neon 8.13.2 → 8.15.0

package/dist/_chunks/{dev-CSvxAecE.js → dev-DlUJFzRs.js}

@@ -1,15 +1,15 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { defaultDevEnvFiles, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { l as functionBaseUrlKey } from "./env-BpP3Dqpe.js";
-import { branchIdResolve } from "../utils/enrichers.js";
-import { bundleEntry } from "../utils/esbuild.js";
-import { a as resolveDevEnv } from "./env-BNm69Qh8.js";
-import { f as envFlag } from "./config-BH_qRHiG.js";
+import { l as functionBaseUrlKey } from "./env-JgoSsmyt.js";
+import { a as resolveDevEnv } from "./env-CIFMBEon.js";
 import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/functions.js";
 import { resolveWatchInputs } from "../dev/inputs.js";
+import { branchIdResolve } from "../utils/enrichers.js";
+import { bundleEntry } from "../utils/esbuild.js";
+import { f as envFlag } from "./config-BjCm5cfr.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -18,7 +18,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { bundleAsIs, describeNativeFinding, findUndeclaredNativePackages, resolveEsbuildEntry } from "@neon/config-runtime";
 import { once } from "node:events";
 import { createServer } from "node:net";
-//#region src/commands/dev.ts
+// src/commands/dev.ts
 var dev_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	captureShellEnv: () => captureShellEnv,
@@ -941,5 +941,4 @@ const resolveRuntimePath = () => {
 	if (!existsSync(candidate)) throw new Error(`Could not locate the dev runtime at ${candidate}`);
 	return candidate;
 };
-//#endregion
 export { devBundleDir as a, diffUnits as c, handler as d, loadDevEnvFiles as f, sourceFunctionUrlOverlay as g, reportDevCredential as h, describe as i, formatEnvFiles as l, planFunctionsToUnits as m, captureShellEnv as n, devEnvContext as o, localFunctionUrlEnv as p, command as r, dev_exports as s, builder as t, formatEnvSummary as u };

package/dist/_chunks/{diff-DhxxbdQE.js → diff-dnxneH0u.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
@@ -6,7 +6,7 @@ import { looksLikeBranchId } from "../utils/formats.js";
 import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js";
 import { renderDatabaseSchemaDiff, renderSchemaDiffReport } from "../utils/git_diff.js";
 import chalk from "chalk";
-//#region src/commands/diff.ts
+// src/commands/diff.ts
 var diff_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -174,5 +174,4 @@ const writeStructured = (props, diffs) => {
 		"diff"
 	] });
 };
-//#endregion
 export { handler as a, diff_exports as i, command as n, describe as r, builder as t };

package/dist/_chunks/{docs-CrVybkTP.js → docs-CClmgj_Z.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { getCliAgent, isCi } from "../env.js";
 import pkg_default from "../pkg.js";
 import { isNetworkError } from "../errors.js";
@@ -6,7 +6,7 @@ import { resolveOutputWidth, stripAnsi, truncateTo } from "../human_table.js";
 import { writer } from "../writer.js";
 import { single } from "../utils/flags.js";
 import chalk from "chalk";
-//#region src/commands/docs.ts
+// src/commands/docs.ts
 var docs_exports = /* @__PURE__ */ __exportAll({
 	DEFAULT_SITE_SEARCH_URL: () => DEFAULT_SITE_SEARCH_URL,
 	MAX_LIMIT: () => 40,
@@ -193,5 +193,4 @@ function parseSearchHits(raw) {
 		};
 	});
 }
-//#endregion
 export { builder as a, docs_exports as c, resolveSiteSearchUrl as d, siteSearchHeaders as f, SITE_SEARCH_CATEGORIES as i, formatSearchResults as l, MAX_LIMIT as n, command as o, MAX_QUERY_LENGTH as r, describe as s, DEFAULT_SITE_SEARCH_URL as t, parseSearchHits as u };

package/dist/_chunks/{env-5HS5qQGd.js → env-BOt9AZ1j.js}

@@ -1,19 +1,19 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { ensureGitignored } from "../context.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
 import { getCliName } from "../utils/cli_name.js";
 import { deprecatedServiceMessage, parseServices, servicesFlagValue, servicesOption } from "../neon_services.js";
 import { mergeEnvFile, readEnvFile, resolveEnvFilePath } from "../env_file.js";
-import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-BpP3Dqpe.js";
+import { t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-JgoSsmyt.js";
 import { ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, ownedEnvServiceKeys, parseEnvPullKeys } from "../env_services.js";
+import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "./env-CIFMBEon.js";
 import { fillSingleProject, resolveBranchRef } from "../utils/enrichers.js";
 import { warnAiGateway } from "../utils/ai_gateway_notice.js";
-import { i as dropClaimableUnsupported, o as resolveNeonEnvVars } from "./env-BNm69Qh8.js";
 import { formatPulledEnv, pulledBranch } from "../commands/env_output.js";
 import { existsSync } from "node:fs";
 import chalk from "chalk";
-//#region src/commands/env.ts
+// src/commands/env.ts
 var env_exports = /* @__PURE__ */ __exportAll({
 	ENV_PULL_SKIPPED_HINT: () => ENV_PULL_SKIPPED_HINT,
 	autoPullEnvAfterPin: () => autoPullEnvAfterPin,
@@ -280,5 +280,4 @@ const pickNeonVars = (vars) => {
 	for (const [name, value] of Object.entries(vars)) if (NEON_VAR_NAMES.some((key) => key === name) || isFunctionBaseUrlKey(name)) out[name] = value;
 	return out;
 };
-//#endregion
 export { describe as a, pull as c, command as i, autoPullEnvAfterPin as n, env_exports as o, builder as r, handler as s, ENV_PULL_SKIPPED_HINT as t };

package/dist/_chunks/{env-BNm69Qh8.js → env-CIFMBEon.js}

@@ -2,14 +2,14 @@ import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { declaredNeonServices } from "../config_services.js";
 import { loadProjectConfig } from "../project.js";
-import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-BpP3Dqpe.js";
+import { a as defaultAiGatewayCredential, c as fetchEnvKeysState, d as isLiveCredential, h as toEntries, i as credentialName, l as functionBaseUrlKey, m as resolveBranchPolicy, n as createApiFromOptions, o as defaultStorageCredential, p as policyEnvKeys, r as credentialEnvKeys, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./env-JgoSsmyt.js";
 import { ENV_PULL_SERVICES, envKeysForSelection, serviceForEnvKey, servicesForEnvKeys } from "../env_services.js";
 import { formatInstallCommand, resolvePackageManager } from "../utils/package_manager.js";
 import { StagingOnlyError } from "../utils/staging.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, isPlatformError } from "@neon/config";
 import { credentialScopesSatisfied } from "@neon/config/v1";
 import { plan, pullConfig } from "@neon/config-runtime";
-//#region ../../internals/env-core/dist/reuse-secrets.js
+// ../../internals/env-core/dist/reuse-secrets.js
 /**
 * Resolve a branch's env while keeping secrets the caller already holds.
 *
@@ -198,8 +198,7 @@ function halfReusable(named, defaultMeta, requiredScopes) {
 	if (defaultMeta !== null) return named.tokenId === defaultMeta.tokenId;
 	return credentialScopesSatisfied(named.scopes, requiredScopes);
 }
-//#endregion
-//#region src/dev/env.ts
+// src/dev/env.ts
 /** The API-targeting options every runtime call forwards from the context. */
 const apiOptions = (ctx) => ({
 	...ctx.apiKey ? { apiKey: ctx.apiKey } : {},
@@ -764,5 +763,4 @@ const loadNeonConfig = async (ctx) => {
 		throw err;
 	}
 };
-//#endregion
 export { resolveDevEnv as a, dropClaimableUnsupported as i, MissingBranchContextError as n, resolveNeonEnvVars as o, ServiceNotOnBranchError as r, DevEnvMismatchError as t };

package/dist/_chunks/{env-BpP3Dqpe.js → env-JgoSsmyt.js}

@@ -1,6 +1,6 @@
-import { n as defaultConnectionRole, t as NEON_DEFAULT_OWNER_ROLE } from "./roles-C3M4q9DS.js";
+import { n as defaultConnectionRole, t as NEON_DEFAULT_OWNER_ROLE } from "./roles-Bd9r8_pX.js";
 import { ErrorCode, PlatformError, createNeonApiFromOptions, deriveCredentialScopes, isPlatformError, resolveConfig } from "@neon/config/v1";
-//#region ../../internals/env-core/dist/env.js
+// ../../internals/env-core/dist/env.js
 /**
 * The Neon env core — resolving a branch's env from the Neon API, and projecting it into
 * OS-level `{ KEY: value }` pairs.
@@ -651,5 +651,4 @@ function toEntries(env) {
 	if (env.functions) for (const slug of Object.keys(env.functions).sort()) put(functionBaseUrlKey(slug), env.functions[slug]?.baseUrl);
 	return out;
 }
-//#endregion
 export { defaultAiGatewayCredential as a, fetchEnvKeysState as c, isLiveCredential as d, parseFunctionBaseUrlKey as f, toEntries as h, credentialName as i, functionBaseUrlKey as l, resolveBranchPolicy as m, createApiFromOptions as n, defaultStorageCredential as o, policyEnvKeys as p, credentialEnvKeys as r, fetchEnvKeys as s, NEON_ENV_VAR_KEYS as t, isFunctionBaseUrlKey as u };

package/dist/_chunks/{feedback-CMayyTa8.js → feedback-mQmdTRFn.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isNetworkError } from "../errors.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
-//#region src/commands/feedback.ts
+// src/commands/feedback.ts
 var feedback_exports = /* @__PURE__ */ __exportAll({
 	DEFAULT_FEEDBACK_URL: () => DEFAULT_FEEDBACK_URL,
 	MAX_FEEDBACK_LENGTH: () => MAX_FEEDBACK_LENGTH,
@@ -84,5 +84,4 @@ async function sendFeedback(opts) {
 	}
 	if (!response.ok) throw new Error(await feedbackErrorMessage(response));
 }
-//#endregion
 export { describe as a, resolveFeedbackUrl as c, command as i, MAX_FEEDBACK_LENGTH as n, feedback_exports as o, builder as r, handler as s, DEFAULT_FEEDBACK_URL as t };

package/dist/_chunks/{functions-Q0zuvtnk.js → functions-3ypiRwZK.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError, retryOnLock } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
@@ -15,7 +15,7 @@ import { statSync } from "node:fs";
 import { dirname } from "node:path";
 import { FUNCTION_SOURCE_ENTRIES } from "@neon/config";
 import { bundleAsIs, describeNativeFinding, findUndeclaredNativePackages, resolveEsbuildEntry, zipFunctionBundle } from "@neon/config-runtime";
-//#region src/commands/functions.ts
+// src/commands/functions.ts
 var functions_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -460,5 +460,4 @@ const deleteDomain = async (props) => {
 	}
 	log.info(`Custom domain ${props.domain} deleted from branch ${branchId}`);
 };
-//#endregion
 export { describe as a, deploymentPollDelay as i, builder as n, functions_exports as o, command as r, handler as s, aliases as t };

package/dist/_chunks/{git-H32TNt6M.js → git-j6xSVo3e.js}

@@ -1,17 +1,17 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollowedGitHookSync, readContextFile, setGitBranchMap, setGitBranchMapping, setGitFollow } from "../context.js";
 import { writer } from "../writer.js";
 import { neonSafeBranchName } from "../utils/branch_name.js";
 import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
-import { o as quoteFlagValue } from "./link-BgtkOBws.js";
-import { o as handler$1 } from "./checkout-CXIOydqZ.js";
+import { o as quoteFlagValue } from "./link-nAiuWKfg.js";
+import { o as handler$1 } from "./checkout-BpOcFaAi.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";
 import prompts from "prompts";
-//#region src/commands/git.ts
+// src/commands/git.ts
 var git_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -352,5 +352,4 @@ const confirmPrune = async (props, toDelete) => {
 	});
 	return Boolean(ok);
 };
-//#endregion
 export { describe as a, install as c, sync as d, uninstall as f, command as i, partitionBranchesToPrune as l, builder as n, git_exports as o, cleanup as r, handler as s, aliases as t, status as u };

package/dist/_chunks/{init-BkA6RilG.js → init-CcVJb492.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { getCliName } from "../utils/cli_name.js";
 import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { NEON_SERVICES, servicesOption } from "../neon_services.js";
@@ -6,7 +6,7 @@ import { coerceAgentFlag } from "../utils/agent_flag.js";
 import { initPluginAgents, initSkillsMcpAgents } from "../init/plan.js";
 import { listSkillIds } from "../skills/catalog.js";
 import { runInit } from "../init/run.js";
-//#region src/commands/init.ts
+// src/commands/init.ts
 var init_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -53,7 +53,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	key: "services",
 	allowed: NEON_SERVICES,
 	describe: "Services to declare in neon.ts",
-	also: "postgres alone writes the starter policy; every branch has Postgres. Implies creating neon.ts. Cannot be combined with --no-config."
+	also: "postgres alone writes the starter policy; every branch has Postgres. data-api also declares auth unless the linked branch's Data API already uses an external identity provider. Implies creating neon.ts. Cannot be combined with --no-config."
 })).option("org-id", {
 	describe: "Forwarded to link: organization ID to link to",
 	type: "string"
@@ -107,5 +107,4 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 const handler = async (props) => {
 	await runInit(props);
 };
-//#endregion
 export { init_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{inspect-g0wekylj.js → inspect-yFAb61qo.js}

@@ -1,9 +1,9 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
 import { formatInspectQueryError, resolveInspectTargets, runInspectQuery } from "../utils/inspect_db.js";
 import { INSPECT_QUERIES } from "../utils/inspect_queries.js";
-//#region src/commands/inspect.ts
+// src/commands/inspect.ts
 var inspect_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -86,5 +86,4 @@ const builder = (argv) => argv.usage("$0 inspect <sub-command> [options]").comma
 const handler = (args) => {
 	return args;
 };
-//#endregion
 export { handler as a, describe as i, builder as n, inspect_exports as o, command as r, aliases as t };

package/dist/_chunks/{ip_allow-5lLFvIuE.js → ip_allow-DBdxNEUa.js}

@@ -1,10 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import { projectUpdateRequest } from "../parameters.gen.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/ip_allow.ts
+// src/commands/ip_allow.ts
 var ip_allow_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -102,5 +102,4 @@ const parse = (project) => {
 		protected_branches_only: project.settings?.allowed_ips?.protected_branches_only ?? false
 	};
 };
-//#endregion
 export { ip_allow_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{link-BgtkOBws.js → link-nAiuWKfg.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isInteractiveTerminal } from "../env.js";
 import { log } from "../log.js";
 import { isNeonApiError, messageFromBody } from "../api.js";
-import { r as defaultDir } from "./paths-DMq0Lt7a.js";
+import { r as defaultDir } from "./paths-B55ZfOg1.js";
 import "../config.js";
 import { applyContext, contextBranch, readContextFile, setContext, updateContextFile } from "../context.js";
 import { isClaimableEnvTarget } from "../claimable/state.js";
@@ -13,12 +13,12 @@ import { writer } from "../writer.js";
 import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js";
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
-import { n as autoPullEnvAfterPin } from "./env-5HS5qQGd.js";
-import { h as initCmd } from "./config-BH_qRHiG.js";
+import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
+import { h as initCmd } from "./config-BjCm5cfr.js";
 import { formatLinkSummary } from "../commands/link_output.js";
-import { r as REGIONS } from "./projects-BwI2Uo0z.js";
+import { r as REGIONS } from "./projects-a3X4OFEJ.js";
 import prompts from "prompts";
-//#region src/commands/link.ts
+// src/commands/link.ts
 var link_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -932,5 +932,4 @@ const mustString = (value, name) => {
 	if (value === void 0) throw new Error(`Internal error: expected ${name} to be set.`);
 	return value;
 };
-//#endregion
 export { link_exports as a, shouldOfferConfigInit as c, handler as i, command as n, quoteFlagValue as o, describe as r, runLink as s, builder as t };

package/dist/_chunks/{logs-DWkpjzIH.js → logs-BB4uvblR.js}

@@ -1,10 +1,10 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { branchIdFromProps, fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/logs.ts
+// src/commands/logs.ts
 var logs_exports = /* @__PURE__ */ __exportAll({
 	assertReachableLogsPage: () => assertReachableLogsPage,
 	buildLogsQueryBody: () => buildLogsQueryBody,
@@ -287,5 +287,4 @@ const fieldValues = async (props) => {
 	});
 	if (data.is_truncated) log.info(`More values exist than were returned for "${escapeLogSingleLine(props.field)}". Narrow the window with --since or --start-time, restrict --source, or raise --limit, then run it again.`);
 };
-//#endregion
 export { describe as a, handler as c, command as i, logs_exports as l, buildLogsQueryBody as n, escapeLogSingleLine as o, builder as r, escapeLogTableCell as s, assertReachableLogsPage as t };

package/dist/_chunks/{mcp-Bo-7TKc7.js → mcp-BznTRK3w.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { readContextFile } from "../context.js";
 import { recordCommandSuccessExtras } from "../analytics.js";
@@ -12,7 +12,7 @@ import { AGENT_MCP_SKIP_MESSAGE } from "../init/copy.js";
 import { mintMcpApiKey, mintedKeyRevokeCommand, withdrawMintedKey } from "../mcp/mint.js";
 import { canPickAgentsInteractively, skippableAgentPicker } from "../utils/agent_picker.js";
 import { resolveMcpPlan } from "../mcp/plan.js";
-//#region src/commands/mcp.ts
+// src/commands/mcp.ts
 var mcp_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => "mcp",
@@ -249,5 +249,4 @@ const handler = async (props) => {
 	if (error) throw error;
 	recordCommandSuccessExtras({ scope: outcome.scope });
 };
-//#endregion
 export { mcpInstallError as a, setupNeonMcp as c, handler as i, command as n, mcp_exports as o, describe as r, reportMcpInstall as s, builder as t };

package/dist/_chunks/{neon_auth-DpF83S24.js → neon_auth-Dw-ucM5Y.js}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { codeFromBody, isNeonApiError, retryOnLock } from "../api.js";
 import { stripAnsi } from "../human_table.js";
@@ -6,8 +6,9 @@ import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { NeonAuthEmailVerificationMethod, NeonAuthOauthProviderId, NeonAuthOauthProviderType, NeonAuthSupportedAuthProvider } from "../utils/api_enums.js";
 import { branchIdFromProps, fillSingleProject, resolveBranchFromProps } from "../utils/enrichers.js";
+import { readFileSync } from "node:fs";
 import chalk from "chalk";
-//#region src/commands/neon_auth.ts
+// src/commands/neon_auth.ts
 var neon_auth_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -45,17 +46,53 @@ const INTEGRATION_STATUS_FIELDS = [
 	"created_at",
 	"jwks_url"
 ];
-const OAUTH_PROVIDER_FIELDS = [
+const OAUTH_PROVIDER_LIST_FIELDS = [
 	"id",
 	"type",
 	"client_id"
 ];
+const OAUTH_PROVIDER_FIELDS = [
+	...OAUTH_PROVIDER_LIST_FIELDS,
+	"microsoft_tenant_id",
+	"apple_team_id",
+	"apple_key_id"
+];
 const ALLOW_LOCALHOST_FIELDS = ["allow_localhost"];
 const SUPPORTED_OAUTH_PROVIDERS = [
 	NeonAuthOauthProviderId.Google,
 	NeonAuthOauthProviderId.Github,
-	NeonAuthOauthProviderId.Vercel
+	NeonAuthOauthProviderId.Vercel,
+	NeonAuthOauthProviderId.Microsoft,
+	NeonAuthOauthProviderId.Apple
 ];
+const OWN_CREDENTIALS_NOTE = `${[NeonAuthOauthProviderId.Microsoft, NeonAuthOauthProviderId.Apple].join(" and ")} always need your own credentials`;
+const OAUTH_CREDENTIAL_OPTIONS = {
+	"oauth-client-id": {
+		describe: `OAuth client ID from your provider app. For apple, the Services ID. Omit to use Neon's shared OAuth app, where one exists; ${OWN_CREDENTIALS_NOTE}.`,
+		type: "string"
+	},
+	"oauth-client-secret": {
+		describe: `OAuth client secret from your provider app. Omit to use Neon's shared OAuth app, where one exists; ${OWN_CREDENTIALS_NOTE}.`,
+		type: "string"
+	},
+	"oauth-client-secret-file": {
+		describe: "Read the OAuth client secret from a file, for example the apple .p8 private key",
+		type: "string",
+		conflicts: "oauth-client-secret"
+	},
+	"microsoft-tenant-id": {
+		describe: "Tenant ID for the microsoft provider: common, organizations, consumers, a tenant GUID, or a domain",
+		type: "string"
+	},
+	"apple-team-id": {
+		describe: "Apple Developer Team ID (apple only)",
+		type: "string"
+	},
+	"apple-key-id": {
+		describe: "Key ID of the Sign in with Apple private key (apple only). Sent together with a new apple client secret, and only with one",
+		type: "string"
+	}
+};
 const DOMAIN_FIELDS = ["domain"];
 const EMAIL_PASSWORD_FIELDS = [
 	"enabled",
@@ -139,14 +176,7 @@ const builder = (argv) => {
 				choices: SUPPORTED_OAUTH_PROVIDERS,
 				demandOption: true
 			},
-			"oauth-client-id": {
-				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			},
-			"oauth-client-secret": {
-				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			}
+			...OAUTH_CREDENTIAL_OPTIONS
 		}), async (args) => {
 			await oauthProviderAdd(args);
 		}).command("update", "Update an OAuth provider", (yargs) => yargs.options({
@@ -156,14 +186,7 @@ const builder = (argv) => {
 				choices: SUPPORTED_OAUTH_PROVIDERS,
 				demandOption: true
 			},
-			"oauth-client-id": {
-				describe: "OAuth client ID from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			},
-			"oauth-client-secret": {
-				describe: "OAuth client secret from your provider app. Omit to use Neon's shared OAuth app.",
-				type: "string"
-			}
+			...OAUTH_CREDENTIAL_OPTIONS
 		}), async (args) => {
 			await oauthProviderUpdate(args);
 		}).command("delete", "Delete an OAuth provider", (yargs) => yargs.options({ "provider-id": {
@@ -605,10 +628,37 @@ const oauthProviderList = async (props) => {
 		printMessage("No OAuth providers are configured for this branch.");
 		return;
 	}
-	writer(props).end(data.providers, { fields: OAUTH_PROVIDER_FIELDS });
+	writer(props).end(data.providers, { fields: OAUTH_PROVIDER_LIST_FIELDS });
 	if (data.providers.some((p) => p.type === NeonAuthOauthProviderType.Shared) && props.output === "table") writeStyled(`\n${chalk.yellow("Caution:")} ${SHARED_PROVIDER_DISCLAIMER}\n\n`);
 };
+const resolveClientSecret = (props) => {
+	const file = props.oauthClientSecretFile;
+	if (file === void 0) return props.oauthClientSecret;
+	let contents;
+	try {
+		contents = readFileSync(file, "utf8");
+	} catch (err) {
+		throw new Error(`Could not read --oauth-client-secret-file ${file}: ${err.message}`);
+	}
+	const secret = contents.replace(/[\r\n]+$/, "");
+	if (!secret) throw new Error(`--oauth-client-secret-file ${file} is empty.`);
+	return secret;
+};
+const sharedProviderRejectedMessage = (providerId) => {
+	let flags;
+	switch (providerId) {
+		case NeonAuthOauthProviderId.Apple:
+			flags = "--oauth-client-id <Services ID>, --oauth-client-secret-file <.p8>, --apple-team-id and --apple-key-id";
+			break;
+		case NeonAuthOauthProviderId.Microsoft:
+			flags = "--oauth-client-id and --oauth-client-secret (and optionally --microsoft-tenant-id)";
+			break;
+		default: flags = "--oauth-client-id and --oauth-client-secret";
+	}
+	return `The "${providerId}" provider requires your own OAuth app credentials.\nRe-run with ${flags} to provide them.\nCreate an OAuth app at your provider and use those credentials.`;
+};
 const oauthProviderAdd = async (props) => {
+	const clientSecret = resolveClientSecret(props);
 	const branchId = await resolveBranch(props);
 	const baseUrlRequest = callbackBaseUrl(props, branchId, props.providerId);
 	let data;
@@ -616,38 +666,55 @@ const oauthProviderAdd = async (props) => {
 		({data} = await props.apiClient.addBranchNeonAuthOauthProvider(props.projectId, branchId, {
 			id: props.providerId,
 			client_id: props.oauthClientId,
-			client_secret: props.oauthClientSecret
+			client_secret: clientSecret,
+			microsoft_tenant_id: props.microsoftTenantId,
+			apple_team_id: props.appleTeamId,
+			apple_key_id: props.appleKeyId
 		}));
 	} catch (err) {
-		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
+		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(sharedProviderRejectedMessage(props.providerId));
 		throw err;
 	}
 	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
 	else printKvBlock("OAuth provider added", [
 		["ID:", data.id],
 		["Type:", data.type],
-		...data.client_id ? [["Client ID:", data.client_id]] : []
+		...data.client_id ? [["Client ID:", data.client_id]] : [],
+		...data.microsoft_tenant_id ? [["Tenant ID:", data.microsoft_tenant_id]] : [],
+		...data.apple_team_id ? [["Team ID:", data.apple_team_id]] : [],
+		...data.apple_key_id ? [["Key ID:", data.apple_key_id]] : []
 	]);
 	printCallbackInstructions(props.providerId, await baseUrlRequest);
 };
 const oauthProviderUpdate = async (props) => {
+	const clientSecret = resolveClientSecret(props);
+	if (props.providerId === NeonAuthOauthProviderId.Apple) {
+		if (clientSecret !== void 0 && !props.appleKeyId) throw new Error("Changing the apple client secret requires --apple-key-id, the Key ID of the new private key.");
+		if (props.appleKeyId !== void 0 && clientSecret === void 0) throw new Error("--apple-key-id identifies the new private key, so it requires --oauth-client-secret or --oauth-client-secret-file.");
+	}
 	const branchId = await resolveBranch(props);
 	const baseUrlRequest = callbackBaseUrl(props, branchId, props.providerId);
 	let data;
 	try {
 		({data} = await props.apiClient.updateBranchNeonAuthOauthProvider(props.projectId, branchId, props.providerId, {
 			client_id: props.oauthClientId,
-			client_secret: props.oauthClientSecret
+			client_secret: clientSecret,
+			microsoft_tenant_id: props.microsoftTenantId,
+			apple_team_id: props.appleTeamId,
+			apple_key_id: props.appleKeyId
 		}));
 	} catch (err) {
-		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(`The "${props.providerId}" provider requires your own OAuth app credentials.\nRe-run with --oauth-client-id and --oauth-client-secret to provide them.\nCreate an OAuth app at your provider and use those credentials.`);
+		if (isNeonApiError(err) && codeFromBody(err.data) === "INVALID_SHARED_OAUTH_PROVIDER") throw new Error(sharedProviderRejectedMessage(props.providerId));
 		throw err;
 	}
 	if (props.output === "json" || props.output === "yaml") writer(props).end(data, { fields: OAUTH_PROVIDER_FIELDS });
 	else printKvBlock("OAuth provider updated", [
 		["ID:", data.id],
 		["Type:", data.type],
-		...data.client_id ? [["Client ID:", data.client_id]] : []
+		...data.client_id ? [["Client ID:", data.client_id]] : [],
+		...data.microsoft_tenant_id ? [["Tenant ID:", data.microsoft_tenant_id]] : [],
+		...data.apple_team_id ? [["Team ID:", data.apple_team_id]] : [],
+		...data.apple_key_id ? [["Key ID:", data.apple_key_id]] : []
 	]);
 	printCallbackInstructions(props.providerId, await baseUrlRequest);
 };
@@ -660,6 +727,14 @@ const CALLBACK_INSTRUCTIONS = {
 		lead: "Create a Vercel App in your Vercel Dashboard and add the following authorization callback URL:",
 		urlLabel: "callback/vercel"
 	},
+	microsoft: {
+		lead: "Register an application in Microsoft Entra ID > App registrations, and add the following redirect URI under the Web platform:",
+		urlLabel: "callback/microsoft"
+	},
+	apple: {
+		lead: "Create a Services ID in the Apple Developer portal, enable Sign in with Apple for it, and add the following return URL (Apple requires HTTPS and does not accept localhost):",
+		urlLabel: "callback/apple"
+	},
 	google: {
 		lead: "Get Google credentials by creating an OAuth client in Google Cloud Console > Credentials, and add the following authorized redirect URL:",
 		urlLabel: "callback/google"
@@ -1256,5 +1331,4 @@ const userSetRole = async (props) => {
 	const { data } = await props.apiClient.updateNeonAuthUserRole(props.projectId, branchId, props.userId, { roles: props.roles });
 	printKvBlock("Roles updated", [["User ID:", data.id], ["Roles:", props.roles.join(", ")]]);
 };
-//#endregion
 export { neon_auth_exports as a, handler as i, command as n, describe as r, builder as t };

package/dist/_chunks/{open-CX3BT3Tp.js → open-T2nI89Oh.js}

@@ -1,8 +1,8 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { log } from "../log.js";
 import { getCliName } from "../utils/cli_name.js";
 import open from "open";
-//#region src/commands/open.ts
+// src/commands/open.ts
 var open_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,
 	command: () => command,
@@ -29,5 +29,4 @@ const handler = async (props) => {
 		});
 	});
 };
-//#endregion
 export { open_exports as a, handler as i, command as n, projectConsoleUrl as o, describe as r, builder as t };

package/dist/_chunks/{operations-D4I-AxVs.js → operations-CzaR_uqx.js}

@@ -1,7 +1,7 @@
-import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { writer } from "../writer.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-//#region src/commands/operations.ts
+// src/commands/operations.ts
 var operations_exports = /* @__PURE__ */ __exportAll({
 	aliases: () => aliases,
 	builder: () => builder,
@@ -33,5 +33,4 @@ const list = async (props) => {
 	});
 	writer(props).end(data.operations, { fields: OPERATIONS_FIELDS });
 };
-//#endregion
 export { handler as a, describe as i, builder as n, list as o, command as r, operations_exports as s, aliases as t };