neon 8.14.0 → 8.15.1

package/README.md

@@ -673,7 +673,7 @@ export default defineConfig({
 
 ### Getting a `neon.ts` (`config init`)
 
-`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is purely local — no auth, no API calls. In an interactive terminal it asks which services the policy should declare:
+`neon config init` scaffolds the policy and installs `@neon/config` / `@neon/env`, so a project can go straight to `plan` / `apply`. It is local — no auth and no API calls — except `--services data-api`, which reads the linked branch's Data API with a credential already on hand (never a login) so the scaffold declares the right auth. In an interactive terminal it asks which services the policy should declare:
 
 ```
 ? Which Neon services should neon.ts declare? (space to toggle, enter to confirm) ›
@@ -1056,6 +1056,8 @@ On a TTY the command asks which agents, then installs. Detected agents start sel
 
 Default scope is `project`. `--global` is `user`. On macOS and Linux, Cursor and Claude Code store the plugin cache under `~/.claude/plugins`; on Windows, Cursor installs into Cursor extensions. `project` vs `user` is the scope field the plugins CLI records, not a directory in the repo. VS Code, GitHub Copilot CLI, and Grok Build only install user-level: they are skipped at the default scope with a warning, and a VS Code-only project fails if nothing else is selected. Pass `--global` for those.
 
+GitHub Copilot CLI and Grok Build install through their own CLIs (`copilot`, `grok`), so `neon plugins` runs `copilot --version` or `grok --version` first. A command that is missing, fails, or (for Copilot) is older than 0.0.400 is skipped with a warning under `-y`, fails an explicit `--agent`, and in `neon init` gets Neon skills and MCP instead of the plugin. The other agents install by writing files, so their detected config directory is enough.
+
 Supported agents with a plugins mapping: `claude-code`, `claude-desktop`, `codex`, `cursor`, `github-copilot-cli`, `grok-build`, `vscode`. `claude-desktop` installs as Claude Code; detecting both produces one install and lists both names in the table. `mcporter` is a known MCP name that is then skipped.
 
 The plugins CLI installs every plugin it finds in the Neon plugin package. Today that is `neon-postgres` from `neondatabase/agent-skills`. It includes the Neon MCP server (`https://mcp.neon.tech/mcp`) and these skills: `neon`, `neon-ai-gateway`, `neon-auth`, `neon-functions`, `neon-object-storage`, `neon-postgres`, `neon-postgres-branches`, `neon-postgres-egress-optimizer`, `neon-realtime`. It does not include `neon-postgres-agent-platforms`.
@@ -1122,7 +1124,7 @@ Without a template, a terminal asks which one to use; anything else exits with t
 
 A template's `layout` decides what you get. `router` writes one module per operation plus a generated `index.ts` that dispatches on the URL path, and declares one function. `separate` declares each operation as its own function under the slug the template gives it. Without `--operation` or `--all-operations`, a TTY asks which operations to include and anything else uses the template's recommended ones.
 
-Variables a template needs are declared on each function in `neon.ts` (`env: { API_KEY: process.env.API_KEY! }`) and added, without values, to `.env.example` next to it. Values are never written to `.env` or `.env.local` for you: a blank placeholder there would deploy as an empty string and delete the live value. Put the real value in the file `env pull` uses and deploy with `neon config apply --env .env.local`. `neon dev` reads function env from your shell, so export it there as well.
+Variables a template needs are declared on each function in `neon.ts` (`env: { API_KEY: process.env.API_KEY! }`) and added, without values, to `.env.example` next to it. Values are never written to `.env` or `.env.local` for you: a blank placeholder there would deploy as an empty string and delete the live value. Put the real value in the file `env pull` uses and deploy with `neon config apply --env .env.local`. `neon dev` loads it automatically.
 
 Nothing is written until every check passes: a file that already exists with different contents needs `--force`, and a slug `neon.ts` already declares needs `--slug`, `--force`, or `--no-add-to-config`. A `separate` template sets its own slugs, so `--slug` only changes its directory; remove the existing declarations from `neon.ts`, or use `--force` or `--no-add-to-config`.
 

package/dist/_chunks/{auth-DPSDYYtG.js → auth-rup6nemJ.js}

@@ -28,6 +28,7 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	deleteCredentialsAt: () => deleteCredentialsAt,
 	describe: () => describe,
 	ensureAuth: () => ensureAuth,
+	existingApiClient: () => existingApiClient,
 	handler: () => handler,
 	isAccessTokenUsable: () => isAccessTokenUsable,
 	locationForAuth: () => locationForAuth,
@@ -288,6 +289,42 @@ const usableCredential = async (props, at) => {
 		return null;
 	}
 };
+/**
+* The API client for a credential this invocation already holds — the `--api-key` flag or
+* `NEON_API_KEY`, or the selected profile's stored key or OAuth session, refreshed when
+* expired — along with the key it uses. Never starts a login, so a read that only enriches a
+* local file cannot interrupt it. Null when there is no such credential.
+*
+* Selection follows {@link ensureAuth} exactly; only the fallback differs. `ensureAuth` may
+* log in, and a caller that is only reading a branch to improve a scaffold must not.
+*/
+const existingApiClient = async (props) => {
+	const selection = selectCredential({
+		...credentialInputs(),
+		profileFlag: props.profile
+	});
+	if (selection.source !== "profile") return {
+		apiKey: selection.apiKey,
+		apiClient: getApiClient({
+			apiKey: selection.apiKey,
+			apiHost: props.apiHost
+		})
+	};
+	const usable = await usableCredential({
+		configDir: props.configDir,
+		apiHost: props.apiHost,
+		oauthHost: props.oauthHost ?? process.env.NEON_OAUTH_HOST ?? "https://oauth2.neon.tech",
+		clientId: props.clientId ?? "neonctl"
+	}, locationForAuth(props.configDir, selection.profile));
+	if (usable === null) return null;
+	return {
+		apiKey: usable.apiKey,
+		apiClient: getApiClient({
+			apiKey: usable.apiKey,
+			apiHost: props.apiHost
+		})
+	};
+};
 const ensureAuth = async (props) => {
 	if (props._.length === 0 || props.help) return;
 	if (isCurrentBranchProbe(props)) return;
@@ -491,4 +528,4 @@ const deleteCredentialsAt = (at, configDir) => {
 	}
 };
 const md5hash = (s) => createHash("md5").update(s).digest("hex");
-export { command as a, ensureAuth as c, locationForAuth as d, refreshStoredCredentials as f, builder as i, handler as l, authFlow as n, deleteCredentialsAt as o, usableCredential as p, auth_exports as r, describe as s, aliases as t, isAccessTokenUsable as u };
+export { command as a, ensureAuth as c, isAccessTokenUsable as d, locationForAuth as f, builder as i, existingApiClient as l, usableCredential as m, authFlow as n, deleteCredentialsAt as o, refreshStoredCredentials as p, auth_exports as r, describe as s, aliases as t, handler as u };

package/dist/_chunks/{checkout-C6VMMgY6.js → checkout-BpOcFaAi.js}

@@ -12,8 +12,8 @@ import { fillSingleProject, listAllProjectBranches } from "../utils/enrichers.js
 import { buildCheckoutEvent, readGitContext } from "../utils/git.js";
 import { buildHookBranch, loadHookConfig, resolveHookEnv, runCheckoutAfterHook, runCheckoutBeforeHook, runCreateAfterHook, runCreateBeforeHook } from "../utils/hooks.js";
 import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
-import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-7SIE_C5O.js";
-import { i as handler$1 } from "./link-CcwTXRny.js";
+import { a as applyPolicyOnCreate, f as envFlag, l as createBranchFromPolicyOnCheckout } from "./config-BjCm5cfr.js";
+import { i as handler$1 } from "./link-nAiuWKfg.js";
 import chalk from "chalk";
 import prompts from "prompts";
 // src/commands/checkout.ts

package/dist/_chunks/{config-7SIE_C5O.js → config-BjCm5cfr.js}

@@ -2,10 +2,13 @@ import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { isCi, isInteractiveTerminal } from "../env.js";
 import { log } from "../log.js";
 import { getApiClient } from "../api.js";
+import { r as defaultDir } from "./paths-B55ZfOg1.js";
+import "../config.js";
 import { contextBranch, ensureDirectoryGitignored, readContextFile } from "../context.js";
 import { getCliName } from "../utils/cli_name.js";
+import { l as existingApiClient } from "./auth-rup6nemJ.js";
 import { NEON_SERVICES, NEON_SERVICE_LABELS, deprecatedServiceMessage, servicesFlagValue, servicesOption } from "../neon_services.js";
-import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
+import { FUNCTION_FILENAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, dataApiChoiceFromView, parseConfigInitServices, renderFunctionSource, renderNeonConfig, renderNeonConfigFromView } from "../config_template.js";
 import { TYPESCRIPT_EXTENSION, asRelativeModulePath, editNeonConfig } from "../config_edit.js";
 import { toNeonConfigView } from "../config_format.js";
 import { declaredNeonServices } from "../config_services.js";
@@ -208,6 +211,53 @@ const seedFromBranch = async (props) => {
 		branchName: live.branch.name
 	};
 };
+/**
+* Which `dataApi` entry to scaffold for `data-api`. A linked branch whose Data API already
+* verifies an external IdP gets the external form, so the policy does not go on to enable
+* Neon Auth over it on the first `neon deploy`. The read goes through {@link liveConfigView},
+* the same path as `--from-branch`, so both agree on what the branch has.
+*
+* Anything short of a clear answer — no project to read, no credentials, a failed read, no
+* Data API on the branch — falls back to today's Neon Auth scaffold. The read must never make
+* `init` fail: a user without the Data API loses nothing, and one with it is told how to fix
+* the file by hand.
+*/
+const resolveInitDataApiChoice = async (props) => {
+	const { projectId } = props;
+	if (!projectId) return { kind: "neon" };
+	try {
+		const access = props.apiClient ? {
+			apiClient: props.apiClient,
+			apiKey: props.apiKey
+		} : await existingApiClient({
+			configDir: props.configDir ?? defaultDir,
+			apiHost: props.apiHost ?? "https://console.neon.tech/api/v2",
+			...props.profile !== void 0 ? { profile: props.profile } : {},
+			...props.oauthHost !== void 0 ? { oauthHost: props.oauthHost } : {},
+			...props.clientId !== void 0 ? { clientId: props.clientId } : {}
+		});
+		if (access === null) {
+			log.warning("Not signed in, so the Data API on the linked branch could not be read; declaring it with Neon Auth. If it verifies an external identity provider, set dataApi.authProvider to \"external\" in neon.ts before deploying.");
+			return { kind: "neon" };
+		}
+		const ref = await resolveBranchRef({
+			apiClient: access.apiClient,
+			projectId,
+			...props.branch !== void 0 ? { branch: props.branch } : {}
+		});
+		const { view } = await liveConfigView({
+			projectId,
+			branchId: ref.branchId,
+			...access.apiKey ? { apiKey: access.apiKey } : {},
+			...props.apiHost ? { apiHost: props.apiHost } : {},
+			...props.runtimeApi ? { runtimeApi: props.runtimeApi } : {}
+		});
+		return view.dataApi === void 0 ? { kind: "neon" } : dataApiChoiceFromView(view.dataApi);
+	} catch (error) {
+		log.warning("Couldn't read the Data API on the linked branch (%s); declaring it with Neon Auth. If it verifies an external identity provider, set dataApi.authProvider to \"external\" in neon.ts before deploying.", error instanceof Error ? error.message : String(error));
+		return { kind: "neon" };
+	}
+};
 /** The install command to print, prefixed with a `cd` when the project is not the cwd. */
 const installCommandFrom = (dir, pm, missing, options) => {
 	const command = formatInstallCommand(pm, [...missing], options);
@@ -265,7 +315,8 @@ const initCmd = async (props) => {
 		}
 	} else {
 		const services = await resolveServices(props);
-		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services));
+		const dataApi = services.includes("data-api") ? await resolveInitDataApiChoice(props) : void 0;
+		writeFileSync(join(cwd, "neon.ts"), renderNeonConfig(services, dataApi ? { dataApi } : {}));
 		if (!props.silent) {
 			if (services.length === 0) log.info("Created neon.ts with a starter policy.");
 			else {
@@ -273,6 +324,7 @@ const initCmd = async (props) => {
 				log.info("Created neon.ts declaring %s.", declared.join(", "));
 			}
 		}
+		if (dataApi?.kind === "external") log.info("The branch's Data API verifies an external identity provider%s, so neon.ts declares it with authProvider \"external\" and does not enable Neon Auth.", dataApi.providerName ? ` (${dataApi.providerName})` : "");
 		if (services.includes("functions")) scaffoldFunction(cwd);
 	}
 	await ensureConfigPackages(cwd, props);
@@ -445,7 +497,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 }), (args) => applyCmd(args)).command("add", "Add a service, function, or bucket to neon.ts (creates it if missing)", (yargs) => yargs.command("auth", "Enable Neon Auth (auth: true)", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "auth"
-}))).command("data-api", "Enable the Data API (dataApi: true) and Neon Auth, which the default provider requires", addSharedOptions, (args) => addCmd(addProps(args, {
+}))).command("data-api", "Enable the Data API (dataApi: true) and Neon Auth, which the default provider requires. For an external identity provider, set dataApi.authProvider to \"external\" instead", addSharedOptions, (args) => addCmd(addProps(args, {
 	kind: "service",
 	service: "data-api"
 }))).command("ai-gateway", "Enable the AI Gateway (aiGateway: true)", addSharedOptions, (args) => addCmd(addProps(args, {
@@ -502,7 +554,7 @@ const builder = (argv) => argv.usage("$0 config <sub-command> [options]").option
 		also: "postgres alone writes the starter policy; every branch has Postgres. Omitted: pick interactively on a terminal, starter policy in CI or without a TTY."
 	}),
 	"from-branch": {
-		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. The only mode of `config init` that calls the Neon API.",
+		describe: "Seed neon.ts from a branch's live Neon state instead of asking. Uses the branch pinned in .neon, or --branch <name|id>, or the project's default branch. Needs credentials and a project.",
 		type: "boolean",
 		conflicts: "services"
 	}

package/dist/_chunks/{deploy-DmKZcAnR.js → deploy-DmEEhux0.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-7SIE_C5O.js";
+import { f as envFlag, i as applyFlags, p as envPullFlag, r as applyCmd } from "./config-BjCm5cfr.js";
 import { DEPLOY_COMMANDS_EPILOGUE } from "../commands/deploy_help.js";
 // src/commands/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({

package/dist/_chunks/{dev-Dv0HKcFF.js → dev-DlUJFzRs.js}

@@ -9,7 +9,7 @@ import { findConfigFunctionBySource, resolveFunctionsFromConfig } from "../dev/f
 import { resolveWatchInputs } from "../dev/inputs.js";
 import { branchIdResolve } from "../utils/enrichers.js";
 import { bundleEntry } from "../utils/esbuild.js";
-import { f as envFlag } from "./config-7SIE_C5O.js";
+import { f as envFlag } from "./config-BjCm5cfr.js";
 import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/_chunks/{docs-CClmgj_Z.js → docs-BpLiSTmm.js}

@@ -128,7 +128,7 @@ function siteSearchHeaders(opts) {
 		"Content-Type": "application/json",
 		"User-Agent": `neon/${opts.version}`,
 		"x-caller-source": "cli",
-		...opts.agent ? { "x-caller-client": encodeURIComponent(opts.agent) } : {},
+		...opts.analytics && opts.agent ? { "x-caller-client": encodeURIComponent(opts.agent) } : {},
 		...opts.analytics ? {} : { "x-caller-analytics": "off" }
 	};
 }

package/dist/_chunks/{git-Dxw9w9dK.js → git-j6xSVo3e.js}

@@ -5,8 +5,8 @@ import { CONTEXT_FILE, contextBranch, gitBranchMap, gitBranchMapping, isUnfollow
 import { writer } from "../writer.js";
 import { neonSafeBranchName } from "../utils/branch_name.js";
 import { currentGitBranch, gitPull, gitRepoRoot, hasUpstream, installPostCheckoutHook, isGitRepo, isManagedHook, localGitBranches, postCheckoutHookPath, readGitContext, removePostCheckoutHook } from "../utils/git.js";
-import { o as quoteFlagValue } from "./link-CcwTXRny.js";
-import { o as handler$1 } from "./checkout-C6VMMgY6.js";
+import { o as quoteFlagValue } from "./link-nAiuWKfg.js";
+import { o as handler$1 } from "./checkout-BpOcFaAi.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";

package/dist/_chunks/{init-BOOGv-mD.js → init-CcVJb492.js}

@@ -53,7 +53,7 @@ const builder = (yargs) => yargs.usage("$0 init [options]").option("context-file
 	key: "services",
 	allowed: NEON_SERVICES,
 	describe: "Services to declare in neon.ts",
-	also: "postgres alone writes the starter policy; every branch has Postgres. Implies creating neon.ts. Cannot be combined with --no-config."
+	also: "postgres alone writes the starter policy; every branch has Postgres. data-api also declares auth unless the linked branch's Data API already uses an external identity provider. Implies creating neon.ts. Cannot be combined with --no-config."
 })).option("org-id", {
 	describe: "Forwarded to link: organization ID to link to",
 	type: "string"

package/dist/_chunks/{link-CcwTXRny.js → link-nAiuWKfg.js}

@@ -14,7 +14,7 @@ import { createBranch, pickBranchInteractively } from "../utils/branch_picker.js
 import { looksLikeBranchId } from "../utils/formats.js";
 import { listAllProjectBranches } from "../utils/enrichers.js";
 import { n as autoPullEnvAfterPin } from "./env-BOt9AZ1j.js";
-import { h as initCmd } from "./config-7SIE_C5O.js";
+import { h as initCmd } from "./config-BjCm5cfr.js";
 import { formatLinkSummary } from "../commands/link_output.js";
 import { r as REGIONS } from "./projects-a3X4OFEJ.js";
 import prompts from "prompts";

package/dist/_chunks/{plugins-CKOcBuuP.js → plugins-B2Gym8Lw.js}

@@ -5,7 +5,7 @@ import { helpCsv, helpEpilogue } from "../utils/help_text.js";
 import { getAgentDisplayName } from "../mcp/agents.js";
 import { NEON_MCP_URL } from "../mcp/install.js";
 import "../init/agents.js";
-import { pluginsInstallableAgents } from "../plugins/targets.js";
+import { pluginsCommandProblemText, pluginsInstallableAgents } from "../plugins/targets.js";
 import { writer } from "../writer.js";
 import { noPassthrough } from "../utils/flags.js";
 import { AGENT_PLUGIN_SKIP_MESSAGE } from "../init/copy.js";
@@ -77,7 +77,7 @@ const installPlugins = async (options) => {
 	});
 	for (const agent of plan.skipped) log.warning("Skipping %s: no plugins mapping.", getAgentDisplayName(agent));
 	for (const agent of plan.userScopeSkipped) log.warning("Skipping %s: plugins are user-level. Pass --global.", getAgentDisplayName(agent));
-	for (const { agent, command } of plan.missingCommands) log.warning("Skipping %s: the plugin installs through \"%s\", which was not found on PATH.", getAgentDisplayName(agent), command);
+	for (const row of plan.unusableCommands) log.warning("Skipping %s: the plugin installs through \"%s\", which %s.", getAgentDisplayName(row.agent), row.command.name, pluginsCommandProblemText(row));
 	const rows = [];
 	const failed = [];
 	const scope = scopeLabel(plan.scope);

package/dist/_chunks/{profile-H0d7gFrX.js → profile-BAlM625e.js}

@@ -10,7 +10,7 @@ import { _ as upsertProfile, a as canDropProfilesFile, c as listProfiles, d as n
 import { auth, revokeToken } from "../auth.js";
 import { t as credentialInputs } from "./auth_selection-CwGLN9Qz.js";
 import { readOutgoingCredential, retirePreviousCredential, revokeTokenSet, withdrawKey } from "../retire_credential.js";
-import { n as authFlow, p as usableCredential } from "./auth-DPSDYYtG.js";
+import { m as usableCredential, n as authFlow } from "./auth-rup6nemJ.js";
 import { identityFromAuthDetails, isApiKeyMethod, mintedKeyName, notAnApiKeyMessage } from "../profile_keys.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";

package/dist/_chunks/{status-DS_yUXFo.js → status-BC4XXuuE.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-BJohB4LM.js";
 import { fillSingleProject } from "../utils/enrichers.js";
-import { y as status } from "./config-7SIE_C5O.js";
+import { y as status } from "./config-BjCm5cfr.js";
 // src/commands/status.ts
 var status_exports = /* @__PURE__ */ __exportAll({
 	builder: () => builder,

package/dist/analytics.js

@@ -1,5 +1,5 @@
 import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-DbeSh3Pl.js";
-import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
+import { getCliAgent, getGithubEnvVars, getTty, isCi } from "./env.js";
 import { log } from "./log.js";
 import { getOrCreateAnonymousId } from "./anonymous_id.js";
 import pkg_default from "./pkg.js";
@@ -248,7 +248,8 @@ const settleErrorReports = async (deadline) => {
 const getErrorAnalyticsEventContext = (_args) => ({
 	version: pkg_default.version,
 	ci: isCi(),
-	agent: getCliAgent(process.env)
+	agent: getCliAgent(process.env),
+	tty: getTty()
 });
 const CREDENTIAL_TOKEN_ID = /\bnak_live_[0-9a-f]+\b/gi;
 const redactCredentialTokenIds = (text) => text.replace(CREDENTIAL_TOKEN_ID, "nak_live_<redacted>");
@@ -353,6 +354,7 @@ const getAnalyticsEventProperties = (args) => ({
 	flags: { output: args.output },
 	ci: isCi(),
 	agent: getCliAgent(process.env),
+	tty: getTty(),
 	githubEnvVars: getGithubEnvVars(process.env)
 });
 export { analyticsIdentity, analyticsMiddleware, closeAnalytics, commandSuccessProperties, getAnalyticsEventProperties, getErrorAnalyticsEventProperties, initAnalyticsClientMiddleware, isAnalyticsActive, recordCommandSuccessExtras, recordScaffoldedTemplate, redactCredentialTokenIds, sendError, storedCredentialAttribution, takeCommandSuccessExtras, telemetryCredential, trackCommandSuccess, trackEvent, useAnalyticsClientForTests };

package/dist/api.js

@@ -288,7 +288,7 @@ async function readJsonBody(response) {
 	}
 }
 const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }) => {
-	const baseUrl = apiHost ?? DEFAULT_API_HOST;
+	const baseUrl = apiHost ?? "https://console.neon.tech/api/v2";
 	const fetchWithTimeout = makeTimedFetch(validateRequestTimeout(requestTimeoutMs));
 	const client = createClient(createConfig({
 		auth: () => apiKey,
@@ -1079,4 +1079,4 @@ const getApiClient = ({ apiKey, apiHost, requestTimeoutMs = REQUEST_TIMEOUT_MS }
 		}))
 	};
 };
-export { ContentType, NeonApiError, UnreadableResponseError, codeFromBody, getApiClient, isNeonApiError, messageFromBody, retryOnLock };
+export { ContentType, DEFAULT_API_HOST, NeonApiError, UnreadableResponseError, codeFromBody, getApiClient, isNeonApiError, messageFromBody, retryOnLock };

package/dist/auth_recovery.js

@@ -2,7 +2,7 @@ import { t as storeFor } from "./_chunks/credential_io-DbeSh3Pl.js";
 import { log } from "./log.js";
 import { authFailureMessage, getAuthContext, locationFromContext } from "./auth_context.js";
 import { AuthRefreshError } from "./auth.js";
-import { f as refreshStoredCredentials, u as isAccessTokenUsable } from "./_chunks/auth-DPSDYYtG.js";
+import { d as isAccessTokenUsable, p as refreshStoredCredentials } from "./_chunks/auth-rup6nemJ.js";
 // src/auth_recovery.ts
 const supersededOnDisk = (rejectedToken) => {
 	if (rejectedToken === void 0) return false;

package/dist/commands/auth.js

@@ -1 +1 @@
-export { t as aliases, n as authFlow, i as builder, a as command, o as deleteCredentialsAt, s as describe, c as ensureAuth, l as handler, u as isAccessTokenUsable, d as locationForAuth, f as refreshStoredCredentials, p as usableCredential } from "../_chunks/auth-DPSDYYtG.js";
+export { t as aliases, n as authFlow, i as builder, a as command, o as deleteCredentialsAt, s as describe, c as ensureAuth, l as existingApiClient, u as handler, d as isAccessTokenUsable, f as locationForAuth, p as refreshStoredCredentials, m as usableCredential } from "../_chunks/auth-rup6nemJ.js";

package/dist/commands/checkout.js

@@ -1 +1 @@
-export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-C6VMMgY6.js";
+export { t as builder, r as command, i as describe, a as formatCheckoutPolicyFailure, o as handler } from "../_chunks/checkout-BpOcFaAi.js";

package/dist/commands/config.js

@@ -1 +1 @@
-export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-7SIE_C5O.js";
+export { t as ConfigInstallFailed, n as addCmd, r as applyCmd, i as applyFlags, a as applyPolicyOnCreate, o as builder, s as command, l as createBranchFromPolicyOnCheckout, u as describe, d as ensureConfigPackages, f as envFlag, p as envPullFlag, m as handler, h as initCmd, g as installCommandFrom, _ as missingDependencies, v as planCmd, y as status } from "../_chunks/config-BjCm5cfr.js";

package/dist/commands/deploy.js

@@ -1 +1 @@
-export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-DmKZcAnR.js";
+export { t as builder, n as command, i as describe, a as handler } from "../_chunks/deploy-DmEEhux0.js";

package/dist/commands/dev.js

@@ -1 +1 @@
-export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-Dv0HKcFF.js";
+export { t as builder, n as captureShellEnv, r as command, i as describe, a as devBundleDir, o as devEnvContext, c as diffUnits, l as formatEnvFiles, u as formatEnvSummary, d as handler, f as loadDevEnvFiles, p as localFunctionUrlEnv, m as planFunctionsToUnits, h as reportDevCredential, g as sourceFunctionUrlOverlay } from "../_chunks/dev-DlUJFzRs.js";

package/dist/commands/docs.js

@@ -1 +1 @@
-export { t as DEFAULT_SITE_SEARCH_URL, n as MAX_LIMIT, r as MAX_QUERY_LENGTH, i as SITE_SEARCH_CATEGORIES, a as builder, o as command, s as describe, l as formatSearchResults, u as parseSearchHits, d as resolveSiteSearchUrl, f as siteSearchHeaders } from "../_chunks/docs-CClmgj_Z.js";
+export { t as DEFAULT_SITE_SEARCH_URL, n as MAX_LIMIT, r as MAX_QUERY_LENGTH, i as SITE_SEARCH_CATEGORIES, a as builder, o as command, s as describe, l as formatSearchResults, u as parseSearchHits, d as resolveSiteSearchUrl, f as siteSearchHeaders } from "../_chunks/docs-BpLiSTmm.js";

package/dist/commands/functions_new.js

@@ -8,7 +8,7 @@ import { writer } from "../writer.js";
 import { formatInitDone, printInitDone } from "../init/chrome.js";
 import { FUNCTION_SLUG_PATTERN, deriveFunctionSlug } from "../utils/function_slug.js";
 import { displayPath } from "./env_output.js";
-import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-7SIE_C5O.js";
+import { _ as missingDependencies, d as ensureConfigPackages, g as installCommandFrom } from "../_chunks/config-BjCm5cfr.js";
 import { recommendedOperations } from "../functions/registry.js";
 import { collidingFiles, operationsFromFlags, planConfigRegistration, planEnvExample, planScaffold, writeScaffold } from "../functions/scaffold.js";
 import { describeRegistrySource, openRegistry } from "../functions/source.js";
@@ -169,9 +169,8 @@ const scaffoldFromTemplate = async (options) => {
 	const envFile = displayPath(resolveEnvFilePath(location), cwd);
 	const names = environment.join(", ");
 	if (variables && register) {
-		const them = environment.length === 1 ? "it" : "them";
-		nextSteps.push(`Set ${variables} in ${envFile}. \`${cli} dev\` reads ${them} from your shell, so export ${them} there too.`);
-		next.push(`Set ${names} in ${envFile}, and export ${them} for ${cli} dev`);
+		nextSteps.push(`Set ${variables} in ${envFile} (\`${cli} dev\` loads it automatically).`);
+		next.push(`Set ${names} in ${envFile} (${cli} dev loads it automatically)`);
 	} else if (variables) {
 		nextSteps.push(`Set ${variables} in your shell.`);
 		next.push(`Set ${names} in your shell`);

package/dist/commands/git.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-Dxw9w9dK.js";
+export { t as aliases, n as builder, r as cleanup, i as command, a as describe, s as handler, c as install, l as partitionBranchesToPrune, u as status, d as sync, f as uninstall } from "../_chunks/git-j6xSVo3e.js";

package/dist/commands/index.js

@@ -1,31 +1,31 @@
-import { r as auth_exports } from "../_chunks/auth-DPSDYYtG.js";
+import { r as auth_exports } from "../_chunks/auth-rup6nemJ.js";
 import { t as api_exports } from "../_chunks/api-1MKsfpY3.js";
 import { n as api_keys_exports } from "../_chunks/api_keys-6Xnxl7a8.js";
 import { n as ask_exports } from "../_chunks/ask-Xlek1Pxh.js";
 import { o as env_exports } from "../_chunks/env-BOt9AZ1j.js";
-import { c as config_exports } from "../_chunks/config-7SIE_C5O.js";
+import { c as config_exports } from "../_chunks/config-BjCm5cfr.js";
 import { u as projects_exports } from "../_chunks/projects-a3X4OFEJ.js";
-import { a as link_exports } from "../_chunks/link-CcwTXRny.js";
+import { a as link_exports } from "../_chunks/link-nAiuWKfg.js";
 import { o as mcp_exports } from "../_chunks/mcp-BznTRK3w.js";
-import { c as plugins_exports } from "../_chunks/plugins-CKOcBuuP.js";
+import { c as plugins_exports } from "../_chunks/plugins-B2Gym8Lw.js";
 import { l as skills_exports } from "../_chunks/skills-DKgafm65.js";
 import { t as bootstrap_exports } from "../_chunks/bootstrap-BDkvsAVJ.js";
 import { r as branches_exports } from "../_chunks/branches-Bp-5z1lM.js";
 import { n as bucket_exports } from "../_chunks/bucket-D06bvDSa.js";
-import { n as checkout_exports } from "../_chunks/checkout-C6VMMgY6.js";
+import { n as checkout_exports } from "../_chunks/checkout-BpOcFaAi.js";
 import { o as claim_exports } from "../_chunks/claim-DlLZmcq0.js";
 import { a as connection_string_exports } from "../_chunks/connection_string-C9e7N4xk.js";
 import { a as credentials_exports } from "../_chunks/credentials-BMBNmW0t.js";
 import { r as data_api_exports } from "../_chunks/data_api-CHDwvMTG.js";
 import { o as databases_exports } from "../_chunks/databases-DC2h6IW2.js";
-import { r as deploy_exports } from "../_chunks/deploy-DmKZcAnR.js";
-import { s as dev_exports } from "../_chunks/dev-Dv0HKcFF.js";
+import { r as deploy_exports } from "../_chunks/deploy-DmEEhux0.js";
+import { s as dev_exports } from "../_chunks/dev-DlUJFzRs.js";
 import { i as diff_exports } from "../_chunks/diff-dnxneH0u.js";
-import { c as docs_exports } from "../_chunks/docs-CClmgj_Z.js";
+import { c as docs_exports } from "../_chunks/docs-BpLiSTmm.js";
 import { o as feedback_exports } from "../_chunks/feedback-mQmdTRFn.js";
 import { o as functions_exports } from "../_chunks/functions-3ypiRwZK.js";
-import { o as git_exports } from "../_chunks/git-Dxw9w9dK.js";
-import { a as init_exports } from "../_chunks/init-BOOGv-mD.js";
+import { o as git_exports } from "../_chunks/git-j6xSVo3e.js";
+import { a as init_exports } from "../_chunks/init-CcVJb492.js";
 import { o as inspect_exports } from "../_chunks/inspect-yFAb61qo.js";
 import { a as ip_allow_exports } from "../_chunks/ip_allow-DBdxNEUa.js";
 import { l as logs_exports } from "../_chunks/logs-BB4uvblR.js";
@@ -33,13 +33,13 @@ import { a as neon_auth_exports } from "../_chunks/neon_auth-Dw-ucM5Y.js";
 import { a as open_exports } from "../_chunks/open-T2nI89Oh.js";
 import { s as operations_exports } from "../_chunks/operations-CzaR_uqx.js";
 import { o as orgs_exports } from "../_chunks/orgs-Dpbr-K0A.js";
-import { o as profile_exports } from "../_chunks/profile-H0d7gFrX.js";
+import { o as profile_exports } from "../_chunks/profile-BAlM625e.js";
 import { a as psql_exports } from "../_chunks/psql-Bce4X0NG.js";
 import { s as realtime_exports } from "../_chunks/realtime-BwtzYf5a.js";
 import { l as roles_exports } from "../_chunks/roles-xRuu0462.js";
 import { a as set_context_exports } from "../_chunks/set_context-ompB6d2D.js";
 import { s as snapshots_exports } from "../_chunks/snapshots-DxNhjcco.js";
-import { a as status_exports } from "../_chunks/status-DS_yUXFo.js";
+import { a as status_exports } from "../_chunks/status-BC4XXuuE.js";
 import { d as triggers_exports } from "../_chunks/triggers-BfvyeJUC.js";
 import { s as user_exports } from "../_chunks/user-D9mC430O.js";
 import { i as vpc_endpoints_exports } from "../_chunks/vpc_endpoints-C-Y4WK2M.js";

package/dist/commands/init.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/init-BOOGv-mD.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/init-CcVJb492.js";

package/dist/commands/link.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-CcwTXRny.js";
+export { t as builder, n as command, r as describe, i as handler, o as quoteFlagValue, s as runLink, c as shouldOfferConfigInit } from "../_chunks/link-nAiuWKfg.js";

package/dist/commands/plugins.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as command, i as describe, a as handler, o as installPlugins, s as pluginsInstallError, l as reportPluginsInstall } from "../_chunks/plugins-CKOcBuuP.js";
+export { t as aliases, n as builder, r as command, i as describe, a as handler, o as installPlugins, s as pluginsInstallError, l as reportPluginsInstall } from "../_chunks/plugins-B2Gym8Lw.js";

package/dist/commands/profile.js

@@ -1 +1 @@
-export { t as aliases, n as builder, r as command, i as describe, a as handler } from "../_chunks/profile-H0d7gFrX.js";
+export { t as aliases, n as builder, r as command, i as describe, a as handler } from "../_chunks/profile-BAlM625e.js";

package/dist/commands/status.js

@@ -1 +1 @@
-export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-DS_yUXFo.js";
+export { t as builder, n as command, r as describe, i as handler } from "../_chunks/status-BC4XXuuE.js";

package/dist/config_format.js

@@ -28,7 +28,7 @@ const formatDurationSeconds = (totalSeconds) => {
 const toNeonConfigView = (resolved, preview) => {
 	const view = {};
 	if (resolved.authEnabled) view.auth = true;
-	if (resolved.dataApiEnabled) view.dataApi = true;
+	if (resolved.dataApiEnabled) view.dataApi = toDataApiView(resolved.dataApi);
 	const previewView = toPreviewView(preview);
 	if (previewView) view.preview = previewView;
 	const branch = {};
@@ -39,6 +39,14 @@ const toNeonConfigView = (resolved, preview) => {
 	if (Object.keys(branch).length > 0) view.branch = branch;
 	return view;
 };
+const toDataApiView = (dataApi) => {
+	if (dataApi?.authProvider !== "external") return true;
+	const view = { authProvider: "external" };
+	if (dataApi.jwksUrl !== void 0) view.jwksUrl = dataApi.jwksUrl;
+	if (dataApi.providerName !== void 0) view.providerName = dataApi.providerName;
+	if (dataApi.jwtAudience !== void 0) view.jwtAudience = dataApi.jwtAudience;
+	return view;
+};
 const toPreviewView = (preview) => {
 	if (!preview) return void 0;
 	const out = {};

package/dist/config_template.js

@@ -18,8 +18,9 @@ const REQUIRED_PACKAGES = [CONFIG_PACKAGE, ENV_PACKAGE];
 * from these names to the `neon.ts` fields (`aiGateway`, `functions`, `buckets`, `dataApi`).
 *
 * Postgres is absent because every branch has it, so there is nothing to declare. Selecting
-* `data-api` also writes `auth: true`: the default Data API provider requires Neon Auth, and
-* `defineConfig` type-errors the file without it.
+* `data-api` also writes `auth: true` unless the caller says the Data API verifies an external
+* provider (see {@link DataApiTemplateChoice}): the default Data API provider requires Neon
+* Auth, and `defineConfig` type-errors the file without it.
 */
 const CONFIG_INIT_SERVICES = NEON_SERVICES.filter((service) => service !== "postgres");
 /**
@@ -64,18 +65,44 @@ const renderGaServices = (services) => {
 	if (lines.length === 0) return "";
 	return `${lines.join("\n")}\n`;
 };
+/** The template choice for a view's `dataApi` entry (`config status` / `--from-branch`). */
+const dataApiChoiceFromView = (dataApi) => {
+	if (dataApi === true) return { kind: "neon" };
+	const { authProvider: _provider, ...wiring } = dataApi;
+	return {
+		kind: "external",
+		...wiring
+	};
+};
+/**
+* The `dataApi` entry, ending in a newline. The external form carries whatever wiring is
+* known; without a JWKS URL it still type-checks (the URL is optional) and still declares the
+* Data API, so a comment says where the URL lives rather than inventing one.
+*/
+const renderDataApiEntry = (choice) => {
+	if (choice.kind === "neon") return `${at(1, "dataApi: true,").join("\n")}\n`;
+	const fields = at(2, `authProvider: "external",`);
+	if (choice.jwksUrl === void 0) fields.push(...at(2, "// The JWKS URL is registered on the project; add `jwksUrl` to declare it here too."));
+	else fields.push(...at(2, `jwksUrl: ${renderScalar(choice.jwksUrl)},`));
+	if (choice.providerName !== void 0) fields.push(...at(2, `providerName: ${renderScalar(choice.providerName)},`));
+	if (choice.jwtAudience !== void 0) fields.push(...at(2, `jwtAudience: ${renderScalar(choice.jwtAudience)},`));
+	return `${block(1, "dataApi", fields).join("\n")}\n`;
+};
 /**
 * Render the `neon.ts` policy `config init` writes. With no services this is the starter
 * policy — an explicit `auth: false`, no service keys beyond that, and a `branch` closure that gives
 * new non-default branches a 7-day TTL — so the picker's "skip everything" answer and a
 * non-interactive run produce the identical file.
 *
-* `data-api` writes `dataApi: true` and forces `auth: true`. The default provider is Neon
-* Auth; omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
+* `data-api` writes `dataApi: true` and forces `auth: true` unless `options.dataApi` says the
+* branch's Data API verifies an external provider. The default provider is Neon Auth;
+* omitting auth is a `defineConfig` type error rather than a deploy-time surprise.
 */
-const renderNeonConfig = (services) => {
-	const auth = services.includes("auth") || services.includes("data-api");
-	const dataApi = services.includes("data-api") ? "  dataApi: true,\n" : "";
+const renderNeonConfig = (services, options = {}) => {
+	const dataApiChoice = options.dataApi ?? { kind: "neon" };
+	const declaresDataApi = services.includes("data-api");
+	const auth = services.includes("auth") || declaresDataApi && dataApiChoice.kind !== "external";
+	const dataApi = declaresDataApi ? renderDataApiEntry(dataApiChoice) : "";
 	const realtimeDeclaration = services.includes("realtime") ? "  preview: {\n    realtime: true,\n  },\n" : "";
 	return `import { defineConfig } from "${CONFIG_PACKAGE}/v1";
 
@@ -154,7 +181,7 @@ const renderSeededGaServices = (view, branchName) => {
 * than an empty `defineConfig({})`: seeding found nothing, and the caller says so.
 */
 const renderNeonConfigFromView = (view, branchName) => {
-	const services = [view.auth ? "  auth: true," : "", view.dataApi ? "  dataApi: true," : ""].filter((line) => line !== "");
+	const services = [view.auth ? "  auth: true," : "", view.dataApi ? renderDataApiEntry(dataApiChoiceFromView(view.dataApi)).trimEnd() : ""].filter((line) => line !== "");
 	const gaServices = renderSeededGaServices(view, branchName);
 	const branch = renderSeededBranch(view);
 	if (services.length === 0 && gaServices === "" && branch === "") return {
@@ -202,4 +229,4 @@ const renderFunctionSource = (slug, language) => {
 `;
 };
 const FUNCTION_TEMPLATE = renderFunctionSource(FUNCTION_SLUG, "ts");
-export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };
+export { BUCKET_NAME, CONFIG_INIT_SERVICES, CONFIG_PACKAGE, ENV_PACKAGE, FUNCTION_FILENAME, FUNCTION_NAME, FUNCTION_SLUG, FUNCTION_TEMPLATE, REQUIRED_PACKAGES, dataApiChoiceFromView, parseConfigInitServices, renderFunctionSource, renderKey, renderNeonConfig, renderNeonConfigFromView };