { currentContextFile, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isFunctionsTemplateCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile } from "../context.js";
-import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "./profiles-DIB1av2Q.js";
+import { _ as upsertProfile, d as newProfileLocation, g as selectProfileName, h as resolveProfile, i as assertValidProfileName, l as locationForName, m as readProfiles, n as KEYRING_CREDENTIALS, p as profilesUsingPath, r as assertProfilesUsable, s as isKeyringPointer, t as DEFAULT_PROFILE, u as locationOf } from "./profiles-DTazQtjK.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { AuthRefreshError, auth, classifyRefreshFailure, refreshToken } from "../auth.js";
-import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "./auth_selection-YX5_KZgD.js";
+import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "./auth_selection-CwGLN9Qz.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, claimableCredentialsExist, claimableCredentialsPath, readLinkedClaimableCredentials, shouldUseClaimableCredentials } from "../claimable/state.js";
 import { readOutgoingCredential, retirePreviousCredential } from "../retire_credential.js";
@@ -19,7 +19,7 @@ import { helpEpilogue, helpWidth, wrapHelpText } from "../utils/help_text.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
-//#region src/commands/auth.ts
+// src/commands/auth.ts
 var auth_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	authFlow: () => authFlow,
@@ -28,6 +28,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	deleteCredentialsAt: () => deleteCredentialsAt,
 	describe: () => describe,
 	ensureAuth: () => ensureAuth,
+	existingApiClient: () => existingApiClient,
 	handler: () => handler,
 	isAccessTokenUsable: () => isAccessTokenUsable,
 	locationForAuth: () => locationForAuth,
@@ -288,6 +289,42 @@ const usableCredential = async (props, at) => {
 		return null;
 	}
 };
+/**
+* The API client for a credential this invocation already holds — the `--api-key` flag or
+* `NEON_API_KEY`, or the selected profile's stored key or OAuth session, refreshed when
+* expired — along with the key it uses. Never starts a login, so a read that only enriches a
+* local file cannot interrupt it. Null when there is no such credential.
+*
+* Selection follows {@link ensureAuth} exactly; only the fallback differs. `ensureAuth` may
+* log in, and a caller that is only reading a branch to improve a scaffold must not.
+*/
+const existingApiClient = async (props) => {
+	const selection = selectCredential({
+		...credentialInputs(),
+		profileFlag: props.profile
+	});
+	if (selection.source !== "profile") return {
+		apiKey: selection.apiKey,
+		apiClient: getApiClient({
+			apiKey: selection.apiKey,
+			apiHost: props.apiHost
+		})
+	};
+	const usable = await usableCredential({
+		configDir: props.configDir,
+		apiHost: props.apiHost,
+		oauthHost: props.oauthHost ?? process.env.NEON_OAUTH_HOST ?? "https://oauth2.neon.tech",
+		clientId: props.clientId ?? "neonctl"
+	}, locationForAuth(props.configDir, selection.profile));
+	if (usable === null) return null;
+	return {
+		apiKey: usable.apiKey,
+		apiClient: getApiClient({
+			apiKey: usable.apiKey,
+			apiHost: props.apiHost
+		})
+	};
+};
 const ensureAuth = async (props) => {
 	if (props._.length === 0 || props.help) return;
 	if (isCurrentBranchProbe(props)) return;
@@ -491,5 +528,4 @@ const deleteCredentialsAt = (at, configDir) => {
 	}
 };
 const md5hash = (s) => createHash("md5").update(s).digest("hex");
-//#endregion
-export { command as a, ensureAuth as c, locationForAuth as d, refreshStoredCredentials as f, builder as i, handler as l, authFlow as n, deleteCredentialsAt as o, usableCredential as p, auth_exports as r, describe as s, aliases as t, isAccessTokenUsable as u };
+export { command as a, ensureAuth as c, isAccessTokenUsable as d, locationForAuth as f, builder as i, existingApiClient as l, usableCredential as m, authFlow as n, deleteCredentialsAt as o, refreshStoredCredentials as p, auth_exports as r, describe as s, aliases as t, handler as u };

package/dist/_chunks/{auth_selection-YX5_KZgD.js → auth_selection-CwGLN9Qz.js}

@@ -1,5 +1,5 @@
-import "./profiles-DIB1av2Q.js";
-//#region ../../internals/cli-core/dist/auth_selection.js
+import "./profiles-DTazQtjK.js";
+// ../../internals/cli-core/dist/auth_selection.js
 /**
 * # Which credential an invocation authenticates with
 *
@@ -81,5 +81,4 @@ function nonEmpty(value) {
 	const trimmed = value.trim();
 	return trimmed === "" ? void 0 : trimmed;
 }
-//#endregion
 export { selectCredential as i, displacedProfileWarning as n, recordCredentialInputs as r, credentialInputs as t };

package/dist/_chunks/{bootstrap-wPZWa1sT.js → bootstrap-BDkvsAVJ.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { recordCommandSuccessExtras, recordScaffoldedTemplate } from "../analytics.js";
@@ -17,7 +17,7 @@ import { runAgentTooling } from "../init/tooling.js";
 import { existsSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
 import prompts from "prompts";
-//#region src/commands/bootstrap.ts
+// src/commands/bootstrap.ts
 var bootstrap_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -495,5 +495,4 @@ const onPromptState = (state) => {
 		process.exit(1);
 	}
 };
-//#endregion
 export { handler as a, describe as i, builder as n, command as r, bootstrap_exports as t };

package/dist/_chunks/{branches-BNa1xX1L.js → branches-Bp-5z1lM.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { retryOnLock } from "../api.js";
 import { contextBranch, readContextFile } from "../context.js";
@@ -12,7 +12,7 @@ import { psql } from "../utils/psql.js";
 import { parsePointInTime } from "../utils/point_in_time.js";
 import { parseSchemaDiffParams, schemaDiff } from "../commands/schema_diff.js";
 import chalk from "chalk";
-//#region src/commands/branches.ts
+// src/commands/branches.ts
 var branches_exports = /* @__PURE__ */ __exportAll({
 	BRANCH_FIELDS: () => BRANCH_FIELDS,
 	aliases: () => aliases,
@@ -456,5 +456,4 @@ const setExpiration = async (props) => {
 		})
 	});
 };
-//#endregion
 export { command as a, builder as i, aliases as n, describe as o, branches_exports as r, handler as s, BRANCH_FIELDS as t };

package/dist/_chunks/{bucket-BCdryTkD.js → bucket-D06bvDSa.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { createProjectBranchBucket, deleteProjectBranchBucket, deleteProjectBranchBucketObject, deleteProjectBranchBucketObjectsByPrefix, getProjectBranchBucketObject, listProjectBranchBucketObjects, listProjectBranchBuckets, presignUpload } from "../storage_api.js";
@@ -8,7 +8,7 @@ import { createReadStream, createWriteStream } from "node:fs";
 import { basename } from "node:path";
 import { stat, unlink } from "node:fs/promises";
 import { pipeline } from "node:stream/promises";
-//#region src/commands/bucket.ts
+// src/commands/bucket.ts
 var bucket_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -405,5 +405,4 @@ const deleteObject = async (props) => {
 	}
 	log.info(`Object "${rest}" deleted from bucket "${bucket}" on branch ${branchId}`);
 };
-//#endregion
 export { describe as a, splitBucketTarget as c, command as i, bucket_exports as n, handler as o, builder as r, resolveListDelimiter as s, aliases as t };

package/dist/_chunks/{checkout-CXIOydqZ.js → checkout-BpOcFaAi.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
@@ -11,12 +11,12 @@ import { looksLikeBranchId } from "../utils/formats.js";
 import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js";
 import { buildCheckoutEvent, readGitContext } from "../utils/git.js";
 import { buildHookBranch, loadHookConfig, resolveHookEnv, runCheckoutAfterHook, runCheckoutBeforeHook, runCreateAfterHook, runCreateBeforeHook } from "../utils/hooks.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
-import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BH_qRHiG.js";
-import { i as handler$1 } from "./link-BgtkOBws.js";
+import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
+import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BjCm5cfr.js";
+import { i as handler$1 } from "./link-nAiuWKfg.js";
 import chalk from "chalk";
 import prompts from "prompts";
-//#region src/commands/checkout.ts
+// src/commands/checkout.ts
 var checkout_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -344,5 +344,4 @@ const tryAutoDetectProject = async (props) => {
 		return;
 	}
 };
-//#endregion
 export { formatCheckoutPolicyFailure as a, describe as i, checkout_exports as n, handler as o, command as r, builder as t };

package/dist/_chunks/{claim-DqAvAvDm.js → claim-DlLZmcq0.js}

@@ -1,9 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { applyContext, contextBranch, readContextFile } from "../context.js";
-import { t as credentialInputs } from "./auth_selection-YX5_KZgD.js";
+import { t as credentialInputs } from "./auth_selection-CwGLN9Qz.js";
 import { ClaimableClient, ClaimableServiceError } from "../claimable/api.js";
 import { assertionHasExpired, listClaimableCredentials, readClaimableCredentials, readLinkedClaimableCredentials, removeClaimableCredentials, writeClaimableCredentials } from "../claimable/state.js";
 import { NEON_SERVICES, deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
@@ -12,12 +12,12 @@ import { projectConfigPath } from "../project.js";
 import { resolveEnvFilePath } from "../env_file.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
-import { c as pull } from "./env-5HS5qQGd.js";
+import { c as pull } from "./env-BOt9AZ1j.js";
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import open from "open";
 import prompts from "prompts";
 import { loadConfigFromFile } from "@neon/config-runtime";
-//#region src/commands/claim.ts
+// src/commands/claim.ts
 var claim_exports = /* @__PURE__ */ __exportAll({
 	CLAIM_CREATE_FIELDS: () => CLAIM_CREATE_FIELDS,
 	CLAIM_LIST_FIELDS: () => CLAIM_LIST_FIELDS,
@@ -469,5 +469,4 @@ const finishClaimedContext = (props, projectId, contextMatches) => {
 	}
 	log.info("Dropped the local identity assertion. The next command needs `neon login` or `neon link`.");
 };
-//#endregion
 export { claimCreateFields as a, command as c, handler as d, builder as i, create as l, CLAIM_LIST_FIELDS as n, claim_exports as o, aliases as r, claimableCapabilities as s, CLAIM_CREATE_FIELDS as t, describe as u };

package/dist/_chunks/{cmd_pipeline-CEk93dGN.js → cmd_pipeline-BDE-TGto.js}

@@ -15,7 +15,7 @@ import { closeSync, createWriteStream, fsyncSync, openSync, promises } from "nod
 import * as path from "node:path";
 import { platform } from "node:os";
 import { spawn } from "node:child_process";
-//#region src/psql/core/common.ts
+// src/psql/core/common.ts
 /**
 * psql common — the unified send-query / process-result pipeline.
 *
@@ -836,8 +836,7 @@ const __testing = {
 	SAVEPOINT_NAME,
 	CURSOR_NAME
 };
-//#endregion
-//#region src/psql/command/cmd_io.ts
+// src/psql/command/cmd_io.ts
 /**
 * psql I/O & control backslash commands.
 *
@@ -2222,8 +2221,7 @@ const registerIoCommands = (registry) => {
 	registry.register(cmdGexec);
 	registry.register(cmdWatch);
 };
-//#endregion
-//#region src/psql/command/cmd_pipeline.ts
+// src/psql/command/cmd_pipeline.ts
 /**
 * psql pipeline / extended-query backslash commands (WP-21).
 *
@@ -2816,5 +2814,4 @@ const registerPipelineCommands = (registry) => {
 	registry.register(cmdSendPipeline);
 	registry.register(cmdGetResults);
 };
-//#endregion
 export { cmdPrint as A, psqlExec as B, cmdGdesc as C, cmdInclude as D, cmdGx as E, registerIoCommands as F, writeQueryError as G, renderResultSet as H, __testing as I, captureLastError as L, cmdWrite as M, formatWatchTimestamp as N, cmdIncludeRel as O, getQueryFout as P, executeAndPrint as R, cmdG as S, cmdGset as T, sendQuery as U, refreshErrorVars as V, stripLeadingCommentsAndWS as W, stagedNamedBindPresent as _, cmdFlush as a, WATCH_TEST_CONTROLLER as b, cmdParse as c, cmdSyncPipeline as d, consumeBindState as f, registerPipelineCommands as g, lookupPrepared as h, cmdEndPipeline as i, cmdWatch as j, cmdOut as k, cmdSendPipeline as l, getPipelineState as m, cmdBindNamed as n, cmdFlushRequest as o, dropPrepared as p, cmdClosePrepared as r, cmdGetResults as s, cmdBind as t, cmdStartPipeline as u, stashPrepared as v, cmdGexec as w, clearPipelineGateErrors as x, DEFAULT_WATCH_INTERVAL as y, pickOut$1 as z };

package/dist/_chunks/{config-BH_qRHiG.js → config-BjCm5cfr.js}

@@ -1,11 +1,14 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi, isInteractiveTerminal } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
+import { r as defaultDir } from "./paths-B55ZfOg1.js";
+import "../config.js";
 import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
+import { l as existingApiClient } from "./auth-rup6nemJ.js";
 import { NEON_SERVICES, NEON_SERVICE_LABELS, deprecatedServiceMessage, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
+import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, dataApiChoiceFromView, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { TYPESCRIPT_EXTENSION, asRelativeModulePath, editNeonConfig } from "../config_edit.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
@@ -23,13 +26,13 @@ import { readGitContext } from "../utils/git.js";
 import { resolveHookEnv, runDeployAfterHook, runDeployBeforeHook } from "../utils/hooks.js";
 import { pickServicesInteractively } from "../utils/service_picker.js";
 import { zipBundle } from "../utils/zip.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
+import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import chalk from "chalk";
 import { defineConfig, packagesToStage, previewGaWarningForConfig, resolveConfig } from "@neon/config";
 import { PushAbortedError, PushConflictError, apply, assertZipWithinLimits, bundleAsIs, createBranch, describeNativeFinding, enforceLimits, findUndeclaredNativePackages, inspect, isPartialBranchCreateError, plan, resolveEsbuildEntry, traceNativePackages, zipFunctionBundle } from "@neon/config-runtime";
-//#region src/commands/config.ts
+// src/commands/config.ts
 var config_exports = /* @__PURE__ */ __exportAll({
 	ConfigInstallFailed: () => ConfigInstallFailed,
 	addCmd: () => addCmd,
@@ -208,6 +211,53 @@ const seedFromBranch = async (props) => {
 		branchName: live.branch.name
 	};
 };
+/**
+* Which `dataApi` entry to scaffold for `data-api`. A linked branch whose Data API already
+* verifies an external IdP gets the external form, so the policy does not go on to enable
+* Neon Auth over it on the first `neon deploy`. The read goes through {@link liveConfigView},
+* the same path as `--from-branch`, so both agree on what the branch has.
+*
+* Anything short of a clear answer — no project to read, no credentials, a failed read, no
+* Data API on the branch — falls back to today's Neon Auth scaffold. The read must never make
+* `init` fail: a user without the Data API loses nothing, and one with it is told how to fix
+* the file by hand.
+*/
+const resolveInitDataApiChoice = async (props) => {
+	const { projectId } = props;
+	if (!projectId) return { kind: "neon" };
+	try {
+		const access = props.apiClient ? {
+			apiClient: props.apiClient,
+			apiKey: props.apiKey
+		} : await existingApiClient({
+			configDir: props.configDir ?? defaultDir,
+			apiHost: props.apiHost ?? "https://console.neon.tech/api/v2",
+			...props.profile !== void 0 ? { profile: props.profile } : {},
+			...props.oauthHost !== void 0 ? { oauthHost: props.oauthHost } : {},
+			...props.clientId !== void 0 ? { clientId: props.clientId } : {}
+		});
+		if (access === null) {
+			log.warning("Not signed in, so the Data API on the linked branch could not be read; declaring it with Neon Auth. If it verifies an external identity provider, set dataApi.authProvider to \"external\" in neon.ts before deploying.");
+			return { kind: "neon" };
+		}
+		const ref = await resolveBranchRef({
+			apiClient: access.apiClient,
+			projectId,
+			...props.branch !== void 0 ? { branch: props.branch } : {}
+		});
+		const { view } = await liveConfigView({
+			projectId,
+			branchId: ref.branchId,
+			...access.apiKey ? { apiKey: access.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		});
+		return view.dataApi === void 0 ? { kind: "neon" } : dataApiChoiceFromView(view.dataApi);
+	} catch (error) {
+		log.warning("Couldn't read the Data API on the linked branch (%s); declaring it with Neon Auth. If it verifies an external identity provider, set dataApi.authProvider to \"external\" in neon.ts before deploying.", error instanceof Error ? error.message : String(error));
+		return { kind: "neon" };
+	}
+};
 /** The install command to print, prefixed with a `cd` when the project is not the cwd. */
 const installCommandFrom = (dir, pm, missing, options) => {
 	const command = formatInstallCommand(pm, [...missing], options);
@@ -265,7 +315,8 @@ const initCmd = async (props) => {
 		}
 	} else {
 		const services = await resolveServices(props);
-		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
+		const dataApi = services.includes("data-api") ? await resolveInitDataApiChoice(props) : void 0;
+		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services, dataApi ? { dataApi } : {}));
 		if (!props.silent) {
 			if (services.length === 0) log.info("Created neon.ts with a starter policy.");
 			else {
@@ -273,6 +324,7 @@ const initCmd = async (props) => {
 				log.info("Created neon.ts declaring %s.", declared.join(", "));
 			}
 		}
+		if (dataApi?.kind === "external") log.info("The branch's Data API verifies an external identity provider%s, so neon.ts declares it with authProvider \"external\" and does not enable Neon Auth.", dataApi.providerName ? ` (${dataApi.providerName})` : "");
 		if (services.includes("functions")) scaffoldFunction(cwd);
 	}
 	await ensureConfigPackages(cwd, props);
@@ -445,7 +497,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 }), (args) => applyCmd(args)).command("add", "Add a service, function, or bucket to neon.ts (creates it if missing)", (yargs) => yargs.command("auth", "Enable Neon Auth (auth: true)", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "auth"
-}))).command("data-api", "Enable the Data API (dataApi: true) and Neon Auth, which the default provider requires", addSharedOptions, (args) => addCmd(addProps(args, {
+}))).command("data-api", "Enable the Data API (dataApi: true) and Neon Auth, which the default provider requires. For an external identity provider, set dataApi.authProvider to \"external\" instead", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "data-api"
 }))).command("ai-gateway", "Enable the AI Gateway (aiGateway: true)", addSharedOptions, (args) => addCmd(addProps(args, {
@@ -502,7 +554,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 		also: "postgres alone writes the starter policy; every branch has Postgres. Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
 	}),
 	"from-branch": {
-		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. The only mode of `config init` that calls the Neon API.",
+		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. Needs credentials and a project.",
 		type: "boolean",
 		conflicts: "services"
 	}
@@ -1109,5 +1161,4 @@ const createBranchFromPolicyOnCheckout = async (props) => {
 		throw err;
 	}
 };
-//#endregion
 export { missingDependencies as _, applyPolicyOnCreate as a, config_exports as c, ensureConfigPackages as d, envFlag as f, installCommandFrom as g, initCmd as h, applyFlags as i, createBranchFromPolicyOnCheckout as l, handler as m, addCmd as n, builder as o, envPullFlag as p, applyCmd as r, command as s, ConfigInstallFailed as t, describe as u, planCmd as v, status as y };

package/dist/_chunks/{connection_string-DB4awPzZ.js → connection_string-C9e7N4xk.js}

@@ -1,11 +1,11 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as defaultConnectionRole } from "./roles-C3M4q9DS.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
+import { n as defaultConnectionRole } from "./roles-Bd9r8_pX.js";
 import { writer } from "../writer.js";
 import { EndpointType } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
 import { psql } from "../utils/psql.js";
 import { parsePITBranch } from "../utils/point_in_time.js";
-//#region src/commands/connection_string.ts
+// src/commands/connection_string.ts
 var connection_string_exports = /* @__PURE__ */ __exportAll({
 	SSL_MODES: () => SSL_MODES,
 	aliases: () => aliases,
@@ -150,5 +150,4 @@ const handler = async (props) => {
 	] });
 	else process.stdout.write(connectionString.toString() + "\n");
 };
-//#endregion
 export { connection_string_exports as a, command as i, aliases as n, describe as o, builder as r, handler as s, SSL_MODES as t };

package/dist/_chunks/{credential_io-BS-0Pmwc.js → credential_io-DbeSh3Pl.js}

@@ -1,11 +1,11 @@
-import { t as writeSecretFile } from "./secure_file-BucZj4yQ.js";
-import { a as isOwnedCredentialPath } from "./paths-DMq0Lt7a.js";
-import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-DIB1av2Q.js";
+import { t as writeSecretFile } from "./secure_file-Caskdohg.js";
+import { a as isOwnedCredentialPath } from "./paths-B55ZfOg1.js";
+import { f as profilesFilePath, v as CRED_STORAGE_FILE, y as CRED_STORAGE_KEYRING } from "./profiles-DTazQtjK.js";
 import { tryLoadKeyring } from "../keyring.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { dirname } from "node:path";
 import { createHash } from "node:crypto";
-//#region ../../internals/cli-core/dist/credentials.js
+// ../../internals/cli-core/dist/credentials.js
 /**
 * # Stored credentials — one file per account, two kinds
 *
@@ -188,8 +188,7 @@ const isSameCredential = (existingKey, replacementKey) => {
 	const trimmed = existingKey.trim();
 	return trimmed !== "" && trimmed === replacementKey.trim();
 };
-//#endregion
-//#region ../../internals/cli-core/dist/credential_store.js
+// ../../internals/cli-core/dist/credential_store.js
 const KEYRING_SERVICE = "com.neon.neon-cli";
 /** Hashing the resolved profiles directory isolates config roots while keeping profile names visible. */
 const keyringAccount = (configDir, profile) => `cli:${createHash("sha256").update(dirname(profilesFilePath(configDir))).digest("hex")}:${profile}`;
@@ -411,8 +410,6 @@ const createCredentialStore = (dir, options = {}) => {
 		assertKeyringWritable
 	};
 };
-//#endregion
-//#region src/credential_io.ts
+// src/credential_io.ts
 const storeFor = (dir) => createCredentialStore(dir, { keyring: tryLoadKeyring() });
-//#endregion
 export { OAUTH as a, describeScope as c, scopeOf as d, API_KEY as i, interpretCredentials as l, KEYRING_SERVICE as n, apiKeyCredentials as o, keyringAccount as r, credentialLabel as s, storeFor as t, isSameCredential as u };

package/dist/_chunks/{credentials-BSjE9fRR.js → credentials-BMBNmW0t.js}

@@ -1,9 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody, retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/credentials.ts
+// src/commands/credentials.ts
 var credentials_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -142,5 +142,4 @@ const revoke = async (props) => {
 	await withCredentialNotFound(props.tokenId, branchId, () => retryOnLock(() => props.apiClient.revokeCredential(props.projectId, branchId, props.tokenId)));
 	log.info(`Credential ${props.tokenId} revoked`);
 };
-//#endregion
 export { credentials_exports as a, list as c, rotate as d, create as i, reveal as l, builder as n, describe as o, command as r, handler as s, aliases as t, revoke as u };

package/dist/_chunks/{data_api-Djxj5ZQD.js → data_api-CHDwvMTG.js}

@@ -1,10 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
 import { writer } from "../writer.js";
 import { branchIdFromProps, fillSingleProject, resolveSingleDatabase } from "../utils/enrichers.js";
-//#region src/commands/data_api.ts
+// src/commands/data_api.ts
 var data_api_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -259,5 +259,4 @@ const deleteDataApi = async (props) => {
 	}
 	log.info(`Data API deleted for ${database} on branch ${branchId}`);
 };
-//#endregion
 export { handler as a, describe as i, command as n, data_api_exports as r, builder as t };

package/dist/_chunks/{databases-Dok4wru7.js → databases-DC2h6IW2.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { retryOnLock } from "../api.js";
 import { writer } from "../writer.js";
 import { fillSingleProject, resolveBranchFromProps } from "../utils/enrichers.js";
-//#region src/commands/databases.ts
+// src/commands/databases.ts
 var databases_exports = /* @__PURE__ */ __exportAll({
 	DATABASE_FIELDS: () => DATABASE_FIELDS,
 	aliases: () => aliases,
@@ -80,5 +80,4 @@ const deleteDb = async (props) => {
 		humanTitle: `Database deleted from ${branch?.name ?? branchId}`
 	});
 };
-//#endregion
 export { create as a, describe as c, command as i, handler as l, aliases as n, databases_exports as o, builder as r, deleteDb as s, DATABASE_FIELDS as t, list as u };

package/dist/_chunks/{deploy-D7B0Xfjg.js → deploy-DmEEhux0.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BH_qRHiG.js";
+import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BjCm5cfr.js";
 import { DEPLOY_COMMANDS_EPILOGUE } from "../commands/deploy_help.js";
-//#region src/commands/deploy.ts
+// src/commands/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -29,5 +29,4 @@ const builder = (argv) => argv.usage("$0 deploy [options]").options({
 	...envPullFlag
 }).middleware(fillSingleProject).epilogue(DEPLOY_COMMANDS_EPILOGUE).strict();
 const handler = (props) => applyCmd(props);
-//#endregion
 export { handler as a, describe as i, command as n, deploy_exports as r, builder as t };