neon 8.14.0 → 8.15.0

package/README.md

@@ -673,7 +673,7 @@ export default defineConfig({
 
 ### Getting a `neon.ts` (`config init`)
 
-`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is purely local — no auth, no API calls. In an interactive terminal it asks which services the policy should declare:
+`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is local — no auth and no API calls — except `--services data-api`, which reads the linked branch's Data API with a credential already on hand (never a login) so the scaffold declares the right auth. In an interactive terminal it asks which services the policy should declare:
 
 ```
 ? Which Neon services should neon.ts declare? (space to toggle, enter to confirm) ›

package/dist/_chunks/{auth-DPSDYYtG.js → auth-rup6nemJ.js}

@@ -28,6 +28,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	deleteCredentialsAt: () => deleteCredentialsAt,
 	describe: () => describe,
 	ensureAuth: () => ensureAuth,
+	existingApiClient: () => existingApiClient,
 	handler: () => handler,
 	isAccessTokenUsable: () => isAccessTokenUsable,
 	locationForAuth: () => locationForAuth,
@@ -288,6 +289,42 @@ const usableCredential = async (props, at) => {
 		return null;
 	}
 };
+/**
+* The API client for a credential this invocation already holds — the `--api-key` flag or
+* `NEON_API_KEY`, or the selected profile's stored key or OAuth session, refreshed when
+* expired — along with the key it uses. Never starts a login, so a read that only enriches a
+* local file cannot interrupt it. Null when there is no such credential.
+*
+* Selection follows {@link ensureAuth} exactly; only the fallback differs. `ensureAuth` may
+* log in, and a caller that is only reading a branch to improve a scaffold must not.
+*/
+const existingApiClient = async (props) => {
+	const selection = selectCredential({
+		...credentialInputs(),
+		profileFlag: props.profile
+	});
+	if (selection.source !== "profile") return {
+		apiKey: selection.apiKey,
+		apiClient: getApiClient({
+			apiKey: selection.apiKey,
+			apiHost: props.apiHost
+		})
+	};
+	const usable = await usableCredential({
+		configDir: props.configDir,
+		apiHost: props.apiHost,
+		oauthHost: props.oauthHost ?? process.env.NEON_OAUTH_HOST ?? "https://oauth2.neon.tech",
+		clientId: props.clientId ?? "neonctl"
+	}, locationForAuth(props.configDir, selection.profile));
+	if (usable === null) return null;
+	return {
+		apiKey: usable.apiKey,
+		apiClient: getApiClient({
+			apiKey: usable.apiKey,
+			apiHost: props.apiHost
+		})
+	};
+};
 const ensureAuth = async (props) => {
 	if (props._.length === 0 || props.help) return;
 	if (isCurrentBranchProbe(props)) return;
@@ -491,4 +528,4 @@ const deleteCredentialsAt = (at, configDir) => {
 	}
 };
 const md5hash = (s) => createHash("md5").update(s).digest("hex");
-export { command as a, ensureAuth as c, locationForAuth as d, refreshStoredCredentials as f, builder as i, handler as l, authFlow as n, deleteCredentialsAt as o, usableCredential as p, auth_exports as r, describe as s, aliases as t, isAccessTokenUsable as u };
+export { command as a, ensureAuth as c, isAccessTokenUsable as d, locationForAuth as f, builder as i, existingApiClient as l, usableCredential as m, authFlow as n, deleteCredentialsAt as o, refreshStoredCredentials as p, auth_exports as r, describe as s, aliases as t, handler as u };

package/dist/_chunks/{checkout-C6VMMgY6.js → checkout-BpOcFaAi.js}

@@ -12,8 +12,8 @@ import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js
 import { buildCheckoutEvent, readGitContext } from "../utils/git.js";
 import { buildHookBranch, loadHookConfig, resolveHookEnv, runCheckoutAfterHook, runCheckoutBeforeHook, runCreateAfterHook, runCreateBeforeHook } from "../utils/hooks.js";
 import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
-import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-7SIE_C5O.js";
-import { i as handler$1 } from "./link-CcwTXRny.js";
+import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BjCm5cfr.js";
+import { i as handler$1 } from "./link-nAiuWKfg.js";
 import chalk from "chalk";
 import prompts from "prompts";
 // src/commands/checkout.ts

package/dist/_chunks/{config-7SIE_C5O.js → config-BjCm5cfr.js}

@@ -2,10 +2,13 @@ import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi, isInteractiveTerminal } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
+import { r as defaultDir } from "./paths-B55ZfOg1.js";
+import "../config.js";
 import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
+import { l as existingApiClient } from "./auth-rup6nemJ.js";
 import { NEON_SERVICES, NEON_SERVICE_LABELS, deprecatedServiceMessage, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
+import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, dataApiChoiceFromView, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { TYPESCRIPT_EXTENSION, asRelativeModulePath, editNeonConfig } from "../config_edit.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
@@ -208,6 +211,53 @@ const seedFromBranch = async (props) => {
 		branchName: live.branch.name
 	};
 };
+/**
+* Which `dataApi` entry to scaffold for `data-api`. A linked branch whose Data API already
+* verifies an external IdP gets the external form, so the policy does not go on to enable
+* Neon Auth over it on the first `neon deploy`. The read goes through {@link liveConfigView},
+* the same path as `--from-branch`, so both agree on what the branch has.
+*
+* Anything short of a clear answer — no project to read, no credentials, a failed read, no
+* Data API on the branch — falls back to today's Neon Auth scaffold. The read must never make
+* `init` fail: a user without the Data API loses nothing, and one with it is told how to fix
+* the file by hand.
+*/
+const resolveInitDataApiChoice = async (props) => {
+	const { projectId } = props;
+	if (!projectId) return { kind: "neon" };
+	try {
+		const access = props.apiClient ? {
+			apiClient: props.apiClient,
+			apiKey: props.apiKey
+		} : await existingApiClient({
+			configDir: props.configDir ?? defaultDir,
+			apiHost: props.apiHost ?? "https://console.neon.tech/api/v2",
+			...props.profile !== void 0 ? { profile: props.profile } : {},
+			...props.oauthHost !== void 0 ? { oauthHost: props.oauthHost } : {},
+			...props.clientId !== void 0 ? { clientId: props.clientId } : {}
+		});
+		if (access === null) {
+			log.warning("Not signed in, so the Data API on the linked branch could not be read; declaring it with Neon Auth. If it verifies an external identity provider, set dataApi.authProvider to \"external\" in neon.ts before deploying.");
+			return { kind: "neon" };
+		}
+		const ref = await resolveBranchRef({
+			apiClient: access.apiClient,
+			projectId,
+			...props.branch !== void 0 ? { branch: props.branch } : {}
+		});
+		const { view } = await liveConfigView({
+			projectId,
+			branchId: ref.branchId,
+			...access.apiKey ? { apiKey: access.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		});
+		return view.dataApi === void 0 ? { kind: "neon" } : dataApiChoiceFromView(view.dataApi);
+	} catch (error) {
+		log.warning("Couldn't read the Data API on the linked branch (%s); declaring it with Neon Auth. If it verifies an external identity provider, set dataApi.authProvider to \"external\" in neon.ts before deploying.", error instanceof Error ? error.message : String(error));
+		return { kind: "neon" };
+	}
+};
 /** The install command to print, prefixed with a `cd` when the project is not the cwd. */
 const installCommandFrom = (dir, pm, missing, options) => {
 	const command = formatInstallCommand(pm, [...missing], options);
@@ -265,7 +315,8 @@ const initCmd = async (props) => {
 		}
 	} else {
 		const services = await resolveServices(props);
-		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
+		const dataApi = services.includes("data-api") ? await resolveInitDataApiChoice(props) : void 0;
+		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services, dataApi ? { dataApi } : {}));
 		if (!props.silent) {
 			if (services.length === 0) log.info("Created neon.ts with a starter policy.");
 			else {
@@ -273,6 +324,7 @@ const initCmd = async (props) => {
 				log.info("Created neon.ts declaring %s.", declared.join(", "));
 			}
 		}
+		if (dataApi?.kind === "external") log.info("The branch's Data API verifies an external identity provider%s, so neon.ts declares it with authProvider \"external\" and does not enable Neon Auth.", dataApi.providerName ? ` (${dataApi.providerName})` : "");
 		if (services.includes("functions")) scaffoldFunction(cwd);
 	}
 	await ensureConfigPackages(cwd, props);
@@ -445,7 +497,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 }), (args) => applyCmd(args)).command("add", "Add a service, function, or bucket to neon.ts (creates it if missing)", (yargs) => yargs.command("auth", "Enable Neon Auth (auth: true)", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "auth"
-}))).command("data-api", "Enable the Data API (dataApi: true) and Neon Auth, which the default provider requires", addSharedOptions, (args) => addCmd(addProps(args, {
+}))).command("data-api", "Enable the Data API (dataApi: true) and Neon Auth, which the default provider requires. For an external identity provider, set dataApi.authProvider to \"external\" instead", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "data-api"
 }))).command("ai-gateway", "Enable the AI Gateway (aiGateway: true)", addSharedOptions, (args) => addCmd(addProps(args, {
@@ -502,7 +554,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 		also: "postgres alone writes the starter policy; every branch has Postgres. Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
 	}),
 	"from-branch": {
-		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. The only mode of `config init` that calls the Neon API.",
+		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. Needs credentials and a project.",
 		type: "boolean",
 		conflicts: "services"
 	}

package/dist/_chunks/{deploy-DmKZcAnR.js → deploy-DmEEhux0.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-7SIE_C5O.js";
+import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BjCm5cfr.js";
 import { DEPLOY_COMMANDS_EPILOGUE } from "../commands/deploy_help.js";
 // src/commands/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({

package/dist/_chunks/{dev-Dv0HKcFF.js → dev-DlUJFzRs.js}

@@ -9,7 +9,7 @@ import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/f
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { f as envFlag } from "./config-7SIE_C5O.js";
+import { f as envFlag } from "./config-BjCm5cfr.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/_chunks/{git-Dxw9w9dK.js → git-j6xSVo3e.js}

@@ -5,8 +5,8 @@ import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollow
 import { writer } from "../writer.js";
 import { neonSafeBranchName } from "../utils/branch_name.js";
 import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
-import { o as quoteFlagValue } from "./link-CcwTXRny.js";
-import { o as handler$1 } from "./checkout-C6VMMgY6.js";
+import { o as quoteFlagValue } from "./link-nAiuWKfg.js";
+import { o as handler$1 } from "./checkout-BpOcFaAi.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";

package/dist/_chunks/{init-BOOGv-mD.js → init-CcVJb492.js}

@@ -53,7 +53,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	key: "services",
 	allowed: NEON_SERVICES,
 	describe: "Services to declare in neon.ts",
-	also: "postgres alone writes the starter policy; every branch has Postgres. Implies creating neon.ts. Cannot be combined with --no-config."
+	also: "postgres alone writes the starter policy; every branch has Postgres. data-api also declares auth unless the linked branch's Data API already uses an external identity provider. Implies creating neon.ts. Cannot be combined with --no-config."
 })).option("org-id", {
 	describe: "Forwarded to link: organization ID to link to",
 	type: "string"

package/dist/_chunks/{link-CcwTXRny.js → link-nAiuWKfg.js}

@@ -14,7 +14,7 @@ import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
 import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
-import { h as initCmd } from "./config-7SIE_C5O.js";
+import { h as initCmd } from "./config-BjCm5cfr.js";
 import { formatLinkSummary } from "../commands/link_output.js";
 import { r as REGIONS } from "./projects-a3X4OFEJ.js";
 import prompts from "prompts";

package/dist/_chunks/{profile-H0d7gFrX.js → profile-BAlM625e.js}

@@ -10,7 +10,7 @@ import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as n
 import { auth, revokeToken } from "../auth.js";
 import { t as credentialInputs } from "./auth_selection-CwGLN9Qz.js";
 import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
-import { n as authFlow, p as usableCredential } from "./auth-DPSDYYtG.js";
+import { m as usableCredential, n as authFlow } from "./auth-rup6nemJ.js";
 import { identityFromAuthDetails, isApiKeyMethod, mintedKeyName, notAnApiKeyMessage } from "../profile_keys.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";

package/dist/_chunks/{status-DS_yUXFo.js → status-BC4XXuuE.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { y as status } from "./config-7SIE_C5O.js";
+import { y as status } from "./config-BjCm5cfr.js";
 // src/commands/status.ts
 var status_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,

package/dist/api.js

@@ -288,7 +288,7 @@ async function readJsonBody(response) {
 	}
 }
 const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }) => {
-	const baseUrl = apiHost ?? DEFAULT_API_HOST;
+	const baseUrl = apiHost ?? "https://console.neon.tech/api/v2";
 	const fetchWithTimeout = makeTimedFetch(validateRequestTimeout(requestTimeoutMs));
 	const client = createClient(createConfig({
 		auth: () => apiKey,
@@ -1079,4 +1079,4 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 		}))
 	};
 };
-export { ContentType, NeonApiError, UnreadableResponseError, codeFromBody, getApiClient, isNeonApiError, messageFromBody, retryOnLock };
+export { ContentType, DEFAULT_API_HOST, NeonApiError, UnreadableResponseError, codeFromBody, getApiClient, isNeonApiError, messageFromBody, retryOnLock };

package/dist/auth_recovery.js

@@ -2,7 +2,7 @@ import { t as storeFor } from "./_chunks/credential_io-DbeSh3Pl.js";
 import { log } from "./log.js";
 import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
 import { AuthRefreshError } from "./auth.js";
-import { f as refreshStoredCredentials, u as isAccessTokenUsable } from "./_chunks/auth-DPSDYYtG.js";
+import { d as isAccessTokenUsable, p as refreshStoredCredentials } from "./_chunks/auth-rup6nemJ.js";
 // src/auth_recovery.ts
 const supersededOnDisk = (rejectedToken) => {
 	if (rejectedToken === void 0) return false;

package/dist/commands/auth.js

@@ -1 +1 @@
-export { t as aliases, n as authFlow, i as builder, a as command, o as deleteCredentialsAt, s as describe, c as ensureAuth, l as handler, u as isAccessTokenUsable, d as locationForAuth, f as refreshStoredCredentials, p as usableCredential } from "../_chunks/auth-DPSDYYtG.js";
+export { t as aliases, n as authFlow, i as builder, a as command, o as deleteCredentialsAt, s as describe, c as ensureAuth, l as existingApiClient, u as handler, d as isAccessTokenUsable, f as locationForAuth, p as refreshStoredCredentials, m as usableCredential } from "../_chunks/auth-rup6nemJ.js";

package/dist/commands/checkout.js

@@ -1 +1 @@
-export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-C6VMMgY6.js";
+export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-BpOcFaAi.js";

package/dist/commands/config.js

@@ -1 +1 @@
-export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-7SIE_C5O.js";
+export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-BjCm5cfr.js";

package/dist/commands/deploy.js

@@ -1 +1 @@
-export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-DmKZcAnR.js";
+export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-DmEEhux0.js";

package/dist/commands/dev.js

@@ -1 +1 @@
-export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-Dv0HKcFF.js";
+export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-DlUJFzRs.js";

package/dist/commands/functions_new.js

@@ -8,7 +8,7 @@ import { writer } from "../writer.js";
 import { formatInitDone, printInitDone } from "../init/chrome.js";
 import { FUNCTION_SLUG_PATTERN, deriveFunctionSlug } from "../utils/function_slug.js";
 import { displayPath } from "./env_output.js";
-import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-7SIE_C5O.js";
+import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-BjCm5cfr.js";
 import { recommendedOperations } from "../functions/registry.js";
 import { collidingFiles, operationsFromFlags, planConfigRegistration, planEnvExample, planScaffold, writeScaffold } from "../functions/scaffold.js";
 import { describeRegistrySource, openRegistry } from "../functions/source.js";

package/dist/commands/git.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-Dxw9w9dK.js";
+export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-j6xSVo3e.js";

package/dist/commands/index.js

@@ -1,31 +1,31 @@
-import { r as auth_exports } from "../_chunks/auth-DPSDYYtG.js";
+import { r as auth_exports } from "../_chunks/auth-rup6nemJ.js";
 import { t as api_exports } from "../_chunks/api-1MKsfpY3.js";
 import { n as api_keys_exports } from "../_chunks/api_keys-6Xnxl7a8.js";
 import { n as ask_exports } from "../_chunks/ask-Xlek1Pxh.js";
 import { o as env_exports } from "../_chunks/env-BOt9AZ1j.js";
-import { c as config_exports } from "../_chunks/config-7SIE_C5O.js";
+import { c as config_exports } from "../_chunks/config-BjCm5cfr.js";
 import { u as projects_exports } from "../_chunks/projects-a3X4OFEJ.js";
-import { a as link_exports } from "../_chunks/link-CcwTXRny.js";
+import { a as link_exports } from "../_chunks/link-nAiuWKfg.js";
 import { o as mcp_exports } from "../_chunks/mcp-BznTRK3w.js";
 import { c as plugins_exports } from "../_chunks/plugins-CKOcBuuP.js";
 import { l as skills_exports } from "../_chunks/skills-DKgafm65.js";
 import { t as bootstrap_exports } from "../_chunks/bootstrap-BDkvsAVJ.js";
 import { r as branches_exports } from "../_chunks/branches-Bp-5z1lM.js";
 import { n as bucket_exports } from "../_chunks/bucket-D06bvDSa.js";
-import { n as checkout_exports } from "../_chunks/checkout-C6VMMgY6.js";
+import { n as checkout_exports } from "../_chunks/checkout-BpOcFaAi.js";
 import { o as claim_exports } from "../_chunks/claim-DlLZmcq0.js";
 import { a as connection_string_exports } from "../_chunks/connection_string-C9e7N4xk.js";
 import { a as credentials_exports } from "../_chunks/credentials-BMBNmW0t.js";
 import { r as data_api_exports } from "../_chunks/data_api-CHDwvMTG.js";
 import { o as databases_exports } from "../_chunks/databases-DC2h6IW2.js";
-import { r as deploy_exports } from "../_chunks/deploy-DmKZcAnR.js";
-import { s as dev_exports } from "../_chunks/dev-Dv0HKcFF.js";
+import { r as deploy_exports } from "../_chunks/deploy-DmEEhux0.js";
+import { s as dev_exports } from "../_chunks/dev-DlUJFzRs.js";
 import { i as diff_exports } from "../_chunks/diff-dnxneH0u.js";
 import { c as docs_exports } from "../_chunks/docs-CClmgj_Z.js";
 import { o as feedback_exports } from "../_chunks/feedback-mQmdTRFn.js";
 import { o as functions_exports } from "../_chunks/functions-3ypiRwZK.js";
-import { o as git_exports } from "../_chunks/git-Dxw9w9dK.js";
-import { a as init_exports } from "../_chunks/init-BOOGv-mD.js";
+import { o as git_exports } from "../_chunks/git-j6xSVo3e.js";
+import { a as init_exports } from "../_chunks/init-CcVJb492.js";
 import { o as inspect_exports } from "../_chunks/inspect-yFAb61qo.js";
 import { a as ip_allow_exports } from "../_chunks/ip_allow-DBdxNEUa.js";
 import { l as logs_exports } from "../_chunks/logs-BB4uvblR.js";
@@ -33,13 +33,13 @@ import { a as neon_auth_exports } from "../_chunks/neon_auth-Dw-ucM5Y.js";
 import { a as open_exports } from "../_chunks/open-T2nI89Oh.js";
 import { s as operations_exports } from "../_chunks/operations-CzaR_uqx.js";
 import { o as orgs_exports } from "../_chunks/orgs-Dpbr-K0A.js";
-import { o as profile_exports } from "../_chunks/profile-H0d7gFrX.js";
+import { o as profile_exports } from "../_chunks/profile-BAlM625e.js";
 import { a as psql_exports } from "../_chunks/psql-Bce4X0NG.js";
 import { s as realtime_exports } from "../_chunks/realtime-BwtzYf5a.js";
 import { l as roles_exports } from "../_chunks/roles-xRuu0462.js";
 import { a as set_context_exports } from "../_chunks/set_context-ompB6d2D.js";
 import { s as snapshots_exports } from "../_chunks/snapshots-DxNhjcco.js";
-import { a as status_exports } from "../_chunks/status-DS_yUXFo.js";
+import { a as status_exports } from "../_chunks/status-BC4XXuuE.js";
 import { d as triggers_exports } from "../_chunks/triggers-BfvyeJUC.js";
 import { s as user_exports } from "../_chunks/user-D9mC430O.js";
 import { i as vpc_endpoints_exports } from "../_chunks/vpc_endpoints-C-Y4WK2M.js";

package/dist/commands/init.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/init-BOOGv-mD.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/init-CcVJb492.js";

package/dist/commands/link.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-CcwTXRny.js";
+export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-nAiuWKfg.js";

package/dist/commands/profile.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as command, i as describe, a as handler } from "../_chunks/profile-H0d7gFrX.js";
+export { t as aliases, n as builder, r as command, i as describe, a as handler } from "../_chunks/profile-BAlM625e.js";

package/dist/commands/status.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-DS_yUXFo.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-BC4XXuuE.js";

package/dist/config_format.js

@@ -28,7 +28,7 @@ const formatDurationSeconds = (totalSeconds) => {
 const toNeonConfigView = (resolved, preview) => {
 	const view = {};
 	if (resolved.authEnabled) view.auth = true;
-	if (resolved.dataApiEnabled) view.dataApi = true;
+	if (resolved.dataApiEnabled) view.dataApi = toDataApiView(resolved.dataApi);
 	const previewView = toPreviewView(preview);
 	if (previewView) view.preview = previewView;
 	const branch = {};
@@ -39,6 +39,14 @@ const toNeonConfigView = (resolved, preview) => {
 	if (Object.keys(branch).length > 0) view.branch = branch;
 	return view;
 };
+const toDataApiView = (dataApi) => {
+	if (dataApi?.authProvider !== "external") return true;
+	const view = { authProvider: "external" };
+	if (dataApi.jwksUrl !== void 0) view.jwksUrl = dataApi.jwksUrl;
+	if (dataApi.providerName !== void 0) view.providerName = dataApi.providerName;
+	if (dataApi.jwtAudience !== void 0) view.jwtAudience = dataApi.jwtAudience;
+	return view;
+};
 const toPreviewView = (preview) => {
 	if (!preview) return void 0;
 	const out = {};

package/dist/config_template.js

@@ -18,8 +18,9 @@ const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 * from these names to the `neon.ts` fields (`aiGateway`, `functions`, `buckets`, `dataApi`).
 *
 * Postgres is absent because every branch has it, so there is nothing to declare. Selecting
-* `data-api` also writes `auth: true`: the default Data API provider requires Neon Auth, and
-* `defineConfig` type-errors the file without it.
+* `data-api` also writes `auth: true` unless the caller says the Data API verifies an external
+* provider (see {@link DataApiTemplateChoice}): the default Data API provider requires Neon
+* Auth, and `defineConfig` type-errors the file without it.
 */
 const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres");
 /**
@@ -64,18 +65,44 @@ const renderGaServices = (services) => {
 	if (lines.length === 0) return "";
 	return `${lines.join("\n")}\n`;
 };
+/** The template choice for a view's `dataApi` entry (`config status` / `--from-branch`). */
+const dataApiChoiceFromView = (dataApi) => {
+	if (dataApi === true) return { kind: "neon" };
+	const { authProvider: _provider, ...wiring } = dataApi;
+	return {
+		kind: "external",
+		...wiring
+	};
+};
+/**
+* The `dataApi` entry, ending in a newline. The external form carries whatever wiring is
+* known; without a JWKS URL it still type-checks (the URL is optional) and still declares the
+* Data API, so a comment says where the URL lives rather than inventing one.
+*/
+const renderDataApiEntry = (choice) => {
+	if (choice.kind === "neon") return `${at(1, "dataApi: true,").join("\n")}\n`;
+	const fields = at(2, `authProvider: "external",`);
+	if (choice.jwksUrl === void 0) fields.push(...at(2, "// The JWKS URL is registered on the project; add `jwksUrl` to declare it here too."));
+	else fields.push(...at(2, `jwksUrl: ${renderScalar(choice.jwksUrl)},`));
+	if (choice.providerName !== void 0) fields.push(...at(2, `providerName: ${renderScalar(choice.providerName)},`));
+	if (choice.jwtAudience !== void 0) fields.push(...at(2, `jwtAudience: ${renderScalar(choice.jwtAudience)},`));
+	return `${block(1, "dataApi", fields).join("\n")}\n`;
+};
 /**
 * Render the `neon.ts` policy `config init` writes. With no services this is the starter
 * policy — an explicit `auth: false`, no service keys beyond that, and a `branch` closure that gives
 * new non-default branches a 7-day TTL — so the picker's "skip everything" answer and a
 * non-interactive run produce the identical file.
 *
-* `data-api` writes `dataApi: true` and forces `auth: true`. The default provider is Neon
-* Auth; omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
+* `data-api` writes `dataApi: true` and forces `auth: true` unless `options.dataApi` says the
+* branch's Data API verifies an external provider. The default provider is Neon Auth;
+* omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
 */
-const renderNeonConfig = (services) => {
-	const auth = services.includes("auth") || services.includes("data-api");
-	const dataApi = services.includes("data-api") ? "  dataApi: true,\n" : "";
+const renderNeonConfig = (services, options = {}) => {
+	const dataApiChoice = options.dataApi ?? { kind: "neon" };
+	const declaresDataApi = services.includes("data-api");
+	const auth = services.includes("auth") || declaresDataApi && dataApiChoice.kind !== "external";
+	const dataApi = declaresDataApi ? renderDataApiEntry(dataApiChoice) : "";
 	const realtimeDeclaration = services.includes("realtime") ? "  preview: {\n    realtime: true,\n  },\n" : "";
 	return `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
 
@@ -154,7 +181,7 @@ const renderSeededGaServices = (view, branchName) => {
 * than an empty `defineConfig({})`: seeding found nothing, and the caller says so.
 */
 const renderNeonConfigFromView = (view, branchName) => {
-	const services = [view.auth ? "  auth: true," : "", view.dataApi ? "  dataApi: true," : ""].filter((line) => line !== "");
+	const services = [view.auth ? "  auth: true," : "", view.dataApi ? renderDataApiEntry(dataApiChoiceFromView(view.dataApi)).trimEnd() : ""].filter((line) => line !== "");
 	const gaServices = renderSeededGaServices(view, branchName);
 	const branch = renderSeededBranch(view);
 	if (services.length === 0 && gaServices === "" && branch === "") return {
@@ -202,4 +229,4 @@ const renderFunctionSource = (slug, language) => {
 `;
 };
 const FUNCTION_TEMPLATE = renderFunctionSource(FUNCTION_SLUG, "ts");
-export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };
+export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, dataApiChoiceFromView, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };

package/dist/index.js

@@ -9,7 +9,7 @@ import { NETWORK_ERROR_MESSAGE, isNetworkError, matchErrorCode } from "./errors.
 import { analyticsMiddleware, closeAnalytics, initAnalyticsClientMiddleware, isAnalyticsActive, recordCommandSuccessExtras, sendError, takeCommandSuccessExtras, trackCommandSuccess } from "./analytics.js";
 import { AuthRefreshError, defaultClientID } from "./auth.js";
 import { getCliName } from "./utils/cli_name.js";
-import { c as ensureAuth } from "./_chunks/auth-DPSDYYtG.js";
+import { c as ensureAuth } from "./_chunks/auth-rup6nemJ.js";
 import { recoverFrom401 } from "./auth_recovery.js";
 import { UsageError, failOnUsageError, isBareParentCommand, showHelp, showUsageErrorHelp } from "./help.js";
 import { lazyCommands, preloadCommand } from "./commands/manifest.js";

package/dist/init/auth.js

@@ -2,7 +2,7 @@ import { isNeonApiError } from "../api.js";
 import { r as defaultDir } from "../_chunks/paths-B55ZfOg1.js";
 import "../config.js";
 import "../auth.js";
-import { c as ensureAuth } from "../_chunks/auth-DPSDYYtG.js";
+import { c as ensureAuth, l as existingApiClient } from "../_chunks/auth-rup6nemJ.js";
 import { recoverFrom401 } from "../auth_recovery.js";
 import { c as pull } from "../_chunks/env-BOt9AZ1j.js";
 import { c as setupNeonMcp } from "../_chunks/mcp-BznTRK3w.js";
@@ -54,6 +54,27 @@ const runAuthenticatedMcp = async (options) => {
 	}
 };
 /**
+* The client and key `neon config init` may read the linked branch with. Init calls this only
+* after a link is verified, but a pin that was already in place can have no credentials on
+* disk, so this never starts a login: with nothing usable it returns an empty result and the
+* scaffold declares the Neon Auth default with a warning, as a failed read does.
+*/
+const resolveInitConfigApi = async (options) => {
+	const access = await existingApiClient({
+		configDir: options.configDir ?? defaultDir,
+		apiHost: options.apiHost ?? "https://console.neon.tech/api/v2",
+		...options.profile !== void 0 ? { profile: options.profile } : {},
+		...options.oauthHost !== void 0 ? { oauthHost: options.oauthHost } : {},
+		...options.clientId !== void 0 ? { clientId: options.clientId } : {}
+	});
+	if (access === null) return {};
+	return {
+		apiClient: access.apiClient,
+		apiKey: access.apiKey,
+		apiHost: options.apiHost
+	};
+};
+/**
 * Resolves Neon auth the same way a standalone `neon env pull` invocation would, then runs
 * `pull` — the same function `link`/`checkout` already call directly via
 * `autoPullEnvAfterPin` (see `commands/env.ts`).
@@ -77,4 +98,4 @@ const pullInitEnv = async (props) => {
 		throw authenticationFailed();
 	}
 };
-export { pullInitEnv, runAuthenticatedMcp };
+export { pullInitEnv, resolveInitConfigApi, runAuthenticatedMcp };

package/dist/init/link.js

@@ -2,9 +2,9 @@ import { isNeonApiError } from "../api.js";
 import { r as defaultDir } from "../_chunks/paths-B55ZfOg1.js";
 import "../config.js";
 import "../auth.js";
-import { c as ensureAuth } from "../_chunks/auth-DPSDYYtG.js";
+import { c as ensureAuth } from "../_chunks/auth-rup6nemJ.js";
 import { recoverFrom401 } from "../auth_recovery.js";
-import { s as runLink } from "../_chunks/link-CcwTXRny.js";
+import { s as runLink } from "../_chunks/link-nAiuWKfg.js";
 // src/init/link.ts
 const isUnauthorized = (error) => isNeonApiError(error) && error.status === 401;
 const authenticationFailed = () => /* @__PURE__ */ new Error("Authentication failed.");

package/dist/init/run.js

@@ -17,11 +17,11 @@ import { FALLBACK_SKILLS_AGENTS, assertNamedAgentTooling, funnelAgentSetup, plan
 import { inferPackageManager, resolvePackageManager } from "../utils/package_manager.js";
 import { AGENTS_NOT_INSTALLED, CANCELLED_BODY, CLAIMABLE_ACCOUNT_FLAGS, CLAIMABLE_ALREADY_LINKED, CLAIMABLE_MCP_API_KEY, CLAIMABLE_NO_LINK, MCP_API_KEY_NEEDS_AUTH, MCP_SCOPED_NEEDS_PROJECT, NON_TTY_LINK_NEEDS_AUTH, NO_AGENTS_FALLBACK_STATUS, PROGRESS, PROJECT_PINNED_OFFLINE, claimableNext, claimableThenServicesNext, configInitNext, envPullFailedNext, existingConfigNext, installFailedNext, mcpAfterLinkNext, mcpConfigLocationSkipped, mcpConfigLocationUnavailable, mcpKeyFailedNext, namedAgentsUnavailable, newConfigNext, offlinePinNext, skippedLinkNext, toolingFailedNext, unattendedUnauthedNext } from "./copy.js";
 import { agentsRowValue, configRowValue, formatInitDone, headingForKind, printInitBanner, printInitDone, printInitProgress, projectRowValue, shouldPrintInitBanner } from "./chrome.js";
-import { h as initCmd, t as ConfigInstallFailed } from "../_chunks/config-7SIE_C5O.js";
-import { o as quoteFlagValue, s as runLink } from "../_chunks/link-CcwTXRny.js";
+import { h as initCmd, t as ConfigInstallFailed } from "../_chunks/config-BjCm5cfr.js";
+import { o as quoteFlagValue, s as runLink } from "../_chunks/link-nAiuWKfg.js";
 import { runAuthenticatedLink } from "./link.js";
 import { CannotMintApiKeyError } from "../mcp/mint.js";
-import { pullInitEnv } from "./auth.js";
+import { pullInitEnv, resolveInitConfigApi } from "./auth.js";
 import { InitCancelled, raceSigint, restoreCursor } from "./cancelled.js";
 import { pickAgentSetupInteractively, pickInitAgentsInteractively, pickInitConfigInteractively, pickInitMcpAuthInteractively, pickInitMcpConfigLocationInteractively, pickInitModeInteractively, pickInitPackageManagerInteractively, pickInitProjectSetupInteractively, pickInitServicesInteractively, pickInitSkillsInteractively } from "./wizard.js";
 import { runToolingSteps, toolingStepCommandText } from "./tooling.js";
@@ -130,13 +130,28 @@ const pickOrDetectAgents = async (input) => {
 	return detected;
 };
 const defaultInitConfig = async (input) => {
+	let project = {};
+	if (input.project) try {
+		project = {
+			...await resolveInitConfigApi(input.project.auth),
+			projectId: input.project.projectId,
+			...input.project.branch !== void 0 ? { branch: input.project.branch } : {},
+			...input.project.auth.configDir !== void 0 ? { configDir: input.project.auth.configDir } : {},
+			...input.project.auth.profile !== void 0 ? { profile: input.project.auth.profile } : {},
+			...input.project.auth.oauthHost !== void 0 ? { oauthHost: input.project.auth.oauthHost } : {},
+			...input.project.auth.clientId !== void 0 ? { clientId: input.project.auth.clientId } : {}
+		};
+	} catch (error) {
+		log.warning("Couldn't authenticate to read the Data API on the linked branch (%s); declaring it with Neon Auth.", error instanceof Error ? error.message : String(error));
+	}
 	await initCmd({
 		cwd: input.cwd,
 		install: input.install,
 		silent: true,
 		requireInstall: true,
 		...input.services !== void 0 ? { services: input.services } : {},
-		...input.packageManager !== void 0 ? { packageManager: input.packageManager } : {}
+		...input.packageManager !== void 0 ? { packageManager: input.packageManager } : {},
+		...project
 	});
 };
 const defaultCreateClaimable = async (input) => {
@@ -557,12 +572,19 @@ const runInit = async (props) => {
 			}
 			if (!existingConfig) printInitProgress(PROGRESS.config);
 			printInitProgress(PROGRESS.install(pm));
+			const readableProject = funnel.link !== "skipped" && !pinnedOffline && declared.includes("data-api") ? readContextFile(contextFile) : void 0;
+			const readableBranch = readableProject !== void 0 ? contextBranch(readableProject) : void 0;
 			try {
 				await (props.initConfig ?? defaultInitConfig)({
 					cwd,
 					install: true,
 					packageManager: pm,
-					...planned !== void 0 ? { services: planned } : {}
+					...planned !== void 0 ? { services: planned } : {},
+					...typeof readableProject?.projectId === "string" ? { project: {
+						projectId: readableProject.projectId,
+						...readableBranch !== void 0 ? { branch: readableBranch } : {},
+						auth
+					} } : {}
 				});
 			} catch (error) {
 				if (error instanceof ConfigInstallFailed) {

package/dist/init/wizard.js

@@ -207,7 +207,7 @@ const pickInitServicesInteractively = async () => {
 			{
 				value: "data-api",
 				title: "Data API",
-				description: "Declare an HTTP API for Postgres. Also declares Managed Better Auth."
+				description: "Declare an HTTP API for Postgres. Also declares Managed Better Auth, unless the branch's Data API already uses an external identity provider."
 			},
 			{
 				value: "functions",

package/dist/utils/service_picker.js

@@ -36,7 +36,7 @@ const CHOICES = [
 	{
 		value: "data-api",
 		title: "Data API",
-		description: "PostgREST-compatible HTTP API. Also declares Auth; the default provider needs it."
+		description: "PostgREST-compatible HTTP API. Also declares Auth, which the default provider needs, unless the linked branch's Data API already uses an external identity provider."
 	},
 	{
 		value: "functions",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "8.14.0",
+  "version": "8.15.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -72,10 +72,10 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.9.6",
+    "@neon/config": "1.10.0",
+    "@neon/config-runtime": "1.11.0",
     "@neon/realtime": "0.1.2",
-    "@neon/config-runtime": "1.10.5",
-    "@neon/sdk": "7.6.1"
+    "@neon/sdk": "7.7.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",
@@ -111,11 +111,11 @@
     "tsx": "4.22.3",
     "typescript": "^5.9.0",
     "vitest": "^3.0.9",
-    "@neon-internals/env-core": "0.0.37",
     "@neon-internals/cli-core": "0.0.0",
-    "@neon/e2e-harness": "0.0.0",
-    "@neon/env": "1.6.7",
-    "@neon/functions": "0.11.0"
+    "@neon-internals/env-core": "0.0.38",
+    "@neon/env": "1.6.8",
+    "@neon/functions": "0.11.0",
+    "@neon/e2e-harness": "0.0.0"
   },
   "publishConfig": {
     "access": "public",