neon 8.13.2 → 8.15.0

package/dist/config_template.js

@@ -1,5 +1,5 @@
 import { NEON_SERVICES, parseServices } from "./neon_services.js";
-//#region src/config_template.ts
+// src/config_template.ts
 /**
 * The published npm packages a `neon.ts` project needs — the `@neon/*` org names.
 *
@@ -18,8 +18,9 @@ const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 * from these names to the `neon.ts` fields (`aiGateway`, `functions`, `buckets`, `dataApi`).
 *
 * Postgres is absent because every branch has it, so there is nothing to declare. Selecting
-* `data-api` also writes `auth: true`: the default Data API provider requires Neon Auth, and
-* `defineConfig` type-errors the file without it.
+* `data-api` also writes `auth: true` unless the caller says the Data API verifies an external
+* provider (see {@link DataApiTemplateChoice}): the default Data API provider requires Neon
+* Auth, and `defineConfig` type-errors the file without it.
 */
 const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres");
 /**
@@ -64,18 +65,44 @@ const renderGaServices = (services) => {
 	if (lines.length === 0) return "";
 	return `${lines.join("\n")}\n`;
 };
+/** The template choice for a view's `dataApi` entry (`config status` / `--from-branch`). */
+const dataApiChoiceFromView = (dataApi) => {
+	if (dataApi === true) return { kind: "neon" };
+	const { authProvider: _provider, ...wiring } = dataApi;
+	return {
+		kind: "external",
+		...wiring
+	};
+};
+/**
+* The `dataApi` entry, ending in a newline. The external form carries whatever wiring is
+* known; without a JWKS URL it still type-checks (the URL is optional) and still declares the
+* Data API, so a comment says where the URL lives rather than inventing one.
+*/
+const renderDataApiEntry = (choice) => {
+	if (choice.kind === "neon") return `${at(1, "dataApi: true,").join("\n")}\n`;
+	const fields = at(2, `authProvider: "external",`);
+	if (choice.jwksUrl === void 0) fields.push(...at(2, "// The JWKS URL is registered on the project; add `jwksUrl` to declare it here too."));
+	else fields.push(...at(2, `jwksUrl: ${renderScalar(choice.jwksUrl)},`));
+	if (choice.providerName !== void 0) fields.push(...at(2, `providerName: ${renderScalar(choice.providerName)},`));
+	if (choice.jwtAudience !== void 0) fields.push(...at(2, `jwtAudience: ${renderScalar(choice.jwtAudience)},`));
+	return `${block(1, "dataApi", fields).join("\n")}\n`;
+};
 /**
 * Render the `neon.ts` policy `config init` writes. With no services this is the starter
 * policy — an explicit `auth: false`, no service keys beyond that, and a `branch` closure that gives
 * new non-default branches a 7-day TTL — so the picker's "skip everything" answer and a
 * non-interactive run produce the identical file.
 *
-* `data-api` writes `dataApi: true` and forces `auth: true`. The default provider is Neon
-* Auth; omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
+* `data-api` writes `dataApi: true` and forces `auth: true` unless `options.dataApi` says the
+* branch's Data API verifies an external provider. The default provider is Neon Auth;
+* omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
 */
-const renderNeonConfig = (services) => {
-	const auth = services.includes("auth") || services.includes("data-api");
-	const dataApi = services.includes("data-api") ? "  dataApi: true,\n" : "";
+const renderNeonConfig = (services, options = {}) => {
+	const dataApiChoice = options.dataApi ?? { kind: "neon" };
+	const declaresDataApi = services.includes("data-api");
+	const auth = services.includes("auth") || declaresDataApi && dataApiChoice.kind !== "external";
+	const dataApi = declaresDataApi ? renderDataApiEntry(dataApiChoice) : "";
 	const realtimeDeclaration = services.includes("realtime") ? "  preview: {\n    realtime: true,\n  },\n" : "";
 	return `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
 
@@ -154,7 +181,7 @@ const renderSeededGaServices = (view, branchName) => {
 * than an empty `defineConfig({})`: seeding found nothing, and the caller says so.
 */
 const renderNeonConfigFromView = (view, branchName) => {
-	const services = [view.auth ? "  auth: true," : "", view.dataApi ? "  dataApi: true," : ""].filter((line) => line !== "");
+	const services = [view.auth ? "  auth: true," : "", view.dataApi ? renderDataApiEntry(dataApiChoiceFromView(view.dataApi)).trimEnd() : ""].filter((line) => line !== "");
 	const gaServices = renderSeededGaServices(view, branchName);
 	const branch = renderSeededBranch(view);
 	if (services.length === 0 && gaServices === "" && branch === "") return {
@@ -202,5 +229,4 @@ const renderFunctionSource = (slug, language) => {
 `;
 };
 const FUNCTION_TEMPLATE = renderFunctionSource(FUNCTION_SLUG, "ts");
-//#endregion
-export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };
+export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, dataApiChoiceFromView, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };

package/dist/context.js

@@ -2,7 +2,7 @@ import { log } from "./log.js";
 import { accessSync, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, normalize, resolve } from "node:path";
 import { homedir } from "node:os";
-//#region src/context.ts
+// src/context.ts
 /**
 * The branch pinned in a context, reading the current `branch` field and
 * falling back to the legacy `branchId` so pre-migration `.neon` files keep
@@ -359,5 +359,4 @@ const globToRegExp = (pattern) => {
 	const source = pattern.replace(/[.+^${}()|\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]");
 	return new RegExp(`^${source}$`);
 };
-//#endregion
 export { CONTEXT_FILE, applyContext, contextBranch, currentContextFile, enrichFromContext, ensureDirectoryGitignored, ensureGitignored, gitBranchMap, gitBranchMapping, isApiKeysCommand, isAskCommand, isClaimCommand, isConfigAdd, isConfigInit, isCurrentBranchProbe, isDocsCommand, isFeedbackCommand, isFunctionsTemplateCommand, isGitLocalCommand, isInspectDbUrl, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, isUnfollowedGitHookSync, readContextFile, setContext, setGitBranchMap, setGitBranchMapping, setGitFollow, updateContextFile, walkContextFile };

package/dist/credential_io.js

@@ -1 +1 @@
-export { t as storeFor } from "./_chunks/credential_io-BS-0Pmwc.js";
+export { t as storeFor } from "./_chunks/credential_io-DbeSh3Pl.js";

package/dist/current_branch_fast_path.js

@@ -1,7 +1,7 @@
 import { log } from "./log.js";
 import { contextBranch, currentContextFile, readContextFile } from "./context.js";
 import { getCliName } from "./utils/cli_name.js";
-//#region src/current_branch_fast_path.ts
+// src/current_branch_fast_path.ts
 /**
 * Offline fast path for `(config) status --current-branch` (used by shell prompts).
 *
@@ -43,5 +43,4 @@ const isExactCurrentBranchInvocation = (args) => {
 	const rest = args[0] === "status" ? args.slice(1) : args[0] === "config" && args[1] === "status" ? args.slice(2) : null;
 	return rest !== null && rest.length === 1 && rest[0] === "--current-branch";
 };
-//#endregion
 export { tryCurrentBranchFastPath };

package/dist/custom_domains_api.js

@@ -1,4 +1,4 @@
-//#region src/custom_domains_api.ts
+// src/custom_domains_api.ts
 const customDomainsPath = (projectId, branchId) => `/projects/${encodeURIComponent(projectId)}/branches/${encodeURIComponent(branchId)}/custom-domains`;
 const listCustomDomains = async (apiClient, projectId, branchId, { cursor, limit } = {}) => {
 	const { data } = await apiClient.request({
@@ -33,5 +33,4 @@ const deleteCustomDomain = async (apiClient, projectId, branchId, domain) => {
 		secure: true
 	});
 };
-//#endregion
 export { deleteCustomDomain, listCustomDomains, registerCustomDomain };

package/dist/dev/env.js

@@ -1 +1 @@
-export { t as DevEnvMismatchError, n as MissingBranchContextError, r as ServiceNotOnBranchError, i as dropClaimableUnsupported, a as resolveDevEnv, o as resolveNeonEnvVars } from "../_chunks/env-BNm69Qh8.js";
+export { t as DevEnvMismatchError, n as MissingBranchContextError, r as ServiceNotOnBranchError, i as dropClaimableUnsupported, a as resolveDevEnv, o as resolveNeonEnvVars } from "../_chunks/env-CIFMBEon.js";

package/dist/dev/functions.js

@@ -2,7 +2,7 @@ import { loadProjectConfig } from "../project.js";
 import { existsSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { resolveConfig } from "@neon/config";
-//#region src/dev/functions.ts
+// src/dev/functions.ts
 /**
 * Load `neon.ts` (if any) and resolve the list of functions it declares into
 * {@link PlannedFunction}s for `neon dev` to serve. Returns `null` when there is no
@@ -81,5 +81,4 @@ const loadNeonConfig = async (cwd, contextFile) => {
 		throw err;
 	}
 };
-//#endregion
 export { findConfigFunctionBySource, resolveFunctionsFromConfig };

package/dist/dev/inputs.js

@@ -1,5 +1,5 @@
 import { resolve } from "node:path";
-//#region src/dev/inputs.ts
+// src/dev/inputs.ts
 const defaultDeps = {
 	isPackaged: () => process.pkg !== void 0,
 	loadEsbuild: (name) => import(name)
@@ -47,5 +47,4 @@ const resolveWatchInputs = async (source, deps = defaultDeps) => {
 	if (!inputs) return null;
 	return Object.keys(inputs).map((p) => resolve(process.cwd(), p));
 };
-//#endregion
 export { resolveWatchInputs };

package/dist/dev/runtime.js

@@ -3,7 +3,7 @@ import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createServer } from "node:http";
 import { getRequestListener } from "@hono/node-server";
-//#region src/dev/runtime.ts
+// src/dev/runtime.ts
 const isFunction = (value) => typeof value === "function";
 const hasFetchMethod = (value) => typeof value === "object" && value !== null && "fetch" in value && typeof value.fetch === "function";
 /**
@@ -165,5 +165,4 @@ if (isDirectExecution()) {
 		process.exit(1);
 	});
 }
-//#endregion
 export { portSelectionFromEnv, resolveFetchHandler, resolveUpgradeHandler, startRuntime, withErrorBoundary };

package/dist/dev/websocket.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-//#region src/dev/websocket.ts
+// src/dev/websocket.ts
 /**
 * WebSocket support for the `neon dev` server.
 *
@@ -834,5 +834,4 @@ const protocolError = (code, message) => {
 	err.wsCode = code;
 	return err;
 };
-//#endregion
 export { CloseEventCtor, acceptKey, createUpgradeListener, installWebSocketBridge, isWebSocketHandshake, upgradeWebSocket, validateHandshake, writeUpgradeRejection };

package/dist/env.js

@@ -1,4 +1,4 @@
-//#region src/env.ts
+// src/env.ts
 const isCi = () => {
 	return process.env.CI !== "false" && Boolean(process.env.CI);
 };
@@ -38,5 +38,4 @@ const getGithubEnvVars = (env) => {
 	});
 	return Object.fromEntries(map);
 };
-//#endregion
 export { getCliAgent, getGithubEnvVars, isCi, isDebug, isInteractiveTerminal };

package/dist/env_file.js

@@ -1,7 +1,7 @@
 import { projectDir } from "./project.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-//#region src/env_file.ts
+// src/env_file.ts
 /**
 * Default dotenv file `env pull` writes to: `.env` when one already exists in the project
 * directory (update where secrets already live), otherwise `.env.local` — matching the
@@ -152,5 +152,4 @@ const trimTrailingBlank = (lines) => {
 	while (out.length > 0 && out[out.length - 1]?.trim() === "") out.pop();
 	return out;
 };
-//#endregion
 export { defaultDevEnvFiles, loadEnvFileIntoProcess, mergeEnvContent, mergeEnvFile, readEnvFile, resolveEnvFilePath };

package/dist/env_services.js

@@ -1,6 +1,6 @@
 import { NEON_SERVICES } from "./neon_services.js";
-import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-BpP3Dqpe.js";
-//#region src/env_services.ts
+import { f as parseFunctionBaseUrlKey, t as NEON_ENV_VAR_KEYS, u as isFunctionBaseUrlKey } from "./_chunks/env-JgoSsmyt.js";
+// src/env_services.ts
 const ENV_PULL_SERVICES = NEON_SERVICES;
 const ENV_PULL_KEYS = [
 	...Object.values(NEON_ENV_VAR_KEYS.postgres),
@@ -121,5 +121,4 @@ const editDistance = (left, right) => {
 };
 /** Narrow yargs' array option value without accepting any other runtime shape. */
 const envPullFlagValue = (value) => Array.isArray(value) ? value.map(String) : void 0;
-//#endregion
 export { BRANCH_ENV_KEY, ENV_PULL_KEYS, ENV_PULL_KEY_HELP, ENV_PULL_SERVICES, envKeysForSelection, envPullFlagValue, envServiceKeys, ownedEnvServiceKeys, parseEnvPullKeys, serviceForEnvKey, servicesForEnvKeys };